tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:
"Hopefully the last pull request for this release. Fingers crossed:

1) Only refcount ESP stats on full sockets, from Martin Willi.

2) Missing barriers in AF_UNIX, from Al Viro.

3) RCU protection fixes in ipv6 route code, from Paolo Abeni.

4) Avoid false positives in untrusted GSO validation, from Willem de
Bruijn.

5) Forwarded mesh packets in mac80211 need more tailroom allocated,
from Felix Fietkau.

6) Use operstate consistently for linkup in team driver, from George
Wilkie.

7) ThunderX bug fixes from Vadim Lomovtsev. Mostly races between VF
and PF code paths.

8) Purge ipv6 exceptions during netdevice removal, from Paolo Abeni.

9) nfp eBPF code gen fixes from Jiong Wang.

10) bnxt_en firmware timeout fix from Michael Chan.

11) Use after free in udp/udpv6 error handlers, from Paolo Abeni.

12) Fix a race in x25_bind triggerable by syzbot, from Eric Dumazet"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (65 commits)
net: phy: realtek: Dummy IRQ calls for RTL8366RB
tcp: repaired skbs must init their tso_segs
net/x25: fix a race in x25_bind()
net: dsa: Remove documentation for port_fdb_prepare
Revert "bridge: do not add port to router list when receives query with source 0.0.0.0"
selftests: fib_tests: sleep after changing carrier. again.
net: set static variable an initial value in atl2_probe()
net: phy: marvell10g: Fix Multi-G advertisement to only advertise 10G
bpf, doc: add bpf list as secondary entry to maintainers file
udp: fix possible user after free in error handler
udpv6: fix possible user after free in error handler
fou6: fix proto error handler argument type
udpv6: add the required annotation to mib type
mdio_bus: Fix use-after-free on device_register fails
net: Set rtm_table to RT_TABLE_COMPAT for ipv6 for tables > 255
bnxt_en: Wait longer for the firmware message response to complete.
bnxt_en: Fix typo in firmware message timeout logic.
nfp: bpf: fix ALU32 high bits clearance bug
nfp: bpf: fix code-gen bug on BPF_ALU | BPF_XOR | BPF_K
Documentation: networking: switchdev: Update port parent ID section
...

Linus Torvalds c4eb1e18 e60b5f79

+569 -421
+3 -7
Documentation/networking/dsa/dsa.txt
··· 533 533 function that the driver has to call for each VLAN the given port is a member 534 534 of. A switchdev object is used to carry the VID and bridge flags. 535 535 536 - - port_fdb_prepare: bridge layer function invoked when the bridge prepares the 537 - installation of a Forwarding Database entry. If the operation is not 538 - supported, this function should return -EOPNOTSUPP to inform the bridge code 539 - to fallback to a software implementation. No hardware setup must be done in 540 - this function. See port_fdb_add for this and details. 541 - 542 536 - port_fdb_add: bridge layer function invoked when the bridge wants to install a 543 537 Forwarding Database entry, the switch hardware should be programmed with the 544 538 specified address in the specified VLAN Id in the forwarding database 545 - associated with this VLAN ID 539 + associated with this VLAN ID. If the operation is not supported, this 540 + function should return -EOPNOTSUPP to inform the bridge code to fallback to 541 + a software implementation. 546 542 547 543 Note: VLAN ID 0 corresponds to the port private database, which, in the context 548 544 of DSA, would be the its port-based VLAN, used by the associated bridge device.
+5 -5
Documentation/networking/switchdev.txt
··· 92 92 Switch ID 93 93 ^^^^^^^^^ 94 94 95 - The switchdev driver must implement the switchdev op switchdev_port_attr_get 96 - for SWITCHDEV_ATTR_ID_PORT_PARENT_ID for each port netdev, returning the same 97 - physical ID for each port of a switch. The ID must be unique between switches 98 - on the same system. The ID does not need to be unique between switches on 99 - different systems. 95 + The switchdev driver must implement the net_device operation 96 + ndo_get_port_parent_id for each port netdev, returning the same physical ID for 97 + each port of a switch. The ID must be unique between switches on the same 98 + system. The ID does not need to be unique between switches on different 99 + systems. 100 100 101 101 The switch ID is used to locate ports on a switch and to know if aggregated 102 102 ports belong to the same switch.
+14 -3
MAINTAINERS
··· 2851 2851 R: Song Liu <songliubraving@fb.com> 2852 2852 R: Yonghong Song <yhs@fb.com> 2853 2853 L: netdev@vger.kernel.org 2854 - L: linux-kernel@vger.kernel.org 2854 + L: bpf@vger.kernel.org 2855 2855 T: git git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git 2856 2856 T: git git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git 2857 2857 Q: https://patchwork.ozlabs.org/project/netdev/list/?delegate=77147 ··· 2881 2881 BPF JIT for ARM 2882 2882 M: Shubham Bansal <illusionist.neo@gmail.com> 2883 2883 L: netdev@vger.kernel.org 2884 + L: bpf@vger.kernel.org 2884 2885 S: Maintained 2885 2886 F: arch/arm/net/ 2886 2887 ··· 2890 2889 M: Alexei Starovoitov <ast@kernel.org> 2891 2890 M: Zi Shen Lim <zlim.lnx@gmail.com> 2892 2891 L: netdev@vger.kernel.org 2892 + L: bpf@vger.kernel.org 2893 2893 S: Supported 2894 2894 F: arch/arm64/net/ 2895 2895 2896 2896 BPF JIT for MIPS (32-BIT AND 64-BIT) 2897 2897 M: Paul Burton <paul.burton@mips.com> 2898 2898 L: netdev@vger.kernel.org 2899 + L: bpf@vger.kernel.org 2899 2900 S: Maintained 2900 2901 F: arch/mips/net/ 2901 2902 2902 2903 BPF JIT for NFP NICs 2903 2904 M: Jakub Kicinski <jakub.kicinski@netronome.com> 2904 2905 L: netdev@vger.kernel.org 2906 + L: bpf@vger.kernel.org 2905 2907 S: Supported 2906 2908 F: drivers/net/ethernet/netronome/nfp/bpf/ 2907 2909 ··· 2912 2908 M: Naveen N. Rao <naveen.n.rao@linux.ibm.com> 2913 2909 M: Sandipan Das <sandipan@linux.ibm.com> 2914 2910 L: netdev@vger.kernel.org 2911 + L: bpf@vger.kernel.org 2915 2912 S: Maintained 2916 2913 F: arch/powerpc/net/ 2917 2914 ··· 2920 2915 M: Martin Schwidefsky <schwidefsky@de.ibm.com> 2921 2916 M: Heiko Carstens <heiko.carstens@de.ibm.com> 2922 2917 L: netdev@vger.kernel.org 2918 + L: bpf@vger.kernel.org 2923 2919 S: Maintained 2924 2920 F: arch/s390/net/ 2925 2921 X: arch/s390/net/pnet.c ··· 2928 2922 BPF JIT for SPARC (32-BIT AND 64-BIT) 2929 2923 M: David S. Miller <davem@davemloft.net> 2930 2924 L: netdev@vger.kernel.org 2925 + L: bpf@vger.kernel.org 2931 2926 S: Maintained 2932 2927 F: arch/sparc/net/ 2933 2928 2934 2929 BPF JIT for X86 32-BIT 2935 2930 M: Wang YanQing <udknight@gmail.com> 2936 2931 L: netdev@vger.kernel.org 2932 + L: bpf@vger.kernel.org 2937 2933 S: Maintained 2938 2934 F: arch/x86/net/bpf_jit_comp32.c 2939 2935 ··· 2943 2935 M: Alexei Starovoitov <ast@kernel.org> 2944 2936 M: Daniel Borkmann <daniel@iogearbox.net> 2945 2937 L: netdev@vger.kernel.org 2938 + L: bpf@vger.kernel.org 2946 2939 S: Supported 2947 2940 F: arch/x86/net/ 2948 2941 X: arch/x86/net/bpf_jit_comp32.c ··· 3398 3389 F: drivers/media/platform/marvell-ccic/ 3399 3390 3400 3391 CAIF NETWORK LAYER 3401 - M: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no> 3402 3392 L: netdev@vger.kernel.org 3403 - S: Supported 3393 + S: Orphan 3404 3394 F: Documentation/networking/caif/ 3405 3395 F: drivers/net/caif/ 3406 3396 F: include/uapi/linux/caif/ ··· 8494 8486 M: John Fastabend <john.fastabend@gmail.com> 8495 8487 M: Daniel Borkmann <daniel@iogearbox.net> 8496 8488 L: netdev@vger.kernel.org 8489 + L: bpf@vger.kernel.org 8497 8490 S: Maintained 8498 8491 F: include/linux/skmsg.h 8499 8492 F: net/core/skmsg.c ··· 16722 16713 M: John Fastabend <john.fastabend@gmail.com> 16723 16714 L: netdev@vger.kernel.org 16724 16715 L: xdp-newbies@vger.kernel.org 16716 + L: bpf@vger.kernel.org 16725 16717 S: Supported 16726 16718 F: net/core/xdp.c 16727 16719 F: include/net/xdp.h ··· 16736 16726 M: Björn Töpel <bjorn.topel@intel.com> 16737 16727 M: Magnus Karlsson <magnus.karlsson@intel.com> 16738 16728 L: netdev@vger.kernel.org 16729 + L: bpf@vger.kernel.org 16739 16730 S: Maintained 16740 16731 F: kernel/bpf/xskmap.c 16741 16732 F: net/xdp/
+14 -21
drivers/net/bonding/bond_main.c
··· 1183 1183 } 1184 1184 } 1185 1185 1186 - /* Link-local multicast packets should be passed to the 1187 - * stack on the link they arrive as well as pass them to the 1188 - * bond-master device. These packets are mostly usable when 1189 - * stack receives it with the link on which they arrive 1190 - * (e.g. LLDP) they also must be available on master. Some of 1191 - * the use cases include (but are not limited to): LLDP agents 1192 - * that must be able to operate both on enslaved interfaces as 1193 - * well as on bonds themselves; linux bridges that must be able 1194 - * to process/pass BPDUs from attached bonds when any kind of 1195 - * STP version is enabled on the network. 1186 + /* 1187 + * For packets determined by bond_should_deliver_exact_match() call to 1188 + * be suppressed we want to make an exception for link-local packets. 1189 + * This is necessary for e.g. LLDP daemons to be able to monitor 1190 + * inactive slave links without being forced to bind to them 1191 + * explicitly. 1192 + * 1193 + * At the same time, packets that are passed to the bonding master 1194 + * (including link-local ones) can have their originating interface 1195 + * determined via PACKET_ORIGDEV socket option. 1196 1196 */ 1197 - if (is_link_local_ether_addr(eth_hdr(skb)->h_dest)) { 1198 - struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC); 1199 - 1200 - if (nskb) { 1201 - nskb->dev = bond->dev; 1202 - nskb->queue_mapping = 0; 1203 - netif_rx(nskb); 1204 - } 1205 - return RX_HANDLER_PASS; 1206 - } 1207 - if (bond_should_deliver_exact_match(skb, slave, bond)) 1197 + if (bond_should_deliver_exact_match(skb, slave, bond)) { 1198 + if (is_link_local_ether_addr(eth_hdr(skb)->h_dest)) 1199 + return RX_HANDLER_PASS; 1208 1200 return RX_HANDLER_EXACT; 1201 + } 1209 1202 1210 1203 skb->dev = bond->dev; 1211 1204
+1 -3
drivers/net/ethernet/atheros/atlx/atl2.c
··· 1335 1335 { 1336 1336 struct net_device *netdev; 1337 1337 struct atl2_adapter *adapter; 1338 - static int cards_found; 1338 + static int cards_found = 0; 1339 1339 unsigned long mmio_start; 1340 1340 int mmio_len; 1341 1341 int err; 1342 - 1343 - cards_found = 0; 1344 1342 1345 1343 err = pci_enable_device(pdev); 1346 1344 if (err)
+2 -2
drivers/net/ethernet/broadcom/bnxt/bnxt.c
··· 3903 3903 if (len) 3904 3904 break; 3905 3905 /* on first few passes, just barely sleep */ 3906 - if (i < DFLT_HWRM_CMD_TIMEOUT) 3906 + if (i < HWRM_SHORT_TIMEOUT_COUNTER) 3907 3907 usleep_range(HWRM_SHORT_MIN_TIMEOUT, 3908 3908 HWRM_SHORT_MAX_TIMEOUT); 3909 3909 else ··· 3926 3926 dma_rmb(); 3927 3927 if (*valid) 3928 3928 break; 3929 - udelay(1); 3929 + usleep_range(1, 5); 3930 3930 } 3931 3931 3932 3932 if (j >= HWRM_VALID_BIT_DELAY_USEC) {
+1 -1
drivers/net/ethernet/broadcom/bnxt/bnxt.h
··· 582 582 (HWRM_SHORT_TIMEOUT_COUNTER * HWRM_SHORT_MIN_TIMEOUT + \ 583 583 ((n) - HWRM_SHORT_TIMEOUT_COUNTER) * HWRM_MIN_TIMEOUT)) 584 584 585 - #define HWRM_VALID_BIT_DELAY_USEC 20 585 + #define HWRM_VALID_BIT_DELAY_USEC 150 586 586 587 587 #define BNXT_HWRM_CHNL_CHIMP 0 588 588 #define BNXT_HWRM_CHNL_KONG 1
+8 -6
drivers/net/ethernet/cavium/thunder/nic.h
··· 271 271 }; 272 272 273 273 struct nicvf_work { 274 - struct delayed_work work; 274 + struct work_struct work; 275 275 u8 mode; 276 276 struct xcast_addr_list *mc; 277 277 }; ··· 327 327 struct nicvf_work rx_mode_work; 328 328 /* spinlock to protect workqueue arguments from concurrent access */ 329 329 spinlock_t rx_mode_wq_lock; 330 - 330 + /* workqueue for handling kernel ndo_set_rx_mode() calls */ 331 + struct workqueue_struct *nicvf_rx_mode_wq; 332 + /* mutex to protect VF's mailbox contents from concurrent access */ 333 + struct mutex rx_mode_mtx; 334 + struct delayed_work link_change_work; 331 335 /* PTP timestamp */ 332 336 struct cavium_ptp *ptp_clock; 333 337 /* Inbound timestamping is on */ ··· 579 575 580 576 struct xcast { 581 577 u8 msg; 582 - union { 583 - u8 mode; 584 - u64 mac; 585 - } data; 578 + u8 mode; 579 + u64 mac:48; 586 580 }; 587 581 588 582 /* 128 bit shared memory between PF and each VF */
+46 -103
drivers/net/ethernet/cavium/thunder/nic_main.c
··· 57 57 #define NIC_GET_BGX_FROM_VF_LMAC_MAP(map) ((map >> 4) & 0xF) 58 58 #define NIC_GET_LMAC_FROM_VF_LMAC_MAP(map) (map & 0xF) 59 59 u8 *vf_lmac_map; 60 - struct delayed_work dwork; 61 - struct workqueue_struct *check_link; 62 - u8 *link; 63 - u8 *duplex; 64 - u32 *speed; 65 60 u16 cpi_base[MAX_NUM_VFS_SUPPORTED]; 66 61 u16 rssi_base[MAX_NUM_VFS_SUPPORTED]; 67 - bool mbx_lock[MAX_NUM_VFS_SUPPORTED]; 68 62 69 63 /* MSI-X */ 70 64 u8 num_vec; ··· 923 929 nic_reg_write(nic, NIC_PF_PKIND_0_15_CFG | (pkind_idx << 3), pkind_val); 924 930 } 925 931 932 + /* Get BGX LMAC link status and update corresponding VF 933 + * if there is a change, valid only if internal L2 switch 934 + * is not present otherwise VF link is always treated as up 935 + */ 936 + static void nic_link_status_get(struct nicpf *nic, u8 vf) 937 + { 938 + union nic_mbx mbx = {}; 939 + struct bgx_link_status link; 940 + u8 bgx, lmac; 941 + 942 + mbx.link_status.msg = NIC_MBOX_MSG_BGX_LINK_CHANGE; 943 + 944 + /* Get BGX, LMAC indices for the VF */ 945 + bgx = NIC_GET_BGX_FROM_VF_LMAC_MAP(nic->vf_lmac_map[vf]); 946 + lmac = NIC_GET_LMAC_FROM_VF_LMAC_MAP(nic->vf_lmac_map[vf]); 947 + 948 + /* Get interface link status */ 949 + bgx_get_lmac_link_state(nic->node, bgx, lmac, &link); 950 + 951 + /* Send a mbox message to VF with current link status */ 952 + mbx.link_status.link_up = link.link_up; 953 + mbx.link_status.duplex = link.duplex; 954 + mbx.link_status.speed = link.speed; 955 + mbx.link_status.mac_type = link.mac_type; 956 + 957 + /* reply with link status */ 958 + nic_send_msg_to_vf(nic, vf, &mbx); 959 + } 960 + 926 961 /* Interrupt handler to handle mailbox messages from VFs */ 927 962 static void nic_handle_mbx_intr(struct nicpf *nic, int vf) 928 963 { ··· 963 940 int bgx, lmac; 964 941 int i; 965 942 int ret = 0; 966 - 967 - nic->mbx_lock[vf] = true; 968 943 969 944 mbx_addr = nic_get_mbx_addr(vf); 970 945 mbx_data = (u64 *)&mbx; ··· 978 957 switch (mbx.msg.msg) { 979 958 case NIC_MBOX_MSG_READY: 980 959 nic_mbx_send_ready(nic, vf); 981 - if (vf < nic->num_vf_en) { 982 - nic->link[vf] = 0; 983 - nic->duplex[vf] = 0; 984 - nic->speed[vf] = 0; 985 - } 986 - goto unlock; 960 + return; 987 961 case NIC_MBOX_MSG_QS_CFG: 988 962 reg_addr = NIC_PF_QSET_0_127_CFG | 989 963 (mbx.qs.num << NIC_QS_ID_SHIFT); ··· 1047 1031 break; 1048 1032 case NIC_MBOX_MSG_RSS_SIZE: 1049 1033 nic_send_rss_size(nic, vf); 1050 - goto unlock; 1034 + return; 1051 1035 case NIC_MBOX_MSG_RSS_CFG: 1052 1036 case NIC_MBOX_MSG_RSS_CFG_CONT: 1053 1037 nic_config_rss(nic, &mbx.rss_cfg); ··· 1055 1039 case NIC_MBOX_MSG_CFG_DONE: 1056 1040 /* Last message of VF config msg sequence */ 1057 1041 nic_enable_vf(nic, vf, true); 1058 - goto unlock; 1042 + break; 1059 1043 case NIC_MBOX_MSG_SHUTDOWN: 1060 1044 /* First msg in VF teardown sequence */ 1061 1045 if (vf >= nic->num_vf_en) ··· 1065 1049 break; 1066 1050 case NIC_MBOX_MSG_ALLOC_SQS: 1067 1051 nic_alloc_sqs(nic, &mbx.sqs_alloc); 1068 - goto unlock; 1052 + return; 1069 1053 case NIC_MBOX_MSG_NICVF_PTR: 1070 1054 nic->nicvf[vf] = mbx.nicvf.nicvf; 1071 1055 break; 1072 1056 case NIC_MBOX_MSG_PNICVF_PTR: 1073 1057 nic_send_pnicvf(nic, vf); 1074 - goto unlock; 1058 + return; 1075 1059 case NIC_MBOX_MSG_SNICVF_PTR: 1076 1060 nic_send_snicvf(nic, &mbx.nicvf); 1077 - goto unlock; 1061 + return; 1078 1062 case NIC_MBOX_MSG_BGX_STATS: 1079 1063 nic_get_bgx_stats(nic, &mbx.bgx_stats); 1080 - goto unlock; 1064 + return; 1081 1065 case NIC_MBOX_MSG_LOOPBACK: 1082 1066 ret = nic_config_loopback(nic, &mbx.lbk); 1083 1067 break; ··· 1086 1070 break; 1087 1071 case NIC_MBOX_MSG_PFC: 1088 1072 nic_pause_frame(nic, vf, &mbx.pfc); 1089 - goto unlock; 1073 + return; 1090 1074 case NIC_MBOX_MSG_PTP_CFG: 1091 1075 nic_config_timestamp(nic, vf, &mbx.ptp); 1092 1076 break; ··· 1110 1094 bgx = NIC_GET_BGX_FROM_VF_LMAC_MAP(nic->vf_lmac_map[vf]); 1111 1095 lmac = NIC_GET_LMAC_FROM_VF_LMAC_MAP(nic->vf_lmac_map[vf]); 1112 1096 bgx_set_dmac_cam_filter(nic->node, bgx, lmac, 1113 - mbx.xcast.data.mac, 1097 + mbx.xcast.mac, 1114 1098 vf < NIC_VF_PER_MBX_REG ? vf : 1115 1099 vf - NIC_VF_PER_MBX_REG); 1116 1100 break; ··· 1122 1106 } 1123 1107 bgx = NIC_GET_BGX_FROM_VF_LMAC_MAP(nic->vf_lmac_map[vf]); 1124 1108 lmac = NIC_GET_LMAC_FROM_VF_LMAC_MAP(nic->vf_lmac_map[vf]); 1125 - bgx_set_xcast_mode(nic->node, bgx, lmac, mbx.xcast.data.mode); 1109 + bgx_set_xcast_mode(nic->node, bgx, lmac, mbx.xcast.mode); 1126 1110 break; 1111 + case NIC_MBOX_MSG_BGX_LINK_CHANGE: 1112 + if (vf >= nic->num_vf_en) { 1113 + ret = -1; /* NACK */ 1114 + break; 1115 + } 1116 + nic_link_status_get(nic, vf); 1117 + return; 1127 1118 default: 1128 1119 dev_err(&nic->pdev->dev, 1129 1120 "Invalid msg from VF%d, msg 0x%x\n", vf, mbx.msg.msg); ··· 1144 1121 mbx.msg.msg, vf); 1145 1122 nic_mbx_send_nack(nic, vf); 1146 1123 } 1147 - unlock: 1148 - nic->mbx_lock[vf] = false; 1149 1124 } 1150 1125 1151 1126 static irqreturn_t nic_mbx_intr_handler(int irq, void *nic_irq) ··· 1291 1270 return 0; 1292 1271 } 1293 1272 1294 - /* Poll for BGX LMAC link status and update corresponding VF 1295 - * if there is a change, valid only if internal L2 switch 1296 - * is not present otherwise VF link is always treated as up 1297 - */ 1298 - static void nic_poll_for_link(struct work_struct *work) 1299 - { 1300 - union nic_mbx mbx = {}; 1301 - struct nicpf *nic; 1302 - struct bgx_link_status link; 1303 - u8 vf, bgx, lmac; 1304 - 1305 - nic = container_of(work, struct nicpf, dwork.work); 1306 - 1307 - mbx.link_status.msg = NIC_MBOX_MSG_BGX_LINK_CHANGE; 1308 - 1309 - for (vf = 0; vf < nic->num_vf_en; vf++) { 1310 - /* Poll only if VF is UP */ 1311 - if (!nic->vf_enabled[vf]) 1312 - continue; 1313 - 1314 - /* Get BGX, LMAC indices for the VF */ 1315 - bgx = NIC_GET_BGX_FROM_VF_LMAC_MAP(nic->vf_lmac_map[vf]); 1316 - lmac = NIC_GET_LMAC_FROM_VF_LMAC_MAP(nic->vf_lmac_map[vf]); 1317 - /* Get interface link status */ 1318 - bgx_get_lmac_link_state(nic->node, bgx, lmac, &link); 1319 - 1320 - /* Inform VF only if link status changed */ 1321 - if (nic->link[vf] == link.link_up) 1322 - continue; 1323 - 1324 - if (!nic->mbx_lock[vf]) { 1325 - nic->link[vf] = link.link_up; 1326 - nic->duplex[vf] = link.duplex; 1327 - nic->speed[vf] = link.speed; 1328 - 1329 - /* Send a mbox message to VF with current link status */ 1330 - mbx.link_status.link_up = link.link_up; 1331 - mbx.link_status.duplex = link.duplex; 1332 - mbx.link_status.speed = link.speed; 1333 - mbx.link_status.mac_type = link.mac_type; 1334 - nic_send_msg_to_vf(nic, vf, &mbx); 1335 - } 1336 - } 1337 - queue_delayed_work(nic->check_link, &nic->dwork, HZ * 2); 1338 - } 1339 - 1340 1273 static int nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) 1341 1274 { 1342 1275 struct device *dev = &pdev->dev; ··· 1359 1384 if (!nic->vf_lmac_map) 1360 1385 goto err_release_regions; 1361 1386 1362 - nic->link = devm_kmalloc_array(dev, max_lmac, sizeof(u8), GFP_KERNEL); 1363 - if (!nic->link) 1364 - goto err_release_regions; 1365 - 1366 - nic->duplex = devm_kmalloc_array(dev, max_lmac, sizeof(u8), GFP_KERNEL); 1367 - if (!nic->duplex) 1368 - goto err_release_regions; 1369 - 1370 - nic->speed = devm_kmalloc_array(dev, max_lmac, sizeof(u32), GFP_KERNEL); 1371 - if (!nic->speed) 1372 - goto err_release_regions; 1373 - 1374 1387 /* Initialize hardware */ 1375 1388 nic_init_hw(nic); 1376 1389 ··· 1374 1411 if (err) 1375 1412 goto err_unregister_interrupts; 1376 1413 1377 - /* Register a physical link status poll fn() */ 1378 - nic->check_link = alloc_workqueue("check_link_status", 1379 - WQ_UNBOUND | WQ_MEM_RECLAIM, 1); 1380 - if (!nic->check_link) { 1381 - err = -ENOMEM; 1382 - goto err_disable_sriov; 1383 - } 1384 - 1385 - INIT_DELAYED_WORK(&nic->dwork, nic_poll_for_link); 1386 - queue_delayed_work(nic->check_link, &nic->dwork, 0); 1387 - 1388 1414 return 0; 1389 1415 1390 - err_disable_sriov: 1391 - if (nic->flags & NIC_SRIOV_ENABLED) 1392 - pci_disable_sriov(pdev); 1393 1416 err_unregister_interrupts: 1394 1417 nic_unregister_interrupts(nic); 1395 1418 err_release_regions: ··· 1395 1446 1396 1447 if (nic->flags & NIC_SRIOV_ENABLED) 1397 1448 pci_disable_sriov(pdev); 1398 - 1399 - if (nic->check_link) { 1400 - /* Destroy work Queue */ 1401 - cancel_delayed_work_sync(&nic->dwork); 1402 - destroy_workqueue(nic->check_link); 1403 - } 1404 1449 1405 1450 nic_unregister_interrupts(nic); 1406 1451 pci_release_regions(pdev);
+86 -42
drivers/net/ethernet/cavium/thunder/nicvf_main.c
··· 68 68 MODULE_PARM_DESC(cpi_alg, 69 69 "PFC algorithm (0=none, 1=VLAN, 2=VLAN16, 3=IP Diffserv)"); 70 70 71 - /* workqueue for handling kernel ndo_set_rx_mode() calls */ 72 - static struct workqueue_struct *nicvf_rx_mode_wq; 73 - 74 71 static inline u8 nicvf_netdev_qidx(struct nicvf *nic, u8 qidx) 75 72 { 76 73 if (nic->sqs_mode) ··· 124 127 { 125 128 int timeout = NIC_MBOX_MSG_TIMEOUT; 126 129 int sleep = 10; 130 + int ret = 0; 131 + 132 + mutex_lock(&nic->rx_mode_mtx); 127 133 128 134 nic->pf_acked = false; 129 135 nic->pf_nacked = false; ··· 139 139 netdev_err(nic->netdev, 140 140 "PF NACK to mbox msg 0x%02x from VF%d\n", 141 141 (mbx->msg.msg & 0xFF), nic->vf_id); 142 - return -EINVAL; 142 + ret = -EINVAL; 143 + break; 143 144 } 144 145 msleep(sleep); 145 146 if (nic->pf_acked) ··· 150 149 netdev_err(nic->netdev, 151 150 "PF didn't ACK to mbox msg 0x%02x from VF%d\n", 152 151 (mbx->msg.msg & 0xFF), nic->vf_id); 153 - return -EBUSY; 152 + ret = -EBUSY; 153 + break; 154 154 } 155 155 } 156 - return 0; 156 + mutex_unlock(&nic->rx_mode_mtx); 157 + return ret; 157 158 } 158 159 159 160 /* Checks if VF is able to comminicate with PF ··· 173 170 } 174 171 175 172 return 1; 173 + } 174 + 175 + static void nicvf_send_cfg_done(struct nicvf *nic) 176 + { 177 + union nic_mbx mbx = {}; 178 + 179 + mbx.msg.msg = NIC_MBOX_MSG_CFG_DONE; 180 + if (nicvf_send_msg_to_pf(nic, &mbx)) { 181 + netdev_err(nic->netdev, 182 + "PF didn't respond to CFG DONE msg\n"); 183 + } 176 184 } 177 185 178 186 static void nicvf_read_bgx_stats(struct nicvf *nic, struct bgx_stats_msg *bgx) ··· 242 228 break; 243 229 case NIC_MBOX_MSG_BGX_LINK_CHANGE: 244 230 nic->pf_acked = true; 245 - nic->link_up = mbx.link_status.link_up; 246 - nic->duplex = mbx.link_status.duplex; 247 - nic->speed = mbx.link_status.speed; 248 - nic->mac_type = mbx.link_status.mac_type; 249 - if (nic->link_up) { 250 - netdev_info(nic->netdev, "Link is Up %d Mbps %s duplex\n", 251 - nic->speed, 252 - nic->duplex == DUPLEX_FULL ? 253 - "Full" : "Half"); 254 - netif_carrier_on(nic->netdev); 255 - netif_tx_start_all_queues(nic->netdev); 256 - } else { 257 - netdev_info(nic->netdev, "Link is Down\n"); 258 - netif_carrier_off(nic->netdev); 259 - netif_tx_stop_all_queues(nic->netdev); 231 + if (nic->link_up != mbx.link_status.link_up) { 232 + nic->link_up = mbx.link_status.link_up; 233 + nic->duplex = mbx.link_status.duplex; 234 + nic->speed = mbx.link_status.speed; 235 + nic->mac_type = mbx.link_status.mac_type; 236 + if (nic->link_up) { 237 + netdev_info(nic->netdev, 238 + "Link is Up %d Mbps %s duplex\n", 239 + nic->speed, 240 + nic->duplex == DUPLEX_FULL ? 241 + "Full" : "Half"); 242 + netif_carrier_on(nic->netdev); 243 + netif_tx_start_all_queues(nic->netdev); 244 + } else { 245 + netdev_info(nic->netdev, "Link is Down\n"); 246 + netif_carrier_off(nic->netdev); 247 + netif_tx_stop_all_queues(nic->netdev); 248 + } 260 249 } 261 250 break; 262 251 case NIC_MBOX_MSG_ALLOC_SQS: ··· 1328 1311 struct nicvf_cq_poll *cq_poll = NULL; 1329 1312 union nic_mbx mbx = {}; 1330 1313 1314 + cancel_delayed_work_sync(&nic->link_change_work); 1315 + 1316 + /* wait till all queued set_rx_mode tasks completes */ 1317 + drain_workqueue(nic->nicvf_rx_mode_wq); 1318 + 1331 1319 mbx.msg.msg = NIC_MBOX_MSG_SHUTDOWN; 1332 1320 nicvf_send_msg_to_pf(nic, &mbx); 1333 1321 ··· 1432 1410 return nicvf_send_msg_to_pf(nic, &mbx); 1433 1411 } 1434 1412 1413 + static void nicvf_link_status_check_task(struct work_struct *work_arg) 1414 + { 1415 + struct nicvf *nic = container_of(work_arg, 1416 + struct nicvf, 1417 + link_change_work.work); 1418 + union nic_mbx mbx = {}; 1419 + mbx.msg.msg = NIC_MBOX_MSG_BGX_LINK_CHANGE; 1420 + nicvf_send_msg_to_pf(nic, &mbx); 1421 + queue_delayed_work(nic->nicvf_rx_mode_wq, 1422 + &nic->link_change_work, 2 * HZ); 1423 + } 1424 + 1435 1425 int nicvf_open(struct net_device *netdev) 1436 1426 { 1437 1427 int cpu, err, qidx; 1438 1428 struct nicvf *nic = netdev_priv(netdev); 1439 1429 struct queue_set *qs = nic->qs; 1440 1430 struct nicvf_cq_poll *cq_poll = NULL; 1441 - union nic_mbx mbx = {}; 1431 + 1432 + /* wait till all queued set_rx_mode tasks completes if any */ 1433 + drain_workqueue(nic->nicvf_rx_mode_wq); 1442 1434 1443 1435 netif_carrier_off(netdev); 1444 1436 ··· 1548 1512 nicvf_enable_intr(nic, NICVF_INTR_RBDR, qidx); 1549 1513 1550 1514 /* Send VF config done msg to PF */ 1551 - mbx.msg.msg = NIC_MBOX_MSG_CFG_DONE; 1552 - nicvf_write_to_mbx(nic, &mbx); 1515 + nicvf_send_cfg_done(nic); 1516 + 1517 + INIT_DELAYED_WORK(&nic->link_change_work, 1518 + nicvf_link_status_check_task); 1519 + queue_delayed_work(nic->nicvf_rx_mode_wq, 1520 + &nic->link_change_work, 0); 1553 1521 1554 1522 return 0; 1555 1523 cleanup: ··· 1981 1941 1982 1942 /* flush DMAC filters and reset RX mode */ 1983 1943 mbx.xcast.msg = NIC_MBOX_MSG_RESET_XCAST; 1984 - nicvf_send_msg_to_pf(nic, &mbx); 1944 + if (nicvf_send_msg_to_pf(nic, &mbx) < 0) 1945 + goto free_mc; 1985 1946 1986 1947 if (mode & BGX_XCAST_MCAST_FILTER) { 1987 1948 /* once enabling filtering, we need to signal to PF to add 1988 1949 * its' own LMAC to the filter to accept packets for it. 1989 1950 */ 1990 1951 mbx.xcast.msg = NIC_MBOX_MSG_ADD_MCAST; 1991 - mbx.xcast.data.mac = 0; 1992 - nicvf_send_msg_to_pf(nic, &mbx); 1952 + mbx.xcast.mac = 0; 1953 + if (nicvf_send_msg_to_pf(nic, &mbx) < 0) 1954 + goto free_mc; 1993 1955 } 1994 1956 1995 1957 /* check if we have any specific MACs to be added to PF DMAC filter */ ··· 1999 1957 /* now go through kernel list of MACs and add them one by one */ 2000 1958 for (idx = 0; idx < mc_addrs->count; idx++) { 2001 1959 mbx.xcast.msg = NIC_MBOX_MSG_ADD_MCAST; 2002 - mbx.xcast.data.mac = mc_addrs->mc[idx]; 2003 - nicvf_send_msg_to_pf(nic, &mbx); 1960 + mbx.xcast.mac = mc_addrs->mc[idx]; 1961 + if (nicvf_send_msg_to_pf(nic, &mbx) < 0) 1962 + goto free_mc; 2004 1963 } 2005 - kfree(mc_addrs); 2006 1964 } 2007 1965 2008 1966 /* and finally set rx mode for PF accordingly */ 2009 1967 mbx.xcast.msg = NIC_MBOX_MSG_SET_XCAST; 2010 - mbx.xcast.data.mode = mode; 1968 + mbx.xcast.mode = mode; 2011 1969 2012 1970 nicvf_send_msg_to_pf(nic, &mbx); 1971 + free_mc: 1972 + kfree(mc_addrs); 2013 1973 } 2014 1974 2015 1975 static void nicvf_set_rx_mode_task(struct work_struct *work_arg) 2016 1976 { 2017 1977 struct nicvf_work *vf_work = container_of(work_arg, struct nicvf_work, 2018 - work.work); 1978 + work); 2019 1979 struct nicvf *nic = container_of(vf_work, struct nicvf, rx_mode_work); 2020 1980 u8 mode; 2021 1981 struct xcast_addr_list *mc; ··· 2074 2030 kfree(nic->rx_mode_work.mc); 2075 2031 nic->rx_mode_work.mc = mc_list; 2076 2032 nic->rx_mode_work.mode = mode; 2077 - queue_delayed_work(nicvf_rx_mode_wq, &nic->rx_mode_work.work, 0); 2033 + queue_work(nic->nicvf_rx_mode_wq, &nic->rx_mode_work.work); 2078 2034 spin_unlock(&nic->rx_mode_wq_lock); 2079 2035 } 2080 2036 ··· 2231 2187 2232 2188 INIT_WORK(&nic->reset_task, nicvf_reset_task); 2233 2189 2234 - INIT_DELAYED_WORK(&nic->rx_mode_work.work, nicvf_set_rx_mode_task); 2190 + nic->nicvf_rx_mode_wq = alloc_ordered_workqueue("nicvf_rx_mode_wq_VF%d", 2191 + WQ_MEM_RECLAIM, 2192 + nic->vf_id); 2193 + INIT_WORK(&nic->rx_mode_work.work, nicvf_set_rx_mode_task); 2235 2194 spin_lock_init(&nic->rx_mode_wq_lock); 2195 + mutex_init(&nic->rx_mode_mtx); 2236 2196 2237 2197 err = register_netdev(netdev); 2238 2198 if (err) { ··· 2276 2228 nic = netdev_priv(netdev); 2277 2229 pnetdev = nic->pnicvf->netdev; 2278 2230 2279 - cancel_delayed_work_sync(&nic->rx_mode_work.work); 2280 - 2281 2231 /* Check if this Qset is assigned to different VF. 2282 2232 * If yes, clean primary and all secondary Qsets. 2283 2233 */ 2284 2234 if (pnetdev && (pnetdev->reg_state == NETREG_REGISTERED)) 2285 2235 unregister_netdev(pnetdev); 2236 + if (nic->nicvf_rx_mode_wq) { 2237 + destroy_workqueue(nic->nicvf_rx_mode_wq); 2238 + nic->nicvf_rx_mode_wq = NULL; 2239 + } 2286 2240 nicvf_unregister_interrupts(nic); 2287 2241 pci_set_drvdata(pdev, NULL); 2288 2242 if (nic->drv_stats) ··· 2311 2261 static int __init nicvf_init_module(void) 2312 2262 { 2313 2263 pr_info("%s, ver %s\n", DRV_NAME, DRV_VERSION); 2314 - nicvf_rx_mode_wq = alloc_ordered_workqueue("nicvf_generic", 2315 - WQ_MEM_RECLAIM); 2316 2264 return pci_register_driver(&nicvf_driver); 2317 2265 } 2318 2266 2319 2267 static void __exit nicvf_cleanup_module(void) 2320 2268 { 2321 - if (nicvf_rx_mode_wq) { 2322 - destroy_workqueue(nicvf_rx_mode_wq); 2323 - nicvf_rx_mode_wq = NULL; 2324 - } 2325 2269 pci_unregister_driver(&nicvf_driver); 2326 2270 } 2327 2271
+1 -1
drivers/net/ethernet/cavium/thunder/thunder_bgx.c
··· 1217 1217 1218 1218 /* Disable MAC steering (NCSI traffic) */ 1219 1219 for (i = 0; i < RX_TRAFFIC_STEER_RULE_COUNT; i++) 1220 - bgx_reg_write(bgx, 0, BGX_CMR_RX_STREERING + (i * 8), 0x00); 1220 + bgx_reg_write(bgx, 0, BGX_CMR_RX_STEERING + (i * 8), 0x00); 1221 1221 } 1222 1222 1223 1223 static u8 bgx_get_lane2sds_cfg(struct bgx *bgx, struct lmac *lmac)
+1 -1
drivers/net/ethernet/cavium/thunder/thunder_bgx.h
··· 60 60 #define RX_DMACX_CAM_EN BIT_ULL(48) 61 61 #define RX_DMACX_CAM_LMACID(x) (((u64)x) << 49) 62 62 #define RX_DMAC_COUNT 32 63 - #define BGX_CMR_RX_STREERING 0x300 63 + #define BGX_CMR_RX_STEERING 0x300 64 64 #define RX_TRAFFIC_STEER_RULE_COUNT 8 65 65 #define BGX_CMR_CHAN_MSK_AND 0x450 66 66 #define BGX_CMR_BIST_STATUS 0x460
+24 -3
drivers/net/ethernet/intel/i40e/i40e_main.c
··· 3289 3289 i40e_alloc_rx_buffers_zc(ring, I40E_DESC_UNUSED(ring)) : 3290 3290 !i40e_alloc_rx_buffers(ring, I40E_DESC_UNUSED(ring)); 3291 3291 if (!ok) { 3292 + /* Log this in case the user has forgotten to give the kernel 3293 + * any buffers, even later in the application. 3294 + */ 3292 3295 dev_info(&vsi->back->pdev->dev, 3293 - "Failed allocate some buffers on %sRx ring %d (pf_q %d)\n", 3296 + "Failed to allocate some buffers on %sRx ring %d (pf_q %d)\n", 3294 3297 ring->xsk_umem ? "UMEM enabled " : "", 3295 3298 ring->queue_index, pf_q); 3296 3299 } ··· 6728 6725 6729 6726 for (i = 0; i < vsi->num_queue_pairs; i++) { 6730 6727 i40e_clean_tx_ring(vsi->tx_rings[i]); 6731 - if (i40e_enabled_xdp_vsi(vsi)) 6728 + if (i40e_enabled_xdp_vsi(vsi)) { 6729 + /* Make sure that in-progress ndo_xdp_xmit 6730 + * calls are completed. 6731 + */ 6732 + synchronize_rcu(); 6732 6733 i40e_clean_tx_ring(vsi->xdp_rings[i]); 6734 + } 6733 6735 i40e_clean_rx_ring(vsi->rx_rings[i]); 6734 6736 } 6735 6737 ··· 11903 11895 if (old_prog) 11904 11896 bpf_prog_put(old_prog); 11905 11897 11898 + /* Kick start the NAPI context if there is an AF_XDP socket open 11899 + * on that queue id. This so that receiving will start. 11900 + */ 11901 + if (need_reset && prog) 11902 + for (i = 0; i < vsi->num_queue_pairs; i++) 11903 + if (vsi->xdp_rings[i]->xsk_umem) 11904 + (void)i40e_xsk_async_xmit(vsi->netdev, i); 11905 + 11906 11906 return 0; 11907 11907 } 11908 11908 ··· 11971 11955 static void i40e_queue_pair_clean_rings(struct i40e_vsi *vsi, int queue_pair) 11972 11956 { 11973 11957 i40e_clean_tx_ring(vsi->tx_rings[queue_pair]); 11974 - if (i40e_enabled_xdp_vsi(vsi)) 11958 + if (i40e_enabled_xdp_vsi(vsi)) { 11959 + /* Make sure that in-progress ndo_xdp_xmit calls are 11960 + * completed. 11961 + */ 11962 + synchronize_rcu(); 11975 11963 i40e_clean_tx_ring(vsi->xdp_rings[queue_pair]); 11964 + } 11976 11965 i40e_clean_rx_ring(vsi->rx_rings[queue_pair]); 11977 11966 } 11978 11967
+3 -1
drivers/net/ethernet/intel/i40e/i40e_txrx.c
··· 3709 3709 struct i40e_netdev_priv *np = netdev_priv(dev); 3710 3710 unsigned int queue_index = smp_processor_id(); 3711 3711 struct i40e_vsi *vsi = np->vsi; 3712 + struct i40e_pf *pf = vsi->back; 3712 3713 struct i40e_ring *xdp_ring; 3713 3714 int drops = 0; 3714 3715 int i; ··· 3717 3716 if (test_bit(__I40E_VSI_DOWN, vsi->state)) 3718 3717 return -ENETDOWN; 3719 3718 3720 - if (!i40e_enabled_xdp_vsi(vsi) || queue_index >= vsi->num_queue_pairs) 3719 + if (!i40e_enabled_xdp_vsi(vsi) || queue_index >= vsi->num_queue_pairs || 3720 + test_bit(__I40E_CONFIG_BUSY, pf->state)) 3721 3721 return -ENXIO; 3722 3722 3723 3723 if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK))
+5
drivers/net/ethernet/intel/i40e/i40e_xsk.c
··· 183 183 err = i40e_queue_pair_enable(vsi, qid); 184 184 if (err) 185 185 return err; 186 + 187 + /* Kick start the NAPI context so that receiving will start */ 188 + err = i40e_xsk_async_xmit(vsi->netdev, qid); 189 + if (err) 190 + return err; 186 191 } 187 192 188 193 return 0;
+16 -3
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
··· 3953 3953 else 3954 3954 mrqc = IXGBE_MRQC_VMDQRSS64EN; 3955 3955 3956 - /* Enable L3/L4 for Tx Switched packets */ 3957 - mrqc |= IXGBE_MRQC_L3L4TXSWEN; 3956 + /* Enable L3/L4 for Tx Switched packets only for X550, 3957 + * older devices do not support this feature 3958 + */ 3959 + if (hw->mac.type >= ixgbe_mac_X550) 3960 + mrqc |= IXGBE_MRQC_L3L4TXSWEN; 3958 3961 } else { 3959 3962 if (tcs > 4) 3960 3963 mrqc = IXGBE_MRQC_RTRSS8TCEN; ··· 10228 10225 int i, frame_size = dev->mtu + ETH_HLEN + ETH_FCS_LEN + VLAN_HLEN; 10229 10226 struct ixgbe_adapter *adapter = netdev_priv(dev); 10230 10227 struct bpf_prog *old_prog; 10228 + bool need_reset; 10231 10229 10232 10230 if (adapter->flags & IXGBE_FLAG_SRIOV_ENABLED) 10233 10231 return -EINVAL; ··· 10251 10247 return -ENOMEM; 10252 10248 10253 10249 old_prog = xchg(&adapter->xdp_prog, prog); 10250 + need_reset = (!!prog != !!old_prog); 10254 10251 10255 10252 /* If transitioning XDP modes reconfigure rings */ 10256 - if (!!prog != !!old_prog) { 10253 + if (need_reset) { 10257 10254 int err = ixgbe_setup_tc(dev, adapter->hw_tcs); 10258 10255 10259 10256 if (err) { ··· 10269 10264 10270 10265 if (old_prog) 10271 10266 bpf_prog_put(old_prog); 10267 + 10268 + /* Kick start the NAPI context if there is an AF_XDP socket open 10269 + * on that queue id. This so that receiving will start. 10270 + */ 10271 + if (need_reset && prog) 10272 + for (i = 0; i < adapter->num_rx_queues; i++) 10273 + if (adapter->xdp_ring[i]->xsk_umem) 10274 + (void)ixgbe_xsk_async_xmit(adapter->netdev, i); 10272 10275 10273 10276 return 0; 10274 10277 }
+12 -3
drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c
··· 144 144 ixgbe_txrx_ring_disable(adapter, qid); 145 145 146 146 err = ixgbe_add_xsk_umem(adapter, umem, qid); 147 + if (err) 148 + return err; 147 149 148 - if (if_running) 150 + if (if_running) { 149 151 ixgbe_txrx_ring_enable(adapter, qid); 150 152 151 - return err; 153 + /* Kick start the NAPI context so that receiving will start */ 154 + err = ixgbe_xsk_async_xmit(adapter->netdev, qid); 155 + if (err) 156 + return err; 157 + } 158 + 159 + return 0; 152 160 } 153 161 154 162 static int ixgbe_xsk_umem_disable(struct ixgbe_adapter *adapter, u16 qid) ··· 642 634 dma_addr_t dma; 643 635 644 636 while (budget-- > 0) { 645 - if (unlikely(!ixgbe_desc_unused(xdp_ring))) { 637 + if (unlikely(!ixgbe_desc_unused(xdp_ring)) || 638 + !netif_carrier_ok(xdp_ring->netdev)) { 646 639 work_done = false; 647 640 break; 648 641 }
+1 -1
drivers/net/ethernet/marvell/mvneta.c
··· 2146 2146 if (unlikely(!skb)) 2147 2147 goto err_drop_frame_ret_pool; 2148 2148 2149 - dma_sync_single_range_for_cpu(dev->dev.parent, 2149 + dma_sync_single_range_for_cpu(&pp->bm_priv->pdev->dev, 2150 2150 rx_desc->buf_phys_addr, 2151 2151 MVNETA_MH_SIZE + NET_SKB_PAD, 2152 2152 rx_bytes,
+6 -11
drivers/net/ethernet/netronome/nfp/bpf/jit.c
··· 1291 1291 1292 1292 static int 1293 1293 wrp_alu32_imm(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta, 1294 - enum alu_op alu_op, bool skip) 1294 + enum alu_op alu_op) 1295 1295 { 1296 1296 const struct bpf_insn *insn = &meta->insn; 1297 - 1298 - if (skip) { 1299 - meta->skip = true; 1300 - return 0; 1301 - } 1302 1297 1303 1298 wrp_alu_imm(nfp_prog, insn->dst_reg * 2, alu_op, insn->imm); 1304 1299 wrp_immed(nfp_prog, reg_both(insn->dst_reg * 2 + 1), 0); ··· 2304 2309 2305 2310 static int xor_imm(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta) 2306 2311 { 2307 - return wrp_alu32_imm(nfp_prog, meta, ALU_OP_XOR, !~meta->insn.imm); 2312 + return wrp_alu32_imm(nfp_prog, meta, ALU_OP_XOR); 2308 2313 } 2309 2314 2310 2315 static int and_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta) ··· 2314 2319 2315 2320 static int and_imm(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta) 2316 2321 { 2317 - return wrp_alu32_imm(nfp_prog, meta, ALU_OP_AND, !~meta->insn.imm); 2322 + return wrp_alu32_imm(nfp_prog, meta, ALU_OP_AND); 2318 2323 } 2319 2324 2320 2325 static int or_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta) ··· 2324 2329 2325 2330 static int or_imm(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta) 2326 2331 { 2327 - return wrp_alu32_imm(nfp_prog, meta, ALU_OP_OR, !meta->insn.imm); 2332 + return wrp_alu32_imm(nfp_prog, meta, ALU_OP_OR); 2328 2333 } 2329 2334 2330 2335 static int add_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta) ··· 2334 2339 2335 2340 static int add_imm(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta) 2336 2341 { 2337 - return wrp_alu32_imm(nfp_prog, meta, ALU_OP_ADD, !meta->insn.imm); 2342 + return wrp_alu32_imm(nfp_prog, meta, ALU_OP_ADD); 2338 2343 } 2339 2344 2340 2345 static int sub_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta) ··· 2344 2349 2345 2350 static int sub_imm(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta) 2346 2351 { 2347 - return wrp_alu32_imm(nfp_prog, meta, ALU_OP_SUB, !meta->insn.imm); 2352 + return wrp_alu32_imm(nfp_prog, meta, ALU_OP_SUB); 2348 2353 } 2349 2354 2350 2355 static int mul_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
+4
drivers/net/ipvlan/ipvlan_main.c
··· 499 499 500 500 if (!data) 501 501 return 0; 502 + if (!ns_capable(dev_net(ipvlan->phy_dev)->user_ns, CAP_NET_ADMIN)) 503 + return -EPERM; 502 504 503 505 if (data[IFLA_IPVLAN_MODE]) { 504 506 u16 nmode = nla_get_u16(data[IFLA_IPVLAN_MODE]); ··· 603 601 struct ipvl_dev *tmp = netdev_priv(phy_dev); 604 602 605 603 phy_dev = tmp->phy_dev; 604 + if (!ns_capable(dev_net(phy_dev)->user_ns, CAP_NET_ADMIN)) 605 + return -EPERM; 606 606 } else if (!netif_is_ipvlan_port(phy_dev)) { 607 607 /* Exit early if the underlying link is invalid or busy */ 608 608 if (phy_dev->type != ARPHRD_ETHER ||
+5 -1
drivers/net/phy/marvell10g.c
··· 26 26 #include <linux/marvell_phy.h> 27 27 #include <linux/phy.h> 28 28 29 + #define MDIO_AN_10GBT_CTRL_ADV_NBT_MASK 0x01e0 30 + 29 31 enum { 30 32 MV_PCS_BASE_T = 0x0000, 31 33 MV_PCS_BASE_R = 0x1000, ··· 388 386 else 389 387 reg = 0; 390 388 389 + /* Make sure we clear unsupported 2.5G/5G advertising */ 391 390 ret = mv3310_modify(phydev, MDIO_MMD_AN, MDIO_AN_10GBT_CTRL, 392 - MDIO_AN_10GBT_CTRL_ADV10G, reg); 391 + MDIO_AN_10GBT_CTRL_ADV10G | 392 + MDIO_AN_10GBT_CTRL_ADV_NBT_MASK, reg); 393 393 if (ret < 0) 394 394 return ret; 395 395 if (ret > 0)
-1
drivers/net/phy/mdio_bus.c
··· 379 379 err = device_register(&bus->dev); 380 380 if (err) { 381 381 pr_err("mii_bus %s failed to register\n", bus->id); 382 - put_device(&bus->dev); 383 382 return -EINVAL; 384 383 } 385 384
+7
drivers/net/phy/realtek.c
··· 282 282 .name = "RTL8366RB Gigabit Ethernet", 283 283 .features = PHY_GBIT_FEATURES, 284 284 .config_init = &rtl8366rb_config_init, 285 + /* These interrupts are handled by the irq controller 286 + * embedded inside the RTL8366RB, they get unmasked when the 287 + * irq is requested and ACKed by reading the status register, 288 + * which is done by the irqchip code. 289 + */ 290 + .ack_interrupt = genphy_no_ack_interrupt, 291 + .config_intr = genphy_no_config_intr, 285 292 .suspend = genphy_suspend, 286 293 .resume = genphy_resume, 287 294 },
+2 -2
drivers/net/team/team.c
··· 1256 1256 list_add_tail_rcu(&port->list, &team->port_list); 1257 1257 team_port_enable(team, port); 1258 1258 __team_compute_features(team); 1259 - __team_port_change_port_added(port, !!netif_carrier_ok(port_dev)); 1259 + __team_port_change_port_added(port, !!netif_oper_up(port_dev)); 1260 1260 __team_options_change_check(team); 1261 1261 1262 1262 netdev_info(dev, "Port device %s added\n", portname); ··· 2915 2915 2916 2916 switch (event) { 2917 2917 case NETDEV_UP: 2918 - if (netif_carrier_ok(dev)) 2918 + if (netif_oper_up(dev)) 2919 2919 team_port_change_check(port, true); 2920 2920 break; 2921 2921 case NETDEV_DOWN:
+1 -1
drivers/net/usb/r8152.c
··· 1179 1179 } else { 1180 1180 /* test for RTL8153-BND and RTL8153-BD */ 1181 1181 ocp_data = ocp_read_byte(tp, MCU_TYPE_USB, USB_MISC_1); 1182 - if ((ocp_data & BND_MASK) == 0 && (ocp_data & BD_MASK)) { 1182 + if ((ocp_data & BND_MASK) == 0 && (ocp_data & BD_MASK) == 0) { 1183 1183 netif_dbg(tp, probe, tp->netdev, 1184 1184 "Invalid variant for MAC pass through\n"); 1185 1185 return -ENODEV;
+3
drivers/net/vrf.c
··· 1273 1273 1274 1274 /* default to no qdisc; user can add if desired */ 1275 1275 dev->priv_flags |= IFF_NO_QUEUE; 1276 + 1277 + dev->min_mtu = 0; 1278 + dev->max_mtu = 0; 1276 1279 } 1277 1280 1278 1281 static int vrf_validate(struct nlattr *tb[], struct nlattr *data[],
+1 -1
drivers/net/wireless/mac80211_hwsim.c
··· 3554 3554 goto out_err; 3555 3555 } 3556 3556 3557 - genlmsg_reply(skb, info); 3557 + res = genlmsg_reply(skb, info); 3558 3558 break; 3559 3559 } 3560 3560
+8
include/linux/phy.h
··· 992 992 { 993 993 return 0; 994 994 } 995 + static inline int genphy_no_ack_interrupt(struct phy_device *phydev) 996 + { 997 + return 0; 998 + } 999 + static inline int genphy_no_config_intr(struct phy_device *phydev) 1000 + { 1001 + return 0; 1002 + } 995 1003 int genphy_read_mmd_unsupported(struct phy_device *phdev, int devad, 996 1004 u16 regnum); 997 1005 int genphy_write_mmd_unsupported(struct phy_device *phdev, int devnum,
+12 -2
include/linux/virtio_net.h
··· 61 61 /* gso packets without NEEDS_CSUM do not set transport_offset. 62 62 * probe and drop if does not match one of the above types. 63 63 */ 64 - if (gso_type) { 64 + if (gso_type && skb->network_header) { 65 + if (!skb->protocol) 66 + virtio_net_hdr_set_proto(skb, hdr); 67 + retry: 65 68 skb_probe_transport_header(skb, -1); 66 - if (!skb_transport_header_was_set(skb)) 69 + if (!skb_transport_header_was_set(skb)) { 70 + /* UFO does not specify ipv4 or 6: try both */ 71 + if (gso_type & SKB_GSO_UDP && 72 + skb->protocol == htons(ETH_P_IP)) { 73 + skb->protocol = htons(ETH_P_IPV6); 74 + goto retry; 75 + } 67 76 return -EINVAL; 77 + } 68 78 } 69 79 } 70 80
+3 -2
include/net/phonet/pep.h
··· 63 63 u8 state_after_reset; /* reset request */ 64 64 u8 error_code; /* any response */ 65 65 u8 pep_type; /* status indication */ 66 - u8 data[1]; 66 + u8 data0; /* anything else */ 67 67 }; 68 + u8 data[]; 68 69 }; 69 - #define other_pep_type data[1] 70 + #define other_pep_type data[0] 70 71 71 72 static inline struct pnpipehdr *pnp_hdr(struct sk_buff *skb) 72 73 {
+9 -3
include/net/xfrm.h
··· 853 853 xfrm_pol_put(pols[i]); 854 854 } 855 855 856 - void __xfrm_state_destroy(struct xfrm_state *); 856 + void __xfrm_state_destroy(struct xfrm_state *, bool); 857 857 858 858 static inline void __xfrm_state_put(struct xfrm_state *x) 859 859 { ··· 863 863 static inline void xfrm_state_put(struct xfrm_state *x) 864 864 { 865 865 if (refcount_dec_and_test(&x->refcnt)) 866 - __xfrm_state_destroy(x); 866 + __xfrm_state_destroy(x, false); 867 + } 868 + 869 + static inline void xfrm_state_put_sync(struct xfrm_state *x) 870 + { 871 + if (refcount_dec_and_test(&x->refcnt)) 872 + __xfrm_state_destroy(x, true); 867 873 } 868 874 869 875 static inline void xfrm_state_hold(struct xfrm_state *x) ··· 1596 1590 1597 1591 struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq); 1598 1592 int xfrm_state_delete(struct xfrm_state *x); 1599 - int xfrm_state_flush(struct net *net, u8 proto, bool task_valid); 1593 + int xfrm_state_flush(struct net *net, u8 proto, bool task_valid, bool sync); 1600 1594 int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_valid); 1601 1595 void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si); 1602 1596 void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si);
+1
kernel/bpf/lpm_trie.c
··· 471 471 } 472 472 473 473 if (!node || node->prefixlen != key->prefixlen || 474 + node->prefixlen != matchlen || 474 475 (node->flags & LPM_TREE_NODE_FLAG_IM)) { 475 476 ret = -ENOENT; 476 477 goto out;
+24 -21
net/bpf/test_run.c
··· 13 13 #include <net/sock.h> 14 14 #include <net/tcp.h> 15 15 16 - static __always_inline u32 bpf_test_run_one(struct bpf_prog *prog, void *ctx, 17 - struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE]) 18 - { 19 - u32 ret; 20 - 21 - preempt_disable(); 22 - rcu_read_lock(); 23 - bpf_cgroup_storage_set(storage); 24 - ret = BPF_PROG_RUN(prog, ctx); 25 - rcu_read_unlock(); 26 - preempt_enable(); 27 - 28 - return ret; 29 - } 30 - 31 - static int bpf_test_run(struct bpf_prog *prog, void *ctx, u32 repeat, u32 *ret, 32 - u32 *time) 16 + static int bpf_test_run(struct bpf_prog *prog, void *ctx, u32 repeat, 17 + u32 *retval, u32 *time) 33 18 { 34 19 struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE] = { 0 }; 35 20 enum bpf_cgroup_storage_type stype; 36 21 u64 time_start, time_spent = 0; 22 + int ret = 0; 37 23 u32 i; 38 24 39 25 for_each_cgroup_storage_type(stype) { ··· 34 48 35 49 if (!repeat) 36 50 repeat = 1; 51 + 52 + rcu_read_lock(); 53 + preempt_disable(); 37 54 time_start = ktime_get_ns(); 38 55 for (i = 0; i < repeat; i++) { 39 - *ret = bpf_test_run_one(prog, ctx, storage); 56 + bpf_cgroup_storage_set(storage); 57 + *retval = BPF_PROG_RUN(prog, ctx); 58 + 59 + if (signal_pending(current)) { 60 + ret = -EINTR; 61 + break; 62 + } 63 + 40 64 if (need_resched()) { 41 - if (signal_pending(current)) 42 - break; 43 65 time_spent += ktime_get_ns() - time_start; 66 + preempt_enable(); 67 + rcu_read_unlock(); 68 + 44 69 cond_resched(); 70 + 71 + rcu_read_lock(); 72 + preempt_disable(); 45 73 time_start = ktime_get_ns(); 46 74 } 47 75 } 48 76 time_spent += ktime_get_ns() - time_start; 77 + preempt_enable(); 78 + rcu_read_unlock(); 79 + 49 80 do_div(time_spent, repeat); 50 81 *time = time_spent > U32_MAX ? U32_MAX : (u32)time_spent; 51 82 52 83 for_each_cgroup_storage_type(stype) 53 84 bpf_cgroup_storage_free(storage[stype]); 54 85 55 - return 0; 86 + return ret; 56 87 } 57 88 58 89 static int bpf_test_finish(const union bpf_attr *kattr,
+1 -8
net/bridge/br_multicast.c
··· 1204 1204 return; 1205 1205 1206 1206 br_multicast_update_query_timer(br, query, max_delay); 1207 - 1208 - /* Based on RFC4541, section 2.1.1 IGMP Forwarding Rules, 1209 - * the arrival port for IGMP Queries where the source address 1210 - * is 0.0.0.0 should not be added to router port list. 1211 - */ 1212 - if ((saddr->proto == htons(ETH_P_IP) && saddr->u.ip4) || 1213 - saddr->proto == htons(ETH_P_IPV6)) 1214 - br_multicast_mark_router(br, port); 1207 + br_multicast_mark_router(br, port); 1215 1208 } 1216 1209 1217 1210 static void br_ip4_multicast_query(struct net_bridge *br,
+5 -1
net/compat.c
··· 388 388 char __user *optval, unsigned int optlen) 389 389 { 390 390 int err; 391 - struct socket *sock = sockfd_lookup(fd, &err); 391 + struct socket *sock; 392 392 393 + if (optlen > INT_MAX) 394 + return -EINVAL; 395 + 396 + sock = sockfd_lookup(fd, &err); 393 397 if (sock) { 394 398 err = security_socket_setsockopt(sock, level, optname); 395 399 if (err) {
+4 -3
net/dsa/port.c
··· 69 69 70 70 int dsa_port_enable(struct dsa_port *dp, struct phy_device *phy) 71 71 { 72 - u8 stp_state = dp->bridge_dev ? BR_STATE_BLOCKING : BR_STATE_FORWARDING; 73 72 struct dsa_switch *ds = dp->ds; 74 73 int port = dp->index; 75 74 int err; ··· 79 80 return err; 80 81 } 81 82 82 - dsa_port_set_state_now(dp, stp_state); 83 + if (!dp->bridge_dev) 84 + dsa_port_set_state_now(dp, BR_STATE_FORWARDING); 83 85 84 86 return 0; 85 87 } ··· 90 90 struct dsa_switch *ds = dp->ds; 91 91 int port = dp->index; 92 92 93 - dsa_port_set_state_now(dp, BR_STATE_DISABLED); 93 + if (!dp->bridge_dev) 94 + dsa_port_set_state_now(dp, BR_STATE_DISABLED); 94 95 95 96 if (ds->ops->port_disable) 96 97 ds->ops->port_disable(ds, port, phy);
+1 -1
net/ipv4/esp4.c
··· 328 328 skb->len += tailen; 329 329 skb->data_len += tailen; 330 330 skb->truesize += tailen; 331 - if (sk) 331 + if (sk && sk_fullsock(sk)) 332 332 refcount_add(tailen, &sk->sk_wmem_alloc); 333 333 334 334 goto out;
+17 -16
net/ipv4/ip_gre.c
··· 1457 1457 struct ip_tunnel_parm *p = &t->parms; 1458 1458 __be16 o_flags = p->o_flags; 1459 1459 1460 - if ((t->erspan_ver == 1 || t->erspan_ver == 2) && 1461 - !t->collect_md) 1462 - o_flags |= TUNNEL_KEY; 1460 + if (t->erspan_ver == 1 || t->erspan_ver == 2) { 1461 + if (!t->collect_md) 1462 + o_flags |= TUNNEL_KEY; 1463 + 1464 + if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, t->erspan_ver)) 1465 + goto nla_put_failure; 1466 + 1467 + if (t->erspan_ver == 1) { 1468 + if (nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, t->index)) 1469 + goto nla_put_failure; 1470 + } else { 1471 + if (nla_put_u8(skb, IFLA_GRE_ERSPAN_DIR, t->dir)) 1472 + goto nla_put_failure; 1473 + if (nla_put_u16(skb, IFLA_GRE_ERSPAN_HWID, t->hwid)) 1474 + goto nla_put_failure; 1475 + } 1476 + } 1463 1477 1464 1478 if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) || 1465 1479 nla_put_be16(skb, IFLA_GRE_IFLAGS, ··· 1506 1492 1507 1493 if (t->collect_md) { 1508 1494 if (nla_put_flag(skb, IFLA_GRE_COLLECT_METADATA)) 1509 - goto nla_put_failure; 1510 - } 1511 - 1512 - if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, t->erspan_ver)) 1513 - goto nla_put_failure; 1514 - 1515 - if (t->erspan_ver == 1) { 1516 - if (nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, t->index)) 1517 - goto nla_put_failure; 1518 - } else if (t->erspan_ver == 2) { 1519 - if (nla_put_u8(skb, IFLA_GRE_ERSPAN_DIR, t->dir)) 1520 - goto nla_put_failure; 1521 - if (nla_put_u16(skb, IFLA_GRE_ERSPAN_HWID, t->hwid)) 1522 1495 goto nla_put_failure; 1523 1496 } 1524 1497
+1
net/ipv4/tcp_output.c
··· 2347 2347 /* "skb_mstamp_ns" is used as a start point for the retransmit timer */ 2348 2348 skb->skb_mstamp_ns = tp->tcp_wstamp_ns = tp->tcp_clock_cache; 2349 2349 list_move_tail(&skb->tcp_tsorted_anchor, &tp->tsorted_sent_queue); 2350 + tcp_init_tso_segs(skb, mss_now); 2350 2351 goto repair; /* Skip network transmission */ 2351 2352 } 2352 2353
+4 -2
net/ipv4/udp.c
··· 562 562 563 563 for (i = 0; i < MAX_IPTUN_ENCAP_OPS; i++) { 564 564 int (*handler)(struct sk_buff *skb, u32 info); 565 + const struct ip_tunnel_encap_ops *encap; 565 566 566 - if (!iptun_encaps[i]) 567 + encap = rcu_dereference(iptun_encaps[i]); 568 + if (!encap) 567 569 continue; 568 - handler = rcu_dereference(iptun_encaps[i]->err_handler); 570 + handler = encap->err_handler; 569 571 if (handler && !handler(skb, info)) 570 572 return 0; 571 573 }
+1 -1
net/ipv6/esp6.c
··· 296 296 skb->len += tailen; 297 297 skb->data_len += tailen; 298 298 skb->truesize += tailen; 299 - if (sk) 299 + if (sk && sk_fullsock(sk)) 300 300 refcount_add(tailen, &sk->sk_wmem_alloc); 301 301 302 302 goto out;
+1 -1
net/ipv6/fou6.c
··· 72 72 73 73 static int gue6_err_proto_handler(int proto, struct sk_buff *skb, 74 74 struct inet6_skb_parm *opt, 75 - u8 type, u8 code, int offset, u32 info) 75 + u8 type, u8 code, int offset, __be32 info) 76 76 { 77 77 const struct inet6_protocol *ipprot; 78 78
+21 -18
net/ipv6/ip6_gre.c
··· 1722 1722 static void ip6erspan_set_version(struct nlattr *data[], 1723 1723 struct __ip6_tnl_parm *parms) 1724 1724 { 1725 + if (!data) 1726 + return; 1727 + 1725 1728 parms->erspan_ver = 1; 1726 1729 if (data[IFLA_GRE_ERSPAN_VER]) 1727 1730 parms->erspan_ver = nla_get_u8(data[IFLA_GRE_ERSPAN_VER]); ··· 2107 2104 struct __ip6_tnl_parm *p = &t->parms; 2108 2105 __be16 o_flags = p->o_flags; 2109 2106 2110 - if ((p->erspan_ver == 1 || p->erspan_ver == 2) && 2111 - !p->collect_md) 2112 - o_flags |= TUNNEL_KEY; 2107 + if (p->erspan_ver == 1 || p->erspan_ver == 2) { 2108 + if (!p->collect_md) 2109 + o_flags |= TUNNEL_KEY; 2110 + 2111 + if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, p->erspan_ver)) 2112 + goto nla_put_failure; 2113 + 2114 + if (p->erspan_ver == 1) { 2115 + if (nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, p->index)) 2116 + goto nla_put_failure; 2117 + } else { 2118 + if (nla_put_u8(skb, IFLA_GRE_ERSPAN_DIR, p->dir)) 2119 + goto nla_put_failure; 2120 + if (nla_put_u16(skb, IFLA_GRE_ERSPAN_HWID, p->hwid)) 2121 + goto nla_put_failure; 2122 + } 2123 + } 2113 2124 2114 2125 if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) || 2115 2126 nla_put_be16(skb, IFLA_GRE_IFLAGS, ··· 2138 2121 nla_put_u8(skb, IFLA_GRE_ENCAP_LIMIT, p->encap_limit) || 2139 2122 nla_put_be32(skb, IFLA_GRE_FLOWINFO, p->flowinfo) || 2140 2123 nla_put_u32(skb, IFLA_GRE_FLAGS, p->flags) || 2141 - nla_put_u32(skb, IFLA_GRE_FWMARK, p->fwmark) || 2142 - nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, p->index)) 2124 + nla_put_u32(skb, IFLA_GRE_FWMARK, p->fwmark)) 2143 2125 goto nla_put_failure; 2144 2126 2145 2127 if (nla_put_u16(skb, IFLA_GRE_ENCAP_TYPE, ··· 2153 2137 2154 2138 if (p->collect_md) { 2155 2139 if (nla_put_flag(skb, IFLA_GRE_COLLECT_METADATA)) 2156 - goto nla_put_failure; 2157 - } 2158 - 2159 - if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, p->erspan_ver)) 2160 - goto nla_put_failure; 2161 - 2162 - if (p->erspan_ver == 1) { 2163 - if (nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, p->index)) 2164 - goto nla_put_failure; 2165 - } else if (p->erspan_ver == 2) { 2166 - if (nla_put_u8(skb, IFLA_GRE_ERSPAN_DIR, p->dir)) 2167 - goto nla_put_failure; 2168 - if (nla_put_u16(skb, IFLA_GRE_ERSPAN_HWID, p->hwid)) 2169 2140 goto nla_put_failure; 2170 2141 } 2171 2142
+24 -8
net/ipv6/route.c
··· 1274 1274 static void rt6_remove_exception(struct rt6_exception_bucket *bucket, 1275 1275 struct rt6_exception *rt6_ex) 1276 1276 { 1277 + struct fib6_info *from; 1277 1278 struct net *net; 1278 1279 1279 1280 if (!bucket || !rt6_ex) 1280 1281 return; 1281 1282 1282 1283 net = dev_net(rt6_ex->rt6i->dst.dev); 1284 + net->ipv6.rt6_stats->fib_rt_cache--; 1285 + 1286 + /* purge completely the exception to allow releasing the held resources: 1287 + * some [sk] cache may keep the dst around for unlimited time 1288 + */ 1289 + from = rcu_dereference_protected(rt6_ex->rt6i->from, 1290 + lockdep_is_held(&rt6_exception_lock)); 1291 + rcu_assign_pointer(rt6_ex->rt6i->from, NULL); 1292 + fib6_info_release(from); 1293 + dst_dev_put(&rt6_ex->rt6i->dst); 1294 + 1283 1295 hlist_del_rcu(&rt6_ex->hlist); 1284 1296 dst_release(&rt6_ex->rt6i->dst); 1285 1297 kfree_rcu(rt6_ex, rcu); 1286 1298 WARN_ON_ONCE(!bucket->depth); 1287 1299 bucket->depth--; 1288 - net->ipv6.rt6_stats->fib_rt_cache--; 1289 1300 } 1290 1301 1291 1302 /* Remove oldest rt6_ex in bucket and free the memory ··· 1610 1599 static void rt6_update_exception_stamp_rt(struct rt6_info *rt) 1611 1600 { 1612 1601 struct rt6_exception_bucket *bucket; 1613 - struct fib6_info *from = rt->from; 1614 1602 struct in6_addr *src_key = NULL; 1615 1603 struct rt6_exception *rt6_ex; 1616 - 1617 - if (!from || 1618 - !(rt->rt6i_flags & RTF_CACHE)) 1619 - return; 1604 + struct fib6_info *from; 1620 1605 1621 1606 rcu_read_lock(); 1607 + from = rcu_dereference(rt->from); 1608 + if (!from || !(rt->rt6i_flags & RTF_CACHE)) 1609 + goto unlock; 1610 + 1622 1611 bucket = rcu_dereference(from->rt6i_exception_bucket); 1623 1612 1624 1613 #ifdef CONFIG_IPV6_SUBTREES ··· 1637 1626 if (rt6_ex) 1638 1627 rt6_ex->stamp = jiffies; 1639 1628 1629 + unlock: 1640 1630 rcu_read_unlock(); 1641 1631 } 1642 1632 ··· 2754 2742 u32 tbid = l3mdev_fib_table(dev) ? : RT_TABLE_MAIN; 2755 2743 const struct in6_addr *gw_addr = &cfg->fc_gateway; 2756 2744 u32 flags = RTF_LOCAL | RTF_ANYCAST | RTF_REJECT; 2745 + struct fib6_info *from; 2757 2746 struct rt6_info *grt; 2758 2747 int err; 2759 2748 2760 2749 err = 0; 2761 2750 grt = ip6_nh_lookup_table(net, cfg, gw_addr, tbid, 0); 2762 2751 if (grt) { 2752 + rcu_read_lock(); 2753 + from = rcu_dereference(grt->from); 2763 2754 if (!grt->dst.error && 2764 2755 /* ignore match if it is the default route */ 2765 - grt->from && !ipv6_addr_any(&grt->from->fib6_dst.addr) && 2756 + from && !ipv6_addr_any(&from->fib6_dst.addr) && 2766 2757 (grt->rt6i_flags & flags || dev != grt->dst.dev)) { 2767 2758 NL_SET_ERR_MSG(extack, 2768 2759 "Nexthop has invalid gateway or device mismatch"); 2769 2760 err = -EINVAL; 2770 2761 } 2762 + rcu_read_unlock(); 2771 2763 2772 2764 ip6_rt_put(grt); 2773 2765 } ··· 4665 4649 table = rt->fib6_table->tb6_id; 4666 4650 else 4667 4651 table = RT6_TABLE_UNSPEC; 4668 - rtm->rtm_table = table; 4652 + rtm->rtm_table = table < 256 ? table : RT_TABLE_COMPAT; 4669 4653 if (nla_put_u32(skb, RTA_TABLE, table)) 4670 4654 goto nla_put_failure; 4671 4655
+7 -5
net/ipv6/udp.c
··· 288 288 int peeked, peeking, off; 289 289 int err; 290 290 int is_udplite = IS_UDPLITE(sk); 291 + struct udp_mib __percpu *mib; 291 292 bool checksum_valid = false; 292 - struct udp_mib *mib; 293 293 int is_udp4; 294 294 295 295 if (flags & MSG_ERRQUEUE) ··· 420 420 */ 421 421 static int __udp6_lib_err_encap_no_sk(struct sk_buff *skb, 422 422 struct inet6_skb_parm *opt, 423 - u8 type, u8 code, int offset, u32 info) 423 + u8 type, u8 code, int offset, __be32 info) 424 424 { 425 425 int i; 426 426 427 427 for (i = 0; i < MAX_IPTUN_ENCAP_OPS; i++) { 428 428 int (*handler)(struct sk_buff *skb, struct inet6_skb_parm *opt, 429 - u8 type, u8 code, int offset, u32 info); 429 + u8 type, u8 code, int offset, __be32 info); 430 + const struct ip6_tnl_encap_ops *encap; 430 431 431 - if (!ip6tun_encaps[i]) 432 + encap = rcu_dereference(ip6tun_encaps[i]); 433 + if (!encap) 432 434 continue; 433 - handler = rcu_dereference(ip6tun_encaps[i]->err_handler); 435 + handler = encap->err_handler; 434 436 if (handler && !handler(skb, opt, type, code, offset, info)) 435 437 return 0; 436 438 }
+1 -1
net/ipv6/xfrm6_tunnel.c
··· 344 344 struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net); 345 345 unsigned int i; 346 346 347 - xfrm_state_flush(net, IPSEC_PROTO_ANY, false); 348 347 xfrm_flush_gc(); 348 + xfrm_state_flush(net, IPSEC_PROTO_ANY, false, true); 349 349 350 350 for (i = 0; i < XFRM6_TUNNEL_SPI_BYADDR_HSIZE; i++) 351 351 WARN_ON_ONCE(!hlist_empty(&xfrm6_tn->spi_byaddr[i]));
+16 -26
net/key/af_key.c
··· 196 196 return 0; 197 197 } 198 198 199 - static int pfkey_broadcast_one(struct sk_buff *skb, struct sk_buff **skb2, 200 - gfp_t allocation, struct sock *sk) 199 + static int pfkey_broadcast_one(struct sk_buff *skb, gfp_t allocation, 200 + struct sock *sk) 201 201 { 202 202 int err = -ENOBUFS; 203 203 204 - sock_hold(sk); 205 - if (*skb2 == NULL) { 206 - if (refcount_read(&skb->users) != 1) { 207 - *skb2 = skb_clone(skb, allocation); 208 - } else { 209 - *skb2 = skb; 210 - refcount_inc(&skb->users); 211 - } 204 + if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf) 205 + return err; 206 + 207 + skb = skb_clone(skb, allocation); 208 + 209 + if (skb) { 210 + skb_set_owner_r(skb, sk); 211 + skb_queue_tail(&sk->sk_receive_queue, skb); 212 + sk->sk_data_ready(sk); 213 + err = 0; 212 214 } 213 - if (*skb2 != NULL) { 214 - if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf) { 215 - skb_set_owner_r(*skb2, sk); 216 - skb_queue_tail(&sk->sk_receive_queue, *skb2); 217 - sk->sk_data_ready(sk); 218 - *skb2 = NULL; 219 - err = 0; 220 - } 221 - } 222 - sock_put(sk); 223 215 return err; 224 216 } 225 217 ··· 226 234 { 227 235 struct netns_pfkey *net_pfkey = net_generic(net, pfkey_net_id); 228 236 struct sock *sk; 229 - struct sk_buff *skb2 = NULL; 230 237 int err = -ESRCH; 231 238 232 239 /* XXX Do we need something like netlink_overrun? I think ··· 244 253 * socket. 245 254 */ 246 255 if (pfk->promisc) 247 - pfkey_broadcast_one(skb, &skb2, GFP_ATOMIC, sk); 256 + pfkey_broadcast_one(skb, GFP_ATOMIC, sk); 248 257 249 258 /* the exact target will be processed later */ 250 259 if (sk == one_sk) ··· 259 268 continue; 260 269 } 261 270 262 - err2 = pfkey_broadcast_one(skb, &skb2, GFP_ATOMIC, sk); 271 + err2 = pfkey_broadcast_one(skb, GFP_ATOMIC, sk); 263 272 264 273 /* Error is cleared after successful sending to at least one 265 274 * registered KM */ ··· 269 278 rcu_read_unlock(); 270 279 271 280 if (one_sk != NULL) 272 - err = pfkey_broadcast_one(skb, &skb2, allocation, one_sk); 281 + err = pfkey_broadcast_one(skb, allocation, one_sk); 273 282 274 - kfree_skb(skb2); 275 283 kfree_skb(skb); 276 284 return err; 277 285 } ··· 1773 1783 if (proto == 0) 1774 1784 return -EINVAL; 1775 1785 1776 - err = xfrm_state_flush(net, proto, true); 1786 + err = xfrm_state_flush(net, proto, true, false); 1777 1787 err2 = unicast_flush_resp(sk, hdr); 1778 1788 if (err || err2) { 1779 1789 if (err == -ESRCH) /* empty table - go quietly */
+2 -2
net/mac80211/main.c
··· 615 615 * We need a bit of data queued to build aggregates properly, so 616 616 * instruct the TCP stack to allow more than a single ms of data 617 617 * to be queued in the stack. The value is a bit-shift of 1 618 - * second, so 8 is ~4ms of queued data. Only affects local TCP 618 + * second, so 7 is ~8ms of queued data. Only affects local TCP 619 619 * sockets. 620 620 * This is the default, anyhow - drivers may need to override it 621 621 * for local reasons (longer buffers, longer completion time, or 622 622 * similar). 623 623 */ 624 - local->hw.tx_sk_pacing_shift = 8; 624 + local->hw.tx_sk_pacing_shift = 7; 625 625 626 626 /* set up some defaults */ 627 627 local->hw.queues = 1;
+6 -1
net/mac80211/rx.c
··· 2644 2644 struct ieee80211_sub_if_data *sdata = rx->sdata; 2645 2645 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; 2646 2646 u16 ac, q, hdrlen; 2647 + int tailroom = 0; 2647 2648 2648 2649 hdr = (struct ieee80211_hdr *) skb->data; 2649 2650 hdrlen = ieee80211_hdrlen(hdr->frame_control); ··· 2733 2732 if (!ifmsh->mshcfg.dot11MeshForwarding) 2734 2733 goto out; 2735 2734 2735 + if (sdata->crypto_tx_tailroom_needed_cnt) 2736 + tailroom = IEEE80211_ENCRYPT_TAILROOM; 2737 + 2736 2738 fwd_skb = skb_copy_expand(skb, local->tx_headroom + 2737 - sdata->encrypt_headroom, 0, GFP_ATOMIC); 2739 + sdata->encrypt_headroom, 2740 + tailroom, GFP_ATOMIC); 2738 2741 if (!fwd_skb) 2739 2742 goto out; 2740 2743
+16 -16
net/phonet/pep.c
··· 132 132 ph->utid = 0; 133 133 ph->message_id = id; 134 134 ph->pipe_handle = pn->pipe_handle; 135 - ph->data[0] = code; 135 + ph->error_code = code; 136 136 return pn_skb_send(sk, skb, NULL); 137 137 } 138 138 ··· 153 153 ph->utid = id; /* whatever */ 154 154 ph->message_id = id; 155 155 ph->pipe_handle = pn->pipe_handle; 156 - ph->data[0] = code; 156 + ph->error_code = code; 157 157 return pn_skb_send(sk, skb, NULL); 158 158 } 159 159 ··· 208 208 struct pnpipehdr *ph; 209 209 struct sockaddr_pn dst; 210 210 u8 data[4] = { 211 - oph->data[0], /* PEP type */ 211 + oph->pep_type, /* PEP type */ 212 212 code, /* error code, at an unusual offset */ 213 213 PAD, PAD, 214 214 }; ··· 221 221 ph->utid = oph->utid; 222 222 ph->message_id = PNS_PEP_CTRL_RESP; 223 223 ph->pipe_handle = oph->pipe_handle; 224 - ph->data[0] = oph->data[1]; /* CTRL id */ 224 + ph->data0 = oph->data[0]; /* CTRL id */ 225 225 226 226 pn_skb_get_src_sockaddr(oskb, &dst); 227 227 return pn_skb_send(sk, skb, &dst); ··· 272 272 return -EINVAL; 273 273 274 274 hdr = pnp_hdr(skb); 275 - if (hdr->data[0] != PN_PEP_TYPE_COMMON) { 275 + if (hdr->pep_type != PN_PEP_TYPE_COMMON) { 276 276 net_dbg_ratelimited("Phonet unknown PEP type: %u\n", 277 - (unsigned int)hdr->data[0]); 277 + (unsigned int)hdr->pep_type); 278 278 return -EOPNOTSUPP; 279 279 } 280 280 281 - switch (hdr->data[1]) { 281 + switch (hdr->data[0]) { 282 282 case PN_PEP_IND_FLOW_CONTROL: 283 283 switch (pn->tx_fc) { 284 284 case PN_LEGACY_FLOW_CONTROL: 285 - switch (hdr->data[4]) { 285 + switch (hdr->data[3]) { 286 286 case PEP_IND_BUSY: 287 287 atomic_set(&pn->tx_credits, 0); 288 288 break; ··· 292 292 } 293 293 break; 294 294 case PN_ONE_CREDIT_FLOW_CONTROL: 295 - if (hdr->data[4] == PEP_IND_READY) 295 + if (hdr->data[3] == PEP_IND_READY) 296 296 atomic_set(&pn->tx_credits, wake = 1); 297 297 break; 298 298 } ··· 301 301 case PN_PEP_IND_ID_MCFC_GRANT_CREDITS: 302 302 if (pn->tx_fc != PN_MULTI_CREDIT_FLOW_CONTROL) 303 303 break; 304 - atomic_add(wake = hdr->data[4], &pn->tx_credits); 304 + atomic_add(wake = hdr->data[3], &pn->tx_credits); 305 305 break; 306 306 307 307 default: 308 308 net_dbg_ratelimited("Phonet unknown PEP indication: %u\n", 309 - (unsigned int)hdr->data[1]); 309 + (unsigned int)hdr->data[0]); 310 310 return -EOPNOTSUPP; 311 311 } 312 312 if (wake) ··· 318 318 { 319 319 struct pep_sock *pn = pep_sk(sk); 320 320 struct pnpipehdr *hdr = pnp_hdr(skb); 321 - u8 n_sb = hdr->data[0]; 321 + u8 n_sb = hdr->data0; 322 322 323 323 pn->rx_fc = pn->tx_fc = PN_LEGACY_FLOW_CONTROL; 324 324 __skb_pull(skb, sizeof(*hdr)); ··· 506 506 return -ECONNREFUSED; 507 507 508 508 /* Parse sub-blocks */ 509 - n_sb = hdr->data[4]; 509 + n_sb = hdr->data[3]; 510 510 while (n_sb > 0) { 511 511 u8 type, buf[6], len = sizeof(buf); 512 512 const u8 *data = pep_get_sb(skb, &type, &len, buf); ··· 739 739 ph->utid = 0; 740 740 ph->message_id = PNS_PIPE_REMOVE_REQ; 741 741 ph->pipe_handle = pn->pipe_handle; 742 - ph->data[0] = PAD; 742 + ph->data0 = PAD; 743 743 return pn_skb_send(sk, skb, NULL); 744 744 } 745 745 ··· 817 817 peer_type = hdr->other_pep_type << 8; 818 818 819 819 /* Parse sub-blocks (options) */ 820 - n_sb = hdr->data[4]; 820 + n_sb = hdr->data[3]; 821 821 while (n_sb > 0) { 822 822 u8 type, buf[1], len = sizeof(buf); 823 823 const u8 *data = pep_get_sb(skb, &type, &len, buf); ··· 1109 1109 ph->utid = 0; 1110 1110 if (pn->aligned) { 1111 1111 ph->message_id = PNS_PIPE_ALIGNED_DATA; 1112 - ph->data[0] = 0; /* padding */ 1112 + ph->data0 = 0; /* padding */ 1113 1113 } else 1114 1114 ph->message_id = PNS_PIPE_DATA; 1115 1115 ph->pipe_handle = pn->pipe_handle;
+2 -1
net/sctp/transport.c
··· 207 207 208 208 /* When a data chunk is sent, reset the heartbeat interval. */ 209 209 expires = jiffies + sctp_transport_timeout(transport); 210 - if (time_before(transport->hb_timer.expires, expires) && 210 + if ((time_before(transport->hb_timer.expires, expires) || 211 + !timer_pending(&transport->hb_timer)) && 211 212 !mod_timer(&transport->hb_timer, 212 213 expires + prandom_u32_max(transport->rto))) 213 214 sctp_transport_hold(transport);
+3 -3
net/smc/smc.h
··· 113 113 } __aligned(8); 114 114 115 115 enum smc_urg_state { 116 - SMC_URG_VALID, /* data present */ 117 - SMC_URG_NOTYET, /* data pending */ 118 - SMC_URG_READ /* data was already read */ 116 + SMC_URG_VALID = 1, /* data present */ 117 + SMC_URG_NOTYET = 2, /* data pending */ 118 + SMC_URG_READ = 3, /* data was already read */ 119 119 }; 120 120 121 121 struct smc_connection {
+6 -5
net/tipc/socket.c
··· 388 388 rc_ = tipc_sk_sock_err((sock_), timeo_); \ 389 389 if (rc_) \ 390 390 break; \ 391 - prepare_to_wait(sk_sleep(sk_), &wait_, TASK_INTERRUPTIBLE); \ 391 + add_wait_queue(sk_sleep(sk_), &wait_); \ 392 392 release_sock(sk_); \ 393 393 *(timeo_) = wait_woken(&wait_, TASK_INTERRUPTIBLE, *(timeo_)); \ 394 394 sched_annotate_sleep(); \ ··· 1677 1677 static int tipc_wait_for_rcvmsg(struct socket *sock, long *timeop) 1678 1678 { 1679 1679 struct sock *sk = sock->sk; 1680 - DEFINE_WAIT(wait); 1680 + DEFINE_WAIT_FUNC(wait, woken_wake_function); 1681 1681 long timeo = *timeop; 1682 1682 int err = sock_error(sk); 1683 1683 ··· 1685 1685 return err; 1686 1686 1687 1687 for (;;) { 1688 - prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE); 1689 1688 if (timeo && skb_queue_empty(&sk->sk_receive_queue)) { 1690 1689 if (sk->sk_shutdown & RCV_SHUTDOWN) { 1691 1690 err = -ENOTCONN; 1692 1691 break; 1693 1692 } 1693 + add_wait_queue(sk_sleep(sk), &wait); 1694 1694 release_sock(sk); 1695 - timeo = schedule_timeout(timeo); 1695 + timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo); 1696 + sched_annotate_sleep(); 1696 1697 lock_sock(sk); 1698 + remove_wait_queue(sk_sleep(sk), &wait); 1697 1699 } 1698 1700 err = 0; 1699 1701 if (!skb_queue_empty(&sk->sk_receive_queue)) ··· 1711 1709 if (err) 1712 1710 break; 1713 1711 } 1714 - finish_wait(sk_sleep(sk), &wait); 1715 1712 *timeop = timeo; 1716 1713 return err; 1717 1714 }
+34 -25
net/unix/af_unix.c
··· 890 890 addr->hash ^= sk->sk_type; 891 891 892 892 __unix_remove_socket(sk); 893 - u->addr = addr; 893 + smp_store_release(&u->addr, addr); 894 894 __unix_insert_socket(&unix_socket_table[addr->hash], sk); 895 895 spin_unlock(&unix_table_lock); 896 896 err = 0; ··· 1060 1060 1061 1061 err = 0; 1062 1062 __unix_remove_socket(sk); 1063 - u->addr = addr; 1063 + smp_store_release(&u->addr, addr); 1064 1064 __unix_insert_socket(list, sk); 1065 1065 1066 1066 out_unlock: ··· 1331 1331 RCU_INIT_POINTER(newsk->sk_wq, &newu->peer_wq); 1332 1332 otheru = unix_sk(other); 1333 1333 1334 - /* copy address information from listening to new sock*/ 1335 - if (otheru->addr) { 1336 - refcount_inc(&otheru->addr->refcnt); 1337 - newu->addr = otheru->addr; 1338 - } 1334 + /* copy address information from listening to new sock 1335 + * 1336 + * The contents of *(otheru->addr) and otheru->path 1337 + * are seen fully set up here, since we have found 1338 + * otheru in hash under unix_table_lock. Insertion 1339 + * into the hash chain we'd found it in had been done 1340 + * in an earlier critical area protected by unix_table_lock, 1341 + * the same one where we'd set *(otheru->addr) contents, 1342 + * as well as otheru->path and otheru->addr itself. 1343 + * 1344 + * Using smp_store_release() here to set newu->addr 1345 + * is enough to make those stores, as well as stores 1346 + * to newu->path visible to anyone who gets newu->addr 1347 + * by smp_load_acquire(). IOW, the same warranties 1348 + * as for unix_sock instances bound in unix_bind() or 1349 + * in unix_autobind(). 1350 + */ 1339 1351 if (otheru->path.dentry) { 1340 1352 path_get(&otheru->path); 1341 1353 newu->path = otheru->path; 1342 1354 } 1355 + refcount_inc(&otheru->addr->refcnt); 1356 + smp_store_release(&newu->addr, otheru->addr); 1343 1357 1344 1358 /* Set credentials */ 1345 1359 copy_peercred(sk, other); ··· 1467 1453 static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int peer) 1468 1454 { 1469 1455 struct sock *sk = sock->sk; 1470 - struct unix_sock *u; 1456 + struct unix_address *addr; 1471 1457 DECLARE_SOCKADDR(struct sockaddr_un *, sunaddr, uaddr); 1472 1458 int err = 0; 1473 1459 ··· 1482 1468 sock_hold(sk); 1483 1469 } 1484 1470 1485 - u = unix_sk(sk); 1486 - unix_state_lock(sk); 1487 - if (!u->addr) { 1471 + addr = smp_load_acquire(&unix_sk(sk)->addr); 1472 + if (!addr) { 1488 1473 sunaddr->sun_family = AF_UNIX; 1489 1474 sunaddr->sun_path[0] = 0; 1490 1475 err = sizeof(short); 1491 1476 } else { 1492 - struct unix_address *addr = u->addr; 1493 - 1494 1477 err = addr->len; 1495 1478 memcpy(sunaddr, addr->name, addr->len); 1496 1479 } 1497 - unix_state_unlock(sk); 1498 1480 sock_put(sk); 1499 1481 out: 1500 1482 return err; ··· 2083 2073 2084 2074 static void unix_copy_addr(struct msghdr *msg, struct sock *sk) 2085 2075 { 2086 - struct unix_sock *u = unix_sk(sk); 2076 + struct unix_address *addr = smp_load_acquire(&unix_sk(sk)->addr); 2087 2077 2088 - if (u->addr) { 2089 - msg->msg_namelen = u->addr->len; 2090 - memcpy(msg->msg_name, u->addr->name, u->addr->len); 2078 + if (addr) { 2079 + msg->msg_namelen = addr->len; 2080 + memcpy(msg->msg_name, addr->name, addr->len); 2091 2081 } 2092 2082 } 2093 2083 ··· 2591 2581 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) 2592 2582 return -EPERM; 2593 2583 2594 - unix_state_lock(sk); 2595 - path = unix_sk(sk)->path; 2596 - if (!path.dentry) { 2597 - unix_state_unlock(sk); 2584 + if (!smp_load_acquire(&unix_sk(sk)->addr)) 2598 2585 return -ENOENT; 2599 - } 2586 + 2587 + path = unix_sk(sk)->path; 2588 + if (!path.dentry) 2589 + return -ENOENT; 2600 2590 2601 2591 path_get(&path); 2602 - unix_state_unlock(sk); 2603 2592 2604 2593 fd = get_unused_fd_flags(O_CLOEXEC); 2605 2594 if (fd < 0) ··· 2839 2830 (s->sk_state == TCP_ESTABLISHED ? SS_CONNECTING : SS_DISCONNECTING), 2840 2831 sock_i_ino(s)); 2841 2832 2842 - if (u->addr) { 2833 + if (u->addr) { // under unix_table_lock here 2843 2834 int i, len; 2844 2835 seq_putc(seq, ' '); 2845 2836
+2 -1
net/unix/diag.c
··· 10 10 11 11 static int sk_diag_dump_name(struct sock *sk, struct sk_buff *nlskb) 12 12 { 13 - struct unix_address *addr = unix_sk(sk)->addr; 13 + /* might or might not have unix_table_lock */ 14 + struct unix_address *addr = smp_load_acquire(&unix_sk(sk)->addr); 14 15 15 16 if (!addr) 16 17 return 0;
+8 -5
net/x25/af_x25.c
··· 679 679 struct sockaddr_x25 *addr = (struct sockaddr_x25 *)uaddr; 680 680 int len, i, rc = 0; 681 681 682 - if (!sock_flag(sk, SOCK_ZAPPED) || 683 - addr_len != sizeof(struct sockaddr_x25) || 682 + if (addr_len != sizeof(struct sockaddr_x25) || 684 683 addr->sx25_family != AF_X25) { 685 684 rc = -EINVAL; 686 685 goto out; ··· 698 699 } 699 700 700 701 lock_sock(sk); 701 - x25_sk(sk)->source_addr = addr->sx25_addr; 702 - x25_insert_socket(sk); 703 - sock_reset_flag(sk, SOCK_ZAPPED); 702 + if (sock_flag(sk, SOCK_ZAPPED)) { 703 + x25_sk(sk)->source_addr = addr->sx25_addr; 704 + x25_insert_socket(sk); 705 + sock_reset_flag(sk, SOCK_ZAPPED); 706 + } else { 707 + rc = -EINVAL; 708 + } 704 709 release_sock(sk); 705 710 SOCK_DEBUG(sk, "x25_bind: socket is bound\n"); 706 711 out:
+15 -1
net/xdp/xsk.c
··· 366 366 367 367 xskq_destroy(xs->rx); 368 368 xskq_destroy(xs->tx); 369 - xdp_put_umem(xs->umem); 370 369 371 370 sock_orphan(sk); 372 371 sock->sk = NULL; ··· 717 718 .sendpage = sock_no_sendpage, 718 719 }; 719 720 721 + static void xsk_destruct(struct sock *sk) 722 + { 723 + struct xdp_sock *xs = xdp_sk(sk); 724 + 725 + if (!sock_flag(sk, SOCK_DEAD)) 726 + return; 727 + 728 + xdp_put_umem(xs->umem); 729 + 730 + sk_refcnt_debug_dec(sk); 731 + } 732 + 720 733 static int xsk_create(struct net *net, struct socket *sock, int protocol, 721 734 int kern) 722 735 { ··· 754 743 sock_init_data(sock, sk); 755 744 756 745 sk->sk_family = PF_XDP; 746 + 747 + sk->sk_destruct = xsk_destruct; 748 + sk_refcnt_debug_inc(sk); 757 749 758 750 sock_set_flag(sk, SOCK_RCU_FREE); 759 751
+2 -2
net/xfrm/xfrm_interface.c
··· 76 76 int ifindex; 77 77 struct xfrm_if *xi; 78 78 79 - if (!skb->dev) 79 + if (!secpath_exists(skb) || !skb->dev) 80 80 return NULL; 81 81 82 - xfrmn = net_generic(dev_net(skb->dev), xfrmi_net_id); 82 + xfrmn = net_generic(xs_net(xfrm_input_state(skb)), xfrmi_net_id); 83 83 ifindex = skb->dev->ifindex; 84 84 85 85 for_each_xfrmi_rcu(xfrmn->xfrmi[0], xi) {
+3 -1
net/xfrm/xfrm_policy.c
··· 3314 3314 3315 3315 if (ifcb) { 3316 3316 xi = ifcb->decode_session(skb); 3317 - if (xi) 3317 + if (xi) { 3318 3318 if_id = xi->p.if_id; 3319 + net = xi->net; 3320 + } 3319 3321 } 3320 3322 rcu_read_unlock(); 3321 3323
+19 -11
net/xfrm/xfrm_state.c
··· 432 432 } 433 433 EXPORT_SYMBOL(xfrm_state_free); 434 434 435 - static void xfrm_state_gc_destroy(struct xfrm_state *x) 435 + static void ___xfrm_state_destroy(struct xfrm_state *x) 436 436 { 437 437 tasklet_hrtimer_cancel(&x->mtimer); 438 438 del_timer_sync(&x->rtimer); ··· 474 474 synchronize_rcu(); 475 475 476 476 hlist_for_each_entry_safe(x, tmp, &gc_list, gclist) 477 - xfrm_state_gc_destroy(x); 477 + ___xfrm_state_destroy(x); 478 478 } 479 479 480 480 static enum hrtimer_restart xfrm_timer_handler(struct hrtimer *me) ··· 598 598 } 599 599 EXPORT_SYMBOL(xfrm_state_alloc); 600 600 601 - void __xfrm_state_destroy(struct xfrm_state *x) 601 + void __xfrm_state_destroy(struct xfrm_state *x, bool sync) 602 602 { 603 603 WARN_ON(x->km.state != XFRM_STATE_DEAD); 604 604 605 - spin_lock_bh(&xfrm_state_gc_lock); 606 - hlist_add_head(&x->gclist, &xfrm_state_gc_list); 607 - spin_unlock_bh(&xfrm_state_gc_lock); 608 - schedule_work(&xfrm_state_gc_work); 605 + if (sync) { 606 + synchronize_rcu(); 607 + ___xfrm_state_destroy(x); 608 + } else { 609 + spin_lock_bh(&xfrm_state_gc_lock); 610 + hlist_add_head(&x->gclist, &xfrm_state_gc_list); 611 + spin_unlock_bh(&xfrm_state_gc_lock); 612 + schedule_work(&xfrm_state_gc_work); 613 + } 609 614 } 610 615 EXPORT_SYMBOL(__xfrm_state_destroy); 611 616 ··· 713 708 } 714 709 #endif 715 710 716 - int xfrm_state_flush(struct net *net, u8 proto, bool task_valid) 711 + int xfrm_state_flush(struct net *net, u8 proto, bool task_valid, bool sync) 717 712 { 718 713 int i, err = 0, cnt = 0; 719 714 ··· 735 730 err = xfrm_state_delete(x); 736 731 xfrm_audit_state_delete(x, err ? 0 : 1, 737 732 task_valid); 738 - xfrm_state_put(x); 733 + if (sync) 734 + xfrm_state_put_sync(x); 735 + else 736 + xfrm_state_put(x); 739 737 if (!err) 740 738 cnt++; 741 739 ··· 2223 2215 if (atomic_read(&t->tunnel_users) == 2) 2224 2216 xfrm_state_delete(t); 2225 2217 atomic_dec(&t->tunnel_users); 2226 - xfrm_state_put(t); 2218 + xfrm_state_put_sync(t); 2227 2219 x->tunnel = NULL; 2228 2220 } 2229 2221 } ··· 2383 2375 unsigned int sz; 2384 2376 2385 2377 flush_work(&net->xfrm.state_hash_work); 2386 - xfrm_state_flush(net, IPSEC_PROTO_ANY, false); 2387 2378 flush_work(&xfrm_state_gc_work); 2379 + xfrm_state_flush(net, IPSEC_PROTO_ANY, false, true); 2388 2380 2389 2381 WARN_ON(!list_empty(&net->xfrm.state_all)); 2390 2382
+1 -1
net/xfrm/xfrm_user.c
··· 1932 1932 struct xfrm_usersa_flush *p = nlmsg_data(nlh); 1933 1933 int err; 1934 1934 1935 - err = xfrm_state_flush(net, p->proto, true); 1935 + err = xfrm_state_flush(net, p->proto, true, false); 1936 1936 if (err) { 1937 1937 if (err == -ESRCH) /* empty table */ 1938 1938 return 0;
+6 -4
security/lsm_audit.c
··· 321 321 if (a->u.net->sk) { 322 322 struct sock *sk = a->u.net->sk; 323 323 struct unix_sock *u; 324 + struct unix_address *addr; 324 325 int len = 0; 325 326 char *p = NULL; 326 327 ··· 352 351 #endif 353 352 case AF_UNIX: 354 353 u = unix_sk(sk); 354 + addr = smp_load_acquire(&u->addr); 355 + if (!addr) 356 + break; 355 357 if (u->path.dentry) { 356 358 audit_log_d_path(ab, " path=", &u->path); 357 359 break; 358 360 } 359 - if (!u->addr) 360 - break; 361 - len = u->addr->len-sizeof(short); 362 - p = &u->addr->name->sun_path[0]; 361 + len = addr->len-sizeof(short); 362 + p = &addr->name->sun_path[0]; 363 363 audit_log_format(ab, " path="); 364 364 if (*p) 365 365 audit_log_untrustedstring(ab, p);
+10
tools/testing/selftests/bpf/test_lpm_map.c
··· 474 474 assert(bpf_map_lookup_elem(map_fd, key, &value) == -1 && 475 475 errno == ENOENT); 476 476 477 + key->prefixlen = 30; // unused prefix so far 478 + inet_pton(AF_INET, "192.255.0.0", key->data); 479 + assert(bpf_map_delete_elem(map_fd, key) == -1 && 480 + errno == ENOENT); 481 + 482 + key->prefixlen = 16; // same prefix as the root node 483 + inet_pton(AF_INET, "192.255.0.0", key->data); 484 + assert(bpf_map_delete_elem(map_fd, key) == -1 && 485 + errno == ENOENT); 486 + 477 487 /* assert initial lookup */ 478 488 key->prefixlen = 32; 479 489 inet_pton(AF_INET, "192.168.0.1", key->data);
+1
tools/testing/selftests/net/fib_tests.sh
··· 388 388 389 389 set -e 390 390 $IP link set dev dummy0 carrier off 391 + sleep 1 391 392 set +e 392 393 393 394 echo " Carrier down"