tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'net-6.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Jakub Kicinski:
"Including fixes from bpf, can and netfilter.

Current release - regressions:

- phy: fix null-deref in phy_attach_direct

- mac802154: fix possible double free upon parsing error

Previous releases - regressions:

- bpf: preserve reg parent/live fields when copying range info,
prevent mis-verification of programs as safe

- ip6: fix GRE tunnels not generating IPv6 link local addresses

- phy: dp83822: fix null-deref on DP83825/DP83826 devices

- sctp: do not check hb_timer.expires when resetting hb_timer

- eth: mtk_sock: fix SGMII configuration after phylink conversion

Previous releases - always broken:

- eth: xdp: execute xdp_do_flush() before napi_complete_done()

- skb: do not mix page pool and page referenced frags in GRO

- bpf:
- fix a possible task gone issue with bpf_send_signal[_thread]()
- fix an off-by-one bug in bpf_mem_cache_idx() to select the right
cache
- add missing btf_put to register_btf_id_dtor_kfuncs
- sockmap: fon't let sock_map_{close,destroy,unhash} call itself

- gso: fix null-deref in skb_segment_list()

- mctp: purge receive queues on sk destruction

- fix UaF caused by accept on already connected socket in exotic
socket families

- tls: don't treat list head as an entry in tls_is_tx_ready()

- netfilter: br_netfilter: disable sabotage_in hook after first
suppression

- wwan: t7xx: fix runtime PM implementation

Misc:

- MAINTAINERS: spring cleanup of networking maintainers"

* tag 'net-6.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (65 commits)
mtk_sgmii: enable PCS polling to allow SFP work
net: mediatek: sgmii: fix duplex configuration
net: mediatek: sgmii: ensure the SGMII PHY is powered down on configuration
MAINTAINERS: update SCTP maintainers
MAINTAINERS: ipv6: retire Hideaki Yoshifuji
mailmap: add John Crispin's entry
MAINTAINERS: bonding: move Veaceslav Falico to CREDITS
net: openvswitch: fix flow memory leak in ovs_flow_cmd_new
net: ethernet: mtk_eth_soc: disable hardware DSA untagging for second MAC
virtio-net: Keep stop() to follow mirror sequence of open()
selftests: net: udpgso_bench_tx: Cater for pending datagrams zerocopy benchmarking
selftests: net: udpgso_bench: Fix racing bug between the rx/tx programs
selftests: net: udpgso_bench_rx/tx: Stop when wrong CLI args are provided
selftests: net: udpgso_bench_rx: Fix 'used uninitialized' compiler warning
can: mcp251xfd: mcp251xfd_ring_set_ringparam(): assign missing tx_obj_num_coalesce_irq
can: isotp: split tx timer into transmission and timeout
can: isotp: handle wait_event_interruptible() return values
can: raw: fix CAN FD frame transmissions over CAN XL devices
can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate
hv_netvsc: Fix missed pagebuf entries in netvsc_dma_map/unmap()
...

Linus Torvalds edb9b8f3 e7368fd3

+599 -272
+1
.mailmap
··· 214 214 Jisheng Zhang <jszhang@kernel.org> <Jisheng.Zhang@synaptics.com> 215 215 Johan Hovold <johan@kernel.org> <jhovold@gmail.com> 216 216 Johan Hovold <johan@kernel.org> <johan@hovoldconsulting.com> 217 + John Crispin <john@phrozen.org> <blogic@openwrt.org> 217 218 John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> 218 219 John Stultz <johnstul@us.ibm.com> 219 220 Jordan Crouse <jordan@cosmicpenguin.net> <jcrouse@codeaurora.org>
+8
CREDITS
··· 1173 1173 D: APM driver (early port) 1174 1174 D: DRM drivers (author of several) 1175 1175 1176 + N: Veaceslav Falico 1177 + E: vfalico@gmail.com 1178 + D: Co-maintainer and co-author of the network bonding driver. 1179 + 1176 1180 N: János Farkas 1177 1181 E: chexum@shadow.banki.hu 1178 1182 D: romfs, various (mostly networking) fixes ··· 4182 4178 S: B-1206 Jingmao Guojigongyu 4183 4179 S: 16 Baliqiao Nanjie, Beijing 101100 4184 4180 S: People's Repulic of China 4181 + 4182 + N: Vlad Yasevich 4183 + E: vyasevich@gmail.com 4184 + D: SCTP protocol maintainer. 4185 4185 4186 4186 N: Aviad Yehezkel 4187 4187 E: aviadye@nvidia.com
+1 -1
Documentation/networking/device_drivers/ethernet/intel/ice.rst
··· 819 819 ---- 820 820 This driver supports NAPI (Rx polling mode). 821 821 For more information on NAPI, see 822 - https://www.linuxfoundation.org/collaborate/workgroups/networking/napi 822 + https://wiki.linuxfoundation.org/networking/napi 823 823 824 824 825 825 MACVLAN
+1 -3
MAINTAINERS
··· 3771 3771 3772 3772 BONDING DRIVER 3773 3773 M: Jay Vosburgh <j.vosburgh@gmail.com> 3774 - M: Veaceslav Falico <vfalico@gmail.com> 3775 3774 M: Andy Gospodarek <andy@greyhouse.net> 3776 3775 L: netdev@vger.kernel.org 3777 3776 S: Supported ··· 14608 14609 14609 14610 NETWORKING [IPv4/IPv6] 14610 14611 M: "David S. Miller" <davem@davemloft.net> 14611 - M: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org> 14612 14612 M: David Ahern <dsahern@kernel.org> 14613 14613 L: netdev@vger.kernel.org 14614 14614 S: Maintained ··· 18690 18692 F: include/target/ 18691 18693 18692 18694 SCTP PROTOCOL 18693 - M: Vlad Yasevich <vyasevich@gmail.com> 18694 18695 M: Neil Horman <nhorman@tuxdriver.com> 18695 18696 M: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> 18697 + M: Xin Long <lucien.xin@gmail.com> 18696 18698 L: linux-sctp@vger.kernel.org 18697 18699 S: Maintained 18698 18700 W: http://lksctp.sourceforge.net
+1
drivers/net/can/spi/mcp251xfd/mcp251xfd-ethtool.c
··· 48 48 priv->rx_obj_num = layout.cur_rx; 49 49 priv->rx_obj_num_coalesce_irq = layout.rx_coalesce; 50 50 priv->tx->obj_num = layout.cur_tx; 51 + priv->tx_obj_num_coalesce_irq = layout.tx_coalesce; 51 52 52 53 return 0; 53 54 }
+4 -3
drivers/net/dsa/Kconfig
··· 35 35 the xrx200 / VR9 SoC. 36 36 37 37 config NET_DSA_MT7530 38 - tristate "MediaTek MT753x and MT7621 Ethernet switch support" 38 + tristate "MediaTek MT7530 and MT7531 Ethernet switch support" 39 39 select NET_DSA_TAG_MTK 40 40 select MEDIATEK_GE_PHY 41 41 help 42 - This enables support for the MediaTek MT7530, MT7531, and MT7621 43 - Ethernet switch chips. 42 + This enables support for the MediaTek MT7530 and MT7531 Ethernet 43 + switch chips. Multi-chip module MT7530 in MT7621AT, MT7621DAT, 44 + MT7621ST and MT7623AI SoCs is supported. 44 45 45 46 config NET_DSA_MV88E6060 46 47 tristate "Marvell 88E6060 ethernet switch chip support"
+3 -3
drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
··· 2410 2410 2411 2411 cleaned = qman_p_poll_dqrr(np->p, budget); 2412 2412 2413 + if (np->xdp_act & XDP_REDIRECT) 2414 + xdp_do_flush(); 2415 + 2413 2416 if (cleaned < budget) { 2414 2417 napi_complete_done(napi, cleaned); 2415 2418 qman_p_irqsource_add(np->p, QM_PIRQ_DQRI); 2416 2419 } else if (np->down) { 2417 2420 qman_p_irqsource_add(np->p, QM_PIRQ_DQRI); 2418 2421 } 2419 - 2420 - if (np->xdp_act & XDP_REDIRECT) 2421 - xdp_do_flush(); 2422 2422 2423 2423 return cleaned; 2424 2424 }
+6 -3
drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
··· 1993 1993 if (rx_cleaned >= budget || 1994 1994 txconf_cleaned >= DPAA2_ETH_TXCONF_PER_NAPI) { 1995 1995 work_done = budget; 1996 + if (ch->xdp.res & XDP_REDIRECT) 1997 + xdp_do_flush(); 1996 1998 goto out; 1997 1999 } 1998 2000 } while (store_cleaned); 2001 + 2002 + if (ch->xdp.res & XDP_REDIRECT) 2003 + xdp_do_flush(); 1999 2004 2000 2005 /* Update NET DIM with the values for this CDAN */ 2001 2006 dpaa2_io_update_net_dim(ch->dpio, ch->stats.frames_per_cdan, ··· 2037 2032 txc_fq->dq_bytes = 0; 2038 2033 } 2039 2034 2040 - if (ch->xdp.res & XDP_REDIRECT) 2041 - xdp_do_flush_map(); 2042 - else if (rx_cleaned && ch->xdp.res & XDP_TX) 2035 + if (rx_cleaned && ch->xdp.res & XDP_TX) 2043 2036 dpaa2_eth_xdp_tx_flush(priv, ch, &priv->fq[flowid]); 2044 2037 2045 2038 return work_done;
+3
drivers/net/ethernet/freescale/fman/fman_memac.c
··· 1055 1055 return ERR_PTR(-EPROBE_DEFER); 1056 1056 1057 1057 pcs = lynx_pcs_create(mdiodev); 1058 + if (!pcs) 1059 + mdio_device_free(mdiodev); 1060 + 1058 1061 return pcs; 1059 1062 } 1060 1063
+1 -1
drivers/net/ethernet/intel/ice/ice.h
··· 880 880 void ice_set_ethtool_safe_mode_ops(struct net_device *netdev); 881 881 u16 ice_get_avail_txq_count(struct ice_pf *pf); 882 882 u16 ice_get_avail_rxq_count(struct ice_pf *pf); 883 - int ice_vsi_recfg_qs(struct ice_vsi *vsi, int new_rx, int new_tx); 883 + int ice_vsi_recfg_qs(struct ice_vsi *vsi, int new_rx, int new_tx, bool locked); 884 884 void ice_update_vsi_stats(struct ice_vsi *vsi); 885 885 void ice_update_pf_stats(struct ice_pf *pf); 886 886 void
+13 -10
drivers/net/ethernet/intel/ice/ice_dcb_lib.c
··· 441 441 goto out; 442 442 } 443 443 444 - ice_pf_dcb_recfg(pf); 444 + ice_pf_dcb_recfg(pf, false); 445 445 446 446 out: 447 447 /* enable previously downed VSIs */ ··· 731 731 /** 732 732 * ice_pf_dcb_recfg - Reconfigure all VEBs and VSIs 733 733 * @pf: pointer to the PF struct 734 + * @locked: is adev device lock held 734 735 * 735 736 * Assumed caller has already disabled all VSIs before 736 737 * calling this function. Reconfiguring DCB based on 737 738 * local_dcbx_cfg. 738 739 */ 739 - void ice_pf_dcb_recfg(struct ice_pf *pf) 740 + void ice_pf_dcb_recfg(struct ice_pf *pf, bool locked) 740 741 { 741 742 struct ice_dcbx_cfg *dcbcfg = &pf->hw.port_info->qos_cfg.local_dcbx_cfg; 742 743 struct iidc_event *event; ··· 784 783 if (vsi->type == ICE_VSI_PF) 785 784 ice_dcbnl_set_all(vsi); 786 785 } 787 - /* Notify the AUX drivers that TC change is finished */ 788 - event = kzalloc(sizeof(*event), GFP_KERNEL); 789 - if (!event) 790 - return; 786 + if (!locked) { 787 + /* Notify the AUX drivers that TC change is finished */ 788 + event = kzalloc(sizeof(*event), GFP_KERNEL); 789 + if (!event) 790 + return; 791 791 792 - set_bit(IIDC_EVENT_AFTER_TC_CHANGE, event->type); 793 - ice_send_event_to_aux(pf, event); 794 - kfree(event); 792 + set_bit(IIDC_EVENT_AFTER_TC_CHANGE, event->type); 793 + ice_send_event_to_aux(pf, event); 794 + kfree(event); 795 + } 795 796 } 796 797 797 798 /** ··· 1047 1044 } 1048 1045 1049 1046 /* changes in configuration update VSI */ 1050 - ice_pf_dcb_recfg(pf); 1047 + ice_pf_dcb_recfg(pf, false); 1051 1048 1052 1049 /* enable previously downed VSIs */ 1053 1050 ice_dcb_ena_dis_vsi(pf, true, true);
+2 -2
drivers/net/ethernet/intel/ice/ice_dcb_lib.h
··· 23 23 int 24 24 ice_pf_dcb_cfg(struct ice_pf *pf, struct ice_dcbx_cfg *new_cfg, bool locked); 25 25 int ice_dcb_bwchk(struct ice_pf *pf, struct ice_dcbx_cfg *dcbcfg); 26 - void ice_pf_dcb_recfg(struct ice_pf *pf); 26 + void ice_pf_dcb_recfg(struct ice_pf *pf, bool locked); 27 27 void ice_vsi_cfg_dcb_rings(struct ice_vsi *vsi); 28 28 int ice_init_pf_dcb(struct ice_pf *pf, bool locked); 29 29 void ice_update_dcb_stats(struct ice_pf *pf); ··· 128 128 return 0; 129 129 } 130 130 131 - static inline void ice_pf_dcb_recfg(struct ice_pf *pf) { } 131 + static inline void ice_pf_dcb_recfg(struct ice_pf *pf, bool locked) { } 132 132 static inline void ice_vsi_cfg_dcb_rings(struct ice_vsi *vsi) { } 133 133 static inline void ice_update_dcb_stats(struct ice_pf *pf) { } 134 134 static inline void
+24 -4
drivers/net/ethernet/intel/ice/ice_ethtool.c
··· 3641 3641 struct ice_vsi *vsi = np->vsi; 3642 3642 struct ice_pf *pf = vsi->back; 3643 3643 int new_rx = 0, new_tx = 0; 3644 + bool locked = false; 3644 3645 u32 curr_combined; 3646 + int ret = 0; 3645 3647 3646 3648 /* do not support changing channels in Safe Mode */ 3647 3649 if (ice_is_safe_mode(pf)) { ··· 3707 3705 return -EINVAL; 3708 3706 } 3709 3707 3710 - ice_vsi_recfg_qs(vsi, new_rx, new_tx); 3708 + if (pf->adev) { 3709 + mutex_lock(&pf->adev_mutex); 3710 + device_lock(&pf->adev->dev); 3711 + locked = true; 3712 + if (pf->adev->dev.driver) { 3713 + netdev_err(dev, "Cannot change channels when RDMA is active\n"); 3714 + ret = -EBUSY; 3715 + goto adev_unlock; 3716 + } 3717 + } 3711 3718 3712 - if (!netif_is_rxfh_configured(dev)) 3713 - return ice_vsi_set_dflt_rss_lut(vsi, new_rx); 3719 + ice_vsi_recfg_qs(vsi, new_rx, new_tx, locked); 3720 + 3721 + if (!netif_is_rxfh_configured(dev)) { 3722 + ret = ice_vsi_set_dflt_rss_lut(vsi, new_rx); 3723 + goto adev_unlock; 3724 + } 3714 3725 3715 3726 /* Update rss_size due to change in Rx queues */ 3716 3727 vsi->rss_size = ice_get_valid_rss_size(&pf->hw, new_rx); 3717 3728 3718 - return 0; 3729 + adev_unlock: 3730 + if (locked) { 3731 + device_unlock(&pf->adev->dev); 3732 + mutex_unlock(&pf->adev_mutex); 3733 + } 3734 + return ret; 3719 3735 } 3720 3736 3721 3737 /**
+3 -2
drivers/net/ethernet/intel/ice/ice_main.c
··· 4195 4195 * @vsi: VSI being changed 4196 4196 * @new_rx: new number of Rx queues 4197 4197 * @new_tx: new number of Tx queues 4198 + * @locked: is adev device_lock held 4198 4199 * 4199 4200 * Only change the number of queues if new_tx, or new_rx is non-0. 4200 4201 * 4201 4202 * Returns 0 on success. 4202 4203 */ 4203 - int ice_vsi_recfg_qs(struct ice_vsi *vsi, int new_rx, int new_tx) 4204 + int ice_vsi_recfg_qs(struct ice_vsi *vsi, int new_rx, int new_tx, bool locked) 4204 4205 { 4205 4206 struct ice_pf *pf = vsi->back; 4206 4207 int err = 0, timeout = 50; ··· 4230 4229 4231 4230 ice_vsi_close(vsi); 4232 4231 ice_vsi_rebuild(vsi, false); 4233 - ice_pf_dcb_recfg(pf); 4232 + ice_pf_dcb_recfg(pf, locked); 4234 4233 ice_vsi_open(vsi); 4235 4234 done: 4236 4235 clear_bit(ICE_CFG_BUSY, pf->state);
+9 -5
drivers/net/ethernet/intel/igc/igc_ptp.c
··· 417 417 * 418 418 * We need to convert the system time value stored in the RX/TXSTMP registers 419 419 * into a hwtstamp which can be used by the upper level timestamping functions. 420 + * 421 + * Returns 0 on success. 420 422 **/ 421 - static void igc_ptp_systim_to_hwtstamp(struct igc_adapter *adapter, 422 - struct skb_shared_hwtstamps *hwtstamps, 423 - u64 systim) 423 + static int igc_ptp_systim_to_hwtstamp(struct igc_adapter *adapter, 424 + struct skb_shared_hwtstamps *hwtstamps, 425 + u64 systim) 424 426 { 425 427 switch (adapter->hw.mac.type) { 426 428 case igc_i225: ··· 432 430 systim & 0xFFFFFFFF); 433 431 break; 434 432 default: 435 - break; 433 + return -EINVAL; 436 434 } 435 + return 0; 437 436 } 438 437 439 438 /** ··· 655 652 656 653 regval = rd32(IGC_TXSTMPL); 657 654 regval |= (u64)rd32(IGC_TXSTMPH) << 32; 658 - igc_ptp_systim_to_hwtstamp(adapter, &shhwtstamps, regval); 655 + if (igc_ptp_systim_to_hwtstamp(adapter, &shhwtstamps, regval)) 656 + return; 659 657 660 658 switch (adapter->link_speed) { 661 659 case SPEED_10:
+28 -9
drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c
··· 1500 1500 BIT(DEVLINK_PARAM_CMODE_RUNTIME), 1501 1501 rvu_af_dl_dwrr_mtu_get, rvu_af_dl_dwrr_mtu_set, 1502 1502 rvu_af_dl_dwrr_mtu_validate), 1503 + }; 1504 + 1505 + static const struct devlink_param rvu_af_dl_param_exact_match[] = { 1503 1506 DEVLINK_PARAM_DRIVER(RVU_AF_DEVLINK_PARAM_ID_NPC_EXACT_FEATURE_DISABLE, 1504 1507 "npc_exact_feature_disable", DEVLINK_PARAM_TYPE_STRING, 1505 1508 BIT(DEVLINK_PARAM_CMODE_RUNTIME), ··· 1559 1556 { 1560 1557 struct rvu_devlink *rvu_dl; 1561 1558 struct devlink *dl; 1562 - size_t size; 1563 1559 int err; 1564 1560 1565 1561 dl = devlink_alloc(&rvu_devlink_ops, sizeof(struct rvu_devlink), ··· 1580 1578 goto err_dl_health; 1581 1579 } 1582 1580 1583 - /* Register exact match devlink only for CN10K-B */ 1584 - size = ARRAY_SIZE(rvu_af_dl_params); 1585 - if (!rvu_npc_exact_has_match_table(rvu)) 1586 - size -= 1; 1587 - 1588 - err = devlink_params_register(dl, rvu_af_dl_params, size); 1581 + err = devlink_params_register(dl, rvu_af_dl_params, ARRAY_SIZE(rvu_af_dl_params)); 1589 1582 if (err) { 1590 1583 dev_err(rvu->dev, 1591 1584 "devlink params register failed with error %d", err); 1592 1585 goto err_dl_health; 1593 1586 } 1594 1587 1588 + /* Register exact match devlink only for CN10K-B */ 1589 + if (!rvu_npc_exact_has_match_table(rvu)) 1590 + goto done; 1591 + 1592 + err = devlink_params_register(dl, rvu_af_dl_param_exact_match, 1593 + ARRAY_SIZE(rvu_af_dl_param_exact_match)); 1594 + if (err) { 1595 + dev_err(rvu->dev, 1596 + "devlink exact match params register failed with error %d", err); 1597 + goto err_dl_exact_match; 1598 + } 1599 + 1600 + done: 1595 1601 devlink_register(dl); 1596 1602 return 0; 1603 + 1604 + err_dl_exact_match: 1605 + devlink_params_unregister(dl, rvu_af_dl_params, ARRAY_SIZE(rvu_af_dl_params)); 1597 1606 1598 1607 err_dl_health: 1599 1608 rvu_health_reporters_destroy(rvu); ··· 1618 1605 struct devlink *dl = rvu_dl->dl; 1619 1606 1620 1607 devlink_unregister(dl); 1621 - devlink_params_unregister(dl, rvu_af_dl_params, 1622 - ARRAY_SIZE(rvu_af_dl_params)); 1608 + 1609 + devlink_params_unregister(dl, rvu_af_dl_params, ARRAY_SIZE(rvu_af_dl_params)); 1610 + 1611 + /* Unregister exact match devlink only for CN10K-B */ 1612 + if (rvu_npc_exact_has_match_table(rvu)) 1613 + devlink_params_unregister(dl, rvu_af_dl_param_exact_match, 1614 + ARRAY_SIZE(rvu_af_dl_param_exact_match)); 1615 + 1623 1616 rvu_health_reporters_destroy(rvu); 1624 1617 devlink_free(dl); 1625 1618 }
+4 -2
drivers/net/ethernet/mediatek/mtk_eth_soc.c
··· 3177 3177 struct mtk_eth *eth = mac->hw; 3178 3178 int i, err; 3179 3179 3180 - if (mtk_uses_dsa(dev) && !eth->prog) { 3180 + if ((mtk_uses_dsa(dev) && !eth->prog) && 3181 + !(mac->id == 1 && MTK_HAS_CAPS(eth->soc->caps, MTK_GMAC1_TRGMII))) { 3181 3182 for (i = 0; i < ARRAY_SIZE(eth->dsa_meta); i++) { 3182 3183 struct metadata_dst *md_dst = eth->dsa_meta[i]; 3183 3184 ··· 3195 3194 } 3196 3195 } else { 3197 3196 /* Hardware special tag parsing needs to be disabled if at least 3198 - * one MAC does not use DSA. 3197 + * one MAC does not use DSA, or the second MAC of the MT7621 and 3198 + * MT7623 SoCs is being used. 3199 3199 */ 3200 3200 u32 val = mtk_r32(eth, MTK_CDMP_IG_CTRL); 3201 3201 val &= ~MTK_CDMP_STAG_EN;
+3 -1
drivers/net/ethernet/mediatek/mtk_eth_soc.h
··· 519 519 #define SGMII_SPEED_10 FIELD_PREP(SGMII_SPEED_MASK, 0) 520 520 #define SGMII_SPEED_100 FIELD_PREP(SGMII_SPEED_MASK, 1) 521 521 #define SGMII_SPEED_1000 FIELD_PREP(SGMII_SPEED_MASK, 2) 522 - #define SGMII_DUPLEX_FULL BIT(4) 522 + #define SGMII_DUPLEX_HALF BIT(4) 523 523 #define SGMII_IF_MODE_BIT5 BIT(5) 524 524 #define SGMII_REMOTE_FAULT_DIS BIT(8) 525 525 #define SGMII_CODE_SYNC_SET_VAL BIT(9) ··· 1036 1036 * @regmap: The register map pointing at the range used to setup 1037 1037 * SGMII modes 1038 1038 * @ana_rgc3: The offset refers to register ANA_RGC3 related to regmap 1039 + * @interface: Currently configured interface mode 1039 1040 * @pcs: Phylink PCS structure 1040 1041 */ 1041 1042 struct mtk_pcs { 1042 1043 struct regmap *regmap; 1043 1044 u32 ana_rgc3; 1045 + phy_interface_t interface; 1044 1046 struct phylink_pcs pcs; 1045 1047 }; 1046 1048
+1 -2
drivers/net/ethernet/mediatek/mtk_ppe.c
··· 615 615 u32 ib1_mask = mtk_get_ib1_pkt_type_mask(ppe->eth) | MTK_FOE_IB1_UDP; 616 616 int type; 617 617 618 - flow_info = kzalloc(offsetof(struct mtk_flow_entry, l2_data.end), 619 - GFP_ATOMIC); 618 + flow_info = kzalloc(sizeof(*flow_info), GFP_ATOMIC); 620 619 if (!flow_info) 621 620 return; 622 621
-1
drivers/net/ethernet/mediatek/mtk_ppe.h
··· 279 279 struct { 280 280 struct mtk_flow_entry *base_flow; 281 281 struct hlist_node list; 282 - struct {} end; 283 282 } l2_data; 284 283 }; 285 284 struct rhash_head node;
+32 -14
drivers/net/ethernet/mediatek/mtk_sgmii.c
··· 43 43 int advertise, link_timer; 44 44 bool changed, use_an; 45 45 46 - if (interface == PHY_INTERFACE_MODE_2500BASEX) 47 - rgc3 = RG_PHY_SPEED_3_125G; 48 - else 49 - rgc3 = 0; 50 - 51 46 advertise = phylink_mii_c22_pcs_encode_advertisement(interface, 52 47 advertising); 53 48 if (advertise < 0) ··· 83 88 bmcr = 0; 84 89 } 85 90 86 - /* Configure the underlying interface speed */ 87 - regmap_update_bits(mpcs->regmap, mpcs->ana_rgc3, 88 - RG_PHY_SPEED_3_125G, rgc3); 91 + if (mpcs->interface != interface) { 92 + /* PHYA power down */ 93 + regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, 94 + SGMII_PHYA_PWD, SGMII_PHYA_PWD); 95 + 96 + if (interface == PHY_INTERFACE_MODE_2500BASEX) 97 + rgc3 = RG_PHY_SPEED_3_125G; 98 + else 99 + rgc3 = 0; 100 + 101 + /* Configure the underlying interface speed */ 102 + regmap_update_bits(mpcs->regmap, mpcs->ana_rgc3, 103 + RG_PHY_SPEED_3_125G, rgc3); 104 + 105 + mpcs->interface = interface; 106 + } 89 107 90 108 /* Update the advertisement, noting whether it has changed */ 91 109 regmap_update_bits_check(mpcs->regmap, SGMSYS_PCS_ADVERTISE, ··· 116 108 regmap_update_bits(mpcs->regmap, SGMSYS_PCS_CONTROL_1, 117 109 SGMII_AN_RESTART | SGMII_AN_ENABLE, bmcr); 118 110 119 - /* Release PHYA power down state */ 120 - regmap_update_bits(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, 121 - SGMII_PHYA_PWD, 0); 111 + /* Release PHYA power down state 112 + * Only removing bit SGMII_PHYA_PWD isn't enough. 113 + * There are cases when the SGMII_PHYA_PWD register contains 0x9 which 114 + * prevents SGMII from working. The SGMII still shows link but no traffic 115 + * can flow. Writing 0x0 to the PHYA_PWD register fix the issue. 0x0 was 116 + * taken from a good working state of the SGMII interface. 117 + * Unknown how much the QPHY needs but it is racy without a sleep. 118 + * Tested on mt7622 & mt7986. 119 + */ 120 + usleep_range(50, 100); 121 + regmap_write(mpcs->regmap, SGMSYS_QPHY_PWR_STATE_CTRL, 0); 122 122 123 123 return changed; 124 124 } ··· 154 138 else 155 139 sgm_mode = SGMII_SPEED_1000; 156 140 157 - if (duplex == DUPLEX_FULL) 158 - sgm_mode |= SGMII_DUPLEX_FULL; 141 + if (duplex != DUPLEX_FULL) 142 + sgm_mode |= SGMII_DUPLEX_HALF; 159 143 160 144 regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE, 161 - SGMII_DUPLEX_FULL | SGMII_SPEED_MASK, 145 + SGMII_DUPLEX_HALF | SGMII_SPEED_MASK, 162 146 sgm_mode); 163 147 } 164 148 } ··· 187 171 return PTR_ERR(ss->pcs[i].regmap); 188 172 189 173 ss->pcs[i].pcs.ops = &mtk_pcs_ops; 174 + ss->pcs[i].pcs.poll = true; 175 + ss->pcs[i].interface = PHY_INTERFACE_MODE_NA; 190 176 } 191 177 192 178 return 0;
+3 -3
drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c
··· 608 608 lan966x_fdma_rx_reload(rx); 609 609 } 610 610 611 - if (counter < weight && napi_complete_done(napi, counter)) 612 - lan_wr(0xff, lan966x, FDMA_INTR_DB_ENA); 613 - 614 611 if (redirect) 615 612 xdp_do_flush(); 613 + 614 + if (counter < weight && napi_complete_done(napi, counter)) 615 + lan_wr(0xff, lan966x, FDMA_INTR_DB_ENA); 616 616 617 617 return counter; 618 618 }
+7 -1
drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
··· 460 460 sizeof(struct nfp_tun_neigh_v4); 461 461 unsigned long cookie = (unsigned long)neigh; 462 462 struct nfp_flower_priv *priv = app->priv; 463 + struct nfp_tun_neigh_lag lag_info; 463 464 struct nfp_neigh_entry *nn_entry; 464 465 u32 port_id; 465 466 u8 mtype; ··· 468 467 port_id = nfp_flower_get_port_id_from_netdev(app, netdev); 469 468 if (!port_id) 470 469 return; 470 + 471 + if ((port_id & NFP_FL_LAG_OUT) == NFP_FL_LAG_OUT) { 472 + memset(&lag_info, 0, sizeof(struct nfp_tun_neigh_lag)); 473 + nfp_flower_lag_get_info_from_netdev(app, netdev, &lag_info); 474 + } 471 475 472 476 spin_lock_bh(&priv->predt_lock); 473 477 nn_entry = rhashtable_lookup_fast(&priv->neigh_table, &cookie, ··· 521 515 neigh_ha_snapshot(common->dst_addr, neigh, netdev); 522 516 523 517 if ((port_id & NFP_FL_LAG_OUT) == NFP_FL_LAG_OUT) 524 - nfp_flower_lag_get_info_from_netdev(app, netdev, lag); 518 + memcpy(lag, &lag_info, sizeof(struct nfp_tun_neigh_lag)); 525 519 common->port_id = cpu_to_be32(port_id); 526 520 527 521 if (rhashtable_insert_fast(&priv->neigh_table,
+4 -3
drivers/net/ethernet/qlogic/qede/qede_fp.c
··· 1438 1438 rx_work_done = (likely(fp->type & QEDE_FASTPATH_RX) && 1439 1439 qede_has_rx_work(fp->rxq)) ? 1440 1440 qede_rx_int(fp, budget) : 0; 1441 + 1442 + if (fp->xdp_xmit & QEDE_XDP_REDIRECT) 1443 + xdp_do_flush(); 1444 + 1441 1445 /* Handle case where we are called by netpoll with a budget of 0 */ 1442 1446 if (rx_work_done < budget || !budget) { 1443 1447 if (!qede_poll_is_more_work(fp)) { ··· 1460 1456 fp->xdp_tx->tx_db.data.bd_prod = cpu_to_le16(xdp_prod); 1461 1457 qede_update_tx_producer(fp->xdp_tx); 1462 1458 } 1463 - 1464 - if (fp->xdp_xmit & QEDE_XDP_REDIRECT) 1465 - xdp_do_flush_map(); 1466 1459 1467 1460 return rx_work_done; 1468 1461 }
+4 -1
drivers/net/ethernet/sfc/efx.c
··· 1003 1003 /* Determine netdevice features */ 1004 1004 net_dev->features |= (efx->type->offload_features | NETIF_F_SG | 1005 1005 NETIF_F_TSO | NETIF_F_RXCSUM | NETIF_F_RXALL); 1006 - if (efx->type->offload_features & (NETIF_F_IPV6_CSUM | NETIF_F_HW_CSUM)) 1006 + if (efx->type->offload_features & (NETIF_F_IPV6_CSUM | NETIF_F_HW_CSUM)) { 1007 1007 net_dev->features |= NETIF_F_TSO6; 1008 + if (efx_has_cap(efx, TX_TSO_V2_ENCAP)) 1009 + net_dev->hw_enc_features |= NETIF_F_TSO6; 1010 + } 1008 1011 /* Check whether device supports TSO */ 1009 1012 if (!efx->type->tso_versions || !efx->type->tso_versions(efx)) 1010 1013 net_dev->features &= ~NETIF_F_ALL_TSO;
+2
drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
··· 560 560 plat_dat->has_gmac4 = 1; 561 561 plat_dat->pmt = 1; 562 562 plat_dat->tso_en = of_property_read_bool(np, "snps,tso"); 563 + if (of_device_is_compatible(np, "qcom,qcs404-ethqos")) 564 + plat_dat->rx_clk_runs_in_lpi = 1; 563 565 564 566 ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res); 565 567 if (ret)
+2 -1
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
··· 1080 1080 1081 1081 stmmac_mac_set(priv, priv->ioaddr, true); 1082 1082 if (phy && priv->dma_cap.eee) { 1083 - priv->eee_active = phy_init_eee(phy, 1) >= 0; 1083 + priv->eee_active = 1084 + phy_init_eee(phy, !priv->plat->rx_clk_runs_in_lpi) >= 0; 1084 1085 priv->eee_enabled = stmmac_eee_init(priv); 1085 1086 priv->tx_lpi_enabled = priv->eee_enabled; 1086 1087 stmmac_set_eee_pls(priv, priv->hw, true);
+2 -7
drivers/net/hyperv/netvsc.c
··· 987 987 void netvsc_dma_unmap(struct hv_device *hv_dev, 988 988 struct hv_netvsc_packet *packet) 989 989 { 990 - u32 page_count = packet->cp_partial ? 991 - packet->page_buf_cnt - packet->rmsg_pgcnt : 992 - packet->page_buf_cnt; 993 990 int i; 994 991 995 992 if (!hv_is_isolation_supported()) ··· 995 998 if (!packet->dma_range) 996 999 return; 997 1000 998 - for (i = 0; i < page_count; i++) 1001 + for (i = 0; i < packet->page_buf_cnt; i++) 999 1002 dma_unmap_single(&hv_dev->device, packet->dma_range[i].dma, 1000 1003 packet->dma_range[i].mapping_size, 1001 1004 DMA_TO_DEVICE); ··· 1025 1028 struct hv_netvsc_packet *packet, 1026 1029 struct hv_page_buffer *pb) 1027 1030 { 1028 - u32 page_count = packet->cp_partial ? 1029 - packet->page_buf_cnt - packet->rmsg_pgcnt : 1030 - packet->page_buf_cnt; 1031 + u32 page_count = packet->page_buf_cnt; 1031 1032 dma_addr_t dma; 1032 1033 int i; 1033 1034
+4 -2
drivers/net/phy/dp83822.c
··· 233 233 DP83822_ENERGY_DET_INT_EN | 234 234 DP83822_LINK_QUAL_INT_EN); 235 235 236 - if (!dp83822->fx_enabled) 236 + /* Private data pointer is NULL on DP83825/26 */ 237 + if (!dp83822 || !dp83822->fx_enabled) 237 238 misr_status |= DP83822_ANEG_COMPLETE_INT_EN | 238 239 DP83822_DUP_MODE_CHANGE_INT_EN | 239 240 DP83822_SPEED_CHANGED_INT_EN; ··· 254 253 DP83822_PAGE_RX_INT_EN | 255 254 DP83822_EEE_ERROR_CHANGE_INT_EN); 256 255 257 - if (!dp83822->fx_enabled) 256 + /* Private data pointer is NULL on DP83825/26 */ 257 + if (!dp83822 || !dp83822->fx_enabled) 258 258 misr_status |= DP83822_ANEG_ERR_INT_EN | 259 259 DP83822_WOL_PKT_INT_EN; 260 260
+2
drivers/net/phy/meson-gxl.c
··· 271 271 .handle_interrupt = meson_gxl_handle_interrupt, 272 272 .suspend = genphy_suspend, 273 273 .resume = genphy_resume, 274 + .read_mmd = genphy_read_mmd_unsupported, 275 + .write_mmd = genphy_write_mmd_unsupported, 274 276 }, 275 277 }; 276 278
+1 -1
drivers/net/phy/phy_device.c
··· 1517 1517 * another mac interface, so we should create a device link between 1518 1518 * phy dev and mac dev. 1519 1519 */ 1520 - if (phydev->mdio.bus->parent && dev->dev.parent != phydev->mdio.bus->parent) 1520 + if (dev && phydev->mdio.bus->parent && dev->dev.parent != phydev->mdio.bus->parent) 1521 1521 phydev->devlink = device_link_add(dev->dev.parent, &phydev->mdio.dev, 1522 1522 DL_FLAG_PM_RUNTIME | DL_FLAG_STATELESS); 1523 1523
+4 -4
drivers/net/virtio_net.c
··· 1677 1677 1678 1678 received = virtnet_receive(rq, budget, &xdp_xmit); 1679 1679 1680 + if (xdp_xmit & VIRTIO_XDP_REDIR) 1681 + xdp_do_flush(); 1682 + 1680 1683 /* Out of packets? */ 1681 1684 if (received < budget) 1682 1685 virtqueue_napi_complete(napi, rq->vq, received); 1683 - 1684 - if (xdp_xmit & VIRTIO_XDP_REDIR) 1685 - xdp_do_flush(); 1686 1686 1687 1687 if (xdp_xmit & VIRTIO_XDP_TX) { 1688 1688 sq = virtnet_xdp_get_sq(vi); ··· 2158 2158 cancel_delayed_work_sync(&vi->refill); 2159 2159 2160 2160 for (i = 0; i < vi->max_queue_pairs; i++) { 2161 - xdp_rxq_info_unreg(&vi->rq[i].xdp_rxq); 2162 2161 napi_disable(&vi->rq[i].napi); 2162 + xdp_rxq_info_unreg(&vi->rq[i].xdp_rxq); 2163 2163 virtnet_napi_tx_disable(&vi->sq[i].napi); 2164 2164 } 2165 2165
+10 -1
drivers/net/wwan/t7xx/t7xx_hif_dpmaif.c
··· 152 152 } 153 153 154 154 t7xx_pcie_mac_clear_int(dpmaif_ctrl->t7xx_dev, isr_para->pcie_int); 155 + 156 + return IRQ_WAKE_THREAD; 157 + } 158 + 159 + static irqreturn_t t7xx_dpmaif_isr_thread(int irq, void *data) 160 + { 161 + struct dpmaif_isr_para *isr_para = data; 162 + struct dpmaif_ctrl *dpmaif_ctrl = isr_para->dpmaif_ctrl; 163 + 155 164 t7xx_dpmaif_irq_cb(isr_para); 156 165 t7xx_pcie_mac_set_int(dpmaif_ctrl->t7xx_dev, isr_para->pcie_int); 157 166 return IRQ_HANDLED; ··· 197 188 t7xx_pcie_mac_clear_int(t7xx_dev, int_type); 198 189 199 190 t7xx_dev->intr_handler[int_type] = t7xx_dpmaif_isr_handler; 200 - t7xx_dev->intr_thread[int_type] = NULL; 191 + t7xx_dev->intr_thread[int_type] = t7xx_dpmaif_isr_thread; 201 192 t7xx_dev->callback_param[int_type] = isr_para; 202 193 203 194 t7xx_pcie_mac_clear_int_status(t7xx_dev, int_type);
+20 -9
drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c
··· 840 840 841 841 if (!rxq->que_started) { 842 842 atomic_set(&rxq->rx_processing, 0); 843 + pm_runtime_put_autosuspend(rxq->dpmaif_ctrl->dev); 843 844 dev_err(rxq->dpmaif_ctrl->dev, "Work RXQ: %d has not been started\n", rxq->index); 844 845 return work_done; 845 846 } 846 847 847 - if (!rxq->sleep_lock_pending) { 848 - pm_runtime_get_noresume(rxq->dpmaif_ctrl->dev); 848 + if (!rxq->sleep_lock_pending) 849 849 t7xx_pci_disable_sleep(t7xx_dev); 850 - } 851 850 852 851 ret = try_wait_for_completion(&t7xx_dev->sleep_lock_acquire); 853 852 if (!ret) { ··· 875 876 napi_complete_done(napi, work_done); 876 877 t7xx_dpmaif_clr_ip_busy_sts(&rxq->dpmaif_ctrl->hw_info); 877 878 t7xx_dpmaif_dlq_unmask_rx_done(&rxq->dpmaif_ctrl->hw_info, rxq->index); 879 + t7xx_pci_enable_sleep(rxq->dpmaif_ctrl->t7xx_dev); 880 + pm_runtime_mark_last_busy(rxq->dpmaif_ctrl->dev); 881 + pm_runtime_put_autosuspend(rxq->dpmaif_ctrl->dev); 882 + atomic_set(&rxq->rx_processing, 0); 878 883 } else { 879 884 t7xx_dpmaif_clr_ip_busy_sts(&rxq->dpmaif_ctrl->hw_info); 880 885 } 881 - 882 - t7xx_pci_enable_sleep(rxq->dpmaif_ctrl->t7xx_dev); 883 - pm_runtime_mark_last_busy(rxq->dpmaif_ctrl->dev); 884 - pm_runtime_put_noidle(rxq->dpmaif_ctrl->dev); 885 - atomic_set(&rxq->rx_processing, 0); 886 886 887 887 return work_done; 888 888 } ··· 889 891 void t7xx_dpmaif_irq_rx_done(struct dpmaif_ctrl *dpmaif_ctrl, const unsigned int que_mask) 890 892 { 891 893 struct dpmaif_rx_queue *rxq; 892 - int qno; 894 + struct dpmaif_ctrl *ctrl; 895 + int qno, ret; 893 896 894 897 qno = ffs(que_mask) - 1; 895 898 if (qno < 0 || qno > DPMAIF_RXQ_NUM - 1) { ··· 899 900 } 900 901 901 902 rxq = &dpmaif_ctrl->rxq[qno]; 903 + ctrl = rxq->dpmaif_ctrl; 904 + /* We need to make sure that the modem has been resumed before 905 + * calling napi. This can't be done inside the polling function 906 + * as we could be blocked waiting for device to be resumed, 907 + * which can't be done from softirq context the poll function 908 + * is running in. 909 + */ 910 + ret = pm_runtime_resume_and_get(ctrl->dev); 911 + if (ret < 0 && ret != -EACCES) { 912 + dev_err(ctrl->dev, "Failed to resume device: %d\n", ret); 913 + return; 914 + } 902 915 napi_schedule(&rxq->napi); 903 916 } 904 917
+15 -1
drivers/net/wwan/t7xx/t7xx_netdev.c
··· 27 27 #include <linux/list.h> 28 28 #include <linux/netdev_features.h> 29 29 #include <linux/netdevice.h> 30 + #include <linux/pm_runtime.h> 30 31 #include <linux/skbuff.h> 31 32 #include <linux/types.h> 32 33 #include <linux/wwan.h> ··· 46 45 47 46 static void t7xx_ccmni_enable_napi(struct t7xx_ccmni_ctrl *ctlb) 48 47 { 49 - int i; 48 + struct dpmaif_ctrl *ctrl; 49 + int i, ret; 50 + 51 + ctrl = ctlb->hif_ctrl; 50 52 51 53 if (ctlb->is_napi_en) 52 54 return; 53 55 54 56 for (i = 0; i < RXQ_NUM; i++) { 57 + /* The usage count has to be bumped every time before calling 58 + * napi_schedule. It will be decresed in the poll routine, 59 + * right after napi_complete_done is called. 60 + */ 61 + ret = pm_runtime_resume_and_get(ctrl->dev); 62 + if (ret < 0) { 63 + dev_err(ctrl->dev, "Failed to resume device: %d\n", 64 + ret); 65 + return; 66 + } 55 67 napi_enable(ctlb->napi[i]); 56 68 napi_schedule(ctlb->napi[i]); 57 69 }
+2
drivers/net/wwan/t7xx/t7xx_pci.c
··· 121 121 iowrite32(T7XX_L1_BIT(0), IREG_BASE(t7xx_dev) + ENABLE_ASPM_LOWPWR); 122 122 atomic_set(&t7xx_dev->md_pm_state, MTK_PM_RESUMED); 123 123 124 + pm_runtime_mark_last_busy(&t7xx_dev->pdev->dev); 125 + pm_runtime_allow(&t7xx_dev->pdev->dev); 124 126 pm_runtime_put_noidle(&t7xx_dev->pdev->dev); 125 127 } 126 128
+1
include/linux/stmmac.h
··· 252 252 int rss_en; 253 253 int mac_port_sel_speed; 254 254 bool en_tx_lpi_clockgating; 255 + bool rx_clk_runs_in_lpi; 255 256 int has_xgmac; 256 257 bool vlan_fail_q_en; 257 258 u8 vlan_fail_q;
+12
include/linux/util_macros.h
··· 38 38 */ 39 39 #define find_closest_descending(x, a, as) __find_closest(x, a, as, >=) 40 40 41 + /** 42 + * is_insidevar - check if the @ptr points inside the @var memory range. 43 + * @ptr: the pointer to a memory address. 44 + * @var: the variable which address and size identify the memory range. 45 + * 46 + * Evaluates to true if the address in @ptr lies within the memory 47 + * range allocated to @var. 48 + */ 49 + #define is_insidevar(ptr, var) \ 50 + ((uintptr_t)(ptr) >= (uintptr_t)(var) && \ 51 + (uintptr_t)(ptr) < (uintptr_t)(var) + sizeof(var)) 52 + 41 53 #endif
-1
kernel/bpf/bpf_lsm.c
··· 51 51 */ 52 52 BTF_SET_START(bpf_lsm_locked_sockopt_hooks) 53 53 #ifdef CONFIG_SECURITY_NETWORK 54 - BTF_ID(func, bpf_lsm_socket_sock_rcv_skb) 55 54 BTF_ID(func, bpf_lsm_sock_graft) 56 55 BTF_ID(func, bpf_lsm_inet_csk_clone) 57 56 BTF_ID(func, bpf_lsm_inet_conn_established)
+2 -2
kernel/bpf/btf.c
··· 7782 7782 7783 7783 sort(tab->dtors, tab->cnt, sizeof(tab->dtors[0]), btf_id_cmp_func, NULL); 7784 7784 7785 - return 0; 7786 7785 end: 7787 - btf_free_dtor_kfunc_tab(btf); 7786 + if (ret) 7787 + btf_free_dtor_kfunc_tab(btf); 7788 7788 btf_put(btf); 7789 7789 return ret; 7790 7790 }
+1 -1
kernel/bpf/memalloc.c
··· 71 71 if (size <= 192) 72 72 return size_index[(size - 1) / 8] - 1; 73 73 74 - return fls(size - 1) - 1; 74 + return fls(size - 1) - 2; 75 75 } 76 76 77 77 #define NUM_CACHES 11
+18 -7
kernel/bpf/verifier.c
··· 3243 3243 return reg->type != SCALAR_VALUE; 3244 3244 } 3245 3245 3246 + /* Copy src state preserving dst->parent and dst->live fields */ 3247 + static void copy_register_state(struct bpf_reg_state *dst, const struct bpf_reg_state *src) 3248 + { 3249 + struct bpf_reg_state *parent = dst->parent; 3250 + enum bpf_reg_liveness live = dst->live; 3251 + 3252 + *dst = *src; 3253 + dst->parent = parent; 3254 + dst->live = live; 3255 + } 3256 + 3246 3257 static void save_register_state(struct bpf_func_state *state, 3247 3258 int spi, struct bpf_reg_state *reg, 3248 3259 int size) 3249 3260 { 3250 3261 int i; 3251 3262 3252 - state->stack[spi].spilled_ptr = *reg; 3263 + copy_register_state(&state->stack[spi].spilled_ptr, reg); 3253 3264 if (size == BPF_REG_SIZE) 3254 3265 state->stack[spi].spilled_ptr.live |= REG_LIVE_WRITTEN; 3255 3266 ··· 3588 3577 */ 3589 3578 s32 subreg_def = state->regs[dst_regno].subreg_def; 3590 3579 3591 - state->regs[dst_regno] = *reg; 3580 + copy_register_state(&state->regs[dst_regno], reg); 3592 3581 state->regs[dst_regno].subreg_def = subreg_def; 3593 3582 } else { 3594 3583 for (i = 0; i < size; i++) { ··· 3609 3598 3610 3599 if (dst_regno >= 0) { 3611 3600 /* restore register state from stack */ 3612 - state->regs[dst_regno] = *reg; 3601 + copy_register_state(&state->regs[dst_regno], reg); 3613 3602 /* mark reg as written since spilled pointer state likely 3614 3603 * has its liveness marks cleared by is_state_visited() 3615 3604 * which resets stack/reg liveness for state transitions ··· 9603 9592 */ 9604 9593 if (!ptr_is_dst_reg) { 9605 9594 tmp = *dst_reg; 9606 - *dst_reg = *ptr_reg; 9595 + copy_register_state(dst_reg, ptr_reg); 9607 9596 } 9608 9597 ret = sanitize_speculative_path(env, NULL, env->insn_idx + 1, 9609 9598 env->insn_idx); ··· 10856 10845 * to propagate min/max range. 10857 10846 */ 10858 10847 src_reg->id = ++env->id_gen; 10859 - *dst_reg = *src_reg; 10848 + copy_register_state(dst_reg, src_reg); 10860 10849 dst_reg->live |= REG_LIVE_WRITTEN; 10861 10850 dst_reg->subreg_def = DEF_NOT_SUBREG; 10862 10851 } else { ··· 10867 10856 insn->src_reg); 10868 10857 return -EACCES; 10869 10858 } else if (src_reg->type == SCALAR_VALUE) { 10870 - *dst_reg = *src_reg; 10859 + copy_register_state(dst_reg, src_reg); 10871 10860 /* Make sure ID is cleared otherwise 10872 10861 * dst_reg min/max could be incorrectly 10873 10862 * propagated into src_reg by find_equal_scalars() ··· 11666 11655 11667 11656 bpf_for_each_reg_in_vstate(vstate, state, reg, ({ 11668 11657 if (reg->type == SCALAR_VALUE && reg->id == known_reg->id) 11669 - *reg = *known_reg; 11658 + copy_register_state(reg, known_reg); 11670 11659 })); 11671 11660 } 11672 11661
+2 -1
kernel/trace/bpf_trace.c
··· 833 833 834 834 work = container_of(entry, struct send_signal_irq_work, irq_work); 835 835 group_send_sig_info(work->sig, SEND_SIG_PRIV, work->task, work->type); 836 + put_task_struct(work->task); 836 837 } 837 838 838 839 static int bpf_send_signal_common(u32 sig, enum pid_type type) ··· 868 867 * to the irq_work. The current task may change when queued 869 868 * irq works get executed. 870 869 */ 871 - work->task = current; 870 + work->task = get_task_struct(current); 872 871 work->sig = sig; 873 872 work->type = type; 874 873 irq_work_queue(&work->irq_work);
+1
net/bridge/br_netfilter_hooks.c
··· 871 871 if (nf_bridge && !nf_bridge->in_prerouting && 872 872 !netif_is_l3_master(skb->dev) && 873 873 !netif_is_l3_slave(skb->dev)) { 874 + nf_bridge_info_free(skb); 874 875 state->okfn(state->net, state->sk, skb); 875 876 return NF_STOLEN; 876 877 }
+33 -36
net/can/isotp.c
··· 140 140 canid_t rxid; 141 141 ktime_t tx_gap; 142 142 ktime_t lastrxcf_tstamp; 143 - struct hrtimer rxtimer, txtimer; 143 + struct hrtimer rxtimer, txtimer, txfrtimer; 144 144 struct can_isotp_options opt; 145 145 struct can_isotp_fc_options rxfc, txfc; 146 146 struct can_isotp_ll_options ll; ··· 871 871 } 872 872 873 873 /* start timer to send next consecutive frame with correct delay */ 874 - hrtimer_start(&so->txtimer, so->tx_gap, HRTIMER_MODE_REL_SOFT); 874 + hrtimer_start(&so->txfrtimer, so->tx_gap, HRTIMER_MODE_REL_SOFT); 875 875 } 876 876 877 877 static enum hrtimer_restart isotp_tx_timer_handler(struct hrtimer *hrtimer) ··· 879 879 struct isotp_sock *so = container_of(hrtimer, struct isotp_sock, 880 880 txtimer); 881 881 struct sock *sk = &so->sk; 882 - enum hrtimer_restart restart = HRTIMER_NORESTART; 883 882 884 - switch (so->tx.state) { 885 - case ISOTP_SENDING: 883 + /* don't handle timeouts in IDLE state */ 884 + if (so->tx.state == ISOTP_IDLE) 885 + return HRTIMER_NORESTART; 886 886 887 - /* cfecho should be consumed by isotp_rcv_echo() here */ 888 - if (!so->cfecho) { 889 - /* start timeout for unlikely lost echo skb */ 890 - hrtimer_set_expires(&so->txtimer, 891 - ktime_add(ktime_get(), 892 - ktime_set(ISOTP_ECHO_TIMEOUT, 0))); 893 - restart = HRTIMER_RESTART; 887 + /* we did not get any flow control or echo frame in time */ 894 888 895 - /* push out the next consecutive frame */ 896 - isotp_send_cframe(so); 897 - break; 898 - } 889 + /* report 'communication error on send' */ 890 + sk->sk_err = ECOMM; 891 + if (!sock_flag(sk, SOCK_DEAD)) 892 + sk_error_report(sk); 899 893 900 - /* cfecho has not been cleared in isotp_rcv_echo() */ 901 - pr_notice_once("can-isotp: cfecho %08X timeout\n", so->cfecho); 902 - fallthrough; 894 + /* reset tx state */ 895 + so->tx.state = ISOTP_IDLE; 896 + wake_up_interruptible(&so->wait); 903 897 904 - case ISOTP_WAIT_FC: 905 - case ISOTP_WAIT_FIRST_FC: 898 + return HRTIMER_NORESTART; 899 + } 906 900 907 - /* we did not get any flow control frame in time */ 901 + static enum hrtimer_restart isotp_txfr_timer_handler(struct hrtimer *hrtimer) 902 + { 903 + struct isotp_sock *so = container_of(hrtimer, struct isotp_sock, 904 + txfrtimer); 908 905 909 - /* report 'communication error on send' */ 910 - sk->sk_err = ECOMM; 911 - if (!sock_flag(sk, SOCK_DEAD)) 912 - sk_error_report(sk); 906 + /* start echo timeout handling and cover below protocol error */ 907 + hrtimer_start(&so->txtimer, ktime_set(ISOTP_ECHO_TIMEOUT, 0), 908 + HRTIMER_MODE_REL_SOFT); 913 909 914 - /* reset tx state */ 915 - so->tx.state = ISOTP_IDLE; 916 - wake_up_interruptible(&so->wait); 917 - break; 910 + /* cfecho should be consumed by isotp_rcv_echo() here */ 911 + if (so->tx.state == ISOTP_SENDING && !so->cfecho) 912 + isotp_send_cframe(so); 918 913 919 - default: 920 - WARN_ONCE(1, "can-isotp: tx timer state %08X cfecho %08X\n", 921 - so->tx.state, so->cfecho); 922 - } 923 - 924 - return restart; 914 + return HRTIMER_NORESTART; 925 915 } 926 916 927 917 static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) ··· 1152 1162 /* wait for complete transmission of current pdu */ 1153 1163 wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE); 1154 1164 1165 + /* force state machines to be idle also when a signal occurred */ 1166 + so->tx.state = ISOTP_IDLE; 1167 + so->rx.state = ISOTP_IDLE; 1168 + 1155 1169 spin_lock(&isotp_notifier_lock); 1156 1170 while (isotp_busy_notifier == so) { 1157 1171 spin_unlock(&isotp_notifier_lock); ··· 1188 1194 } 1189 1195 } 1190 1196 1197 + hrtimer_cancel(&so->txfrtimer); 1191 1198 hrtimer_cancel(&so->txtimer); 1192 1199 hrtimer_cancel(&so->rxtimer); 1193 1200 ··· 1592 1597 so->rxtimer.function = isotp_rx_timer_handler; 1593 1598 hrtimer_init(&so->txtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT); 1594 1599 so->txtimer.function = isotp_tx_timer_handler; 1600 + hrtimer_init(&so->txfrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT); 1601 + so->txfrtimer.function = isotp_txfr_timer_handler; 1595 1602 1596 1603 init_waitqueue_head(&so->wait); 1597 1604 spin_lock_init(&so->rx_lock);
-4
net/can/j1939/transport.c
··· 1092 1092 bool active; 1093 1093 1094 1094 j1939_session_list_lock(priv); 1095 - /* This function should be called with a session ref-count of at 1096 - * least 2. 1097 - */ 1098 - WARN_ON_ONCE(kref_read(&session->kref) < 2); 1099 1095 active = j1939_session_deactivate_locked(session); 1100 1096 j1939_session_list_unlock(priv); 1101 1097
+31 -16
net/can/raw.c
··· 132 132 return; 133 133 134 134 /* make sure to not pass oversized frames to the socket */ 135 - if ((can_is_canfd_skb(oskb) && !ro->fd_frames && !ro->xl_frames) || 136 - (can_is_canxl_skb(oskb) && !ro->xl_frames)) 135 + if ((!ro->fd_frames && can_is_canfd_skb(oskb)) || 136 + (!ro->xl_frames && can_is_canxl_skb(oskb))) 137 137 return; 138 138 139 139 /* eliminate multiple filter matches for the same skb */ ··· 670 670 if (copy_from_sockptr(&ro->fd_frames, optval, optlen)) 671 671 return -EFAULT; 672 672 673 + /* Enabling CAN XL includes CAN FD */ 674 + if (ro->xl_frames && !ro->fd_frames) { 675 + ro->fd_frames = ro->xl_frames; 676 + return -EINVAL; 677 + } 673 678 break; 674 679 675 680 case CAN_RAW_XL_FRAMES: ··· 684 679 if (copy_from_sockptr(&ro->xl_frames, optval, optlen)) 685 680 return -EFAULT; 686 681 682 + /* Enabling CAN XL includes CAN FD */ 683 + if (ro->xl_frames) 684 + ro->fd_frames = ro->xl_frames; 687 685 break; 688 686 689 687 case CAN_RAW_JOIN_FILTERS: ··· 794 786 return 0; 795 787 } 796 788 789 + static bool raw_bad_txframe(struct raw_sock *ro, struct sk_buff *skb, int mtu) 790 + { 791 + /* Classical CAN -> no checks for flags and device capabilities */ 792 + if (can_is_can_skb(skb)) 793 + return false; 794 + 795 + /* CAN FD -> needs to be enabled and a CAN FD or CAN XL device */ 796 + if (ro->fd_frames && can_is_canfd_skb(skb) && 797 + (mtu == CANFD_MTU || can_is_canxl_dev_mtu(mtu))) 798 + return false; 799 + 800 + /* CAN XL -> needs to be enabled and a CAN XL device */ 801 + if (ro->xl_frames && can_is_canxl_skb(skb) && 802 + can_is_canxl_dev_mtu(mtu)) 803 + return false; 804 + 805 + return true; 806 + } 807 + 797 808 static int raw_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) 798 809 { 799 810 struct sock *sk = sock->sk; ··· 860 833 goto free_skb; 861 834 862 835 err = -EINVAL; 863 - if (ro->xl_frames && can_is_canxl_dev_mtu(dev->mtu)) { 864 - /* CAN XL, CAN FD and Classical CAN */ 865 - if (!can_is_canxl_skb(skb) && !can_is_canfd_skb(skb) && 866 - !can_is_can_skb(skb)) 867 - goto free_skb; 868 - } else if (ro->fd_frames && dev->mtu == CANFD_MTU) { 869 - /* CAN FD and Classical CAN */ 870 - if (!can_is_canfd_skb(skb) && !can_is_can_skb(skb)) 871 - goto free_skb; 872 - } else { 873 - /* Classical CAN */ 874 - if (!can_is_can_skb(skb)) 875 - goto free_skb; 876 - } 836 + if (raw_bad_txframe(ro, skb, dev->mtu)) 837 + goto free_skb; 877 838 878 839 sockcm_init(&sockc, sk); 879 840 if (msg->msg_controllen) {
+9
net/core/gro.c
··· 162 162 struct sk_buff *lp; 163 163 int segs; 164 164 165 + /* Do not splice page pool based packets w/ non-page pool 166 + * packets. This can result in reference count issues as page 167 + * pool pages will not decrement the reference count and will 168 + * instead be immediately returned to the pool or have frag 169 + * count decremented. 170 + */ 171 + if (p->pp_recycle != skb->pp_recycle) 172 + return -ETOOMANYREFS; 173 + 165 174 /* pairs with WRITE_ONCE() in netif_set_gro_max_size() */ 166 175 gro_max_size = READ_ONCE(p->dev->gro_max_size); 167 176
+2 -3
net/core/skbuff.c
··· 4100 4100 4101 4101 skb_shinfo(skb)->frag_list = NULL; 4102 4102 4103 - do { 4103 + while (list_skb) { 4104 4104 nskb = list_skb; 4105 4105 list_skb = list_skb->next; 4106 4106 ··· 4146 4146 if (skb_needs_linearize(nskb, features) && 4147 4147 __skb_linearize(nskb)) 4148 4148 goto err_linearize; 4149 - 4150 - } while (list_skb); 4149 + } 4151 4150 4152 4151 skb->truesize = skb->truesize - delta_truesize; 4153 4152 skb->data_len = skb->data_len - delta_len;
+34 -27
net/core/sock_map.c
··· 1569 1569 psock = sk_psock(sk); 1570 1570 if (unlikely(!psock)) { 1571 1571 rcu_read_unlock(); 1572 - if (sk->sk_prot->unhash) 1573 - sk->sk_prot->unhash(sk); 1574 - return; 1572 + saved_unhash = READ_ONCE(sk->sk_prot)->unhash; 1573 + } else { 1574 + saved_unhash = psock->saved_unhash; 1575 + sock_map_remove_links(sk, psock); 1576 + rcu_read_unlock(); 1575 1577 } 1576 - 1577 - saved_unhash = psock->saved_unhash; 1578 - sock_map_remove_links(sk, psock); 1579 - rcu_read_unlock(); 1580 - saved_unhash(sk); 1578 + if (WARN_ON_ONCE(saved_unhash == sock_map_unhash)) 1579 + return; 1580 + if (saved_unhash) 1581 + saved_unhash(sk); 1581 1582 } 1582 1583 EXPORT_SYMBOL_GPL(sock_map_unhash); 1583 1584 ··· 1591 1590 psock = sk_psock_get(sk); 1592 1591 if (unlikely(!psock)) { 1593 1592 rcu_read_unlock(); 1594 - if (sk->sk_prot->destroy) 1595 - sk->sk_prot->destroy(sk); 1596 - return; 1593 + saved_destroy = READ_ONCE(sk->sk_prot)->destroy; 1594 + } else { 1595 + saved_destroy = psock->saved_destroy; 1596 + sock_map_remove_links(sk, psock); 1597 + rcu_read_unlock(); 1598 + sk_psock_stop(psock); 1599 + sk_psock_put(sk, psock); 1597 1600 } 1598 - 1599 - saved_destroy = psock->saved_destroy; 1600 - sock_map_remove_links(sk, psock); 1601 - rcu_read_unlock(); 1602 - sk_psock_stop(psock); 1603 - sk_psock_put(sk, psock); 1604 - saved_destroy(sk); 1601 + if (WARN_ON_ONCE(saved_destroy == sock_map_destroy)) 1602 + return; 1603 + if (saved_destroy) 1604 + saved_destroy(sk); 1605 1605 } 1606 1606 EXPORT_SYMBOL_GPL(sock_map_destroy); 1607 1607 ··· 1617 1615 if (unlikely(!psock)) { 1618 1616 rcu_read_unlock(); 1619 1617 release_sock(sk); 1620 - return sk->sk_prot->close(sk, timeout); 1618 + saved_close = READ_ONCE(sk->sk_prot)->close; 1619 + } else { 1620 + saved_close = psock->saved_close; 1621 + sock_map_remove_links(sk, psock); 1622 + rcu_read_unlock(); 1623 + sk_psock_stop(psock); 1624 + release_sock(sk); 1625 + cancel_work_sync(&psock->work); 1626 + sk_psock_put(sk, psock); 1621 1627 } 1622 - 1623 - saved_close = psock->saved_close; 1624 - sock_map_remove_links(sk, psock); 1625 - rcu_read_unlock(); 1626 - sk_psock_stop(psock); 1627 - release_sock(sk); 1628 - cancel_work_sync(&psock->work); 1629 - sk_psock_put(sk, psock); 1628 + /* Make sure we do not recurse. This is a bug. 1629 + * Leak the socket instead of crashing on a stack overflow. 1630 + */ 1631 + if (WARN_ON_ONCE(saved_close == sock_map_close)) 1632 + return; 1630 1633 saved_close(sk, timeout); 1631 1634 } 1632 1635 EXPORT_SYMBOL_GPL(sock_map_close);
+2 -2
net/ipv4/tcp_bpf.c
··· 6 6 #include <linux/bpf.h> 7 7 #include <linux/init.h> 8 8 #include <linux/wait.h> 9 + #include <linux/util_macros.h> 9 10 10 11 #include <net/inet_common.h> 11 12 #include <net/tls.h> ··· 640 639 */ 641 640 void tcp_bpf_clone(const struct sock *sk, struct sock *newsk) 642 641 { 643 - int family = sk->sk_family == AF_INET6 ? TCP_BPF_IPV6 : TCP_BPF_IPV4; 644 642 struct proto *prot = newsk->sk_prot; 645 643 646 - if (prot == &tcp_bpf_prots[family][TCP_BPF_BASE]) 644 + if (is_insidevar(prot, tcp_bpf_prots)) 647 645 newsk->sk_prot = sk->sk_prot_creator; 648 646 } 649 647 #endif /* CONFIG_BPF_SYSCALL */
+32 -27
net/ipv6/addrconf.c
··· 3127 3127 offset = sizeof(struct in6_addr) - 4; 3128 3128 memcpy(&addr.s6_addr32[3], idev->dev->dev_addr + offset, 4); 3129 3129 3130 - if (idev->dev->flags&IFF_POINTOPOINT) { 3130 + if (!(idev->dev->flags & IFF_POINTOPOINT) && idev->dev->type == ARPHRD_SIT) { 3131 + scope = IPV6_ADDR_COMPATv4; 3132 + plen = 96; 3133 + pflags |= RTF_NONEXTHOP; 3134 + } else { 3131 3135 if (idev->cnf.addr_gen_mode == IN6_ADDR_GEN_MODE_NONE) 3132 3136 return; 3133 3137 3134 3138 addr.s6_addr32[0] = htonl(0xfe800000); 3135 3139 scope = IFA_LINK; 3136 3140 plen = 64; 3137 - } else { 3138 - scope = IPV6_ADDR_COMPATv4; 3139 - plen = 96; 3140 - pflags |= RTF_NONEXTHOP; 3141 3141 } 3142 3142 3143 3143 if (addr.s6_addr32[3]) { ··· 3447 3447 } 3448 3448 #endif 3449 3449 3450 + static void addrconf_init_auto_addrs(struct net_device *dev) 3451 + { 3452 + switch (dev->type) { 3453 + #if IS_ENABLED(CONFIG_IPV6_SIT) 3454 + case ARPHRD_SIT: 3455 + addrconf_sit_config(dev); 3456 + break; 3457 + #endif 3458 + #if IS_ENABLED(CONFIG_NET_IPGRE) || IS_ENABLED(CONFIG_IPV6_GRE) 3459 + case ARPHRD_IP6GRE: 3460 + case ARPHRD_IPGRE: 3461 + addrconf_gre_config(dev); 3462 + break; 3463 + #endif 3464 + case ARPHRD_LOOPBACK: 3465 + init_loopback(dev); 3466 + break; 3467 + 3468 + default: 3469 + addrconf_dev_config(dev); 3470 + break; 3471 + } 3472 + } 3473 + 3450 3474 static int fixup_permanent_addr(struct net *net, 3451 3475 struct inet6_dev *idev, 3452 3476 struct inet6_ifaddr *ifp) ··· 3639 3615 run_pending = 1; 3640 3616 } 3641 3617 3642 - switch (dev->type) { 3643 - #if IS_ENABLED(CONFIG_IPV6_SIT) 3644 - case ARPHRD_SIT: 3645 - addrconf_sit_config(dev); 3646 - break; 3647 - #endif 3648 - #if IS_ENABLED(CONFIG_NET_IPGRE) || IS_ENABLED(CONFIG_IPV6_GRE) 3649 - case ARPHRD_IP6GRE: 3650 - case ARPHRD_IPGRE: 3651 - addrconf_gre_config(dev); 3652 - break; 3653 - #endif 3654 - case ARPHRD_LOOPBACK: 3655 - init_loopback(dev); 3656 - break; 3657 - 3658 - default: 3659 - addrconf_dev_config(dev); 3660 - break; 3661 - } 3618 + addrconf_init_auto_addrs(dev); 3662 3619 3663 3620 if (!IS_ERR_OR_NULL(idev)) { 3664 3621 if (run_pending) ··· 6402 6397 6403 6398 if (idev->cnf.addr_gen_mode != new_val) { 6404 6399 idev->cnf.addr_gen_mode = new_val; 6405 - addrconf_dev_config(idev->dev); 6400 + addrconf_init_auto_addrs(idev->dev); 6406 6401 } 6407 6402 } else if (&net->ipv6.devconf_all->addr_gen_mode == ctl->data) { 6408 6403 struct net_device *dev; ··· 6413 6408 if (idev && 6414 6409 idev->cnf.addr_gen_mode != new_val) { 6415 6410 idev->cnf.addr_gen_mode = new_val; 6416 - addrconf_dev_config(idev->dev); 6411 + addrconf_init_auto_addrs(idev->dev); 6417 6412 } 6418 6413 } 6419 6414 }
-1
net/mac802154/rx.c
··· 213 213 ret = ieee802154_parse_frame_start(skb, &hdr); 214 214 if (ret) { 215 215 pr_debug("got invalid frame\n"); 216 - kfree_skb(skb); 217 216 return; 218 217 } 219 218
+6
net/mctp/af_mctp.c
··· 587 587 del_timer_sync(&msk->key_expiry); 588 588 } 589 589 590 + static void mctp_sk_destruct(struct sock *sk) 591 + { 592 + skb_queue_purge(&sk->sk_receive_queue); 593 + } 594 + 590 595 static struct proto mctp_proto = { 591 596 .name = "MCTP", 592 597 .owner = THIS_MODULE, ··· 628 623 return -ENOMEM; 629 624 630 625 sock_init_data(sock, sk); 626 + sk->sk_destruct = mctp_sk_destruct; 631 627 632 628 rc = 0; 633 629 if (sk->sk_prot->init)
+3 -2
net/netfilter/nf_conntrack_proto_sctp.c
··· 142 142 } 143 143 #endif 144 144 145 + /* do_basic_checks ensures sch->length > 0, do not use before */ 145 146 #define for_each_sctp_chunk(skb, sch, _sch, offset, dataoff, count) \ 146 147 for ((offset) = (dataoff) + sizeof(struct sctphdr), (count) = 0; \ 147 - ((sch) = skb_header_pointer((skb), (offset), sizeof(_sch), &(_sch))) && \ 148 - (sch)->length; \ 148 + (offset) < (skb)->len && \ 149 + ((sch) = skb_header_pointer((skb), (offset), sizeof(_sch), &(_sch))); \ 149 150 (offset) += (ntohs((sch)->length) + 3) & ~3, (count)++) 150 151 151 152 /* Some validity checks to make sure the chunks are fine */
+5
net/netrom/af_netrom.c
··· 400 400 struct sock *sk = sock->sk; 401 401 402 402 lock_sock(sk); 403 + if (sock->state != SS_UNCONNECTED) { 404 + release_sock(sk); 405 + return -EINVAL; 406 + } 407 + 403 408 if (sk->sk_state != TCP_LISTEN) { 404 409 memset(&nr_sk(sk)->user_addr, 0, AX25_ADDR_LEN); 405 410 sk->sk_max_ack_backlog = backlog;
+6 -6
net/openvswitch/datapath.c
··· 1004 1004 key = kzalloc(sizeof(*key), GFP_KERNEL); 1005 1005 if (!key) { 1006 1006 error = -ENOMEM; 1007 - goto err_kfree_key; 1007 + goto err_kfree_flow; 1008 1008 } 1009 1009 1010 1010 ovs_match_init(&match, key, false, &mask); 1011 1011 error = ovs_nla_get_match(net, &match, a[OVS_FLOW_ATTR_KEY], 1012 1012 a[OVS_FLOW_ATTR_MASK], log); 1013 1013 if (error) 1014 - goto err_kfree_flow; 1014 + goto err_kfree_key; 1015 1015 1016 1016 ovs_flow_mask_key(&new_flow->key, key, true, &mask); 1017 1017 ··· 1019 1019 error = ovs_nla_get_identifier(&new_flow->id, a[OVS_FLOW_ATTR_UFID], 1020 1020 key, log); 1021 1021 if (error) 1022 - goto err_kfree_flow; 1022 + goto err_kfree_key; 1023 1023 1024 1024 /* Validate actions. */ 1025 1025 error = ovs_nla_copy_actions(net, a[OVS_FLOW_ATTR_ACTIONS], 1026 1026 &new_flow->key, &acts, log); 1027 1027 if (error) { 1028 1028 OVS_NLERR(log, "Flow actions may not be safe on all matching packets."); 1029 - goto err_kfree_flow; 1029 + goto err_kfree_key; 1030 1030 } 1031 1031 1032 1032 reply = ovs_flow_cmd_alloc_info(acts, &new_flow->id, info, false, ··· 1126 1126 kfree_skb(reply); 1127 1127 err_kfree_acts: 1128 1128 ovs_nla_free_flow_actions(acts); 1129 - err_kfree_flow: 1130 - ovs_flow_free(new_flow, false); 1131 1129 err_kfree_key: 1132 1130 kfree(key); 1131 + err_kfree_flow: 1132 + ovs_flow_free(new_flow, false); 1133 1133 error: 1134 1134 return error; 1135 1135 }
+4 -1
net/qrtr/ns.c
··· 83 83 84 84 node->id = node_id; 85 85 86 - radix_tree_insert(&nodes, node_id, node); 86 + if (radix_tree_insert(&nodes, node_id, node)) { 87 + kfree(node); 88 + return NULL; 89 + } 87 90 88 91 return node; 89 92 }
+8
net/rose/af_rose.c
··· 488 488 { 489 489 struct sock *sk = sock->sk; 490 490 491 + lock_sock(sk); 492 + if (sock->state != SS_UNCONNECTED) { 493 + release_sock(sk); 494 + return -EINVAL; 495 + } 496 + 491 497 if (sk->sk_state != TCP_LISTEN) { 492 498 struct rose_sock *rose = rose_sk(sk); 493 499 ··· 503 497 memset(rose->dest_digis, 0, AX25_ADDR_LEN * ROSE_MAX_DIGIS); 504 498 sk->sk_max_ack_backlog = backlog; 505 499 sk->sk_state = TCP_LISTEN; 500 + release_sock(sk); 506 501 return 0; 507 502 } 503 + release_sock(sk); 508 504 509 505 return -EOPNOTSUPP; 510 506 }
+4 -1
net/sched/sch_htb.c
··· 431 431 while (cl->cmode == HTB_MAY_BORROW && p && mask) { 432 432 m = mask; 433 433 while (m) { 434 - int prio = ffz(~m); 434 + unsigned int prio = ffz(~m); 435 + 436 + if (WARN_ON_ONCE(prio > ARRAY_SIZE(p->inner.clprio))) 437 + break; 435 438 m &= ~(1 << prio); 436 439 437 440 if (p->inner.clprio[prio].feed.rb_node)
+1 -3
net/sctp/transport.c
··· 196 196 197 197 /* When a data chunk is sent, reset the heartbeat interval. */ 198 198 expires = jiffies + sctp_transport_timeout(transport); 199 - if ((time_before(transport->hb_timer.expires, expires) || 200 - !timer_pending(&transport->hb_timer)) && 201 - !mod_timer(&transport->hb_timer, 199 + if (!mod_timer(&transport->hb_timer, 202 200 expires + get_random_u32_below(transport->rto))) 203 201 sctp_transport_hold(transport); 204 202 }
+1 -1
net/tls/tls_sw.c
··· 2427 2427 { 2428 2428 struct tls_rec *rec; 2429 2429 2430 - rec = list_first_entry(&ctx->tx_list, struct tls_rec, list); 2430 + rec = list_first_entry_or_null(&ctx->tx_list, struct tls_rec, list); 2431 2431 if (!rec) 2432 2432 return false; 2433 2433
+63 -18
tools/testing/selftests/bpf/prog_tests/sockmap_listen.c
··· 30 30 #define MAX_STRERR_LEN 256 31 31 #define MAX_TEST_NAME 80 32 32 33 + #define __always_unused __attribute__((__unused__)) 34 + 33 35 #define _FAIL(errnum, fmt...) \ 34 36 ({ \ 35 37 error_at_line(0, (errnum), __func__, __LINE__, fmt); \ ··· 323 321 return socket_loopback_reuseport(family, sotype, -1); 324 322 } 325 323 326 - static void test_insert_invalid(int family, int sotype, int mapfd) 324 + static void test_insert_invalid(struct test_sockmap_listen *skel __always_unused, 325 + int family, int sotype, int mapfd) 327 326 { 328 327 u32 key = 0; 329 328 u64 value; ··· 341 338 FAIL_ERRNO("map_update: expected EBADF"); 342 339 } 343 340 344 - static void test_insert_opened(int family, int sotype, int mapfd) 341 + static void test_insert_opened(struct test_sockmap_listen *skel __always_unused, 342 + int family, int sotype, int mapfd) 345 343 { 346 344 u32 key = 0; 347 345 u64 value; ··· 363 359 xclose(s); 364 360 } 365 361 366 - static void test_insert_bound(int family, int sotype, int mapfd) 362 + static void test_insert_bound(struct test_sockmap_listen *skel __always_unused, 363 + int family, int sotype, int mapfd) 367 364 { 368 365 struct sockaddr_storage addr; 369 366 socklen_t len; ··· 391 386 xclose(s); 392 387 } 393 388 394 - static void test_insert(int family, int sotype, int mapfd) 389 + static void test_insert(struct test_sockmap_listen *skel __always_unused, 390 + int family, int sotype, int mapfd) 395 391 { 396 392 u64 value; 397 393 u32 key; ··· 408 402 xclose(s); 409 403 } 410 404 411 - static void test_delete_after_insert(int family, int sotype, int mapfd) 405 + static void test_delete_after_insert(struct test_sockmap_listen *skel __always_unused, 406 + int family, int sotype, int mapfd) 412 407 { 413 408 u64 value; 414 409 u32 key; ··· 426 419 xclose(s); 427 420 } 428 421 429 - static void test_delete_after_close(int family, int sotype, int mapfd) 422 + static void test_delete_after_close(struct test_sockmap_listen *skel __always_unused, 423 + int family, int sotype, int mapfd) 430 424 { 431 425 int err, s; 432 426 u64 value; ··· 450 442 FAIL_ERRNO("map_delete: expected EINVAL/EINVAL"); 451 443 } 452 444 453 - static void test_lookup_after_insert(int family, int sotype, int mapfd) 445 + static void test_lookup_after_insert(struct test_sockmap_listen *skel __always_unused, 446 + int family, int sotype, int mapfd) 454 447 { 455 448 u64 cookie, value; 456 449 socklen_t len; ··· 479 470 xclose(s); 480 471 } 481 472 482 - static void test_lookup_after_delete(int family, int sotype, int mapfd) 473 + static void test_lookup_after_delete(struct test_sockmap_listen *skel __always_unused, 474 + int family, int sotype, int mapfd) 483 475 { 484 476 int err, s; 485 477 u64 value; ··· 503 493 xclose(s); 504 494 } 505 495 506 - static void test_lookup_32_bit_value(int family, int sotype, int mapfd) 496 + static void test_lookup_32_bit_value(struct test_sockmap_listen *skel __always_unused, 497 + int family, int sotype, int mapfd) 507 498 { 508 499 u32 key, value32; 509 500 int err, s; ··· 534 523 xclose(s); 535 524 } 536 525 537 - static void test_update_existing(int family, int sotype, int mapfd) 526 + static void test_update_existing(struct test_sockmap_listen *skel __always_unused, 527 + int family, int sotype, int mapfd) 538 528 { 539 529 int s1, s2; 540 530 u64 value; ··· 563 551 /* Exercise the code path where we destroy child sockets that never 564 552 * got accept()'ed, aka orphans, when parent socket gets closed. 565 553 */ 566 - static void test_destroy_orphan_child(int family, int sotype, int mapfd) 554 + static void do_destroy_orphan_child(int family, int sotype, int mapfd) 567 555 { 568 556 struct sockaddr_storage addr; 569 557 socklen_t len; ··· 594 582 xclose(s); 595 583 } 596 584 585 + static void test_destroy_orphan_child(struct test_sockmap_listen *skel, 586 + int family, int sotype, int mapfd) 587 + { 588 + int msg_verdict = bpf_program__fd(skel->progs.prog_msg_verdict); 589 + int skb_verdict = bpf_program__fd(skel->progs.prog_skb_verdict); 590 + const struct test { 591 + int progfd; 592 + enum bpf_attach_type atype; 593 + } tests[] = { 594 + { -1, -1 }, 595 + { msg_verdict, BPF_SK_MSG_VERDICT }, 596 + { skb_verdict, BPF_SK_SKB_VERDICT }, 597 + }; 598 + const struct test *t; 599 + 600 + for (t = tests; t < tests + ARRAY_SIZE(tests); t++) { 601 + if (t->progfd != -1 && 602 + xbpf_prog_attach(t->progfd, mapfd, t->atype, 0) != 0) 603 + return; 604 + 605 + do_destroy_orphan_child(family, sotype, mapfd); 606 + 607 + if (t->progfd != -1) 608 + xbpf_prog_detach2(t->progfd, mapfd, t->atype); 609 + } 610 + } 611 + 597 612 /* Perform a passive open after removing listening socket from SOCKMAP 598 613 * to ensure that callbacks get restored properly. 599 614 */ 600 - static void test_clone_after_delete(int family, int sotype, int mapfd) 615 + static void test_clone_after_delete(struct test_sockmap_listen *skel __always_unused, 616 + int family, int sotype, int mapfd) 601 617 { 602 618 struct sockaddr_storage addr; 603 619 socklen_t len; ··· 661 621 * SOCKMAP, but got accept()'ed only after the parent has been removed 662 622 * from SOCKMAP, gets cloned without parent psock state or callbacks. 663 623 */ 664 - static void test_accept_after_delete(int family, int sotype, int mapfd) 624 + static void test_accept_after_delete(struct test_sockmap_listen *skel __always_unused, 625 + int family, int sotype, int mapfd) 665 626 { 666 627 struct sockaddr_storage addr; 667 628 const u32 zero = 0; ··· 716 675 /* Check that child socket that got created and accepted while parent 717 676 * was in a SOCKMAP is cloned without parent psock state or callbacks. 718 677 */ 719 - static void test_accept_before_delete(int family, int sotype, int mapfd) 678 + static void test_accept_before_delete(struct test_sockmap_listen *skel __always_unused, 679 + int family, int sotype, int mapfd) 720 680 { 721 681 struct sockaddr_storage addr; 722 682 const u32 zero = 0, one = 1; ··· 826 784 return NULL; 827 785 } 828 786 829 - static void test_syn_recv_insert_delete(int family, int sotype, int mapfd) 787 + static void test_syn_recv_insert_delete(struct test_sockmap_listen *skel __always_unused, 788 + int family, int sotype, int mapfd) 830 789 { 831 790 struct connect_accept_ctx ctx = { 0 }; 832 791 struct sockaddr_storage addr; ··· 890 847 return NULL; 891 848 } 892 849 893 - static void test_race_insert_listen(int family, int socktype, int mapfd) 850 + static void test_race_insert_listen(struct test_sockmap_listen *skel __always_unused, 851 + int family, int socktype, int mapfd) 894 852 { 895 853 struct connect_accept_ctx ctx = { 0 }; 896 854 const u32 zero = 0; ··· 1517 1473 int family, int sotype) 1518 1474 { 1519 1475 const struct op_test { 1520 - void (*fn)(int family, int sotype, int mapfd); 1476 + void (*fn)(struct test_sockmap_listen *skel, 1477 + int family, int sotype, int mapfd); 1521 1478 const char *name; 1522 1479 int sotype; 1523 1480 } tests[] = { ··· 1565 1520 if (!test__start_subtest(s)) 1566 1521 continue; 1567 1522 1568 - t->fn(family, sotype, map_fd); 1523 + t->fn(skel, family, sotype, map_fd); 1569 1524 test_ops_cleanup(map); 1570 1525 } 1571 1526 }
+36
tools/testing/selftests/bpf/verifier/search_pruning.c
··· 225 225 .result_unpriv = ACCEPT, 226 226 .insn_processed = 15, 227 227 }, 228 + /* The test performs a conditional 64-bit write to a stack location 229 + * fp[-8], this is followed by an unconditional 8-bit write to fp[-8], 230 + * then data is read from fp[-8]. This sequence is unsafe. 231 + * 232 + * The test would be mistakenly marked as safe w/o dst register parent 233 + * preservation in verifier.c:copy_register_state() function. 234 + * 235 + * Note the usage of BPF_F_TEST_STATE_FREQ to force creation of the 236 + * checkpoint state after conditional 64-bit assignment. 237 + */ 238 + { 239 + "write tracking and register parent chain bug", 240 + .insns = { 241 + /* r6 = ktime_get_ns() */ 242 + BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns), 243 + BPF_MOV64_REG(BPF_REG_6, BPF_REG_0), 244 + /* r0 = ktime_get_ns() */ 245 + BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns), 246 + /* if r0 > r6 goto +1 */ 247 + BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_6, 1), 248 + /* *(u64 *)(r10 - 8) = 0xdeadbeef */ 249 + BPF_ST_MEM(BPF_DW, BPF_REG_FP, -8, 0xdeadbeef), 250 + /* r1 = 42 */ 251 + BPF_MOV64_IMM(BPF_REG_1, 42), 252 + /* *(u8 *)(r10 - 8) = r1 */ 253 + BPF_STX_MEM(BPF_B, BPF_REG_FP, BPF_REG_1, -8), 254 + /* r2 = *(u64 *)(r10 - 8) */ 255 + BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_FP, -8), 256 + /* exit(0) */ 257 + BPF_MOV64_IMM(BPF_REG_0, 0), 258 + BPF_EXIT_INSN(), 259 + }, 260 + .flags = BPF_F_TEST_STATE_FREQ, 261 + .errstr = "invalid read from stack off -8+1 size 8", 262 + .result = REJECT, 263 + },
+1 -1
tools/testing/selftests/net/cmsg_ipv6.sh
··· 6 6 NS=ns 7 7 IP6=2001:db8:1::1/64 8 8 TGT6=2001:db8:1::2 9 - TMPF=`mktemp` 9 + TMPF=$(mktemp --suffix ".pcap") 10 10 11 11 cleanup() 12 12 {
+19 -3
tools/testing/selftests/net/udpgso_bench.sh
··· 7 7 readonly YELLOW='\033[0;33m' 8 8 readonly RED='\033[0;31m' 9 9 readonly NC='\033[0m' # No Color 10 + readonly TESTPORT=8000 10 11 11 12 readonly KSFT_PASS=0 12 13 readonly KSFT_FAIL=1 ··· 57 56 58 57 run_one() { 59 58 local -r args=$@ 59 + local nr_socks=0 60 + local i=0 61 + local -r timeout=10 60 62 61 - ./udpgso_bench_rx & 62 - ./udpgso_bench_rx -t & 63 + ./udpgso_bench_rx -p "$TESTPORT" & 64 + ./udpgso_bench_rx -p "$TESTPORT" -t & 63 65 64 - ./udpgso_bench_tx ${args} 66 + # Wait for the above test program to get ready to receive connections. 67 + while [ "$i" -lt "$timeout" ]; do 68 + nr_socks="$(ss -lnHi | grep -c "\*:${TESTPORT}")" 69 + [ "$nr_socks" -eq 2 ] && break 70 + i=$((i + 1)) 71 + sleep 1 72 + done 73 + if [ "$nr_socks" -ne 2 ]; then 74 + echo "timed out while waiting for udpgso_bench_rx" 75 + exit 1 76 + fi 77 + 78 + ./udpgso_bench_tx -p "$TESTPORT" ${args} 65 79 } 66 80 67 81 run_in_netns() {
+3 -1
tools/testing/selftests/net/udpgso_bench_rx.c
··· 250 250 static void do_flush_udp(int fd) 251 251 { 252 252 static char rbuf[ETH_MAX_MTU]; 253 - int ret, len, gso_size, budget = 256; 253 + int ret, len, gso_size = 0, budget = 256; 254 254 255 255 len = cfg_read_all ? sizeof(rbuf) : 0; 256 256 while (budget--) { ··· 336 336 cfg_verify = true; 337 337 cfg_read_all = true; 338 338 break; 339 + default: 340 + exit(1); 339 341 } 340 342 } 341 343
+29 -7
tools/testing/selftests/net/udpgso_bench_tx.c
··· 62 62 static int cfg_port = 8000; 63 63 static int cfg_runtime_ms = -1; 64 64 static bool cfg_poll; 65 + static int cfg_poll_loop_timeout_ms = 2000; 65 66 static bool cfg_segment; 66 67 static bool cfg_sendmmsg; 67 68 static bool cfg_tcp; ··· 236 235 } 237 236 } 238 237 239 - static void flush_errqueue(int fd, const bool do_poll) 238 + static void flush_errqueue(int fd, const bool do_poll, 239 + unsigned long poll_timeout, const bool poll_err) 240 240 { 241 241 if (do_poll) { 242 242 struct pollfd fds = {0}; 243 243 int ret; 244 244 245 245 fds.fd = fd; 246 - ret = poll(&fds, 1, 500); 246 + ret = poll(&fds, 1, poll_timeout); 247 247 if (ret == 0) { 248 - if (cfg_verbose) 248 + if ((cfg_verbose) && (poll_err)) 249 249 fprintf(stderr, "poll timeout\n"); 250 250 } else if (ret < 0) { 251 251 error(1, errno, "poll"); ··· 254 252 } 255 253 256 254 flush_errqueue_recv(fd); 255 + } 256 + 257 + static void flush_errqueue_retry(int fd, unsigned long num_sends) 258 + { 259 + unsigned long tnow, tstop; 260 + bool first_try = true; 261 + 262 + tnow = gettimeofday_ms(); 263 + tstop = tnow + cfg_poll_loop_timeout_ms; 264 + do { 265 + flush_errqueue(fd, true, tstop - tnow, first_try); 266 + first_try = false; 267 + tnow = gettimeofday_ms(); 268 + } while ((stat_zcopies != num_sends) && (tnow < tstop)); 257 269 } 258 270 259 271 static int send_tcp(int fd, char *data) ··· 429 413 430 414 static void usage(const char *filepath) 431 415 { 432 - error(1, 0, "Usage: %s [-46acmHPtTuvz] [-C cpu] [-D dst ip] [-l secs] [-M messagenr] [-p port] [-s sendsize] [-S gsosize]", 416 + error(1, 0, "Usage: %s [-46acmHPtTuvz] [-C cpu] [-D dst ip] [-l secs] " 417 + "[-L secs] [-M messagenr] [-p port] [-s sendsize] [-S gsosize]", 433 418 filepath); 434 419 } 435 420 ··· 440 423 int max_len, hdrlen; 441 424 int c; 442 425 443 - while ((c = getopt(argc, argv, "46acC:D:Hl:mM:p:s:PS:tTuvz")) != -1) { 426 + while ((c = getopt(argc, argv, "46acC:D:Hl:L:mM:p:s:PS:tTuvz")) != -1) { 444 427 switch (c) { 445 428 case '4': 446 429 if (cfg_family != PF_UNSPEC) ··· 468 451 break; 469 452 case 'l': 470 453 cfg_runtime_ms = strtoul(optarg, NULL, 10) * 1000; 454 + break; 455 + case 'L': 456 + cfg_poll_loop_timeout_ms = strtoul(optarg, NULL, 10) * 1000; 471 457 break; 472 458 case 'm': 473 459 cfg_sendmmsg = true; ··· 510 490 case 'z': 511 491 cfg_zerocopy = true; 512 492 break; 493 + default: 494 + exit(1); 513 495 } 514 496 } 515 497 ··· 699 677 num_sends += send_udp(fd, buf[i]); 700 678 num_msgs++; 701 679 if ((cfg_zerocopy && ((num_msgs & 0xF) == 0)) || cfg_tx_tstamp) 702 - flush_errqueue(fd, cfg_poll); 680 + flush_errqueue(fd, cfg_poll, 500, true); 703 681 704 682 if (cfg_msg_nr && num_msgs >= cfg_msg_nr) 705 683 break; ··· 718 696 } while (!interrupted && (cfg_runtime_ms == -1 || tnow < tstop)); 719 697 720 698 if (cfg_zerocopy || cfg_tx_tstamp) 721 - flush_errqueue(fd, true); 699 + flush_errqueue_retry(fd, num_sends); 722 700 723 701 if (close(fd)) 724 702 error(1, errno, "close");