tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

1) Fix handling of pinned BPF map nodes in hash of maps, from Daniel
Borkmann.

2) IPSEC ESP error paths leak memory, from Steffen Klassert.

3) We need an RCU grace period before freeing fib6_node objects, from
Wei Wang.

4) Must check skb_put_padto() return value in HSR driver, from FLorian
Fainelli.

5) Fix oops on PHY probe failure in ftgmac100 driver, from Andrew
Jeffery.

6) Fix infinite loop in UDP queue when using SO_PEEK_OFF, from Eric
Dumazet.

7) Use after free when tcf_chain_destroy() called multiple times, from
Jiri Pirko.

8) Fix KSZ DSA tag layer multiple free of SKBS, from Florian Fainelli.

9) Fix leak of uninitialized memory in sctp_get_sctp_info(),
inet_diag_msg_sctpladdrs_fill() and inet_diag_msg_sctpaddrs_fill().
From Stefano Brivio.

10) L2TP tunnel refcount fixes from Guillaume Nault.

11) Don't leak UDP secpath in udp_set_dev_scratch(), from Yossi
Kauperman.

12) Revert a PHY layer change wrt. handling of PHY_HALTED state in
phy_stop_machine(), it causes regressions for multiple people. From
Florian Fainelli.

13) When packets are sent out of br0 we have to clear the
offload_fwdq_mark value.

14) Several NULL pointer deref fixes in packet schedulers when their
->init() routine fails. From Nikolay Aleksandrov.

15) Aquantium devices cannot checksum offload correctly when the packet
is <= 60 bytes. From Pavel Belous.

16) Fix vnet header access past end of buffer in AF_PACKET, from
Benjamin Poirier.

17) Double free in probe error paths of nfp driver, from Dan Carpenter.

18) QOS capability not checked properly in DCB init paths of mlx5
driver, from Huy Nguyen.

19) Fix conflicts between firmware load failure and health_care timer in
mlx5, also from Huy Nguyen.

20) Fix dangling page pointer when DMA mapping errors occur in mlx5,
from Eran Ben ELisha.

21) ->ndo_setup_tc() in bnxt_en driver doesn't count rings properly,
from Michael Chan.

22) Missing MSIX vector free in bnxt_en, also from Michael Chan.

23) Refcount leak in xfrm layer when using sk_policy, from Lorenzo
Colitti.

24) Fix copy of uninitialized data in qlge driver, from Arnd Bergmann.

25) bpf_setsockopts() erroneously always returns -EINVAL even on
success. Fix from Yuchung Cheng.

26) tipc_rcv() needs to linearize the SKB before parsing the inner
headers, from Parthasarathy Bhuvaragan.

27) Fix deadlock between link status updates and link removal in netvsc
driver, from Stephen Hemminger.

28) Missed locking of page fragment handling in ESP output, from Steffen
Klassert.

29) Fix refcnt leak in ebpf congestion control code, from Sabrina
Dubroca.

30) sxgbe_probe_config_dt() doesn't check devm_kzalloc()'s return value,
from Christophe Jaillet.

31) Fix missing ipv6 rx_dst_cookie update when rx_dst is updated during
early demux, from Paolo Abeni.

32) Several info leaks in xfrm_user layer, from Mathias Krause.

33) Fix out of bounds read in cxgb4 driver, from Stefano Brivio.

34) Properly propagate obsolete state of route upwards in ipv6 so that
upper holders like xfrm can see it. From Xin Long.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (118 commits)
udp: fix secpath leak
bridge: switchdev: Clear forward mark when transmitting packet
mlxsw: spectrum: Forbid linking to devices that have uppers
wl1251: add a missing spin_lock_init()
Revert "net: phy: Correctly process PHY_HALTED in phy_stop_machine()"
net: dsa: bcm_sf2: Fix number of CFP entries for BCM7278
kcm: do not attach PF_KCM sockets to avoid deadlock
sch_tbf: fix two null pointer dereferences on init failure
sch_sfq: fix null pointer dereference on init failure
sch_netem: avoid null pointer deref on init failure
sch_fq_codel: avoid double free on init failure
sch_cbq: fix null pointer dereferences on init failure
sch_hfsc: fix null pointer deref and double free on init failure
sch_hhf: fix null pointer dereference on init failure
sch_multiq: fix double free on init failure
sch_htb: fix crash on init failure
net/mlx5e: Fix CQ moderation mode not set properly
net/mlx5e: Fix inline header size for small packets
net/mlx5: E-Switch, Unload the representors in the correct order
net/mlx5e: Properly resolve TC offloaded ipv6 vxlan tunnel source address
...

Linus Torvalds 8cf9f2a2 b8a78bb4

+820 -563
+4
drivers/net/dsa/bcm_sf2.c
··· 1048 1048 u32 type; 1049 1049 const u16 *reg_offsets; 1050 1050 unsigned int core_reg_align; 1051 + unsigned int num_cfp_rules; 1051 1052 }; 1052 1053 1053 1054 /* Register offsets for the SWITCH_REG_* block */ ··· 1072 1071 .type = BCM7445_DEVICE_ID, 1073 1072 .core_reg_align = 0, 1074 1073 .reg_offsets = bcm_sf2_7445_reg_offsets, 1074 + .num_cfp_rules = 256, 1075 1075 }; 1076 1076 1077 1077 static const u16 bcm_sf2_7278_reg_offsets[] = { ··· 1095 1093 .type = BCM7278_DEVICE_ID, 1096 1094 .core_reg_align = 1, 1097 1095 .reg_offsets = bcm_sf2_7278_reg_offsets, 1096 + .num_cfp_rules = 128, 1098 1097 }; 1099 1098 1100 1099 static const struct of_device_id bcm_sf2_of_match[] = { ··· 1152 1149 priv->type = data->type; 1153 1150 priv->reg_offsets = data->reg_offsets; 1154 1151 priv->core_reg_align = data->core_reg_align; 1152 + priv->num_cfp_rules = data->num_cfp_rules; 1155 1153 1156 1154 /* Auto-detection using standard registers will not work, so 1157 1155 * provide an indication of what kind of device we are for
+1
drivers/net/dsa/bcm_sf2.h
··· 72 72 u32 type; 73 73 const u16 *reg_offsets; 74 74 unsigned int core_reg_align; 75 + unsigned int num_cfp_rules; 75 76 76 77 /* spinlock protecting access to the indirect registers */ 77 78 spinlock_t indir_lock;
+4 -4
drivers/net/dsa/bcm_sf2_cfp.c
··· 98 98 { 99 99 u32 reg; 100 100 101 - WARN_ON(addr >= CFP_NUM_RULES); 101 + WARN_ON(addr >= priv->num_cfp_rules); 102 102 103 103 reg = core_readl(priv, CORE_CFP_ACC); 104 104 reg &= ~(XCESS_ADDR_MASK << XCESS_ADDR_SHIFT); ··· 109 109 static inline unsigned int bcm_sf2_cfp_rule_size(struct bcm_sf2_priv *priv) 110 110 { 111 111 /* Entry #0 is reserved */ 112 - return CFP_NUM_RULES - 1; 112 + return priv->num_cfp_rules - 1; 113 113 } 114 114 115 115 static int bcm_sf2_cfp_rule_set(struct dsa_switch *ds, int port, ··· 523 523 if (!(reg & OP_STR_DONE)) 524 524 break; 525 525 526 - } while (index < CFP_NUM_RULES); 526 + } while (index < priv->num_cfp_rules); 527 527 528 528 /* Put the TCAM size here */ 529 529 nfc->data = bcm_sf2_cfp_rule_size(priv); ··· 544 544 case ETHTOOL_GRXCLSRLCNT: 545 545 /* Subtract the default, unusable rule */ 546 546 nfc->rule_cnt = bitmap_weight(priv->cfp.used, 547 - CFP_NUM_RULES) - 1; 547 + priv->num_cfp_rules) - 1; 548 548 /* We support specifying rule locations */ 549 549 nfc->data |= RX_CLS_LOC_SPECIAL; 550 550 break;
+13 -14
drivers/net/ethernet/apm/xgene/xgene_enet_main.c
··· 1661 1661 return 0; 1662 1662 } 1663 1663 1664 - static int xgene_enet_check_phy_handle(struct xgene_enet_pdata *pdata) 1664 + static void xgene_enet_check_phy_handle(struct xgene_enet_pdata *pdata) 1665 1665 { 1666 1666 int ret; 1667 1667 1668 1668 if (pdata->phy_mode == PHY_INTERFACE_MODE_XGMII) 1669 - return 0; 1669 + return; 1670 1670 1671 1671 if (!IS_ENABLED(CONFIG_MDIO_XGENE)) 1672 - return 0; 1672 + return; 1673 1673 1674 1674 ret = xgene_enet_phy_connect(pdata->ndev); 1675 1675 if (!ret) 1676 1676 pdata->mdio_driver = true; 1677 1677 1678 - return 0; 1678 + return; 1679 1679 } 1680 1680 1681 1681 static void xgene_enet_gpiod_get(struct xgene_enet_pdata *pdata) ··· 1776 1776 return ret; 1777 1777 1778 1778 ret = xgene_enet_get_irqs(pdata); 1779 - if (ret) 1780 - return ret; 1781 - 1782 - ret = xgene_enet_check_phy_handle(pdata); 1783 1779 if (ret) 1784 1780 return ret; 1785 1781 ··· 2093 2097 goto err; 2094 2098 } 2095 2099 2100 + xgene_enet_check_phy_handle(pdata); 2101 + 2096 2102 ret = xgene_enet_init_hw(pdata); 2097 2103 if (ret) 2098 - goto err; 2104 + goto err2; 2099 2105 2100 2106 link_state = pdata->mac_ops->link_state; 2101 2107 if (pdata->phy_mode == PHY_INTERFACE_MODE_XGMII) { ··· 2115 2117 spin_lock_init(&pdata->stats_lock); 2116 2118 ret = xgene_extd_stats_init(pdata); 2117 2119 if (ret) 2118 - goto err2; 2120 + goto err1; 2119 2121 2120 2122 xgene_enet_napi_add(pdata); 2121 2123 ret = register_netdev(ndev); 2122 2124 if (ret) { 2123 2125 netdev_err(ndev, "Failed to register netdev\n"); 2124 - goto err2; 2126 + goto err1; 2125 2127 } 2126 2128 2127 2129 return 0; 2128 2130 2129 - err2: 2131 + err1: 2130 2132 /* 2131 2133 * If necessary, free_netdev() will call netif_napi_del() and undo 2132 2134 * the effects of xgene_enet_napi_add()'s calls to netif_napi_add(). 2133 2135 */ 2134 2136 2137 + xgene_enet_delete_desc_rings(pdata); 2138 + 2139 + err2: 2135 2140 if (pdata->mdio_driver) 2136 2141 xgene_enet_phy_disconnect(pdata); 2137 2142 else if (phy_interface_mode_is_rgmii(pdata->phy_mode)) 2138 2143 xgene_enet_mdio_remove(pdata); 2139 - err1: 2140 - xgene_enet_delete_desc_rings(pdata); 2141 2144 err: 2142 2145 free_netdev(ndev); 2143 2146 return ret;
+1 -2
drivers/net/ethernet/aquantia/atlantic/aq_hw.h
··· 105 105 106 106 int (*hw_set_mac_address)(struct aq_hw_s *self, u8 *mac_addr); 107 107 108 - int (*hw_get_link_status)(struct aq_hw_s *self, 109 - struct aq_hw_link_status_s *link_status); 108 + int (*hw_get_link_status)(struct aq_hw_s *self); 110 109 111 110 int (*hw_set_link_speed)(struct aq_hw_s *self, u32 speed); 112 111
+42 -46
drivers/net/ethernet/aquantia/atlantic/aq_nic.c
··· 103 103 else 104 104 cfg->vecs = 1U; 105 105 106 + cfg->num_rss_queues = min(cfg->vecs, AQ_CFG_NUM_RSS_QUEUES_DEF); 107 + 106 108 cfg->irq_type = aq_pci_func_get_irq_type(self->aq_pci_func); 107 109 108 110 if ((cfg->irq_type == AQ_HW_IRQ_LEGACY) || ··· 125 123 struct net_device *ndev = aq_nic_get_ndev(self); 126 124 int err = 0; 127 125 unsigned int i = 0U; 128 - struct aq_hw_link_status_s link_status; 129 126 struct aq_ring_stats_rx_s stats_rx; 130 127 struct aq_ring_stats_tx_s stats_tx; 131 128 132 129 if (aq_utils_obj_test(&self->header.flags, AQ_NIC_FLAGS_IS_NOT_READY)) 133 130 goto err_exit; 134 131 135 - err = self->aq_hw_ops.hw_get_link_status(self->aq_hw, &link_status); 132 + err = self->aq_hw_ops.hw_get_link_status(self->aq_hw); 136 133 if (err < 0) 137 134 goto err_exit; 138 135 136 + self->link_status = self->aq_hw->aq_link_status; 137 + 139 138 self->aq_hw_ops.hw_interrupt_moderation_set(self->aq_hw, 140 - self->aq_nic_cfg.is_interrupt_moderation); 139 + self->aq_nic_cfg.is_interrupt_moderation); 141 140 142 - if (memcmp(&link_status, &self->link_status, sizeof(link_status))) { 143 - if (link_status.mbps) { 144 - aq_utils_obj_set(&self->header.flags, 145 - AQ_NIC_FLAG_STARTED); 146 - aq_utils_obj_clear(&self->header.flags, 147 - AQ_NIC_LINK_DOWN); 148 - netif_carrier_on(self->ndev); 149 - } else { 150 - netif_carrier_off(self->ndev); 151 - aq_utils_obj_set(&self->header.flags, AQ_NIC_LINK_DOWN); 152 - } 153 - 154 - self->link_status = link_status; 141 + if (self->link_status.mbps) { 142 + aq_utils_obj_set(&self->header.flags, 143 + AQ_NIC_FLAG_STARTED); 144 + aq_utils_obj_clear(&self->header.flags, 145 + AQ_NIC_LINK_DOWN); 146 + netif_carrier_on(self->ndev); 147 + } else { 148 + netif_carrier_off(self->ndev); 149 + aq_utils_obj_set(&self->header.flags, AQ_NIC_LINK_DOWN); 155 150 } 156 151 157 152 memset(&stats_rx, 0U, sizeof(struct aq_ring_stats_rx_s)); ··· 596 597 } 597 598 598 599 int aq_nic_xmit(struct aq_nic_s *self, struct sk_buff *skb) 599 - __releases(&ring->lock) 600 - __acquires(&ring->lock) 601 600 { 602 601 struct aq_ring_s *ring = NULL; 603 602 unsigned int frags = 0U; 604 603 unsigned int vec = skb->queue_mapping % self->aq_nic_cfg.vecs; 605 604 unsigned int tc = 0U; 606 - unsigned int trys = AQ_CFG_LOCK_TRYS; 607 605 int err = NETDEV_TX_OK; 608 606 bool is_nic_in_bad_state; 609 607 ··· 624 628 goto err_exit; 625 629 } 626 630 627 - do { 628 - if (spin_trylock(&ring->header.lock)) { 629 - frags = aq_nic_map_skb(self, skb, ring); 631 + frags = aq_nic_map_skb(self, skb, ring); 630 632 631 - if (likely(frags)) { 632 - err = self->aq_hw_ops.hw_ring_tx_xmit( 633 - self->aq_hw, 634 - ring, frags); 635 - if (err >= 0) { 636 - if (aq_ring_avail_dx(ring) < 637 - AQ_CFG_SKB_FRAGS_MAX + 1) 638 - aq_nic_ndev_queue_stop( 639 - self, 640 - ring->idx); 633 + if (likely(frags)) { 634 + err = self->aq_hw_ops.hw_ring_tx_xmit(self->aq_hw, 635 + ring, 636 + frags); 637 + if (err >= 0) { 638 + if (aq_ring_avail_dx(ring) < AQ_CFG_SKB_FRAGS_MAX + 1) 639 + aq_nic_ndev_queue_stop(self, ring->idx); 641 640 642 - ++ring->stats.tx.packets; 643 - ring->stats.tx.bytes += skb->len; 644 - } 645 - } else { 646 - err = NETDEV_TX_BUSY; 647 - } 648 - 649 - spin_unlock(&ring->header.lock); 650 - break; 641 + ++ring->stats.tx.packets; 642 + ring->stats.tx.bytes += skb->len; 651 643 } 652 - } while (--trys); 653 - 654 - if (!trys) { 644 + } else { 655 645 err = NETDEV_TX_BUSY; 656 - goto err_exit; 657 646 } 658 647 659 648 err_exit: ··· 669 688 netdev_for_each_mc_addr(ha, ndev) { 670 689 ether_addr_copy(self->mc_list.ar[i++], ha->addr); 671 690 ++self->mc_list.count; 691 + 692 + if (i >= AQ_CFG_MULTICAST_ADDRESS_MAX) 693 + break; 672 694 } 673 695 674 - return self->aq_hw_ops.hw_multicast_list_set(self->aq_hw, 696 + if (i >= AQ_CFG_MULTICAST_ADDRESS_MAX) { 697 + /* Number of filters is too big: atlantic does not support this. 698 + * Force all multi filter to support this. 699 + * With this we disable all UC filters and setup "all pass" 700 + * multicast mask 701 + */ 702 + self->packet_filter |= IFF_ALLMULTI; 703 + self->aq_hw->aq_nic_cfg->mc_list_count = 0; 704 + return self->aq_hw_ops.hw_packet_filter_set(self->aq_hw, 705 + self->packet_filter); 706 + } else { 707 + return self->aq_hw_ops.hw_multicast_list_set(self->aq_hw, 675 708 self->mc_list.ar, 676 709 self->mc_list.count); 710 + } 677 711 } 678 712 679 713 int aq_nic_set_mtu(struct aq_nic_s *self, int new_mtu)
-1
drivers/net/ethernet/aquantia/atlantic/aq_ring.c
··· 101 101 self->hw_head = 0; 102 102 self->sw_head = 0; 103 103 self->sw_tail = 0; 104 - spin_lock_init(&self->header.lock); 105 104 return 0; 106 105 } 107 106
-1
drivers/net/ethernet/aquantia/atlantic/aq_utils.h
··· 17 17 #define AQ_DIMOF(_ARY_) ARRAY_SIZE(_ARY_) 18 18 19 19 struct aq_obj_s { 20 - spinlock_t lock; /* spinlock for nic/rings processing */ 21 20 atomic_t flags; 22 21 }; 23 22
+2 -9
drivers/net/ethernet/aquantia/atlantic/aq_vec.c
··· 34 34 #define AQ_VEC_RX_ID 1 35 35 36 36 static int aq_vec_poll(struct napi_struct *napi, int budget) 37 - __releases(&self->lock) 38 - __acquires(&self->lock) 39 37 { 40 38 struct aq_vec_s *self = container_of(napi, struct aq_vec_s, napi); 41 39 struct aq_ring_s *ring = NULL; ··· 45 47 46 48 if (!self) { 47 49 err = -EINVAL; 48 - } else if (spin_trylock(&self->header.lock)) { 50 + } else { 49 51 for (i = 0U, ring = self->ring[0]; 50 52 self->tx_rings > i; ++i, ring = self->ring[i]) { 51 53 if (self->aq_hw_ops->hw_ring_tx_head_update) { ··· 103 105 self->aq_hw_ops->hw_irq_enable(self->aq_hw, 104 106 1U << self->aq_ring_param.vec_idx); 105 107 } 106 - 107 - err_exit: 108 - spin_unlock(&self->header.lock); 109 108 } 110 - 109 + err_exit: 111 110 return work_done; 112 111 } 113 112 ··· 179 184 180 185 self->aq_hw_ops = aq_hw_ops; 181 186 self->aq_hw = aq_hw; 182 - 183 - spin_lock_init(&self->header.lock); 184 187 185 188 for (i = 0U, ring = self->ring[0]; 186 189 self->tx_rings > i; ++i, ring = self->ring[i]) {
+6
drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
··· 629 629 buff->is_udp_cso = (is_err & 0x10U) ? 0 : 1; 630 630 else if (0x0U == (pkt_type & 0x1CU)) 631 631 buff->is_tcp_cso = (is_err & 0x10U) ? 0 : 1; 632 + 633 + /* Checksum offload workaround for small packets */ 634 + if (rxd_wb->pkt_len <= 60) { 635 + buff->is_ip_cso = 0U; 636 + buff->is_cso_err = 0U; 637 + } 632 638 } 633 639 634 640 is_err &= ~0x18U;
+6
drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
··· 645 645 buff->is_udp_cso = buff->is_cso_err ? 0U : 1U; 646 646 else if (0x0U == (pkt_type & 0x1CU)) 647 647 buff->is_tcp_cso = buff->is_cso_err ? 0U : 1U; 648 + 649 + /* Checksum offload workaround for small packets */ 650 + if (rxd_wb->pkt_len <= 60) { 651 + buff->is_ip_cso = 0U; 652 + buff->is_cso_err = 0U; 653 + } 648 654 } 649 655 650 656 is_err &= ~0x18U;
+8 -2
drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
··· 141 141 142 142 err = hw_atl_utils_ver_match(aq_hw_caps->fw_ver_expected, 143 143 aq_hw_read_reg(self, 0x18U)); 144 + 145 + if (err < 0) 146 + pr_err("%s: Bad FW version detected: expected=%x, actual=%x\n", 147 + AQ_CFG_DRV_NAME, 148 + aq_hw_caps->fw_ver_expected, 149 + aq_hw_read_reg(self, 0x18U)); 144 150 return err; 145 151 } 146 152 ··· 319 313 err_exit:; 320 314 } 321 315 322 - int hw_atl_utils_mpi_get_link_status(struct aq_hw_s *self, 323 - struct aq_hw_link_status_s *link_status) 316 + int hw_atl_utils_mpi_get_link_status(struct aq_hw_s *self) 324 317 { 325 318 u32 cp0x036C = aq_hw_read_reg(self, HW_ATL_MPI_STATE_ADR); 326 319 u32 link_speed_mask = cp0x036C >> HW_ATL_MPI_SPEED_SHIFT; 320 + struct aq_hw_link_status_s *link_status = &self->aq_link_status; 327 321 328 322 if (!link_speed_mask) { 329 323 link_status->mbps = 0U;
+1 -2
drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
··· 180 180 int hw_atl_utils_mpi_set_speed(struct aq_hw_s *self, u32 speed, 181 181 enum hal_atl_utils_fw_state_e state); 182 182 183 - int hw_atl_utils_mpi_get_link_status(struct aq_hw_s *self, 184 - struct aq_hw_link_status_s *link_status); 183 + int hw_atl_utils_mpi_get_link_status(struct aq_hw_s *self); 185 184 186 185 int hw_atl_utils_get_mac_permanent(struct aq_hw_s *self, 187 186 struct aq_hw_caps_s *aq_hw_caps,
+3 -1
drivers/net/ethernet/broadcom/bcmsysport.c
··· 597 597 598 598 static void bcm_sysport_free_cb(struct bcm_sysport_cb *cb) 599 599 { 600 - dev_kfree_skb_any(cb->skb); 600 + dev_consume_skb_any(cb->skb); 601 601 cb->skb = NULL; 602 602 dma_unmap_addr_set(cb, dma_addr, 0); 603 603 } ··· 1346 1346 1347 1347 ring->cbs = kcalloc(size, sizeof(struct bcm_sysport_cb), GFP_KERNEL); 1348 1348 if (!ring->cbs) { 1349 + dma_free_coherent(kdev, sizeof(struct dma_desc), 1350 + ring->desc_cpu, ring->desc_dma); 1349 1351 netif_err(priv, hw, priv->netdev, "CB allocation failed\n"); 1350 1352 return -ENOMEM; 1351 1353 }
+29 -12
drivers/net/ethernet/broadcom/bnxt/bnxt.c
··· 4647 4647 pf->port_id = le16_to_cpu(resp->port_id); 4648 4648 bp->dev->dev_port = pf->port_id; 4649 4649 memcpy(pf->mac_addr, resp->mac_address, ETH_ALEN); 4650 - memcpy(bp->dev->dev_addr, pf->mac_addr, ETH_ALEN); 4651 4650 pf->max_rsscos_ctxs = le16_to_cpu(resp->max_rsscos_ctx); 4652 4651 pf->max_cp_rings = le16_to_cpu(resp->max_cmpl_rings); 4653 4652 pf->max_tx_rings = le16_to_cpu(resp->max_tx_rings); ··· 4686 4687 vf->max_stat_ctxs = le16_to_cpu(resp->max_stat_ctx); 4687 4688 4688 4689 memcpy(vf->mac_addr, resp->mac_address, ETH_ALEN); 4689 - mutex_unlock(&bp->hwrm_cmd_lock); 4690 - 4691 - if (is_valid_ether_addr(vf->mac_addr)) { 4692 - /* overwrite netdev dev_adr with admin VF MAC */ 4693 - memcpy(bp->dev->dev_addr, vf->mac_addr, ETH_ALEN); 4694 - } else { 4695 - eth_hw_addr_random(bp->dev); 4696 - rc = bnxt_approve_mac(bp, bp->dev->dev_addr); 4697 - } 4698 - return rc; 4699 4690 #endif 4700 4691 } 4701 4692 ··· 7141 7152 bp->tx_nr_rings = bp->tx_nr_rings_per_tc; 7142 7153 netdev_reset_tc(dev); 7143 7154 } 7155 + bp->tx_nr_rings += bp->tx_nr_rings_xdp; 7144 7156 bp->cp_nr_rings = sh ? max_t(int, bp->tx_nr_rings, bp->rx_nr_rings) : 7145 7157 bp->tx_nr_rings + bp->rx_nr_rings; 7146 7158 bp->num_stat_ctxs = bp->cp_nr_rings; ··· 7651 7661 bnxt_subtract_ulp_resources(bp, BNXT_ROCE_ULP); 7652 7662 } 7653 7663 7664 + static int bnxt_init_mac_addr(struct bnxt *bp) 7665 + { 7666 + int rc = 0; 7667 + 7668 + if (BNXT_PF(bp)) { 7669 + memcpy(bp->dev->dev_addr, bp->pf.mac_addr, ETH_ALEN); 7670 + } else { 7671 + #ifdef CONFIG_BNXT_SRIOV 7672 + struct bnxt_vf_info *vf = &bp->vf; 7673 + 7674 + if (is_valid_ether_addr(vf->mac_addr)) { 7675 + /* overwrite netdev dev_adr with admin VF MAC */ 7676 + memcpy(bp->dev->dev_addr, vf->mac_addr, ETH_ALEN); 7677 + } else { 7678 + eth_hw_addr_random(bp->dev); 7679 + rc = bnxt_approve_mac(bp, bp->dev->dev_addr); 7680 + } 7681 + #endif 7682 + } 7683 + return rc; 7684 + } 7685 + 7654 7686 static void bnxt_parse_log_pcie_link(struct bnxt *bp) 7655 7687 { 7656 7688 enum pcie_link_width width = PCIE_LNK_WIDTH_UNKNOWN; ··· 7801 7789 rc = -1; 7802 7790 goto init_err_pci_clean; 7803 7791 } 7804 - 7792 + rc = bnxt_init_mac_addr(bp); 7793 + if (rc) { 7794 + dev_err(&pdev->dev, "Unable to initialize mac address.\n"); 7795 + rc = -EADDRNOTAVAIL; 7796 + goto init_err_pci_clean; 7797 + } 7805 7798 rc = bnxt_hwrm_queue_qportcfg(bp); 7806 7799 if (rc) { 7807 7800 netdev_err(bp->dev, "hwrm query qportcfg failure rc: %x\n",
+2
drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
··· 84 84 85 85 max_stat_ctxs = bnxt_get_max_func_stat_ctxs(bp); 86 86 bnxt_set_max_func_stat_ctxs(bp, max_stat_ctxs + 1); 87 + if (ulp->msix_requested) 88 + edev->en_ops->bnxt_free_msix(edev, ulp_id); 87 89 } 88 90 if (ulp->max_async_event_id) 89 91 bnxt_hwrm_func_rgtr_async_events(bp, NULL, 0);
+3 -3
drivers/net/ethernet/broadcom/genet/bcmgenet.c
··· 1360 1360 if (skb) { 1361 1361 pkts_compl++; 1362 1362 bytes_compl += GENET_CB(skb)->bytes_sent; 1363 - dev_kfree_skb_any(skb); 1363 + dev_consume_skb_any(skb); 1364 1364 } 1365 1365 1366 1366 txbds_processed++; ··· 1875 1875 cb = ring->cbs + i; 1876 1876 skb = bcmgenet_rx_refill(priv, cb); 1877 1877 if (skb) 1878 - dev_kfree_skb_any(skb); 1878 + dev_consume_skb_any(skb); 1879 1879 if (!cb->skb) 1880 1880 return -ENOMEM; 1881 1881 } ··· 1894 1894 1895 1895 skb = bcmgenet_free_rx_cb(&priv->pdev->dev, cb); 1896 1896 if (skb) 1897 - dev_kfree_skb_any(skb); 1897 + dev_consume_skb_any(skb); 1898 1898 } 1899 1899 } 1900 1900
+3 -3
drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
··· 369 369 list_del(&entry.list); 370 370 spin_unlock(&adap->mbox_lock); 371 371 ret = (v == MBOX_OWNER_FW) ? -EBUSY : -ETIMEDOUT; 372 - t4_record_mbox(adap, cmd, MBOX_LEN, access, ret); 372 + t4_record_mbox(adap, cmd, size, access, ret); 373 373 return ret; 374 374 } 375 375 376 376 /* Copy in the new mailbox command and send it on its way ... */ 377 - t4_record_mbox(adap, cmd, MBOX_LEN, access, 0); 377 + t4_record_mbox(adap, cmd, size, access, 0); 378 378 for (i = 0; i < size; i += 8) 379 379 t4_write_reg64(adap, data_reg + i, be64_to_cpu(*p++)); 380 380 ··· 426 426 } 427 427 428 428 ret = (pcie_fw & PCIE_FW_ERR_F) ? -ENXIO : -ETIMEDOUT; 429 - t4_record_mbox(adap, cmd, MBOX_LEN, access, ret); 429 + t4_record_mbox(adap, cmd, size, access, ret); 430 430 dev_err(adap->pdev_dev, "command %#x in mailbox %d timed out\n", 431 431 *(const u8 *)cmd, mbox); 432 432 t4_report_fw_error(adap);
-1
drivers/net/ethernet/faraday/ftgmac100.c
··· 1863 1863 err_ioremap: 1864 1864 release_resource(priv->res); 1865 1865 err_req_mem: 1866 - netif_napi_del(&priv->napi); 1867 1866 free_netdev(netdev); 1868 1867 err_alloc_etherdev: 1869 1868 return err;
+2
drivers/net/ethernet/freescale/fman/mac.c
··· 623 623 goto no_mem; 624 624 } 625 625 626 + pdev->dev.of_node = node; 627 + pdev->dev.parent = priv->dev; 626 628 set_dma_ops(&pdev->dev, get_dma_ops(priv->dev)); 627 629 628 630 ret = platform_device_add_data(pdev, &data, sizeof(data));
+1 -1
drivers/net/ethernet/marvell/mvpp2.c
··· 6504 6504 struct resource *res; 6505 6505 const char *dt_mac_addr; 6506 6506 const char *mac_from; 6507 - char hw_mac_addr[ETH_ALEN]; 6507 + char hw_mac_addr[ETH_ALEN] = {0}; 6508 6508 u32 id; 6509 6509 int features; 6510 6510 int phy_mode;
+1
drivers/net/ethernet/mellanox/mlx5/core/en.h
··· 263 263 264 264 /* The only setting that cannot be read from FW */ 265 265 u8 tc_tsa[IEEE_8021QAZ_MAX_TCS]; 266 + u8 cap; 266 267 }; 267 268 #endif 268 269
+15 -9
drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
··· 288 288 static u8 mlx5e_dcbnl_getdcbx(struct net_device *dev) 289 289 { 290 290 struct mlx5e_priv *priv = netdev_priv(dev); 291 - struct mlx5e_dcbx *dcbx = &priv->dcbx; 292 - u8 mode = DCB_CAP_DCBX_VER_IEEE | DCB_CAP_DCBX_VER_CEE; 293 291 294 - if (dcbx->mode == MLX5E_DCBX_PARAM_VER_OPER_HOST) 295 - mode |= DCB_CAP_DCBX_HOST; 296 - 297 - return mode; 292 + return priv->dcbx.cap; 298 293 } 299 294 300 295 static u8 mlx5e_dcbnl_setdcbx(struct net_device *dev, u8 mode) ··· 307 312 /* set dcbx to fw controlled */ 308 313 if (!mlx5e_dcbnl_set_dcbx_mode(priv, MLX5E_DCBX_PARAM_VER_OPER_AUTO)) { 309 314 dcbx->mode = MLX5E_DCBX_PARAM_VER_OPER_AUTO; 315 + dcbx->cap &= ~DCB_CAP_DCBX_HOST; 310 316 return 0; 311 317 } 312 318 ··· 319 323 320 324 if (mlx5e_dcbnl_switch_to_host_mode(netdev_priv(dev))) 321 325 return 1; 326 + 327 + dcbx->cap = mode; 322 328 323 329 return 0; 324 330 } ··· 626 628 *cap = false; 627 629 break; 628 630 case DCB_CAP_ATTR_DCBX: 629 - *cap = (DCB_CAP_DCBX_LLD_MANAGED | 630 - DCB_CAP_DCBX_VER_CEE | 631 - DCB_CAP_DCBX_STATIC); 631 + *cap = priv->dcbx.cap | 632 + DCB_CAP_DCBX_VER_CEE | 633 + DCB_CAP_DCBX_VER_IEEE; 632 634 break; 633 635 default: 634 636 *cap = 0; ··· 752 754 { 753 755 struct mlx5e_dcbx *dcbx = &priv->dcbx; 754 756 757 + if (!MLX5_CAP_GEN(priv->mdev, qos)) 758 + return; 759 + 755 760 if (MLX5_CAP_GEN(priv->mdev, dcbx)) 756 761 mlx5e_dcbnl_query_dcbx_mode(priv, &dcbx->mode); 762 + 763 + priv->dcbx.cap = DCB_CAP_DCBX_VER_CEE | 764 + DCB_CAP_DCBX_VER_IEEE; 765 + if (priv->dcbx.mode == MLX5E_DCBX_PARAM_VER_OPER_HOST) 766 + priv->dcbx.cap |= DCB_CAP_DCBX_HOST; 757 767 758 768 mlx5e_ets_init(priv); 759 769 }
+4 -2
drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
··· 641 641 642 642 new_channels.params = priv->channels.params; 643 643 new_channels.params.num_channels = count; 644 - mlx5e_build_default_indir_rqt(priv->mdev, new_channels.params.indirection_rqt, 645 - MLX5E_INDIR_RQT_SIZE, count); 644 + if (!netif_is_rxfh_configured(priv->netdev)) 645 + mlx5e_build_default_indir_rqt(priv->mdev, 646 + new_channels.params.indirection_rqt, 647 + MLX5E_INDIR_RQT_SIZE, count); 646 648 647 649 if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) { 648 650 priv->channels.params = new_channels.params;
+1
drivers/net/ethernet/mellanox/mlx5/core/en_main.c
··· 1969 1969 } 1970 1970 1971 1971 mlx5e_build_common_cq_param(priv, param); 1972 + param->cq_period_mode = params->rx_cq_period_mode; 1972 1973 } 1973 1974 1974 1975 static void mlx5e_build_tx_cq_param(struct mlx5e_priv *priv,
+1 -1
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
··· 222 222 if (unlikely(!page)) 223 223 return -ENOMEM; 224 224 225 - dma_info->page = page; 226 225 dma_info->addr = dma_map_page(rq->pdev, page, 0, 227 226 RQ_PAGE_SIZE(rq), rq->buff.map_dir); 228 227 if (unlikely(dma_mapping_error(rq->pdev, dma_info->addr))) { 229 228 put_page(page); 230 229 return -ENOMEM; 231 230 } 231 + dma_info->page = page; 232 232 233 233 return 0; 234 234 }
+3 -5
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
··· 1443 1443 struct mlx5_eswitch *esw = priv->mdev->priv.eswitch; 1444 1444 int ret; 1445 1445 1446 - dst = ip6_route_output(dev_net(mirred_dev), NULL, fl6); 1447 - ret = dst->error; 1448 - if (ret) { 1449 - dst_release(dst); 1446 + ret = ipv6_stub->ipv6_dst_lookup(dev_net(mirred_dev), NULL, &dst, 1447 + fl6); 1448 + if (ret < 0) 1450 1449 return ret; 1451 - } 1452 1450 1453 1451 *out_ttl = ip6_dst_hoplimit(dst); 1454 1452
+10 -7
drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
··· 128 128 return mlx5e_skb_l2_header_offset(skb); 129 129 } 130 130 131 - static inline unsigned int mlx5e_calc_min_inline(enum mlx5_inline_modes mode, 132 - struct sk_buff *skb) 131 + static inline u16 mlx5e_calc_min_inline(enum mlx5_inline_modes mode, 132 + struct sk_buff *skb) 133 133 { 134 - int hlen; 134 + u16 hlen; 135 135 136 136 switch (mode) { 137 137 case MLX5_INLINE_MODE_NONE: ··· 140 140 hlen = eth_get_headlen(skb->data, skb_headlen(skb)); 141 141 if (hlen == ETH_HLEN && !skb_vlan_tag_present(skb)) 142 142 hlen += VLAN_HLEN; 143 - return hlen; 143 + break; 144 144 case MLX5_INLINE_MODE_IP: 145 145 /* When transport header is set to zero, it means no transport 146 146 * header. When transport header is set to 0xff's, it means 147 147 * transport header wasn't set. 148 148 */ 149 - if (skb_transport_offset(skb)) 150 - return mlx5e_skb_l3_header_offset(skb); 149 + if (skb_transport_offset(skb)) { 150 + hlen = mlx5e_skb_l3_header_offset(skb); 151 + break; 152 + } 151 153 /* fall through */ 152 154 case MLX5_INLINE_MODE_L2: 153 155 default: 154 - return mlx5e_skb_l2_header_offset(skb); 156 + hlen = mlx5e_skb_l2_header_offset(skb); 155 157 } 158 + return min_t(u16, hlen, skb->len); 156 159 } 157 160 158 161 static inline void mlx5e_tx_skb_pull_inline(unsigned char **skb_data,
+1 -1
drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
··· 815 815 struct mlx5_eswitch_rep *rep; 816 816 int vport; 817 817 818 - for (vport = 0; vport < nvports; vport++) { 818 + for (vport = nvports - 1; vport >= 0; vport--) { 819 819 rep = &esw->offloads.vport_reps[vport]; 820 820 if (!rep->valid) 821 821 continue;
+1 -5
drivers/net/ethernet/mellanox/mlx5/core/main.c
··· 1186 1186 } 1187 1187 } 1188 1188 1189 - clear_bit(MLX5_INTERFACE_STATE_DOWN, &dev->intf_state); 1190 1189 set_bit(MLX5_INTERFACE_STATE_UP, &dev->intf_state); 1191 1190 out: 1192 1191 mutex_unlock(&dev->intf_state_mutex); ··· 1260 1261 mlx5_drain_health_recovery(dev); 1261 1262 1262 1263 mutex_lock(&dev->intf_state_mutex); 1263 - if (test_bit(MLX5_INTERFACE_STATE_DOWN, &dev->intf_state)) { 1264 + if (!test_bit(MLX5_INTERFACE_STATE_UP, &dev->intf_state)) { 1264 1265 dev_warn(&dev->pdev->dev, "%s: interface is down, NOP\n", 1265 1266 __func__); 1266 1267 if (cleanup) ··· 1269 1270 } 1270 1271 1271 1272 clear_bit(MLX5_INTERFACE_STATE_UP, &dev->intf_state); 1272 - set_bit(MLX5_INTERFACE_STATE_DOWN, &dev->intf_state); 1273 1273 1274 1274 if (mlx5_device_registered(dev)) 1275 1275 mlx5_detach_device(dev); ··· 1563 1565 int err; 1564 1566 1565 1567 dev_info(&pdev->dev, "Shutdown was called\n"); 1566 - /* Notify mlx5 clients that the kernel is being shut down */ 1567 - set_bit(MLX5_INTERFACE_STATE_SHUTDOWN, &dev->intf_state); 1568 1568 err = mlx5_try_fast_unload(dev); 1569 1569 if (err) 1570 1570 mlx5_unload_one(dev, priv, false);
+6 -6
drivers/net/ethernet/mellanox/mlx5/core/srq.c
··· 201 201 static int arm_srq_cmd(struct mlx5_core_dev *dev, struct mlx5_core_srq *srq, 202 202 u16 lwm, int is_srq) 203 203 { 204 - /* arm_srq structs missing using identical xrc ones */ 205 - u32 srq_in[MLX5_ST_SZ_DW(arm_xrc_srq_in)] = {0}; 206 - u32 srq_out[MLX5_ST_SZ_DW(arm_xrc_srq_out)] = {0}; 204 + u32 srq_in[MLX5_ST_SZ_DW(arm_rq_in)] = {0}; 205 + u32 srq_out[MLX5_ST_SZ_DW(arm_rq_out)] = {0}; 207 206 208 - MLX5_SET(arm_xrc_srq_in, srq_in, opcode, MLX5_CMD_OP_ARM_XRC_SRQ); 209 - MLX5_SET(arm_xrc_srq_in, srq_in, xrc_srqn, srq->srqn); 210 - MLX5_SET(arm_xrc_srq_in, srq_in, lwm, lwm); 207 + MLX5_SET(arm_rq_in, srq_in, opcode, MLX5_CMD_OP_ARM_RQ); 208 + MLX5_SET(arm_rq_in, srq_in, op_mod, MLX5_ARM_RQ_IN_OP_MOD_SRQ); 209 + MLX5_SET(arm_rq_in, srq_in, srq_number, srq->srqn); 210 + MLX5_SET(arm_rq_in, srq_in, lwm, lwm); 211 211 212 212 return mlx5_cmd_exec(dev, srq_in, sizeof(srq_in), 213 213 srq_out, sizeof(srq_out));
+6
drivers/net/ethernet/mellanox/mlxsw/spectrum.c
··· 4139 4139 return -EINVAL; 4140 4140 if (!info->linking) 4141 4141 break; 4142 + if (netdev_has_any_upper_dev(upper_dev)) 4143 + return -EINVAL; 4142 4144 if (netif_is_lag_master(upper_dev) && 4143 4145 !mlxsw_sp_master_lag_check(mlxsw_sp, upper_dev, 4144 4146 info->upper_info)) ··· 4259 4257 case NETDEV_PRECHANGEUPPER: 4260 4258 upper_dev = info->upper_dev; 4261 4259 if (!netif_is_bridge_master(upper_dev)) 4260 + return -EINVAL; 4261 + if (!info->linking) 4262 + break; 4263 + if (netdev_has_any_upper_dev(upper_dev)) 4262 4264 return -EINVAL; 4263 4265 break; 4264 4266 case NETDEV_CHANGEUPPER:
+11 -4
drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
··· 705 705 bool is_port_mc_router) 706 706 { 707 707 struct mlxsw_sp_bridge_port *bridge_port; 708 + int err; 708 709 709 710 if (switchdev_trans_ph_prepare(trans)) 710 711 return 0; ··· 716 715 return 0; 717 716 718 717 if (!bridge_port->bridge_device->multicast_enabled) 719 - return 0; 718 + goto out; 720 719 721 - return mlxsw_sp_bridge_port_flood_table_set(mlxsw_sp_port, bridge_port, 722 - MLXSW_SP_FLOOD_TYPE_MC, 723 - is_port_mc_router); 720 + err = mlxsw_sp_bridge_port_flood_table_set(mlxsw_sp_port, bridge_port, 721 + MLXSW_SP_FLOOD_TYPE_MC, 722 + is_port_mc_router); 723 + if (err) 724 + return err; 725 + 726 + out: 727 + bridge_port->mrouter = is_port_mc_router; 728 + return 0; 724 729 } 725 730 726 731 static int mlxsw_sp_port_mc_disabled_set(struct mlxsw_sp_port *mlxsw_sp_port,
+71 -68
drivers/net/ethernet/netronome/nfp/flower/match.c
··· 42 42 struct tc_cls_flower_offload *flow, u8 key_type, 43 43 bool mask_version) 44 44 { 45 + struct fl_flow_key *target = mask_version ? flow->mask : flow->key; 45 46 struct flow_dissector_key_vlan *flow_vlan; 46 47 u16 tmp_tci; 47 48 49 + memset(frame, 0, sizeof(struct nfp_flower_meta_two)); 48 50 /* Populate the metadata frame. */ 49 51 frame->nfp_flow_key_layer = key_type; 50 52 frame->mask_id = ~0; 51 53 52 - if (mask_version) { 53 - frame->tci = cpu_to_be16(~0); 54 - return; 54 + if (dissector_uses_key(flow->dissector, FLOW_DISSECTOR_KEY_VLAN)) { 55 + flow_vlan = skb_flow_dissector_target(flow->dissector, 56 + FLOW_DISSECTOR_KEY_VLAN, 57 + target); 58 + /* Populate the tci field. */ 59 + if (flow_vlan->vlan_id) { 60 + tmp_tci = FIELD_PREP(NFP_FLOWER_MASK_VLAN_PRIO, 61 + flow_vlan->vlan_priority) | 62 + FIELD_PREP(NFP_FLOWER_MASK_VLAN_VID, 63 + flow_vlan->vlan_id) | 64 + NFP_FLOWER_MASK_VLAN_CFI; 65 + frame->tci = cpu_to_be16(tmp_tci); 66 + } 55 67 } 56 - 57 - flow_vlan = skb_flow_dissector_target(flow->dissector, 58 - FLOW_DISSECTOR_KEY_VLAN, 59 - flow->key); 60 - 61 - /* Populate the tci field. */ 62 - if (!flow_vlan->vlan_id) { 63 - tmp_tci = 0; 64 - } else { 65 - tmp_tci = FIELD_PREP(NFP_FLOWER_MASK_VLAN_PRIO, 66 - flow_vlan->vlan_priority) | 67 - FIELD_PREP(NFP_FLOWER_MASK_VLAN_VID, 68 - flow_vlan->vlan_id) | 69 - NFP_FLOWER_MASK_VLAN_CFI; 70 - } 71 - frame->tci = cpu_to_be16(tmp_tci); 72 68 } 73 69 74 70 static void ··· 95 99 bool mask_version) 96 100 { 97 101 struct fl_flow_key *target = mask_version ? flow->mask : flow->key; 98 - struct flow_dissector_key_eth_addrs *flow_mac; 99 - 100 - flow_mac = skb_flow_dissector_target(flow->dissector, 101 - FLOW_DISSECTOR_KEY_ETH_ADDRS, 102 - target); 102 + struct flow_dissector_key_eth_addrs *addr; 103 103 104 104 memset(frame, 0, sizeof(struct nfp_flower_mac_mpls)); 105 105 106 - /* Populate mac frame. */ 107 - ether_addr_copy(frame->mac_dst, &flow_mac->dst[0]); 108 - ether_addr_copy(frame->mac_src, &flow_mac->src[0]); 106 + if (dissector_uses_key(flow->dissector, FLOW_DISSECTOR_KEY_ETH_ADDRS)) { 107 + addr = skb_flow_dissector_target(flow->dissector, 108 + FLOW_DISSECTOR_KEY_ETH_ADDRS, 109 + target); 110 + /* Populate mac frame. */ 111 + ether_addr_copy(frame->mac_dst, &addr->dst[0]); 112 + ether_addr_copy(frame->mac_src, &addr->src[0]); 113 + } 109 114 110 115 if (mask_version) 111 116 frame->mpls_lse = cpu_to_be32(~0); ··· 118 121 bool mask_version) 119 122 { 120 123 struct fl_flow_key *target = mask_version ? flow->mask : flow->key; 121 - struct flow_dissector_key_ports *flow_tp; 124 + struct flow_dissector_key_ports *tp; 122 125 123 - flow_tp = skb_flow_dissector_target(flow->dissector, 124 - FLOW_DISSECTOR_KEY_PORTS, 125 - target); 126 + memset(frame, 0, sizeof(struct nfp_flower_tp_ports)); 126 127 127 - frame->port_src = flow_tp->src; 128 - frame->port_dst = flow_tp->dst; 128 + if (dissector_uses_key(flow->dissector, FLOW_DISSECTOR_KEY_PORTS)) { 129 + tp = skb_flow_dissector_target(flow->dissector, 130 + FLOW_DISSECTOR_KEY_PORTS, 131 + target); 132 + frame->port_src = tp->src; 133 + frame->port_dst = tp->dst; 134 + } 129 135 } 130 136 131 137 static void ··· 137 137 bool mask_version) 138 138 { 139 139 struct fl_flow_key *target = mask_version ? flow->mask : flow->key; 140 - struct flow_dissector_key_ipv4_addrs *flow_ipv4; 141 - struct flow_dissector_key_basic *flow_basic; 140 + struct flow_dissector_key_ipv4_addrs *addr; 141 + struct flow_dissector_key_basic *basic; 142 142 143 - flow_ipv4 = skb_flow_dissector_target(flow->dissector, 144 - FLOW_DISSECTOR_KEY_IPV4_ADDRS, 145 - target); 146 - 147 - flow_basic = skb_flow_dissector_target(flow->dissector, 148 - FLOW_DISSECTOR_KEY_BASIC, 149 - target); 150 - 151 - /* Populate IPv4 frame. */ 152 - frame->reserved = 0; 153 - frame->ipv4_src = flow_ipv4->src; 154 - frame->ipv4_dst = flow_ipv4->dst; 155 - frame->proto = flow_basic->ip_proto; 156 143 /* Wildcard TOS/TTL for now. */ 157 - frame->tos = 0; 158 - frame->ttl = 0; 144 + memset(frame, 0, sizeof(struct nfp_flower_ipv4)); 145 + 146 + if (dissector_uses_key(flow->dissector, 147 + FLOW_DISSECTOR_KEY_IPV4_ADDRS)) { 148 + addr = skb_flow_dissector_target(flow->dissector, 149 + FLOW_DISSECTOR_KEY_IPV4_ADDRS, 150 + target); 151 + frame->ipv4_src = addr->src; 152 + frame->ipv4_dst = addr->dst; 153 + } 154 + 155 + if (dissector_uses_key(flow->dissector, FLOW_DISSECTOR_KEY_BASIC)) { 156 + basic = skb_flow_dissector_target(flow->dissector, 157 + FLOW_DISSECTOR_KEY_BASIC, 158 + target); 159 + frame->proto = basic->ip_proto; 160 + } 159 161 } 160 162 161 163 static void ··· 166 164 bool mask_version) 167 165 { 168 166 struct fl_flow_key *target = mask_version ? flow->mask : flow->key; 169 - struct flow_dissector_key_ipv6_addrs *flow_ipv6; 170 - struct flow_dissector_key_basic *flow_basic; 167 + struct flow_dissector_key_ipv6_addrs *addr; 168 + struct flow_dissector_key_basic *basic; 171 169 172 - flow_ipv6 = skb_flow_dissector_target(flow->dissector, 173 - FLOW_DISSECTOR_KEY_IPV6_ADDRS, 174 - target); 175 - 176 - flow_basic = skb_flow_dissector_target(flow->dissector, 177 - FLOW_DISSECTOR_KEY_BASIC, 178 - target); 179 - 180 - /* Populate IPv6 frame. */ 181 - frame->reserved = 0; 182 - frame->ipv6_src = flow_ipv6->src; 183 - frame->ipv6_dst = flow_ipv6->dst; 184 - frame->proto = flow_basic->ip_proto; 185 170 /* Wildcard LABEL/TOS/TTL for now. */ 186 - frame->ipv6_flow_label_exthdr = 0; 187 - frame->tos = 0; 188 - frame->ttl = 0; 171 + memset(frame, 0, sizeof(struct nfp_flower_ipv6)); 172 + 173 + if (dissector_uses_key(flow->dissector, 174 + FLOW_DISSECTOR_KEY_IPV6_ADDRS)) { 175 + addr = skb_flow_dissector_target(flow->dissector, 176 + FLOW_DISSECTOR_KEY_IPV6_ADDRS, 177 + target); 178 + frame->ipv6_src = addr->src; 179 + frame->ipv6_dst = addr->dst; 180 + } 181 + 182 + if (dissector_uses_key(flow->dissector, FLOW_DISSECTOR_KEY_BASIC)) { 183 + basic = skb_flow_dissector_target(flow->dissector, 184 + FLOW_DISSECTOR_KEY_BASIC, 185 + target); 186 + frame->proto = basic->ip_proto; 187 + } 189 188 } 190 189 191 190 int nfp_flower_compile_flow_match(struct tc_cls_flower_offload *flow,
+42 -18
drivers/net/ethernet/netronome/nfp/flower/offload.c
··· 105 105 nfp_flower_calculate_key_layers(struct nfp_fl_key_ls *ret_key_ls, 106 106 struct tc_cls_flower_offload *flow) 107 107 { 108 - struct flow_dissector_key_control *mask_enc_ctl; 109 - struct flow_dissector_key_basic *mask_basic; 110 - struct flow_dissector_key_basic *key_basic; 108 + struct flow_dissector_key_basic *mask_basic = NULL; 109 + struct flow_dissector_key_basic *key_basic = NULL; 110 + struct flow_dissector_key_ip *mask_ip = NULL; 111 111 u32 key_layer_two; 112 112 u8 key_layer; 113 113 int key_size; 114 114 115 - mask_enc_ctl = skb_flow_dissector_target(flow->dissector, 116 - FLOW_DISSECTOR_KEY_ENC_CONTROL, 117 - flow->mask); 115 + if (dissector_uses_key(flow->dissector, 116 + FLOW_DISSECTOR_KEY_ENC_CONTROL)) { 117 + struct flow_dissector_key_control *mask_enc_ctl = 118 + skb_flow_dissector_target(flow->dissector, 119 + FLOW_DISSECTOR_KEY_ENC_CONTROL, 120 + flow->mask); 121 + /* We are expecting a tunnel. For now we ignore offloading. */ 122 + if (mask_enc_ctl->addr_type) 123 + return -EOPNOTSUPP; 124 + } 118 125 119 - mask_basic = skb_flow_dissector_target(flow->dissector, 120 - FLOW_DISSECTOR_KEY_BASIC, 121 - flow->mask); 126 + if (dissector_uses_key(flow->dissector, FLOW_DISSECTOR_KEY_BASIC)) { 127 + mask_basic = skb_flow_dissector_target(flow->dissector, 128 + FLOW_DISSECTOR_KEY_BASIC, 129 + flow->mask); 122 130 123 - key_basic = skb_flow_dissector_target(flow->dissector, 124 - FLOW_DISSECTOR_KEY_BASIC, 125 - flow->key); 131 + key_basic = skb_flow_dissector_target(flow->dissector, 132 + FLOW_DISSECTOR_KEY_BASIC, 133 + flow->key); 134 + } 135 + 136 + if (dissector_uses_key(flow->dissector, FLOW_DISSECTOR_KEY_IP)) 137 + mask_ip = skb_flow_dissector_target(flow->dissector, 138 + FLOW_DISSECTOR_KEY_IP, 139 + flow->mask); 140 + 126 141 key_layer_two = 0; 127 142 key_layer = NFP_FLOWER_LAYER_PORT | NFP_FLOWER_LAYER_MAC; 128 143 key_size = sizeof(struct nfp_flower_meta_one) + 129 144 sizeof(struct nfp_flower_in_port) + 130 145 sizeof(struct nfp_flower_mac_mpls); 131 146 132 - /* We are expecting a tunnel. For now we ignore offloading. */ 133 - if (mask_enc_ctl->addr_type) 134 - return -EOPNOTSUPP; 135 - 136 - if (mask_basic->n_proto) { 147 + if (mask_basic && mask_basic->n_proto) { 137 148 /* Ethernet type is present in the key. */ 138 149 switch (key_basic->n_proto) { 139 150 case cpu_to_be16(ETH_P_IP): 151 + if (mask_ip && mask_ip->tos) 152 + return -EOPNOTSUPP; 153 + if (mask_ip && mask_ip->ttl) 154 + return -EOPNOTSUPP; 140 155 key_layer |= NFP_FLOWER_LAYER_IPV4; 141 156 key_size += sizeof(struct nfp_flower_ipv4); 142 157 break; 143 158 144 159 case cpu_to_be16(ETH_P_IPV6): 160 + if (mask_ip && mask_ip->tos) 161 + return -EOPNOTSUPP; 162 + if (mask_ip && mask_ip->ttl) 163 + return -EOPNOTSUPP; 145 164 key_layer |= NFP_FLOWER_LAYER_IPV6; 146 165 key_size += sizeof(struct nfp_flower_ipv6); 147 166 break; ··· 169 150 * because we rely on it to get to the host. 170 151 */ 171 152 case cpu_to_be16(ETH_P_ARP): 153 + return -EOPNOTSUPP; 154 + 155 + /* Currently we do not offload MPLS. */ 156 + case cpu_to_be16(ETH_P_MPLS_UC): 157 + case cpu_to_be16(ETH_P_MPLS_MC): 172 158 return -EOPNOTSUPP; 173 159 174 160 /* Will be included in layer 2. */ ··· 190 166 } 191 167 } 192 168 193 - if (mask_basic->ip_proto) { 169 + if (mask_basic && mask_basic->ip_proto) { 194 170 /* Ethernet type is present in the key. */ 195 171 switch (key_basic->ip_proto) { 196 172 case IPPROTO_TCP:
+7 -9
drivers/net/ethernet/netronome/nfp/nfp_main.c
··· 98 98 struct nfp_pf *pf = pci_get_drvdata(pdev); 99 99 int err; 100 100 101 - mutex_lock(&pf->lock); 102 - 103 101 if (num_vfs > pf->limit_vfs) { 104 102 nfp_info(pf->cpp, "Firmware limits number of VFs to %u\n", 105 103 pf->limit_vfs); 106 - err = -EINVAL; 107 - goto err_unlock; 104 + return -EINVAL; 108 105 } 109 106 110 107 err = pci_enable_sriov(pdev, num_vfs); 111 108 if (err) { 112 109 dev_warn(&pdev->dev, "Failed to enable PCI SR-IOV: %d\n", err); 113 - goto err_unlock; 110 + return err; 114 111 } 112 + 113 + mutex_lock(&pf->lock); 115 114 116 115 err = nfp_app_sriov_enable(pf->app, num_vfs); 117 116 if (err) { ··· 128 129 return num_vfs; 129 130 130 131 err_sriov_disable: 131 - pci_disable_sriov(pdev); 132 - err_unlock: 133 132 mutex_unlock(&pf->lock); 133 + pci_disable_sriov(pdev); 134 134 return err; 135 135 #endif 136 136 return 0; ··· 156 158 157 159 pf->num_vfs = 0; 158 160 161 + mutex_unlock(&pf->lock); 162 + 159 163 pci_disable_sriov(pdev); 160 164 dev_dbg(&pdev->dev, "Removed VFs.\n"); 161 - 162 - mutex_unlock(&pf->lock); 163 165 #endif 164 166 return 0; 165 167 }
+7 -7
drivers/net/ethernet/netronome/nfp/nfp_net_common.c
··· 895 895 896 896 netdev_tx_sent_queue(nd_q, txbuf->real_len); 897 897 898 + skb_tx_timestamp(skb); 899 + 898 900 tx_ring->wr_p += nr_frags + 1; 899 901 if (nfp_net_tx_ring_should_stop(tx_ring)) 900 902 nfp_net_tx_ring_stop(nd_q, tx_ring); ··· 904 902 tx_ring->wr_ptr_add += nr_frags + 1; 905 903 if (!skb->xmit_more || netif_xmit_stopped(nd_q)) 906 904 nfp_net_tx_xmit_more_flush(tx_ring); 907 - 908 - skb_tx_timestamp(skb); 909 905 910 906 return NETDEV_TX_OK; 911 907 ··· 1751 1751 continue; 1752 1752 } 1753 1753 1754 + nfp_net_dma_unmap_rx(dp, rxbuf->dma_addr); 1755 + 1756 + nfp_net_rx_give_one(dp, rx_ring, new_frag, new_dma_addr); 1757 + 1754 1758 if (likely(!meta.portid)) { 1755 1759 netdev = dp->netdev; 1756 1760 } else { ··· 1763 1759 nn = netdev_priv(dp->netdev); 1764 1760 netdev = nfp_app_repr_get(nn->app, meta.portid); 1765 1761 if (unlikely(!netdev)) { 1766 - nfp_net_rx_drop(dp, r_vec, rx_ring, rxbuf, skb); 1762 + nfp_net_rx_drop(dp, r_vec, rx_ring, NULL, skb); 1767 1763 continue; 1768 1764 } 1769 1765 nfp_repr_inc_rx_stats(netdev, pkt_len); 1770 1766 } 1771 - 1772 - nfp_net_dma_unmap_rx(dp, rxbuf->dma_addr); 1773 - 1774 - nfp_net_rx_give_one(dp, rx_ring, new_frag, new_dma_addr); 1775 1767 1776 1768 skb_reserve(skb, pkt_off); 1777 1769 skb_put(skb, pkt_len);
+15 -11
drivers/net/ethernet/netronome/nfp/nfp_net_main.c
··· 456 456 { 457 457 int err; 458 458 459 - err = nfp_net_pf_app_start_ctrl(pf); 460 - if (err) 461 - return err; 462 - 463 459 err = nfp_app_start(pf->app, pf->ctrl_vnic); 464 460 if (err) 465 - goto err_ctrl_stop; 461 + return err; 466 462 467 463 if (pf->num_vfs) { 468 464 err = nfp_app_sriov_enable(pf->app, pf->num_vfs); ··· 470 474 471 475 err_app_stop: 472 476 nfp_app_stop(pf->app); 473 - err_ctrl_stop: 474 - nfp_net_pf_app_stop_ctrl(pf); 475 477 return err; 476 478 } 477 479 ··· 478 484 if (pf->num_vfs) 479 485 nfp_app_sriov_disable(pf->app); 480 486 nfp_app_stop(pf->app); 481 - nfp_net_pf_app_stop_ctrl(pf); 482 487 } 483 488 484 489 static void nfp_net_pci_unmap_mem(struct nfp_pf *pf) ··· 552 559 553 560 static void nfp_net_pci_remove_finish(struct nfp_pf *pf) 554 561 { 555 - nfp_net_pf_app_stop(pf); 562 + nfp_net_pf_app_stop_ctrl(pf); 556 563 /* stop app first, to avoid double free of ctrl vNIC's ddir */ 557 564 nfp_net_debugfs_dir_clean(&pf->ddir); 558 565 ··· 683 690 { 684 691 struct nfp_net_fw_version fw_ver; 685 692 u8 __iomem *ctrl_bar, *qc_bar; 693 + struct nfp_net *nn; 686 694 int stride; 687 695 int err; 688 696 ··· 760 766 if (err) 761 767 goto err_free_vnics; 762 768 763 - err = nfp_net_pf_app_start(pf); 769 + err = nfp_net_pf_app_start_ctrl(pf); 764 770 if (err) 765 771 goto err_free_irqs; 766 772 ··· 768 774 if (err) 769 775 goto err_stop_app; 770 776 777 + err = nfp_net_pf_app_start(pf); 778 + if (err) 779 + goto err_clean_vnics; 780 + 771 781 mutex_unlock(&pf->lock); 772 782 773 783 return 0; 774 784 785 + err_clean_vnics: 786 + list_for_each_entry(nn, &pf->vnics, vnic_list) 787 + if (nfp_net_is_data_vnic(nn)) 788 + nfp_net_pf_clean_vnic(pf, nn); 775 789 err_stop_app: 776 - nfp_net_pf_app_stop(pf); 790 + nfp_net_pf_app_stop_ctrl(pf); 777 791 err_free_irqs: 778 792 nfp_net_pf_free_irqs(pf); 779 793 err_free_vnics: ··· 804 802 mutex_lock(&pf->lock); 805 803 if (list_empty(&pf->vnics)) 806 804 goto out; 805 + 806 + nfp_net_pf_app_stop(pf); 807 807 808 808 list_for_each_entry(nn, &pf->vnics, vnic_list) 809 809 if (nfp_net_is_data_vnic(nn))
+1 -1
drivers/net/ethernet/qlogic/qlge/qlge_dbg.c
··· 724 724 seg_hdr->cookie = MPI_COREDUMP_COOKIE; 725 725 seg_hdr->segNum = seg_number; 726 726 seg_hdr->segSize = seg_size; 727 - memcpy(seg_hdr->description, desc, (sizeof(seg_hdr->description)) - 1); 727 + strncpy(seg_hdr->description, desc, (sizeof(seg_hdr->description)) - 1); 728 728 } 729 729 730 730 /*
+2 -3
drivers/net/ethernet/realtek/r8169.c
··· 6863 6863 rtl8169_unmap_tx_skb(&tp->pci_dev->dev, tx_skb, 6864 6864 tp->TxDescArray + entry); 6865 6865 if (skb) { 6866 - tp->dev->stats.tx_dropped++; 6867 - dev_kfree_skb_any(skb); 6866 + dev_consume_skb_any(skb); 6868 6867 tx_skb->skb = NULL; 6869 6868 } 6870 6869 } ··· 7318 7319 tp->tx_stats.packets++; 7319 7320 tp->tx_stats.bytes += tx_skb->skb->len; 7320 7321 u64_stats_update_end(&tp->tx_stats.syncp); 7321 - dev_kfree_skb_any(tx_skb->skb); 7322 + dev_consume_skb_any(tx_skb->skb); 7322 7323 tx_skb->skb = NULL; 7323 7324 } 7324 7325 dirty_tx++;
+2
drivers/net/ethernet/samsung/sxgbe/sxgbe_platform.c
··· 47 47 plat->mdio_bus_data = devm_kzalloc(&pdev->dev, 48 48 sizeof(*plat->mdio_bus_data), 49 49 GFP_KERNEL); 50 + if (!plat->mdio_bus_data) 51 + return -ENOMEM; 50 52 51 53 dma_cfg = devm_kzalloc(&pdev->dev, sizeof(*dma_cfg), GFP_KERNEL); 52 54 if (!dma_cfg)
+4 -1
drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
··· 269 269 ctrl &= ~(SYSMGR_EMACGRP_CTRL_PHYSEL_MASK << reg_shift); 270 270 ctrl |= val << reg_shift; 271 271 272 - if (dwmac->f2h_ptp_ref_clk) { 272 + if (dwmac->f2h_ptp_ref_clk || 273 + phymode == PHY_INTERFACE_MODE_MII || 274 + phymode == PHY_INTERFACE_MODE_GMII || 275 + phymode == PHY_INTERFACE_MODE_SGMII) { 273 276 ctrl |= SYSMGR_EMACGRP_CTRL_PTP_REF_CLK_MASK << (reg_shift / 2); 274 277 regmap_read(sys_mgr_base_addr, SYSMGR_FPGAGRP_MODULE_REG, 275 278 &module);
-8
drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
··· 979 979 } 980 980 981 981 static const struct of_device_id sun8i_dwmac_match[] = { 982 - { .compatible = "allwinner,sun8i-h3-emac", 983 - .data = &emac_variant_h3 }, 984 - { .compatible = "allwinner,sun8i-v3s-emac", 985 - .data = &emac_variant_v3s }, 986 - { .compatible = "allwinner,sun8i-a83t-emac", 987 - .data = &emac_variant_a83t }, 988 - { .compatible = "allwinner,sun50i-a64-emac", 989 - .data = &emac_variant_a64 }, 990 982 { } 991 983 }; 992 984 MODULE_DEVICE_TABLE(of, sun8i_dwmac_match);
+1 -1
drivers/net/ethernet/ti/cpsw-common.c
··· 96 96 if (of_machine_is_compatible("ti,dra7")) 97 97 return davinci_emac_3517_get_macid(dev, 0x514, slave, mac_addr); 98 98 99 - dev_err(dev, "incompatible machine/device type for reading mac address\n"); 99 + dev_info(dev, "incompatible machine/device type for reading mac address\n"); 100 100 return -ENOENT; 101 101 } 102 102 EXPORT_SYMBOL_GPL(ti_cm_get_macid);
+6 -1
drivers/net/hyperv/netvsc_drv.c
··· 1269 1269 bool notify = false, reschedule = false; 1270 1270 unsigned long flags, next_reconfig, delay; 1271 1271 1272 - rtnl_lock(); 1272 + /* if changes are happening, comeback later */ 1273 + if (!rtnl_trylock()) { 1274 + schedule_delayed_work(&ndev_ctx->dwork, LINKCHANGE_INT); 1275 + return; 1276 + } 1277 + 1273 1278 net_device = rtnl_dereference(ndev_ctx->nvdev); 1274 1279 if (!net_device) 1275 1280 goto out_unlock;
+1
drivers/net/macsec.c
··· 3521 3521 module_exit(macsec_exit); 3522 3522 3523 3523 MODULE_ALIAS_RTNL_LINK("macsec"); 3524 + MODULE_ALIAS_GENL_FAMILY("macsec"); 3524 3525 3525 3526 MODULE_DESCRIPTION("MACsec IEEE 802.1AE"); 3526 3527 MODULE_LICENSE("GPL v2");
-3
drivers/net/phy/phy.c
··· 749 749 if (phydev->state > PHY_UP && phydev->state != PHY_HALTED) 750 750 phydev->state = PHY_UP; 751 751 mutex_unlock(&phydev->lock); 752 - 753 - /* Now we can run the state machine synchronously */ 754 - phy_state_machine(&phydev->state_queue.work); 755 752 } 756 753 757 754 /**
+4 -2
drivers/net/phy/phy_device.c
··· 864 864 #define ATTACHED_FMT "attached PHY driver [%s] (mii_bus:phy_addr=%s, irq=%d)" 865 865 void phy_attached_print(struct phy_device *phydev, const char *fmt, ...) 866 866 { 867 + const char *drv_name = phydev->drv ? phydev->drv->name : "unbound"; 868 + 867 869 if (!fmt) { 868 870 dev_info(&phydev->mdio.dev, ATTACHED_FMT "\n", 869 - phydev->drv->name, phydev_name(phydev), 871 + drv_name, phydev_name(phydev), 870 872 phydev->irq); 871 873 } else { 872 874 va_list ap; 873 875 874 876 dev_info(&phydev->mdio.dev, ATTACHED_FMT, 875 - phydev->drv->name, phydev_name(phydev), 877 + drv_name, phydev_name(phydev), 876 878 phydev->irq); 877 879 878 880 va_start(ap, fmt);
+7
drivers/net/usb/cdc_ncm.c
··· 1758 1758 .driver_info = (unsigned long)&wwan_noarp_info, 1759 1759 }, 1760 1760 1761 + /* u-blox TOBY-L4 */ 1762 + { USB_DEVICE_AND_INTERFACE_INFO(0x1546, 0x1010, 1763 + USB_CLASS_COMM, 1764 + USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE), 1765 + .driver_info = (unsigned long)&wwan_info, 1766 + }, 1767 + 1761 1768 /* Generic CDC-NCM devices */ 1762 1769 { USB_INTERFACE_INFO(USB_CLASS_COMM, 1763 1770 USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE),
+1 -1
drivers/net/virtio_net.c
··· 1058 1058 bytes += skb->len; 1059 1059 packets++; 1060 1060 1061 - dev_kfree_skb_any(skb); 1061 + dev_consume_skb_any(skb); 1062 1062 } 1063 1063 1064 1064 /* Avoid overhead when no packets have been processed
+2
drivers/net/wireless/intel/iwlwifi/pcie/internal.h
··· 787 787 788 788 void iwl_pcie_enable_rx_wake(struct iwl_trans *trans, bool enable); 789 789 790 + void iwl_pcie_rx_allocator_work(struct work_struct *data); 791 + 790 792 /* common functions that are used by gen2 transport */ 791 793 void iwl_pcie_apm_config(struct iwl_trans *trans); 792 794 int iwl_pcie_prepare_card_hw(struct iwl_trans *trans);
+1 -9
drivers/net/wireless/intel/iwlwifi/pcie/rx.c
··· 597 597 rxq->free_count += RX_CLAIM_REQ_ALLOC; 598 598 } 599 599 600 - static void iwl_pcie_rx_allocator_work(struct work_struct *data) 600 + void iwl_pcie_rx_allocator_work(struct work_struct *data) 601 601 { 602 602 struct iwl_rb_allocator *rba_p = 603 603 container_of(data, struct iwl_rb_allocator, rx_alloc); ··· 900 900 return err; 901 901 } 902 902 def_rxq = trans_pcie->rxq; 903 - if (!rba->alloc_wq) 904 - rba->alloc_wq = alloc_workqueue("rb_allocator", 905 - WQ_HIGHPRI | WQ_UNBOUND, 1); 906 - INIT_WORK(&rba->rx_alloc, iwl_pcie_rx_allocator_work); 907 903 908 904 spin_lock(&rba->lock); 909 905 atomic_set(&rba->req_pending, 0); ··· 1013 1017 } 1014 1018 1015 1019 cancel_work_sync(&rba->rx_alloc); 1016 - if (rba->alloc_wq) { 1017 - destroy_workqueue(rba->alloc_wq); 1018 - rba->alloc_wq = NULL; 1019 - } 1020 1020 1021 1021 iwl_pcie_free_rbs_pool(trans); 1022 1022
+9
drivers/net/wireless/intel/iwlwifi/pcie/trans.c
··· 1786 1786 iwl_pcie_tx_free(trans); 1787 1787 iwl_pcie_rx_free(trans); 1788 1788 1789 + if (trans_pcie->rba.alloc_wq) { 1790 + destroy_workqueue(trans_pcie->rba.alloc_wq); 1791 + trans_pcie->rba.alloc_wq = NULL; 1792 + } 1793 + 1789 1794 if (trans_pcie->msix_enabled) { 1790 1795 for (i = 0; i < trans_pcie->alloc_vecs; i++) { 1791 1796 irq_set_affinity_hint( ··· 3173 3168 } 3174 3169 trans_pcie->inta_mask = CSR_INI_SET_MASK; 3175 3170 } 3171 + 3172 + trans_pcie->rba.alloc_wq = alloc_workqueue("rb_allocator", 3173 + WQ_HIGHPRI | WQ_UNBOUND, 1); 3174 + INIT_WORK(&trans_pcie->rba.rx_alloc, iwl_pcie_rx_allocator_work); 3176 3175 3177 3176 #ifdef CONFIG_IWLWIFI_PCIE_RTPM 3178 3177 trans->runtime_pm_mode = IWL_PLAT_PM_MODE_D0I3;
+1
drivers/net/wireless/ti/wl1251/main.c
··· 1571 1571 1572 1572 wl->state = WL1251_STATE_OFF; 1573 1573 mutex_init(&wl->mutex); 1574 + spin_lock_init(&wl->wl_lock); 1574 1575 1575 1576 wl->tx_mgmt_frm_rate = DEFAULT_HW_GEN_TX_RATE; 1576 1577 wl->tx_mgmt_frm_mod = DEFAULT_HW_GEN_MODULATION_TYPE;
+1 -3
include/linux/mlx5/driver.h
··· 673 673 }; 674 674 675 675 enum mlx5_interface_state { 676 - MLX5_INTERFACE_STATE_DOWN = BIT(0), 677 - MLX5_INTERFACE_STATE_UP = BIT(1), 678 - MLX5_INTERFACE_STATE_SHUTDOWN = BIT(2), 676 + MLX5_INTERFACE_STATE_UP = BIT(0), 679 677 }; 680 678 681 679 enum mlx5_pci_status {
+2
include/linux/netdevice.h
··· 3866 3866 bool netdev_has_upper_dev_all_rcu(struct net_device *dev, 3867 3867 struct net_device *upper_dev); 3868 3868 3869 + bool netdev_has_any_upper_dev(struct net_device *dev); 3870 + 3869 3871 void *netdev_lower_get_next_private(struct net_device *dev, 3870 3872 struct list_head **iter); 3871 3873 void *netdev_lower_get_next_private_rcu(struct net_device *dev,
+43 -10
include/linux/skbuff.h
··· 973 973 int __must_check skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, 974 974 int offset, int len); 975 975 int skb_cow_data(struct sk_buff *skb, int tailbits, struct sk_buff **trailer); 976 - int skb_pad(struct sk_buff *skb, int pad); 976 + int __skb_pad(struct sk_buff *skb, int pad, bool free_on_error); 977 + 978 + /** 979 + * skb_pad - zero pad the tail of an skb 980 + * @skb: buffer to pad 981 + * @pad: space to pad 982 + * 983 + * Ensure that a buffer is followed by a padding area that is zero 984 + * filled. Used by network drivers which may DMA or transfer data 985 + * beyond the buffer end onto the wire. 986 + * 987 + * May return error in out of memory cases. The skb is freed on error. 988 + */ 989 + static inline int skb_pad(struct sk_buff *skb, int pad) 990 + { 991 + return __skb_pad(skb, pad, true); 992 + } 977 993 #define dev_kfree_skb(a) consume_skb(a) 978 994 979 995 int skb_append_datato_frags(struct sock *sk, struct sk_buff *skb, ··· 2841 2825 * skb_put_padto - increase size and pad an skbuff up to a minimal size 2842 2826 * @skb: buffer to pad 2843 2827 * @len: minimal length 2828 + * @free_on_error: free buffer on error 2829 + * 2830 + * Pads up a buffer to ensure the trailing bytes exist and are 2831 + * blanked. If the buffer already contains sufficient data it 2832 + * is untouched. Otherwise it is extended. Returns zero on 2833 + * success. The skb is freed on error if @free_on_error is true. 2834 + */ 2835 + static inline int __skb_put_padto(struct sk_buff *skb, unsigned int len, 2836 + bool free_on_error) 2837 + { 2838 + unsigned int size = skb->len; 2839 + 2840 + if (unlikely(size < len)) { 2841 + len -= size; 2842 + if (__skb_pad(skb, len, free_on_error)) 2843 + return -ENOMEM; 2844 + __skb_put(skb, len); 2845 + } 2846 + return 0; 2847 + } 2848 + 2849 + /** 2850 + * skb_put_padto - increase size and pad an skbuff up to a minimal size 2851 + * @skb: buffer to pad 2852 + * @len: minimal length 2844 2853 * 2845 2854 * Pads up a buffer to ensure the trailing bytes exist and are 2846 2855 * blanked. If the buffer already contains sufficient data it ··· 2874 2833 */ 2875 2834 static inline int skb_put_padto(struct sk_buff *skb, unsigned int len) 2876 2835 { 2877 - unsigned int size = skb->len; 2878 - 2879 - if (unlikely(size < len)) { 2880 - len -= size; 2881 - if (skb_pad(skb, len)) 2882 - return -ENOMEM; 2883 - __skb_put(skb, len); 2884 - } 2885 - return 0; 2836 + return __skb_put_padto(skb, len, true); 2886 2837 } 2887 2838 2888 2839 static inline int skb_add_data(struct sk_buff *skb,
+30 -2
include/net/ip6_fib.h
··· 70 70 __u16 fn_flags; 71 71 int fn_sernum; 72 72 struct rt6_info *rr_ptr; 73 + struct rcu_head rcu; 73 74 }; 74 75 75 76 #ifndef CONFIG_IPV6_SUBTREES ··· 105 104 * the same cache line. 106 105 */ 107 106 struct fib6_table *rt6i_table; 108 - struct fib6_node *rt6i_node; 107 + struct fib6_node __rcu *rt6i_node; 109 108 110 109 struct in6_addr rt6i_gateway; 111 110 ··· 168 167 rt0->rt6i_flags |= RTF_EXPIRES; 169 168 } 170 169 170 + /* Function to safely get fn->sernum for passed in rt 171 + * and store result in passed in cookie. 172 + * Return true if we can get cookie safely 173 + * Return false if not 174 + */ 175 + static inline bool rt6_get_cookie_safe(const struct rt6_info *rt, 176 + u32 *cookie) 177 + { 178 + struct fib6_node *fn; 179 + bool status = false; 180 + 181 + rcu_read_lock(); 182 + fn = rcu_dereference(rt->rt6i_node); 183 + 184 + if (fn) { 185 + *cookie = fn->fn_sernum; 186 + status = true; 187 + } 188 + 189 + rcu_read_unlock(); 190 + return status; 191 + } 192 + 171 193 static inline u32 rt6_get_cookie(const struct rt6_info *rt) 172 194 { 195 + u32 cookie = 0; 196 + 173 197 if (rt->rt6i_flags & RTF_PCPU || 174 198 (unlikely(!list_empty(&rt->rt6i_uncached)) && rt->dst.from)) 175 199 rt = (struct rt6_info *)(rt->dst.from); 176 200 177 - return rt->rt6i_node ? rt->rt6i_node->fn_sernum : 0; 201 + rt6_get_cookie_safe(rt, &cookie); 202 + 203 + return cookie; 178 204 } 179 205 180 206 static inline void ip6_rt_put(struct rt6_info *rt)
+7
include/net/sch_generic.h
··· 101 101 spinlock_t busylock ____cacheline_aligned_in_smp; 102 102 }; 103 103 104 + static inline void qdisc_refcount_inc(struct Qdisc *qdisc) 105 + { 106 + if (qdisc->flags & TCQ_F_BUILTIN) 107 + return; 108 + refcount_inc(&qdisc->refcnt); 109 + } 110 + 104 111 static inline bool qdisc_is_running(const struct Qdisc *qdisc) 105 112 { 106 113 return (raw_read_seqcount(&qdisc->running) & 1) ? true : false;
+1 -3
include/net/tcp.h
··· 1004 1004 void tcp_get_available_congestion_control(char *buf, size_t len); 1005 1005 void tcp_get_allowed_congestion_control(char *buf, size_t len); 1006 1006 int tcp_set_allowed_congestion_control(char *allowed); 1007 - int tcp_set_congestion_control(struct sock *sk, const char *name, bool load); 1008 - void tcp_reinit_congestion_control(struct sock *sk, 1009 - const struct tcp_congestion_ops *ca); 1007 + int tcp_set_congestion_control(struct sock *sk, const char *name, bool load, bool reinit); 1010 1008 u32 tcp_slow_start(struct tcp_sock *tp, u32 acked); 1011 1009 void tcp_cong_avoid_ai(struct tcp_sock *tp, u32 w, u32 acked); 1012 1010
+1 -1
include/net/udp.h
··· 260 260 } 261 261 262 262 void udp_v4_early_demux(struct sk_buff *skb); 263 - void udp_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst); 263 + bool udp_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst); 264 264 int udp_get_port(struct sock *sk, unsigned short snum, 265 265 int (*saddr_cmp)(const struct sock *, 266 266 const struct sock *));
+17 -13
kernel/bpf/hashtab.c
··· 652 652 } 653 653 } 654 654 655 + static bool fd_htab_map_needs_adjust(const struct bpf_htab *htab) 656 + { 657 + return htab->map.map_type == BPF_MAP_TYPE_HASH_OF_MAPS && 658 + BITS_PER_LONG == 64; 659 + } 660 + 661 + static u32 htab_size_value(const struct bpf_htab *htab, bool percpu) 662 + { 663 + u32 size = htab->map.value_size; 664 + 665 + if (percpu || fd_htab_map_needs_adjust(htab)) 666 + size = round_up(size, 8); 667 + return size; 668 + } 669 + 655 670 static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key, 656 671 void *value, u32 key_size, u32 hash, 657 672 bool percpu, bool onallcpus, 658 673 struct htab_elem *old_elem) 659 674 { 660 - u32 size = htab->map.value_size; 675 + u32 size = htab_size_value(htab, percpu); 661 676 bool prealloc = htab_is_prealloc(htab); 662 677 struct htab_elem *l_new, **pl_new; 663 678 void __percpu *pptr; ··· 711 696 712 697 memcpy(l_new->key, key, key_size); 713 698 if (percpu) { 714 - /* round up value_size to 8 bytes */ 715 - size = round_up(size, 8); 716 - 717 699 if (prealloc) { 718 700 pptr = htab_elem_get_ptr(l_new, key_size); 719 701 } else { ··· 1221 1209 1222 1210 static struct bpf_map *fd_htab_map_alloc(union bpf_attr *attr) 1223 1211 { 1224 - struct bpf_map *map; 1225 - 1226 1212 if (attr->value_size != sizeof(u32)) 1227 1213 return ERR_PTR(-EINVAL); 1228 - 1229 - /* pointer is stored internally */ 1230 - attr->value_size = sizeof(void *); 1231 - map = htab_map_alloc(attr); 1232 - attr->value_size = sizeof(u32); 1233 - 1234 - return map; 1214 + return htab_map_alloc(attr); 1235 1215 } 1236 1216 1237 1217 static void fd_htab_map_free(struct bpf_map *map)
+3
net/bridge/br_device.c
··· 53 53 brstats->tx_bytes += skb->len; 54 54 u64_stats_update_end(&brstats->syncp); 55 55 56 + #ifdef CONFIG_NET_SWITCHDEV 57 + skb->offload_fwd_mark = 0; 58 + #endif 56 59 BR_INPUT_SKB_CB(skb)->brdev = dev; 57 60 58 61 skb_reset_mac_header(skb);
+1 -1
net/bridge/br_switchdev.c
··· 115 115 void 116 116 br_switchdev_fdb_notify(const struct net_bridge_fdb_entry *fdb, int type) 117 117 { 118 - if (!fdb->added_by_user) 118 + if (!fdb->added_by_user || !fdb->dst) 119 119 return; 120 120 121 121 switch (type) {
+1 -1
net/core/datagram.c
··· 362 362 if (flags & MSG_PEEK) { 363 363 err = -ENOENT; 364 364 spin_lock_bh(&sk_queue->lock); 365 - if (skb == skb_peek(sk_queue)) { 365 + if (skb->next) { 366 366 __skb_unlink(skb, sk_queue); 367 367 refcount_dec(&skb->users); 368 368 if (destructor)
+3 -1
net/core/dev.c
··· 5289 5289 * Ideally, a new ndo_busy_poll_stop() could avoid another round. 5290 5290 */ 5291 5291 rc = napi->poll(napi, BUSY_POLL_BUDGET); 5292 + trace_napi_poll(napi, rc, BUSY_POLL_BUDGET); 5292 5293 netpoll_poll_unlock(have_poll_lock); 5293 5294 if (rc == BUSY_POLL_BUDGET) 5294 5295 __napi_schedule(napi); ··· 5668 5667 * Find out if a device is linked to an upper device and return true in case 5669 5668 * it is. The caller must hold the RTNL lock. 5670 5669 */ 5671 - static bool netdev_has_any_upper_dev(struct net_device *dev) 5670 + bool netdev_has_any_upper_dev(struct net_device *dev) 5672 5671 { 5673 5672 ASSERT_RTNL(); 5674 5673 5675 5674 return !list_empty(&dev->adj_list.upper); 5676 5675 } 5676 + EXPORT_SYMBOL(netdev_has_any_upper_dev); 5677 5677 5678 5678 /** 5679 5679 * netdev_master_upper_dev_get - Get master upper device
+2 -6
net/core/filter.c
··· 2836 2836 sk->sk_prot->setsockopt == tcp_setsockopt) { 2837 2837 if (optname == TCP_CONGESTION) { 2838 2838 char name[TCP_CA_NAME_MAX]; 2839 + bool reinit = bpf_sock->op > BPF_SOCK_OPS_NEEDS_ECN; 2839 2840 2840 2841 strncpy(name, optval, min_t(long, optlen, 2841 2842 TCP_CA_NAME_MAX-1)); 2842 2843 name[TCP_CA_NAME_MAX-1] = 0; 2843 - ret = tcp_set_congestion_control(sk, name, false); 2844 - if (!ret && bpf_sock->op > BPF_SOCK_OPS_NEEDS_ECN) 2845 - /* replacing an existing ca */ 2846 - tcp_reinit_congestion_control(sk, 2847 - inet_csk(sk)->icsk_ca_ops); 2844 + ret = tcp_set_congestion_control(sk, name, false, reinit); 2848 2845 } else { 2849 2846 struct tcp_sock *tp = tcp_sk(sk); 2850 2847 ··· 2869 2872 ret = -EINVAL; 2870 2873 } 2871 2874 } 2872 - ret = -EINVAL; 2873 2875 #endif 2874 2876 } else { 2875 2877 ret = -EINVAL;
+8 -5
net/core/skbuff.c
··· 1363 1363 EXPORT_SYMBOL(skb_copy_expand); 1364 1364 1365 1365 /** 1366 - * skb_pad - zero pad the tail of an skb 1366 + * __skb_pad - zero pad the tail of an skb 1367 1367 * @skb: buffer to pad 1368 1368 * @pad: space to pad 1369 + * @free_on_error: free buffer on error 1369 1370 * 1370 1371 * Ensure that a buffer is followed by a padding area that is zero 1371 1372 * filled. Used by network drivers which may DMA or transfer data 1372 1373 * beyond the buffer end onto the wire. 1373 1374 * 1374 - * May return error in out of memory cases. The skb is freed on error. 1375 + * May return error in out of memory cases. The skb is freed on error 1376 + * if @free_on_error is true. 1375 1377 */ 1376 1378 1377 - int skb_pad(struct sk_buff *skb, int pad) 1379 + int __skb_pad(struct sk_buff *skb, int pad, bool free_on_error) 1378 1380 { 1379 1381 int err; 1380 1382 int ntail; ··· 1405 1403 return 0; 1406 1404 1407 1405 free_skb: 1408 - kfree_skb(skb); 1406 + if (free_on_error) 1407 + kfree_skb(skb); 1409 1408 return err; 1410 1409 } 1411 - EXPORT_SYMBOL(skb_pad); 1410 + EXPORT_SYMBOL(__skb_pad); 1412 1411 1413 1412 /** 1414 1413 * pskb_put - add data to the tail of a potentially fragmented buffer
+1 -1
net/dsa/dsa2.c
··· 577 577 return err; 578 578 } 579 579 580 - if (!dst->cpu_dp->netdev) { 580 + if (!dst->cpu_dp) { 581 581 pr_warn("Tree has no master device\n"); 582 582 return -EINVAL; 583 583 }
+7 -5
net/dsa/tag_ksz.c
··· 42 42 padlen = (skb->len >= ETH_ZLEN) ? 0 : ETH_ZLEN - skb->len; 43 43 44 44 if (skb_tailroom(skb) >= padlen + KSZ_INGRESS_TAG_LEN) { 45 - if (skb_put_padto(skb, skb->len + padlen)) 45 + /* Let dsa_slave_xmit() free skb */ 46 + if (__skb_put_padto(skb, skb->len + padlen, false)) 46 47 return NULL; 47 48 48 49 nskb = skb; ··· 61 60 skb_transport_header(skb) - skb->head); 62 61 skb_copy_and_csum_dev(skb, skb_put(nskb, skb->len)); 63 62 64 - if (skb_put_padto(nskb, nskb->len + padlen)) { 65 - kfree_skb(nskb); 63 + /* Let skb_put_padto() free nskb, and let dsa_slave_xmit() free 64 + * skb 65 + */ 66 + if (skb_put_padto(nskb, nskb->len + padlen)) 66 67 return NULL; 67 - } 68 68 69 - kfree_skb(skb); 69 + consume_skb(skb); 70 70 } 71 71 72 72 tag = skb_put(nskb, KSZ_INGRESS_TAG_LEN);
+1 -1
net/dsa/tag_trailer.c
··· 40 40 skb_set_network_header(nskb, skb_network_header(skb) - skb->head); 41 41 skb_set_transport_header(nskb, skb_transport_header(skb) - skb->head); 42 42 skb_copy_and_csum_dev(skb, skb_put(nskb, skb->len)); 43 - kfree_skb(skb); 43 + consume_skb(skb); 44 44 45 45 if (padlen) { 46 46 skb_put_zero(nskb, padlen);
+2 -1
net/hsr/hsr_device.c
··· 314 314 hsr_sp = skb_put(skb, sizeof(struct hsr_sup_payload)); 315 315 ether_addr_copy(hsr_sp->MacAddressA, master->dev->dev_addr); 316 316 317 - skb_put_padto(skb, ETH_ZLEN + HSR_HLEN); 317 + if (skb_put_padto(skb, ETH_ZLEN + HSR_HLEN)) 318 + return; 318 319 319 320 hsr_forward_skb(skb, master); 320 321 return;
+12 -8
net/ipv4/esp4.c
··· 258 258 esp_output_udp_encap(x, skb, esp); 259 259 260 260 if (!skb_cloned(skb)) { 261 - if (tailen <= skb_availroom(skb)) { 261 + if (tailen <= skb_tailroom(skb)) { 262 262 nfrags = 1; 263 263 trailer = skb; 264 264 tail = skb_tail_pointer(trailer); ··· 292 292 293 293 kunmap_atomic(vaddr); 294 294 295 - spin_unlock_bh(&x->lock); 296 - 297 295 nfrags = skb_shinfo(skb)->nr_frags; 298 296 299 297 __skb_fill_page_desc(skb, nfrags, page, pfrag->offset, ··· 299 301 skb_shinfo(skb)->nr_frags = ++nfrags; 300 302 301 303 pfrag->offset = pfrag->offset + allocsize; 304 + 305 + spin_unlock_bh(&x->lock); 306 + 302 307 nfrags++; 303 308 304 309 skb->len += tailen; ··· 382 381 (unsigned char *)esph - skb->data, 383 382 assoclen + ivlen + esp->clen + alen); 384 383 if (unlikely(err < 0)) 385 - goto error; 384 + goto error_free; 386 385 387 386 if (!esp->inplace) { 388 387 int allocsize; ··· 393 392 spin_lock_bh(&x->lock); 394 393 if (unlikely(!skb_page_frag_refill(allocsize, pfrag, GFP_ATOMIC))) { 395 394 spin_unlock_bh(&x->lock); 396 - goto error; 395 + goto error_free; 397 396 } 398 397 399 398 skb_shinfo(skb)->nr_frags = 1; ··· 410 409 (unsigned char *)esph - skb->data, 411 410 assoclen + ivlen + esp->clen + alen); 412 411 if (unlikely(err < 0)) 413 - goto error; 412 + goto error_free; 414 413 } 415 414 416 415 if ((x->props.flags & XFRM_STATE_ESN)) ··· 443 442 444 443 if (sg != dsg) 445 444 esp_ssg_unref(x, tmp); 446 - kfree(tmp); 447 445 446 + error_free: 447 + kfree(tmp); 448 448 error: 449 449 return err; 450 450 } ··· 697 695 698 696 sg_init_table(sg, nfrags); 699 697 err = skb_to_sgvec(skb, sg, 0, skb->len); 700 - if (unlikely(err < 0)) 698 + if (unlikely(err < 0)) { 699 + kfree(tmp); 701 700 goto out; 701 + } 702 702 703 703 skb->ip_summed = CHECKSUM_NONE; 704 704
+1 -1
net/ipv4/esp4_offload.c
··· 257 257 esp.seqno = cpu_to_be64(xo->seq.low + ((u64)xo->seq.hi << 32)); 258 258 259 259 err = esp_output_tail(x, skb, &esp); 260 - if (err < 0) 260 + if (err) 261 261 return err; 262 262 263 263 secpath_reset(skb);
+5 -5
net/ipv4/netfilter/arp_tables.c
··· 268 268 acpar.targinfo = t->data; 269 269 verdict = t->u.kernel.target->target(skb, &acpar); 270 270 271 - /* Target might have changed stuff. */ 272 - arp = arp_hdr(skb); 273 - 274 - if (verdict == XT_CONTINUE) 271 + if (verdict == XT_CONTINUE) { 272 + /* Target might have changed stuff. */ 273 + arp = arp_hdr(skb); 275 274 e = arpt_next_entry(e); 276 - else 275 + } else { 277 276 /* Verdict */ 278 277 break; 278 + } 279 279 } while (!acpar.hotdrop); 280 280 xt_write_recseq_end(addend); 281 281 local_bh_enable();
+5 -4
net/ipv4/netfilter/ip_tables.c
··· 352 352 acpar.targinfo = t->data; 353 353 354 354 verdict = t->u.kernel.target->target(skb, &acpar); 355 - /* Target might have changed stuff. */ 356 - ip = ip_hdr(skb); 357 - if (verdict == XT_CONTINUE) 355 + if (verdict == XT_CONTINUE) { 356 + /* Target might have changed stuff. */ 357 + ip = ip_hdr(skb); 358 358 e = ipt_next_entry(e); 359 - else 359 + } else { 360 360 /* Verdict */ 361 361 break; 362 + } 362 363 } while (!acpar.hotdrop); 363 364 364 365 xt_write_recseq_end(addend);
+3 -1
net/ipv4/netfilter/ipt_CLUSTERIP.c
··· 117 117 * functions are also incrementing the refcount on their own, 118 118 * so it's safe to remove the entry even if it's in use. */ 119 119 #ifdef CONFIG_PROC_FS 120 - proc_remove(c->pde); 120 + if (cn->procdir) 121 + proc_remove(c->pde); 121 122 #endif 122 123 return; 123 124 } ··· 816 815 #ifdef CONFIG_PROC_FS 817 816 struct clusterip_net *cn = net_generic(net, clusterip_net_id); 818 817 proc_remove(cn->procdir); 818 + cn->procdir = NULL; 819 819 #endif 820 820 nf_unregister_net_hook(net, &cip_arp_ops); 821 821 }
+1 -1
net/ipv4/tcp.c
··· 2481 2481 name[val] = 0; 2482 2482 2483 2483 lock_sock(sk); 2484 - err = tcp_set_congestion_control(sk, name, true); 2484 + err = tcp_set_congestion_control(sk, name, true, true); 2485 2485 release_sock(sk); 2486 2486 return err; 2487 2487 }
+14 -5
net/ipv4/tcp_cong.c
··· 189 189 INET_ECN_dontxmit(sk); 190 190 } 191 191 192 - void tcp_reinit_congestion_control(struct sock *sk, 193 - const struct tcp_congestion_ops *ca) 192 + static void tcp_reinit_congestion_control(struct sock *sk, 193 + const struct tcp_congestion_ops *ca) 194 194 { 195 195 struct inet_connection_sock *icsk = inet_csk(sk); 196 196 ··· 338 338 * tcp_reinit_congestion_control (if the current congestion control was 339 339 * already initialized. 340 340 */ 341 - int tcp_set_congestion_control(struct sock *sk, const char *name, bool load) 341 + int tcp_set_congestion_control(struct sock *sk, const char *name, bool load, bool reinit) 342 342 { 343 343 struct inet_connection_sock *icsk = inet_csk(sk); 344 344 const struct tcp_congestion_ops *ca; ··· 360 360 if (!ca) { 361 361 err = -ENOENT; 362 362 } else if (!load) { 363 - icsk->icsk_ca_ops = ca; 364 - if (!try_module_get(ca->owner)) 363 + const struct tcp_congestion_ops *old_ca = icsk->icsk_ca_ops; 364 + 365 + if (try_module_get(ca->owner)) { 366 + if (reinit) { 367 + tcp_reinit_congestion_control(sk, ca); 368 + } else { 369 + icsk->icsk_ca_ops = ca; 370 + module_put(old_ca->owner); 371 + } 372 + } else { 365 373 err = -EBUSY; 374 + } 366 375 } else if (!((ca->flags & TCP_CONG_NON_RESTRICTED) || 367 376 ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))) { 368 377 err = -EPERM;
+4 -2
net/ipv4/udp.c
··· 1176 1176 scratch->csum_unnecessary = !!skb_csum_unnecessary(skb); 1177 1177 scratch->is_linear = !skb_is_nonlinear(skb); 1178 1178 #endif 1179 - if (likely(!skb->_skb_refdst)) 1179 + if (likely(!skb->_skb_refdst && !skb_sec_path(skb))) 1180 1180 scratch->_tsize_state |= UDP_SKB_IS_STATELESS; 1181 1181 } 1182 1182 ··· 1929 1929 /* For TCP sockets, sk_rx_dst is protected by socket lock 1930 1930 * For UDP, we use xchg() to guard against concurrent changes. 1931 1931 */ 1932 - void udp_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst) 1932 + bool udp_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst) 1933 1933 { 1934 1934 struct dst_entry *old; 1935 1935 1936 1936 if (dst_hold_safe(dst)) { 1937 1937 old = xchg(&sk->sk_rx_dst, dst); 1938 1938 dst_release(old); 1939 + return old != dst; 1939 1940 } 1941 + return false; 1940 1942 } 1941 1943 EXPORT_SYMBOL(udp_sk_rx_dst_set); 1942 1944
+1 -1
net/ipv6/addrconf.c
··· 5556 5556 * our DAD process, so we don't need 5557 5557 * to do it again 5558 5558 */ 5559 - if (!(ifp->rt->rt6i_node)) 5559 + if (!rcu_access_pointer(ifp->rt->rt6i_node)) 5560 5560 ip6_ins_rt(ifp->rt); 5561 5561 if (ifp->idev->cnf.forwarding) 5562 5562 addrconf_join_anycast(ifp);
+9 -7
net/ipv6/esp6.c
··· 226 226 int tailen = esp->tailen; 227 227 228 228 if (!skb_cloned(skb)) { 229 - if (tailen <= skb_availroom(skb)) { 229 + if (tailen <= skb_tailroom(skb)) { 230 230 nfrags = 1; 231 231 trailer = skb; 232 232 tail = skb_tail_pointer(trailer); ··· 260 260 261 261 kunmap_atomic(vaddr); 262 262 263 - spin_unlock_bh(&x->lock); 264 - 265 263 nfrags = skb_shinfo(skb)->nr_frags; 266 264 267 265 __skb_fill_page_desc(skb, nfrags, page, pfrag->offset, ··· 267 269 skb_shinfo(skb)->nr_frags = ++nfrags; 268 270 269 271 pfrag->offset = pfrag->offset + allocsize; 272 + 273 + spin_unlock_bh(&x->lock); 274 + 270 275 nfrags++; 271 276 272 277 skb->len += tailen; ··· 346 345 (unsigned char *)esph - skb->data, 347 346 assoclen + ivlen + esp->clen + alen); 348 347 if (unlikely(err < 0)) 349 - goto error; 348 + goto error_free; 350 349 351 350 if (!esp->inplace) { 352 351 int allocsize; ··· 357 356 spin_lock_bh(&x->lock); 358 357 if (unlikely(!skb_page_frag_refill(allocsize, pfrag, GFP_ATOMIC))) { 359 358 spin_unlock_bh(&x->lock); 360 - goto error; 359 + goto error_free; 361 360 } 362 361 363 362 skb_shinfo(skb)->nr_frags = 1; ··· 374 373 (unsigned char *)esph - skb->data, 375 374 assoclen + ivlen + esp->clen + alen); 376 375 if (unlikely(err < 0)) 377 - goto error; 376 + goto error_free; 378 377 } 379 378 380 379 if ((x->props.flags & XFRM_STATE_ESN)) ··· 407 406 408 407 if (sg != dsg) 409 408 esp_ssg_unref(x, tmp); 410 - kfree(tmp); 411 409 410 + error_free: 411 + kfree(tmp); 412 412 error: 413 413 return err; 414 414 }
+1 -1
net/ipv6/esp6_offload.c
··· 286 286 esp.seqno = cpu_to_be64(xo->seq.low + ((u64)xo->seq.hi << 32)); 287 287 288 288 err = esp6_output_tail(x, skb, &esp); 289 - if (err < 0) 289 + if (err) 290 290 return err; 291 291 292 292 secpath_reset(skb);
+26 -9
net/ipv6/ip6_fib.c
··· 148 148 return fn; 149 149 } 150 150 151 - static void node_free(struct fib6_node *fn) 151 + static void node_free_immediate(struct fib6_node *fn) 152 152 { 153 153 kmem_cache_free(fib6_node_kmem, fn); 154 + } 155 + 156 + static void node_free_rcu(struct rcu_head *head) 157 + { 158 + struct fib6_node *fn = container_of(head, struct fib6_node, rcu); 159 + 160 + kmem_cache_free(fib6_node_kmem, fn); 161 + } 162 + 163 + static void node_free(struct fib6_node *fn) 164 + { 165 + call_rcu(&fn->rcu, node_free_rcu); 154 166 } 155 167 156 168 static void rt6_free_pcpu(struct rt6_info *non_pcpu_rt) ··· 613 601 614 602 if (!in || !ln) { 615 603 if (in) 616 - node_free(in); 604 + node_free_immediate(in); 617 605 if (ln) 618 - node_free(ln); 606 + node_free_immediate(ln); 619 607 return ERR_PTR(-ENOMEM); 620 608 } 621 609 ··· 889 877 890 878 rt->dst.rt6_next = iter; 891 879 *ins = rt; 892 - rt->rt6i_node = fn; 880 + rcu_assign_pointer(rt->rt6i_node, fn); 893 881 atomic_inc(&rt->rt6i_ref); 894 882 if (!info->skip_notify) 895 883 inet6_rt_notify(RTM_NEWROUTE, rt, info, nlflags); ··· 915 903 return err; 916 904 917 905 *ins = rt; 918 - rt->rt6i_node = fn; 906 + rcu_assign_pointer(rt->rt6i_node, fn); 919 907 rt->dst.rt6_next = iter->dst.rt6_next; 920 908 atomic_inc(&rt->rt6i_ref); 921 909 if (!info->skip_notify) ··· 1050 1038 root, and then (in failure) stale node 1051 1039 in main tree. 1052 1040 */ 1053 - node_free(sfn); 1041 + node_free_immediate(sfn); 1054 1042 err = PTR_ERR(sn); 1055 1043 goto failure; 1056 1044 } ··· 1480 1468 1481 1469 int fib6_del(struct rt6_info *rt, struct nl_info *info) 1482 1470 { 1471 + struct fib6_node *fn = rcu_dereference_protected(rt->rt6i_node, 1472 + lockdep_is_held(&rt->rt6i_table->tb6_lock)); 1483 1473 struct net *net = info->nl_net; 1484 - struct fib6_node *fn = rt->rt6i_node; 1485 1474 struct rt6_info **rtp; 1486 1475 1487 1476 #if RT6_DEBUG >= 2 ··· 1671 1658 if (res) { 1672 1659 #if RT6_DEBUG >= 2 1673 1660 pr_debug("%s: del failed: rt=%p@%p err=%d\n", 1674 - __func__, rt, rt->rt6i_node, res); 1661 + __func__, rt, 1662 + rcu_access_pointer(rt->rt6i_node), 1663 + res); 1675 1664 #endif 1676 1665 continue; 1677 1666 } ··· 1795 1780 } 1796 1781 gc_args->more++; 1797 1782 } else if (rt->rt6i_flags & RTF_CACHE) { 1783 + if (time_after_eq(now, rt->dst.lastuse + gc_args->timeout)) 1784 + rt->dst.obsolete = DST_OBSOLETE_KILL; 1798 1785 if (atomic_read(&rt->dst.__refcnt) == 1 && 1799 - time_after_eq(now, rt->dst.lastuse + gc_args->timeout)) { 1786 + rt->dst.obsolete == DST_OBSOLETE_KILL) { 1800 1787 RT6_TRACE("aging clone %p\n", rt); 1801 1788 return -1; 1802 1789 } else if (rt->rt6i_flags & RTF_GATEWAY) {
-1
net/ipv6/ipv6_sockglue.c
··· 242 242 pktopt = xchg(&np->pktoptions, NULL); 243 243 kfree_skb(pktopt); 244 244 245 - sk->sk_destruct = inet_sock_destruct; 246 245 /* 247 246 * ... and add it to the refcnt debug socks count 248 247 * in the new family. -acme
+2 -4
net/ipv6/output_core.c
··· 86 86 87 87 while (offset <= packet_len) { 88 88 struct ipv6_opt_hdr *exthdr; 89 - unsigned int len; 90 89 91 90 switch (**nexthdr) { 92 91 ··· 111 112 112 113 exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) + 113 114 offset); 114 - len = ipv6_optlen(exthdr); 115 - if (len + offset >= IPV6_MAXPLEN) 115 + offset += ipv6_optlen(exthdr); 116 + if (offset > IPV6_MAXPLEN) 116 117 return -EINVAL; 117 - offset += len; 118 118 *nexthdr = &exthdr->nexthdr; 119 119 } 120 120
+15 -5
net/ipv6/route.c
··· 440 440 if (time_after(jiffies, rt->dst.expires)) 441 441 return true; 442 442 } else if (rt->dst.from) { 443 - return rt6_check_expired((struct rt6_info *) rt->dst.from); 443 + return rt->dst.obsolete != DST_OBSOLETE_FORCE_CHK || 444 + rt6_check_expired((struct rt6_info *)rt->dst.from); 444 445 } 445 446 return false; 446 447 } ··· 1290 1289 1291 1290 static struct dst_entry *rt6_check(struct rt6_info *rt, u32 cookie) 1292 1291 { 1293 - if (!rt->rt6i_node || (rt->rt6i_node->fn_sernum != cookie)) 1292 + u32 rt_cookie = 0; 1293 + 1294 + if (!rt6_get_cookie_safe(rt, &rt_cookie) || rt_cookie != cookie) 1294 1295 return NULL; 1295 1296 1296 1297 if (rt6_check_expired(rt)) ··· 1360 1357 if (rt->rt6i_flags & RTF_CACHE) { 1361 1358 if (dst_hold_safe(&rt->dst)) 1362 1359 ip6_del_rt(rt); 1363 - } else if (rt->rt6i_node && (rt->rt6i_flags & RTF_DEFAULT)) { 1364 - rt->rt6i_node->fn_sernum = -1; 1360 + } else { 1361 + struct fib6_node *fn; 1362 + 1363 + rcu_read_lock(); 1364 + fn = rcu_dereference(rt->rt6i_node); 1365 + if (fn && (rt->rt6i_flags & RTF_DEFAULT)) 1366 + fn->fn_sernum = -1; 1367 + rcu_read_unlock(); 1365 1368 } 1366 1369 } 1367 1370 } ··· 1384 1375 static bool rt6_cache_allowed_for_pmtu(const struct rt6_info *rt) 1385 1376 { 1386 1377 return !(rt->rt6i_flags & RTF_CACHE) && 1387 - (rt->rt6i_flags & RTF_PCPU || rt->rt6i_node); 1378 + (rt->rt6i_flags & RTF_PCPU || 1379 + rcu_access_pointer(rt->rt6i_node)); 1388 1380 } 1389 1381 1390 1382 static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk,
+10 -1
net/ipv6/udp.c
··· 768 768 return 0; 769 769 } 770 770 771 + static void udp6_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst) 772 + { 773 + if (udp_sk_rx_dst_set(sk, dst)) { 774 + const struct rt6_info *rt = (const struct rt6_info *)dst; 775 + 776 + inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt); 777 + } 778 + } 779 + 771 780 int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, 772 781 int proto) 773 782 { ··· 826 817 int ret; 827 818 828 819 if (unlikely(sk->sk_rx_dst != dst)) 829 - udp_sk_rx_dst_set(sk, dst); 820 + udp6_sk_rx_dst_set(sk, dst); 830 821 831 822 ret = udpv6_queue_rcv_skb(sk, skb); 832 823 sock_put(sk);
+4
net/kcm/kcmsock.c
··· 1383 1383 if (!csk) 1384 1384 return -EINVAL; 1385 1385 1386 + /* We must prevent loops or risk deadlock ! */ 1387 + if (csk->sk_family == PF_KCM) 1388 + return -EOPNOTSUPP; 1389 + 1386 1390 psock = kmem_cache_zalloc(kcm_psockp, GFP_KERNEL); 1387 1391 if (!psock) 1388 1392 return -ENOMEM;
+23 -49
net/l2tp/l2tp_core.c
··· 113 113 spinlock_t l2tp_session_hlist_lock; 114 114 }; 115 115 116 - static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel); 117 116 118 117 static inline struct l2tp_tunnel *l2tp_tunnel(struct sock *sk) 119 118 { ··· 125 126 126 127 return net_generic(net, l2tp_net_id); 127 128 } 128 - 129 - /* Tunnel reference counts. Incremented per session that is added to 130 - * the tunnel. 131 - */ 132 - static inline void l2tp_tunnel_inc_refcount_1(struct l2tp_tunnel *tunnel) 133 - { 134 - refcount_inc(&tunnel->ref_count); 135 - } 136 - 137 - static inline void l2tp_tunnel_dec_refcount_1(struct l2tp_tunnel *tunnel) 138 - { 139 - if (refcount_dec_and_test(&tunnel->ref_count)) 140 - l2tp_tunnel_free(tunnel); 141 - } 142 - #ifdef L2TP_REFCNT_DEBUG 143 - #define l2tp_tunnel_inc_refcount(_t) \ 144 - do { \ 145 - pr_debug("l2tp_tunnel_inc_refcount: %s:%d %s: cnt=%d\n", \ 146 - __func__, __LINE__, (_t)->name, \ 147 - refcount_read(&_t->ref_count)); \ 148 - l2tp_tunnel_inc_refcount_1(_t); \ 149 - } while (0) 150 - #define l2tp_tunnel_dec_refcount(_t) \ 151 - do { \ 152 - pr_debug("l2tp_tunnel_dec_refcount: %s:%d %s: cnt=%d\n", \ 153 - __func__, __LINE__, (_t)->name, \ 154 - refcount_read(&_t->ref_count)); \ 155 - l2tp_tunnel_dec_refcount_1(_t); \ 156 - } while (0) 157 - #else 158 - #define l2tp_tunnel_inc_refcount(t) l2tp_tunnel_inc_refcount_1(t) 159 - #define l2tp_tunnel_dec_refcount(t) l2tp_tunnel_dec_refcount_1(t) 160 - #endif 161 129 162 130 /* Session hash global list for L2TPv3. 163 131 * The session_id SHOULD be random according to RFC3931, but several ··· 194 228 { 195 229 return &tunnel->session_hlist[hash_32(session_id, L2TP_HASH_BITS)]; 196 230 } 231 + 232 + /* Lookup a tunnel. A new reference is held on the returned tunnel. */ 233 + struct l2tp_tunnel *l2tp_tunnel_get(const struct net *net, u32 tunnel_id) 234 + { 235 + const struct l2tp_net *pn = l2tp_pernet(net); 236 + struct l2tp_tunnel *tunnel; 237 + 238 + rcu_read_lock_bh(); 239 + list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) { 240 + if (tunnel->tunnel_id == tunnel_id) { 241 + l2tp_tunnel_inc_refcount(tunnel); 242 + rcu_read_unlock_bh(); 243 + 244 + return tunnel; 245 + } 246 + } 247 + rcu_read_unlock_bh(); 248 + 249 + return NULL; 250 + } 251 + EXPORT_SYMBOL_GPL(l2tp_tunnel_get); 197 252 198 253 /* Lookup a session. A new reference is held on the returned session. 199 254 * Optionally calls session->ref() too if do_ref is true. ··· 1335 1348 } 1336 1349 } 1337 1350 1338 - /* Really kill the tunnel. 1339 - * Come here only when all sessions have been cleared from the tunnel. 1340 - */ 1341 - static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel) 1342 - { 1343 - BUG_ON(refcount_read(&tunnel->ref_count) != 0); 1344 - BUG_ON(tunnel->sock != NULL); 1345 - l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: free...\n", tunnel->name); 1346 - kfree_rcu(tunnel, rcu); 1347 - } 1348 - 1349 1351 /* Workqueue tunnel deletion function */ 1350 1352 static void l2tp_tunnel_del_work(struct work_struct *work) 1351 1353 { ··· 1820 1844 1821 1845 l2tp_session_set_header_len(session, tunnel->version); 1822 1846 1847 + refcount_set(&session->ref_count, 1); 1848 + 1823 1849 err = l2tp_session_add_to_tunnel(tunnel, session); 1824 1850 if (err) { 1825 1851 kfree(session); ··· 1829 1851 return ERR_PTR(err); 1830 1852 } 1831 1853 1832 - /* Bump the reference count. The session context is deleted 1833 - * only when this drops to zero. 1834 - */ 1835 - refcount_set(&session->ref_count, 1); 1836 1854 l2tp_tunnel_inc_refcount(tunnel); 1837 1855 1838 1856 /* Ensure tunnel socket isn't deleted */
+13
net/l2tp/l2tp_core.h
··· 231 231 return tunnel; 232 232 } 233 233 234 + struct l2tp_tunnel *l2tp_tunnel_get(const struct net *net, u32 tunnel_id); 235 + 234 236 struct l2tp_session *l2tp_session_get(const struct net *net, 235 237 struct l2tp_tunnel *tunnel, 236 238 u32 session_id, bool do_ref); ··· 270 268 const struct l2tp_nl_cmd_ops *ops); 271 269 void l2tp_nl_unregister_ops(enum l2tp_pwtype pw_type); 272 270 int l2tp_ioctl(struct sock *sk, int cmd, unsigned long arg); 271 + 272 + static inline void l2tp_tunnel_inc_refcount(struct l2tp_tunnel *tunnel) 273 + { 274 + refcount_inc(&tunnel->ref_count); 275 + } 276 + 277 + static inline void l2tp_tunnel_dec_refcount(struct l2tp_tunnel *tunnel) 278 + { 279 + if (refcount_dec_and_test(&tunnel->ref_count)) 280 + kfree_rcu(tunnel, rcu); 281 + } 273 282 274 283 /* Session reference counts. Incremented when code obtains a reference 275 284 * to a session.
+39 -27
net/l2tp/l2tp_netlink.c
··· 65 65 (info->attrs[L2TP_ATTR_CONN_ID])) { 66 66 tunnel_id = nla_get_u32(info->attrs[L2TP_ATTR_CONN_ID]); 67 67 session_id = nla_get_u32(info->attrs[L2TP_ATTR_SESSION_ID]); 68 - tunnel = l2tp_tunnel_find(net, tunnel_id); 69 - if (tunnel) 68 + tunnel = l2tp_tunnel_get(net, tunnel_id); 69 + if (tunnel) { 70 70 session = l2tp_session_get(net, tunnel, session_id, 71 71 do_ref); 72 + l2tp_tunnel_dec_refcount(tunnel); 73 + } 72 74 } 73 75 74 76 return session; ··· 273 271 } 274 272 tunnel_id = nla_get_u32(info->attrs[L2TP_ATTR_CONN_ID]); 275 273 276 - tunnel = l2tp_tunnel_find(net, tunnel_id); 277 - if (tunnel == NULL) { 274 + tunnel = l2tp_tunnel_get(net, tunnel_id); 275 + if (!tunnel) { 278 276 ret = -ENODEV; 279 277 goto out; 280 278 } ··· 283 281 tunnel, L2TP_CMD_TUNNEL_DELETE); 284 282 285 283 (void) l2tp_tunnel_delete(tunnel); 284 + 285 + l2tp_tunnel_dec_refcount(tunnel); 286 286 287 287 out: 288 288 return ret; ··· 303 299 } 304 300 tunnel_id = nla_get_u32(info->attrs[L2TP_ATTR_CONN_ID]); 305 301 306 - tunnel = l2tp_tunnel_find(net, tunnel_id); 307 - if (tunnel == NULL) { 302 + tunnel = l2tp_tunnel_get(net, tunnel_id); 303 + if (!tunnel) { 308 304 ret = -ENODEV; 309 305 goto out; 310 306 } ··· 314 310 315 311 ret = l2tp_tunnel_notify(&l2tp_nl_family, info, 316 312 tunnel, L2TP_CMD_TUNNEL_MODIFY); 313 + 314 + l2tp_tunnel_dec_refcount(tunnel); 317 315 318 316 out: 319 317 return ret; ··· 444 438 445 439 if (!info->attrs[L2TP_ATTR_CONN_ID]) { 446 440 ret = -EINVAL; 447 - goto out; 441 + goto err; 448 442 } 449 443 450 444 tunnel_id = nla_get_u32(info->attrs[L2TP_ATTR_CONN_ID]); 451 445 452 - tunnel = l2tp_tunnel_find(net, tunnel_id); 453 - if (tunnel == NULL) { 454 - ret = -ENODEV; 455 - goto out; 456 - } 457 - 458 446 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 459 447 if (!msg) { 460 448 ret = -ENOMEM; 461 - goto out; 449 + goto err; 450 + } 451 + 452 + tunnel = l2tp_tunnel_get(net, tunnel_id); 453 + if (!tunnel) { 454 + ret = -ENODEV; 455 + goto err_nlmsg; 462 456 } 463 457 464 458 ret = l2tp_nl_tunnel_send(msg, info->snd_portid, info->snd_seq, 465 459 NLM_F_ACK, tunnel, L2TP_CMD_TUNNEL_GET); 466 460 if (ret < 0) 467 - goto err_out; 461 + goto err_nlmsg_tunnel; 462 + 463 + l2tp_tunnel_dec_refcount(tunnel); 468 464 469 465 return genlmsg_unicast(net, msg, info->snd_portid); 470 466 471 - err_out: 467 + err_nlmsg_tunnel: 468 + l2tp_tunnel_dec_refcount(tunnel); 469 + err_nlmsg: 472 470 nlmsg_free(msg); 473 - 474 - out: 471 + err: 475 472 return ret; 476 473 } 477 474 ··· 518 509 ret = -EINVAL; 519 510 goto out; 520 511 } 512 + 521 513 tunnel_id = nla_get_u32(info->attrs[L2TP_ATTR_CONN_ID]); 522 - tunnel = l2tp_tunnel_find(net, tunnel_id); 514 + tunnel = l2tp_tunnel_get(net, tunnel_id); 523 515 if (!tunnel) { 524 516 ret = -ENODEV; 525 517 goto out; ··· 528 518 529 519 if (!info->attrs[L2TP_ATTR_SESSION_ID]) { 530 520 ret = -EINVAL; 531 - goto out; 521 + goto out_tunnel; 532 522 } 533 523 session_id = nla_get_u32(info->attrs[L2TP_ATTR_SESSION_ID]); 534 524 535 525 if (!info->attrs[L2TP_ATTR_PEER_SESSION_ID]) { 536 526 ret = -EINVAL; 537 - goto out; 527 + goto out_tunnel; 538 528 } 539 529 peer_session_id = nla_get_u32(info->attrs[L2TP_ATTR_PEER_SESSION_ID]); 540 530 541 531 if (!info->attrs[L2TP_ATTR_PW_TYPE]) { 542 532 ret = -EINVAL; 543 - goto out; 533 + goto out_tunnel; 544 534 } 545 535 cfg.pw_type = nla_get_u16(info->attrs[L2TP_ATTR_PW_TYPE]); 546 536 if (cfg.pw_type >= __L2TP_PWTYPE_MAX) { 547 537 ret = -EINVAL; 548 - goto out; 538 + goto out_tunnel; 549 539 } 550 540 551 541 if (tunnel->version > 2) { ··· 567 557 u16 len = nla_len(info->attrs[L2TP_ATTR_COOKIE]); 568 558 if (len > 8) { 569 559 ret = -EINVAL; 570 - goto out; 560 + goto out_tunnel; 571 561 } 572 562 cfg.cookie_len = len; 573 563 memcpy(&cfg.cookie[0], nla_data(info->attrs[L2TP_ATTR_COOKIE]), len); ··· 576 566 u16 len = nla_len(info->attrs[L2TP_ATTR_PEER_COOKIE]); 577 567 if (len > 8) { 578 568 ret = -EINVAL; 579 - goto out; 569 + goto out_tunnel; 580 570 } 581 571 cfg.peer_cookie_len = len; 582 572 memcpy(&cfg.peer_cookie[0], nla_data(info->attrs[L2TP_ATTR_PEER_COOKIE]), len); ··· 619 609 if ((l2tp_nl_cmd_ops[cfg.pw_type] == NULL) || 620 610 (l2tp_nl_cmd_ops[cfg.pw_type]->session_create == NULL)) { 621 611 ret = -EPROTONOSUPPORT; 622 - goto out; 612 + goto out_tunnel; 623 613 } 624 614 625 615 /* Check that pseudowire-specific params are present */ ··· 629 619 case L2TP_PWTYPE_ETH_VLAN: 630 620 if (!info->attrs[L2TP_ATTR_VLAN_ID]) { 631 621 ret = -EINVAL; 632 - goto out; 622 + goto out_tunnel; 633 623 } 634 624 break; 635 625 case L2TP_PWTYPE_ETH: ··· 657 647 } 658 648 } 659 649 650 + out_tunnel: 651 + l2tp_tunnel_dec_refcount(tunnel); 660 652 out: 661 653 return ret; 662 654 }
+1 -1
net/netfilter/nf_nat_core.c
··· 441 441 else 442 442 ct->status |= IPS_DST_NAT; 443 443 444 - if (nfct_help(ct)) 444 + if (nfct_help(ct) && !nfct_seqadj(ct)) 445 445 if (!nfct_seqadj_ext_add(ct)) 446 446 return NF_DROP; 447 447 }
+2 -2
net/netfilter/nft_compat.c
··· 305 305 const struct nf_hook_ops *ops = &basechain->ops[0]; 306 306 307 307 hook_mask = 1 << ops->hooknum; 308 - if (!(hook_mask & target->hooks)) 308 + if (target->hooks && !(hook_mask & target->hooks)) 309 309 return -EINVAL; 310 310 311 311 ret = nft_compat_chain_validate_dependency(target->table, ··· 484 484 const struct nf_hook_ops *ops = &basechain->ops[0]; 485 485 486 486 hook_mask = 1 << ops->hooknum; 487 - if (!(hook_mask & match->hooks)) 487 + if (match->hooks && !(hook_mask & match->hooks)) 488 488 return -EINVAL; 489 489 490 490 ret = nft_compat_chain_validate_dependency(match->table,
+14 -11
net/netfilter/nft_limit.c
··· 65 65 limit->nsecs = unit * NSEC_PER_SEC; 66 66 if (limit->rate == 0 || limit->nsecs < unit) 67 67 return -EOVERFLOW; 68 - limit->tokens = limit->tokens_max = limit->nsecs; 69 68 70 - if (tb[NFTA_LIMIT_BURST]) { 71 - u64 rate; 72 - 69 + if (tb[NFTA_LIMIT_BURST]) 73 70 limit->burst = ntohl(nla_get_be32(tb[NFTA_LIMIT_BURST])); 71 + else 72 + limit->burst = 0; 74 73 75 - rate = limit->rate + limit->burst; 76 - if (rate < limit->rate) 77 - return -EOVERFLOW; 74 + if (limit->rate + limit->burst < limit->rate) 75 + return -EOVERFLOW; 78 76 79 - limit->rate = rate; 80 - } 77 + /* The token bucket size limits the number of tokens can be 78 + * accumulated. tokens_max specifies the bucket size. 79 + * tokens_max = unit * (rate + burst) / rate. 80 + */ 81 + limit->tokens = div_u64(limit->nsecs * (limit->rate + limit->burst), 82 + limit->rate); 83 + limit->tokens_max = limit->tokens; 84 + 81 85 if (tb[NFTA_LIMIT_FLAGS]) { 82 86 u32 flags = ntohl(nla_get_be32(tb[NFTA_LIMIT_FLAGS])); 83 87 ··· 99 95 { 100 96 u32 flags = limit->invert ? NFT_LIMIT_F_INV : 0; 101 97 u64 secs = div_u64(limit->nsecs, NSEC_PER_SEC); 102 - u64 rate = limit->rate - limit->burst; 103 98 104 - if (nla_put_be64(skb, NFTA_LIMIT_RATE, cpu_to_be64(rate), 99 + if (nla_put_be64(skb, NFTA_LIMIT_RATE, cpu_to_be64(limit->rate), 105 100 NFTA_LIMIT_PAD) || 106 101 nla_put_be64(skb, NFTA_LIMIT_UNIT, cpu_to_be64(secs), 107 102 NFTA_LIMIT_PAD) ||
+9 -3
net/packet/af_packet.c
··· 2191 2191 struct timespec ts; 2192 2192 __u32 ts_status; 2193 2193 bool is_drop_n_account = false; 2194 + bool do_vnet = false; 2194 2195 2195 2196 /* struct tpacket{2,3}_hdr is aligned to a multiple of TPACKET_ALIGNMENT. 2196 2197 * We may add members to them until current aligned size without forcing ··· 2242 2241 netoff = TPACKET_ALIGN(po->tp_hdrlen + 2243 2242 (maclen < 16 ? 16 : maclen)) + 2244 2243 po->tp_reserve; 2245 - if (po->has_vnet_hdr) 2244 + if (po->has_vnet_hdr) { 2246 2245 netoff += sizeof(struct virtio_net_hdr); 2246 + do_vnet = true; 2247 + } 2247 2248 macoff = netoff - maclen; 2248 2249 } 2249 2250 if (po->tp_version <= TPACKET_V2) { ··· 2262 2259 skb_set_owner_r(copy_skb, sk); 2263 2260 } 2264 2261 snaplen = po->rx_ring.frame_size - macoff; 2265 - if ((int)snaplen < 0) 2262 + if ((int)snaplen < 0) { 2266 2263 snaplen = 0; 2264 + do_vnet = false; 2265 + } 2267 2266 } 2268 2267 } else if (unlikely(macoff + snaplen > 2269 2268 GET_PBDQC_FROM_RB(&po->rx_ring)->max_frame_len)) { ··· 2278 2273 if (unlikely((int)snaplen < 0)) { 2279 2274 snaplen = 0; 2280 2275 macoff = GET_PBDQC_FROM_RB(&po->rx_ring)->max_frame_len; 2276 + do_vnet = false; 2281 2277 } 2282 2278 } 2283 2279 spin_lock(&sk->sk_receive_queue.lock); ··· 2304 2298 } 2305 2299 spin_unlock(&sk->sk_receive_queue.lock); 2306 2300 2307 - if (po->has_vnet_hdr) { 2301 + if (do_vnet) { 2308 2302 if (virtio_net_hdr_from_skb(skb, h.raw + macoff - 2309 2303 sizeof(struct virtio_net_hdr), 2310 2304 vio_le(), true)) {
+12 -4
net/sched/cls_api.c
··· 215 215 216 216 static void tcf_chain_destroy(struct tcf_chain *chain) 217 217 { 218 - list_del(&chain->list); 219 - tcf_chain_flush(chain); 220 - kfree(chain); 218 + /* May be already removed from the list by the previous call. */ 219 + if (!list_empty(&chain->list)) 220 + list_del_init(&chain->list); 221 + 222 + /* There might still be a reference held when we got here from 223 + * tcf_block_put. Wait for the user to drop reference before free. 224 + */ 225 + if (!chain->refcnt) 226 + kfree(chain); 221 227 } 222 228 223 229 struct tcf_chain *tcf_chain_get(struct tcf_block *block, u32 chain_index, ··· 294 288 if (!block) 295 289 return; 296 290 297 - list_for_each_entry_safe(chain, tmp, &block->chain_list, list) 291 + list_for_each_entry_safe(chain, tmp, &block->chain_list, list) { 292 + tcf_chain_flush(chain); 298 293 tcf_chain_destroy(chain); 294 + } 299 295 kfree(block); 300 296 } 301 297 EXPORT_SYMBOL(tcf_block_put);
+3 -3
net/sched/sch_api.c
··· 836 836 837 837 old = dev_graft_qdisc(dev_queue, new); 838 838 if (new && i > 0) 839 - refcount_inc(&new->refcnt); 839 + qdisc_refcount_inc(new); 840 840 841 841 if (!ingress) 842 842 qdisc_destroy(old); ··· 847 847 notify_and_destroy(net, skb, n, classid, 848 848 dev->qdisc, new); 849 849 if (new && !new->ops->attach) 850 - refcount_inc(&new->refcnt); 850 + qdisc_refcount_inc(new); 851 851 dev->qdisc = new ? : &noop_qdisc; 852 852 853 853 if (new && new->ops->attach) ··· 1256 1256 if (q == p || 1257 1257 (p && check_loop(q, p, 0))) 1258 1258 return -ELOOP; 1259 - refcount_inc(&q->refcnt); 1259 + qdisc_refcount_inc(q); 1260 1260 goto graft; 1261 1261 } else { 1262 1262 if (!q)
+7 -3
net/sched/sch_cbq.c
··· 1139 1139 struct tc_ratespec *r; 1140 1140 int err; 1141 1141 1142 + qdisc_watchdog_init(&q->watchdog, sch); 1143 + hrtimer_init(&q->delay_timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS_PINNED); 1144 + q->delay_timer.function = cbq_undelay; 1145 + 1146 + if (!opt) 1147 + return -EINVAL; 1148 + 1142 1149 err = nla_parse_nested(tb, TCA_CBQ_MAX, opt, cbq_policy, NULL); 1143 1150 if (err < 0) 1144 1151 return err; ··· 1184 1177 q->link.avpkt = q->link.allot/2; 1185 1178 q->link.minidle = -0x7FFFFFFF; 1186 1179 1187 - qdisc_watchdog_init(&q->watchdog, sch); 1188 - hrtimer_init(&q->delay_timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS_PINNED); 1189 - q->delay_timer.function = cbq_undelay; 1190 1180 q->toplevel = TC_CBQ_MAXLEVEL; 1191 1181 q->now = psched_get_time(); 1192 1182
+1 -3
net/sched/sch_fq_codel.c
··· 491 491 if (!q->flows) 492 492 return -ENOMEM; 493 493 q->backlogs = kvzalloc(q->flows_cnt * sizeof(u32), GFP_KERNEL); 494 - if (!q->backlogs) { 495 - kvfree(q->flows); 494 + if (!q->backlogs) 496 495 return -ENOMEM; 497 - } 498 496 for (i = 0; i < q->flows_cnt; i++) { 499 497 struct fq_codel_flow *flow = q->flows + i; 500 498
+1 -1
net/sched/sch_generic.c
··· 785 785 dev->priv_flags & IFF_NO_QUEUE) { 786 786 netdev_for_each_tx_queue(dev, attach_one_default_qdisc, NULL); 787 787 dev->qdisc = txq->qdisc_sleeping; 788 - refcount_inc(&dev->qdisc->refcnt); 788 + qdisc_refcount_inc(dev->qdisc); 789 789 } else { 790 790 qdisc = qdisc_create_dflt(txq, &mq_qdisc_ops, TC_H_ROOT); 791 791 if (qdisc) {
+3 -7
net/sched/sch_hfsc.c
··· 1418 1418 struct tc_hfsc_qopt *qopt; 1419 1419 int err; 1420 1420 1421 + qdisc_watchdog_init(&q->watchdog, sch); 1422 + 1421 1423 if (opt == NULL || nla_len(opt) < sizeof(*qopt)) 1422 1424 return -EINVAL; 1423 1425 qopt = nla_data(opt); ··· 1432 1430 1433 1431 err = tcf_block_get(&q->root.block, &q->root.filter_list); 1434 1432 if (err) 1435 - goto err_tcf; 1433 + return err; 1436 1434 1437 1435 q->root.cl_common.classid = sch->handle; 1438 1436 q->root.refcnt = 1; ··· 1450 1448 qdisc_class_hash_insert(&q->clhash, &q->root.cl_common); 1451 1449 qdisc_class_hash_grow(sch, &q->clhash); 1452 1450 1453 - qdisc_watchdog_init(&q->watchdog, sch); 1454 - 1455 1451 return 0; 1456 - 1457 - err_tcf: 1458 - qdisc_class_hash_destroy(&q->clhash); 1459 - return err; 1460 1452 } 1461 1453 1462 1454 static int
+3
net/sched/sch_hhf.c
··· 477 477 kvfree(q->hhf_valid_bits[i]); 478 478 } 479 479 480 + if (!q->hh_flows) 481 + return; 482 + 480 483 for (i = 0; i < HH_FLOWS_CNT; i++) { 481 484 struct hh_flow_state *flow, *next; 482 485 struct list_head *head = &q->hh_flows[i];
+3 -2
net/sched/sch_htb.c
··· 1017 1017 int err; 1018 1018 int i; 1019 1019 1020 + qdisc_watchdog_init(&q->watchdog, sch); 1021 + INIT_WORK(&q->work, htb_work_func); 1022 + 1020 1023 if (!opt) 1021 1024 return -EINVAL; 1022 1025 ··· 1044 1041 for (i = 0; i < TC_HTB_NUMPRIO; i++) 1045 1042 INIT_LIST_HEAD(q->drops + i); 1046 1043 1047 - qdisc_watchdog_init(&q->watchdog, sch); 1048 - INIT_WORK(&q->work, htb_work_func); 1049 1044 qdisc_skb_head_init(&q->direct_queue); 1050 1045 1051 1046 if (tb[TCA_HTB_DIRECT_QLEN])
+1 -6
net/sched/sch_multiq.c
··· 257 257 for (i = 0; i < q->max_bands; i++) 258 258 q->queues[i] = &noop_qdisc; 259 259 260 - err = multiq_tune(sch, opt); 261 - 262 - if (err) 263 - kfree(q->queues); 264 - 265 - return err; 260 + return multiq_tune(sch, opt); 266 261 } 267 262 268 263 static int multiq_dump(struct Qdisc *sch, struct sk_buff *skb)
+2 -2
net/sched/sch_netem.c
··· 933 933 struct netem_sched_data *q = qdisc_priv(sch); 934 934 int ret; 935 935 936 + qdisc_watchdog_init(&q->watchdog, sch); 937 + 936 938 if (!opt) 937 939 return -EINVAL; 938 - 939 - qdisc_watchdog_init(&q->watchdog, sch); 940 940 941 941 q->loss_model = CLG_RANDOM; 942 942 ret = netem_change(sch, opt);
+3 -3
net/sched/sch_sfq.c
··· 716 716 int i; 717 717 int err; 718 718 719 + setup_deferrable_timer(&q->perturb_timer, sfq_perturbation, 720 + (unsigned long)sch); 721 + 719 722 err = tcf_block_get(&q->block, &q->filter_list); 720 723 if (err) 721 724 return err; 722 - 723 - setup_deferrable_timer(&q->perturb_timer, sfq_perturbation, 724 - (unsigned long)sch); 725 725 726 726 for (i = 0; i < SFQ_MAX_DEPTH + 1; i++) { 727 727 q->dep[i].next = i + SFQ_MAX_FLOWS;
+3 -2
net/sched/sch_tbf.c
··· 425 425 { 426 426 struct tbf_sched_data *q = qdisc_priv(sch); 427 427 428 + qdisc_watchdog_init(&q->watchdog, sch); 429 + q->qdisc = &noop_qdisc; 430 + 428 431 if (opt == NULL) 429 432 return -EINVAL; 430 433 431 434 q->t_c = ktime_get_ns(); 432 - qdisc_watchdog_init(&q->watchdog, sch); 433 - q->qdisc = &noop_qdisc; 434 435 435 436 return tbf_change(sch, opt); 436 437 }
+5 -2
net/sctp/sctp_diag.c
··· 70 70 71 71 info = nla_data(attr); 72 72 list_for_each_entry_rcu(laddr, address_list, list) { 73 - memcpy(info, &laddr->a, addrlen); 73 + memcpy(info, &laddr->a, sizeof(laddr->a)); 74 + memset(info + sizeof(laddr->a), 0, addrlen - sizeof(laddr->a)); 74 75 info += addrlen; 75 76 } 76 77 ··· 94 93 info = nla_data(attr); 95 94 list_for_each_entry(from, &asoc->peer.transport_addr_list, 96 95 transports) { 97 - memcpy(info, &from->ipaddr, addrlen); 96 + memcpy(info, &from->ipaddr, sizeof(from->ipaddr)); 97 + memset(info + sizeof(from->ipaddr), 0, 98 + addrlen - sizeof(from->ipaddr)); 98 99 info += addrlen; 99 100 } 100 101
+1 -2
net/sctp/socket.c
··· 4538 4538 info->sctpi_ictrlchunks = asoc->stats.ictrlchunks; 4539 4539 4540 4540 prim = asoc->peer.primary_path; 4541 - memcpy(&info->sctpi_p_address, &prim->ipaddr, 4542 - sizeof(struct sockaddr_storage)); 4541 + memcpy(&info->sctpi_p_address, &prim->ipaddr, sizeof(prim->ipaddr)); 4543 4542 info->sctpi_p_state = prim->state; 4544 4543 info->sctpi_p_cwnd = prim->cwnd; 4545 4544 info->sctpi_p_srtt = prim->srtt;
+11 -15
net/tipc/bearer.c
··· 65 65 } 66 66 67 67 static void bearer_disable(struct net *net, struct tipc_bearer *b); 68 + static int tipc_l2_rcv_msg(struct sk_buff *skb, struct net_device *dev, 69 + struct packet_type *pt, struct net_device *orig_dev); 68 70 69 71 /** 70 72 * tipc_media_find - locates specified media object by name ··· 430 428 431 429 /* Associate TIPC bearer with L2 bearer */ 432 430 rcu_assign_pointer(b->media_ptr, dev); 431 + b->pt.dev = dev; 432 + b->pt.type = htons(ETH_P_TIPC); 433 + b->pt.func = tipc_l2_rcv_msg; 434 + dev_add_pack(&b->pt); 433 435 memset(&b->bcast_addr, 0, sizeof(b->bcast_addr)); 434 436 memcpy(b->bcast_addr.value, dev->broadcast, b->media->hwaddr_len); 435 437 b->bcast_addr.media_id = b->media->type_id; ··· 453 447 struct net_device *dev; 454 448 455 449 dev = (struct net_device *)rtnl_dereference(b->media_ptr); 450 + dev_remove_pack(&b->pt); 456 451 RCU_INIT_POINTER(dev->tipc_ptr, NULL); 457 452 synchronize_net(); 458 453 dev_put(dev); ··· 601 594 struct tipc_bearer *b; 602 595 603 596 rcu_read_lock(); 604 - b = rcu_dereference_rtnl(dev->tipc_ptr); 597 + b = rcu_dereference_rtnl(dev->tipc_ptr) ?: 598 + rcu_dereference_rtnl(orig_dev->tipc_ptr); 605 599 if (likely(b && test_bit(0, &b->up) && 606 600 (skb->pkt_type <= PACKET_MULTICAST))) { 607 601 skb->next = NULL; 608 - tipc_rcv(dev_net(dev), skb, b); 602 + tipc_rcv(dev_net(b->pt.dev), skb, b); 609 603 rcu_read_unlock(); 610 604 return NET_RX_SUCCESS; 611 605 } ··· 667 659 return NOTIFY_OK; 668 660 } 669 661 670 - static struct packet_type tipc_packet_type __read_mostly = { 671 - .type = htons(ETH_P_TIPC), 672 - .func = tipc_l2_rcv_msg, 673 - }; 674 - 675 662 static struct notifier_block notifier = { 676 663 .notifier_call = tipc_l2_device_event, 677 664 .priority = 0, ··· 674 671 675 672 int tipc_bearer_setup(void) 676 673 { 677 - int err; 678 - 679 - err = register_netdevice_notifier(&notifier); 680 - if (err) 681 - return err; 682 - dev_add_pack(&tipc_packet_type); 683 - return 0; 674 + return register_netdevice_notifier(&notifier); 684 675 } 685 676 686 677 void tipc_bearer_cleanup(void) 687 678 { 688 679 unregister_netdevice_notifier(&notifier); 689 - dev_remove_pack(&tipc_packet_type); 690 680 } 691 681 692 682 void tipc_bearer_stop(struct net *net)
+2
net/tipc/bearer.h
··· 131 131 * @name: bearer name (format = media:interface) 132 132 * @media: ptr to media structure associated with bearer 133 133 * @bcast_addr: media address used in broadcasting 134 + * @pt: packet type for bearer 134 135 * @rcu: rcu struct for tipc_bearer 135 136 * @priority: default link priority for bearer 136 137 * @window: default window size for bearer ··· 152 151 char name[TIPC_MAX_BEARER_NAME]; 153 152 struct tipc_media *media; 154 153 struct tipc_media_addr bcast_addr; 154 + struct packet_type pt; 155 155 struct rcu_head rcu; 156 156 u32 priority; 157 157 u32 window;
+5 -2
net/tipc/msg.c
··· 479 479 bool tipc_msg_reverse(u32 own_node, struct sk_buff **skb, int err) 480 480 { 481 481 struct sk_buff *_skb = *skb; 482 - struct tipc_msg *hdr = buf_msg(_skb); 482 + struct tipc_msg *hdr; 483 483 struct tipc_msg ohdr; 484 - int dlen = min_t(uint, msg_data_sz(hdr), MAX_FORWARD_SIZE); 484 + int dlen; 485 485 486 486 if (skb_linearize(_skb)) 487 487 goto exit; 488 488 hdr = buf_msg(_skb); 489 + dlen = min_t(uint, msg_data_sz(hdr), MAX_FORWARD_SIZE); 489 490 if (msg_dest_droppable(hdr)) 490 491 goto exit; 491 492 if (msg_errcode(hdr)) ··· 512 511 pskb_expand_head(_skb, BUF_HEADROOM, BUF_TAILROOM, GFP_ATOMIC)) 513 512 goto exit; 514 513 514 + /* reassign after skb header modifications */ 515 + hdr = buf_msg(_skb); 515 516 /* Now reverse the concerned fields */ 516 517 msg_set_errcode(hdr, err); 517 518 msg_set_non_seq(hdr, 0);
+3 -1
net/tipc/node.c
··· 1126 1126 strncpy(linkname, tipc_link_name(link), len); 1127 1127 err = 0; 1128 1128 } 1129 - exit: 1130 1129 tipc_node_read_unlock(node); 1130 + exit: 1131 1131 tipc_node_put(node); 1132 1132 return err; 1133 1133 } ··· 1557 1557 1558 1558 /* Check/update node state before receiving */ 1559 1559 if (unlikely(skb)) { 1560 + if (unlikely(skb_linearize(skb))) 1561 + goto discard; 1560 1562 tipc_node_write_lock(n); 1561 1563 if (tipc_node_check_state(n, skb, bearer_id, &xmitq)) { 1562 1564 if (le->link) {
+3 -3
net/tipc/socket.c
··· 2255 2255 2256 2256 do { 2257 2257 tsk = ERR_PTR(rhashtable_walk_start(&iter)); 2258 - if (tsk) 2259 - continue; 2258 + if (IS_ERR(tsk)) 2259 + goto walk_stop; 2260 2260 2261 2261 while ((tsk = rhashtable_walk_next(&iter)) && !IS_ERR(tsk)) { 2262 2262 spin_lock_bh(&tsk->sk.sk_lock.slock); ··· 2265 2265 msg_set_orignode(msg, tn->own_addr); 2266 2266 spin_unlock_bh(&tsk->sk.sk_lock.slock); 2267 2267 } 2268 - 2268 + walk_stop: 2269 2269 rhashtable_walk_stop(&iter); 2270 2270 } while (tsk == ERR_PTR(-EAGAIN)); 2271 2271 }
+9 -12
net/tipc/subscr.c
··· 52 52 struct list_head subscrp_list; 53 53 }; 54 54 55 - static void tipc_subscrp_delete(struct tipc_subscription *sub); 56 55 static void tipc_subscrb_put(struct tipc_subscriber *subscriber); 57 56 58 57 /** ··· 196 197 { 197 198 struct list_head *subscription_list = &subscriber->subscrp_list; 198 199 struct tipc_subscription *sub, *temp; 200 + u32 timeout; 199 201 200 202 spin_lock_bh(&subscriber->lock); 201 203 list_for_each_entry_safe(sub, temp, subscription_list, subscrp_list) { 202 204 if (s && memcmp(s, &sub->evt.s, sizeof(struct tipc_subscr))) 203 205 continue; 204 206 205 - tipc_nametbl_unsubscribe(sub); 206 - list_del(&sub->subscrp_list); 207 - tipc_subscrp_delete(sub); 207 + timeout = htohl(sub->evt.s.timeout, sub->swap); 208 + if (timeout == TIPC_WAIT_FOREVER || del_timer(&sub->timer)) { 209 + tipc_nametbl_unsubscribe(sub); 210 + list_del(&sub->subscrp_list); 211 + tipc_subscrp_put(sub); 212 + } 208 213 209 214 if (s) 210 215 break; ··· 239 236 tipc_subscrb_put(subscriber); 240 237 } 241 238 242 - static void tipc_subscrp_delete(struct tipc_subscription *sub) 243 - { 244 - u32 timeout = htohl(sub->evt.s.timeout, sub->swap); 245 - 246 - if (timeout == TIPC_WAIT_FOREVER || del_timer(&sub->timer)) 247 - tipc_subscrp_put(sub); 248 - } 249 - 250 239 static void tipc_subscrp_cancel(struct tipc_subscr *s, 251 240 struct tipc_subscriber *subscriber) 252 241 { 242 + tipc_subscrb_get(subscriber); 253 243 tipc_subscrb_subscrp_delete(subscriber, s); 244 + tipc_subscrb_put(subscriber); 254 245 } 255 246 256 247 static struct tipc_subscription *tipc_subscrp_create(struct net *net,
+6 -1
net/xfrm/xfrm_policy.c
··· 2226 2226 goto no_transform; 2227 2227 } 2228 2228 2229 - dst_hold(&xdst->u.dst); 2230 2229 route = xdst->route; 2231 2230 } 2232 2231 } ··· 3307 3308 struct xfrm_state *x_new[XFRM_MAX_DEPTH]; 3308 3309 struct xfrm_migrate *mp; 3309 3310 3311 + /* Stage 0 - sanity checks */ 3310 3312 if ((err = xfrm_migrate_check(m, num_migrate)) < 0) 3311 3313 goto out; 3314 + 3315 + if (dir >= XFRM_POLICY_MAX) { 3316 + err = -EINVAL; 3317 + goto out; 3318 + } 3312 3319 3313 3320 /* Stage 1 - find policy */ 3314 3321 if ((pol = xfrm_migrate_policy_find(sel, dir, type, net)) == NULL) {
+8
net/xfrm/xfrm_state.c
··· 1620 1620 xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n, 1621 1621 unsigned short family, struct net *net) 1622 1622 { 1623 + int i; 1623 1624 int err = 0; 1624 1625 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family); 1625 1626 if (!afinfo) ··· 1629 1628 spin_lock_bh(&net->xfrm.xfrm_state_lock); /*FIXME*/ 1630 1629 if (afinfo->tmpl_sort) 1631 1630 err = afinfo->tmpl_sort(dst, src, n); 1631 + else 1632 + for (i = 0; i < n; i++) 1633 + dst[i] = src[i]; 1632 1634 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 1633 1635 rcu_read_unlock(); 1634 1636 return err; ··· 1642 1638 xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n, 1643 1639 unsigned short family) 1644 1640 { 1641 + int i; 1645 1642 int err = 0; 1646 1643 struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family); 1647 1644 struct net *net = xs_net(*src); ··· 1653 1648 spin_lock_bh(&net->xfrm.xfrm_state_lock); 1654 1649 if (afinfo->state_sort) 1655 1650 err = afinfo->state_sort(dst, src, n); 1651 + else 1652 + for (i = 0; i < n; i++) 1653 + dst[i] = src[i]; 1656 1654 spin_unlock_bh(&net->xfrm.xfrm_state_lock); 1657 1655 rcu_read_unlock(); 1658 1656 return err;
+5 -1
net/xfrm/xfrm_user.c
··· 796 796 return -EMSGSIZE; 797 797 798 798 xuo = nla_data(attr); 799 - 799 + memset(xuo, 0, sizeof(*xuo)); 800 800 xuo->ifindex = xso->dev->ifindex; 801 801 xuo->flags = xso->flags; 802 802 ··· 1869 1869 return -EMSGSIZE; 1870 1870 1871 1871 id = nlmsg_data(nlh); 1872 + memset(&id->sa_id, 0, sizeof(id->sa_id)); 1872 1873 memcpy(&id->sa_id.daddr, &x->id.daddr, sizeof(x->id.daddr)); 1873 1874 id->sa_id.spi = x->id.spi; 1874 1875 id->sa_id.family = x->props.family; ··· 2579 2578 ue = nlmsg_data(nlh); 2580 2579 copy_to_user_state(x, &ue->state); 2581 2580 ue->hard = (c->data.hard != 0) ? 1 : 0; 2581 + /* clear the padding bytes */ 2582 + memset(&ue->hard + 1, 0, sizeof(*ue) - offsetofend(typeof(*ue), hard)); 2582 2583 2583 2584 err = xfrm_mark_put(skb, &x->mark); 2584 2585 if (err) ··· 2718 2715 struct nlattr *attr; 2719 2716 2720 2717 id = nlmsg_data(nlh); 2718 + memset(id, 0, sizeof(*id)); 2721 2719 memcpy(&id->daddr, &x->id.daddr, sizeof(id->daddr)); 2722 2720 id->spi = x->id.spi; 2723 2721 id->family = x->props.family;