tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:
"Some more fixes trickled in over the past few days:

1) PIM device names can overflow the IFNAMSIZ buffer unless we
properly limit the allowed indexes, fix from Eric Dumazet.

2) Under heavy load we can OOPS in icmp reply processing due to an
unchecked inet_putpeer() call. Fix from Neal Cardwell.

3) SCTP round trip calculations need to use 64-bit math to avoid
overflows, fix from Schoch Christian.

4) Fix a memory leak and an error return flub in SCTP and IRDA
triggerable by userspace. Fix from Tommi Rantala and found by the
syscall fuzzer (trinity).

5) MLX4 driver gives bogus size to memcpy() call, fix from Amir
Vadai.

6) Fix length calculation in VHOST descriptor translation, from
Michael S Tsirkin.

7) Ambassador ATM driver loops forever while loading firmware, fix
from Dan Carpenter.

8) Over MTU packets in openvswitch warn about wrong device, fix from
Jesse Gross.

9) Netfilter IPSET's netlink code can overrun a string buffer because
it's not properly limited to IFNAMSIZ. Fix from Florian Westphal.

10) PCAN USB driver sets wrong timestamp in SKB, from Oliver Hartkopp.

11) Make sure the RX ifindex always has a valid value in the CAN BCM
driver, even if we haven't received a frame yet. Fix also from
Oliver Hartkopp."

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
team: fix hw_features setup
atm: forever loop loading ambassador firmware
vhost: fix length for cross region descriptor
irda: irttp: fix memory leak in irttp_open_tsap() error path
net: qmi_wwan: add Huawei E173
net/mlx4_en: Can set maxrate only for TC0
sctp: Error in calculation of RTTvar
sctp: fix -ENOMEM result with invalid user space pointer in sendto() syscall
sctp: fix memory leak in sctp_datamsg_from_user() when copy from user space fails
net: ipmr: limit MRT_TABLE identifiers
ipv4: avoid passing NULL to inet_putpeer() in icmpv4_xrlim_allow()
can: bcm: initialize ifindex for timeouts without previous frame reception
can: peak_usb: fix hwtstamp assignment
netfilter: ipset: fix netiface set name overflow
openvswitch: Store flow key len if ARP opcode is not request or reply.
openvswitch: Print device when warning about over MTU packets.

Linus Torvalds e9296e89 4b05a1c7

+53 -28
+1
drivers/atm/ambassador.c
··· 1961 1961 res = loader_verify(lb, dev, rec); 1962 1962 if (res) 1963 1963 break; 1964 + rec = ihex_next_binrec(rec); 1964 1965 } 1965 1966 release_firmware(fw); 1966 1967 if (!res)
+6 -2
drivers/net/can/usb/peak_usb/pcan_usb.c
··· 519 519 mc->pdev->dev.can.state = new_state; 520 520 521 521 if (status_len & PCAN_USB_STATUSLEN_TIMESTAMP) { 522 + struct skb_shared_hwtstamps *hwts = skb_hwtstamps(skb); 523 + 522 524 peak_usb_get_ts_tv(&mc->pdev->time_ref, mc->ts16, &tv); 523 - skb->tstamp = timeval_to_ktime(tv); 525 + hwts->hwtstamp = timeval_to_ktime(tv); 524 526 } 525 527 526 528 netif_rx(skb); ··· 607 605 struct sk_buff *skb; 608 606 struct can_frame *cf; 609 607 struct timeval tv; 608 + struct skb_shared_hwtstamps *hwts; 610 609 611 610 skb = alloc_can_skb(mc->netdev, &cf); 612 611 if (!skb) ··· 655 652 656 653 /* convert timestamp into kernel time */ 657 654 peak_usb_get_ts_tv(&mc->pdev->time_ref, mc->ts16, &tv); 658 - skb->tstamp = timeval_to_ktime(tv); 655 + hwts = skb_hwtstamps(skb); 656 + hwts->hwtstamp = timeval_to_ktime(tv); 659 657 660 658 /* push the skb */ 661 659 netif_rx(skb);
+6 -2
drivers/net/can/usb/peak_usb/pcan_usb_pro.c
··· 532 532 struct can_frame *can_frame; 533 533 struct sk_buff *skb; 534 534 struct timeval tv; 535 + struct skb_shared_hwtstamps *hwts; 535 536 536 537 skb = alloc_can_skb(netdev, &can_frame); 537 538 if (!skb) ··· 550 549 memcpy(can_frame->data, rx->data, can_frame->can_dlc); 551 550 552 551 peak_usb_get_ts_tv(&usb_if->time_ref, le32_to_cpu(rx->ts32), &tv); 553 - skb->tstamp = timeval_to_ktime(tv); 552 + hwts = skb_hwtstamps(skb); 553 + hwts->hwtstamp = timeval_to_ktime(tv); 554 554 555 555 netif_rx(skb); 556 556 netdev->stats.rx_packets++; ··· 572 570 u8 err_mask = 0; 573 571 struct sk_buff *skb; 574 572 struct timeval tv; 573 + struct skb_shared_hwtstamps *hwts; 575 574 576 575 /* nothing should be sent while in BUS_OFF state */ 577 576 if (dev->can.state == CAN_STATE_BUS_OFF) ··· 667 664 dev->can.state = new_state; 668 665 669 666 peak_usb_get_ts_tv(&usb_if->time_ref, le32_to_cpu(er->ts32), &tv); 670 - skb->tstamp = timeval_to_ktime(tv); 667 + hwts = skb_hwtstamps(skb); 668 + hwts->hwtstamp = timeval_to_ktime(tv); 671 669 netif_rx(skb); 672 670 netdev->stats.rx_packets++; 673 671 netdev->stats.rx_bytes += can_frame->can_dlc;
+1 -1
drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c
··· 237 237 if (err) 238 238 return err; 239 239 240 - memcpy(priv->maxrate, tmp, sizeof(*priv->maxrate)); 240 + memcpy(priv->maxrate, tmp, sizeof(priv->maxrate)); 241 241 242 242 return 0; 243 243 }
+3 -1
drivers/net/team/team.c
··· 1794 1794 1795 1795 dev->features |= NETIF_F_LLTX; 1796 1796 dev->features |= NETIF_F_GRO; 1797 - dev->hw_features = NETIF_F_HW_VLAN_TX | 1797 + dev->hw_features = TEAM_VLAN_FEATURES | 1798 + NETIF_F_HW_VLAN_TX | 1798 1799 NETIF_F_HW_VLAN_RX | 1799 1800 NETIF_F_HW_VLAN_FILTER; 1800 1801 1802 + dev->hw_features &= ~(NETIF_F_ALL_CSUM & ~NETIF_F_HW_CSUM); 1801 1803 dev->features |= dev->hw_features; 1802 1804 } 1803 1805
+1
drivers/net/usb/qmi_wwan.c
··· 385 385 }, 386 386 387 387 /* 3. Combined interface devices matching on interface number */ 388 + {QMI_FIXED_INTF(0x12d1, 0x140c, 1)}, /* Huawei E173 */ 388 389 {QMI_FIXED_INTF(0x19d2, 0x0002, 1)}, 389 390 {QMI_FIXED_INTF(0x19d2, 0x0012, 1)}, 390 391 {QMI_FIXED_INTF(0x19d2, 0x0017, 3)},
+1 -1
drivers/vhost/vhost.c
··· 1076 1076 } 1077 1077 _iov = iov + ret; 1078 1078 size = reg->memory_size - addr + reg->guest_phys_addr; 1079 - _iov->iov_len = min((u64)len, size); 1079 + _iov->iov_len = min((u64)len - s, size); 1080 1080 _iov->iov_base = (void __user *)(unsigned long) 1081 1081 (reg->userspace_addr + addr - reg->guest_phys_addr); 1082 1082 s += size;
+3
net/can/bcm.c
··· 1084 1084 op->sk = sk; 1085 1085 op->ifindex = ifindex; 1086 1086 1087 + /* ifindex for timeout events w/o previous frame reception */ 1088 + op->rx_ifindex = ifindex; 1089 + 1087 1090 /* initialize uninitialized (kzalloc) structure */ 1088 1091 hrtimer_init(&op->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); 1089 1092 op->timer.function = bcm_rx_timeout_handler;
+2 -1
net/ipv4/icmp.c
··· 257 257 struct inet_peer *peer = inet_getpeer_v4(net->ipv4.peers, fl4->daddr, 1); 258 258 rc = inet_peer_xrlim_allow(peer, 259 259 net->ipv4.sysctl_icmp_ratelimit); 260 - inet_putpeer(peer); 260 + if (peer) 261 + inet_putpeer(peer); 261 262 } 262 263 out: 263 264 return rc;
+4
net/ipv4/ipmr.c
··· 1318 1318 if (get_user(v, (u32 __user *)optval)) 1319 1319 return -EFAULT; 1320 1320 1321 + /* "pimreg%u" should not exceed 16 bytes (IFNAMSIZ) */ 1322 + if (v != RT_TABLE_DEFAULT && v >= 1000000000) 1323 + return -EINVAL; 1324 + 1321 1325 rtnl_lock(); 1322 1326 ret = 0; 1323 1327 if (sk == rtnl_dereference(mrt->mroute_sk)) {
+1
net/irda/irttp.c
··· 441 441 lsap = irlmp_open_lsap(stsap_sel, &ttp_notify, 0); 442 442 if (lsap == NULL) { 443 443 IRDA_DEBUG(0, "%s: unable to allocate LSAP!!\n", __func__); 444 + __irttp_close_tsap(self); 444 445 return NULL; 445 446 } 446 447
+1 -1
net/netfilter/ipset/ip_set_hash_netiface.c
··· 793 793 [IPSET_ATTR_IP] = { .type = NLA_NESTED }, 794 794 [IPSET_ATTR_IP_TO] = { .type = NLA_NESTED }, 795 795 [IPSET_ATTR_IFACE] = { .type = NLA_NUL_STRING, 796 - .len = IPSET_MAXNAMELEN - 1 }, 796 + .len = IFNAMSIZ - 1 }, 797 797 [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 }, 798 798 [IPSET_ATTR_CIDR] = { .type = NLA_U8 }, 799 799 [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
+5 -9
net/openvswitch/flow.c
··· 702 702 /* We only match on the lower 8 bits of the opcode. */ 703 703 if (ntohs(arp->ar_op) <= 0xff) 704 704 key->ip.proto = ntohs(arp->ar_op); 705 - 706 - if (key->ip.proto == ARPOP_REQUEST 707 - || key->ip.proto == ARPOP_REPLY) { 708 - memcpy(&key->ipv4.addr.src, arp->ar_sip, sizeof(key->ipv4.addr.src)); 709 - memcpy(&key->ipv4.addr.dst, arp->ar_tip, sizeof(key->ipv4.addr.dst)); 710 - memcpy(key->ipv4.arp.sha, arp->ar_sha, ETH_ALEN); 711 - memcpy(key->ipv4.arp.tha, arp->ar_tha, ETH_ALEN); 712 - key_len = SW_FLOW_KEY_OFFSET(ipv4.arp); 713 - } 705 + memcpy(&key->ipv4.addr.src, arp->ar_sip, sizeof(key->ipv4.addr.src)); 706 + memcpy(&key->ipv4.addr.dst, arp->ar_tip, sizeof(key->ipv4.addr.dst)); 707 + memcpy(key->ipv4.arp.sha, arp->ar_sha, ETH_ALEN); 708 + memcpy(key->ipv4.arp.tha, arp->ar_tha, ETH_ALEN); 709 + key_len = SW_FLOW_KEY_OFFSET(ipv4.arp); 714 710 } 715 711 } else if (key->eth.type == htons(ETH_P_IPV6)) { 716 712 int nh_len; /* IPv6 Header + Extensions */
+1 -1
net/openvswitch/vport-netdev.c
··· 158 158 159 159 if (unlikely(packet_length(skb) > mtu && !skb_is_gso(skb))) { 160 160 net_warn_ratelimited("%s: dropped over-mtu packet: %d > %d\n", 161 - ovs_dp_name(vport->dp), 161 + netdev_vport->dev->name, 162 162 packet_length(skb), mtu); 163 163 goto error; 164 164 }
+14 -6
net/sctp/chunk.c
··· 183 183 184 184 msg = sctp_datamsg_new(GFP_KERNEL); 185 185 if (!msg) 186 - return NULL; 186 + return ERR_PTR(-ENOMEM); 187 187 188 188 /* Note: Calculate this outside of the loop, so that all fragments 189 189 * have the same expiration. ··· 280 280 281 281 chunk = sctp_make_datafrag_empty(asoc, sinfo, len, frag, 0); 282 282 283 - if (!chunk) 283 + if (!chunk) { 284 + err = -ENOMEM; 284 285 goto errout; 286 + } 287 + 285 288 err = sctp_user_addto_chunk(chunk, offset, len, msgh->msg_iov); 286 289 if (err < 0) 287 - goto errout; 290 + goto errout_chunk_free; 288 291 289 292 offset += len; 290 293 ··· 318 315 319 316 chunk = sctp_make_datafrag_empty(asoc, sinfo, over, frag, 0); 320 317 321 - if (!chunk) 318 + if (!chunk) { 319 + err = -ENOMEM; 322 320 goto errout; 321 + } 323 322 324 323 err = sctp_user_addto_chunk(chunk, offset, over,msgh->msg_iov); 325 324 ··· 329 324 __skb_pull(chunk->skb, (__u8 *)chunk->chunk_hdr 330 325 - (__u8 *)chunk->skb->data); 331 326 if (err < 0) 332 - goto errout; 327 + goto errout_chunk_free; 333 328 334 329 sctp_datamsg_assign(msg, chunk); 335 330 list_add_tail(&chunk->frag_list, &msg->chunks); 336 331 } 337 332 338 333 return msg; 334 + 335 + errout_chunk_free: 336 + sctp_chunk_free(chunk); 339 337 340 338 errout: 341 339 list_for_each_safe(pos, temp, &msg->chunks) { ··· 347 339 sctp_chunk_free(chunk); 348 340 } 349 341 sctp_datamsg_put(msg); 350 - return NULL; 342 + return ERR_PTR(err); 351 343 } 352 344 353 345 /* Check whether this message has expired. */
+2 -2
net/sctp/socket.c
··· 1915 1915 1916 1916 /* Break the message into multiple chunks of maximum size. */ 1917 1917 datamsg = sctp_datamsg_from_user(asoc, sinfo, msg, msg_len); 1918 - if (!datamsg) { 1919 - err = -ENOMEM; 1918 + if (IS_ERR(datamsg)) { 1919 + err = PTR_ERR(datamsg); 1920 1920 goto out_free; 1921 1921 } 1922 1922
+1 -1
net/sctp/transport.c
··· 331 331 * 1/8, rto_alpha would be expressed as 3. 332 332 */ 333 333 tp->rttvar = tp->rttvar - (tp->rttvar >> net->sctp.rto_beta) 334 - + ((abs(tp->srtt - rtt)) >> net->sctp.rto_beta); 334 + + (((__u32)abs64((__s64)tp->srtt - (__s64)rtt)) >> net->sctp.rto_beta); 335 335 tp->srtt = tp->srtt - (tp->srtt >> net->sctp.rto_alpha) 336 336 + (rtt >> net->sctp.rto_alpha); 337 337 } else {