Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

+3 -1

Documentation/devicetree/bindings/net/can/rcar_canfd.txt

··· 5 5 - compatible: Must contain one or more of the following: 6 6 - "renesas,rcar-gen3-canfd" for R-Car Gen3 compatible controller. 7 7 - "renesas,r8a7795-canfd" for R8A7795 (R-Car H3) compatible controller. 8 - - "renesas,r8a7796-canfd" for R8A7796 (R-Car M3) compatible controller. 8 + - "renesas,r8a7796-canfd" for R8A7796 (R-Car M3-W) compatible controller. 9 + - "renesas,r8a77970-canfd" for R8A77970 (R-Car V3M) compatible controller. 10 + - "renesas,r8a77980-canfd" for R8A77980 (R-Car V3H) compatible controller. 9 11 10 12 When compatible with the generic version, nodes must list the 11 13 SoC-specific version corresponding to the platform first, followed by the

+2 -2

MAINTAINERS

··· 137 137 ----------------------------------- 138 138 139 139 3C59X NETWORK DRIVER 140 - M: Steffen Klassert <klassert@mathematik.tu-chemnitz.de> 140 + M: Steffen Klassert <klassert@kernel.org> 141 141 L: netdev@vger.kernel.org 142 - S: Maintained 142 + S: Odd Fixes 143 143 F: Documentation/networking/vortex.txt 144 144 F: drivers/net/ethernet/3com/3c59x.c 145 145

+2 -2

arch/arm/boot/dts/imx35.dtsi

··· 303 303 }; 304 304 305 305 can1: can@53fe4000 { 306 - compatible = "fsl,imx35-flexcan"; 306 + compatible = "fsl,imx35-flexcan", "fsl,imx25-flexcan"; 307 307 reg = <0x53fe4000 0x1000>; 308 308 clocks = <&clks 33>, <&clks 33>; 309 309 clock-names = "ipg", "per"; ··· 312 312 }; 313 313 314 314 can2: can@53fe8000 { 315 - compatible = "fsl,imx35-flexcan"; 315 + compatible = "fsl,imx35-flexcan", "fsl,imx25-flexcan"; 316 316 reg = <0x53fe8000 0x1000>; 317 317 clocks = <&clks 34>, <&clks 34>; 318 318 clock-names = "ipg", "per";

+2 -2

arch/arm/boot/dts/imx53.dtsi

··· 551 551 }; 552 552 553 553 can1: can@53fc8000 { 554 - compatible = "fsl,imx53-flexcan"; 554 + compatible = "fsl,imx53-flexcan", "fsl,imx25-flexcan"; 555 555 reg = <0x53fc8000 0x4000>; 556 556 interrupts = <82>; 557 557 clocks = <&clks IMX5_CLK_CAN1_IPG_GATE>, ··· 561 561 }; 562 562 563 563 can2: can@53fcc000 { 564 - compatible = "fsl,imx53-flexcan"; 564 + compatible = "fsl,imx53-flexcan", "fsl,imx25-flexcan"; 565 565 reg = <0x53fcc000 0x4000>; 566 566 interrupts = <83>; 567 567 clocks = <&clks IMX5_CLK_CAN2_IPG_GATE>,

+1 -1

drivers/atm/firestream.c

··· 191 191 "reserved 37", 192 192 "reserved 38", 193 193 "reserved 39", 194 - "reseverd 40", 194 + "reserved 40", 195 195 "reserved 41", 196 196 "reserved 42", 197 197 "reserved 43",

+3

drivers/atm/zatm.c

··· 28 28 #include <asm/io.h> 29 29 #include <linux/atomic.h> 30 30 #include <linux/uaccess.h> 31 + #include <linux/nospec.h> 31 32 32 33 #include "uPD98401.h" 33 34 #include "uPD98402.h" ··· 1459 1458 return -EFAULT; 1460 1459 if (pool < 0 || pool > ZATM_LAST_POOL) 1461 1460 return -EINVAL; 1461 + pool = array_index_nospec(pool, 1462 + ZATM_LAST_POOL + 1); 1462 1463 spin_lock_irqsave(&zatm_dev->lock, flags); 1463 1464 info = zatm_dev->pool_info[pool]; 1464 1465 if (cmd == ZATM_GETPOOLZ) {

+15 -4

drivers/bluetooth/btusb.c

··· 231 231 { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 }, 232 232 { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, 233 233 { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 }, 234 + { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, 234 235 { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, 235 236 { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 }, 236 237 { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 }, ··· 264 263 { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 }, 265 264 266 265 /* QCA ROME chipset */ 267 - { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_QCA_ROME }, 268 266 { USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME }, 269 267 { USB_DEVICE(0x0cf3, 0xe009), .driver_info = BTUSB_QCA_ROME }, 270 268 { USB_DEVICE(0x0cf3, 0xe010), .driver_info = BTUSB_QCA_ROME }, ··· 397 397 .matches = { 398 398 DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), 399 399 DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 3060"), 400 + }, 401 + }, 402 + { 403 + /* Dell XPS 9360 (QCA ROME device 0cf3:e300) */ 404 + .matches = { 405 + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), 406 + DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9360"), 400 407 }, 401 408 }, 402 409 {} ··· 2859 2852 } 2860 2853 #endif 2861 2854 2855 + static void btusb_check_needs_reset_resume(struct usb_interface *intf) 2856 + { 2857 + if (dmi_check_system(btusb_needs_reset_resume_table)) 2858 + interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME; 2859 + } 2860 + 2862 2861 static int btusb_probe(struct usb_interface *intf, 2863 2862 const struct usb_device_id *id) 2864 2863 { ··· 2987 2974 hdev->send = btusb_send_frame; 2988 2975 hdev->notify = btusb_notify; 2989 2976 2990 - if (dmi_check_system(btusb_needs_reset_resume_table)) 2991 - interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME; 2992 - 2993 2977 #ifdef CONFIG_PM 2994 2978 err = btusb_config_oob_wake(hdev); 2995 2979 if (err) ··· 3074 3064 data->setup_on_usb = btusb_setup_qca; 3075 3065 hdev->set_bdaddr = btusb_set_bdaddr_ath3012; 3076 3066 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 3067 + btusb_check_needs_reset_resume(intf); 3077 3068 } 3078 3069 3079 3070 #ifdef CONFIG_BT_HCIBTUSB_RTL

+9 -6

drivers/net/bonding/bond_alb.c

··· 450 450 { 451 451 int i; 452 452 453 - if (!client_info->slave) 453 + if (!client_info->slave || !is_valid_ether_addr(client_info->mac_dst)) 454 454 return; 455 455 456 456 for (i = 0; i < RLB_ARP_BURST_SIZE; i++) { ··· 943 943 skb->priority = TC_PRIO_CONTROL; 944 944 skb->dev = slave->dev; 945 945 946 + netdev_dbg(slave->bond->dev, 947 + "Send learning packet: dev %s mac %pM vlan %d\n", 948 + slave->dev->name, mac_addr, vid); 949 + 946 950 if (vid) 947 951 __vlan_hwaccel_put_tag(skb, vlan_proto, vid); 948 952 ··· 969 965 u8 *mac_addr = data->mac_addr; 970 966 struct bond_vlan_tag *tags; 971 967 972 - if (is_vlan_dev(upper) && vlan_get_encap_level(upper) == 0) { 973 - if (strict_match && 974 - ether_addr_equal_64bits(mac_addr, 975 - upper->dev_addr)) { 968 + if (is_vlan_dev(upper) && 969 + bond->nest_level == vlan_get_encap_level(upper) - 1) { 970 + if (upper->addr_assign_type == NET_ADDR_STOLEN) { 976 971 alb_send_lp_vid(slave, mac_addr, 977 972 vlan_dev_vlan_proto(upper), 978 973 vlan_dev_vlan_id(upper)); 979 - } else if (!strict_match) { 974 + } else { 980 975 alb_send_lp_vid(slave, upper->dev_addr, 981 976 vlan_dev_vlan_proto(upper), 982 977 vlan_dev_vlan_id(upper));

+2

drivers/net/bonding/bond_main.c

··· 1738 1738 if (bond_mode_uses_xmit_hash(bond)) 1739 1739 bond_update_slave_arr(bond, NULL); 1740 1740 1741 + bond->nest_level = dev_get_nest_level(bond_dev); 1742 + 1741 1743 netdev_info(bond_dev, "Enslaving %s as %s interface with %s link\n", 1742 1744 slave_dev->name, 1743 1745 bond_is_active_slave(new_slave) ? "an active" : "a backup",

+1 -1

drivers/net/can/dev.c

··· 605 605 { 606 606 struct can_priv *priv = netdev_priv(dev); 607 607 608 - netdev_dbg(dev, "bus-off\n"); 608 + netdev_info(dev, "bus-off\n"); 609 609 610 610 netif_carrier_off(dev); 611 611

+14 -12

drivers/net/can/flexcan.c

··· 200 200 #define FLEXCAN_QUIRK_DISABLE_MECR BIT(4) /* Disable Memory error detection */ 201 201 #define FLEXCAN_QUIRK_USE_OFF_TIMESTAMP BIT(5) /* Use timestamp based offloading */ 202 202 #define FLEXCAN_QUIRK_BROKEN_PERR_STATE BIT(6) /* No interrupt for error passive */ 203 + #define FLEXCAN_QUIRK_DEFAULT_BIG_ENDIAN BIT(7) /* default to BE register access */ 203 204 204 205 /* Structure of the message buffer */ 205 206 struct flexcan_mb { ··· 288 287 }; 289 288 290 289 static const struct flexcan_devtype_data fsl_p1010_devtype_data = { 290 + .quirks = FLEXCAN_QUIRK_BROKEN_WERR_STATE | 291 + FLEXCAN_QUIRK_BROKEN_PERR_STATE | 292 + FLEXCAN_QUIRK_DEFAULT_BIG_ENDIAN, 293 + }; 294 + 295 + static const struct flexcan_devtype_data fsl_imx25_devtype_data = { 291 296 .quirks = FLEXCAN_QUIRK_BROKEN_WERR_STATE | 292 297 FLEXCAN_QUIRK_BROKEN_PERR_STATE, 293 298 }; ··· 1258 1251 static const struct of_device_id flexcan_of_match[] = { 1259 1252 { .compatible = "fsl,imx6q-flexcan", .data = &fsl_imx6q_devtype_data, }, 1260 1253 { .compatible = "fsl,imx28-flexcan", .data = &fsl_imx28_devtype_data, }, 1261 - { .compatible = "fsl,imx53-flexcan", .data = &fsl_p1010_devtype_data, }, 1262 - { .compatible = "fsl,imx35-flexcan", .data = &fsl_p1010_devtype_data, }, 1263 - { .compatible = "fsl,imx25-flexcan", .data = &fsl_p1010_devtype_data, }, 1254 + { .compatible = "fsl,imx53-flexcan", .data = &fsl_imx25_devtype_data, }, 1255 + { .compatible = "fsl,imx35-flexcan", .data = &fsl_imx25_devtype_data, }, 1256 + { .compatible = "fsl,imx25-flexcan", .data = &fsl_imx25_devtype_data, }, 1264 1257 { .compatible = "fsl,p1010-flexcan", .data = &fsl_p1010_devtype_data, }, 1265 1258 { .compatible = "fsl,vf610-flexcan", .data = &fsl_vf610_devtype_data, }, 1266 1259 { .compatible = "fsl,ls1021ar2-flexcan", .data = &fsl_ls1021a_r2_devtype_data, }, ··· 1344 1337 1345 1338 priv = netdev_priv(dev); 1346 1339 1347 - if (of_property_read_bool(pdev->dev.of_node, "big-endian")) { 1340 + if (of_property_read_bool(pdev->dev.of_node, "big-endian") || 1341 + devtype_data->quirks & FLEXCAN_QUIRK_DEFAULT_BIG_ENDIAN) { 1348 1342 priv->read = flexcan_read_be; 1349 1343 priv->write = flexcan_write_be; 1350 1344 } else { 1351 - if (of_device_is_compatible(pdev->dev.of_node, 1352 - "fsl,p1010-flexcan")) { 1353 - priv->read = flexcan_read_be; 1354 - priv->write = flexcan_write_be; 1355 - } else { 1356 - priv->read = flexcan_read_le; 1357 - priv->write = flexcan_write_le; 1358 - } 1345 + priv->read = flexcan_read_le; 1346 + priv->write = flexcan_write_le; 1359 1347 } 1360 1348 1361 1349 priv->can.clock.freq = clock_freq;

+7 -4

drivers/net/can/spi/hi311x.c

··· 91 91 #define HI3110_STAT_BUSOFF BIT(2) 92 92 #define HI3110_STAT_ERRP BIT(3) 93 93 #define HI3110_STAT_ERRW BIT(4) 94 + #define HI3110_STAT_TXMTY BIT(7) 94 95 95 96 #define HI3110_BTR0_SJW_SHIFT 6 96 97 #define HI3110_BTR0_BRP_SHIFT 0 ··· 428 427 struct hi3110_priv *priv = netdev_priv(net); 429 428 struct spi_device *spi = priv->spi; 430 429 430 + mutex_lock(&priv->hi3110_lock); 431 431 bec->txerr = hi3110_read(spi, HI3110_READ_TEC); 432 432 bec->rxerr = hi3110_read(spi, HI3110_READ_REC); 433 + mutex_unlock(&priv->hi3110_lock); 433 434 434 435 return 0; 435 436 } ··· 738 735 } 739 736 } 740 737 741 - if (intf == 0) 742 - break; 743 - 744 - if (intf & HI3110_INT_TXCPLT) { 738 + if (priv->tx_len && statf & HI3110_STAT_TXMTY) { 745 739 net->stats.tx_packets++; 746 740 net->stats.tx_bytes += priv->tx_len - 1; 747 741 can_led_event(net, CAN_LED_EVENT_TX); ··· 748 748 } 749 749 netif_wake_queue(net); 750 750 } 751 + 752 + if (intf == 0) 753 + break; 751 754 } 752 755 mutex_unlock(&priv->hi3110_lock); 753 756 return IRQ_HANDLED;

+1 -1

drivers/net/can/usb/kvaser_usb.c

··· 1179 1179 1180 1180 skb = alloc_can_skb(priv->netdev, &cf); 1181 1181 if (!skb) { 1182 - stats->tx_dropped++; 1182 + stats->rx_dropped++; 1183 1183 return; 1184 1184 } 1185 1185

+26

drivers/net/dsa/mv88e6xxx/chip.c

··· 3370 3370 .num_internal_phys = 5, 3371 3371 .max_vid = 4095, 3372 3372 .port_base_addr = 0x10, 3373 + .phy_base_addr = 0x0, 3373 3374 .global1_addr = 0x1b, 3374 3375 .global2_addr = 0x1c, 3375 3376 .age_time_coeff = 15000, ··· 3392 3391 .num_internal_phys = 0, 3393 3392 .max_vid = 4095, 3394 3393 .port_base_addr = 0x10, 3394 + .phy_base_addr = 0x0, 3395 3395 .global1_addr = 0x1b, 3396 3396 .global2_addr = 0x1c, 3397 3397 .age_time_coeff = 15000, ··· 3412 3410 .num_internal_phys = 8, 3413 3411 .max_vid = 4095, 3414 3412 .port_base_addr = 0x10, 3413 + .phy_base_addr = 0x0, 3415 3414 .global1_addr = 0x1b, 3416 3415 .global2_addr = 0x1c, 3417 3416 .age_time_coeff = 15000, ··· 3434 3431 .num_internal_phys = 5, 3435 3432 .max_vid = 4095, 3436 3433 .port_base_addr = 0x10, 3434 + .phy_base_addr = 0x0, 3437 3435 .global1_addr = 0x1b, 3438 3436 .global2_addr = 0x1c, 3439 3437 .age_time_coeff = 15000, ··· 3456 3452 .num_internal_phys = 0, 3457 3453 .max_vid = 4095, 3458 3454 .port_base_addr = 0x10, 3455 + .phy_base_addr = 0x0, 3459 3456 .global1_addr = 0x1b, 3460 3457 .global2_addr = 0x1c, 3461 3458 .age_time_coeff = 15000, ··· 3477 3472 .num_gpio = 11, 3478 3473 .max_vid = 4095, 3479 3474 .port_base_addr = 0x10, 3475 + .phy_base_addr = 0x10, 3480 3476 .global1_addr = 0x1b, 3481 3477 .global2_addr = 0x1c, 3482 3478 .age_time_coeff = 3750, ··· 3499 3493 .num_internal_phys = 5, 3500 3494 .max_vid = 4095, 3501 3495 .port_base_addr = 0x10, 3496 + .phy_base_addr = 0x0, 3502 3497 .global1_addr = 0x1b, 3503 3498 .global2_addr = 0x1c, 3504 3499 .age_time_coeff = 15000, ··· 3521 3514 .num_internal_phys = 0, 3522 3515 .max_vid = 4095, 3523 3516 .port_base_addr = 0x10, 3517 + .phy_base_addr = 0x0, 3524 3518 .global1_addr = 0x1b, 3525 3519 .global2_addr = 0x1c, 3526 3520 .age_time_coeff = 15000, ··· 3543 3535 .num_internal_phys = 5, 3544 3536 .max_vid = 4095, 3545 3537 .port_base_addr = 0x10, 3538 + .phy_base_addr = 0x0, 3546 3539 .global1_addr = 0x1b, 3547 3540 .global2_addr = 0x1c, 3548 3541 .age_time_coeff = 15000, ··· 3566 3557 .num_gpio = 15, 3567 3558 .max_vid = 4095, 3568 3559 .port_base_addr = 0x10, 3560 + .phy_base_addr = 0x0, 3569 3561 .global1_addr = 0x1b, 3570 3562 .global2_addr = 0x1c, 3571 3563 .age_time_coeff = 15000, ··· 3588 3578 .num_internal_phys = 5, 3589 3579 .max_vid = 4095, 3590 3580 .port_base_addr = 0x10, 3581 + .phy_base_addr = 0x0, 3591 3582 .global1_addr = 0x1b, 3592 3583 .global2_addr = 0x1c, 3593 3584 .age_time_coeff = 15000, ··· 3611 3600 .num_gpio = 15, 3612 3601 .max_vid = 4095, 3613 3602 .port_base_addr = 0x10, 3603 + .phy_base_addr = 0x0, 3614 3604 .global1_addr = 0x1b, 3615 3605 .global2_addr = 0x1c, 3616 3606 .age_time_coeff = 15000, ··· 3633 3621 .num_internal_phys = 0, 3634 3622 .max_vid = 4095, 3635 3623 .port_base_addr = 0x10, 3624 + .phy_base_addr = 0x0, 3636 3625 .global1_addr = 0x1b, 3637 3626 .global2_addr = 0x1c, 3638 3627 .age_time_coeff = 15000, ··· 3654 3641 .num_gpio = 16, 3655 3642 .max_vid = 8191, 3656 3643 .port_base_addr = 0x0, 3644 + .phy_base_addr = 0x0, 3657 3645 .global1_addr = 0x1b, 3658 3646 .global2_addr = 0x1c, 3659 3647 .tag_protocol = DSA_TAG_PROTO_DSA, ··· 3677 3663 .num_gpio = 16, 3678 3664 .max_vid = 8191, 3679 3665 .port_base_addr = 0x0, 3666 + .phy_base_addr = 0x0, 3680 3667 .global1_addr = 0x1b, 3681 3668 .global2_addr = 0x1c, 3682 3669 .age_time_coeff = 3750, ··· 3699 3684 .num_internal_phys = 11, 3700 3685 .max_vid = 8191, 3701 3686 .port_base_addr = 0x0, 3687 + .phy_base_addr = 0x0, 3702 3688 .global1_addr = 0x1b, 3703 3689 .global2_addr = 0x1c, 3704 3690 .age_time_coeff = 3750, ··· 3723 3707 .num_gpio = 15, 3724 3708 .max_vid = 4095, 3725 3709 .port_base_addr = 0x10, 3710 + .phy_base_addr = 0x0, 3726 3711 .global1_addr = 0x1b, 3727 3712 .global2_addr = 0x1c, 3728 3713 .age_time_coeff = 15000, ··· 3747 3730 .num_gpio = 16, 3748 3731 .max_vid = 8191, 3749 3732 .port_base_addr = 0x0, 3733 + .phy_base_addr = 0x0, 3750 3734 .global1_addr = 0x1b, 3751 3735 .global2_addr = 0x1c, 3752 3736 .age_time_coeff = 3750, ··· 3771 3753 .num_gpio = 15, 3772 3754 .max_vid = 4095, 3773 3755 .port_base_addr = 0x10, 3756 + .phy_base_addr = 0x0, 3774 3757 .global1_addr = 0x1b, 3775 3758 .global2_addr = 0x1c, 3776 3759 .age_time_coeff = 15000, ··· 3795 3776 .num_gpio = 15, 3796 3777 .max_vid = 4095, 3797 3778 .port_base_addr = 0x10, 3779 + .phy_base_addr = 0x0, 3798 3780 .global1_addr = 0x1b, 3799 3781 .global2_addr = 0x1c, 3800 3782 .age_time_coeff = 15000, ··· 3818 3798 .num_gpio = 11, 3819 3799 .max_vid = 4095, 3820 3800 .port_base_addr = 0x10, 3801 + .phy_base_addr = 0x10, 3821 3802 .global1_addr = 0x1b, 3822 3803 .global2_addr = 0x1c, 3823 3804 .age_time_coeff = 3750, ··· 3841 3820 .num_internal_phys = 5, 3842 3821 .max_vid = 4095, 3843 3822 .port_base_addr = 0x10, 3823 + .phy_base_addr = 0x0, 3844 3824 .global1_addr = 0x1b, 3845 3825 .global2_addr = 0x1c, 3846 3826 .age_time_coeff = 15000, ··· 3863 3841 .num_internal_phys = 5, 3864 3842 .max_vid = 4095, 3865 3843 .port_base_addr = 0x10, 3844 + .phy_base_addr = 0x0, 3866 3845 .global1_addr = 0x1b, 3867 3846 .global2_addr = 0x1c, 3868 3847 .age_time_coeff = 15000, ··· 3886 3863 .num_gpio = 15, 3887 3864 .max_vid = 4095, 3888 3865 .port_base_addr = 0x10, 3866 + .phy_base_addr = 0x0, 3889 3867 .global1_addr = 0x1b, 3890 3868 .global2_addr = 0x1c, 3891 3869 .age_time_coeff = 15000, ··· 3909 3885 .num_gpio = 16, 3910 3886 .max_vid = 8191, 3911 3887 .port_base_addr = 0x0, 3888 + .phy_base_addr = 0x0, 3912 3889 .global1_addr = 0x1b, 3913 3890 .global2_addr = 0x1c, 3914 3891 .age_time_coeff = 3750, ··· 3932 3907 .num_gpio = 16, 3933 3908 .max_vid = 8191, 3934 3909 .port_base_addr = 0x0, 3910 + .phy_base_addr = 0x0, 3935 3911 .global1_addr = 0x1b, 3936 3912 .global2_addr = 0x1c, 3937 3913 .age_time_coeff = 3750,

+1

drivers/net/dsa/mv88e6xxx/chip.h

··· 114 114 unsigned int num_gpio; 115 115 unsigned int max_vid; 116 116 unsigned int port_base_addr; 117 + unsigned int phy_base_addr; 117 118 unsigned int global1_addr; 118 119 unsigned int global2_addr; 119 120 unsigned int age_time_coeff;

+1 -1

drivers/net/dsa/mv88e6xxx/global2.c

··· 1118 1118 err = irq; 1119 1119 goto out; 1120 1120 } 1121 - bus->irq[chip->info->port_base_addr + phy] = irq; 1121 + bus->irq[chip->info->phy_base_addr + phy] = irq; 1122 1122 } 1123 1123 return 0; 1124 1124 out:

+3

drivers/net/ethernet/aquantia/atlantic/aq_nic.c

··· 95 95 /*rss rings */ 96 96 cfg->vecs = min(cfg->aq_hw_caps->vecs, AQ_CFG_VECS_DEF); 97 97 cfg->vecs = min(cfg->vecs, num_online_cpus()); 98 + cfg->vecs = min(cfg->vecs, self->irqvecs); 98 99 /* cfg->vecs should be power of 2 for RSS */ 99 100 if (cfg->vecs >= 8U) 100 101 cfg->vecs = 8U; ··· 247 246 248 247 self->ndev->hw_features |= aq_hw_caps->hw_features; 249 248 self->ndev->features = aq_hw_caps->hw_features; 249 + self->ndev->vlan_features |= NETIF_F_HW_CSUM | NETIF_F_RXCSUM | 250 + NETIF_F_RXHASH | NETIF_F_SG | NETIF_F_LRO; 250 251 self->ndev->priv_flags = aq_hw_caps->hw_priv_flags; 251 252 self->ndev->priv_flags |= IFF_LIVE_ADDR_CHANGE; 252 253

+1

drivers/net/ethernet/aquantia/atlantic/aq_nic.h

··· 80 80 81 81 struct pci_dev *pdev; 82 82 unsigned int msix_entry_mask; 83 + u32 irqvecs; 83 84 }; 84 85 85 86 static inline struct device *aq_nic_get_dev(struct aq_nic_s *self)

+9 -9

drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c

··· 267 267 numvecs = min(numvecs, num_online_cpus()); 268 268 /*enable interrupts */ 269 269 #if !AQ_CFG_FORCE_LEGACY_INT 270 - err = pci_alloc_irq_vectors(self->pdev, numvecs, numvecs, 271 - PCI_IRQ_MSIX); 270 + numvecs = pci_alloc_irq_vectors(self->pdev, 1, numvecs, 271 + PCI_IRQ_MSIX | PCI_IRQ_MSI | 272 + PCI_IRQ_LEGACY); 272 273 273 - if (err < 0) { 274 - err = pci_alloc_irq_vectors(self->pdev, 1, 1, 275 - PCI_IRQ_MSI | PCI_IRQ_LEGACY); 276 - if (err < 0) 277 - goto err_hwinit; 274 + if (numvecs < 0) { 275 + err = numvecs; 276 + goto err_hwinit; 278 277 } 279 278 #endif 279 + self->irqvecs = numvecs; 280 280 281 281 /* net device init */ 282 282 aq_nic_cfg_start(self); ··· 298 298 kfree(self->aq_hw); 299 299 err_ioremap: 300 300 free_netdev(ndev); 301 - err_pci_func: 302 - pci_release_regions(pdev); 303 301 err_ndev: 302 + pci_release_regions(pdev); 303 + err_pci_func: 304 304 pci_disable_device(pdev); 305 305 return err; 306 306 }

+5 -4

drivers/net/ethernet/broadcom/tg3.c

··· 8733 8733 tg3_mem_rx_release(tp); 8734 8734 tg3_mem_tx_release(tp); 8735 8735 8736 - /* Protect tg3_get_stats64() from reading freed tp->hw_stats. */ 8737 - tg3_full_lock(tp, 0); 8736 + /* tp->hw_stats can be referenced safely: 8737 + * 1. under rtnl_lock 8738 + * 2. or under tp->lock if TG3_FLAG_INIT_COMPLETE is set. 8739 + */ 8738 8740 if (tp->hw_stats) { 8739 8741 dma_free_coherent(&tp->pdev->dev, sizeof(struct tg3_hw_stats), 8740 8742 tp->hw_stats, tp->stats_mapping); 8741 8743 tp->hw_stats = NULL; 8742 8744 } 8743 - tg3_full_unlock(tp); 8744 8745 } 8745 8746 8746 8747 /* ··· 14179 14178 struct tg3 *tp = netdev_priv(dev); 14180 14179 14181 14180 spin_lock_bh(&tp->lock); 14182 - if (!tp->hw_stats) { 14181 + if (!tp->hw_stats || !tg3_flag(tp, INIT_COMPLETE)) { 14183 14182 *stats = tp->net_stats_prev; 14184 14183 spin_unlock_bh(&tp->lock); 14185 14184 return;

+3 -4

drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c

··· 3433 3433 sgl = adapter->hma.sgt->sgl; 3434 3434 node = dev_to_node(adapter->pdev_dev); 3435 3435 for_each_sg(sgl, iter, sgt->orig_nents, i) { 3436 - newpage = alloc_pages_node(node, __GFP_NOWARN | GFP_KERNEL, 3437 - page_order); 3436 + newpage = alloc_pages_node(node, __GFP_NOWARN | GFP_KERNEL | 3437 + __GFP_ZERO, page_order); 3438 3438 if (!newpage) { 3439 3439 dev_err(adapter->pdev_dev, 3440 3440 "Not enough memory for HMA page allocation\n"); ··· 5474 5474 } 5475 5475 spin_lock_init(&adapter->mbox_lock); 5476 5476 INIT_LIST_HEAD(&adapter->mlist.list); 5477 + adapter->mbox_log->size = T4_OS_LOG_MBOX_CMDS; 5477 5478 pci_set_drvdata(pdev, adapter); 5478 5479 5479 5480 if (func != ent->driver_data) { ··· 5508 5507 err = -ENOMEM; 5509 5508 goto out_free_adapter; 5510 5509 } 5511 - 5512 - adapter->mbox_log->size = T4_OS_LOG_MBOX_CMDS; 5513 5510 5514 5511 /* PCI device has been enabled */ 5515 5512 adapter->flags |= DEV_ENABLED;

+1 -1

drivers/net/ethernet/intel/ice/ice_controlq.c

··· 1014 1014 desc = ICE_CTL_Q_DESC(cq->rq, ntc); 1015 1015 desc_idx = ntc; 1016 1016 1017 + cq->rq_last_status = (enum ice_aq_err)le16_to_cpu(desc->retval); 1017 1018 flags = le16_to_cpu(desc->flags); 1018 1019 if (flags & ICE_AQ_FLAG_ERR) { 1019 1020 ret_code = ICE_ERR_AQ_ERROR; 1020 - cq->rq_last_status = (enum ice_aq_err)le16_to_cpu(desc->retval); 1021 1021 ice_debug(hw, ICE_DBG_AQ_MSG, 1022 1022 "Control Receive Queue Event received with error 0x%x\n", 1023 1023 cq->rq_last_status);

+1 -1

drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c

··· 943 943 kfree(ipsec->ip_tbl); 944 944 kfree(ipsec->rx_tbl); 945 945 kfree(ipsec->tx_tbl); 946 + kfree(ipsec); 946 947 err1: 947 - kfree(adapter->ipsec); 948 948 netdev_err(adapter->netdev, "Unable to allocate memory for SA tables"); 949 949 } 950 950

+3

drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c

··· 3427 3427 hw->phy.sfp_setup_needed = false; 3428 3428 } 3429 3429 3430 + if (status == IXGBE_ERR_SFP_NOT_SUPPORTED) 3431 + return status; 3432 + 3430 3433 /* Reset PHY */ 3431 3434 if (!hw->phy.reset_disable && hw->phy.ops.reset) 3432 3435 hw->phy.ops.reset(hw);

+1 -1

drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c

··· 4137 4137 return NETDEV_TX_OK; 4138 4138 } 4139 4139 4140 - static int ixgbevf_xmit_frame(struct sk_buff *skb, struct net_device *netdev) 4140 + static netdev_tx_t ixgbevf_xmit_frame(struct sk_buff *skb, struct net_device *netdev) 4141 4141 { 4142 4142 struct ixgbevf_adapter *adapter = netdev_priv(netdev); 4143 4143 struct ixgbevf_ring *tx_ring;

+16

drivers/net/ethernet/mellanox/mlx4/en_ethtool.c

··· 1027 1027 if (!coal->tx_max_coalesced_frames_irq) 1028 1028 return -EINVAL; 1029 1029 1030 + if (coal->tx_coalesce_usecs > MLX4_EN_MAX_COAL_TIME || 1031 + coal->rx_coalesce_usecs > MLX4_EN_MAX_COAL_TIME || 1032 + coal->rx_coalesce_usecs_low > MLX4_EN_MAX_COAL_TIME || 1033 + coal->rx_coalesce_usecs_high > MLX4_EN_MAX_COAL_TIME) { 1034 + netdev_info(dev, "%s: maximum coalesce time supported is %d usecs\n", 1035 + __func__, MLX4_EN_MAX_COAL_TIME); 1036 + return -ERANGE; 1037 + } 1038 + 1039 + if (coal->tx_max_coalesced_frames > MLX4_EN_MAX_COAL_PKTS || 1040 + coal->rx_max_coalesced_frames > MLX4_EN_MAX_COAL_PKTS) { 1041 + netdev_info(dev, "%s: maximum coalesced frames supported is %d\n", 1042 + __func__, MLX4_EN_MAX_COAL_PKTS); 1043 + return -ERANGE; 1044 + } 1045 + 1030 1046 priv->rx_frames = (coal->rx_max_coalesced_frames == 1031 1047 MLX4_EN_AUTO_CONF) ? 1032 1048 MLX4_EN_RX_COAL_TARGET :

+1 -7

drivers/net/ethernet/mellanox/mlx4/en_netdev.c

··· 3324 3324 MAX_TX_RINGS, GFP_KERNEL); 3325 3325 if (!priv->tx_ring[t]) { 3326 3326 err = -ENOMEM; 3327 - goto err_free_tx; 3327 + goto out; 3328 3328 } 3329 3329 priv->tx_cq[t] = kzalloc(sizeof(struct mlx4_en_cq *) * 3330 3330 MAX_TX_RINGS, GFP_KERNEL); 3331 3331 if (!priv->tx_cq[t]) { 3332 - kfree(priv->tx_ring[t]); 3333 3332 err = -ENOMEM; 3334 3333 goto out; 3335 3334 } ··· 3581 3582 3582 3583 return 0; 3583 3584 3584 - err_free_tx: 3585 - while (t--) { 3586 - kfree(priv->tx_ring[t]); 3587 - kfree(priv->tx_cq[t]); 3588 - } 3589 3585 out: 3590 3586 mlx4_en_destroy_netdev(dev); 3591 3587 return err;

+5 -2

drivers/net/ethernet/mellanox/mlx4/mlx4_en.h

··· 132 132 #define MLX4_EN_TX_COAL_PKTS 16 133 133 #define MLX4_EN_TX_COAL_TIME 0x10 134 134 135 + #define MLX4_EN_MAX_COAL_PKTS U16_MAX 136 + #define MLX4_EN_MAX_COAL_TIME U16_MAX 137 + 135 138 #define MLX4_EN_RX_RATE_LOW 400000 136 139 #define MLX4_EN_RX_COAL_TIME_LOW 0 137 140 #define MLX4_EN_RX_RATE_HIGH 450000 ··· 555 552 u16 rx_usecs_low; 556 553 u32 pkt_rate_high; 557 554 u16 rx_usecs_high; 558 - u16 sample_interval; 559 - u16 adaptive_rx_coal; 555 + u32 sample_interval; 556 + u32 adaptive_rx_coal; 560 557 u32 msg_enable; 561 558 u32 loopback_ok; 562 559 u32 validate_loopback;

+4

drivers/net/ethernet/mellanox/mlx5/core/en_tc.c

··· 1261 1261 f->mask); 1262 1262 addr_type = key->addr_type; 1263 1263 1264 + /* the HW doesn't support frag first/later */ 1265 + if (mask->flags & FLOW_DIS_FIRST_FRAG) 1266 + return -EOPNOTSUPP; 1267 + 1264 1268 if (mask->flags & FLOW_DIS_IS_FRAGMENT) { 1265 1269 MLX5_SET(fte_match_set_lyr_2_4, headers_c, frag, 1); 1266 1270 MLX5_SET(fte_match_set_lyr_2_4, headers_v, frag,

+28

drivers/net/ethernet/mellanox/mlx5/core/eq.c

··· 34 34 #include <linux/module.h> 35 35 #include <linux/mlx5/driver.h> 36 36 #include <linux/mlx5/cmd.h> 37 + #ifdef CONFIG_RFS_ACCEL 38 + #include <linux/cpu_rmap.h> 39 + #endif 37 40 #include "mlx5_core.h" 38 41 #include "fpga/core.h" 39 42 #include "eswitch.h" ··· 925 922 MLX5_SET(query_eq_in, in, opcode, MLX5_CMD_OP_QUERY_EQ); 926 923 MLX5_SET(query_eq_in, in, eq_number, eq->eqn); 927 924 return mlx5_cmd_exec(dev, in, sizeof(in), out, outlen); 925 + } 926 + 927 + /* This function should only be called after mlx5_cmd_force_teardown_hca */ 928 + void mlx5_core_eq_free_irqs(struct mlx5_core_dev *dev) 929 + { 930 + struct mlx5_eq_table *table = &dev->priv.eq_table; 931 + struct mlx5_eq *eq; 932 + 933 + #ifdef CONFIG_RFS_ACCEL 934 + if (dev->rmap) { 935 + free_irq_cpu_rmap(dev->rmap); 936 + dev->rmap = NULL; 937 + } 938 + #endif 939 + list_for_each_entry(eq, &table->comp_eqs_list, list) 940 + free_irq(eq->irqn, eq); 941 + 942 + free_irq(table->pages_eq.irqn, &table->pages_eq); 943 + free_irq(table->async_eq.irqn, &table->async_eq); 944 + free_irq(table->cmd_eq.irqn, &table->cmd_eq); 945 + #ifdef CONFIG_INFINIBAND_ON_DEMAND_PAGING 946 + if (MLX5_CAP_GEN(dev, pg)) 947 + free_irq(table->pfault_eq.irqn, &table->pfault_eq); 948 + #endif 949 + pci_free_irq_vectors(dev->pdev); 928 950 }

+10 -1

drivers/net/ethernet/mellanox/mlx5/core/eswitch.c

··· 2175 2175 memset(vf_stats, 0, sizeof(*vf_stats)); 2176 2176 vf_stats->rx_packets = 2177 2177 MLX5_GET_CTR(out, received_eth_unicast.packets) + 2178 + MLX5_GET_CTR(out, received_ib_unicast.packets) + 2178 2179 MLX5_GET_CTR(out, received_eth_multicast.packets) + 2180 + MLX5_GET_CTR(out, received_ib_multicast.packets) + 2179 2181 MLX5_GET_CTR(out, received_eth_broadcast.packets); 2180 2182 2181 2183 vf_stats->rx_bytes = 2182 2184 MLX5_GET_CTR(out, received_eth_unicast.octets) + 2185 + MLX5_GET_CTR(out, received_ib_unicast.octets) + 2183 2186 MLX5_GET_CTR(out, received_eth_multicast.octets) + 2187 + MLX5_GET_CTR(out, received_ib_multicast.octets) + 2184 2188 MLX5_GET_CTR(out, received_eth_broadcast.octets); 2185 2189 2186 2190 vf_stats->tx_packets = 2187 2191 MLX5_GET_CTR(out, transmitted_eth_unicast.packets) + 2192 + MLX5_GET_CTR(out, transmitted_ib_unicast.packets) + 2188 2193 MLX5_GET_CTR(out, transmitted_eth_multicast.packets) + 2194 + MLX5_GET_CTR(out, transmitted_ib_multicast.packets) + 2189 2195 MLX5_GET_CTR(out, transmitted_eth_broadcast.packets); 2190 2196 2191 2197 vf_stats->tx_bytes = 2192 2198 MLX5_GET_CTR(out, transmitted_eth_unicast.octets) + 2199 + MLX5_GET_CTR(out, transmitted_ib_unicast.octets) + 2193 2200 MLX5_GET_CTR(out, transmitted_eth_multicast.octets) + 2201 + MLX5_GET_CTR(out, transmitted_ib_multicast.octets) + 2194 2202 MLX5_GET_CTR(out, transmitted_eth_broadcast.octets); 2195 2203 2196 2204 vf_stats->multicast = 2197 - MLX5_GET_CTR(out, received_eth_multicast.packets); 2205 + MLX5_GET_CTR(out, received_eth_multicast.packets) + 2206 + MLX5_GET_CTR(out, received_ib_multicast.packets); 2198 2207 2199 2208 vf_stats->broadcast = 2200 2209 MLX5_GET_CTR(out, received_eth_broadcast.packets);

+8

drivers/net/ethernet/mellanox/mlx5/core/main.c

··· 1587 1587 1588 1588 mlx5_enter_error_state(dev, true); 1589 1589 1590 + /* Some platforms requiring freeing the IRQ's in the shutdown 1591 + * flow. If they aren't freed they can't be allocated after 1592 + * kexec. There is no need to cleanup the mlx5_core software 1593 + * contexts. 1594 + */ 1595 + mlx5_irq_clear_affinity_hints(dev); 1596 + mlx5_core_eq_free_irqs(dev); 1597 + 1590 1598 return 0; 1591 1599 } 1592 1600

+2

drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h

··· 128 128 u32 *out, int outlen); 129 129 int mlx5_start_eqs(struct mlx5_core_dev *dev); 130 130 void mlx5_stop_eqs(struct mlx5_core_dev *dev); 131 + /* This function should only be called after mlx5_cmd_force_teardown_hca */ 132 + void mlx5_core_eq_free_irqs(struct mlx5_core_dev *dev); 131 133 struct mlx5_eq *mlx5_eqn2eq(struct mlx5_core_dev *dev, int eqn); 132 134 u32 mlx5_eq_poll_irq_disabled(struct mlx5_eq *eq); 133 135 void mlx5_cq_tasklet_cb(unsigned long data);

+2 -2

drivers/net/ethernet/mellanox/mlxsw/core.c

··· 1100 1100 err_alloc_lag_mapping: 1101 1101 mlxsw_ports_fini(mlxsw_core); 1102 1102 err_ports_init: 1103 - mlxsw_bus->fini(bus_priv); 1104 - err_bus_init: 1105 1103 if (!reload) 1106 1104 devlink_resources_unregister(devlink, NULL); 1107 1105 err_register_resources: 1106 + mlxsw_bus->fini(bus_priv); 1107 + err_bus_init: 1108 1108 if (!reload) 1109 1109 devlink_free(devlink); 1110 1110 err_devlink_alloc:

-19

drivers/net/ethernet/netronome/nfp/flower/main.c

··· 52 52 53 53 #define NFP_FLOWER_ALLOWED_VER 0x0001000000010000UL 54 54 55 - #define NFP_FLOWER_FRAME_HEADROOM 158 56 - 57 55 static const char *nfp_flower_extra_cap(struct nfp_app *app, struct nfp_net *nn) 58 56 { 59 57 return "FLOWER"; ··· 557 559 app->priv = NULL; 558 560 } 559 561 560 - static int 561 - nfp_flower_check_mtu(struct nfp_app *app, struct net_device *netdev, 562 - int new_mtu) 563 - { 564 - /* The flower fw reserves NFP_FLOWER_FRAME_HEADROOM bytes of the 565 - * supported max MTU to allow for appending tunnel headers. To prevent 566 - * unexpected behaviour this needs to be accounted for. 567 - */ 568 - if (new_mtu > netdev->max_mtu - NFP_FLOWER_FRAME_HEADROOM) { 569 - nfp_err(app->cpp, "New MTU (%d) is not valid\n", new_mtu); 570 - return -EINVAL; 571 - } 572 - 573 - return 0; 574 - } 575 - 576 562 static bool nfp_flower_check_ack(struct nfp_flower_priv *app_priv) 577 563 { 578 564 bool ret; ··· 638 656 .init = nfp_flower_init, 639 657 .clean = nfp_flower_clean, 640 658 641 - .check_mtu = nfp_flower_check_mtu, 642 659 .repr_change_mtu = nfp_flower_repr_change_mtu, 643 660 644 661 .vnic_alloc = nfp_flower_vnic_alloc,

+6 -4

drivers/net/ethernet/ni/nixge.c

··· 1170 1170 1171 1171 cell = nvmem_cell_get(dev, "address"); 1172 1172 if (IS_ERR(cell)) 1173 - return cell; 1173 + return NULL; 1174 1174 1175 1175 mac = nvmem_cell_read(cell, &cell_size); 1176 1176 nvmem_cell_put(cell); ··· 1183 1183 struct nixge_priv *priv; 1184 1184 struct net_device *ndev; 1185 1185 struct resource *dmares; 1186 - const char *mac_addr; 1186 + const u8 *mac_addr; 1187 1187 int err; 1188 1188 1189 1189 ndev = alloc_etherdev(sizeof(*priv)); ··· 1202 1202 ndev->max_mtu = NIXGE_JUMBO_MTU; 1203 1203 1204 1204 mac_addr = nixge_get_nvmem_address(&pdev->dev); 1205 - if (mac_addr && is_valid_ether_addr(mac_addr)) 1205 + if (mac_addr && is_valid_ether_addr(mac_addr)) { 1206 1206 ether_addr_copy(ndev->dev_addr, mac_addr); 1207 - else 1207 + kfree(mac_addr); 1208 + } else { 1208 1209 eth_hw_addr_random(ndev); 1210 + } 1209 1211 1210 1212 priv = netdev_priv(ndev); 1211 1213 priv->ndev = ndev;

+2 -4

drivers/net/ethernet/qlogic/qed/qed_l2.c

··· 115 115 116 116 void qed_l2_setup(struct qed_hwfn *p_hwfn) 117 117 { 118 - if (p_hwfn->hw_info.personality != QED_PCI_ETH && 119 - p_hwfn->hw_info.personality != QED_PCI_ETH_ROCE) 118 + if (!QED_IS_L2_PERSONALITY(p_hwfn)) 120 119 return; 121 120 122 121 mutex_init(&p_hwfn->p_l2_info->lock); ··· 125 126 { 126 127 u32 i; 127 128 128 - if (p_hwfn->hw_info.personality != QED_PCI_ETH && 129 - p_hwfn->hw_info.personality != QED_PCI_ETH_ROCE) 129 + if (!QED_IS_L2_PERSONALITY(p_hwfn)) 130 130 return; 131 131 132 132 if (!p_hwfn->p_l2_info)

+1 -1

drivers/net/ethernet/qlogic/qed/qed_main.c

··· 680 680 tasklet_disable(p_hwfn->sp_dpc); 681 681 p_hwfn->b_sp_dpc_enabled = false; 682 682 DP_VERBOSE(cdev, NETIF_MSG_IFDOWN, 683 - "Disabled sp taskelt [hwfn %d] at %p\n", 683 + "Disabled sp tasklet [hwfn %d] at %p\n", 684 684 i, p_hwfn->sp_dpc); 685 685 } 686 686 }

+1 -1

drivers/net/ethernet/qlogic/qede/qede_rdma.c

··· 238 238 } 239 239 240 240 if (!found) { 241 - event_node = kzalloc(sizeof(*event_node), GFP_KERNEL); 241 + event_node = kzalloc(sizeof(*event_node), GFP_ATOMIC); 242 242 if (!event_node) { 243 243 DP_NOTICE(edev, 244 244 "qedr: Could not allocate memory for rdma work\n");

+3

drivers/net/ethernet/realtek/r8169.c

··· 4981 4981 static void rtl_pll_power_up(struct rtl8169_private *tp) 4982 4982 { 4983 4983 rtl_generic_op(tp, tp->pll_power_ops.up); 4984 + 4985 + /* give MAC/PHY some time to resume */ 4986 + msleep(20); 4984 4987 } 4985 4988 4986 4989 static void rtl_init_pll_power_ops(struct rtl8169_private *tp)

+2 -3

drivers/net/ethernet/sun/niu.c

··· 3443 3443 3444 3444 len = (val & RCR_ENTRY_L2_LEN) >> 3445 3445 RCR_ENTRY_L2_LEN_SHIFT; 3446 - len -= ETH_FCS_LEN; 3446 + append_size = len + ETH_HLEN + ETH_FCS_LEN; 3447 3447 3448 3448 addr = (val & RCR_ENTRY_PKT_BUF_ADDR) << 3449 3449 RCR_ENTRY_PKT_BUF_ADDR_SHIFT; ··· 3453 3453 RCR_ENTRY_PKTBUFSZ_SHIFT]; 3454 3454 3455 3455 off = addr & ~PAGE_MASK; 3456 - append_size = rcr_size; 3457 3456 if (num_rcr == 1) { 3458 3457 int ptype; 3459 3458 ··· 3465 3466 else 3466 3467 skb_checksum_none_assert(skb); 3467 3468 } else if (!(val & RCR_ENTRY_MULTI)) 3468 - append_size = len - skb->len; 3469 + append_size = append_size - skb->len; 3469 3470 3470 3471 niu_rx_skb_append(skb, page, off, append_size, rcr_size); 3471 3472 if ((page->index + rp->rbr_block_size) - rcr_size == addr) {

+2 -1

drivers/net/hyperv/netvsc_drv.c

··· 1840 1840 goto rx_handler_failed; 1841 1841 } 1842 1842 1843 - ret = netdev_upper_dev_link(vf_netdev, ndev, NULL); 1843 + ret = netdev_master_upper_dev_link(vf_netdev, ndev, 1844 + NULL, NULL, NULL); 1844 1845 if (ret != 0) { 1845 1846 netdev_err(vf_netdev, 1846 1847 "can not set master device %s (err = %d)\n",

+1 -1

drivers/net/hyperv/rndis_filter.c

··· 1288 1288 rndis_device->link_state ? "down" : "up"); 1289 1289 1290 1290 if (net_device->nvsp_version < NVSP_PROTOCOL_VERSION_5) 1291 - return net_device; 1291 + goto out; 1292 1292 1293 1293 rndis_filter_query_link_speed(rndis_device, net_device); 1294 1294

+1 -1

drivers/net/ieee802154/atusb.c

··· 1045 1045 atusb->tx_dr.bRequest = ATUSB_TX; 1046 1046 atusb->tx_dr.wValue = cpu_to_le16(0); 1047 1047 1048 - atusb->tx_urb = usb_alloc_urb(0, GFP_ATOMIC); 1048 + atusb->tx_urb = usb_alloc_urb(0, GFP_KERNEL); 1049 1049 if (!atusb->tx_urb) 1050 1050 goto fail; 1051 1051

+10 -5

drivers/net/ieee802154/mcr20a.c

··· 1267 1267 ret = mcr20a_get_platform_data(spi, pdata); 1268 1268 if (ret < 0) { 1269 1269 dev_crit(&spi->dev, "mcr20a_get_platform_data failed.\n"); 1270 - return ret; 1270 + goto free_pdata; 1271 1271 } 1272 1272 1273 1273 /* init reset gpio */ ··· 1275 1275 ret = devm_gpio_request_one(&spi->dev, pdata->rst_gpio, 1276 1276 GPIOF_OUT_INIT_HIGH, "reset"); 1277 1277 if (ret) 1278 - return ret; 1278 + goto free_pdata; 1279 1279 } 1280 1280 1281 1281 /* reset mcr20a */ ··· 1291 1291 hw = ieee802154_alloc_hw(sizeof(*lp), &mcr20a_hw_ops); 1292 1292 if (!hw) { 1293 1293 dev_crit(&spi->dev, "ieee802154_alloc_hw failed\n"); 1294 - return -ENOMEM; 1294 + ret = -ENOMEM; 1295 + goto free_pdata; 1295 1296 } 1296 1297 1297 1298 /* init mcr20a local data */ ··· 1309 1308 /* init buf */ 1310 1309 lp->buf = devm_kzalloc(&spi->dev, SPI_COMMAND_BUFFER, GFP_KERNEL); 1311 1310 1312 - if (!lp->buf) 1313 - return -ENOMEM; 1311 + if (!lp->buf) { 1312 + ret = -ENOMEM; 1313 + goto free_dev; 1314 + } 1314 1315 1315 1316 mcr20a_setup_tx_spi_messages(lp); 1316 1317 mcr20a_setup_rx_spi_messages(lp); ··· 1369 1366 1370 1367 free_dev: 1371 1368 ieee802154_free_hw(lp->hw); 1369 + free_pdata: 1370 + kfree(pdata); 1372 1371 1373 1372 return ret; 1374 1373 }

+10

drivers/net/phy/broadcom.c

··· 720 720 .get_strings = bcm_phy_get_strings, 721 721 .get_stats = bcm53xx_phy_get_stats, 722 722 .probe = bcm53xx_phy_probe, 723 + }, { 724 + .phy_id = PHY_ID_BCM89610, 725 + .phy_id_mask = 0xfffffff0, 726 + .name = "Broadcom BCM89610", 727 + .features = PHY_GBIT_FEATURES, 728 + .flags = PHY_HAS_INTERRUPT, 729 + .config_init = bcm54xx_config_init, 730 + .ack_interrupt = bcm_phy_ack_intr, 731 + .config_intr = bcm_phy_config_intr, 723 732 } }; 724 733 725 734 module_phy_driver(broadcom_drivers); ··· 750 741 { PHY_ID_BCMAC131, 0xfffffff0 }, 751 742 { PHY_ID_BCM5241, 0xfffffff0 }, 752 743 { PHY_ID_BCM5395, 0xfffffff0 }, 744 + { PHY_ID_BCM89610, 0xfffffff0 }, 753 745 { } 754 746 }; 755 747

+1 -1

drivers/net/phy/sfp-bus.c

··· 125 125 if (id->base.br_nominal) { 126 126 if (id->base.br_nominal != 255) { 127 127 br_nom = id->base.br_nominal * 100; 128 - br_min = br_nom + id->base.br_nominal * id->ext.br_min; 128 + br_min = br_nom - id->base.br_nominal * id->ext.br_min; 129 129 br_max = br_nom + id->base.br_nominal * id->ext.br_max; 130 130 } else if (id->ext.br_max) { 131 131 br_nom = 250 * id->ext.br_max;

+1

drivers/net/wireless/mac80211_hwsim.c

··· 3236 3236 GENL_SET_ERR_MSG(info,"MAC is no valid source addr"); 3237 3237 NL_SET_BAD_ATTR(info->extack, 3238 3238 info->attrs[HWSIM_ATTR_PERM_ADDR]); 3239 + kfree(hwname); 3239 3240 return -EINVAL; 3240 3241 } 3241 3242

+1

include/linux/brcmphy.h

··· 25 25 #define PHY_ID_BCM54612E 0x03625e60 26 26 #define PHY_ID_BCM54616S 0x03625d10 27 27 #define PHY_ID_BCM57780 0x03625d90 28 + #define PHY_ID_BCM89610 0x03625cd0 28 29 29 30 #define PHY_ID_BCM7250 0xae025280 30 31 #define PHY_ID_BCM7260 0xae025190

+1

include/net/bonding.h

··· 198 198 struct slave __rcu *primary_slave; 199 199 struct bond_up_slave __rcu *slave_arr; /* Array of usable slaves */ 200 200 bool force_primary; 201 + u32 nest_level; 201 202 s32 slave_cnt; /* never change this value outside the attach/detach wrappers */ 202 203 int (*recv_probe)(const struct sk_buff *, struct bonding *, 203 204 struct slave *);

+1 -1

include/net/flow_dissector.h

··· 251 251 * This structure is used to hold a digest of the full flow keys. This is a 252 252 * larger "hash" of a flow to allow definitively matching specific flows where 253 253 * the 32 bit skb->hash is not large enough. The size is limited to 16 bytes so 254 - * that it can by used in CB of skb (see sch_choke for an example). 254 + * that it can be used in CB of skb (see sch_choke for an example). 255 255 */ 256 256 #define FLOW_KEYS_DIGEST_LEN 16 257 257 struct flow_keys_digest {

+1 -1

include/net/mac80211.h

··· 2080 2080 * virtual interface might not be given air time for the transmission of 2081 2081 * the frame, as it is not synced with the AP/P2P GO yet, and thus the 2082 2082 * deauthentication frame might not be transmitted. 2083 - > 2083 + * 2084 2084 * @IEEE80211_HW_DOESNT_SUPPORT_QOS_NDP: The driver (or firmware) doesn't 2085 2085 * support QoS NDP for AP probing - that's most likely a driver bug. 2086 2086 *

+1

include/net/xfrm.h

··· 375 375 int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo); 376 376 int xfrm_input_unregister_afinfo(const struct xfrm_input_afinfo *afinfo); 377 377 378 + void xfrm_flush_gc(void); 378 379 void xfrm_state_delete_tunnel(struct xfrm_state *x); 379 380 380 381 struct xfrm_type {

+85

include/trace/events/rxrpc.h

··· 15 15 #define _TRACE_RXRPC_H 16 16 17 17 #include <linux/tracepoint.h> 18 + #include <linux/errqueue.h> 18 19 19 20 /* 20 21 * Define enums for tracing information. ··· 209 208 rxrpc_cong_retransmit_again, 210 209 rxrpc_cong_rtt_window_end, 211 210 rxrpc_cong_saw_nack, 211 + }; 212 + 213 + enum rxrpc_tx_fail_trace { 214 + rxrpc_tx_fail_call_abort, 215 + rxrpc_tx_fail_call_ack, 216 + rxrpc_tx_fail_call_data_frag, 217 + rxrpc_tx_fail_call_data_nofrag, 218 + rxrpc_tx_fail_call_final_resend, 219 + rxrpc_tx_fail_conn_abort, 220 + rxrpc_tx_fail_conn_challenge, 221 + rxrpc_tx_fail_conn_response, 222 + rxrpc_tx_fail_reject, 223 + rxrpc_tx_fail_version_keepalive, 224 + rxrpc_tx_fail_version_reply, 212 225 }; 213 226 214 227 #endif /* end __RXRPC_DECLARE_TRACE_ENUMS_ONCE_ONLY */ ··· 452 437 EM(RXRPC_CALL_LOCAL_ERROR, "LocalError") \ 453 438 E_(RXRPC_CALL_NETWORK_ERROR, "NetError") 454 439 440 + #define rxrpc_tx_fail_traces \ 441 + EM(rxrpc_tx_fail_call_abort, "CallAbort") \ 442 + EM(rxrpc_tx_fail_call_ack, "CallAck") \ 443 + EM(rxrpc_tx_fail_call_data_frag, "CallDataFrag") \ 444 + EM(rxrpc_tx_fail_call_data_nofrag, "CallDataNofrag") \ 445 + EM(rxrpc_tx_fail_call_final_resend, "CallFinalResend") \ 446 + EM(rxrpc_tx_fail_conn_abort, "ConnAbort") \ 447 + EM(rxrpc_tx_fail_conn_challenge, "ConnChall") \ 448 + EM(rxrpc_tx_fail_conn_response, "ConnResp") \ 449 + EM(rxrpc_tx_fail_reject, "Reject") \ 450 + EM(rxrpc_tx_fail_version_keepalive, "VerKeepalive") \ 451 + E_(rxrpc_tx_fail_version_reply, "VerReply") 452 + 455 453 /* 456 454 * Export enum symbols via userspace. 457 455 */ ··· 488 460 rxrpc_propose_ack_outcomes; 489 461 rxrpc_congest_modes; 490 462 rxrpc_congest_changes; 463 + rxrpc_tx_fail_traces; 491 464 492 465 /* 493 466 * Now redefine the EM() and E_() macros to map the enums to the strings that ··· 1401 1372 __entry->call, 1402 1373 __entry->ix, 1403 1374 __entry->anno) 1375 + ); 1376 + 1377 + TRACE_EVENT(rxrpc_rx_icmp, 1378 + TP_PROTO(struct rxrpc_peer *peer, struct sock_extended_err *ee, 1379 + struct sockaddr_rxrpc *srx), 1380 + 1381 + TP_ARGS(peer, ee, srx), 1382 + 1383 + TP_STRUCT__entry( 1384 + __field(unsigned int, peer ) 1385 + __field_struct(struct sock_extended_err, ee ) 1386 + __field_struct(struct sockaddr_rxrpc, srx ) 1387 + ), 1388 + 1389 + TP_fast_assign( 1390 + __entry->peer = peer->debug_id; 1391 + memcpy(&__entry->ee, ee, sizeof(__entry->ee)); 1392 + memcpy(&__entry->srx, srx, sizeof(__entry->srx)); 1393 + ), 1394 + 1395 + TP_printk("P=%08x o=%u t=%u c=%u i=%u d=%u e=%d %pISp", 1396 + __entry->peer, 1397 + __entry->ee.ee_origin, 1398 + __entry->ee.ee_type, 1399 + __entry->ee.ee_code, 1400 + __entry->ee.ee_info, 1401 + __entry->ee.ee_data, 1402 + __entry->ee.ee_errno, 1403 + &__entry->srx.transport) 1404 + ); 1405 + 1406 + TRACE_EVENT(rxrpc_tx_fail, 1407 + TP_PROTO(unsigned int debug_id, rxrpc_serial_t serial, int ret, 1408 + enum rxrpc_tx_fail_trace what), 1409 + 1410 + TP_ARGS(debug_id, serial, ret, what), 1411 + 1412 + TP_STRUCT__entry( 1413 + __field(unsigned int, debug_id ) 1414 + __field(rxrpc_serial_t, serial ) 1415 + __field(int, ret ) 1416 + __field(enum rxrpc_tx_fail_trace, what ) 1417 + ), 1418 + 1419 + TP_fast_assign( 1420 + __entry->debug_id = debug_id; 1421 + __entry->serial = serial; 1422 + __entry->ret = ret; 1423 + __entry->what = what; 1424 + ), 1425 + 1426 + TP_printk("c=%08x r=%x ret=%d %s", 1427 + __entry->debug_id, 1428 + __entry->serial, 1429 + __entry->ret, 1430 + __print_symbolic(__entry->what, rxrpc_tx_fail_traces)) 1404 1431 ); 1405 1432 1406 1433 #endif /* _TRACE_RXRPC_H */

+2

include/uapi/linux/nl80211.h

··· 2698 2698 #define NL80211_ATTR_KEYS NL80211_ATTR_KEYS 2699 2699 #define NL80211_ATTR_FEATURE_FLAGS NL80211_ATTR_FEATURE_FLAGS 2700 2700 2701 + #define NL80211_WIPHY_NAME_MAXLEN 128 2702 + 2701 2703 #define NL80211_MAX_SUPP_RATES 32 2702 2704 #define NL80211_MAX_SUPP_HT_RATES 77 2703 2705 #define NL80211_MAX_SUPP_REG_RULES 64

+14 -5

kernel/bpf/syscall.c

··· 26 26 #include <linux/cred.h> 27 27 #include <linux/timekeeping.h> 28 28 #include <linux/ctype.h> 29 + #include <linux/nospec.h> 29 30 30 31 #define IS_FD_ARRAY(map) ((map)->map_type == BPF_MAP_TYPE_PROG_ARRAY || \ 31 32 (map)->map_type == BPF_MAP_TYPE_PERF_EVENT_ARRAY || \ ··· 103 102 static struct bpf_map *find_and_alloc_map(union bpf_attr *attr) 104 103 { 105 104 const struct bpf_map_ops *ops; 105 + u32 type = attr->map_type; 106 106 struct bpf_map *map; 107 107 int err; 108 108 109 - if (attr->map_type >= ARRAY_SIZE(bpf_map_types)) 109 + if (type >= ARRAY_SIZE(bpf_map_types)) 110 110 return ERR_PTR(-EINVAL); 111 - ops = bpf_map_types[attr->map_type]; 111 + type = array_index_nospec(type, ARRAY_SIZE(bpf_map_types)); 112 + ops = bpf_map_types[type]; 112 113 if (!ops) 113 114 return ERR_PTR(-EINVAL); 114 115 ··· 125 122 if (IS_ERR(map)) 126 123 return map; 127 124 map->ops = ops; 128 - map->map_type = attr->map_type; 125 + map->map_type = type; 129 126 return map; 130 127 } 131 128 ··· 874 871 875 872 static int find_prog_type(enum bpf_prog_type type, struct bpf_prog *prog) 876 873 { 877 - if (type >= ARRAY_SIZE(bpf_prog_types) || !bpf_prog_types[type]) 874 + const struct bpf_prog_ops *ops; 875 + 876 + if (type >= ARRAY_SIZE(bpf_prog_types)) 877 + return -EINVAL; 878 + type = array_index_nospec(type, ARRAY_SIZE(bpf_prog_types)); 879 + ops = bpf_prog_types[type]; 880 + if (!ops) 878 881 return -EINVAL; 879 882 880 883 if (!bpf_prog_is_dev_bound(prog->aux)) 881 - prog->aux->ops = bpf_prog_types[type]; 884 + prog->aux->ops = ops; 882 885 else 883 886 prog->aux->ops = &bpf_offload_prog_ops; 884 887 prog->type = type;

+1 -1

net/9p/trans_common.c

··· 16 16 #include <linux/module.h> 17 17 18 18 /** 19 - * p9_release_req_pages - Release pages after the transaction. 19 + * p9_release_pages - Release pages after the transaction. 20 20 */ 21 21 void p9_release_pages(struct page **pages, int nr_pages) 22 22 {

+2 -2

net/9p/trans_fd.c

··· 1092 1092 }; 1093 1093 1094 1094 /** 1095 - * p9_poll_proc - poll worker thread 1096 - * @a: thread state and arguments 1095 + * p9_poll_workfn - poll worker thread 1096 + * @work: work queue 1097 1097 * 1098 1098 * polls all v9fs transports for new events and queues the appropriate 1099 1099 * work to the work queue

+1 -3

net/9p/trans_rdma.c

··· 68 68 * @pd: Protection Domain pointer 69 69 * @qp: Queue Pair pointer 70 70 * @cq: Completion Queue pointer 71 - * @dm_mr: DMA Memory Region pointer 72 - * @lkey: The local access only memory region key 73 71 * @timeout: Number of uSecs to wait for connection management events 74 72 * @privport: Whether a privileged port may be used 75 73 * @port: The port to use ··· 630 632 } 631 633 632 634 /** 633 - * trans_create_rdma - Transport method for creating atransport instance 635 + * rdma_create_trans - Transport method for creating a transport instance 634 636 * @client: client instance 635 637 * @addr: IP address string 636 638 * @args: Mount options string

+2 -3

net/9p/trans_virtio.c

··· 60 60 61 61 /** 62 62 * struct virtio_chan - per-instance transport information 63 - * @initialized: whether the channel is initialized 64 63 * @inuse: whether the channel is in use 65 64 * @lock: protects multiple elements within this structure 66 65 * @client: client instance ··· 384 385 * @uidata: user bffer that should be ued for zero copy read 385 386 * @uodata: user buffer that shoud be user for zero copy write 386 387 * @inlen: read buffer size 387 - * @olen: write buffer size 388 - * @hdrlen: reader header size, This is the size of response protocol data 388 + * @outlen: write buffer size 389 + * @in_hdr_len: reader header size, This is the size of response protocol data 389 390 * 390 391 */ 391 392 static int

+1 -1

net/9p/trans_xen.c

··· 485 485 486 486 static int xen_9pfs_front_resume(struct xenbus_device *dev) 487 487 { 488 - dev_warn(&dev->dev, "suspsend/resume unsupported\n"); 488 + dev_warn(&dev->dev, "suspend/resume unsupported\n"); 489 489 return 0; 490 490 } 491 491

+7 -2

net/atm/lec.c

··· 41 41 #include <linux/module.h> 42 42 #include <linux/init.h> 43 43 44 + /* Hardening for Spectre-v1 */ 45 + #include <linux/nospec.h> 46 + 44 47 #include "lec.h" 45 48 #include "lec_arpc.h" 46 49 #include "resources.h" ··· 690 687 bytes_left = copy_from_user(&ioc_data, arg, sizeof(struct atmlec_ioc)); 691 688 if (bytes_left != 0) 692 689 pr_info("copy from user failed for %d bytes\n", bytes_left); 693 - if (ioc_data.dev_num < 0 || ioc_data.dev_num >= MAX_LEC_ITF || 694 - !dev_lec[ioc_data.dev_num]) 690 + if (ioc_data.dev_num < 0 || ioc_data.dev_num >= MAX_LEC_ITF) 691 + return -EINVAL; 692 + ioc_data.dev_num = array_index_nospec(ioc_data.dev_num, MAX_LEC_ITF); 693 + if (!dev_lec[ioc_data.dev_num]) 695 694 return -EINVAL; 696 695 vpriv = kmalloc(sizeof(struct lec_vcc_priv), GFP_KERNEL); 697 696 if (!vpriv)

+2 -2

net/ieee802154/6lowpan/6lowpan_i.h

··· 20 20 struct frag_lowpan_compare_key { 21 21 u16 tag; 22 22 u16 d_size; 23 - const struct ieee802154_addr src; 24 - const struct ieee802154_addr dst; 23 + struct ieee802154_addr src; 24 + struct ieee802154_addr dst; 25 25 }; 26 26 27 27 /* Equivalent of ipv4 struct ipq

+7 -7

net/ieee802154/6lowpan/reassembly.c

··· 75 75 { 76 76 struct netns_ieee802154_lowpan *ieee802154_lowpan = 77 77 net_ieee802154_lowpan(net); 78 - struct frag_lowpan_compare_key key = { 79 - .tag = cb->d_tag, 80 - .d_size = cb->d_size, 81 - .src = *src, 82 - .dst = *dst, 83 - }; 78 + struct frag_lowpan_compare_key key = {}; 84 79 struct inet_frag_queue *q; 80 + 81 + key.tag = cb->d_tag; 82 + key.d_size = cb->d_size; 83 + key.src = *src; 84 + key.dst = *dst; 85 85 86 86 q = inet_frag_find(&ieee802154_lowpan->frags, &key); 87 87 if (!q) ··· 372 372 struct lowpan_frag_queue *fq; 373 373 struct net *net = dev_net(skb->dev); 374 374 struct lowpan_802154_cb *cb = lowpan_802154_cb(skb); 375 - struct ieee802154_hdr hdr; 375 + struct ieee802154_hdr hdr = {}; 376 376 int err; 377 377 378 378 if (ieee802154_hdr_peek_addrs(skb, &hdr) < 0)

+5 -2

net/ipv4/ping.c

··· 775 775 ipc.addr = faddr = daddr; 776 776 777 777 if (ipc.opt && ipc.opt->opt.srr) { 778 - if (!daddr) 779 - return -EINVAL; 778 + if (!daddr) { 779 + err = -EINVAL; 780 + goto out_free; 781 + } 780 782 faddr = ipc.opt->opt.faddr; 781 783 } 782 784 tos = get_rttos(&ipc, inet); ··· 844 842 845 843 out: 846 844 ip_rt_put(rt); 845 + out_free: 847 846 if (free) 848 847 kfree(ipc.opt); 849 848 if (!err) {

+1

net/ipv4/route.c

··· 1375 1375 fnhe->fnhe_gw = 0; 1376 1376 fnhe->fnhe_pmtu = 0; 1377 1377 fnhe->fnhe_expires = 0; 1378 + fnhe->fnhe_mtu_locked = false; 1378 1379 fnhe_flush_routes(fnhe); 1379 1380 orig = NULL; 1380 1381 }

+7 -4

net/ipv4/udp.c

··· 401 401 bool dev_match = (sk->sk_bound_dev_if == dif || 402 402 sk->sk_bound_dev_if == sdif); 403 403 404 - if (exact_dif && !dev_match) 404 + if (!dev_match) 405 405 return -1; 406 - if (sk->sk_bound_dev_if && dev_match) 406 + if (sk->sk_bound_dev_if) 407 407 score += 4; 408 408 } 409 409 ··· 952 952 sock_tx_timestamp(sk, ipc.sockc.tsflags, &ipc.tx_flags); 953 953 954 954 if (ipc.opt && ipc.opt->opt.srr) { 955 - if (!daddr) 956 - return -EINVAL; 955 + if (!daddr) { 956 + err = -EINVAL; 957 + goto out_free; 958 + } 957 959 faddr = ipc.opt->opt.faddr; 958 960 connected = 0; 959 961 } ··· 1076 1074 1077 1075 out: 1078 1076 ip_rt_put(rt); 1077 + out_free: 1079 1078 if (free) 1080 1079 kfree(ipc.opt); 1081 1080 if (!err)

+4 -5

net/ipv6/Kconfig

··· 34 34 bool "IPv6: Route Information (RFC 4191) support" 35 35 depends on IPV6_ROUTER_PREF 36 36 ---help--- 37 - This is experimental support of Route Information. 37 + Support of Route Information. 38 38 39 39 If unsure, say N. 40 40 41 41 config IPV6_OPTIMISTIC_DAD 42 42 bool "IPv6: Enable RFC 4429 Optimistic DAD" 43 43 ---help--- 44 - This is experimental support for optimistic Duplicate 45 - Address Detection. It allows for autoconfigured addresses 46 - to be used more quickly. 44 + Support for optimistic Duplicate Address Detection. It allows for 45 + autoconfigured addresses to be used more quickly. 47 46 48 47 If unsure, say N. 49 48 ··· 279 280 depends on IPV6 280 281 select IP_MROUTE_COMMON 281 282 ---help--- 282 - Experimental support for IPv6 multicast forwarding. 283 + Support for IPv6 multicast forwarding. 283 284 If unsure, say N. 284 285 285 286 config IPV6_MROUTE_MULTIPLE_TABLES

+2 -2

net/ipv6/ip6_vti.c

··· 669 669 else 670 670 mtu = ETH_DATA_LEN - LL_MAX_HEADER - sizeof(struct ipv6hdr); 671 671 672 - dev->mtu = max_t(int, mtu, IPV6_MIN_MTU); 672 + dev->mtu = max_t(int, mtu, IPV4_MIN_MTU); 673 673 } 674 674 675 675 /** ··· 881 881 dev->priv_destructor = vti6_dev_free; 882 882 883 883 dev->type = ARPHRD_TUNNEL6; 884 - dev->min_mtu = IPV6_MIN_MTU; 884 + dev->min_mtu = IPV4_MIN_MTU; 885 885 dev->max_mtu = IP_MAX_MTU - sizeof(struct ipv6hdr); 886 886 dev->flags |= IFF_NOARP; 887 887 dev->addr_len = sizeof(struct in6_addr);

+2 -2

net/ipv6/udp.c

··· 148 148 bool dev_match = (sk->sk_bound_dev_if == dif || 149 149 sk->sk_bound_dev_if == sdif); 150 150 151 - if (exact_dif && !dev_match) 151 + if (!dev_match) 152 152 return -1; 153 - if (sk->sk_bound_dev_if && dev_match) 153 + if (sk->sk_bound_dev_if) 154 154 score++; 155 155 } 156 156

+3

net/ipv6/xfrm6_tunnel.c

··· 341 341 struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net); 342 342 unsigned int i; 343 343 344 + xfrm_state_flush(net, IPSEC_PROTO_ANY, false); 345 + xfrm_flush_gc(); 346 + 344 347 for (i = 0; i < XFRM6_TUNNEL_SPI_BYADDR_HSIZE; i++) 345 348 WARN_ON_ONCE(!hlist_empty(&xfrm6_tn->spi_byaddr[i])); 346 349

+35 -10

net/key/af_key.c

··· 437 437 return 0; 438 438 } 439 439 440 + static inline int sadb_key_len(const struct sadb_key *key) 441 + { 442 + int key_bytes = DIV_ROUND_UP(key->sadb_key_bits, 8); 443 + 444 + return DIV_ROUND_UP(sizeof(struct sadb_key) + key_bytes, 445 + sizeof(uint64_t)); 446 + } 447 + 448 + static int verify_key_len(const void *p) 449 + { 450 + const struct sadb_key *key = p; 451 + 452 + if (sadb_key_len(key) > key->sadb_key_len) 453 + return -EINVAL; 454 + 455 + return 0; 456 + } 457 + 440 458 static inline int pfkey_sec_ctx_len(const struct sadb_x_sec_ctx *sec_ctx) 441 459 { 442 460 return DIV_ROUND_UP(sizeof(struct sadb_x_sec_ctx) + ··· 551 533 return -EINVAL; 552 534 if (ext_hdrs[ext_type-1] != NULL) 553 535 return -EINVAL; 554 - if (ext_type == SADB_EXT_ADDRESS_SRC || 555 - ext_type == SADB_EXT_ADDRESS_DST || 556 - ext_type == SADB_EXT_ADDRESS_PROXY || 557 - ext_type == SADB_X_EXT_NAT_T_OA) { 536 + switch (ext_type) { 537 + case SADB_EXT_ADDRESS_SRC: 538 + case SADB_EXT_ADDRESS_DST: 539 + case SADB_EXT_ADDRESS_PROXY: 540 + case SADB_X_EXT_NAT_T_OA: 558 541 if (verify_address_len(p)) 559 542 return -EINVAL; 560 - } 561 - if (ext_type == SADB_X_EXT_SEC_CTX) { 543 + break; 544 + case SADB_X_EXT_SEC_CTX: 562 545 if (verify_sec_ctx_len(p)) 563 546 return -EINVAL; 547 + break; 548 + case SADB_EXT_KEY_AUTH: 549 + case SADB_EXT_KEY_ENCRYPT: 550 + if (verify_key_len(p)) 551 + return -EINVAL; 552 + break; 553 + default: 554 + break; 564 555 } 565 556 ext_hdrs[ext_type-1] = (void *) p; 566 557 } ··· 1131 1104 key = ext_hdrs[SADB_EXT_KEY_AUTH - 1]; 1132 1105 if (key != NULL && 1133 1106 sa->sadb_sa_auth != SADB_X_AALG_NULL && 1134 - ((key->sadb_key_bits+7) / 8 == 0 || 1135 - (key->sadb_key_bits+7) / 8 > key->sadb_key_len * sizeof(uint64_t))) 1107 + key->sadb_key_bits == 0) 1136 1108 return ERR_PTR(-EINVAL); 1137 1109 key = ext_hdrs[SADB_EXT_KEY_ENCRYPT-1]; 1138 1110 if (key != NULL && 1139 1111 sa->sadb_sa_encrypt != SADB_EALG_NULL && 1140 - ((key->sadb_key_bits+7) / 8 == 0 || 1141 - (key->sadb_key_bits+7) / 8 > key->sadb_key_len * sizeof(uint64_t))) 1112 + key->sadb_key_bits == 0) 1142 1113 return ERR_PTR(-EINVAL); 1143 1114 1144 1115 x = xfrm_state_alloc(net);

+3

net/llc/af_llc.c

··· 930 930 if (size > llc->dev->mtu) 931 931 size = llc->dev->mtu; 932 932 copied = size - hdrlen; 933 + rc = -EINVAL; 934 + if (copied < 0) 935 + goto release; 933 936 release_sock(sk); 934 937 skb = sock_alloc_send_skb(sk, size, noblock, &rc); 935 938 lock_sock(sk);

+4

net/mac80211/agg-tx.c

··· 8 8 * Copyright 2007, Michael Wu <flamingice@sourmilk.net> 9 9 * Copyright 2007-2010, Intel Corporation 10 10 * Copyright(c) 2015-2017 Intel Deutschland GmbH 11 + * Copyright (C) 2018 Intel Corporation 11 12 * 12 13 * This program is free software; you can redistribute it and/or modify 13 14 * it under the terms of the GNU General Public License version 2 as ··· 970 969 ieee80211_agg_tx_operational(local, sta, tid); 971 970 972 971 sta->ampdu_mlme.addba_req_num[tid] = 0; 972 + 973 + tid_tx->timeout = 974 + le16_to_cpu(mgmt->u.action.u.addba_resp.timeout); 973 975 974 976 if (tid_tx->timeout) { 975 977 mod_timer(&tid_tx->session_timer,

+19 -8

net/mac80211/mlme.c

··· 36 36 #define IEEE80211_AUTH_TIMEOUT (HZ / 5) 37 37 #define IEEE80211_AUTH_TIMEOUT_LONG (HZ / 2) 38 38 #define IEEE80211_AUTH_TIMEOUT_SHORT (HZ / 10) 39 + #define IEEE80211_AUTH_TIMEOUT_SAE (HZ * 2) 39 40 #define IEEE80211_AUTH_MAX_TRIES 3 40 41 #define IEEE80211_AUTH_WAIT_ASSOC (HZ * 5) 41 42 #define IEEE80211_ASSOC_TIMEOUT (HZ / 5) ··· 1788 1787 params[ac].acm = acm; 1789 1788 params[ac].uapsd = uapsd; 1790 1789 1791 - if (params->cw_min == 0 || 1790 + if (params[ac].cw_min == 0 || 1792 1791 params[ac].cw_min > params[ac].cw_max) { 1793 1792 sdata_info(sdata, 1794 1793 "AP has invalid WMM params (CWmin/max=%d/%d for ACI %d), using defaults\n", ··· 3815 3814 tx_flags); 3816 3815 3817 3816 if (tx_flags == 0) { 3818 - auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT; 3819 - auth_data->timeout_started = true; 3820 - run_again(sdata, auth_data->timeout); 3817 + if (auth_data->algorithm == WLAN_AUTH_SAE) 3818 + auth_data->timeout = jiffies + 3819 + IEEE80211_AUTH_TIMEOUT_SAE; 3820 + else 3821 + auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT; 3821 3822 } else { 3822 3823 auth_data->timeout = 3823 3824 round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG); 3824 - auth_data->timeout_started = true; 3825 - run_again(sdata, auth_data->timeout); 3826 3825 } 3826 + 3827 + auth_data->timeout_started = true; 3828 + run_again(sdata, auth_data->timeout); 3827 3829 3828 3830 return 0; 3829 3831 } ··· 3898 3894 ifmgd->status_received = false; 3899 3895 if (ifmgd->auth_data && ieee80211_is_auth(fc)) { 3900 3896 if (status_acked) { 3901 - ifmgd->auth_data->timeout = 3902 - jiffies + IEEE80211_AUTH_TIMEOUT_SHORT; 3897 + if (ifmgd->auth_data->algorithm == 3898 + WLAN_AUTH_SAE) 3899 + ifmgd->auth_data->timeout = 3900 + jiffies + 3901 + IEEE80211_AUTH_TIMEOUT_SAE; 3902 + else 3903 + ifmgd->auth_data->timeout = 3904 + jiffies + 3905 + IEEE80211_AUTH_TIMEOUT_SHORT; 3903 3906 run_again(sdata, ifmgd->auth_data->timeout); 3904 3907 } else { 3905 3908 ifmgd->auth_data->timeout = jiffies - 1;

+2 -1

net/mac80211/tx.c

··· 4 4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz> 5 5 * Copyright 2007 Johannes Berg <johannes@sipsolutions.net> 6 6 * Copyright 2013-2014 Intel Mobile Communications GmbH 7 + * Copyright (C) 2018 Intel Corporation 7 8 * 8 9 * This program is free software; you can redistribute it and/or modify 9 10 * it under the terms of the GNU General Public License version 2 as ··· 1136 1135 } 1137 1136 1138 1137 /* reset session timer */ 1139 - if (reset_agg_timer && tid_tx->timeout) 1138 + if (reset_agg_timer) 1140 1139 tid_tx->last_tx = jiffies; 1141 1140 1142 1141 return queued;

+3 -3

net/netlink/af_netlink.c

··· 2606 2606 { 2607 2607 if (v == SEQ_START_TOKEN) { 2608 2608 seq_puts(seq, 2609 - "sk Eth Pid Groups " 2610 - "Rmem Wmem Dump Locks Drops Inode\n"); 2609 + "sk Eth Pid Groups " 2610 + "Rmem Wmem Dump Locks Drops Inode\n"); 2611 2611 } else { 2612 2612 struct sock *s = v; 2613 2613 struct netlink_sock *nlk = nlk_sk(s); 2614 2614 2615 - seq_printf(seq, "%pK %-3d %-6u %08x %-8d %-8d %d %-8d %-8d %-8lu\n", 2615 + seq_printf(seq, "%pK %-3d %-10u %08x %-8d %-8d %-5d %-8d %-8d %-8lu\n", 2616 2616 s, 2617 2617 s->sk_protocol, 2618 2618 nlk->portid,

+4

net/nsh/nsh.c

··· 57 57 return -ENOMEM; 58 58 nh = (struct nshhdr *)(skb->data); 59 59 length = nsh_hdr_len(nh); 60 + if (length < NSH_BASE_HDR_LEN) 61 + return -EINVAL; 60 62 inner_proto = tun_p_to_eth_p(nh->np); 61 63 if (!pskb_may_pull(skb, length)) 62 64 return -ENOMEM; ··· 92 90 if (unlikely(!pskb_may_pull(skb, NSH_BASE_HDR_LEN))) 93 91 goto out; 94 92 nsh_len = nsh_hdr_len(nsh_hdr(skb)); 93 + if (nsh_len < NSH_BASE_HDR_LEN) 94 + goto out; 95 95 if (unlikely(!pskb_may_pull(skb, nsh_len))) 96 96 goto out; 97 97

+3 -6

net/openvswitch/flow_netlink.c

··· 1712 1712 1713 1713 /* The nlattr stream should already have been validated */ 1714 1714 nla_for_each_nested(nla, attr, rem) { 1715 - if (tbl[nla_type(nla)].len == OVS_ATTR_NESTED) { 1716 - if (tbl[nla_type(nla)].next) 1717 - tbl = tbl[nla_type(nla)].next; 1718 - nlattr_set(nla, val, tbl); 1719 - } else { 1715 + if (tbl[nla_type(nla)].len == OVS_ATTR_NESTED) 1716 + nlattr_set(nla, val, tbl[nla_type(nla)].next ? : tbl); 1717 + else 1720 1718 memset(nla_data(nla), val, nla_len(nla)); 1721 - } 1722 1719 1723 1720 if (nla_type(nla) == OVS_KEY_ATTR_CT_STATE) 1724 1721 *(u32 *)nla_data(nla) &= CT_SUPPORTED_MASK;

+6 -1

net/rfkill/rfkill-gpio.c

··· 137 137 138 138 ret = rfkill_register(rfkill->rfkill_dev); 139 139 if (ret < 0) 140 - return ret; 140 + goto err_destroy; 141 141 142 142 platform_set_drvdata(pdev, rfkill); 143 143 144 144 dev_info(&pdev->dev, "%s device registered.\n", rfkill->name); 145 145 146 146 return 0; 147 + 148 + err_destroy: 149 + rfkill_destroy(rfkill->rfkill_dev); 150 + 151 + return ret; 147 152 } 148 153 149 154 static int rfkill_gpio_remove(struct platform_device *pdev)

+1 -1

net/rxrpc/af_rxrpc.c

··· 313 313 memset(&cp, 0, sizeof(cp)); 314 314 cp.local = rx->local; 315 315 cp.key = key; 316 - cp.security_level = 0; 316 + cp.security_level = rx->min_sec_level; 317 317 cp.exclusive = false; 318 318 cp.upgrade = upgrade; 319 319 cp.service_id = srx->srx_service;

+1

net/rxrpc/ar-internal.h

··· 476 476 RXRPC_CALL_SEND_PING, /* A ping will need to be sent */ 477 477 RXRPC_CALL_PINGING, /* Ping in process */ 478 478 RXRPC_CALL_RETRANS_TIMEOUT, /* Retransmission due to timeout occurred */ 479 + RXRPC_CALL_BEGAN_RX_TIMER, /* We began the expect_rx_by timer */ 479 480 }; 480 481 481 482 /*

+8 -3

net/rxrpc/conn_event.c

··· 40 40 } __attribute__((packed)) pkt; 41 41 struct rxrpc_ackinfo ack_info; 42 42 size_t len; 43 - int ioc; 43 + int ret, ioc; 44 44 u32 serial, mtu, call_id, padding; 45 45 46 46 _enter("%d", conn->debug_id); ··· 135 135 break; 136 136 } 137 137 138 - kernel_sendmsg(conn->params.local->socket, &msg, iov, ioc, len); 138 + ret = kernel_sendmsg(conn->params.local->socket, &msg, iov, ioc, len); 139 139 conn->params.peer->last_tx_at = ktime_get_real(); 140 + if (ret < 0) 141 + trace_rxrpc_tx_fail(conn->debug_id, serial, ret, 142 + rxrpc_tx_fail_call_final_resend); 143 + 140 144 _leave(""); 141 - return; 142 145 } 143 146 144 147 /* ··· 239 236 240 237 ret = kernel_sendmsg(conn->params.local->socket, &msg, iov, 2, len); 241 238 if (ret < 0) { 239 + trace_rxrpc_tx_fail(conn->debug_id, serial, ret, 240 + rxrpc_tx_fail_conn_abort); 242 241 _debug("sendmsg failed: %d", ret); 243 242 return -EAGAIN; 244 243 }

+1 -1

net/rxrpc/input.c

··· 971 971 if (timo) { 972 972 unsigned long now = jiffies, expect_rx_by; 973 973 974 - expect_rx_by = jiffies + timo; 974 + expect_rx_by = now + timo; 975 975 WRITE_ONCE(call->expect_rx_by, expect_rx_by); 976 976 rxrpc_reduce_call_timer(call, expect_rx_by, now, 977 977 rxrpc_timer_set_for_normal);

+2 -1

net/rxrpc/local_event.c

··· 71 71 72 72 ret = kernel_sendmsg(local->socket, &msg, iov, 2, len); 73 73 if (ret < 0) 74 - _debug("sendmsg failed: %d", ret); 74 + trace_rxrpc_tx_fail(local->debug_id, 0, ret, 75 + rxrpc_tx_fail_version_reply); 75 76 76 77 _leave(""); 77 78 }

+42 -15

net/rxrpc/local_object.c

··· 134 134 } 135 135 } 136 136 137 - /* we want to receive ICMP errors */ 138 - opt = 1; 139 - ret = kernel_setsockopt(local->socket, SOL_IP, IP_RECVERR, 140 - (char *) &opt, sizeof(opt)); 141 - if (ret < 0) { 142 - _debug("setsockopt failed"); 143 - goto error; 144 - } 137 + switch (local->srx.transport.family) { 138 + case AF_INET: 139 + /* we want to receive ICMP errors */ 140 + opt = 1; 141 + ret = kernel_setsockopt(local->socket, SOL_IP, IP_RECVERR, 142 + (char *) &opt, sizeof(opt)); 143 + if (ret < 0) { 144 + _debug("setsockopt failed"); 145 + goto error; 146 + } 145 147 146 - /* we want to set the don't fragment bit */ 147 - opt = IP_PMTUDISC_DO; 148 - ret = kernel_setsockopt(local->socket, SOL_IP, IP_MTU_DISCOVER, 149 - (char *) &opt, sizeof(opt)); 150 - if (ret < 0) { 151 - _debug("setsockopt failed"); 152 - goto error; 148 + /* we want to set the don't fragment bit */ 149 + opt = IP_PMTUDISC_DO; 150 + ret = kernel_setsockopt(local->socket, SOL_IP, IP_MTU_DISCOVER, 151 + (char *) &opt, sizeof(opt)); 152 + if (ret < 0) { 153 + _debug("setsockopt failed"); 154 + goto error; 155 + } 156 + break; 157 + 158 + case AF_INET6: 159 + /* we want to receive ICMP errors */ 160 + opt = 1; 161 + ret = kernel_setsockopt(local->socket, SOL_IPV6, IPV6_RECVERR, 162 + (char *) &opt, sizeof(opt)); 163 + if (ret < 0) { 164 + _debug("setsockopt failed"); 165 + goto error; 166 + } 167 + 168 + /* we want to set the don't fragment bit */ 169 + opt = IPV6_PMTUDISC_DO; 170 + ret = kernel_setsockopt(local->socket, SOL_IPV6, IPV6_MTU_DISCOVER, 171 + (char *) &opt, sizeof(opt)); 172 + if (ret < 0) { 173 + _debug("setsockopt failed"); 174 + goto error; 175 + } 176 + break; 177 + 178 + default: 179 + BUG(); 153 180 } 154 181 155 182 /* set the socket up */

+32 -2

net/rxrpc/output.c

··· 210 210 if (ping) 211 211 call->ping_time = now; 212 212 conn->params.peer->last_tx_at = ktime_get_real(); 213 + if (ret < 0) 214 + trace_rxrpc_tx_fail(call->debug_id, serial, ret, 215 + rxrpc_tx_fail_call_ack); 213 216 214 217 if (call->state < RXRPC_CALL_COMPLETE) { 215 218 if (ret < 0) { ··· 297 294 ret = kernel_sendmsg(conn->params.local->socket, 298 295 &msg, iov, 1, sizeof(pkt)); 299 296 conn->params.peer->last_tx_at = ktime_get_real(); 297 + if (ret < 0) 298 + trace_rxrpc_tx_fail(call->debug_id, serial, ret, 299 + rxrpc_tx_fail_call_abort); 300 + 300 301 301 302 rxrpc_put_connection(conn); 302 303 return ret; ··· 394 387 conn->params.peer->last_tx_at = ktime_get_real(); 395 388 396 389 up_read(&conn->params.local->defrag_sem); 390 + if (ret < 0) 391 + trace_rxrpc_tx_fail(call->debug_id, serial, ret, 392 + rxrpc_tx_fail_call_data_nofrag); 397 393 if (ret == -EMSGSIZE) 398 394 goto send_fragmentable; 399 395 ··· 423 413 rxrpc_reduce_call_timer(call, ack_lost_at, nowj, 424 414 rxrpc_timer_set_for_lost_ack); 425 415 } 416 + } 417 + 418 + if (sp->hdr.seq == 1 && 419 + !test_and_set_bit(RXRPC_CALL_BEGAN_RX_TIMER, 420 + &call->flags)) { 421 + unsigned long nowj = jiffies, expect_rx_by; 422 + 423 + expect_rx_by = nowj + call->next_rx_timo; 424 + WRITE_ONCE(call->expect_rx_by, expect_rx_by); 425 + rxrpc_reduce_call_timer(call, expect_rx_by, nowj, 426 + rxrpc_timer_set_for_normal); 426 427 } 427 428 } 428 429 ··· 486 465 #endif 487 466 } 488 467 468 + if (ret < 0) 469 + trace_rxrpc_tx_fail(call->debug_id, serial, ret, 470 + rxrpc_tx_fail_call_data_frag); 471 + 489 472 up_write(&conn->params.local->defrag_sem); 490 473 goto done; 491 474 } ··· 507 482 struct kvec iov[2]; 508 483 size_t size; 509 484 __be32 code; 485 + int ret; 510 486 511 487 _enter("%d", local->debug_id); 512 488 ··· 542 516 whdr.flags ^= RXRPC_CLIENT_INITIATED; 543 517 whdr.flags &= RXRPC_CLIENT_INITIATED; 544 518 545 - kernel_sendmsg(local->socket, &msg, iov, 2, size); 519 + ret = kernel_sendmsg(local->socket, &msg, iov, 2, size); 520 + if (ret < 0) 521 + trace_rxrpc_tx_fail(local->debug_id, 0, ret, 522 + rxrpc_tx_fail_reject); 546 523 } 547 524 548 525 rxrpc_free_skb(skb, rxrpc_skb_rx_freed); ··· 596 567 597 568 ret = kernel_sendmsg(peer->local->socket, &msg, iov, 2, len); 598 569 if (ret < 0) 599 - _debug("sendmsg failed: %d", ret); 570 + trace_rxrpc_tx_fail(peer->debug_id, 0, ret, 571 + rxrpc_tx_fail_version_keepalive); 600 572 601 573 peer->last_tx_at = ktime_get_real(); 602 574 _leave("");

+23 -23

net/rxrpc/peer_event.c

··· 28 28 * Find the peer associated with an ICMP packet. 29 29 */ 30 30 static struct rxrpc_peer *rxrpc_lookup_peer_icmp_rcu(struct rxrpc_local *local, 31 - const struct sk_buff *skb) 31 + const struct sk_buff *skb, 32 + struct sockaddr_rxrpc *srx) 32 33 { 33 34 struct sock_exterr_skb *serr = SKB_EXT_ERR(skb); 34 - struct sockaddr_rxrpc srx; 35 35 36 36 _enter(""); 37 37 38 - memset(&srx, 0, sizeof(srx)); 39 - srx.transport_type = local->srx.transport_type; 40 - srx.transport_len = local->srx.transport_len; 41 - srx.transport.family = local->srx.transport.family; 38 + memset(srx, 0, sizeof(*srx)); 39 + srx->transport_type = local->srx.transport_type; 40 + srx->transport_len = local->srx.transport_len; 41 + srx->transport.family = local->srx.transport.family; 42 42 43 43 /* Can we see an ICMP4 packet on an ICMP6 listening socket? and vice 44 44 * versa? 45 45 */ 46 - switch (srx.transport.family) { 46 + switch (srx->transport.family) { 47 47 case AF_INET: 48 - srx.transport.sin.sin_port = serr->port; 48 + srx->transport.sin.sin_port = serr->port; 49 49 switch (serr->ee.ee_origin) { 50 50 case SO_EE_ORIGIN_ICMP: 51 51 _net("Rx ICMP"); 52 - memcpy(&srx.transport.sin.sin_addr, 52 + memcpy(&srx->transport.sin.sin_addr, 53 53 skb_network_header(skb) + serr->addr_offset, 54 54 sizeof(struct in_addr)); 55 55 break; 56 56 case SO_EE_ORIGIN_ICMP6: 57 57 _net("Rx ICMP6 on v4 sock"); 58 - memcpy(&srx.transport.sin.sin_addr, 58 + memcpy(&srx->transport.sin.sin_addr, 59 59 skb_network_header(skb) + serr->addr_offset + 12, 60 60 sizeof(struct in_addr)); 61 61 break; 62 62 default: 63 - memcpy(&srx.transport.sin.sin_addr, &ip_hdr(skb)->saddr, 63 + memcpy(&srx->transport.sin.sin_addr, &ip_hdr(skb)->saddr, 64 64 sizeof(struct in_addr)); 65 65 break; 66 66 } ··· 68 68 69 69 #ifdef CONFIG_AF_RXRPC_IPV6 70 70 case AF_INET6: 71 - srx.transport.sin6.sin6_port = serr->port; 71 + srx->transport.sin6.sin6_port = serr->port; 72 72 switch (serr->ee.ee_origin) { 73 73 case SO_EE_ORIGIN_ICMP6: 74 74 _net("Rx ICMP6"); 75 - memcpy(&srx.transport.sin6.sin6_addr, 75 + memcpy(&srx->transport.sin6.sin6_addr, 76 76 skb_network_header(skb) + serr->addr_offset, 77 77 sizeof(struct in6_addr)); 78 78 break; 79 79 case SO_EE_ORIGIN_ICMP: 80 80 _net("Rx ICMP on v6 sock"); 81 - srx.transport.sin6.sin6_addr.s6_addr32[0] = 0; 82 - srx.transport.sin6.sin6_addr.s6_addr32[1] = 0; 83 - srx.transport.sin6.sin6_addr.s6_addr32[2] = htonl(0xffff); 84 - memcpy(srx.transport.sin6.sin6_addr.s6_addr + 12, 81 + srx->transport.sin6.sin6_addr.s6_addr32[0] = 0; 82 + srx->transport.sin6.sin6_addr.s6_addr32[1] = 0; 83 + srx->transport.sin6.sin6_addr.s6_addr32[2] = htonl(0xffff); 84 + memcpy(srx->transport.sin6.sin6_addr.s6_addr + 12, 85 85 skb_network_header(skb) + serr->addr_offset, 86 86 sizeof(struct in_addr)); 87 87 break; 88 88 default: 89 - memcpy(&srx.transport.sin6.sin6_addr, 89 + memcpy(&srx->transport.sin6.sin6_addr, 90 90 &ipv6_hdr(skb)->saddr, 91 91 sizeof(struct in6_addr)); 92 92 break; ··· 98 98 BUG(); 99 99 } 100 100 101 - return rxrpc_lookup_peer_rcu(local, &srx); 101 + return rxrpc_lookup_peer_rcu(local, srx); 102 102 } 103 103 104 104 /* ··· 146 146 void rxrpc_error_report(struct sock *sk) 147 147 { 148 148 struct sock_exterr_skb *serr; 149 + struct sockaddr_rxrpc srx; 149 150 struct rxrpc_local *local = sk->sk_user_data; 150 151 struct rxrpc_peer *peer; 151 152 struct sk_buff *skb; ··· 167 166 } 168 167 169 168 rcu_read_lock(); 170 - peer = rxrpc_lookup_peer_icmp_rcu(local, skb); 169 + peer = rxrpc_lookup_peer_icmp_rcu(local, skb, &srx); 171 170 if (peer && !rxrpc_get_peer_maybe(peer)) 172 171 peer = NULL; 173 172 if (!peer) { ··· 176 175 _leave(" [no peer]"); 177 176 return; 178 177 } 178 + 179 + trace_rxrpc_rx_icmp(peer, &serr->ee, &srx); 179 180 180 181 if ((serr->ee.ee_origin == SO_EE_ORIGIN_ICMP && 181 182 serr->ee.ee_type == ICMP_DEST_UNREACH && ··· 211 208 _enter(""); 212 209 213 210 ee = &serr->ee; 214 - 215 - _net("Rx Error o=%d t=%d c=%d e=%d", 216 - ee->ee_origin, ee->ee_type, ee->ee_code, ee->ee_errno); 217 211 218 212 err = ee->ee_errno; 219 213

+4 -2

net/rxrpc/rxkad.c

··· 664 664 665 665 ret = kernel_sendmsg(conn->params.local->socket, &msg, iov, 2, len); 666 666 if (ret < 0) { 667 - _debug("sendmsg failed: %d", ret); 667 + trace_rxrpc_tx_fail(conn->debug_id, serial, ret, 668 + rxrpc_tx_fail_conn_challenge); 668 669 return -EAGAIN; 669 670 } 670 671 ··· 720 719 721 720 ret = kernel_sendmsg(conn->params.local->socket, &msg, iov, 3, len); 722 721 if (ret < 0) { 723 - _debug("sendmsg failed: %d", ret); 722 + trace_rxrpc_tx_fail(conn->debug_id, serial, ret, 723 + rxrpc_tx_fail_conn_response); 724 724 return -EAGAIN; 725 725 } 726 726

+10

net/rxrpc/sendmsg.c

··· 223 223 224 224 ret = rxrpc_send_data_packet(call, skb, false); 225 225 if (ret < 0) { 226 + switch (ret) { 227 + case -ENETUNREACH: 228 + case -EHOSTUNREACH: 229 + case -ECONNREFUSED: 230 + rxrpc_set_call_completion(call, 231 + RXRPC_CALL_LOCAL_ERROR, 232 + 0, ret); 233 + goto out; 234 + } 226 235 _debug("need instant resend %d", ret); 227 236 rxrpc_instant_resend(call, ix); 228 237 } else { ··· 250 241 rxrpc_timer_set_for_send); 251 242 } 252 243 244 + out: 253 245 rxrpc_free_skb(skb, rxrpc_skb_tx_freed); 254 246 _leave(""); 255 247 }

+2 -1

net/sched/act_skbedit.c

··· 121 121 return 0; 122 122 123 123 if (!flags) { 124 - tcf_idr_release(*a, bind); 124 + if (exists) 125 + tcf_idr_release(*a, bind); 125 126 return -EINVAL; 126 127 } 127 128

+4 -1

net/sched/act_skbmod.c

··· 131 131 if (exists && bind) 132 132 return 0; 133 133 134 - if (!lflags) 134 + if (!lflags) { 135 + if (exists) 136 + tcf_idr_release(*a, bind); 135 137 return -EINVAL; 138 + } 136 139 137 140 if (!exists) { 138 141 ret = tcf_idr_create(tn, parm->index, est, a,

+1 -1

net/sched/cls_api.c

··· 152 152 NL_SET_ERR_MSG(extack, "TC classifier not found"); 153 153 err = -ENOENT; 154 154 } 155 - goto errout; 156 155 #endif 156 + goto errout; 157 157 } 158 158 tp->classify = tp->ops->classify; 159 159 tp->protocol = protocol;

+29 -1

net/sctp/associola.c

··· 1024 1024 struct sctp_endpoint *ep; 1025 1025 struct sctp_chunk *chunk; 1026 1026 struct sctp_inq *inqueue; 1027 - int state; 1027 + int first_time = 1; /* is this the first time through the loop */ 1028 1028 int error = 0; 1029 + int state; 1029 1030 1030 1031 /* The association should be held so we should be safe. */ 1031 1032 ep = asoc->ep; ··· 1037 1036 state = asoc->state; 1038 1037 subtype = SCTP_ST_CHUNK(chunk->chunk_hdr->type); 1039 1038 1039 + /* If the first chunk in the packet is AUTH, do special 1040 + * processing specified in Section 6.3 of SCTP-AUTH spec 1041 + */ 1042 + if (first_time && subtype.chunk == SCTP_CID_AUTH) { 1043 + struct sctp_chunkhdr *next_hdr; 1044 + 1045 + next_hdr = sctp_inq_peek(inqueue); 1046 + if (!next_hdr) 1047 + goto normal; 1048 + 1049 + /* If the next chunk is COOKIE-ECHO, skip the AUTH 1050 + * chunk while saving a pointer to it so we can do 1051 + * Authentication later (during cookie-echo 1052 + * processing). 1053 + */ 1054 + if (next_hdr->type == SCTP_CID_COOKIE_ECHO) { 1055 + chunk->auth_chunk = skb_clone(chunk->skb, 1056 + GFP_ATOMIC); 1057 + chunk->auth = 1; 1058 + continue; 1059 + } 1060 + } 1061 + 1062 + normal: 1040 1063 /* SCTP-AUTH, Section 6.3: 1041 1064 * The receiver has a list of chunk types which it expects 1042 1065 * to be received only after an AUTH-chunk. This list has ··· 1099 1074 /* If there is an error on chunk, discard this packet. */ 1100 1075 if (error && chunk) 1101 1076 chunk->pdiscard = 1; 1077 + 1078 + if (first_time) 1079 + first_time = 0; 1102 1080 } 1103 1081 sctp_association_put(asoc); 1104 1082 }

+1 -1

net/sctp/sm_make_chunk.c

··· 1152 1152 const struct sctp_association *asoc, 1153 1153 const struct sctp_chunk *chunk) 1154 1154 { 1155 - static const char error[] = "Association exceeded its max_retans count"; 1155 + static const char error[] = "Association exceeded its max_retrans count"; 1156 1156 size_t payload_len = sizeof(error) + sizeof(struct sctp_errhdr); 1157 1157 struct sctp_chunk *retval; 1158 1158

+46 -40

net/sctp/sm_statefuns.c

··· 153 153 struct sctp_cmd_seq *commands); 154 154 155 155 static enum sctp_ierror sctp_sf_authenticate( 156 - struct net *net, 157 - const struct sctp_endpoint *ep, 158 156 const struct sctp_association *asoc, 159 - const union sctp_subtype type, 160 157 struct sctp_chunk *chunk); 161 158 162 159 static enum sctp_disposition __sctp_sf_do_9_1_abort( ··· 623 626 return SCTP_DISPOSITION_CONSUME; 624 627 } 625 628 629 + static bool sctp_auth_chunk_verify(struct net *net, struct sctp_chunk *chunk, 630 + const struct sctp_association *asoc) 631 + { 632 + struct sctp_chunk auth; 633 + 634 + if (!chunk->auth_chunk) 635 + return true; 636 + 637 + /* SCTP-AUTH: auth_chunk pointer is only set when the cookie-echo 638 + * is supposed to be authenticated and we have to do delayed 639 + * authentication. We've just recreated the association using 640 + * the information in the cookie and now it's much easier to 641 + * do the authentication. 642 + */ 643 + 644 + /* Make sure that we and the peer are AUTH capable */ 645 + if (!net->sctp.auth_enable || !asoc->peer.auth_capable) 646 + return false; 647 + 648 + /* set-up our fake chunk so that we can process it */ 649 + auth.skb = chunk->auth_chunk; 650 + auth.asoc = chunk->asoc; 651 + auth.sctp_hdr = chunk->sctp_hdr; 652 + auth.chunk_hdr = (struct sctp_chunkhdr *) 653 + skb_push(chunk->auth_chunk, 654 + sizeof(struct sctp_chunkhdr)); 655 + skb_pull(chunk->auth_chunk, sizeof(struct sctp_chunkhdr)); 656 + auth.transport = chunk->transport; 657 + 658 + return sctp_sf_authenticate(asoc, &auth) == SCTP_IERROR_NO_ERROR; 659 + } 660 + 626 661 /* 627 662 * Respond to a normal COOKIE ECHO chunk. 628 663 * We are the side that is being asked for an association. ··· 792 763 if (error) 793 764 goto nomem_init; 794 765 795 - /* SCTP-AUTH: auth_chunk pointer is only set when the cookie-echo 796 - * is supposed to be authenticated and we have to do delayed 797 - * authentication. We've just recreated the association using 798 - * the information in the cookie and now it's much easier to 799 - * do the authentication. 800 - */ 801 - if (chunk->auth_chunk) { 802 - struct sctp_chunk auth; 803 - enum sctp_ierror ret; 804 - 805 - /* Make sure that we and the peer are AUTH capable */ 806 - if (!net->sctp.auth_enable || !new_asoc->peer.auth_capable) { 807 - sctp_association_free(new_asoc); 808 - return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 809 - } 810 - 811 - /* set-up our fake chunk so that we can process it */ 812 - auth.skb = chunk->auth_chunk; 813 - auth.asoc = chunk->asoc; 814 - auth.sctp_hdr = chunk->sctp_hdr; 815 - auth.chunk_hdr = (struct sctp_chunkhdr *) 816 - skb_push(chunk->auth_chunk, 817 - sizeof(struct sctp_chunkhdr)); 818 - skb_pull(chunk->auth_chunk, sizeof(struct sctp_chunkhdr)); 819 - auth.transport = chunk->transport; 820 - 821 - ret = sctp_sf_authenticate(net, ep, new_asoc, type, &auth); 822 - if (ret != SCTP_IERROR_NO_ERROR) { 823 - sctp_association_free(new_asoc); 824 - return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 825 - } 766 + if (!sctp_auth_chunk_verify(net, chunk, new_asoc)) { 767 + sctp_association_free(new_asoc); 768 + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 826 769 } 827 770 828 771 repl = sctp_make_cookie_ack(new_asoc, chunk); ··· 1798 1797 if (sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC)) 1799 1798 goto nomem; 1800 1799 1800 + if (!sctp_auth_chunk_verify(net, chunk, new_asoc)) 1801 + return SCTP_DISPOSITION_DISCARD; 1802 + 1801 1803 /* Make sure no new addresses are being added during the 1802 1804 * restart. Though this is a pretty complicated attack 1803 1805 * since you'd have to get inside the cookie. 1804 1806 */ 1805 - if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk, commands)) { 1807 + if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk, commands)) 1806 1808 return SCTP_DISPOSITION_CONSUME; 1807 - } 1808 1809 1809 1810 /* If the endpoint is in the SHUTDOWN-ACK-SENT state and recognizes 1810 1811 * the peer has restarted (Action A), it MUST NOT setup a new ··· 1915 1912 if (sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC)) 1916 1913 goto nomem; 1917 1914 1915 + if (!sctp_auth_chunk_verify(net, chunk, new_asoc)) 1916 + return SCTP_DISPOSITION_DISCARD; 1917 + 1918 1918 /* Update the content of current association. */ 1919 1919 sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc)); 1920 1920 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE, ··· 2014 2008 * It should stop any cookie timer that may be running and send 2015 2009 * a COOKIE ACK. 2016 2010 */ 2011 + 2012 + if (!sctp_auth_chunk_verify(net, chunk, asoc)) 2013 + return SCTP_DISPOSITION_DISCARD; 2017 2014 2018 2015 /* Don't accidentally move back into established state. */ 2019 2016 if (asoc->state < SCTP_STATE_ESTABLISHED) { ··· 4180 4171 * The return value is the disposition of the chunk. 4181 4172 */ 4182 4173 static enum sctp_ierror sctp_sf_authenticate( 4183 - struct net *net, 4184 - const struct sctp_endpoint *ep, 4185 4174 const struct sctp_association *asoc, 4186 - const union sctp_subtype type, 4187 4175 struct sctp_chunk *chunk) 4188 4176 { 4189 4177 struct sctp_shared_key *sh_key = NULL; ··· 4281 4275 commands); 4282 4276 4283 4277 auth_hdr = (struct sctp_authhdr *)chunk->skb->data; 4284 - error = sctp_sf_authenticate(net, ep, asoc, type, chunk); 4278 + error = sctp_sf_authenticate(asoc, chunk); 4285 4279 switch (error) { 4286 4280 case SCTP_IERROR_AUTH_BAD_HMAC: 4287 4281 /* Generate the ERROR chunk and discard the rest

-1

net/sctp/ulpevent.c

··· 715 715 return event; 716 716 717 717 fail_mark: 718 - sctp_chunk_put(chunk); 719 718 kfree_skb(skb); 720 719 fail: 721 720 return NULL;

+13 -2

net/tipc/node.c

··· 1950 1950 int tipc_nl_node_get_link(struct sk_buff *skb, struct genl_info *info) 1951 1951 { 1952 1952 struct net *net = genl_info_net(info); 1953 + struct nlattr *attrs[TIPC_NLA_LINK_MAX + 1]; 1953 1954 struct tipc_nl_msg msg; 1954 1955 char *name; 1955 1956 int err; ··· 1958 1957 msg.portid = info->snd_portid; 1959 1958 msg.seq = info->snd_seq; 1960 1959 1961 - if (!info->attrs[TIPC_NLA_LINK_NAME]) 1960 + if (!info->attrs[TIPC_NLA_LINK]) 1962 1961 return -EINVAL; 1963 - name = nla_data(info->attrs[TIPC_NLA_LINK_NAME]); 1962 + 1963 + err = nla_parse_nested(attrs, TIPC_NLA_LINK_MAX, 1964 + info->attrs[TIPC_NLA_LINK], 1965 + tipc_nl_link_policy, info->extack); 1966 + if (err) 1967 + return err; 1968 + 1969 + if (!attrs[TIPC_NLA_LINK_NAME]) 1970 + return -EINVAL; 1971 + 1972 + name = nla_data(attrs[TIPC_NLA_LINK_NAME]); 1964 1973 1965 1974 msg.skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 1966 1975 if (!msg.skb)

+2 -1

net/tipc/socket.c

··· 1516 1516 1517 1517 srcaddr->sock.family = AF_TIPC; 1518 1518 srcaddr->sock.addrtype = TIPC_ADDR_ID; 1519 + srcaddr->sock.scope = 0; 1519 1520 srcaddr->sock.addr.id.ref = msg_origport(hdr); 1520 1521 srcaddr->sock.addr.id.node = msg_orignode(hdr); 1521 1522 srcaddr->sock.addr.name.domain = 0; 1522 - srcaddr->sock.scope = 0; 1523 1523 m->msg_namelen = sizeof(struct sockaddr_tipc); 1524 1524 1525 1525 if (!msg_in_group(hdr)) ··· 1528 1528 /* Group message users may also want to know sending member's id */ 1529 1529 srcaddr->member.family = AF_TIPC; 1530 1530 srcaddr->member.addrtype = TIPC_ADDR_NAME; 1531 + srcaddr->member.scope = 0; 1531 1532 srcaddr->member.addr.name.name.type = msg_nametype(hdr); 1532 1533 srcaddr->member.addr.name.name.instance = TIPC_SKB_CB(skb)->orig_member; 1533 1534 srcaddr->member.addr.name.domain = 0;

+5 -7

net/tls/tls_main.c

··· 135 135 offset -= sg->offset; 136 136 ctx->partially_sent_offset = offset; 137 137 ctx->partially_sent_record = (void *)sg; 138 + ctx->in_tcp_sendpages = false; 138 139 return ret; 139 140 } 140 141 ··· 249 248 struct tls_context *ctx = tls_get_ctx(sk); 250 249 long timeo = sock_sndtimeo(sk, 0); 251 250 void (*sk_proto_close)(struct sock *sk, long timeout); 251 + bool free_ctx = false; 252 252 253 253 lock_sock(sk); 254 254 sk_proto_close = ctx->sk_proto_close; 255 255 256 - if (ctx->conf == TLS_HW_RECORD) 257 - goto skip_tx_cleanup; 258 - 259 - if (ctx->conf == TLS_BASE) { 260 - kfree(ctx); 261 - ctx = NULL; 256 + if (ctx->conf == TLS_BASE || ctx->conf == TLS_HW_RECORD) { 257 + free_ctx = true; 262 258 goto skip_tx_cleanup; 263 259 } 264 260 ··· 292 294 /* free ctx for TLS_HW_RECORD, used by tcp_set_state 293 295 * for sk->sk_prot->unhash [tls_hw_unhash] 294 296 */ 295 - if (ctx && ctx->conf == TLS_HW_RECORD) 297 + if (free_ctx) 296 298 kfree(ctx); 297 299 } 298 300

+3

net/wireless/core.c

··· 95 95 96 96 ASSERT_RTNL(); 97 97 98 + if (strlen(newname) > NL80211_WIPHY_NAME_MAXLEN) 99 + return -EINVAL; 100 + 98 101 /* prohibit calling the thing phy%d when %d is not its number */ 99 102 sscanf(newname, PHY_NAME "%d%n", &wiphy_idx, &taken); 100 103 if (taken == strlen(newname) && wiphy_idx != rdev->wiphy_idx) {

+1

net/wireless/nl80211.c

··· 9214 9214 9215 9215 if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) { 9216 9216 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 9217 + kzfree(connkeys); 9217 9218 GENL_SET_ERR_MSG(info, 9218 9219 "external auth requires connection ownership"); 9219 9220 return -EINVAL;

+1

net/wireless/reg.c

··· 1026 1026 1027 1027 if (!tmp_rd) { 1028 1028 kfree(regdom); 1029 + kfree(wmm_ptrs); 1029 1030 return -ENOMEM; 1030 1031 } 1031 1032 regdom = tmp_rd;

+6

net/xfrm/xfrm_state.c

··· 2175 2175 return afinfo; 2176 2176 } 2177 2177 2178 + void xfrm_flush_gc(void) 2179 + { 2180 + flush_work(&xfrm_state_gc_work); 2181 + } 2182 + EXPORT_SYMBOL(xfrm_flush_gc); 2183 + 2178 2184 /* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */ 2179 2185 void xfrm_state_delete_tunnel(struct xfrm_state *x) 2180 2186 {

+1 -1

tools/testing/selftests/net/Makefile

··· 6 6 7 7 TEST_PROGS := run_netsocktests run_afpackettests test_bpf.sh netdevice.sh rtnetlink.sh 8 8 TEST_PROGS += fib_tests.sh fib-onlink-tests.sh pmtu.sh 9 - TEST_GEN_PROGS_EXTENDED := in_netns.sh 9 + TEST_PROGS_EXTENDED := in_netns.sh 10 10 TEST_GEN_FILES = socket 11 11 TEST_GEN_FILES += psock_fanout psock_tpacket msg_zerocopy 12 12 TEST_GEN_PROGS = reuseport_bpf reuseport_bpf_cpu reuseport_bpf_numa

+8 -3

tools/testing/selftests/tc-testing/tc-tests/actions/bpf.json

··· 66 66 "cmdUnderTest": "$TC action add action bpf object-file _b.o index 667", 67 67 "expExitCode": "0", 68 68 "verifyCmd": "$TC action get action bpf index 667", 69 - "matchPattern": "action order [0-9]*: bpf _b.o:\\[action\\] id [0-9]* tag 3b185187f1855c4c default-action pipe.*index 667 ref", 69 + "matchPattern": "action order [0-9]*: bpf _b.o:\\[action\\] id [0-9]* tag 3b185187f1855c4c( jited)? default-action pipe.*index 667 ref", 70 70 "matchCount": "1", 71 71 "teardown": [ 72 72 "$TC action flush action bpf", ··· 92 92 "cmdUnderTest": "$TC action add action bpf object-file _c.o index 667", 93 93 "expExitCode": "255", 94 94 "verifyCmd": "$TC action get action bpf index 667", 95 - "matchPattern": "action order [0-9]*: bpf _b.o:\\[action\\] id [0-9].*index 667 ref", 95 + "matchPattern": "action order [0-9]*: bpf _c.o:\\[action\\] id [0-9].*index 667 ref", 96 96 "matchCount": "0", 97 97 "teardown": [ 98 - "$TC action flush action bpf", 98 + [ 99 + "$TC action flush action bpf", 100 + 0, 101 + 1, 102 + 255 103 + ], 99 104 "rm -f _c.o" 100 105 ] 101 106 },

Configure Feed

Configure Feed