Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'net-6.9-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
"Including fixes from bluetooth and IPsec.

The bridge patch is actually a follow-up to a recent fix in the same
area. We have a pending v6.8 AF_UNIX regression; it should be solved
soon, but not in time for this PR.

Current release - regressions:

- eth: ks8851: Queue RX packets in IRQ handler instead of disabling
BHs

- net: bridge: fix corrupted ethernet header on multicast-to-unicast

Current release - new code bugs:

- xfrm: fix possible bad pointer derferencing in error path

Previous releases - regressionis:

- core: fix out-of-bounds access in ops_init

- ipv6:
- fix potential uninit-value access in __ip6_make_skb()
- fib6_rules: avoid possible NULL dereference in fib6_rule_action()

- tcp: use refcount_inc_not_zero() in tcp_twsk_unique().

- rtnetlink: correct nested IFLA_VF_VLAN_LIST attribute validation

- rxrpc: fix congestion control algorithm

- bluetooth:
- l2cap: fix slab-use-after-free in l2cap_connect()
- msft: fix slab-use-after-free in msft_do_close()

- eth: hns3: fix kernel crash when devlink reload during
initialization

- eth: dsa: mv88e6xxx: add phylink_get_caps for the mv88e6320/21
family

Previous releases - always broken:

- xfrm: preserve vlan tags for transport mode software GRO

- tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets

- eth: hns3: keep using user config after hardware reset"

* tag 'net-6.9-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (47 commits)
net: dsa: mv88e6xxx: read cmode on mv88e6320/21 serdes only ports
net: dsa: mv88e6xxx: add phylink_get_caps for the mv88e6320/21 family
net: hns3: fix kernel crash when devlink reload during initialization
net: hns3: fix port vlan filter not disabled issue
net: hns3: use appropriate barrier function after setting a bit value
net: hns3: release PTP resources if pf initialization failed
net: hns3: change type of numa_node_mask as nodemask_t
net: hns3: direct return when receive a unknown mailbox message
net: hns3: using user configure after hardware reset
net/smc: fix neighbour and rtable leak in smc_ib_find_route()
ipv6: prevent NULL dereference in ip6_output()
hsr: Simplify code for announcing HSR nodes timer setup
ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
dt-bindings: net: mediatek: remove wrongly added clocks and SerDes
rxrpc: Only transmit one ACK per jumbo packet received
rxrpc: Fix congestion control algorithm
selftests: test_bridge_neigh_suppress.sh: Fix failures due to duplicate MAC
ipv6: Fix potential uninit-value access in __ip6_make_skb()
net: phy: marvell-88q2xxx: add support for Rev B1 and B2
appletalk: Improve handling of broadcast packets
...

+520 -206
+2 -20
Documentation/devicetree/bindings/net/mediatek,net.yaml
··· 337 337 minItems: 4 338 338 339 339 clocks: 340 - minItems: 34 341 - maxItems: 34 340 + minItems: 24 341 + maxItems: 24 342 342 343 343 clock-names: 344 344 items: ··· 351 351 - const: ethwarp_wocpu1 352 352 - const: ethwarp_wocpu0 353 353 - const: esw 354 - - const: netsys0 355 - - const: netsys1 356 - - const: sgmii_tx250m 357 - - const: sgmii_rx250m 358 - - const: sgmii2_tx250m 359 - - const: sgmii2_rx250m 360 - - const: top_usxgmii0_sel 361 - - const: top_usxgmii1_sel 362 - - const: top_sgm0_sel 363 - - const: top_sgm1_sel 364 - - const: top_xfi_phy0_xtal_sel 365 - - const: top_xfi_phy1_xtal_sel 366 354 - const: top_eth_gmii_sel 367 355 - const: top_eth_refck_50m_sel 368 356 - const: top_eth_sys_200m_sel ··· 363 375 - const: top_netsys_sync_250m_sel 364 376 - const: top_netsys_ppefb_250m_sel 365 377 - const: top_netsys_warp_sel 366 - - const: wocpu1 367 - - const: wocpu0 368 378 - const: xgp1 369 379 - const: xgp2 370 380 - const: xgp3 371 - 372 - mediatek,sgmiisys: 373 - minItems: 2 374 - maxItems: 2 375 381 376 382 patternProperties: 377 383 "^mac@[0-1]$":
+6
Documentation/netlink/specs/rt_link.yaml
··· 1144 1144 - 1145 1145 name: mcast-querier-state 1146 1146 type: binary 1147 + - 1148 + name: fdb-n-learned 1149 + type: u32 1150 + - 1151 + name: fdb-max-learned 1152 + type: u32 1147 1153 - 1148 1154 name: linkinfo-brport-attrs 1149 1155 name-prefix: ifla-brport-
+3 -3
MAINTAINERS
··· 5709 5709 F: drivers/media/dvb-frontends/cxd2820r* 5710 5710 5711 5711 CXGB3 ETHERNET DRIVER (CXGB3) 5712 - M: Raju Rangoju <rajur@chelsio.com> 5712 + M: Potnuri Bharat Teja <bharat@chelsio.com> 5713 5713 L: netdev@vger.kernel.org 5714 5714 S: Supported 5715 5715 W: http://www.chelsio.com ··· 5730 5730 F: drivers/crypto/chelsio 5731 5731 5732 5732 CXGB4 ETHERNET DRIVER (CXGB4) 5733 - M: Raju Rangoju <rajur@chelsio.com> 5733 + M: Potnuri Bharat Teja <bharat@chelsio.com> 5734 5734 L: netdev@vger.kernel.org 5735 5735 S: Supported 5736 5736 W: http://www.chelsio.com ··· 5759 5759 F: include/uapi/rdma/cxgb4-abi.h 5760 5760 5761 5761 CXGB4VF ETHERNET DRIVER (CXGB4VF) 5762 - M: Raju Rangoju <rajur@chelsio.com> 5762 + M: Potnuri Bharat Teja <bharat@chelsio.com> 5763 5763 L: netdev@vger.kernel.org 5764 5764 S: Supported 5765 5765 W: http://www.chelsio.com
+2 -1
arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-pico6.dts
··· 82 82 }; 83 83 84 84 &mmc1 { 85 - bt_reset: bt-reset { 85 + bluetooth@2 { 86 + reg = <2>; 86 87 compatible = "mediatek,mt7921s-bluetooth"; 87 88 pinctrl-names = "default"; 88 89 pinctrl-0 = <&bt_pins_reset>;
+93 -19
drivers/bluetooth/btqca.c
··· 15 15 16 16 #define VERSION "0.1" 17 17 18 - #define QCA_BDADDR_DEFAULT (&(bdaddr_t) {{ 0xad, 0x5a, 0x00, 0x00, 0x00, 0x00 }}) 19 - 20 18 int qca_read_soc_version(struct hci_dev *hdev, struct qca_btsoc_version *ver, 21 19 enum qca_btsoc_type soc_type) 22 20 { ··· 99 101 { 100 102 struct sk_buff *skb; 101 103 struct edl_event_hdr *edl; 102 - char cmd, build_label[QCA_FW_BUILD_VER_LEN]; 104 + char *build_label; 105 + char cmd; 103 106 int build_lbl_len, err = 0; 104 107 105 108 bt_dev_dbg(hdev, "QCA read fw build info"); ··· 113 114 bt_dev_err(hdev, "Reading QCA fw build info failed (%d)", 114 115 err); 115 116 return err; 117 + } 118 + 119 + if (skb->len < sizeof(*edl)) { 120 + err = -EILSEQ; 121 + goto out; 116 122 } 117 123 118 124 edl = (struct edl_event_hdr *)(skb->data); ··· 135 131 goto out; 136 132 } 137 133 138 - build_lbl_len = edl->data[0]; 139 - if (build_lbl_len <= QCA_FW_BUILD_VER_LEN - 1) { 140 - memcpy(build_label, edl->data + 1, build_lbl_len); 141 - *(build_label + build_lbl_len) = '\0'; 134 + if (skb->len < sizeof(*edl) + 1) { 135 + err = -EILSEQ; 136 + goto out; 142 137 } 138 + 139 + build_lbl_len = edl->data[0]; 140 + 141 + if (skb->len < sizeof(*edl) + 1 + build_lbl_len) { 142 + err = -EILSEQ; 143 + goto out; 144 + } 145 + 146 + build_label = kstrndup(&edl->data[1], build_lbl_len, GFP_KERNEL); 147 + if (!build_label) 148 + goto out; 143 149 144 150 hci_set_fw_info(hdev, "%s", build_label); 145 151 152 + kfree(build_label); 146 153 out: 147 154 kfree_skb(skb); 148 155 return err; ··· 252 237 goto out; 253 238 } 254 239 240 + if (skb->len < 3) { 241 + err = -EILSEQ; 242 + goto out; 243 + } 244 + 255 245 *bid = (edl->data[1] << 8) + edl->data[2]; 256 246 bt_dev_dbg(hdev, "%s: bid = %x", __func__, *bid); 257 247 ··· 287 267 } 288 268 EXPORT_SYMBOL_GPL(qca_send_pre_shutdown_cmd); 289 269 290 - static void qca_tlv_check_data(struct hci_dev *hdev, 270 + static int qca_tlv_check_data(struct hci_dev *hdev, 291 271 struct qca_fw_config *config, 292 - u8 *fw_data, enum qca_btsoc_type soc_type) 272 + u8 *fw_data, size_t fw_size, 273 + enum qca_btsoc_type soc_type) 293 274 { 294 275 const u8 *data; 295 276 u32 type_len; ··· 300 279 struct tlv_type_patch *tlv_patch; 301 280 struct tlv_type_nvm *tlv_nvm; 302 281 uint8_t nvm_baud_rate = config->user_baud_rate; 282 + u8 type; 303 283 304 284 config->dnld_mode = QCA_SKIP_EVT_NONE; 305 285 config->dnld_type = QCA_SKIP_EVT_NONE; 306 286 307 287 switch (config->type) { 308 288 case ELF_TYPE_PATCH: 289 + if (fw_size < 7) 290 + return -EINVAL; 291 + 309 292 config->dnld_mode = QCA_SKIP_EVT_VSE_CC; 310 293 config->dnld_type = QCA_SKIP_EVT_VSE_CC; 311 294 ··· 318 293 bt_dev_dbg(hdev, "File version : 0x%x", fw_data[6]); 319 294 break; 320 295 case TLV_TYPE_PATCH: 296 + if (fw_size < sizeof(struct tlv_type_hdr) + sizeof(struct tlv_type_patch)) 297 + return -EINVAL; 298 + 321 299 tlv = (struct tlv_type_hdr *)fw_data; 322 300 type_len = le32_to_cpu(tlv->type_len); 323 301 tlv_patch = (struct tlv_type_patch *)tlv->data; ··· 360 332 break; 361 333 362 334 case TLV_TYPE_NVM: 335 + if (fw_size < sizeof(struct tlv_type_hdr)) 336 + return -EINVAL; 337 + 363 338 tlv = (struct tlv_type_hdr *)fw_data; 364 339 365 340 type_len = le32_to_cpu(tlv->type_len); 366 - length = (type_len >> 8) & 0x00ffffff; 341 + length = type_len >> 8; 342 + type = type_len & 0xff; 367 343 368 - BT_DBG("TLV Type\t\t : 0x%x", type_len & 0x000000ff); 344 + /* Some NVM files have more than one set of tags, only parse 345 + * the first set when it has type 2 for now. When there is 346 + * more than one set there is an enclosing header of type 4. 347 + */ 348 + if (type == 4) { 349 + if (fw_size < 2 * sizeof(struct tlv_type_hdr)) 350 + return -EINVAL; 351 + 352 + tlv++; 353 + 354 + type_len = le32_to_cpu(tlv->type_len); 355 + length = type_len >> 8; 356 + type = type_len & 0xff; 357 + } 358 + 359 + BT_DBG("TLV Type\t\t : 0x%x", type); 369 360 BT_DBG("Length\t\t : %d bytes", length); 361 + 362 + if (type != 2) 363 + break; 364 + 365 + if (fw_size < length + (tlv->data - fw_data)) 366 + return -EINVAL; 370 367 371 368 idx = 0; 372 369 data = tlv->data; 373 - while (idx < length) { 370 + while (idx < length - sizeof(struct tlv_type_nvm)) { 374 371 tlv_nvm = (struct tlv_type_nvm *)(data + idx); 375 372 376 373 tag_id = le16_to_cpu(tlv_nvm->tag_id); 377 374 tag_len = le16_to_cpu(tlv_nvm->tag_len); 378 375 376 + if (length < idx + sizeof(struct tlv_type_nvm) + tag_len) 377 + return -EINVAL; 378 + 379 379 /* Update NVM tags as needed */ 380 380 switch (tag_id) { 381 + case EDL_TAG_ID_BD_ADDR: 382 + if (tag_len != sizeof(bdaddr_t)) 383 + return -EINVAL; 384 + 385 + memcpy(&config->bdaddr, tlv_nvm->data, sizeof(bdaddr_t)); 386 + 387 + break; 388 + 381 389 case EDL_TAG_ID_HCI: 390 + if (tag_len < 3) 391 + return -EINVAL; 392 + 382 393 /* HCI transport layer parameters 383 394 * enabling software inband sleep 384 395 * onto controller side. ··· 433 366 break; 434 367 435 368 case EDL_TAG_ID_DEEP_SLEEP: 369 + if (tag_len < 1) 370 + return -EINVAL; 371 + 436 372 /* Sleep enable mask 437 373 * enabling deep sleep feature on controller. 438 374 */ ··· 444 374 break; 445 375 } 446 376 447 - idx += (sizeof(u16) + sizeof(u16) + 8 + tag_len); 377 + idx += sizeof(struct tlv_type_nvm) + tag_len; 448 378 } 449 379 break; 450 380 451 381 default: 452 382 BT_ERR("Unknown TLV type %d", config->type); 453 - break; 383 + return -EINVAL; 454 384 } 385 + 386 + return 0; 455 387 } 456 388 457 389 static int qca_tlv_send_segment(struct hci_dev *hdev, int seg_size, ··· 603 531 memcpy(data, fw->data, size); 604 532 release_firmware(fw); 605 533 606 - qca_tlv_check_data(hdev, config, data, soc_type); 534 + ret = qca_tlv_check_data(hdev, config, data, size, soc_type); 535 + if (ret) 536 + goto out; 607 537 608 538 segment = data; 609 539 remain = size; ··· 688 614 } 689 615 EXPORT_SYMBOL_GPL(qca_set_bdaddr_rome); 690 616 691 - static int qca_check_bdaddr(struct hci_dev *hdev) 617 + static int qca_check_bdaddr(struct hci_dev *hdev, const struct qca_fw_config *config) 692 618 { 693 619 struct hci_rp_read_bd_addr *bda; 694 620 struct sk_buff *skb; ··· 712 638 } 713 639 714 640 bda = (struct hci_rp_read_bd_addr *)skb->data; 715 - if (!bacmp(&bda->bdaddr, QCA_BDADDR_DEFAULT)) 641 + if (!bacmp(&bda->bdaddr, &config->bdaddr)) 716 642 set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks); 717 643 718 644 kfree_skb(skb); ··· 741 667 enum qca_btsoc_type soc_type, struct qca_btsoc_version ver, 742 668 const char *firmware_name) 743 669 { 744 - struct qca_fw_config config; 670 + struct qca_fw_config config = {}; 745 671 int err; 746 672 u8 rom_ver = 0; 747 673 u32 soc_ver; ··· 926 852 break; 927 853 } 928 854 929 - err = qca_check_bdaddr(hdev); 855 + err = qca_check_bdaddr(hdev, &config); 930 856 if (err) 931 857 return err; 932 858
+2 -1
drivers/bluetooth/btqca.h
··· 29 29 #define EDL_PATCH_CONFIG_RES_EVT (0x00) 30 30 #define QCA_DISABLE_LOGGING_SUB_OP (0x14) 31 31 32 + #define EDL_TAG_ID_BD_ADDR 2 32 33 #define EDL_TAG_ID_HCI (17) 33 34 #define EDL_TAG_ID_DEEP_SLEEP (27) 34 35 ··· 48 47 #define get_soc_ver(soc_id, rom_ver) \ 49 48 ((le32_to_cpu(soc_id) << 16) | (le16_to_cpu(rom_ver))) 50 49 51 - #define QCA_FW_BUILD_VER_LEN 255 52 50 #define QCA_HSP_GF_SOC_ID 0x1200 53 51 #define QCA_HSP_GF_SOC_MASK 0x0000ff00 54 52 ··· 94 94 uint8_t user_baud_rate; 95 95 enum qca_tlv_dnld_mode dnld_mode; 96 96 enum qca_tlv_dnld_mode dnld_type; 97 + bdaddr_t bdaddr; 97 98 }; 98 99 99 100 struct edl_event_hdr {
+31 -8
drivers/net/dsa/mv88e6xxx/chip.c
··· 637 637 MAC_1000FD; 638 638 } 639 639 640 - static int mv88e6352_get_port4_serdes_cmode(struct mv88e6xxx_chip *chip) 640 + static int mv88e63xx_get_port_serdes_cmode(struct mv88e6xxx_chip *chip, int port) 641 641 { 642 642 u16 reg, val; 643 643 int err; 644 644 645 - err = mv88e6xxx_port_read(chip, 4, MV88E6XXX_PORT_STS, &reg); 645 + err = mv88e6xxx_port_read(chip, port, MV88E6XXX_PORT_STS, &reg); 646 646 if (err) 647 647 return err; 648 648 ··· 651 651 return 0xf; 652 652 653 653 val = reg & ~MV88E6XXX_PORT_STS_PHY_DETECT; 654 - err = mv88e6xxx_port_write(chip, 4, MV88E6XXX_PORT_STS, val); 654 + err = mv88e6xxx_port_write(chip, port, MV88E6XXX_PORT_STS, val); 655 655 if (err) 656 656 return err; 657 657 658 - err = mv88e6xxx_port_read(chip, 4, MV88E6XXX_PORT_STS, &val); 658 + err = mv88e6xxx_port_read(chip, port, MV88E6XXX_PORT_STS, &val); 659 659 if (err) 660 660 return err; 661 661 662 662 /* Restore PHY_DETECT value */ 663 - err = mv88e6xxx_port_write(chip, 4, MV88E6XXX_PORT_STS, reg); 663 + err = mv88e6xxx_port_write(chip, port, MV88E6XXX_PORT_STS, reg); 664 664 if (err) 665 665 return err; 666 666 ··· 688 688 if (err <= 0) 689 689 return; 690 690 691 - cmode = mv88e6352_get_port4_serdes_cmode(chip); 691 + cmode = mv88e63xx_get_port_serdes_cmode(chip, port); 692 + if (cmode < 0) 693 + dev_err(chip->dev, "p%d: failed to read serdes cmode\n", 694 + port); 695 + else 696 + mv88e6xxx_translate_cmode(cmode, supported); 697 + } 698 + } 699 + 700 + static void mv88e632x_phylink_get_caps(struct mv88e6xxx_chip *chip, int port, 701 + struct phylink_config *config) 702 + { 703 + unsigned long *supported = config->supported_interfaces; 704 + int cmode; 705 + 706 + /* Translate the default cmode */ 707 + mv88e6xxx_translate_cmode(chip->ports[port].cmode, supported); 708 + 709 + config->mac_capabilities = MAC_SYM_PAUSE | MAC_10 | MAC_100 | 710 + MAC_1000FD; 711 + 712 + /* Port 0/1 are serdes only ports */ 713 + if (port == 0 || port == 1) { 714 + cmode = mv88e63xx_get_port_serdes_cmode(chip, port); 692 715 if (cmode < 0) 693 716 dev_err(chip->dev, "p%d: failed to read serdes cmode\n", 694 717 port); ··· 5116 5093 .gpio_ops = &mv88e6352_gpio_ops, 5117 5094 .avb_ops = &mv88e6352_avb_ops, 5118 5095 .ptp_ops = &mv88e6352_ptp_ops, 5119 - .phylink_get_caps = mv88e6185_phylink_get_caps, 5096 + .phylink_get_caps = mv88e632x_phylink_get_caps, 5120 5097 }; 5121 5098 5122 5099 static const struct mv88e6xxx_ops mv88e6321_ops = { ··· 5162 5139 .gpio_ops = &mv88e6352_gpio_ops, 5163 5140 .avb_ops = &mv88e6352_avb_ops, 5164 5141 .ptp_ops = &mv88e6352_ptp_ops, 5165 - .phylink_get_caps = mv88e6185_phylink_get_caps, 5142 + .phylink_get_caps = mv88e632x_phylink_get_caps, 5166 5143 }; 5167 5144 5168 5145 static const struct mv88e6xxx_ops mv88e6341_ops = {
+1 -1
drivers/net/ethernet/hisilicon/hns3/hnae3.h
··· 897 897 struct hnae3_roce_private_info rinfo; 898 898 }; 899 899 900 - u32 numa_node_mask; /* for multi-chip support */ 900 + nodemask_t numa_node_mask; /* for multi-chip support */ 901 901 902 902 enum hnae3_port_base_vlan_state port_base_vlan_state; 903 903
+28 -24
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
··· 1537 1537 cfg.default_speed, ret); 1538 1538 return ret; 1539 1539 } 1540 + hdev->hw.mac.req_speed = hdev->hw.mac.speed; 1541 + hdev->hw.mac.req_autoneg = AUTONEG_ENABLE; 1542 + hdev->hw.mac.req_duplex = DUPLEX_FULL; 1540 1543 1541 1544 hclge_parse_link_mode(hdev, cfg.speed_ability); 1542 1545 ··· 1769 1766 1770 1767 nic->pdev = hdev->pdev; 1771 1768 nic->ae_algo = &ae_algo; 1772 - nic->numa_node_mask = hdev->numa_node_mask; 1769 + bitmap_copy(nic->numa_node_mask.bits, hdev->numa_node_mask.bits, 1770 + MAX_NUMNODES); 1773 1771 nic->kinfo.io_base = hdev->hw.hw.io_base; 1774 1772 1775 1773 ret = hclge_knic_setup(vport, num_tqps, ··· 2462 2458 2463 2459 roce->pdev = nic->pdev; 2464 2460 roce->ae_algo = nic->ae_algo; 2465 - roce->numa_node_mask = nic->numa_node_mask; 2461 + bitmap_copy(roce->numa_node_mask.bits, nic->numa_node_mask.bits, 2462 + MAX_NUMNODES); 2466 2463 2467 2464 return 0; 2468 2465 } ··· 3347 3342 return ret; 3348 3343 } 3349 3344 3350 - hdev->hw.mac.autoneg = cmd->base.autoneg; 3351 - hdev->hw.mac.speed = cmd->base.speed; 3352 - hdev->hw.mac.duplex = cmd->base.duplex; 3345 + hdev->hw.mac.req_autoneg = cmd->base.autoneg; 3346 + hdev->hw.mac.req_speed = cmd->base.speed; 3347 + hdev->hw.mac.req_duplex = cmd->base.duplex; 3353 3348 linkmode_copy(hdev->hw.mac.advertising, cmd->link_modes.advertising); 3354 3349 3355 3350 return 0; ··· 3382 3377 if (!hnae3_dev_phy_imp_supported(hdev)) 3383 3378 return 0; 3384 3379 3385 - cmd.base.autoneg = hdev->hw.mac.autoneg; 3386 - cmd.base.speed = hdev->hw.mac.speed; 3387 - cmd.base.duplex = hdev->hw.mac.duplex; 3380 + cmd.base.autoneg = hdev->hw.mac.req_autoneg; 3381 + cmd.base.speed = hdev->hw.mac.req_speed; 3382 + cmd.base.duplex = hdev->hw.mac.req_duplex; 3388 3383 linkmode_copy(cmd.link_modes.advertising, hdev->hw.mac.advertising); 3389 3384 3390 3385 return hclge_set_phy_link_ksettings(&hdev->vport->nic, &cmd); ··· 7957 7952 /* Set the DOWN flag here to disable link updating */ 7958 7953 set_bit(HCLGE_STATE_DOWN, &hdev->state); 7959 7954 7960 - /* flush memory to make sure DOWN is seen by service task */ 7961 - smp_mb__before_atomic(); 7955 + smp_mb__after_atomic(); /* flush memory to make sure DOWN is seen by service task */ 7962 7956 hclge_flush_link_update(hdev); 7963 7957 } 7964 7958 } ··· 9910 9906 static int hclge_init_vlan_filter(struct hclge_dev *hdev) 9911 9907 { 9912 9908 struct hclge_vport *vport; 9909 + bool enable = true; 9913 9910 int ret; 9914 9911 int i; 9915 9912 ··· 9930 9925 vport->cur_vlan_fltr_en = true; 9931 9926 } 9932 9927 9928 + if (test_bit(HNAE3_DEV_SUPPORT_VLAN_FLTR_MDF_B, hdev->ae_dev->caps) && 9929 + !test_bit(HNAE3_DEV_SUPPORT_PORT_VLAN_BYPASS_B, hdev->ae_dev->caps)) 9930 + enable = false; 9931 + 9933 9932 return hclge_set_vlan_filter_ctrl(hdev, HCLGE_FILTER_TYPE_PORT, 9934 - HCLGE_FILTER_FE_INGRESS, true, 0); 9933 + HCLGE_FILTER_FE_INGRESS, enable, 0); 9935 9934 } 9936 9935 9937 9936 static int hclge_init_vlan_type(struct hclge_dev *hdev) ··· 11631 11622 if (ret) 11632 11623 goto out; 11633 11624 11634 - ret = hclge_devlink_init(hdev); 11635 - if (ret) 11636 - goto err_pci_uninit; 11637 - 11638 - devl_lock(hdev->devlink); 11639 - 11640 11625 /* Firmware command queue initialize */ 11641 11626 ret = hclge_comm_cmd_queue_init(hdev->pdev, &hdev->hw.hw); 11642 11627 if (ret) 11643 - goto err_devlink_uninit; 11628 + goto err_pci_uninit; 11644 11629 11645 11630 /* Firmware command initialize */ 11646 11631 ret = hclge_comm_cmd_init(hdev->ae_dev, &hdev->hw.hw, &hdev->fw_version, ··· 11762 11759 11763 11760 ret = hclge_update_port_info(hdev); 11764 11761 if (ret) 11765 - goto err_mdiobus_unreg; 11762 + goto err_ptp_uninit; 11766 11763 11767 11764 INIT_KFIFO(hdev->mac_tnl_log); 11768 11765 ··· 11802 11799 dev_warn(&pdev->dev, 11803 11800 "failed to wake on lan init, ret = %d\n", ret); 11804 11801 11802 + ret = hclge_devlink_init(hdev); 11803 + if (ret) 11804 + goto err_ptp_uninit; 11805 + 11805 11806 hclge_state_init(hdev); 11806 11807 hdev->last_reset_time = jiffies; 11807 11808 ··· 11813 11806 HCLGE_DRIVER_NAME); 11814 11807 11815 11808 hclge_task_schedule(hdev, round_jiffies_relative(HZ)); 11816 - 11817 - devl_unlock(hdev->devlink); 11818 11809 return 0; 11819 11810 11811 + err_ptp_uninit: 11812 + hclge_ptp_uninit(hdev); 11820 11813 err_mdiobus_unreg: 11821 11814 if (hdev->hw.mac.phydev) 11822 11815 mdiobus_unregister(hdev->hw.mac.mdio_bus); ··· 11826 11819 pci_free_irq_vectors(pdev); 11827 11820 err_cmd_uninit: 11828 11821 hclge_comm_cmd_uninit(hdev->ae_dev, &hdev->hw.hw); 11829 - err_devlink_uninit: 11830 - devl_unlock(hdev->devlink); 11831 - hclge_devlink_uninit(hdev); 11832 11822 err_pci_uninit: 11833 11823 pcim_iounmap(pdev, hdev->hw.hw.io_base); 11834 11824 pci_release_regions(pdev);
+4 -1
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
··· 279 279 u8 media_type; /* port media type, e.g. fibre/copper/backplane */ 280 280 u8 mac_addr[ETH_ALEN]; 281 281 u8 autoneg; 282 + u8 req_autoneg; 282 283 u8 duplex; 284 + u8 req_duplex; 283 285 u8 support_autoneg; 284 286 u8 speed_type; /* 0: sfp speed, 1: active speed */ 285 287 u8 lane_num; 286 288 u32 speed; 289 + u32 req_speed; 287 290 u32 max_speed; 288 291 u32 speed_ability; /* speed ability supported by current media */ 289 292 u32 module_type; /* sub media type, e.g. kr/cr/sr/lr */ ··· 894 891 895 892 u16 fdir_pf_filter_count; /* Num of guaranteed filters for this PF */ 896 893 u16 num_alloc_vport; /* Num vports this driver supports */ 897 - u32 numa_node_mask; 894 + nodemask_t numa_node_mask; 898 895 u16 rx_buf_len; 899 896 u16 num_tx_desc; /* desc num of per tx queue */ 900 897 u16 num_rx_desc; /* desc num of per rx queue */
+4 -3
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
··· 1077 1077 1078 1078 hdev = param->vport->back; 1079 1079 cmd_func = hclge_mbx_ops_list[param->req->msg.code]; 1080 - if (cmd_func) 1081 - ret = cmd_func(param); 1082 - else 1080 + if (!cmd_func) { 1083 1081 dev_err(&hdev->pdev->dev, 1084 1082 "un-supported mailbox message, code = %u\n", 1085 1083 param->req->msg.code); 1084 + return; 1085 + } 1086 + ret = cmd_func(param); 1086 1087 1087 1088 /* PF driver should not reply IMP */ 1088 1089 if (hnae3_get_bit(param->req->mbx_need_resp, HCLGE_MBX_NEED_RESP_B) &&
+9 -11
drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
··· 412 412 413 413 nic->ae_algo = &ae_algovf; 414 414 nic->pdev = hdev->pdev; 415 - nic->numa_node_mask = hdev->numa_node_mask; 415 + bitmap_copy(nic->numa_node_mask.bits, hdev->numa_node_mask.bits, 416 + MAX_NUMNODES); 416 417 nic->flags |= HNAE3_SUPPORT_VF; 417 418 nic->kinfo.io_base = hdev->hw.hw.io_base; 418 419 ··· 2083 2082 2084 2083 roce->pdev = nic->pdev; 2085 2084 roce->ae_algo = nic->ae_algo; 2086 - roce->numa_node_mask = nic->numa_node_mask; 2087 - 2085 + bitmap_copy(roce->numa_node_mask.bits, nic->numa_node_mask.bits, 2086 + MAX_NUMNODES); 2088 2087 return 0; 2089 2088 } 2090 2089 ··· 2181 2180 } else { 2182 2181 set_bit(HCLGEVF_STATE_DOWN, &hdev->state); 2183 2182 2184 - /* flush memory to make sure DOWN is seen by service task */ 2185 - smp_mb__before_atomic(); 2183 + smp_mb__after_atomic(); /* flush memory to make sure DOWN is seen by service task */ 2186 2184 hclgevf_flush_link_update(hdev); 2187 2185 } 2188 2186 } ··· 2845 2845 if (ret) 2846 2846 return ret; 2847 2847 2848 - ret = hclgevf_devlink_init(hdev); 2849 - if (ret) 2850 - goto err_devlink_init; 2851 - 2852 2848 ret = hclge_comm_cmd_queue_init(hdev->pdev, &hdev->hw.hw); 2853 2849 if (ret) 2854 2850 goto err_cmd_queue_init; ··· 2937 2941 2938 2942 hclgevf_init_rxd_adv_layout(hdev); 2939 2943 2944 + ret = hclgevf_devlink_init(hdev); 2945 + if (ret) 2946 + goto err_config; 2947 + 2940 2948 set_bit(HCLGEVF_STATE_SERVICE_INITED, &hdev->state); 2941 2949 2942 2950 hdev->last_reset_time = jiffies; ··· 2960 2960 err_cmd_init: 2961 2961 hclge_comm_cmd_uninit(hdev->ae_dev, &hdev->hw.hw); 2962 2962 err_cmd_queue_init: 2963 - hclgevf_devlink_uninit(hdev); 2964 - err_devlink_init: 2965 2963 hclgevf_pci_uninit(hdev); 2966 2964 clear_bit(HCLGEVF_STATE_IRQ_INITED, &hdev->state); 2967 2965 return ret;
+1 -1
drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h
··· 236 236 u16 rss_size_max; /* HW defined max RSS task queue */ 237 237 238 238 u16 num_alloc_vport; /* num vports this driver supports */ 239 - u32 numa_node_mask; 239 + nodemask_t numa_node_mask; 240 240 u16 rx_buf_len; 241 241 u16 num_tx_desc; /* desc num of per tx queue */ 242 242 u16 num_rx_desc; /* desc num of per rx queue */
+10 -6
drivers/net/ethernet/micrel/ks8851_common.c
··· 234 234 /** 235 235 * ks8851_rx_pkts - receive packets from the host 236 236 * @ks: The device information. 237 + * @rxq: Queue of packets received in this function. 237 238 * 238 239 * This is called from the IRQ work queue when the system detects that there 239 240 * are packets in the receive queue. Find out how many packets there are and 240 241 * read them from the FIFO. 241 242 */ 242 - static void ks8851_rx_pkts(struct ks8851_net *ks) 243 + static void ks8851_rx_pkts(struct ks8851_net *ks, struct sk_buff_head *rxq) 243 244 { 244 245 struct sk_buff *skb; 245 246 unsigned rxfc; ··· 300 299 ks8851_dbg_dumpkkt(ks, rxpkt); 301 300 302 301 skb->protocol = eth_type_trans(skb, ks->netdev); 303 - __netif_rx(skb); 302 + __skb_queue_tail(rxq, skb); 304 303 305 304 ks->netdev->stats.rx_packets++; 306 305 ks->netdev->stats.rx_bytes += rxlen; ··· 327 326 static irqreturn_t ks8851_irq(int irq, void *_ks) 328 327 { 329 328 struct ks8851_net *ks = _ks; 329 + struct sk_buff_head rxq; 330 330 unsigned handled = 0; 331 331 unsigned long flags; 332 332 unsigned int status; 333 - 334 - local_bh_disable(); 333 + struct sk_buff *skb; 335 334 336 335 ks8851_lock(ks, &flags); 337 336 ··· 385 384 * from the device so do not bother masking just the RX 386 385 * from the device. */ 387 386 388 - ks8851_rx_pkts(ks); 387 + __skb_queue_head_init(&rxq); 388 + ks8851_rx_pkts(ks, &rxq); 389 389 } 390 390 391 391 /* if something stopped the rx process, probably due to wanting ··· 410 408 if (status & IRQ_LCI) 411 409 mii_check_link(&ks->mii); 412 410 413 - local_bh_enable(); 411 + if (status & IRQ_RXI) 412 + while ((skb = __skb_dequeue(&rxq))) 413 + netif_rx(skb); 414 414 415 415 return IRQ_HANDLED; 416 416 }
+103 -16
drivers/net/phy/marvell-88q2xxx.c
··· 12 12 #include <linux/hwmon.h> 13 13 14 14 #define PHY_ID_88Q2220_REVB0 (MARVELL_PHY_ID_88Q2220 | 0x1) 15 + #define PHY_ID_88Q2220_REVB1 (MARVELL_PHY_ID_88Q2220 | 0x2) 16 + #define PHY_ID_88Q2220_REVB2 (MARVELL_PHY_ID_88Q2220 | 0x3) 15 17 16 18 #define MDIO_MMD_AN_MV_STAT 32769 17 19 #define MDIO_MMD_AN_MV_STAT_ANEG 0x0100 ··· 129 127 { MDIO_MMD_PCS, 0xfe79, 0x4 }, 130 128 { MDIO_MMD_PCS, 0xfe5f, 0xe8 }, 131 129 { MDIO_MMD_PCS, 0xfe05, 0x755c }, 130 + }; 131 + 132 + static const struct mmd_val mv88q222x_revb1_init_seq0[] = { 133 + { MDIO_MMD_PCS, 0xffe4, 0x0007 }, 134 + { MDIO_MMD_AN, MDIO_AN_T1_CTRL, 0x0 }, 135 + { MDIO_MMD_PCS, 0xffe3, 0x7000 }, 136 + { MDIO_MMD_PMAPMD, MDIO_CTRL1, 0x0840 }, 137 + }; 138 + 139 + static const struct mmd_val mv88q222x_revb2_init_seq0[] = { 140 + { MDIO_MMD_PCS, 0xffe4, 0x0007 }, 141 + { MDIO_MMD_AN, MDIO_AN_T1_CTRL, 0x0 }, 142 + { MDIO_MMD_PMAPMD, MDIO_CTRL1, 0x0840 }, 143 + }; 144 + 145 + static const struct mmd_val mv88q222x_revb1_revb2_init_seq1[] = { 146 + { MDIO_MMD_PCS, 0xfe07, 0x125a }, 147 + { MDIO_MMD_PCS, 0xfe09, 0x1288 }, 148 + { MDIO_MMD_PCS, 0xfe08, 0x2588 }, 149 + { MDIO_MMD_PCS, 0xfe72, 0x042c }, 150 + { MDIO_MMD_PCS, 0xffe4, 0x0071 }, 151 + { MDIO_MMD_PCS, 0xffe4, 0x0001 }, 152 + { MDIO_MMD_PCS, 0xfe1b, 0x0048 }, 153 + { MDIO_MMD_PMAPMD, 0x0000, 0x0000 }, 154 + { MDIO_MMD_PCS, 0x0000, 0x0000 }, 155 + { MDIO_MMD_PCS, 0xffdb, 0xfc10 }, 156 + { MDIO_MMD_PCS, 0xfe1b, 0x58 }, 157 + { MDIO_MMD_PCS, 0xfcad, 0x030c }, 158 + { MDIO_MMD_PCS, 0x8032, 0x6001 }, 159 + { MDIO_MMD_PCS, 0xfdff, 0x05a5 }, 160 + { MDIO_MMD_PCS, 0xfdec, 0xdbaf }, 161 + { MDIO_MMD_PCS, 0xfcab, 0x1054 }, 162 + { MDIO_MMD_PCS, 0xfcac, 0x1483 }, 163 + { MDIO_MMD_PCS, 0x8033, 0xc801 }, 164 + { MDIO_MMD_AN, 0x8032, 0x2020 }, 165 + { MDIO_MMD_AN, 0x8031, 0xa28 }, 166 + { MDIO_MMD_AN, 0x8031, 0xc28 }, 167 + { MDIO_MMD_PCS, 0xfbba, 0x0cb2 }, 168 + { MDIO_MMD_PCS, 0xfbbb, 0x0c4a }, 169 + { MDIO_MMD_PCS, 0xfe5f, 0xe8 }, 170 + { MDIO_MMD_PCS, 0xfe05, 0x755c }, 171 + { MDIO_MMD_PCS, 0xfa20, 0x002a }, 172 + { MDIO_MMD_PCS, 0xfe11, 0x1105 }, 132 173 }; 133 174 134 175 static int mv88q2xxx_soft_reset(struct phy_device *phydev) ··· 732 687 return 0; 733 688 } 734 689 735 - static int mv88q222x_revb0_config_init(struct phy_device *phydev) 690 + static int mv88q222x_write_mmd_vals(struct phy_device *phydev, 691 + const struct mmd_val *vals, size_t len) 736 692 { 737 - int ret, i; 693 + int ret; 738 694 739 - for (i = 0; i < ARRAY_SIZE(mv88q222x_revb0_init_seq0); i++) { 740 - ret = phy_write_mmd(phydev, mv88q222x_revb0_init_seq0[i].devad, 741 - mv88q222x_revb0_init_seq0[i].regnum, 742 - mv88q222x_revb0_init_seq0[i].val); 695 + for (; len; vals++, len--) { 696 + ret = phy_write_mmd(phydev, vals->devad, vals->regnum, 697 + vals->val); 743 698 if (ret < 0) 744 699 return ret; 745 700 } 701 + 702 + return 0; 703 + } 704 + 705 + static int mv88q222x_revb0_config_init(struct phy_device *phydev) 706 + { 707 + int ret; 708 + 709 + ret = mv88q222x_write_mmd_vals(phydev, mv88q222x_revb0_init_seq0, 710 + ARRAY_SIZE(mv88q222x_revb0_init_seq0)); 711 + if (ret < 0) 712 + return ret; 746 713 747 714 usleep_range(5000, 10000); 748 715 749 - for (i = 0; i < ARRAY_SIZE(mv88q222x_revb0_init_seq1); i++) { 750 - ret = phy_write_mmd(phydev, mv88q222x_revb0_init_seq1[i].devad, 751 - mv88q222x_revb0_init_seq1[i].regnum, 752 - mv88q222x_revb0_init_seq1[i].val); 753 - if (ret < 0) 754 - return ret; 755 - } 716 + ret = mv88q222x_write_mmd_vals(phydev, mv88q222x_revb0_init_seq1, 717 + ARRAY_SIZE(mv88q222x_revb0_init_seq1)); 718 + if (ret < 0) 719 + return ret; 756 720 757 721 return mv88q2xxx_config_init(phydev); 722 + } 723 + 724 + static int mv88q222x_revb1_revb2_config_init(struct phy_device *phydev) 725 + { 726 + bool is_rev_b1 = phydev->c45_ids.device_ids[MDIO_MMD_PMAPMD] == PHY_ID_88Q2220_REVB1; 727 + int ret; 728 + 729 + if (is_rev_b1) 730 + ret = mv88q222x_write_mmd_vals(phydev, mv88q222x_revb1_init_seq0, 731 + ARRAY_SIZE(mv88q222x_revb1_init_seq0)); 732 + else 733 + ret = mv88q222x_write_mmd_vals(phydev, mv88q222x_revb2_init_seq0, 734 + ARRAY_SIZE(mv88q222x_revb2_init_seq0)); 735 + if (ret < 0) 736 + return ret; 737 + 738 + usleep_range(3000, 5000); 739 + 740 + ret = mv88q222x_write_mmd_vals(phydev, mv88q222x_revb1_revb2_init_seq1, 741 + ARRAY_SIZE(mv88q222x_revb1_revb2_init_seq1)); 742 + if (ret < 0) 743 + return ret; 744 + 745 + return mv88q2xxx_config_init(phydev); 746 + } 747 + 748 + static int mv88q222x_config_init(struct phy_device *phydev) 749 + { 750 + if (phydev->c45_ids.device_ids[MDIO_MMD_PMAPMD] == PHY_ID_88Q2220_REVB0) 751 + return mv88q222x_revb0_config_init(phydev); 752 + else 753 + return mv88q222x_revb1_revb2_config_init(phydev); 758 754 } 759 755 760 756 static int mv88q222x_cable_test_start(struct phy_device *phydev) ··· 896 810 .get_sqi_max = mv88q2xxx_get_sqi_max, 897 811 }, 898 812 { 899 - PHY_ID_MATCH_EXACT(PHY_ID_88Q2220_REVB0), 813 + .phy_id = MARVELL_PHY_ID_88Q2220, 814 + .phy_id_mask = MARVELL_PHY_ID_MASK, 900 815 .name = "mv88q2220", 901 816 .flags = PHY_POLL_CABLE_TEST, 902 817 .probe = mv88q2xxx_probe, 903 818 .get_features = mv88q2xxx_get_features, 904 819 .config_aneg = mv88q2xxx_config_aneg, 905 820 .aneg_done = genphy_c45_aneg_done, 906 - .config_init = mv88q222x_revb0_config_init, 821 + .config_init = mv88q222x_config_init, 907 822 .read_status = mv88q2xxx_read_status, 908 823 .soft_reset = mv88q222x_soft_reset, 909 824 .config_intr = mv88q2xxx_config_intr, ··· 923 836 924 837 static struct mdio_device_id __maybe_unused mv88q2xxx_tbl[] = { 925 838 { MARVELL_PHY_ID_88Q2110, MARVELL_PHY_ID_MASK }, 926 - { PHY_ID_MATCH_EXACT(PHY_ID_88Q2220_REVB0), }, 839 + { MARVELL_PHY_ID_88Q2220, MARVELL_PHY_ID_MASK }, 927 840 { /*sentinel*/ } 928 841 }; 929 842 MODULE_DEVICE_TABLE(mdio, mv88q2xxx_tbl);
+15
include/linux/skbuff.h
··· 3031 3031 } 3032 3032 } 3033 3033 3034 + /* Move the full mac header up to current network_header. 3035 + * Leaves skb->data pointing at offset skb->mac_len into the mac_header. 3036 + * Must be provided the complete mac header length. 3037 + */ 3038 + static inline void skb_mac_header_rebuild_full(struct sk_buff *skb, u32 full_mac_len) 3039 + { 3040 + if (skb_mac_header_was_set(skb)) { 3041 + const unsigned char *old_mac = skb_mac_header(skb); 3042 + 3043 + skb_set_mac_header(skb, -full_mac_len); 3044 + memmove(skb_mac_header(skb), old_mac, full_mac_len); 3045 + __skb_push(skb, full_mac_len - skb->mac_len); 3046 + } 3047 + } 3048 + 3034 3049 static inline int skb_checksum_start_offset(const struct sk_buff *skb) 3035 3050 { 3036 3051 return skb->csum_start - skb_headroom(skb);
+3
include/net/xfrm.h
··· 1049 1049 #define CRYPTO_INVALID_PACKET_SYNTAX 64 1050 1050 #define CRYPTO_INVALID_PROTOCOL 128 1051 1051 1052 + /* Used to keep whole l2 header for transport mode GRO */ 1053 + __u32 orig_mac_len; 1054 + 1052 1055 __u8 proto; 1053 1056 __u8 inner_ipproto; 1054 1057 };
+1 -1
include/uapi/linux/xfrm.h
··· 228 228 #define XFRM_NR_MSGTYPES (XFRM_MSG_MAX + 1 - XFRM_MSG_BASE) 229 229 230 230 /* 231 - * Generic LSM security context for comunicating to user space 231 + * Generic LSM security context for communicating to user space 232 232 * NOTE: Same format as sadb_x_sec_ctx 233 233 */ 234 234 struct xfrm_user_sec_ctx {
+16 -3
net/appletalk/ddp.c
··· 88 88 static struct sock *atalk_search_socket(struct sockaddr_at *to, 89 89 struct atalk_iface *atif) 90 90 { 91 + struct sock *def_socket = NULL; 91 92 struct sock *s; 92 93 93 94 read_lock_bh(&atalk_sockets_lock); ··· 99 98 continue; 100 99 101 100 if (to->sat_addr.s_net == ATADDR_ANYNET && 102 - to->sat_addr.s_node == ATADDR_BCAST) 103 - goto found; 101 + to->sat_addr.s_node == ATADDR_BCAST) { 102 + if (atif->address.s_node == at->src_node && 103 + atif->address.s_net == at->src_net) { 104 + /* This socket's address matches the address of the interface 105 + * that received the packet -- use it 106 + */ 107 + goto found; 108 + } 109 + 110 + /* Continue searching for a socket matching the interface address, 111 + * but use this socket by default if no other one is found 112 + */ 113 + def_socket = s; 114 + } 104 115 105 116 if (to->sat_addr.s_net == at->src_net && 106 117 (to->sat_addr.s_node == at->src_node || ··· 129 116 goto found; 130 117 } 131 118 } 132 - s = NULL; 119 + s = def_socket; 133 120 found: 134 121 read_unlock_bh(&atalk_sockets_lock); 135 122 return s;
+1 -2
net/bluetooth/hci_core.c
··· 2768 2768 2769 2769 hci_unregister_suspend_notifier(hdev); 2770 2770 2771 - msft_unregister(hdev); 2772 - 2773 2771 hci_dev_do_close(hdev); 2774 2772 2775 2773 if (!test_bit(HCI_INIT, &hdev->flags) && ··· 2821 2823 hci_discovery_filter_clear(hdev); 2822 2824 hci_blocked_keys_clear(hdev); 2823 2825 hci_codec_list_clear(&hdev->local_codecs); 2826 + msft_release(hdev); 2824 2827 hci_dev_unlock(hdev); 2825 2828 2826 2829 ida_destroy(&hdev->unset_handle_ida);
+2
net/bluetooth/hci_event.c
··· 7037 7037 u16 handle = le16_to_cpu(ev->bis[i]); 7038 7038 7039 7039 bis = hci_conn_hash_lookup_handle(hdev, handle); 7040 + if (!bis) 7041 + continue; 7040 7042 7041 7043 set_bit(HCI_CONN_BIG_SYNC_FAILED, &bis->flags); 7042 7044 hci_connect_cfm(bis, ev->status);
+13 -11
net/bluetooth/l2cap_core.c
··· 415 415 416 416 BT_DBG("chan %p state %s", chan, state_to_string(chan->state)); 417 417 418 + if (!conn) 419 + return; 420 + 418 421 mutex_lock(&conn->chan_lock); 419 422 /* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling 420 423 * this work. No need to call l2cap_chan_hold(chan) here again. ··· 3905 3902 return 0; 3906 3903 } 3907 3904 3908 - static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn, 3909 - struct l2cap_cmd_hdr *cmd, 3910 - u8 *data, u8 rsp_code, u8 amp_id) 3905 + static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, 3906 + u8 *data, u8 rsp_code, u8 amp_id) 3911 3907 { 3912 3908 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data; 3913 3909 struct l2cap_conn_rsp rsp; 3914 - struct l2cap_chan *chan = NULL, *pchan; 3910 + struct l2cap_chan *chan = NULL, *pchan = NULL; 3915 3911 int result, status = L2CAP_CS_NO_INFO; 3916 3912 3917 3913 u16 dcid = 0, scid = __le16_to_cpu(req->scid); ··· 3923 3921 &conn->hcon->dst, ACL_LINK); 3924 3922 if (!pchan) { 3925 3923 result = L2CAP_CR_BAD_PSM; 3926 - goto sendresp; 3924 + goto response; 3927 3925 } 3928 3926 3929 3927 mutex_lock(&conn->chan_lock); ··· 4010 4008 } 4011 4009 4012 4010 response: 4013 - l2cap_chan_unlock(pchan); 4014 - mutex_unlock(&conn->chan_lock); 4015 - l2cap_chan_put(pchan); 4016 - 4017 - sendresp: 4018 4011 rsp.scid = cpu_to_le16(scid); 4019 4012 rsp.dcid = cpu_to_le16(dcid); 4020 4013 rsp.result = cpu_to_le16(result); 4021 4014 rsp.status = cpu_to_le16(status); 4022 4015 l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp); 4016 + 4017 + if (!pchan) 4018 + return; 4023 4019 4024 4020 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) { 4025 4021 struct l2cap_info_req info; ··· 4041 4041 chan->num_conf_req++; 4042 4042 } 4043 4043 4044 - return chan; 4044 + l2cap_chan_unlock(pchan); 4045 + mutex_unlock(&conn->chan_lock); 4046 + l2cap_chan_put(pchan); 4045 4047 } 4046 4048 4047 4049 static int l2cap_connect_req(struct l2cap_conn *conn,
+1 -1
net/bluetooth/msft.c
··· 769 769 mutex_init(&msft->filter_lock); 770 770 } 771 771 772 - void msft_unregister(struct hci_dev *hdev) 772 + void msft_release(struct hci_dev *hdev) 773 773 { 774 774 struct msft_data *msft = hdev->msft_data; 775 775
+2 -2
net/bluetooth/msft.h
··· 14 14 15 15 bool msft_monitor_supported(struct hci_dev *hdev); 16 16 void msft_register(struct hci_dev *hdev); 17 - void msft_unregister(struct hci_dev *hdev); 17 + void msft_release(struct hci_dev *hdev); 18 18 void msft_do_open(struct hci_dev *hdev); 19 19 void msft_do_close(struct hci_dev *hdev); 20 20 void msft_vendor_evt(struct hci_dev *hdev, void *data, struct sk_buff *skb); ··· 35 35 } 36 36 37 37 static inline void msft_register(struct hci_dev *hdev) {} 38 - static inline void msft_unregister(struct hci_dev *hdev) {} 38 + static inline void msft_release(struct hci_dev *hdev) {} 39 39 static inline void msft_do_open(struct hci_dev *hdev) {} 40 40 static inline void msft_do_close(struct hci_dev *hdev) {} 41 41 static inline void msft_vendor_evt(struct hci_dev *hdev, void *data,
+4
net/bluetooth/sco.c
··· 83 83 struct sock *sk; 84 84 85 85 sco_conn_lock(conn); 86 + if (!conn->hcon) { 87 + sco_conn_unlock(conn); 88 + return; 89 + } 86 90 sk = conn->sk; 87 91 if (sk) 88 92 sock_hold(sk);
+7 -2
net/bridge/br_forward.c
··· 258 258 { 259 259 struct net_device *dev = BR_INPUT_SKB_CB(skb)->brdev; 260 260 const unsigned char *src = eth_hdr(skb)->h_source; 261 + struct sk_buff *nskb; 261 262 262 263 if (!should_deliver(p, skb)) 263 264 return; ··· 267 266 if (skb->dev == p->dev && ether_addr_equal(src, addr)) 268 267 return; 269 268 270 - skb = pskb_copy(skb, GFP_ATOMIC); 271 - if (!skb) { 269 + __skb_push(skb, ETH_HLEN); 270 + nskb = pskb_copy(skb, GFP_ATOMIC); 271 + __skb_pull(skb, ETH_HLEN); 272 + if (!nskb) { 272 273 DEV_STATS_INC(dev, tx_dropped); 273 274 return; 274 275 } 275 276 277 + skb = nskb; 278 + __skb_pull(skb, ETH_HLEN); 276 279 if (!is_broadcast_ether_addr(addr)) 277 280 memcpy(eth_hdr(skb)->h_dest, addr, ETH_ALEN); 278 281
+10 -3
net/core/net_namespace.c
··· 69 69 70 70 static struct net_generic *net_alloc_generic(void) 71 71 { 72 + unsigned int gen_ptrs = READ_ONCE(max_gen_ptrs); 73 + unsigned int generic_size; 72 74 struct net_generic *ng; 73 - unsigned int generic_size = offsetof(struct net_generic, ptr[max_gen_ptrs]); 75 + 76 + generic_size = offsetof(struct net_generic, ptr[gen_ptrs]); 74 77 75 78 ng = kzalloc(generic_size, GFP_KERNEL); 76 79 if (ng) 77 - ng->s.len = max_gen_ptrs; 80 + ng->s.len = gen_ptrs; 78 81 79 82 return ng; 80 83 } ··· 1310 1307 if (error < 0) 1311 1308 return error; 1312 1309 *ops->id = error; 1313 - max_gen_ptrs = max(max_gen_ptrs, *ops->id + 1); 1310 + /* This does not require READ_ONCE as writers already hold 1311 + * pernet_ops_rwsem. But WRITE_ONCE is needed to protect 1312 + * net_alloc_generic. 1313 + */ 1314 + WRITE_ONCE(max_gen_ptrs, max(max_gen_ptrs, *ops->id + 1)); 1314 1315 } 1315 1316 error = __register_pernet_operations(list, ops); 1316 1317 if (error) {
+1 -1
net/core/rtnetlink.c
··· 2530 2530 2531 2531 nla_for_each_nested(attr, tb[IFLA_VF_VLAN_LIST], rem) { 2532 2532 if (nla_type(attr) != IFLA_VF_VLAN_INFO || 2533 - nla_len(attr) < NLA_HDRLEN) { 2533 + nla_len(attr) < sizeof(struct ifla_vf_vlan_info)) { 2534 2534 return -EINVAL; 2535 2535 } 2536 2536 if (len >= MAX_VLAN_LIST_LEN)
+12 -15
net/hsr/hsr_device.c
··· 61 61 return false; 62 62 } 63 63 64 - static void hsr_check_announce(struct net_device *hsr_dev, 65 - unsigned char old_operstate) 64 + static void hsr_check_announce(struct net_device *hsr_dev) 66 65 { 67 66 struct hsr_priv *hsr; 68 67 69 68 hsr = netdev_priv(hsr_dev); 70 - 71 - if (READ_ONCE(hsr_dev->operstate) == IF_OPER_UP && old_operstate != IF_OPER_UP) { 72 - /* Went up */ 73 - hsr->announce_count = 0; 74 - mod_timer(&hsr->announce_timer, 75 - jiffies + msecs_to_jiffies(HSR_ANNOUNCE_INTERVAL)); 69 + if (netif_running(hsr_dev) && netif_oper_up(hsr_dev)) { 70 + /* Enable announce timer and start sending supervisory frames */ 71 + if (!timer_pending(&hsr->announce_timer)) { 72 + hsr->announce_count = 0; 73 + mod_timer(&hsr->announce_timer, jiffies + 74 + msecs_to_jiffies(HSR_ANNOUNCE_INTERVAL)); 75 + } 76 + } else { 77 + /* Deactivate the announce timer */ 78 + timer_delete(&hsr->announce_timer); 76 79 } 77 - 78 - if (READ_ONCE(hsr_dev->operstate) != IF_OPER_UP && old_operstate == IF_OPER_UP) 79 - /* Went down */ 80 - del_timer(&hsr->announce_timer); 81 80 } 82 81 83 82 void hsr_check_carrier_and_operstate(struct hsr_priv *hsr) 84 83 { 85 84 struct hsr_port *master; 86 - unsigned char old_operstate; 87 85 bool has_carrier; 88 86 89 87 master = hsr_port_get_hsr(hsr, HSR_PT_MASTER); 90 88 /* netif_stacked_transfer_operstate() cannot be used here since 91 89 * it doesn't set IF_OPER_LOWERLAYERDOWN (?) 92 90 */ 93 - old_operstate = READ_ONCE(master->dev->operstate); 94 91 has_carrier = hsr_check_carrier(master); 95 92 hsr_set_operstate(master, has_carrier); 96 - hsr_check_announce(master->dev, old_operstate); 93 + hsr_check_announce(master->dev); 97 94 } 98 95 99 96 int hsr_get_max_mtu(struct hsr_priv *hsr)
+2 -2
net/ipv4/tcp.c
··· 2710 2710 /* If we've already sent a FIN, or it's a closed state, skip this. */ 2711 2711 if ((1 << sk->sk_state) & 2712 2712 (TCPF_ESTABLISHED | TCPF_SYN_SENT | 2713 - TCPF_SYN_RECV | TCPF_CLOSE_WAIT)) { 2713 + TCPF_CLOSE_WAIT)) { 2714 2714 /* Clear out any half completed packets. FIN if needed. */ 2715 2715 if (tcp_close_state(sk)) 2716 2716 tcp_send_fin(sk); ··· 2819 2819 * machine. State transitions: 2820 2820 * 2821 2821 * TCP_ESTABLISHED -> TCP_FIN_WAIT1 2822 - * TCP_SYN_RECV -> TCP_FIN_WAIT1 (forget it, it's impossible) 2822 + * TCP_SYN_RECV -> TCP_FIN_WAIT1 (it is difficult) 2823 2823 * TCP_CLOSE_WAIT -> TCP_LAST_ACK 2824 2824 * 2825 2825 * are legal only when FIN has been sent (i.e. in window),
+2
net/ipv4/tcp_input.c
··· 6761 6761 6762 6762 tcp_initialize_rcv_mss(sk); 6763 6763 tcp_fast_path_on(tp); 6764 + if (sk->sk_shutdown & SEND_SHUTDOWN) 6765 + tcp_shutdown(sk, SEND_SHUTDOWN); 6764 6766 break; 6765 6767 6766 6768 case TCP_FIN_WAIT1: {
+7 -1
net/ipv4/tcp_ipv4.c
··· 154 154 if (tcptw->tw_ts_recent_stamp && 155 155 (!twp || (reuse && time_after32(ktime_get_seconds(), 156 156 tcptw->tw_ts_recent_stamp)))) { 157 + /* inet_twsk_hashdance() sets sk_refcnt after putting twsk 158 + * and releasing the bucket lock. 159 + */ 160 + if (unlikely(!refcount_inc_not_zero(&sktw->sk_refcnt))) 161 + return 0; 162 + 157 163 /* In case of repair and re-using TIME-WAIT sockets we still 158 164 * want to be sure that it is safe as above but honor the 159 165 * sequence numbers and time stamps set as part of the repair ··· 180 174 tp->rx_opt.ts_recent = tcptw->tw_ts_recent; 181 175 tp->rx_opt.ts_recent_stamp = tcptw->tw_ts_recent_stamp; 182 176 } 183 - sock_hold(sktw); 177 + 184 178 return 1; 185 179 } 186 180
+3 -1
net/ipv4/tcp_output.c
··· 3563 3563 return; 3564 3564 } 3565 3565 } else { 3566 - skb = alloc_skb_fclone(MAX_TCP_HEADER, sk->sk_allocation); 3566 + skb = alloc_skb_fclone(MAX_TCP_HEADER, 3567 + sk_gfp_mask(sk, GFP_ATOMIC | 3568 + __GFP_NOWARN)); 3567 3569 if (unlikely(!skb)) 3568 3570 return; 3569 3571
+5 -1
net/ipv4/xfrm4_input.c
··· 63 63 ip_send_check(iph); 64 64 65 65 if (xo && (xo->flags & XFRM_GRO)) { 66 - skb_mac_header_rebuild(skb); 66 + /* The full l2 header needs to be preserved so that re-injecting the packet at l2 67 + * works correctly in the presence of vlan tags. 68 + */ 69 + skb_mac_header_rebuild_full(skb, xo->orig_mac_len); 70 + skb_reset_network_header(skb); 67 71 skb_reset_transport_header(skb); 68 72 return 0; 69 73 }
+5 -1
net/ipv6/fib6_rules.c
··· 233 233 rt = pol_lookup_func(lookup, 234 234 net, table, flp6, arg->lookup_data, flags); 235 235 if (rt != net->ipv6.ip6_null_entry) { 236 + struct inet6_dev *idev = ip6_dst_idev(&rt->dst); 237 + 238 + if (!idev) 239 + goto again; 236 240 err = fib6_rule_saddr(net, rule, flags, flp6, 237 - ip6_dst_idev(&rt->dst)->dev); 241 + idev->dev); 238 242 239 243 if (err == -EAGAIN) 240 244 goto again;
+2 -2
net/ipv6/ip6_output.c
··· 234 234 skb->protocol = htons(ETH_P_IPV6); 235 235 skb->dev = dev; 236 236 237 - if (unlikely(READ_ONCE(idev->cnf.disable_ipv6))) { 237 + if (unlikely(!idev || READ_ONCE(idev->cnf.disable_ipv6))) { 238 238 IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS); 239 239 kfree_skb_reason(skb, SKB_DROP_REASON_IPV6DISABLED); 240 240 return 0; ··· 1933 1933 u8 icmp6_type; 1934 1934 1935 1935 if (sk->sk_socket->type == SOCK_RAW && 1936 - !inet_test_bit(HDRINCL, sk)) 1936 + !(fl6->flowi6_flags & FLOWI_FLAG_KNOWN_NH)) 1937 1937 icmp6_type = fl6->fl6_icmp_type; 1938 1938 else 1939 1939 icmp6_type = icmp6_hdr(skb)->icmp6_type;
+5 -1
net/ipv6/xfrm6_input.c
··· 58 58 skb_postpush_rcsum(skb, skb_network_header(skb), nhlen); 59 59 60 60 if (xo && (xo->flags & XFRM_GRO)) { 61 - skb_mac_header_rebuild(skb); 61 + /* The full l2 header needs to be preserved so that re-injecting the packet at l2 62 + * works correctly in the presence of vlan tags. 63 + */ 64 + skb_mac_header_rebuild_full(skb, xo->orig_mac_len); 65 + skb_reset_network_header(skb); 62 66 skb_reset_transport_header(skb); 63 67 return 0; 64 68 }
+38 -1
net/mptcp/ctrl.c
··· 96 96 } 97 97 98 98 #ifdef CONFIG_SYSCTL 99 + static int mptcp_set_scheduler(const struct net *net, const char *name) 100 + { 101 + struct mptcp_pernet *pernet = mptcp_get_pernet(net); 102 + struct mptcp_sched_ops *sched; 103 + int ret = 0; 104 + 105 + rcu_read_lock(); 106 + sched = mptcp_sched_find(name); 107 + if (sched) 108 + strscpy(pernet->scheduler, name, MPTCP_SCHED_NAME_MAX); 109 + else 110 + ret = -ENOENT; 111 + rcu_read_unlock(); 112 + 113 + return ret; 114 + } 115 + 116 + static int proc_scheduler(struct ctl_table *ctl, int write, 117 + void *buffer, size_t *lenp, loff_t *ppos) 118 + { 119 + const struct net *net = current->nsproxy->net_ns; 120 + char val[MPTCP_SCHED_NAME_MAX]; 121 + struct ctl_table tbl = { 122 + .data = val, 123 + .maxlen = MPTCP_SCHED_NAME_MAX, 124 + }; 125 + int ret; 126 + 127 + strscpy(val, mptcp_get_scheduler(net), MPTCP_SCHED_NAME_MAX); 128 + 129 + ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 130 + if (write && ret == 0) 131 + ret = mptcp_set_scheduler(net, val); 132 + 133 + return ret; 134 + } 135 + 99 136 static struct ctl_table mptcp_sysctl_table[] = { 100 137 { 101 138 .procname = "enabled", ··· 185 148 .procname = "scheduler", 186 149 .maxlen = MPTCP_SCHED_NAME_MAX, 187 150 .mode = 0644, 188 - .proc_handler = proc_dostring, 151 + .proc_handler = proc_scheduler, 189 152 }, 190 153 { 191 154 .procname = "close_timeout",
+1
net/nfc/nci/core.c
··· 1518 1518 1519 1519 if (!nci_plen(skb->data)) { 1520 1520 kfree_skb(skb); 1521 + kcov_remote_stop(); 1521 1522 break; 1522 1523 } 1523 1524
+1 -1
net/phonet/pn_netlink.c
··· 193 193 struct sk_buff *skb; 194 194 int err = -ENOBUFS; 195 195 196 - skb = nlmsg_new(NLMSG_ALIGN(sizeof(struct ifaddrmsg)) + 196 + skb = nlmsg_new(NLMSG_ALIGN(sizeof(struct rtmsg)) + 197 197 nla_total_size(1) + nla_total_size(4), GFP_KERNEL); 198 198 if (skb == NULL) 199 199 goto errout;
+1 -1
net/rxrpc/ar-internal.h
··· 697 697 * packets) rather than bytes. 698 698 */ 699 699 #define RXRPC_TX_SMSS RXRPC_JUMBO_DATALEN 700 - #define RXRPC_MIN_CWND (RXRPC_TX_SMSS > 2190 ? 2 : RXRPC_TX_SMSS > 1095 ? 3 : 4) 700 + #define RXRPC_MIN_CWND 4 701 701 u8 cong_cwnd; /* Congestion window size */ 702 702 u8 cong_extra; /* Extra to send for congestion management */ 703 703 u8 cong_ssthresh; /* Slow-start threshold */
+1 -6
net/rxrpc/call_object.c
··· 174 174 call->rx_winsize = rxrpc_rx_window_size; 175 175 call->tx_winsize = 16; 176 176 177 - if (RXRPC_TX_SMSS > 2190) 178 - call->cong_cwnd = 2; 179 - else if (RXRPC_TX_SMSS > 1095) 180 - call->cong_cwnd = 3; 181 - else 182 - call->cong_cwnd = 4; 177 + call->cong_cwnd = RXRPC_MIN_CWND; 183 178 call->cong_ssthresh = RXRPC_TX_MAX_WINDOW; 184 179 185 180 call->rxnet = rxnet;
+35 -14
net/rxrpc/input.c
··· 9 9 10 10 #include "ar-internal.h" 11 11 12 + /* Override priority when generating ACKs for received DATA */ 13 + static const u8 rxrpc_ack_priority[RXRPC_ACK__INVALID] = { 14 + [RXRPC_ACK_IDLE] = 1, 15 + [RXRPC_ACK_DELAY] = 2, 16 + [RXRPC_ACK_REQUESTED] = 3, 17 + [RXRPC_ACK_DUPLICATE] = 4, 18 + [RXRPC_ACK_EXCEEDS_WINDOW] = 5, 19 + [RXRPC_ACK_NOSPACE] = 6, 20 + [RXRPC_ACK_OUT_OF_SEQUENCE] = 7, 21 + }; 22 + 12 23 static void rxrpc_proto_abort(struct rxrpc_call *call, rxrpc_seq_t seq, 13 24 enum rxrpc_abort_reason why) 14 25 { ··· 376 365 * Process a DATA packet. 377 366 */ 378 367 static void rxrpc_input_data_one(struct rxrpc_call *call, struct sk_buff *skb, 379 - bool *_notify) 368 + bool *_notify, rxrpc_serial_t *_ack_serial, int *_ack_reason) 380 369 { 381 370 struct rxrpc_skb_priv *sp = rxrpc_skb(skb); 382 371 struct sk_buff *oos; ··· 429 418 /* Send an immediate ACK if we fill in a hole */ 430 419 else if (!skb_queue_empty(&call->rx_oos_queue)) 431 420 ack_reason = RXRPC_ACK_DELAY; 432 - else 433 - call->ackr_nr_unacked++; 434 421 435 422 window++; 436 423 if (after(window, wtop)) { ··· 506 497 } 507 498 508 499 send_ack: 509 - if (ack_reason >= 0) 510 - rxrpc_send_ACK(call, ack_reason, serial, 511 - rxrpc_propose_ack_input_data); 512 - else 513 - rxrpc_propose_delay_ACK(call, serial, 514 - rxrpc_propose_ack_input_data); 500 + if (ack_reason >= 0) { 501 + if (rxrpc_ack_priority[ack_reason] > rxrpc_ack_priority[*_ack_reason]) { 502 + *_ack_serial = serial; 503 + *_ack_reason = ack_reason; 504 + } else if (rxrpc_ack_priority[ack_reason] == rxrpc_ack_priority[*_ack_reason] && 505 + ack_reason == RXRPC_ACK_REQUESTED) { 506 + *_ack_serial = serial; 507 + *_ack_reason = ack_reason; 508 + } 509 + } 515 510 } 516 511 517 512 /* ··· 526 513 struct rxrpc_jumbo_header jhdr; 527 514 struct rxrpc_skb_priv *sp = rxrpc_skb(skb), *jsp; 528 515 struct sk_buff *jskb; 516 + rxrpc_serial_t ack_serial = 0; 529 517 unsigned int offset = sizeof(struct rxrpc_wire_header); 530 518 unsigned int len = skb->len - offset; 531 519 bool notify = false; 520 + int ack_reason = 0; 532 521 533 522 while (sp->hdr.flags & RXRPC_JUMBO_PACKET) { 534 523 if (len < RXRPC_JUMBO_SUBPKTLEN) ··· 550 535 jsp = rxrpc_skb(jskb); 551 536 jsp->offset = offset; 552 537 jsp->len = RXRPC_JUMBO_DATALEN; 553 - rxrpc_input_data_one(call, jskb, &notify); 538 + rxrpc_input_data_one(call, jskb, &notify, &ack_serial, &ack_reason); 554 539 rxrpc_free_skb(jskb, rxrpc_skb_put_jumbo_subpacket); 555 540 556 541 sp->hdr.flags = jhdr.flags; ··· 563 548 564 549 sp->offset = offset; 565 550 sp->len = len; 566 - rxrpc_input_data_one(call, skb, &notify); 551 + rxrpc_input_data_one(call, skb, &notify, &ack_serial, &ack_reason); 552 + 553 + if (ack_reason > 0) { 554 + rxrpc_send_ACK(call, ack_reason, ack_serial, 555 + rxrpc_propose_ack_input_data); 556 + } else { 557 + call->ackr_nr_unacked++; 558 + rxrpc_propose_delay_ACK(call, sp->hdr.serial, 559 + rxrpc_propose_ack_input_data); 560 + } 567 561 if (notify) { 568 562 trace_rxrpc_notify_socket(call->debug_id, sp->hdr.serial); 569 563 rxrpc_notify_socket(call); ··· 708 684 trace_rxrpc_rx_rwind_change(call, sp->hdr.serial, rwind, wake); 709 685 call->tx_winsize = rwind; 710 686 } 711 - 712 - if (call->cong_ssthresh > rwind) 713 - call->cong_ssthresh = rwind; 714 687 715 688 mtu = min(ntohl(trailer->maxMTU), ntohl(trailer->ifMTU)); 716 689
+12 -7
net/smc/smc_ib.c
··· 209 209 if (IS_ERR(rt)) 210 210 goto out; 211 211 if (rt->rt_uses_gateway && rt->rt_gw_family != AF_INET) 212 - goto out; 213 - neigh = rt->dst.ops->neigh_lookup(&rt->dst, NULL, &fl4.daddr); 214 - if (neigh) { 215 - memcpy(nexthop_mac, neigh->ha, ETH_ALEN); 216 - *uses_gateway = rt->rt_uses_gateway; 217 - return 0; 218 - } 212 + goto out_rt; 213 + neigh = dst_neigh_lookup(&rt->dst, &fl4.daddr); 214 + if (!neigh) 215 + goto out_rt; 216 + memcpy(nexthop_mac, neigh->ha, ETH_ALEN); 217 + *uses_gateway = rt->rt_uses_gateway; 218 + neigh_release(neigh); 219 + ip_rt_put(rt); 220 + return 0; 221 + 222 + out_rt: 223 + ip_rt_put(rt); 219 224 out: 220 225 return -ENOENT; 221 226 }
+8
net/xfrm/xfrm_input.c
··· 389 389 */ 390 390 static int xfrm4_transport_input(struct xfrm_state *x, struct sk_buff *skb) 391 391 { 392 + struct xfrm_offload *xo = xfrm_offload(skb); 392 393 int ihl = skb->data - skb_transport_header(skb); 393 394 394 395 if (skb->transport_header != skb->network_header) { 395 396 memmove(skb_transport_header(skb), 396 397 skb_network_header(skb), ihl); 398 + if (xo) 399 + xo->orig_mac_len = 400 + skb_mac_header_was_set(skb) ? skb_mac_header_len(skb) : 0; 397 401 skb->network_header = skb->transport_header; 398 402 } 399 403 ip_hdr(skb)->tot_len = htons(skb->len + ihl); ··· 408 404 static int xfrm6_transport_input(struct xfrm_state *x, struct sk_buff *skb) 409 405 { 410 406 #if IS_ENABLED(CONFIG_IPV6) 407 + struct xfrm_offload *xo = xfrm_offload(skb); 411 408 int ihl = skb->data - skb_transport_header(skb); 412 409 413 410 if (skb->transport_header != skb->network_header) { 414 411 memmove(skb_transport_header(skb), 415 412 skb_network_header(skb), ihl); 413 + if (xo) 414 + xo->orig_mac_len = 415 + skb_mac_header_was_set(skb) ? skb_mac_header_len(skb) : 0; 416 416 skb->network_header = skb->transport_header; 417 417 } 418 418 ipv6_hdr(skb)->payload_len = htons(skb->len + ihl -
+2
net/xfrm/xfrm_policy.c
··· 3593 3593 return pol; 3594 3594 3595 3595 pol = xfrm_policy_lookup(net, &fl1, family, XFRM_POLICY_FWD, if_id); 3596 + if (IS_ERR(pol)) 3597 + pol = NULL; 3596 3598 } 3597 3599 3598 3600 return pol;
+3 -11
tools/testing/selftests/net/test_bridge_neigh_suppress.sh
··· 154 154 setup_topo_ns $ns 155 155 done 156 156 157 - ip link add name veth0 type veth peer name veth1 158 - ip link set dev veth0 netns $h1 name eth0 159 - ip link set dev veth1 netns $sw1 name swp1 160 - 161 - ip link add name veth0 type veth peer name veth1 162 - ip link set dev veth0 netns $sw1 name veth0 163 - ip link set dev veth1 netns $sw2 name veth0 164 - 165 - ip link add name veth0 type veth peer name veth1 166 - ip link set dev veth0 netns $h2 name eth0 167 - ip link set dev veth1 netns $sw2 name swp1 157 + ip -n $h1 link add name eth0 type veth peer name swp1 netns $sw1 158 + ip -n $sw1 link add name veth0 type veth peer name veth0 netns $sw2 159 + ip -n $h2 link add name eth0 type veth peer name swp1 netns $sw2 168 160 } 169 161 170 162 setup_host_common()