tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

1) We have to be careful to not try and place a checksum after the end
of a rawv6 packet, fix from Dave Jones with help from Hannes
Frederic Sowa.

2) Missing memory barriers in tcp_tasklet_func() lead to crashes, from
Eric Dumazet.

3) Several bug fixes for the new XDP support in virtio_net, from Jason
Wang.

4) Increase headroom in RX skbs in be2net driver to accomodate
encapsulations such as geneve. From Kalesh A P.

5) Fix SKB frag unmapping on TX in mvpp2, from Thomas Petazzoni.

6) Pre-pulling UDP headers created a regression in RECVORIGDSTADDR
socket option support, from Willem de Bruijn.

7) UID based routing added a potential OOPS in ip_do_redirect() when we
see an SKB without a socket attached. We just need it for the
network namespace which we can get from skb->dev instead. Fix from
Lorenzo Colitti.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (30 commits)
sctp: fix recovering from 0 win with small data chunks
sctp: do not loose window information if in rwnd_over
virtio-net: XDP support for small buffers
virtio-net: remove big packet XDP codes
virtio-net: forbid XDP when VIRTIO_NET_F_GUEST_UFO is support
virtio-net: make rx buf size estimation works for XDP
virtio-net: unbreak csumed packets for XDP_PASS
virtio-net: correctly handle XDP_PASS for linearized packets
virtio-net: fix page miscount during XDP linearizing
virtio-net: correctly xmit linearized page on XDP_TX
virtio-net: remove the warning before XDP linearizing
mlxsw: spectrum_router: Correctly remove nexthop groups
mlxsw: spectrum_router: Don't reflect dead neighs
neigh: Send netevent after marking neigh as dead
ipv6: handle -EFAULT from skb_copy_bits
inet: fix IP(V6)_RECVORIGDSTADDR for udp sockets
net/sched: cls_flower: Mandate mask when matching on flags
net/sched: act_tunnel_key: Fix setting UDP dst port in metadata under IPv6
stmmac: CSR clock configuration fix
net: ipv4: Don't crash if passing a null sk to ip_do_redirect.
...

Linus Torvalds 50b17cfb a307d0a0

+198 -147
+1 -1
drivers/net/ethernet/emulex/benet/be.h
··· 65 65 /* Number of bytes of an RX frame that are copied to skb->data */ 66 66 #define BE_HDR_LEN ((u16) 64) 67 67 /* allocate extra space to allow tunneling decapsulation without head reallocation */ 68 - #define BE_RX_SKB_ALLOC_SIZE (BE_HDR_LEN + 64) 68 + #define BE_RX_SKB_ALLOC_SIZE 256 69 69 70 70 #define BE_MAX_JUMBO_FRAME_SIZE 9018 71 71 #define BE_MIN_MTU 256
+30 -29
drivers/net/ethernet/marvell/mvpp2.c
··· 770 770 u32 reserved8; 771 771 }; 772 772 773 + struct mvpp2_txq_pcpu_buf { 774 + /* Transmitted SKB */ 775 + struct sk_buff *skb; 776 + 777 + /* Physical address of transmitted buffer */ 778 + dma_addr_t phys; 779 + 780 + /* Size transmitted */ 781 + size_t size; 782 + }; 783 + 773 784 /* Per-CPU Tx queue control */ 774 785 struct mvpp2_txq_pcpu { 775 786 int cpu; ··· 796 785 /* Number of Tx DMA descriptors reserved for each CPU */ 797 786 int reserved_num; 798 787 799 - /* Array of transmitted skb */ 800 - struct sk_buff **tx_skb; 801 - 802 - /* Array of transmitted buffers' physical addresses */ 803 - dma_addr_t *tx_buffs; 788 + /* Infos about transmitted buffers */ 789 + struct mvpp2_txq_pcpu_buf *buffs; 804 790 805 791 /* Index of last TX DMA descriptor that was inserted */ 806 792 int txq_put_index; ··· 987 979 struct sk_buff *skb, 988 980 struct mvpp2_tx_desc *tx_desc) 989 981 { 990 - txq_pcpu->tx_skb[txq_pcpu->txq_put_index] = skb; 991 - if (skb) 992 - txq_pcpu->tx_buffs[txq_pcpu->txq_put_index] = 993 - tx_desc->buf_phys_addr; 982 + struct mvpp2_txq_pcpu_buf *tx_buf = 983 + txq_pcpu->buffs + txq_pcpu->txq_put_index; 984 + tx_buf->skb = skb; 985 + tx_buf->size = tx_desc->data_size; 986 + tx_buf->phys = tx_desc->buf_phys_addr; 994 987 txq_pcpu->txq_put_index++; 995 988 if (txq_pcpu->txq_put_index == txq_pcpu->size) 996 989 txq_pcpu->txq_put_index = 0; ··· 4410 4401 int i; 4411 4402 4412 4403 for (i = 0; i < num; i++) { 4413 - dma_addr_t buf_phys_addr = 4414 - txq_pcpu->tx_buffs[txq_pcpu->txq_get_index]; 4415 - struct sk_buff *skb = txq_pcpu->tx_skb[txq_pcpu->txq_get_index]; 4404 + struct mvpp2_txq_pcpu_buf *tx_buf = 4405 + txq_pcpu->buffs + txq_pcpu->txq_get_index; 4416 4406 4417 4407 mvpp2_txq_inc_get(txq_pcpu); 4418 4408 4419 - dma_unmap_single(port->dev->dev.parent, buf_phys_addr, 4420 - skb_headlen(skb), DMA_TO_DEVICE); 4421 - if (!skb) 4409 + dma_unmap_single(port->dev->dev.parent, tx_buf->phys, 4410 + tx_buf->size, DMA_TO_DEVICE); 4411 + if (!tx_buf->skb) 4422 4412 continue; 4423 - dev_kfree_skb_any(skb); 4413 + dev_kfree_skb_any(tx_buf->skb); 4424 4414 } 4425 4415 } 4426 4416 ··· 4659 4651 for_each_present_cpu(cpu) { 4660 4652 txq_pcpu = per_cpu_ptr(txq->pcpu, cpu); 4661 4653 txq_pcpu->size = txq->size; 4662 - txq_pcpu->tx_skb = kmalloc(txq_pcpu->size * 4663 - sizeof(*txq_pcpu->tx_skb), 4664 - GFP_KERNEL); 4665 - if (!txq_pcpu->tx_skb) 4666 - goto error; 4667 - 4668 - txq_pcpu->tx_buffs = kmalloc(txq_pcpu->size * 4669 - sizeof(dma_addr_t), GFP_KERNEL); 4670 - if (!txq_pcpu->tx_buffs) 4654 + txq_pcpu->buffs = kmalloc(txq_pcpu->size * 4655 + sizeof(struct mvpp2_txq_pcpu_buf), 4656 + GFP_KERNEL); 4657 + if (!txq_pcpu->buffs) 4671 4658 goto error; 4672 4659 4673 4660 txq_pcpu->count = 0; ··· 4676 4673 error: 4677 4674 for_each_present_cpu(cpu) { 4678 4675 txq_pcpu = per_cpu_ptr(txq->pcpu, cpu); 4679 - kfree(txq_pcpu->tx_skb); 4680 - kfree(txq_pcpu->tx_buffs); 4676 + kfree(txq_pcpu->buffs); 4681 4677 } 4682 4678 4683 4679 dma_free_coherent(port->dev->dev.parent, ··· 4695 4693 4696 4694 for_each_present_cpu(cpu) { 4697 4695 txq_pcpu = per_cpu_ptr(txq->pcpu, cpu); 4698 - kfree(txq_pcpu->tx_skb); 4699 - kfree(txq_pcpu->tx_buffs); 4696 + kfree(txq_pcpu->buffs); 4700 4697 } 4701 4698 4702 4699 if (txq->descs)
+9 -4
drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
··· 942 942 char rauht_pl[MLXSW_REG_RAUHT_LEN]; 943 943 struct net_device *dev; 944 944 bool entry_connected; 945 - u8 nud_state; 945 + u8 nud_state, dead; 946 946 bool updating; 947 947 bool removing; 948 948 bool adding; ··· 953 953 dip = ntohl(*((__be32 *) n->primary_key)); 954 954 memcpy(neigh_entry->ha, n->ha, sizeof(neigh_entry->ha)); 955 955 nud_state = n->nud_state; 956 + dead = n->dead; 956 957 dev = n->dev; 957 958 read_unlock_bh(&n->lock); 958 959 959 - entry_connected = nud_state & NUD_VALID; 960 + entry_connected = nud_state & NUD_VALID && !dead; 960 961 adding = (!neigh_entry->offloaded) && entry_connected; 961 962 updating = neigh_entry->offloaded && entry_connected; 962 963 removing = neigh_entry->offloaded && !entry_connected; ··· 1352 1351 struct mlxsw_sp_neigh_entry *neigh_entry; 1353 1352 struct net_device *dev = fib_nh->nh_dev; 1354 1353 struct neighbour *n; 1355 - u8 nud_state; 1354 + u8 nud_state, dead; 1356 1355 1357 1356 /* Take a reference of neigh here ensuring that neigh would 1358 1357 * not be detructed before the nexthop entry is finished. ··· 1384 1383 list_add_tail(&nh->neigh_list_node, &neigh_entry->nexthop_list); 1385 1384 read_lock_bh(&n->lock); 1386 1385 nud_state = n->nud_state; 1386 + dead = n->dead; 1387 1387 read_unlock_bh(&n->lock); 1388 - __mlxsw_sp_nexthop_neigh_update(nh, !(nud_state & NUD_VALID)); 1388 + __mlxsw_sp_nexthop_neigh_update(nh, !(nud_state & NUD_VALID && !dead)); 1389 1389 1390 1390 return 0; 1391 1391 } ··· 1396 1394 { 1397 1395 struct mlxsw_sp_neigh_entry *neigh_entry = nh->neigh_entry; 1398 1396 1397 + __mlxsw_sp_nexthop_neigh_update(nh, true); 1399 1398 list_del(&nh->neigh_list_node); 1400 1399 1401 1400 /* If that is the last nexthop connected to that neigh, remove from ··· 1455 1452 nh = &nh_grp->nexthops[i]; 1456 1453 mlxsw_sp_nexthop_fini(mlxsw_sp, nh); 1457 1454 } 1455 + mlxsw_sp_nexthop_group_refresh(mlxsw_sp, nh_grp); 1456 + WARN_ON_ONCE(nh_grp->adj_index_valid); 1458 1457 kfree(nh_grp); 1459 1458 } 1460 1459
+4 -4
drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
··· 864 864 int ret; 865 865 struct device *dev = &bsp_priv->pdev->dev; 866 866 867 + ret = gmac_clk_enable(bsp_priv, true); 868 + if (ret) 869 + return ret; 870 + 867 871 /*rmii or rgmii*/ 868 872 if (bsp_priv->phy_iface == PHY_INTERFACE_MODE_RGMII) { 869 873 dev_info(dev, "init for RGMII\n"); ··· 881 877 } 882 878 883 879 ret = phy_power_on(bsp_priv, true); 884 - if (ret) 885 - return ret; 886 - 887 - ret = gmac_clk_enable(bsp_priv, true); 888 880 if (ret) 889 881 return ret; 890 882
+1 -1
drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
··· 539 539 mac->mii.reg_shift = 6; 540 540 mac->mii.reg_mask = 0x000007C0; 541 541 mac->mii.clk_csr_shift = 2; 542 - mac->mii.clk_csr_mask = 0xF; 542 + mac->mii.clk_csr_mask = GENMASK(5, 2); 543 543 544 544 /* Get and dump the chip ID */ 545 545 *synopsys_id = stmmac_get_synopsys_id(hwid);
+1 -1
drivers/net/ethernet/stmicro/stmmac/dwmac100_core.c
··· 197 197 mac->mii.reg_shift = 6; 198 198 mac->mii.reg_mask = 0x000007C0; 199 199 mac->mii.clk_csr_shift = 2; 200 - mac->mii.clk_csr_mask = 0xF; 200 + mac->mii.clk_csr_mask = GENMASK(5, 2); 201 201 202 202 /* Synopsys Id is not available on old chips */ 203 203 *synopsys_id = 0;
+4 -4
drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
··· 81 81 value |= (phyaddr << priv->hw->mii.addr_shift) 82 82 & priv->hw->mii.addr_mask; 83 83 value |= (phyreg << priv->hw->mii.reg_shift) & priv->hw->mii.reg_mask; 84 - value |= (priv->clk_csr & priv->hw->mii.clk_csr_mask) 85 - << priv->hw->mii.clk_csr_shift; 84 + value |= (priv->clk_csr << priv->hw->mii.clk_csr_shift) 85 + & priv->hw->mii.clk_csr_mask; 86 86 if (priv->plat->has_gmac4) 87 87 value |= MII_GMAC4_READ; 88 88 ··· 122 122 & priv->hw->mii.addr_mask; 123 123 value |= (phyreg << priv->hw->mii.reg_shift) & priv->hw->mii.reg_mask; 124 124 125 - value |= ((priv->clk_csr & priv->hw->mii.clk_csr_mask) 126 - << priv->hw->mii.clk_csr_shift); 125 + value |= (priv->clk_csr << priv->hw->mii.clk_csr_shift) 126 + & priv->hw->mii.clk_csr_mask; 127 127 if (priv->plat->has_gmac4) 128 128 value |= MII_GMAC4_WRITE; 129 129
+6 -6
drivers/net/fddi/skfp/hwmtm.c
··· 1483 1483 r = queue->rx_curr_get ; 1484 1484 while (queue->rx_used) { 1485 1485 DRV_BUF_FLUSH(r,DDI_DMA_SYNC_FORCPU) ; 1486 - DB_RX("switch OWN bit of RxD 0x%x ",r,0,5) ; 1486 + DB_RX("switch OWN bit of RxD 0x%p ",r,0,5) ; 1487 1487 r->rxd_rbctrl &= ~cpu_to_le32(BMU_OWN) ; 1488 1488 frag_count = 1 ; 1489 1489 DRV_BUF_FLUSH(r,DDI_DMA_SYNC_FORDEV) ; ··· 1645 1645 DB_TX("hwm_tx_frag: len = %d, frame_status = %x ",len,frame_status,2) ; 1646 1646 if (frame_status & LAN_TX) { 1647 1647 /* '*t' is already defined */ 1648 - DB_TX("LAN_TX: TxD = %x, virt = %x ",t,virt,3) ; 1648 + DB_TX("LAN_TX: TxD = %p, virt = %p ",t,virt,3) ; 1649 1649 t->txd_virt = virt ; 1650 1650 t->txd_txdscr = cpu_to_le32(smc->os.hwm.tx_descr) ; 1651 1651 t->txd_tbadr = cpu_to_le32(phys) ; ··· 1819 1819 __le32 tbctrl; 1820 1820 1821 1821 NDD_TRACE("THSB",mb,fc,0) ; 1822 - DB_TX("smt_send_mbuf: mb = 0x%x, fc = 0x%x",mb,fc,4) ; 1822 + DB_TX("smt_send_mbuf: mb = 0x%p, fc = 0x%x",mb,fc,4) ; 1823 1823 1824 1824 mb->sm_off-- ; /* set to fc */ 1825 1825 mb->sm_len++ ; /* + fc */ ··· 1960 1960 1961 1961 do { 1962 1962 DRV_BUF_FLUSH(t1,DDI_DMA_SYNC_FORCPU) ; 1963 - DB_TX("check OWN/EOF bit of TxD 0x%x",t1,0,5) ; 1963 + DB_TX("check OWN/EOF bit of TxD 0x%p",t1,0,5) ; 1964 1964 tbctrl = le32_to_cpu(CR_READ(t1->txd_tbctrl)); 1965 1965 1966 1966 if (tbctrl & BMU_OWN || !queue->tx_used){ ··· 1988 1988 } 1989 1989 else { 1990 1990 #ifndef PASS_1ST_TXD_2_TX_COMP 1991 - DB_TX("mac_drv_tx_comp for TxD 0x%x",t2,0,4) ; 1991 + DB_TX("mac_drv_tx_comp for TxD 0x%p",t2,0,4) ; 1992 1992 mac_drv_tx_complete(smc,t2) ; 1993 1993 #else 1994 1994 DB_TX("mac_drv_tx_comp for TxD 0x%x", ··· 2052 2052 tx_used = queue->tx_used ; 2053 2053 while (tx_used) { 2054 2054 DRV_BUF_FLUSH(t,DDI_DMA_SYNC_FORCPU) ; 2055 - DB_TX("switch OWN bit of TxD 0x%x ",t,0,5) ; 2055 + DB_TX("switch OWN bit of TxD 0x%p ",t,0,5) ; 2056 2056 t->txd_tbctrl &= ~cpu_to_le32(BMU_OWN) ; 2057 2057 DRV_BUF_FLUSH(t,DDI_DMA_SYNC_FORDEV) ; 2058 2058 t = t->txd_next ;
+1 -1
drivers/net/fddi/skfp/pmf.c
··· 284 284 SMbuf *reply ; 285 285 286 286 sm = smtod(mb,struct smt_header *) ; 287 - DB_SMT("SMT: processing PMF frame at %x len %d\n",sm,mb->sm_len) ; 287 + DB_SMT("SMT: processing PMF frame at %p len %d\n",sm,mb->sm_len) ; 288 288 #ifdef DEBUG 289 289 dump_smt(smc,sm,"PMF Received") ; 290 290 #endif
+1 -1
drivers/net/fddi/skfp/smt.c
··· 504 504 #endif 505 505 506 506 smt_swap_para(sm,(int) mb->sm_len,1) ; 507 - DB_SMT("SMT : received packet [%s] at 0x%x\n", 507 + DB_SMT("SMT : received packet [%s] at 0x%p\n", 508 508 smt_type_name[m_fc(mb) & 0xf],sm) ; 509 509 DB_SMT("SMT : version %d, class %s\n",sm->smt_version, 510 510 smt_class_name[(sm->smt_class>LAST_CLASS)?0 : sm->smt_class]) ;
+103 -71
drivers/net/virtio_net.c
··· 333 333 static void virtnet_xdp_xmit(struct virtnet_info *vi, 334 334 struct receive_queue *rq, 335 335 struct send_queue *sq, 336 - struct xdp_buff *xdp) 336 + struct xdp_buff *xdp, 337 + void *data) 337 338 { 338 - struct page *page = virt_to_head_page(xdp->data); 339 339 struct virtio_net_hdr_mrg_rxbuf *hdr; 340 340 unsigned int num_sg, len; 341 341 void *xdp_sent; ··· 343 343 344 344 /* Free up any pending old buffers before queueing new ones. */ 345 345 while ((xdp_sent = virtqueue_get_buf(sq->vq, &len)) != NULL) { 346 - struct page *sent_page = virt_to_head_page(xdp_sent); 346 + if (vi->mergeable_rx_bufs) { 347 + struct page *sent_page = virt_to_head_page(xdp_sent); 347 348 348 - if (vi->mergeable_rx_bufs) 349 349 put_page(sent_page); 350 - else 351 - give_pages(rq, sent_page); 350 + } else { /* small buffer */ 351 + struct sk_buff *skb = xdp_sent; 352 + 353 + kfree_skb(skb); 354 + } 352 355 } 353 356 354 - /* Zero header and leave csum up to XDP layers */ 355 - hdr = xdp->data; 356 - memset(hdr, 0, vi->hdr_len); 357 + if (vi->mergeable_rx_bufs) { 358 + /* Zero header and leave csum up to XDP layers */ 359 + hdr = xdp->data; 360 + memset(hdr, 0, vi->hdr_len); 357 361 358 - num_sg = 1; 359 - sg_init_one(sq->sg, xdp->data, xdp->data_end - xdp->data); 362 + num_sg = 1; 363 + sg_init_one(sq->sg, xdp->data, xdp->data_end - xdp->data); 364 + } else { /* small buffer */ 365 + struct sk_buff *skb = data; 366 + 367 + /* Zero header and leave csum up to XDP layers */ 368 + hdr = skb_vnet_hdr(skb); 369 + memset(hdr, 0, vi->hdr_len); 370 + 371 + num_sg = 2; 372 + sg_init_table(sq->sg, 2); 373 + sg_set_buf(sq->sg, hdr, vi->hdr_len); 374 + skb_to_sgvec(skb, sq->sg + 1, 0, skb->len); 375 + } 360 376 err = virtqueue_add_outbuf(sq->vq, sq->sg, num_sg, 361 - xdp->data, GFP_ATOMIC); 377 + data, GFP_ATOMIC); 362 378 if (unlikely(err)) { 363 - if (vi->mergeable_rx_bufs) 379 + if (vi->mergeable_rx_bufs) { 380 + struct page *page = virt_to_head_page(xdp->data); 381 + 364 382 put_page(page); 365 - else 366 - give_pages(rq, page); 383 + } else /* small buffer */ 384 + kfree_skb(data); 367 385 return; // On error abort to avoid unnecessary kick 368 - } else if (!vi->mergeable_rx_bufs) { 369 - /* If not mergeable bufs must be big packets so cleanup pages */ 370 - give_pages(rq, (struct page *)page->private); 371 - page->private = 0; 372 386 } 373 387 374 388 virtqueue_kick(sq->vq); ··· 391 377 static u32 do_xdp_prog(struct virtnet_info *vi, 392 378 struct receive_queue *rq, 393 379 struct bpf_prog *xdp_prog, 394 - struct page *page, int offset, int len) 380 + void *data, int len) 395 381 { 396 382 int hdr_padded_len; 397 383 struct xdp_buff xdp; 384 + void *buf; 398 385 unsigned int qp; 399 386 u32 act; 400 - u8 *buf; 401 387 402 - buf = page_address(page) + offset; 403 - 404 - if (vi->mergeable_rx_bufs) 388 + if (vi->mergeable_rx_bufs) { 405 389 hdr_padded_len = sizeof(struct virtio_net_hdr_mrg_rxbuf); 406 - else 407 - hdr_padded_len = sizeof(struct padded_vnet_hdr); 390 + xdp.data = data + hdr_padded_len; 391 + xdp.data_end = xdp.data + (len - vi->hdr_len); 392 + buf = data; 393 + } else { /* small buffers */ 394 + struct sk_buff *skb = data; 408 395 409 - xdp.data = buf + hdr_padded_len; 410 - xdp.data_end = xdp.data + (len - vi->hdr_len); 396 + xdp.data = skb->data; 397 + xdp.data_end = xdp.data + len; 398 + buf = skb->data; 399 + } 411 400 412 401 act = bpf_prog_run_xdp(xdp_prog, &xdp); 413 402 switch (act) { ··· 420 403 qp = vi->curr_queue_pairs - 421 404 vi->xdp_queue_pairs + 422 405 smp_processor_id(); 423 - xdp.data = buf + (vi->mergeable_rx_bufs ? 0 : 4); 424 - virtnet_xdp_xmit(vi, rq, &vi->sq[qp], &xdp); 406 + xdp.data = buf; 407 + virtnet_xdp_xmit(vi, rq, &vi->sq[qp], &xdp, data); 425 408 return XDP_TX; 426 409 default: 427 410 bpf_warn_invalid_xdp_action(act); ··· 431 414 } 432 415 } 433 416 434 - static struct sk_buff *receive_small(struct virtnet_info *vi, void *buf, unsigned int len) 417 + static struct sk_buff *receive_small(struct net_device *dev, 418 + struct virtnet_info *vi, 419 + struct receive_queue *rq, 420 + void *buf, unsigned int len) 435 421 { 436 422 struct sk_buff * skb = buf; 423 + struct bpf_prog *xdp_prog; 437 424 438 425 len -= vi->hdr_len; 439 426 skb_trim(skb, len); 440 - 441 - return skb; 442 - } 443 - 444 - static struct sk_buff *receive_big(struct net_device *dev, 445 - struct virtnet_info *vi, 446 - struct receive_queue *rq, 447 - void *buf, 448 - unsigned int len) 449 - { 450 - struct bpf_prog *xdp_prog; 451 - struct page *page = buf; 452 - struct sk_buff *skb; 453 427 454 428 rcu_read_lock(); 455 429 xdp_prog = rcu_dereference(rq->xdp_prog); ··· 450 442 451 443 if (unlikely(hdr->hdr.gso_type || hdr->hdr.flags)) 452 444 goto err_xdp; 453 - act = do_xdp_prog(vi, rq, xdp_prog, page, 0, len); 445 + act = do_xdp_prog(vi, rq, xdp_prog, skb, len); 454 446 switch (act) { 455 447 case XDP_PASS: 456 448 break; ··· 464 456 } 465 457 rcu_read_unlock(); 466 458 467 - skb = page_to_skb(vi, rq, page, 0, len, PAGE_SIZE); 459 + return skb; 460 + 461 + err_xdp: 462 + rcu_read_unlock(); 463 + dev->stats.rx_dropped++; 464 + kfree_skb(skb); 465 + xdp_xmit: 466 + return NULL; 467 + } 468 + 469 + static struct sk_buff *receive_big(struct net_device *dev, 470 + struct virtnet_info *vi, 471 + struct receive_queue *rq, 472 + void *buf, 473 + unsigned int len) 474 + { 475 + struct page *page = buf; 476 + struct sk_buff *skb = page_to_skb(vi, rq, page, 0, len, PAGE_SIZE); 477 + 468 478 if (unlikely(!skb)) 469 479 goto err; 470 480 471 481 return skb; 472 482 473 - err_xdp: 474 - rcu_read_unlock(); 475 483 err: 476 484 dev->stats.rx_dropped++; 477 485 give_pages(rq, page); 478 - xdp_xmit: 479 486 return NULL; 480 487 } 481 488 ··· 506 483 * anymore. 507 484 */ 508 485 static struct page *xdp_linearize_page(struct receive_queue *rq, 509 - u16 num_buf, 486 + u16 *num_buf, 510 487 struct page *p, 511 488 int offset, 512 489 unsigned int *len) ··· 520 497 memcpy(page_address(page) + page_off, page_address(p) + offset, *len); 521 498 page_off += *len; 522 499 523 - while (--num_buf) { 500 + while (--*num_buf) { 524 501 unsigned int buflen; 525 502 unsigned long ctx; 526 503 void *buf; ··· 530 507 if (unlikely(!ctx)) 531 508 goto err_buf; 532 509 533 - /* guard against a misconfigured or uncooperative backend that 534 - * is sending packet larger than the MTU. 535 - */ 536 - if ((page_off + buflen) > PAGE_SIZE) 537 - goto err_buf; 538 - 539 510 buf = mergeable_ctx_to_buf_address(ctx); 540 511 p = virt_to_head_page(buf); 541 512 off = buf - page_address(p); 542 513 514 + /* guard against a misconfigured or uncooperative backend that 515 + * is sending packet larger than the MTU. 516 + */ 517 + if ((page_off + buflen) > PAGE_SIZE) { 518 + put_page(p); 519 + goto err_buf; 520 + } 521 + 543 522 memcpy(page_address(page) + page_off, 544 523 page_address(p) + off, buflen); 545 524 page_off += buflen; 525 + put_page(p); 546 526 } 547 527 548 528 *len = page_off; ··· 578 552 struct page *xdp_page; 579 553 u32 act; 580 554 581 - /* No known backend devices should send packets with 582 - * more than a single buffer when XDP conditions are 583 - * met. However it is not strictly illegal so the case 584 - * is handled as an exception and a warning is thrown. 585 - */ 555 + /* This happens when rx buffer size is underestimated */ 586 556 if (unlikely(num_buf > 1)) { 587 - bpf_warn_invalid_xdp_buffer(); 588 - 589 557 /* linearize data for XDP */ 590 - xdp_page = xdp_linearize_page(rq, num_buf, 558 + xdp_page = xdp_linearize_page(rq, &num_buf, 591 559 page, offset, &len); 592 560 if (!xdp_page) 593 561 goto err_xdp; ··· 595 575 * the receive path after XDP is loaded. In practice I 596 576 * was not able to create this condition. 597 577 */ 598 - if (unlikely(hdr->hdr.gso_type || hdr->hdr.flags)) 578 + if (unlikely(hdr->hdr.gso_type)) 599 579 goto err_xdp; 600 580 601 - act = do_xdp_prog(vi, rq, xdp_prog, page, offset, len); 581 + act = do_xdp_prog(vi, rq, xdp_prog, 582 + page_address(xdp_page) + offset, len); 602 583 switch (act) { 603 584 case XDP_PASS: 604 - if (unlikely(xdp_page != page)) 605 - __free_pages(xdp_page, 0); 585 + /* We can only create skb based on xdp_page. */ 586 + if (unlikely(xdp_page != page)) { 587 + rcu_read_unlock(); 588 + put_page(page); 589 + head_skb = page_to_skb(vi, rq, xdp_page, 590 + 0, len, PAGE_SIZE); 591 + ewma_pkt_len_add(&rq->mrg_avg_pkt_len, len); 592 + return head_skb; 593 + } 606 594 break; 607 595 case XDP_TX: 596 + ewma_pkt_len_add(&rq->mrg_avg_pkt_len, len); 608 597 if (unlikely(xdp_page != page)) 609 598 goto err_xdp; 610 599 rcu_read_unlock(); ··· 622 593 default: 623 594 if (unlikely(xdp_page != page)) 624 595 __free_pages(xdp_page, 0); 596 + ewma_pkt_len_add(&rq->mrg_avg_pkt_len, len); 625 597 goto err_xdp; 626 598 } 627 599 } ··· 734 704 else if (vi->big_packets) 735 705 skb = receive_big(dev, vi, rq, buf, len); 736 706 else 737 - skb = receive_small(vi, buf, len); 707 + skb = receive_small(dev, vi, rq, buf, len); 738 708 739 709 if (unlikely(!skb)) 740 710 return; ··· 1708 1678 int i, err; 1709 1679 1710 1680 if (virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_TSO4) || 1711 - virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_TSO6)) { 1681 + virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_TSO6) || 1682 + virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_ECN) || 1683 + virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_UFO)) { 1712 1684 netdev_warn(dev, "can't set XDP while host is implementing LRO, disable LRO first\n"); 1713 1685 return -EOPNOTSUPP; 1714 1686 }
+1 -1
drivers/net/wireless/ath/ath10k/wmi.c
··· 8271 8271 dma_unmap_single(ar->dev, 8272 8272 ar->wmi.mem_chunks[i].paddr, 8273 8273 ar->wmi.mem_chunks[i].len, 8274 - DMA_TO_DEVICE); 8274 + DMA_BIDIRECTIONAL); 8275 8275 kfree(ar->wmi.mem_chunks[i].vaddr); 8276 8276 } 8277 8277
+1 -1
drivers/net/wireless/ath/ath9k/xmit.c
··· 2713 2713 fifo_list = &txq->txq_fifo[txq->txq_tailidx]; 2714 2714 if (list_empty(fifo_list)) { 2715 2715 ath_txq_unlock(sc, txq); 2716 - return; 2716 + break; 2717 2717 } 2718 2718 2719 2719 bf = list_first_entry(fifo_list, struct ath_buf, list);
+5 -2
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
··· 6868 6868 6869 6869 err = brcmf_p2p_attach(cfg, p2pdev_forced); 6870 6870 if (err) { 6871 - brcmf_err("P2P initilisation failed (%d)\n", err); 6871 + brcmf_err("P2P initialisation failed (%d)\n", err); 6872 6872 goto wiphy_unreg_out; 6873 6873 } 6874 6874 err = brcmf_btcoex_attach(cfg); ··· 6893 6893 err = brcmf_fweh_activate_events(ifp); 6894 6894 if (err) { 6895 6895 brcmf_err("FWEH activation failed (%d)\n", err); 6896 - goto wiphy_unreg_out; 6896 + goto detach; 6897 6897 } 6898 6898 6899 6899 /* Fill in some of the advertised nl80211 supported features */ ··· 6908 6908 6909 6909 return cfg; 6910 6910 6911 + detach: 6912 + brcmf_btcoex_detach(cfg); 6913 + brcmf_p2p_detach(&cfg->p2p); 6911 6914 wiphy_unreg_out: 6912 6915 wiphy_unregister(cfg->wiphy); 6913 6916 priv_out:
+1
drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
··· 137 137 pfn.wpa_auth = cpu_to_le32(BRCMF_PNO_WPA_AUTH_ANY); 138 138 pfn.wsec = cpu_to_le32(0); 139 139 pfn.infra = cpu_to_le32(1); 140 + pfn.flags = 0; 140 141 if (active) 141 142 pfn.flags = cpu_to_le32(1 << BRCMF_PNO_HIDDEN_BIT); 142 143 pfn.ssid.SSID_len = cpu_to_le32(ssid->ssid_len);
+2 -1
drivers/net/wireless/realtek/rtlwifi/core.c
··· 1829 1829 1830 1830 spin_lock_irqsave(&rtlpriv->locks.irq_th_lock, flags); 1831 1831 pskb = __skb_dequeue(&ring->queue); 1832 - dev_kfree_skb_irq(pskb); 1832 + if (pskb) 1833 + dev_kfree_skb_irq(pskb); 1833 1834 1834 1835 /*this is wrong, fill_tx_cmddesc needs update*/ 1835 1836 pdesc = &ring->desc[0];
+1
net/core/neighbour.c
··· 100 100 neigh->parms->neigh_cleanup(neigh); 101 101 102 102 __neigh_notify(neigh, RTM_DELNEIGH, 0); 103 + call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh); 103 104 neigh_release(neigh); 104 105 } 105 106
+1 -1
net/ipv4/ip_sockglue.c
··· 148 148 const struct iphdr *iph = ip_hdr(skb); 149 149 __be16 *ports = (__be16 *)skb_transport_header(skb); 150 150 151 - if (skb_transport_offset(skb) + 4 > skb->len) 151 + if (skb_transport_offset(skb) + 4 > (int)skb->len) 152 152 return; 153 153 154 154 /* All current transport protocols have the port numbers in the
+2 -1
net/ipv4/route.c
··· 798 798 struct rtable *rt; 799 799 struct flowi4 fl4; 800 800 const struct iphdr *iph = (const struct iphdr *) skb->data; 801 + struct net *net = dev_net(skb->dev); 801 802 int oif = skb->dev->ifindex; 802 803 u8 tos = RT_TOS(iph->tos); 803 804 u8 prot = iph->protocol; ··· 806 805 807 806 rt = (struct rtable *) dst; 808 807 809 - __build_flow_key(sock_net(sk), &fl4, sk, iph, oif, tos, prot, mark, 0); 808 + __build_flow_key(net, &fl4, sk, iph, oif, tos, prot, mark, 0); 810 809 __ip_do_redirect(rt, skb, &fl4, true); 811 810 } 812 811
+1
net/ipv4/tcp_output.c
··· 769 769 list_del(&tp->tsq_node); 770 770 771 771 sk = (struct sock *)tp; 772 + smp_mb__before_atomic(); 772 773 clear_bit(TSQ_QUEUED, &sk->sk_tsq_flags); 773 774 774 775 if (!sk->sk_lock.owned &&
+1 -1
net/ipv6/datagram.c
··· 701 701 struct sockaddr_in6 sin6; 702 702 __be16 *ports = (__be16 *) skb_transport_header(skb); 703 703 704 - if (skb_transport_offset(skb) + 4 <= skb->len) { 704 + if (skb_transport_offset(skb) + 4 <= (int)skb->len) { 705 705 /* All current transport protocols have the port numbers in the 706 706 * first four bytes of the transport header and this function is 707 707 * written with this assumption in mind.
+5 -1
net/ipv6/raw.c
··· 591 591 } 592 592 593 593 offset += skb_transport_offset(skb); 594 - BUG_ON(skb_copy_bits(skb, offset, &csum, 2)); 594 + err = skb_copy_bits(skb, offset, &csum, 2); 595 + if (err < 0) { 596 + ip6_flush_pending_frames(sk); 597 + goto out; 598 + } 595 599 596 600 /* in case cksum was not initialized */ 597 601 if (unlikely(csum))
+2 -2
net/sched/act_tunnel_key.c
··· 134 134 saddr = nla_get_in6_addr(tb[TCA_TUNNEL_KEY_ENC_IPV6_SRC]); 135 135 daddr = nla_get_in6_addr(tb[TCA_TUNNEL_KEY_ENC_IPV6_DST]); 136 136 137 - metadata = __ipv6_tun_set_dst(&saddr, &daddr, 0, 0, 0, 138 - dst_port, TUNNEL_KEY, 137 + metadata = __ipv6_tun_set_dst(&saddr, &daddr, 0, 0, dst_port, 138 + 0, TUNNEL_KEY, 139 139 key_id, 0); 140 140 } 141 141
+12 -11
net/sched/cls_flower.c
··· 442 442 } 443 443 } 444 444 445 - static void fl_set_key_flags(struct nlattr **tb, 446 - u32 *flags_key, u32 *flags_mask) 445 + static int fl_set_key_flags(struct nlattr **tb, 446 + u32 *flags_key, u32 *flags_mask) 447 447 { 448 448 u32 key, mask; 449 449 450 - if (!tb[TCA_FLOWER_KEY_FLAGS]) 451 - return; 450 + /* mask is mandatory for flags */ 451 + if (!tb[TCA_FLOWER_KEY_FLAGS_MASK]) 452 + return -EINVAL; 452 453 453 454 key = be32_to_cpu(nla_get_u32(tb[TCA_FLOWER_KEY_FLAGS])); 454 - 455 - if (!tb[TCA_FLOWER_KEY_FLAGS_MASK]) 456 - mask = ~0; 457 - else 458 - mask = be32_to_cpu(nla_get_u32(tb[TCA_FLOWER_KEY_FLAGS_MASK])); 455 + mask = be32_to_cpu(nla_get_u32(tb[TCA_FLOWER_KEY_FLAGS_MASK])); 459 456 460 457 *flags_key = 0; 461 458 *flags_mask = 0; 462 459 463 460 fl_set_key_flag(key, mask, flags_key, flags_mask, 464 461 TCA_FLOWER_KEY_FLAGS_IS_FRAGMENT, FLOW_DIS_IS_FRAGMENT); 462 + 463 + return 0; 465 464 } 466 465 467 466 static int fl_set_key(struct net *net, struct nlattr **tb, 468 467 struct fl_flow_key *key, struct fl_flow_key *mask) 469 468 { 470 469 __be16 ethertype; 470 + int ret = 0; 471 471 #ifdef CONFIG_NET_CLS_IND 472 472 if (tb[TCA_FLOWER_INDEV]) { 473 473 int err = tcf_change_indev(net, tb[TCA_FLOWER_INDEV]); ··· 614 614 &mask->enc_tp.dst, TCA_FLOWER_KEY_ENC_UDP_DST_PORT_MASK, 615 615 sizeof(key->enc_tp.dst)); 616 616 617 - fl_set_key_flags(tb, &key->control.flags, &mask->control.flags); 617 + if (tb[TCA_FLOWER_KEY_FLAGS]) 618 + ret = fl_set_key_flags(tb, &key->control.flags, &mask->control.flags); 618 619 619 - return 0; 620 + return ret; 620 621 } 621 622 622 623 static bool fl_mask_eq(struct fl_flow_mask *mask1,
+2 -2
net/sctp/associola.c
··· 1471 1471 * threshold. The idea is to recover slowly, but up 1472 1472 * to the initial advertised window. 1473 1473 */ 1474 - if (asoc->rwnd_press && asoc->rwnd >= asoc->rwnd_press) { 1474 + if (asoc->rwnd_press) { 1475 1475 int change = min(asoc->pathmtu, asoc->rwnd_press); 1476 1476 asoc->rwnd += change; 1477 1477 asoc->rwnd_press -= change; ··· 1539 1539 asoc->rwnd = 0; 1540 1540 } 1541 1541 } else { 1542 - asoc->rwnd_over = len - asoc->rwnd; 1542 + asoc->rwnd_over += len - asoc->rwnd; 1543 1543 asoc->rwnd = 0; 1544 1544 } 1545 1545