tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

David writes:
"Networking

1) Fix gro_cells leak in xfrm layer, from Li RongQing.

2) BPF selftests change RLIMIT_MEMLOCK blindly, don't do that. From
Eric Dumazet.

3) AF_XDP calls synchronize_net() under RCU lock, fix from Björn
Töpel.

4) Out of bounds packet access in _decode_session6(), from Alexei
Starovoitov.

5) Several ethtool bugs, where we copy a struct into the kernel twice
and our validations of the values in the first copy can be
invalidated by the second copy due to asynchronous updates to the
memory by the user. From Wenwen Wang.

6) Missing netlink attribute validation in cls_api, from Davide
Caratti.

7) LLC SAP sockets neet to be SOCK_RCU FREE, from Cong Wang.

8) rxrpc operates on wrong kvec, from Yue Haibing.

9) A regression was introduced by the disassosciation of route
neighbour references in rt6_probe(), causing probe for
neighbourless routes to not be properly rate limited. Fix from
Sabrina Dubroca.

10) Unsafe RCU locking in tipc, from Tung Nguyen.

11) Use after free in inet6_mc_check(), from Eric Dumazet.

12) PMTU from icmp packets should update the SCTP transport pathmtu,
from Xin Long.

13) Missing peer put on error in rxrpc, from David Howells.

14) Fix pedit in nfp driver, from Pieter Jansen van Vuuren.

15) Fix overflowing shift statement in qla3xxx driver, from Nathan
Chancellor.

16) Fix Spectre v1 in ptp code, from Gustavo A. R. Silva.

17) udp6_unicast_rcv_skb() interprets udpv6_queue_rcv_skb() return
value in an inverted manner, fix from Paolo Abeni.

18) Fix missed unresolved entries in ipmr dumps, from Nikolay
Aleksandrov.

19) Fix NAPI handling under high load, we can completely miss events
when NAPI has to loop more than one time in a cycle. From Heiner
Kallweit."

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (49 commits)
ip6_tunnel: Fix encapsulation layout
tipc: fix info leak from kernel tipc_event
net: socket: fix a missing-check bug
net: sched: Fix for duplicate class dump
r8169: fix NAPI handling under high load
net: ipmr: fix unresolved entry dumps
net: mscc: ocelot: Fix comment in ocelot_vlant_wait_for_completion()
sctp: fix the data size calculation in sctp_data_size
virtio_net: avoid using netif_tx_disable() for serializing tx routine
udp6: fix encap return code for resubmitting
mlxsw: core: Fix use-after-free when flashing firmware during init
sctp: not free the new asoc when sctp_wait_for_connect returns err
sctp: fix race on sctp_id2asoc
r8169: re-enable MSI-X on RTL8168g
net: bpfilter: use get_pid_task instead of pid_task
ptp: fix Spectre v1 vulnerability
net: qla3xxx: Remove overflowing shift statement
geneve, vxlan: Don't set exceptions if skb->len < mtu
geneve, vxlan: Don't check skb_dst() twice
sctp: get pr_assoc and pr_stream all status with SCTP_PR_SCTP_ALL instead
...

Greg Kroah-Hartman 91b15613 2a966610

+253 -187
-1
MAINTAINERS
··· 10122 10122 T: git git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec.git 10123 10123 T: git git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git 10124 10124 S: Maintained 10125 - F: net/core/flow.c 10126 10125 F: net/xfrm/ 10127 10126 F: net/key/ 10128 10127 F: net/ipv4/xfrm*
+5 -2
drivers/net/ethernet/broadcom/genet/bcmmii.c
··· 321 321 phydev->advertising = phydev->supported; 322 322 323 323 /* The internal PHY has its link interrupts routed to the 324 - * Ethernet MAC ISRs 324 + * Ethernet MAC ISRs. On GENETv5 there is a hardware issue 325 + * that prevents the signaling of link UP interrupts when 326 + * the link operates at 10Mbps, so fallback to polling for 327 + * those versions of GENET. 325 328 */ 326 - if (priv->internal_phy) 329 + if (priv->internal_phy && !GENET_IS_V5(priv)) 327 330 dev->phydev->irq = PHY_IGNORE_INTERRUPT; 328 331 329 332 return 0;
+4
drivers/net/ethernet/freescale/fec.h
··· 452 452 * initialisation. 453 453 */ 454 454 #define FEC_QUIRK_MIB_CLEAR (1 << 15) 455 + /* Only i.MX25/i.MX27/i.MX28 controller supports FRBR,FRSR registers, 456 + * those FIFO receive registers are resolved in other platforms. 457 + */ 458 + #define FEC_QUIRK_HAS_FRREG (1 << 16) 455 459 456 460 struct bufdesc_prop { 457 461 int qid;
+12 -4
drivers/net/ethernet/freescale/fec_main.c
··· 91 91 .driver_data = 0, 92 92 }, { 93 93 .name = "imx25-fec", 94 - .driver_data = FEC_QUIRK_USE_GASKET | FEC_QUIRK_MIB_CLEAR, 94 + .driver_data = FEC_QUIRK_USE_GASKET | FEC_QUIRK_MIB_CLEAR | 95 + FEC_QUIRK_HAS_FRREG, 95 96 }, { 96 97 .name = "imx27-fec", 97 - .driver_data = FEC_QUIRK_MIB_CLEAR, 98 + .driver_data = FEC_QUIRK_MIB_CLEAR | FEC_QUIRK_HAS_FRREG, 98 99 }, { 99 100 .name = "imx28-fec", 100 101 .driver_data = FEC_QUIRK_ENET_MAC | FEC_QUIRK_SWAP_FRAME | 101 - FEC_QUIRK_SINGLE_MDIO | FEC_QUIRK_HAS_RACC, 102 + FEC_QUIRK_SINGLE_MDIO | FEC_QUIRK_HAS_RACC | 103 + FEC_QUIRK_HAS_FRREG, 102 104 }, { 103 105 .name = "imx6q-fec", 104 106 .driver_data = FEC_QUIRK_ENET_MAC | FEC_QUIRK_HAS_GBIT | ··· 2166 2164 memset(buf, 0, regs->len); 2167 2165 2168 2166 for (i = 0; i < ARRAY_SIZE(fec_enet_register_offset); i++) { 2169 - off = fec_enet_register_offset[i] / 4; 2167 + off = fec_enet_register_offset[i]; 2168 + 2169 + if ((off == FEC_R_BOUND || off == FEC_R_FSTART) && 2170 + !(fep->quirks & FEC_QUIRK_HAS_FRREG)) 2171 + continue; 2172 + 2173 + off >>= 2; 2170 2174 buf[off] = readl(&theregs[off]); 2171 2175 } 2172 2176 }
+5 -7
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
··· 432 432 433 433 static inline void mlx5e_fill_icosq_frag_edge(struct mlx5e_icosq *sq, 434 434 struct mlx5_wq_cyc *wq, 435 - u16 pi, u16 frag_pi) 435 + u16 pi, u16 nnops) 436 436 { 437 437 struct mlx5e_sq_wqe_info *edge_wi, *wi = &sq->db.ico_wqe[pi]; 438 - u8 nnops = mlx5_wq_cyc_get_frag_size(wq) - frag_pi; 439 438 440 439 edge_wi = wi + nnops; 441 440 ··· 453 454 struct mlx5_wq_cyc *wq = &sq->wq; 454 455 struct mlx5e_umr_wqe *umr_wqe; 455 456 u16 xlt_offset = ix << (MLX5E_LOG_ALIGNED_MPWQE_PPW - 1); 456 - u16 pi, frag_pi; 457 + u16 pi, contig_wqebbs_room; 457 458 int err; 458 459 int i; 459 460 460 461 pi = mlx5_wq_cyc_ctr2ix(wq, sq->pc); 461 - frag_pi = mlx5_wq_cyc_ctr2fragix(wq, sq->pc); 462 - 463 - if (unlikely(frag_pi + MLX5E_UMR_WQEBBS > mlx5_wq_cyc_get_frag_size(wq))) { 464 - mlx5e_fill_icosq_frag_edge(sq, wq, pi, frag_pi); 462 + contig_wqebbs_room = mlx5_wq_cyc_get_contig_wqebbs(wq, pi); 463 + if (unlikely(contig_wqebbs_room < MLX5E_UMR_WQEBBS)) { 464 + mlx5e_fill_icosq_frag_edge(sq, wq, pi, contig_wqebbs_room); 465 465 pi = mlx5_wq_cyc_ctr2ix(wq, sq->pc); 466 466 } 467 467
+11 -11
drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
··· 290 290 291 291 static inline void mlx5e_fill_sq_frag_edge(struct mlx5e_txqsq *sq, 292 292 struct mlx5_wq_cyc *wq, 293 - u16 pi, u16 frag_pi) 293 + u16 pi, u16 nnops) 294 294 { 295 295 struct mlx5e_tx_wqe_info *edge_wi, *wi = &sq->db.wqe_info[pi]; 296 - u8 nnops = mlx5_wq_cyc_get_frag_size(wq) - frag_pi; 297 296 298 297 edge_wi = wi + nnops; 299 298 ··· 347 348 struct mlx5e_tx_wqe_info *wi; 348 349 349 350 struct mlx5e_sq_stats *stats = sq->stats; 351 + u16 headlen, ihs, contig_wqebbs_room; 350 352 u16 ds_cnt, ds_cnt_inl = 0; 351 - u16 headlen, ihs, frag_pi; 352 353 u8 num_wqebbs, opcode; 353 354 u32 num_bytes; 354 355 int num_dma; ··· 385 386 } 386 387 387 388 num_wqebbs = DIV_ROUND_UP(ds_cnt, MLX5_SEND_WQEBB_NUM_DS); 388 - frag_pi = mlx5_wq_cyc_ctr2fragix(wq, sq->pc); 389 - if (unlikely(frag_pi + num_wqebbs > mlx5_wq_cyc_get_frag_size(wq))) { 390 - mlx5e_fill_sq_frag_edge(sq, wq, pi, frag_pi); 389 + contig_wqebbs_room = mlx5_wq_cyc_get_contig_wqebbs(wq, pi); 390 + if (unlikely(contig_wqebbs_room < num_wqebbs)) { 391 + mlx5e_fill_sq_frag_edge(sq, wq, pi, contig_wqebbs_room); 391 392 mlx5e_sq_fetch_wqe(sq, &wqe, &pi); 392 393 } 393 394 ··· 635 636 struct mlx5e_tx_wqe_info *wi; 636 637 637 638 struct mlx5e_sq_stats *stats = sq->stats; 638 - u16 headlen, ihs, pi, frag_pi; 639 + u16 headlen, ihs, pi, contig_wqebbs_room; 639 640 u16 ds_cnt, ds_cnt_inl = 0; 640 641 u8 num_wqebbs, opcode; 641 642 u32 num_bytes; ··· 671 672 } 672 673 673 674 num_wqebbs = DIV_ROUND_UP(ds_cnt, MLX5_SEND_WQEBB_NUM_DS); 674 - frag_pi = mlx5_wq_cyc_ctr2fragix(wq, sq->pc); 675 - if (unlikely(frag_pi + num_wqebbs > mlx5_wq_cyc_get_frag_size(wq))) { 675 + pi = mlx5_wq_cyc_ctr2ix(wq, sq->pc); 676 + contig_wqebbs_room = mlx5_wq_cyc_get_contig_wqebbs(wq, pi); 677 + if (unlikely(contig_wqebbs_room < num_wqebbs)) { 678 + mlx5e_fill_sq_frag_edge(sq, wq, pi, contig_wqebbs_room); 676 679 pi = mlx5_wq_cyc_ctr2ix(wq, sq->pc); 677 - mlx5e_fill_sq_frag_edge(sq, wq, pi, frag_pi); 678 680 } 679 681 680 - mlx5i_sq_fetch_wqe(sq, &wqe, &pi); 682 + mlx5i_sq_fetch_wqe(sq, &wqe, pi); 681 683 682 684 /* fill wqe */ 683 685 wi = &sq->db.wqe_info[pi];
+1 -1
drivers/net/ethernet/mellanox/mlx5/core/eq.c
··· 273 273 case MLX5_PFAULT_SUBTYPE_WQE: 274 274 /* WQE based event */ 275 275 pfault->type = 276 - be32_to_cpu(pf_eqe->wqe.pftype_wq) >> 24; 276 + (be32_to_cpu(pf_eqe->wqe.pftype_wq) >> 24) & 0x7; 277 277 pfault->token = 278 278 be32_to_cpu(pf_eqe->wqe.token); 279 279 pfault->wqe.wq_num =
+4 -5
drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
··· 245 245 return ERR_PTR(res); 246 246 } 247 247 248 - /* Context will be freed by wait func after completion */ 248 + /* Context should be freed by the caller after completion. */ 249 249 return context; 250 250 } 251 251 ··· 418 418 cmd.cmd = htonl(MLX5_FPGA_IPSEC_CMD_OP_SET_CAP); 419 419 cmd.flags = htonl(flags); 420 420 context = mlx5_fpga_ipsec_cmd_exec(mdev, &cmd, sizeof(cmd)); 421 - if (IS_ERR(context)) { 422 - err = PTR_ERR(context); 423 - goto out; 424 - } 421 + if (IS_ERR(context)) 422 + return PTR_ERR(context); 425 423 426 424 err = mlx5_fpga_ipsec_cmd_wait(context); 427 425 if (err) ··· 433 435 } 434 436 435 437 out: 438 + kfree(context); 436 439 return err; 437 440 } 438 441
+2 -3
drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.h
··· 109 109 110 110 static inline void mlx5i_sq_fetch_wqe(struct mlx5e_txqsq *sq, 111 111 struct mlx5i_tx_wqe **wqe, 112 - u16 *pi) 112 + u16 pi) 113 113 { 114 114 struct mlx5_wq_cyc *wq = &sq->wq; 115 115 116 - *pi = mlx5_wq_cyc_ctr2ix(wq, sq->pc); 117 - *wqe = mlx5_wq_cyc_get_wqe(wq, *pi); 116 + *wqe = mlx5_wq_cyc_get_wqe(wq, pi); 118 117 memset(*wqe, 0, sizeof(**wqe)); 119 118 } 120 119
-5
drivers/net/ethernet/mellanox/mlx5/core/wq.c
··· 39 39 return (u32)wq->fbc.sz_m1 + 1; 40 40 } 41 41 42 - u16 mlx5_wq_cyc_get_frag_size(struct mlx5_wq_cyc *wq) 43 - { 44 - return wq->fbc.frag_sz_m1 + 1; 45 - } 46 - 47 42 u32 mlx5_cqwq_get_size(struct mlx5_cqwq *wq) 48 43 { 49 44 return wq->fbc.sz_m1 + 1;
+5 -6
drivers/net/ethernet/mellanox/mlx5/core/wq.h
··· 80 80 void *wqc, struct mlx5_wq_cyc *wq, 81 81 struct mlx5_wq_ctrl *wq_ctrl); 82 82 u32 mlx5_wq_cyc_get_size(struct mlx5_wq_cyc *wq); 83 - u16 mlx5_wq_cyc_get_frag_size(struct mlx5_wq_cyc *wq); 84 83 85 84 int mlx5_wq_qp_create(struct mlx5_core_dev *mdev, struct mlx5_wq_param *param, 86 85 void *qpc, struct mlx5_wq_qp *wq, ··· 139 140 return ctr & wq->fbc.sz_m1; 140 141 } 141 142 142 - static inline u16 mlx5_wq_cyc_ctr2fragix(struct mlx5_wq_cyc *wq, u16 ctr) 143 - { 144 - return ctr & wq->fbc.frag_sz_m1; 145 - } 146 - 147 143 static inline u16 mlx5_wq_cyc_get_head(struct mlx5_wq_cyc *wq) 148 144 { 149 145 return mlx5_wq_cyc_ctr2ix(wq, wq->wqe_ctr); ··· 152 158 static inline void *mlx5_wq_cyc_get_wqe(struct mlx5_wq_cyc *wq, u16 ix) 153 159 { 154 160 return mlx5_frag_buf_get_wqe(&wq->fbc, ix); 161 + } 162 + 163 + static inline u16 mlx5_wq_cyc_get_contig_wqebbs(struct mlx5_wq_cyc *wq, u16 ix) 164 + { 165 + return mlx5_frag_buf_get_idx_last_contig_stride(&wq->fbc, ix) - ix + 1; 155 166 } 156 167 157 168 static inline int mlx5_wq_cyc_cc_bigger(u16 cc1, u16 cc2)
+2
drivers/net/ethernet/mellanox/mlxsw/core.c
··· 1055 1055 err_driver_init: 1056 1056 mlxsw_thermal_fini(mlxsw_core->thermal); 1057 1057 err_thermal_init: 1058 + mlxsw_hwmon_fini(mlxsw_core->hwmon); 1058 1059 err_hwmon_init: 1059 1060 if (!reload) 1060 1061 devlink_unregister(devlink); ··· 1089 1088 if (mlxsw_core->driver->fini) 1090 1089 mlxsw_core->driver->fini(mlxsw_core); 1091 1090 mlxsw_thermal_fini(mlxsw_core->thermal); 1091 + mlxsw_hwmon_fini(mlxsw_core->hwmon); 1092 1092 if (!reload) 1093 1093 devlink_unregister(devlink); 1094 1094 mlxsw_emad_fini(mlxsw_core);
+4
drivers/net/ethernet/mellanox/mlxsw/core.h
··· 359 359 return 0; 360 360 } 361 361 362 + static inline void mlxsw_hwmon_fini(struct mlxsw_hwmon *mlxsw_hwmon) 363 + { 364 + } 365 + 362 366 #endif 363 367 364 368 struct mlxsw_thermal;
+11 -6
drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c
··· 303 303 struct device *hwmon_dev; 304 304 int err; 305 305 306 - mlxsw_hwmon = devm_kzalloc(mlxsw_bus_info->dev, sizeof(*mlxsw_hwmon), 307 - GFP_KERNEL); 306 + mlxsw_hwmon = kzalloc(sizeof(*mlxsw_hwmon), GFP_KERNEL); 308 307 if (!mlxsw_hwmon) 309 308 return -ENOMEM; 310 309 mlxsw_hwmon->core = mlxsw_core; ··· 320 321 mlxsw_hwmon->groups[0] = &mlxsw_hwmon->group; 321 322 mlxsw_hwmon->group.attrs = mlxsw_hwmon->attrs; 322 323 323 - hwmon_dev = devm_hwmon_device_register_with_groups(mlxsw_bus_info->dev, 324 - "mlxsw", 325 - mlxsw_hwmon, 326 - mlxsw_hwmon->groups); 324 + hwmon_dev = hwmon_device_register_with_groups(mlxsw_bus_info->dev, 325 + "mlxsw", mlxsw_hwmon, 326 + mlxsw_hwmon->groups); 327 327 if (IS_ERR(hwmon_dev)) { 328 328 err = PTR_ERR(hwmon_dev); 329 329 goto err_hwmon_register; ··· 335 337 err_hwmon_register: 336 338 err_fans_init: 337 339 err_temp_init: 340 + kfree(mlxsw_hwmon); 338 341 return err; 342 + } 343 + 344 + void mlxsw_hwmon_fini(struct mlxsw_hwmon *mlxsw_hwmon) 345 + { 346 + hwmon_device_unregister(mlxsw_hwmon->hwmon_dev); 347 + kfree(mlxsw_hwmon); 339 348 }
+3 -3
drivers/net/ethernet/mscc/ocelot.c
··· 133 133 { 134 134 unsigned int val, timeout = 10; 135 135 136 - /* Wait for the issued mac table command to be completed, or timeout. 137 - * When the command read from ANA_TABLES_MACACCESS is 138 - * MACACCESS_CMD_IDLE, the issued command completed successfully. 136 + /* Wait for the issued vlan table command to be completed, or timeout. 137 + * When the command read from ANA_TABLES_VLANACCESS is 138 + * VLANACCESS_CMD_IDLE, the issued command completed successfully. 139 139 */ 140 140 do { 141 141 val = ocelot_read(ocelot, ANA_TABLES_VLANACCESS);
+33 -18
drivers/net/ethernet/netronome/nfp/flower/action.c
··· 429 429 430 430 switch (off) { 431 431 case offsetof(struct iphdr, daddr): 432 - set_ip_addr->ipv4_dst_mask = mask; 433 - set_ip_addr->ipv4_dst = exact; 432 + set_ip_addr->ipv4_dst_mask |= mask; 433 + set_ip_addr->ipv4_dst &= ~mask; 434 + set_ip_addr->ipv4_dst |= exact & mask; 434 435 break; 435 436 case offsetof(struct iphdr, saddr): 436 - set_ip_addr->ipv4_src_mask = mask; 437 - set_ip_addr->ipv4_src = exact; 437 + set_ip_addr->ipv4_src_mask |= mask; 438 + set_ip_addr->ipv4_src &= ~mask; 439 + set_ip_addr->ipv4_src |= exact & mask; 438 440 break; 439 441 default: 440 442 return -EOPNOTSUPP; ··· 450 448 } 451 449 452 450 static void 453 - nfp_fl_set_ip6_helper(int opcode_tag, int idx, __be32 exact, __be32 mask, 451 + nfp_fl_set_ip6_helper(int opcode_tag, u8 word, __be32 exact, __be32 mask, 454 452 struct nfp_fl_set_ipv6_addr *ip6) 455 453 { 456 - ip6->ipv6[idx % 4].mask = mask; 457 - ip6->ipv6[idx % 4].exact = exact; 454 + ip6->ipv6[word].mask |= mask; 455 + ip6->ipv6[word].exact &= ~mask; 456 + ip6->ipv6[word].exact |= exact & mask; 458 457 459 458 ip6->reserved = cpu_to_be16(0); 460 459 ip6->head.jump_id = opcode_tag; ··· 468 465 struct nfp_fl_set_ipv6_addr *ip_src) 469 466 { 470 467 __be32 exact, mask; 468 + u8 word; 471 469 472 470 /* We are expecting tcf_pedit to return a big endian value */ 473 471 mask = (__force __be32)~tcf_pedit_mask(action, idx); ··· 477 473 if (exact & ~mask) 478 474 return -EOPNOTSUPP; 479 475 480 - if (off < offsetof(struct ipv6hdr, saddr)) 476 + if (off < offsetof(struct ipv6hdr, saddr)) { 481 477 return -EOPNOTSUPP; 482 - else if (off < offsetof(struct ipv6hdr, daddr)) 483 - nfp_fl_set_ip6_helper(NFP_FL_ACTION_OPCODE_SET_IPV6_SRC, idx, 478 + } else if (off < offsetof(struct ipv6hdr, daddr)) { 479 + word = (off - offsetof(struct ipv6hdr, saddr)) / sizeof(exact); 480 + nfp_fl_set_ip6_helper(NFP_FL_ACTION_OPCODE_SET_IPV6_SRC, word, 484 481 exact, mask, ip_src); 485 - else if (off < offsetof(struct ipv6hdr, daddr) + 486 - sizeof(struct in6_addr)) 487 - nfp_fl_set_ip6_helper(NFP_FL_ACTION_OPCODE_SET_IPV6_DST, idx, 482 + } else if (off < offsetof(struct ipv6hdr, daddr) + 483 + sizeof(struct in6_addr)) { 484 + word = (off - offsetof(struct ipv6hdr, daddr)) / sizeof(exact); 485 + nfp_fl_set_ip6_helper(NFP_FL_ACTION_OPCODE_SET_IPV6_DST, word, 488 486 exact, mask, ip_dst); 489 - else 487 + } else { 490 488 return -EOPNOTSUPP; 489 + } 491 490 492 491 return 0; 493 492 } ··· 548 541 struct nfp_fl_set_eth set_eth; 549 542 enum pedit_header_type htype; 550 543 int idx, nkeys, err; 551 - size_t act_size; 544 + size_t act_size = 0; 552 545 u32 offset, cmd; 553 546 u8 ip_proto = 0; 554 547 ··· 606 599 act_size = sizeof(set_eth); 607 600 memcpy(nfp_action, &set_eth, act_size); 608 601 *a_len += act_size; 609 - } else if (set_ip_addr.head.len_lw) { 602 + } 603 + if (set_ip_addr.head.len_lw) { 604 + nfp_action += act_size; 610 605 act_size = sizeof(set_ip_addr); 611 606 memcpy(nfp_action, &set_ip_addr, act_size); 612 607 *a_len += act_size; ··· 616 607 /* Hardware will automatically fix IPv4 and TCP/UDP checksum. */ 617 608 *csum_updated |= TCA_CSUM_UPDATE_FLAG_IPV4HDR | 618 609 nfp_fl_csum_l4_to_flag(ip_proto); 619 - } else if (set_ip6_dst.head.len_lw && set_ip6_src.head.len_lw) { 610 + } 611 + if (set_ip6_dst.head.len_lw && set_ip6_src.head.len_lw) { 620 612 /* TC compiles set src and dst IPv6 address as a single action, 621 613 * the hardware requires this to be 2 separate actions. 622 614 */ 615 + nfp_action += act_size; 623 616 act_size = sizeof(set_ip6_src); 624 617 memcpy(nfp_action, &set_ip6_src, act_size); 625 618 *a_len += act_size; ··· 634 623 /* Hardware will automatically fix TCP/UDP checksum. */ 635 624 *csum_updated |= nfp_fl_csum_l4_to_flag(ip_proto); 636 625 } else if (set_ip6_dst.head.len_lw) { 626 + nfp_action += act_size; 637 627 act_size = sizeof(set_ip6_dst); 638 628 memcpy(nfp_action, &set_ip6_dst, act_size); 639 629 *a_len += act_size; ··· 642 630 /* Hardware will automatically fix TCP/UDP checksum. */ 643 631 *csum_updated |= nfp_fl_csum_l4_to_flag(ip_proto); 644 632 } else if (set_ip6_src.head.len_lw) { 633 + nfp_action += act_size; 645 634 act_size = sizeof(set_ip6_src); 646 635 memcpy(nfp_action, &set_ip6_src, act_size); 647 636 *a_len += act_size; 648 637 649 638 /* Hardware will automatically fix TCP/UDP checksum. */ 650 639 *csum_updated |= nfp_fl_csum_l4_to_flag(ip_proto); 651 - } else if (set_tport.head.len_lw) { 640 + } 641 + if (set_tport.head.len_lw) { 642 + nfp_action += act_size; 652 643 act_size = sizeof(set_tport); 653 644 memcpy(nfp_action, &set_tport, act_size); 654 645 *a_len += act_size;
+1 -1
drivers/net/ethernet/qlogic/qed/qed_int.c
··· 228 228 attn_master_to_str(GET_FIELD(tmp, QED_GRC_ATTENTION_MASTER)), 229 229 GET_FIELD(tmp2, QED_GRC_ATTENTION_PF), 230 230 (GET_FIELD(tmp2, QED_GRC_ATTENTION_PRIV) == 231 - QED_GRC_ATTENTION_PRIV_VF) ? "VF" : "(Ireelevant)", 231 + QED_GRC_ATTENTION_PRIV_VF) ? "VF" : "(Irrelevant)", 232 232 GET_FIELD(tmp2, QED_GRC_ATTENTION_VF)); 233 233 234 234 out:
-2
drivers/net/ethernet/qlogic/qla3xxx.c
··· 380 380 381 381 qdev->eeprom_cmd_data = AUBURN_EEPROM_CS_1; 382 382 ql_write_nvram_reg(qdev, spir, ISP_NVRAM_MASK | qdev->eeprom_cmd_data); 383 - ql_write_nvram_reg(qdev, spir, 384 - ((ISP_NVRAM_MASK << 16) | qdev->eeprom_cmd_data)); 385 383 } 386 384 387 385 /*
+5 -15
drivers/net/ethernet/realtek/r8169.c
··· 6549 6549 struct rtl8169_private *tp = container_of(napi, struct rtl8169_private, napi); 6550 6550 struct net_device *dev = tp->dev; 6551 6551 u16 enable_mask = RTL_EVENT_NAPI | tp->event_slow; 6552 - int work_done= 0; 6552 + int work_done; 6553 6553 u16 status; 6554 6554 6555 6555 status = rtl_get_events(tp); 6556 6556 rtl_ack_events(tp, status & ~tp->event_slow); 6557 6557 6558 - if (status & RTL_EVENT_NAPI_RX) 6559 - work_done = rtl_rx(dev, tp, (u32) budget); 6558 + work_done = rtl_rx(dev, tp, (u32) budget); 6560 6559 6561 - if (status & RTL_EVENT_NAPI_TX) 6562 - rtl_tx(dev, tp); 6560 + rtl_tx(dev, tp); 6563 6561 6564 6562 if (status & tp->event_slow) { 6565 6563 enable_mask &= ~tp->event_slow; ··· 7091 7093 { 7092 7094 unsigned int flags; 7093 7095 7094 - switch (tp->mac_version) { 7095 - case RTL_GIGA_MAC_VER_01 ... RTL_GIGA_MAC_VER_06: 7096 + if (tp->mac_version <= RTL_GIGA_MAC_VER_06) { 7096 7097 RTL_W8(tp, Cfg9346, Cfg9346_Unlock); 7097 7098 RTL_W8(tp, Config2, RTL_R8(tp, Config2) & ~MSIEnable); 7098 7099 RTL_W8(tp, Cfg9346, Cfg9346_Lock); 7099 7100 flags = PCI_IRQ_LEGACY; 7100 - break; 7101 - case RTL_GIGA_MAC_VER_39 ... RTL_GIGA_MAC_VER_40: 7102 - /* This version was reported to have issues with resume 7103 - * from suspend when using MSI-X 7104 - */ 7105 - flags = PCI_IRQ_LEGACY | PCI_IRQ_MSI; 7106 - break; 7107 - default: 7101 + } else { 7108 7102 flags = PCI_IRQ_ALL_TYPES; 7109 7103 } 7110 7104
+3 -11
drivers/net/geneve.c
··· 830 830 if (IS_ERR(rt)) 831 831 return PTR_ERR(rt); 832 832 833 - if (skb_dst(skb)) { 834 - int mtu = dst_mtu(&rt->dst) - GENEVE_IPV4_HLEN - 835 - info->options_len; 836 - 837 - skb_dst_update_pmtu(skb, mtu); 838 - } 833 + skb_tunnel_check_pmtu(skb, &rt->dst, 834 + GENEVE_IPV4_HLEN + info->options_len); 839 835 840 836 sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true); 841 837 if (geneve->collect_md) { ··· 872 876 if (IS_ERR(dst)) 873 877 return PTR_ERR(dst); 874 878 875 - if (skb_dst(skb)) { 876 - int mtu = dst_mtu(dst) - GENEVE_IPV6_HLEN - info->options_len; 877 - 878 - skb_dst_update_pmtu(skb, mtu); 879 - } 879 + skb_tunnel_check_pmtu(skb, dst, GENEVE_IPV6_HLEN + info->options_len); 880 880 881 881 sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true); 882 882 if (geneve->collect_md) {
+4 -1
drivers/net/virtio_net.c
··· 2218 2218 /* Make sure no work handler is accessing the device */ 2219 2219 flush_work(&vi->config_work); 2220 2220 2221 + netif_tx_lock_bh(vi->dev); 2221 2222 netif_device_detach(vi->dev); 2222 - netif_tx_disable(vi->dev); 2223 + netif_tx_unlock_bh(vi->dev); 2223 2224 cancel_delayed_work_sync(&vi->refill); 2224 2225 2225 2226 if (netif_running(vi->dev)) { ··· 2256 2255 } 2257 2256 } 2258 2257 2258 + netif_tx_lock_bh(vi->dev); 2259 2259 netif_device_attach(vi->dev); 2260 + netif_tx_unlock_bh(vi->dev); 2260 2261 return err; 2261 2262 } 2262 2263
+2 -10
drivers/net/vxlan.c
··· 2194 2194 } 2195 2195 2196 2196 ndst = &rt->dst; 2197 - if (skb_dst(skb)) { 2198 - int mtu = dst_mtu(ndst) - VXLAN_HEADROOM; 2199 - 2200 - skb_dst_update_pmtu(skb, mtu); 2201 - } 2197 + skb_tunnel_check_pmtu(skb, ndst, VXLAN_HEADROOM); 2202 2198 2203 2199 tos = ip_tunnel_ecn_encap(tos, old_iph, skb); 2204 2200 ttl = ttl ? : ip4_dst_hoplimit(&rt->dst); ··· 2231 2235 goto out_unlock; 2232 2236 } 2233 2237 2234 - if (skb_dst(skb)) { 2235 - int mtu = dst_mtu(ndst) - VXLAN6_HEADROOM; 2236 - 2237 - skb_dst_update_pmtu(skb, mtu); 2238 - } 2238 + skb_tunnel_check_pmtu(skb, ndst, VXLAN6_HEADROOM); 2239 2239 2240 2240 tos = ip_tunnel_ecn_encap(tos, old_iph, skb); 2241 2241 ttl = ttl ? : ip6_dst_hoplimit(ndst);
+4
drivers/ptp/ptp_chardev.c
··· 24 24 #include <linux/slab.h> 25 25 #include <linux/timekeeping.h> 26 26 27 + #include <linux/nospec.h> 28 + 27 29 #include "ptp_private.h" 28 30 29 31 static int ptp_disable_pinfunc(struct ptp_clock_info *ops, ··· 250 248 err = -EINVAL; 251 249 break; 252 250 } 251 + pin_index = array_index_nospec(pin_index, ops->n_pins); 253 252 if (mutex_lock_interruptible(&ptp->pincfg_mux)) 254 253 return -ERESTARTSYS; 255 254 pd = ops->pin_config[pin_index]; ··· 269 266 err = -EINVAL; 270 267 break; 271 268 } 269 + pin_index = array_index_nospec(pin_index, ops->n_pins); 272 270 if (mutex_lock_interruptible(&ptp->pincfg_mux)) 273 271 return -ERESTARTSYS; 274 272 err = ptp_set_pinfunc(ptp, pin_index, pd.func, pd.chan);
+8
include/linux/mlx5/driver.h
··· 1032 1032 ((fbc->frag_sz_m1 & ix) << fbc->log_stride); 1033 1033 } 1034 1034 1035 + static inline u32 1036 + mlx5_frag_buf_get_idx_last_contig_stride(struct mlx5_frag_buf_ctrl *fbc, u32 ix) 1037 + { 1038 + u32 last_frag_stride_idx = (ix + fbc->strides_offset) | fbc->frag_sz_m1; 1039 + 1040 + return min_t(u32, last_frag_stride_idx - fbc->strides_offset, fbc->sz_m1); 1041 + } 1042 + 1035 1043 int mlx5_cmd_init(struct mlx5_core_dev *dev); 1036 1044 void mlx5_cmd_cleanup(struct mlx5_core_dev *dev); 1037 1045 void mlx5_cmd_use_events(struct mlx5_core_dev *dev);
+10
include/net/dst.h
··· 527 527 dst->ops->update_pmtu(dst, NULL, skb, mtu); 528 528 } 529 529 530 + static inline void skb_tunnel_check_pmtu(struct sk_buff *skb, 531 + struct dst_entry *encap_dst, 532 + int headroom) 533 + { 534 + u32 encap_mtu = dst_mtu(encap_dst); 535 + 536 + if (skb->len > encap_mtu - headroom) 537 + skb_dst_update_pmtu(skb, encap_mtu - headroom); 538 + } 539 + 530 540 #endif /* _NET_DST_H */
+4
include/net/ip6_fib.h
··· 159 159 struct rt6_info * __percpu *rt6i_pcpu; 160 160 struct rt6_exception_bucket __rcu *rt6i_exception_bucket; 161 161 162 + #ifdef CONFIG_IPV6_ROUTER_PREF 163 + unsigned long last_probe; 164 + #endif 165 + 162 166 u32 fib6_metric; 163 167 u8 fib6_protocol; 164 168 u8 fib6_type;
+1 -1
include/net/sctp/sm.h
··· 347 347 __u16 size; 348 348 349 349 size = ntohs(chunk->chunk_hdr->length); 350 - size -= sctp_datahdr_len(&chunk->asoc->stream); 350 + size -= sctp_datachk_len(&chunk->asoc->stream); 351 351 352 352 return size; 353 353 }
+2
include/net/sctp/structs.h
··· 876 876 unsigned long sackdelay; 877 877 __u32 sackfreq; 878 878 879 + atomic_t mtu_info; 880 + 879 881 /* When was the last time that we heard from this transport? We use 880 882 * this to pick new active and retran paths. 881 883 */
+1
include/uapi/linux/sctp.h
··· 301 301 SCTP_SACK_IMMEDIATELY = (1 << 3), /* SACK should be sent without delay. */ 302 302 /* 2 bits here have been used by SCTP_PR_SCTP_MASK */ 303 303 SCTP_SENDALL = (1 << 6), 304 + SCTP_PR_SCTP_ALL = (1 << 7), 304 305 SCTP_NOTIFICATION = MSG_NOTIFICATION, /* Next message is not user msg but notification. */ 305 306 SCTP_EOF = MSG_FIN, /* Initiate graceful shutdown process. */ 306 307 };
+2 -8
kernel/bpf/xskmap.c
··· 192 192 sock_hold(sock->sk); 193 193 194 194 old_xs = xchg(&m->xsk_map[i], xs); 195 - if (old_xs) { 196 - /* Make sure we've flushed everything. */ 197 - synchronize_net(); 195 + if (old_xs) 198 196 sock_put((struct sock *)old_xs); 199 - } 200 197 201 198 sockfd_put(sock); 202 199 return 0; ··· 209 212 return -EINVAL; 210 213 211 214 old_xs = xchg(&m->xsk_map[k], NULL); 212 - if (old_xs) { 213 - /* Make sure we've flushed everything. */ 214 - synchronize_net(); 215 + if (old_xs) 215 216 sock_put((struct sock *)old_xs); 216 - } 217 217 218 218 return 0; 219 219 }
+4 -2
net/bpfilter/bpfilter_kern.c
··· 23 23 24 24 if (!info->pid) 25 25 return; 26 - tsk = pid_task(find_vpid(info->pid), PIDTYPE_PID); 27 - if (tsk) 26 + tsk = get_pid_task(find_vpid(info->pid), PIDTYPE_PID); 27 + if (tsk) { 28 28 force_sig(SIGKILL, tsk); 29 + put_task_struct(tsk); 30 + } 29 31 fput(info->pipe_to_umh); 30 32 fput(info->pipe_from_umh); 31 33 info->pid = 0;
+9 -2
net/core/ethtool.c
··· 1015 1015 return -EINVAL; 1016 1016 } 1017 1017 1018 + if (info.cmd != cmd) 1019 + return -EINVAL; 1020 + 1018 1021 if (info.cmd == ETHTOOL_GRXCLSRLALL) { 1019 1022 if (info.rule_cnt > 0) { 1020 1023 if (info.rule_cnt <= KMALLOC_MAX_SIZE / sizeof(u32)) ··· 2472 2469 return ret; 2473 2470 } 2474 2471 2475 - static int ethtool_set_per_queue(struct net_device *dev, void __user *useraddr) 2472 + static int ethtool_set_per_queue(struct net_device *dev, 2473 + void __user *useraddr, u32 sub_cmd) 2476 2474 { 2477 2475 struct ethtool_per_queue_op per_queue_opt; 2478 2476 2479 2477 if (copy_from_user(&per_queue_opt, useraddr, sizeof(per_queue_opt))) 2480 2478 return -EFAULT; 2479 + 2480 + if (per_queue_opt.sub_command != sub_cmd) 2481 + return -EINVAL; 2481 2482 2482 2483 switch (per_queue_opt.sub_command) { 2483 2484 case ETHTOOL_GCOALESCE: ··· 2853 2846 rc = ethtool_get_phy_stats(dev, useraddr); 2854 2847 break; 2855 2848 case ETHTOOL_PERQUEUE: 2856 - rc = ethtool_set_per_queue(dev, useraddr); 2849 + rc = ethtool_set_per_queue(dev, useraddr, sub_cmd); 2857 2850 break; 2858 2851 case ETHTOOL_GLINKSETTINGS: 2859 2852 rc = ethtool_get_link_ksettings(dev, useraddr);
-2
net/ipv4/ipmr_base.c
··· 296 296 next_entry: 297 297 e++; 298 298 } 299 - e = 0; 300 - s_e = 0; 301 299 302 300 spin_lock_bh(lock); 303 301 list_for_each_entry(mfc, &mrt->mfc_unres_queue, list) {
+5 -5
net/ipv6/ip6_tunnel.c
··· 1184 1184 } 1185 1185 skb_dst_set(skb, dst); 1186 1186 1187 - if (encap_limit >= 0) { 1188 - init_tel_txopt(&opt, encap_limit); 1189 - ipv6_push_frag_opts(skb, &opt.ops, &proto); 1190 - } 1191 - 1192 1187 if (hop_limit == 0) { 1193 1188 if (skb->protocol == htons(ETH_P_IP)) 1194 1189 hop_limit = ip_hdr(skb)->ttl; ··· 1204 1209 err = ip6_tnl_encap(skb, t, &proto, fl6); 1205 1210 if (err) 1206 1211 return err; 1212 + 1213 + if (encap_limit >= 0) { 1214 + init_tel_txopt(&opt, encap_limit); 1215 + ipv6_push_frag_opts(skb, &opt.ops, &proto); 1216 + } 1207 1217 1208 1218 skb_push(skb, sizeof(struct ipv6hdr)); 1209 1219 skb_reset_network_header(skb);
+8 -8
net/ipv6/mcast.c
··· 2436 2436 { 2437 2437 int err; 2438 2438 2439 - /* callers have the socket lock and rtnl lock 2440 - * so no other readers or writers of iml or its sflist 2441 - */ 2439 + write_lock_bh(&iml->sflock); 2442 2440 if (!iml->sflist) { 2443 2441 /* any-source empty exclude case */ 2444 - return ip6_mc_del_src(idev, &iml->addr, iml->sfmode, 0, NULL, 0); 2442 + err = ip6_mc_del_src(idev, &iml->addr, iml->sfmode, 0, NULL, 0); 2443 + } else { 2444 + err = ip6_mc_del_src(idev, &iml->addr, iml->sfmode, 2445 + iml->sflist->sl_count, iml->sflist->sl_addr, 0); 2446 + sock_kfree_s(sk, iml->sflist, IP6_SFLSIZE(iml->sflist->sl_max)); 2447 + iml->sflist = NULL; 2445 2448 } 2446 - err = ip6_mc_del_src(idev, &iml->addr, iml->sfmode, 2447 - iml->sflist->sl_count, iml->sflist->sl_addr, 0); 2448 - sock_kfree_s(sk, iml->sflist, IP6_SFLSIZE(iml->sflist->sl_max)); 2449 - iml->sflist = NULL; 2449 + write_unlock_bh(&iml->sflock); 2450 2450 return err; 2451 2451 } 2452 2452
+6 -6
net/ipv6/route.c
··· 520 520 521 521 static void rt6_probe(struct fib6_info *rt) 522 522 { 523 - struct __rt6_probe_work *work; 523 + struct __rt6_probe_work *work = NULL; 524 524 const struct in6_addr *nh_gw; 525 525 struct neighbour *neigh; 526 526 struct net_device *dev; 527 + struct inet6_dev *idev; 527 528 528 529 /* 529 530 * Okay, this does not seem to be appropriate ··· 540 539 nh_gw = &rt->fib6_nh.nh_gw; 541 540 dev = rt->fib6_nh.nh_dev; 542 541 rcu_read_lock_bh(); 542 + idev = __in6_dev_get(dev); 543 543 neigh = __ipv6_neigh_lookup_noref(dev, nh_gw); 544 544 if (neigh) { 545 - struct inet6_dev *idev; 546 - 547 545 if (neigh->nud_state & NUD_VALID) 548 546 goto out; 549 547 550 - idev = __in6_dev_get(dev); 551 - work = NULL; 552 548 write_lock(&neigh->lock); 553 549 if (!(neigh->nud_state & NUD_VALID) && 554 550 time_after(jiffies, ··· 555 557 __neigh_set_probe_once(neigh); 556 558 } 557 559 write_unlock(&neigh->lock); 558 - } else { 560 + } else if (time_after(jiffies, rt->last_probe + 561 + idev->cnf.rtr_probe_interval)) { 559 562 work = kmalloc(sizeof(*work), GFP_ATOMIC); 560 563 } 561 564 562 565 if (work) { 566 + rt->last_probe = jiffies; 563 567 INIT_WORK(&work->work, rt6_probe_deferred); 564 568 work->target = *nh_gw; 565 569 dev_hold(dev);
+2 -4
net/ipv6/udp.c
··· 766 766 767 767 ret = udpv6_queue_rcv_skb(sk, skb); 768 768 769 - /* a return value > 0 means to resubmit the input, but 770 - * it wants the return to be -protocol, or 0 771 - */ 769 + /* a return value > 0 means to resubmit the input */ 772 770 if (ret > 0) 773 - return -ret; 771 + return ret; 774 772 return 0; 775 773 } 776 774
+2 -2
net/ipv6/xfrm6_policy.c
··· 146 146 fl6->daddr = reverse ? hdr->saddr : hdr->daddr; 147 147 fl6->saddr = reverse ? hdr->daddr : hdr->saddr; 148 148 149 - while (nh + offset + 1 < skb->data || 150 - pskb_may_pull(skb, nh + offset + 1 - skb->data)) { 149 + while (nh + offset + sizeof(*exthdr) < skb->data || 150 + pskb_may_pull(skb, nh + offset + sizeof(*exthdr) - skb->data)) { 151 151 nh = skb_network_header(skb); 152 152 exthdr = (struct ipv6_opt_hdr *)(nh + offset); 153 153
+1
net/llc/llc_conn.c
··· 734 734 llc_sk(sk)->sap = sap; 735 735 736 736 spin_lock_bh(&sap->sk_lock); 737 + sock_set_flag(sk, SOCK_RCU_FREE); 737 738 sap->sk_count++; 738 739 sk_nulls_add_node_rcu(sk, laddr_hb); 739 740 hlist_add_head(&llc->dev_hash_node, dev_hb);
+1 -1
net/rxrpc/call_accept.c
··· 337 337 { 338 338 struct rxrpc_skb_priv *sp = rxrpc_skb(skb); 339 339 struct rxrpc_connection *conn; 340 - struct rxrpc_peer *peer; 340 + struct rxrpc_peer *peer = NULL; 341 341 struct rxrpc_call *call; 342 342 343 343 _enter("");
+1 -1
net/rxrpc/local_object.c
··· 139 139 udp_sk(usk)->gro_complete = NULL; 140 140 141 141 udp_encap_enable(); 142 - #if IS_ENABLED(CONFIG_IPV6) 142 + #if IS_ENABLED(CONFIG_AF_RXRPC_IPV6) 143 143 if (local->srx.transport.family == AF_INET6) 144 144 udpv6_encap_enable(); 145 145 #endif
+2 -1
net/rxrpc/output.c
··· 572 572 whdr.flags ^= RXRPC_CLIENT_INITIATED; 573 573 whdr.flags &= RXRPC_CLIENT_INITIATED; 574 574 575 - ret = kernel_sendmsg(local->socket, &msg, iov, 2, size); 575 + ret = kernel_sendmsg(local->socket, &msg, 576 + iov, ioc, size); 576 577 if (ret < 0) 577 578 trace_rxrpc_tx_fail(local->debug_id, 0, ret, 578 579 rxrpc_tx_point_reject);
+1
net/rxrpc/peer_event.c
··· 195 195 rxrpc_store_error(peer, serr); 196 196 rcu_read_unlock(); 197 197 rxrpc_free_skb(skb, rxrpc_skb_rx_freed); 198 + rxrpc_put_peer(peer); 198 199 199 200 _leave(""); 200 201 }
+8 -5
net/sched/cls_api.c
··· 31 31 #include <net/pkt_sched.h> 32 32 #include <net/pkt_cls.h> 33 33 34 + extern const struct nla_policy rtm_tca_policy[TCA_MAX + 1]; 35 + 34 36 /* The list of all installed classifier types */ 35 37 static LIST_HEAD(tcf_proto_base); 36 38 ··· 1213 1211 replay: 1214 1212 tp_created = 0; 1215 1213 1216 - err = nlmsg_parse(n, sizeof(*t), tca, TCA_MAX, NULL, extack); 1214 + err = nlmsg_parse(n, sizeof(*t), tca, TCA_MAX, rtm_tca_policy, extack); 1217 1215 if (err < 0) 1218 1216 return err; 1219 1217 ··· 1362 1360 if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) 1363 1361 return -EPERM; 1364 1362 1365 - err = nlmsg_parse(n, sizeof(*t), tca, TCA_MAX, NULL, extack); 1363 + err = nlmsg_parse(n, sizeof(*t), tca, TCA_MAX, rtm_tca_policy, extack); 1366 1364 if (err < 0) 1367 1365 return err; 1368 1366 ··· 1477 1475 void *fh = NULL; 1478 1476 int err; 1479 1477 1480 - err = nlmsg_parse(n, sizeof(*t), tca, TCA_MAX, NULL, extack); 1478 + err = nlmsg_parse(n, sizeof(*t), tca, TCA_MAX, rtm_tca_policy, extack); 1481 1479 if (err < 0) 1482 1480 return err; 1483 1481 ··· 1840 1838 return -EPERM; 1841 1839 1842 1840 replay: 1843 - err = nlmsg_parse(n, sizeof(*t), tca, TCA_MAX, NULL, extack); 1841 + err = nlmsg_parse(n, sizeof(*t), tca, TCA_MAX, rtm_tca_policy, extack); 1844 1842 if (err < 0) 1845 1843 return err; 1846 1844 ··· 1951 1949 if (nlmsg_len(cb->nlh) < sizeof(*tcm)) 1952 1950 return skb->len; 1953 1951 1954 - err = nlmsg_parse(cb->nlh, sizeof(*tcm), tca, TCA_MAX, NULL, NULL); 1952 + err = nlmsg_parse(cb->nlh, sizeof(*tcm), tca, TCA_MAX, rtm_tca_policy, 1953 + NULL); 1955 1954 if (err) 1956 1955 return err; 1957 1956
+6 -5
net/sched/sch_api.c
··· 1307 1307 return 0; 1308 1308 } 1309 1309 1310 - /* 1311 - * Delete/get qdisc. 1312 - */ 1313 - 1314 1310 const struct nla_policy rtm_tca_policy[TCA_MAX + 1] = { 1315 1311 [TCA_KIND] = { .type = NLA_STRING }, 1316 1312 [TCA_OPTIONS] = { .type = NLA_NESTED }, ··· 1318 1322 [TCA_INGRESS_BLOCK] = { .type = NLA_U32 }, 1319 1323 [TCA_EGRESS_BLOCK] = { .type = NLA_U32 }, 1320 1324 }; 1325 + 1326 + /* 1327 + * Delete/get qdisc. 1328 + */ 1321 1329 1322 1330 static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n, 1323 1331 struct netlink_ext_ack *extack) ··· 2059 2059 2060 2060 if (tcm->tcm_parent) { 2061 2061 q = qdisc_match_from_root(root, TC_H_MAJ(tcm->tcm_parent)); 2062 - if (q && tc_dump_tclass_qdisc(q, skb, tcm, cb, t_p, s_t) < 0) 2062 + if (q && q != root && 2063 + tc_dump_tclass_qdisc(q, skb, tcm, cb, t_p, s_t) < 0) 2063 2064 return -1; 2064 2065 return 0; 2065 2066 }
+2 -1
net/sctp/associola.c
··· 1450 1450 /* Get the lowest pmtu of all the transports. */ 1451 1451 list_for_each_entry(t, &asoc->peer.transport_addr_list, transports) { 1452 1452 if (t->pmtu_pending && t->dst) { 1453 - sctp_transport_update_pmtu(t, sctp_dst_mtu(t->dst)); 1453 + sctp_transport_update_pmtu(t, 1454 + atomic_read(&t->mtu_info)); 1454 1455 t->pmtu_pending = 0; 1455 1456 } 1456 1457 if (!pmtu || (t->pathmtu < pmtu))
+1
net/sctp/input.c
··· 395 395 return; 396 396 397 397 if (sock_owned_by_user(sk)) { 398 + atomic_set(&t->mtu_info, pmtu); 398 399 asoc->pmtu_pending = 1; 399 400 t->pmtu_pending = 1; 400 401 return;
+6
net/sctp/output.c
··· 120 120 sctp_assoc_sync_pmtu(asoc); 121 121 } 122 122 123 + if (asoc->pmtu_pending) { 124 + if (asoc->param_flags & SPP_PMTUD_ENABLE) 125 + sctp_assoc_sync_pmtu(asoc); 126 + asoc->pmtu_pending = 0; 127 + } 128 + 123 129 /* If there a is a prepend chunk stick it on the list before 124 130 * any other chunks get appended. 125 131 */
+9 -8
net/sctp/socket.c
··· 271 271 272 272 spin_lock_bh(&sctp_assocs_id_lock); 273 273 asoc = (struct sctp_association *)idr_find(&sctp_assocs_id, (int)id); 274 + if (asoc && (asoc->base.sk != sk || asoc->base.dead)) 275 + asoc = NULL; 274 276 spin_unlock_bh(&sctp_assocs_id_lock); 275 - 276 - if (!asoc || (asoc->base.sk != sk) || asoc->base.dead) 277 - return NULL; 278 277 279 278 return asoc; 280 279 } ··· 1945 1946 if (sp->strm_interleave) { 1946 1947 timeo = sock_sndtimeo(sk, 0); 1947 1948 err = sctp_wait_for_connect(asoc, &timeo); 1948 - if (err) 1949 + if (err) { 1950 + err = -ESRCH; 1949 1951 goto err; 1952 + } 1950 1953 } else { 1951 1954 wait_connect = true; 1952 1955 } ··· 7101 7100 } 7102 7101 7103 7102 policy = params.sprstat_policy; 7104 - if (policy & ~SCTP_PR_SCTP_MASK) 7103 + if (!policy || (policy & ~(SCTP_PR_SCTP_MASK | SCTP_PR_SCTP_ALL))) 7105 7104 goto out; 7106 7105 7107 7106 asoc = sctp_id2assoc(sk, params.sprstat_assoc_id); 7108 7107 if (!asoc) 7109 7108 goto out; 7110 7109 7111 - if (policy == SCTP_PR_SCTP_NONE) { 7110 + if (policy & SCTP_PR_SCTP_ALL) { 7112 7111 params.sprstat_abandoned_unsent = 0; 7113 7112 params.sprstat_abandoned_sent = 0; 7114 7113 for (policy = 0; policy <= SCTP_PR_INDEX(MAX); policy++) { ··· 7160 7159 } 7161 7160 7162 7161 policy = params.sprstat_policy; 7163 - if (policy & ~SCTP_PR_SCTP_MASK) 7162 + if (!policy || (policy & ~(SCTP_PR_SCTP_MASK | SCTP_PR_SCTP_ALL))) 7164 7163 goto out; 7165 7164 7166 7165 asoc = sctp_id2assoc(sk, params.sprstat_assoc_id); ··· 7176 7175 goto out; 7177 7176 } 7178 7177 7179 - if (policy == SCTP_PR_SCTP_NONE) { 7178 + if (policy == SCTP_PR_SCTP_ALL) { 7180 7179 params.sprstat_abandoned_unsent = 0; 7181 7180 params.sprstat_abandoned_sent = 0; 7182 7181 for (policy = 0; policy <= SCTP_PR_INDEX(MAX); policy++) {
+8 -3
net/socket.c
··· 2875 2875 copy_in_user(&rxnfc->fs.ring_cookie, 2876 2876 &compat_rxnfc->fs.ring_cookie, 2877 2877 (void __user *)(&rxnfc->fs.location + 1) - 2878 - (void __user *)&rxnfc->fs.ring_cookie) || 2879 - copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt, 2880 - sizeof(rxnfc->rule_cnt))) 2878 + (void __user *)&rxnfc->fs.ring_cookie)) 2879 + return -EFAULT; 2880 + if (ethcmd == ETHTOOL_GRXCLSRLALL) { 2881 + if (put_user(rule_cnt, &rxnfc->rule_cnt)) 2882 + return -EFAULT; 2883 + } else if (copy_in_user(&rxnfc->rule_cnt, 2884 + &compat_rxnfc->rule_cnt, 2885 + sizeof(rxnfc->rule_cnt))) 2881 2886 return -EFAULT; 2882 2887 } 2883 2888
+1
net/tipc/group.c
··· 666 666 struct sk_buff *skb; 667 667 struct tipc_msg *hdr; 668 668 669 + memset(&evt, 0, sizeof(evt)); 669 670 evt.event = event; 670 671 evt.found_lower = m->instance; 671 672 evt.found_upper = m->instance;
+1
net/tipc/link.c
··· 1041 1041 if (r->last_retransm != buf_seqno(skb)) { 1042 1042 r->last_retransm = buf_seqno(skb); 1043 1043 r->stale_limit = jiffies + msecs_to_jiffies(r->tolerance); 1044 + r->stale_cnt = 0; 1044 1045 } else if (++r->stale_cnt > 99 && time_after(jiffies, r->stale_limit)) { 1045 1046 link_retransmit_failure(l, skb); 1046 1047 if (link_is_bc_sndlink(l))
+2 -2
net/tipc/name_distr.c
··· 115 115 struct sk_buff *buf; 116 116 struct distr_item *item; 117 117 118 - list_del(&publ->binding_node); 118 + list_del_rcu(&publ->binding_node); 119 119 120 120 if (publ->scope == TIPC_NODE_SCOPE) 121 121 return NULL; ··· 147 147 ITEM_SIZE) * ITEM_SIZE; 148 148 u32 msg_rem = msg_dsz; 149 149 150 - list_for_each_entry(publ, pls, binding_node) { 150 + list_for_each_entry_rcu(publ, pls, binding_node) { 151 151 /* Prepare next buffer: */ 152 152 if (!skb) { 153 153 skb = named_prepare_buf(net, PUBLICATION, msg_rem,
+2
net/xdp/xsk.c
··· 744 744 sk->sk_destruct = xsk_destruct; 745 745 sk_refcnt_debug_inc(sk); 746 746 747 + sock_set_flag(sk, SOCK_RCU_FREE); 748 + 747 749 xs = xdp_sk(sk); 748 750 mutex_init(&xs->mutex); 749 751 spin_lock_init(&xs->tx_completion_lock);
+3
net/xfrm/xfrm_interface.c
··· 116 116 117 117 static void xfrmi_dev_free(struct net_device *dev) 118 118 { 119 + struct xfrm_if *xi = netdev_priv(dev); 120 + 121 + gro_cells_destroy(&xi->gro_cells); 119 122 free_percpu(dev->tstats); 120 123 } 121 124
+4 -4
net/xfrm/xfrm_policy.c
··· 632 632 break; 633 633 } 634 634 if (newpos) 635 - hlist_add_behind(&policy->bydst, newpos); 635 + hlist_add_behind_rcu(&policy->bydst, newpos); 636 636 else 637 - hlist_add_head(&policy->bydst, chain); 637 + hlist_add_head_rcu(&policy->bydst, chain); 638 638 } 639 639 640 640 spin_unlock_bh(&net->xfrm.xfrm_policy_lock); ··· 774 774 break; 775 775 } 776 776 if (newpos) 777 - hlist_add_behind(&policy->bydst, newpos); 777 + hlist_add_behind_rcu(&policy->bydst, newpos); 778 778 else 779 - hlist_add_head(&policy->bydst, chain); 779 + hlist_add_head_rcu(&policy->bydst, chain); 780 780 __xfrm_policy_link(policy, dir); 781 781 782 782 /* After previous checking, family can either be AF_INET or AF_INET6 */
+9 -4
tools/testing/selftests/net/reuseport_bpf.c
··· 437 437 } 438 438 } 439 439 440 - static struct rlimit rlim_old, rlim_new; 440 + static struct rlimit rlim_old; 441 441 442 442 static __attribute__((constructor)) void main_ctor(void) 443 443 { 444 444 getrlimit(RLIMIT_MEMLOCK, &rlim_old); 445 - rlim_new.rlim_cur = rlim_old.rlim_cur + (1UL << 20); 446 - rlim_new.rlim_max = rlim_old.rlim_max + (1UL << 20); 447 - setrlimit(RLIMIT_MEMLOCK, &rlim_new); 445 + 446 + if (rlim_old.rlim_cur != RLIM_INFINITY) { 447 + struct rlimit rlim_new; 448 + 449 + rlim_new.rlim_cur = rlim_old.rlim_cur + (1UL << 20); 450 + rlim_new.rlim_max = rlim_old.rlim_max + (1UL << 20); 451 + setrlimit(RLIMIT_MEMLOCK, &rlim_new); 452 + } 448 453 } 449 454 450 455 static __attribute__((destructor)) void main_dtor(void)