tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull more networking fixes from David Miller:
"Some more bug fixes have trickled in, we have:

1) Local MAC entries properly in mscc driver, from Allan W. Nielsen.

2) Eric Dumazet found some more of the typical "pskb_may_pull() -->
oops forgot to reload the header pointer" bugs in ipv6 tunnel
handling.

3) Bad SKB socket pointer in ipv6 fragmentation handling, from Herbert
Xu.

4) Overflow fix in sk_msg_clone(), from Vakul Garg.

5) Validate address lengths in AF_PACKET, from Willem de Bruijn"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
qmi_wwan: Fix qmap header retrieval in qmimux_rx_fixup
qmi_wwan: Add support for Fibocom NL678 series
tls: Do not call sk_memcopy_from_iter with zero length
ipv6: tunnels: fix two use-after-free
Prevent overflow of sk_msg in sk_msg_clone()
packet: validate address length
net: netxen: fix a missing check and an uninitialized use
tcp: fix a race in inet_diag_dump_icsk()
MAINTAINERS: update cxgb4 and cxgb3 maintainer
ipv6: frags: Fix bogus skb->sk in reassembled packets
mscc: Configured MAC entries should be locked.

Linus Torvalds 87935eee 5092adb2

+33 -16
+2 -2
MAINTAINERS
··· 4057 4057 F: drivers/media/dvb-frontends/cxd2820r* 4058 4058 4059 4059 CXGB3 ETHERNET DRIVER (CXGB3) 4060 - M: Santosh Raspatur <santosh@chelsio.com> 4060 + M: Arjun Vynipadath <arjun@chelsio.com> 4061 4061 L: netdev@vger.kernel.org 4062 4062 W: http://www.chelsio.com 4063 4063 S: Supported ··· 4086 4086 F: drivers/crypto/chelsio 4087 4087 4088 4088 CXGB4 ETHERNET DRIVER (CXGB4) 4089 - M: Ganesh Goudar <ganeshgr@chelsio.com> 4089 + M: Arjun Vynipadath <arjun@chelsio.com> 4090 4090 L: netdev@vger.kernel.org 4091 4091 W: http://www.chelsio.com 4092 4092 S: Supported
+1 -1
drivers/net/ethernet/mscc/ocelot.c
··· 747 747 } 748 748 749 749 return ocelot_mact_learn(ocelot, port->chip_port, addr, vid, 750 - ENTRYTYPE_NORMAL); 750 + ENTRYTYPE_LOCKED); 751 751 } 752 752 753 753 static int ocelot_fdb_del(struct ndmsg *ndm, struct nlattr *tb[],
+2 -1
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
··· 1125 1125 return -EINVAL; 1126 1126 } 1127 1127 val = nx_get_bios_version(adapter); 1128 - netxen_rom_fast_read(adapter, NX_BIOS_VERSION_OFFSET, (int *)&bios); 1128 + if (netxen_rom_fast_read(adapter, NX_BIOS_VERSION_OFFSET, (int *)&bios)) 1129 + return -EIO; 1129 1130 if ((__force u32)val != bios) { 1130 1131 dev_err(&pdev->dev, "%s: firmware bios is incompatible\n", 1131 1132 fw_name[fw_type]);
+9 -7
drivers/net/usb/qmi_wwan.c
··· 151 151 152 152 static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb) 153 153 { 154 - unsigned int len, offset = sizeof(struct qmimux_hdr); 154 + unsigned int len, offset = 0; 155 155 struct qmimux_hdr *hdr; 156 156 struct net_device *net; 157 157 struct sk_buff *skbn; 158 + u8 qmimux_hdr_sz = sizeof(*hdr); 158 159 159 - while (offset < skb->len) { 160 - hdr = (struct qmimux_hdr *)skb->data; 160 + while (offset + qmimux_hdr_sz < skb->len) { 161 + hdr = (struct qmimux_hdr *)(skb->data + offset); 161 162 len = be16_to_cpu(hdr->pkt_len); 162 163 163 164 /* drop the packet, bogus length */ 164 - if (offset + len > skb->len) 165 + if (offset + len + qmimux_hdr_sz > skb->len) 165 166 return 0; 166 167 167 168 /* control packet, we do not know what to do */ ··· 177 176 return 0; 178 177 skbn->dev = net; 179 178 180 - switch (skb->data[offset] & 0xf0) { 179 + switch (skb->data[offset + qmimux_hdr_sz] & 0xf0) { 181 180 case 0x40: 182 181 skbn->protocol = htons(ETH_P_IP); 183 182 break; ··· 189 188 goto skip; 190 189 } 191 190 192 - skb_put_data(skbn, skb->data + offset, len); 191 + skb_put_data(skbn, skb->data + offset + qmimux_hdr_sz, len); 193 192 if (netif_rx(skbn) != NET_RX_SUCCESS) 194 193 return 0; 195 194 196 195 skip: 197 - offset += len + sizeof(struct qmimux_hdr); 196 + offset += len + qmimux_hdr_sz; 198 197 } 199 198 return 1; 200 199 } ··· 1266 1265 {QMI_QUIRK_SET_DTR(0x2c7c, 0x0121, 4)}, /* Quectel EC21 Mini PCIe */ 1267 1266 {QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */ 1268 1267 {QMI_FIXED_INTF(0x2c7c, 0x0296, 4)}, /* Quectel BG96 */ 1268 + {QMI_QUIRK_SET_DTR(0x2cb7, 0x0104, 4)}, /* Fibocom NL678 series */ 1269 1269 1270 1270 /* 4. Gobi 1000 devices */ 1271 1271 {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */
+3
net/core/skmsg.c
··· 94 94 } 95 95 96 96 while (len) { 97 + if (sk_msg_full(dst)) 98 + return -ENOSPC; 99 + 97 100 sge_len = sge->length - off; 98 101 sge_off = sge->offset + off; 99 102 if (sge_len > len)
+3 -1
net/ipv4/inet_diag.c
··· 998 998 if (!inet_diag_bc_sk(bc, sk)) 999 999 goto next_normal; 1000 1000 1001 - sock_hold(sk); 1001 + if (!refcount_inc_not_zero(&sk->sk_refcnt)) 1002 + goto next_normal; 1003 + 1002 1004 num_arr[accum] = num; 1003 1005 sk_arr[accum] = sk; 1004 1006 if (++accum == SKARR_SZ)
+1
net/ipv6/ip6_tunnel.c
··· 901 901 goto drop; 902 902 if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) 903 903 goto drop; 904 + ipv6h = ipv6_hdr(skb); 904 905 if (!ip6_tnl_rcv_ctl(t, &ipv6h->daddr, &ipv6h->saddr)) 905 906 goto drop; 906 907 if (iptunnel_pull_header(skb, 0, tpi->proto, false))
+1
net/ipv6/ip6_vti.c
··· 318 318 return 0; 319 319 } 320 320 321 + ipv6h = ipv6_hdr(skb); 321 322 if (!ip6_tnl_rcv_ctl(t, &ipv6h->daddr, &ipv6h->saddr)) { 322 323 t->dev->stats.rx_dropped++; 323 324 rcu_read_unlock();
+1
net/ipv6/reassembly.c
··· 384 384 if (skb_try_coalesce(head, fp, &headstolen, &delta)) { 385 385 kfree_skb_partial(fp, headstolen); 386 386 } else { 387 + fp->sk = NULL; 387 388 if (!skb_shinfo(head)->frag_list) 388 389 skb_shinfo(head)->frag_list = fp; 389 390 head->data_len += fp->len;
+4
net/packet/af_packet.c
··· 2627 2627 proto = saddr->sll_protocol; 2628 2628 addr = saddr->sll_addr; 2629 2629 dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex); 2630 + if (addr && dev && saddr->sll_halen < dev->addr_len) 2631 + goto out; 2630 2632 } 2631 2633 2632 2634 err = -ENXIO; ··· 2827 2825 proto = saddr->sll_protocol; 2828 2826 addr = saddr->sll_addr; 2829 2827 dev = dev_get_by_index(sock_net(sk), saddr->sll_ifindex); 2828 + if (addr && dev && saddr->sll_halen < dev->addr_len) 2829 + goto out; 2830 2830 } 2831 2831 2832 2832 err = -ENXIO;
+6 -4
net/tls/tls_sw.c
··· 935 935 tls_ctx->tx.overhead_size); 936 936 } 937 937 938 - ret = sk_msg_memcopy_from_iter(sk, &msg->msg_iter, msg_pl, 939 - try_to_copy); 940 - if (ret < 0) 941 - goto trim_sgl; 938 + if (try_to_copy) { 939 + ret = sk_msg_memcopy_from_iter(sk, &msg->msg_iter, 940 + msg_pl, try_to_copy); 941 + if (ret < 0) 942 + goto trim_sgl; 943 + } 942 944 943 945 /* Open records defined only if successfully copied, otherwise 944 946 * we would trim the sg but not reset the open record frags.