Skip to content

Commit e13caf1

Browse files
torvaldstorvalds
committed
Merge tag 'net-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Paolo Abeni: "Including fixes from Wireless, IPsec, Netfilter and Bluetooth. Current release - new code bugs: - netfilter: flowtable: use correct direction to set up tunnel route Previous releases - regressions: - wifi: - mac80211: - free AP_VLAN bc_buf SKBs outside IRQ lock - defer link RX stats percpu free to RCU - fix double free on alloc failure - cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock - ipv4: free fib_alias with kfree_rcu() on insert error path - sched: act_tunnel_key: Defer dst_release to RCU callback - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() - bluetooth: fix locking in unpair_device/disconnect_sync - can: add locking for raw flags bitfield - openvswitch: reject oversized nested action attrs - eth: - bnxt_en: handle partially initialized auxiliary devices - ppp: defer channel free to an RCU grace period to fix UAF Previous releases - always broken: - netfilter: xt_nat: reject unsupported target families - wifi: - brcmfmac: fix heap overflow on a short auth frame - cfg80211: add missing FTM API validation - xfrm: - reject optional IPTFS templates in outbound policies - policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - bluetooth: revalidate LOAD_CONN_PARAM queued update - can: fix lockless bound/ifindex race and silent RX_SETUP failure - eth: mlx5: free mlx5_st_idx_data on final dealloc" * tag 'net-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (108 commits) mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n llc: fix SAP refcount leak when creating incoming sockets selftests: netconsole: only restore MAC when it changed on resume bnxt_en: Handle partially initialized auxiliary devices sctp: fix auth_hmacs array size in struct sctp_cookie net/sched: act_tunnel_key: Defer dst_release to RCU callback dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() tcp: fix TIME_WAIT socket reference leak on PSP policy failure net/mlx5: free mlx5_st_idx_data on final dealloc can: isotp: serialize TX state transitions under so->rx_lock can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER can: isotp: use unconditional synchronize_rcu() in isotp_release() can: bcm: track a single source interface for ANYDEV timeout/throttle ops can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() can: bcm: fix stale rx/tx ops after device removal can: bcm: add missing device refcount for CAN filter removal can: bcm: validate frame length in bcm_rx_setup() for RTR replies can: bcm: extend bcm_tx_lock usage for data and timer updates can: bcm: add missing rcu list annotations and operations can: bcm: fix CAN frame rx/tx statistics ...
2 parents af5e34a + 56d96fe commit e13caf1

98 files changed

Lines changed: 1681 additions & 601 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.mailmap‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -826,8 +826,8 @@ Sriram Yagnaraman <sriram.yagnaraman@ericsson.com> <sriram.yagnaraman@est.tech>
826826
Stanislav Fomichev <sdf@fomichev.me> <sdf@google.com>
827827
Stanislav Fomichev <sdf@fomichev.me> <stfomichev@gmail.com>
828828
Stefan Wahren <wahrenst@gmx.net> <stefan.wahren@i2se.com>
829-
Stéphane Grosjean <stephane.grosjean@hms-networks.com> <s.grosjean@peak-system.com>
830-
Stéphane Grosjean <stephane.grosjean@hms-networks.com> <stephane.grosjean@free.fr>
829+
Stéphane Grosjean <s.grosjean@peak-system.fr> <s.grosjean@peak-system.com>
830+
Stéphane Grosjean <s.grosjean@peak-system.fr> <stephane.grosjean@free.fr>
831831
Stéphane Witzmann <stephane.witzmann@ubpmes.univ-bpclermont.fr>
832832
Stephen Hemminger <stephen@networkplumber.org> <shemminger@linux-foundation.org>
833833
Stephen Hemminger <stephen@networkplumber.org> <shemminger@osdl.org>

‎drivers/bluetooth/btqca.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -415,7 +415,7 @@ static int qca_tlv_check_data(struct hci_dev *hdev,
415415

416416
idx = 0;
417417
data = tlv->data;
418-
while (idx < length - sizeof(struct tlv_type_nvm)) {
418+
while (idx + sizeof(struct tlv_type_nvm) <= length) {
419419
tlv_nvm = (struct tlv_type_nvm *)(data + idx);
420420

421421
tag_id = le16_to_cpu(tlv_nvm->tag_id);

‎drivers/bluetooth/btrtl.c‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -797,8 +797,9 @@ static int rtlbt_parse_firmware(struct hci_dev *hdev,
797797
}
798798

799799
BT_DBG("length=%x offset=%x index %d", patch_length, patch_offset, i);
800-
min_size = patch_offset + patch_length;
801-
if (btrtl_dev->fw_len < min_size)
800+
if (patch_length < sizeof(epatch_info->fw_version) ||
801+
patch_offset > btrtl_dev->fw_len ||
802+
patch_length > btrtl_dev->fw_len - patch_offset)
802803
return -EINVAL;
803804

804805
/* Copy the firmware into a new buffer and write the version at

‎drivers/bluetooth/hci_qca.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1087,6 +1087,10 @@ static void qca_controller_memdump(struct work_struct *work)
10871087
if (!(qca_memdump->ram_dump_size)) {
10881088
bt_dev_err(hu->hdev, "Rx invalid memdump size");
10891089
kfree(qca_memdump);
1090+
qca->qca_memdump = NULL;
1091+
qca->memdump_state = QCA_MEMDUMP_COLLECTED;
1092+
clear_and_wake_up_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
1093+
clear_bit(QCA_IBS_DISABLED, &qca->flags);
10901094
kfree_skb(skb);
10911095
mutex_unlock(&qca->hci_memdump_lock);
10921096
return;

‎drivers/dpll/dpll_netlink.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -567,6 +567,9 @@ dpll_msg_add_pin_ref_sync(struct sk_buff *msg, struct dpll_pin *pin,
567567
if (!dpll_pin_available(ref_sync_pin))
568568
continue;
569569
ref_sync_pin_priv = dpll_pin_on_dpll_priv(dpll, ref_sync_pin);
570+
/* Pin may have been unregistered from this dpll already */
571+
if (!ref_sync_pin_priv)
572+
continue;
570573
if (WARN_ON(!ops->ref_sync_get))
571574
return -EOPNOTSUPP;
572575
ret = ops->ref_sync_get(pin, pin_priv, ref_sync_pin,

‎drivers/net/can/Kconfig‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -40,11 +40,8 @@ config CAN_VXCAN
4040
When one end receives the packet it appears on its pair and vice
4141
versa. The vxcan can be used for cross namespace communication.
4242

43-
In opposite to vcan loopback devices the vxcan only forwards CAN
44-
frames to its pair and does *not* provide a local echo of sent
45-
CAN frames. To disable a potential echo in af_can.c the vxcan driver
46-
announces IFF_ECHO in the interface flags. To have a clean start
47-
in each namespace the CAN GW hop counter is set to zero.
43+
To have a clean start in each namespace the CAN GW hop counter is
44+
set to zero.
4845

4946
This driver can also be built as a module. If so, the module
5047
will be called vxcan.

‎drivers/net/can/peak_canfd/peak_canfd.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
/* Copyright (C) 2007, 2011 Wolfgang Grandegger <wg@grandegger.com>
33
*
44
* Copyright (C) 2016-2025 PEAK System-Technik GmbH
5-
* Author: Stéphane Grosjean <stephane.grosjean@hms-networks.com>
5+
* Author: Stéphane Grosjean <s.grosjean@peak-system.fr>
66
*/
77

88
#include <linux/can.h>

‎drivers/net/can/peak_canfd/peak_canfd_user.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
/* CAN driver for PEAK System micro-CAN based adapters
33
*
44
* Copyright (C) 2003-2025 PEAK System-Technik GmbH
5-
* Author: Stéphane Grosjean <stephane.grosjean@hms-networks.com>
5+
* Author: Stéphane Grosjean <s.grosjean@peak-system.fr>
66
*/
77
#ifndef PEAK_CANFD_USER_H
88
#define PEAK_CANFD_USER_H

‎drivers/net/can/peak_canfd/peak_pciefd_main.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
* Derived from the PCAN project file driver/src/pcan_pci.c:
55
*
66
* Copyright (C) 2001-2025 PEAK System-Technik GmbH
7-
* Author: Stéphane Grosjean <stephane.grosjean@hms-networks.com>
7+
* Author: Stéphane Grosjean <s.grosjean@peak-system.fr>
88
*/
99

1010
#include <linux/kernel.h>
@@ -19,7 +19,7 @@
1919

2020
#include "peak_canfd_user.h"
2121

22-
MODULE_AUTHOR("Stéphane Grosjean <stephane.grosjean@hms-networks.com>");
22+
MODULE_AUTHOR("Stéphane Grosjean <s.grosjean@peak-system.fr>");
2323
MODULE_DESCRIPTION("Socket-CAN driver for PEAK PCAN PCIe/M.2 FD family cards");
2424
MODULE_LICENSE("GPL v2");
2525

‎drivers/net/can/sja1000/peak_pci.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
* Derived from the PCAN project file driver/src/pcan_pci.c:
66
*
77
* Copyright (C) 2001-2025 PEAK System-Technik GmbH
8-
* Author: Stéphane Grosjean <stephane.grosjean@hms-networks.com>
8+
* Author: Stéphane Grosjean <s.grosjean@peak-system.fr>
99
*/
1010

1111
#include <linux/kernel.h>
@@ -22,7 +22,7 @@
2222

2323
#include "sja1000.h"
2424

25-
MODULE_AUTHOR("Stéphane Grosjean <stephane.grosjean@hms-networks.com>");
25+
MODULE_AUTHOR("Stéphane Grosjean <s.grosjean@peak-system.fr>");
2626
MODULE_DESCRIPTION("Socket-CAN driver for PEAK PCAN PCI family cards");
2727
MODULE_LICENSE("GPL v2");
2828

0 commit comments

Comments
 (0)