Skip to content

Commit fcee7d8

Browse files
torvaldstorvalds
committed
Merge tag 'net-7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Jakub Kicinski: "Including fixes from Netfilter, IPsec, Bluetooth and WiFi. Current release - fix to a fix: - ipmr: add __rcu to netns_ipv4.mrt, make sure we hold the RCU lock in all relevant places Current release - new code bugs: - fixes for the recently added resizable hash tables - ipv6: make sure we default IPv6 tunnel drivers to =m now that IPv6 itself is built in - drv: octeontx2-af: fixes for parser/CAM fixes Previous releases - regressions: - phy: micrel: fix LAN8814 QSGMII soft reset - wifi: - cw1200: revert "Fix locking in error paths" - ath12k: fix crash on WCN7850, due to adding the same queue buffer to a list multiple times Previous releases - always broken: - number of info leak fixes - ipv6: implement limits on extension header parsing - wifi: number of fixes for missing bound checks in the drivers - Bluetooth: fixes for races and locking issues - af_unix: - fix an issue between garbage collection and PEEK - fix yet another issue with OOB data - xfrm: esp: avoid in-place decrypt on shared skb frags - netfilter: replace skb_try_make_writable() by skb_ensure_writable() - openvswitch: vport: fix race between tunnel creation and linking leading to invalid memory accesses (type confusion) - drv: amd-xgbe: fix PTP addend overflow causing frozen clock Misc: - sched/isolation: make HK_TYPE_KTHREAD an alias of HK_TYPE_DOMAIN (for relevant IPVS change)" * tag 'net-7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (190 commits) net: sparx5: configure serdes for 1000BASE-X in sparx5_port_init() net: sparx5: fix wrong chip ids for TSN SKUs net: stmmac: dwmac-nuvoton: fix NULL pointer dereference in nvt_set_phy_intf_sel() tcp: Fix dst leak in tcp_v6_connect(). ipmr: Call ipmr_fib_lookup() under RCU. net: phy: broadcom: Save PHY counters during suspend net/smc: fix missing sk_err when TCP handshake fails af_unix: Reject SIOCATMARK on non-stream sockets veth: fix OOB txq access in veth_poll() with asymmetric queue counts eth: fbnic: fix double-free of PCS on phylink creation failure net: ethernet: cortina: Drop half-assembled SKB selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl selftests: mptcp: check output: catch cmd errors mptcp: pm: prio: skip closed subflows mptcp: pm: ADD_ADDR rtx: return early if no retrans mptcp: pm: ADD_ADDR rtx: skip inactive subflows mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker mptcp: pm: ADD_ADDR rtx: free sk if last mptcp: pm: ADD_ADDR rtx: always decrease sk refcount mptcp: pm: ADD_ADDR rtx: fix potential data-race ...
2 parents 19cbc75 + 41ae140 commit fcee7d8

189 files changed

Lines changed: 3479 additions & 1154 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎MAINTAINERS‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7077,6 +7077,12 @@ T: git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git core/debugobjec
70777077
F: include/linux/debugobjects.h
70787078
F: lib/debugobjects.c
70797079

7080+
DEC LANCE NETWORK DRIVER
7081+
M: "Maciej W. Rozycki" <macro@orcam.me.uk>
7082+
L: netdev@vger.kernel.org
7083+
S: Maintained
7084+
F: drivers/net/ethernet/amd/declance.c
7085+
70807086
DECSTATION PLATFORM SUPPORT
70817087
M: "Maciej W. Rozycki" <macro@orcam.me.uk>
70827088
L: linux-mips@vger.kernel.org

‎drivers/bluetooth/btintel_pcie.c‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -289,6 +289,9 @@ static inline void btintel_pcie_dump_debug_registers(struct hci_dev *hdev)
289289
skb_put_data(skb, buf, strlen(buf));
290290
data->boot_stage_cache = reg;
291291

292+
if (reg & BTINTEL_PCIE_CSR_BOOT_STAGE_DEVICE_WARNING)
293+
bt_dev_warn(hdev, "Controller device warning (boot_stage: 0x%8.8x)", reg);
294+
292295
reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_IPC_STATUS_REG);
293296
snprintf(buf, sizeof(buf), "ipc status: 0x%8.8x", reg);
294297
skb_put_data(skb, buf, strlen(buf));
@@ -880,8 +883,11 @@ static inline bool btintel_pcie_in_lockdown(struct btintel_pcie_data *data)
880883

881884
static inline bool btintel_pcie_in_error(struct btintel_pcie_data *data)
882885
{
883-
return (data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_DEVICE_ERR) ||
884-
(data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_ABORT_HANDLER);
886+
if (data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_DEVICE_WARNING)
887+
bt_dev_warn(data->hdev, "Controller device warning (boot_stage: 0x%8.8x)",
888+
data->boot_stage_cache);
889+
890+
return data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_ABORT_HANDLER;
885891
}
886892

887893
static void btintel_pcie_msix_gp1_handler(struct btintel_pcie_data *data)
@@ -914,7 +920,8 @@ static void btintel_pcie_msix_gp0_handler(struct btintel_pcie_data *data)
914920
data->img_resp_cache = reg;
915921

916922
if (btintel_pcie_in_error(data)) {
917-
bt_dev_err(data->hdev, "Controller in error state");
923+
bt_dev_err(data->hdev, "Controller in error state (boot_stage: 0x%8.8x)",
924+
data->boot_stage_cache);
918925
btintel_pcie_dump_debug_registers(data->hdev);
919926
return;
920927
}

‎drivers/bluetooth/btintel_pcie.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@
4848
#define BTINTEL_PCIE_CSR_BOOT_STAGE_OPFW (BIT(2))
4949
#define BTINTEL_PCIE_CSR_BOOT_STAGE_ROM_LOCKDOWN (BIT(10))
5050
#define BTINTEL_PCIE_CSR_BOOT_STAGE_IML_LOCKDOWN (BIT(11))
51-
#define BTINTEL_PCIE_CSR_BOOT_STAGE_DEVICE_ERR (BIT(12))
51+
#define BTINTEL_PCIE_CSR_BOOT_STAGE_DEVICE_WARNING (BIT(12))
5252
#define BTINTEL_PCIE_CSR_BOOT_STAGE_ABORT_HANDLER (BIT(13))
5353
#define BTINTEL_PCIE_CSR_BOOT_STAGE_DEVICE_HALTED (BIT(14))
5454
#define BTINTEL_PCIE_CSR_BOOT_STAGE_MAC_ACCESS_ON (BIT(16))

‎drivers/bluetooth/btmtk.c‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -695,8 +695,13 @@ static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
695695
if (data->evt_skb == NULL)
696696
goto err_free_wc;
697697

698-
/* Parse and handle the return WMT event */
699-
wmt_evt = (struct btmtk_hci_wmt_evt *)data->evt_skb->data;
698+
wmt_evt = skb_pull_data(data->evt_skb, sizeof(*wmt_evt));
699+
if (!wmt_evt) {
700+
bt_dev_err(hdev, "WMT event too short (%u bytes)",
701+
data->evt_skb->len);
702+
err = -EINVAL;
703+
goto err_free_skb;
704+
}
700705
if (wmt_evt->whdr.op != hdr->op) {
701706
bt_dev_err(hdev, "Wrong op received %d expected %d",
702707
wmt_evt->whdr.op, hdr->op);
@@ -712,6 +717,12 @@ static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
712717
status = BTMTK_WMT_PATCH_DONE;
713718
break;
714719
case BTMTK_WMT_FUNC_CTRL:
720+
if (!skb_pull_data(data->evt_skb,
721+
sizeof(wmt_evt_funcc->status))) {
722+
err = -EINVAL;
723+
goto err_free_skb;
724+
}
725+
715726
wmt_evt_funcc = (struct btmtk_hci_wmt_evt_funcc *)wmt_evt;
716727
if (be16_to_cpu(wmt_evt_funcc->status) == 0x404)
717728
status = BTMTK_WMT_ON_DONE;

‎drivers/bluetooth/hci_ath.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -191,6 +191,9 @@ static int ath_recv(struct hci_uart *hu, const void *data, int count)
191191
{
192192
struct ath_struct *ath = hu->priv;
193193

194+
if (!ath)
195+
return -ENODEV;
196+
194197
ath->rx_skb = h4_recv_buf(hu, ath->rx_skb, data, count,
195198
ath_recv_pkts, ARRAY_SIZE(ath_recv_pkts));
196199
if (IS_ERR(ath->rx_skb)) {

‎drivers/bluetooth/hci_bcsp.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -585,6 +585,9 @@ static int bcsp_recv(struct hci_uart *hu, const void *data, int count)
585585
if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
586586
return -EUNATCH;
587587

588+
if (!bcsp)
589+
return -ENODEV;
590+
588591
BT_DBG("hu %p count %d rx_state %d rx_count %ld",
589592
hu, count, bcsp->rx_state, bcsp->rx_count);
590593

‎drivers/bluetooth/hci_h4.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,9 @@ static int h4_recv(struct hci_uart *hu, const void *data, int count)
109109
{
110110
struct h4_struct *h4 = hu->priv;
111111

112+
if (!h4)
113+
return -ENODEV;
114+
112115
h4->rx_skb = h4_recv_buf(hu, h4->rx_skb, data, count,
113116
h4_recv_pkts, ARRAY_SIZE(h4_recv_pkts));
114117
if (IS_ERR(h4->rx_skb)) {

‎drivers/bluetooth/hci_h5.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -587,6 +587,9 @@ static int h5_recv(struct hci_uart *hu, const void *data, int count)
587587
struct h5 *h5 = hu->priv;
588588
const unsigned char *ptr = data;
589589

590+
if (!h5)
591+
return -ENODEV;
592+
590593
BT_DBG("%s pending %zu count %d", hu->hdev->name, h5->rx_pending,
591594
count);
592595

‎drivers/bluetooth/virtio_bt.c‎

Lines changed: 32 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
#include <net/bluetooth/hci_core.h>
1313

1414
#define VERSION "0.1"
15+
#define VIRTBT_RX_BUF_SIZE 1000
1516

1617
enum {
1718
VIRTBT_VQ_TX,
@@ -33,11 +34,11 @@ static int virtbt_add_inbuf(struct virtio_bluetooth *vbt)
3334
struct sk_buff *skb;
3435
int err;
3536

36-
skb = alloc_skb(1000, GFP_KERNEL);
37+
skb = alloc_skb(VIRTBT_RX_BUF_SIZE, GFP_KERNEL);
3738
if (!skb)
3839
return -ENOMEM;
3940

40-
sg_init_one(sg, skb->data, 1000);
41+
sg_init_one(sg, skb->data, VIRTBT_RX_BUF_SIZE);
4142

4243
err = virtqueue_add_inbuf(vq, sg, 1, skb, GFP_KERNEL);
4344
if (err < 0) {
@@ -197,23 +198,40 @@ static int virtbt_shutdown_generic(struct hci_dev *hdev)
197198

198199
static void virtbt_rx_handle(struct virtio_bluetooth *vbt, struct sk_buff *skb)
199200
{
201+
size_t min_hdr;
200202
__u8 pkt_type;
201203

202204
pkt_type = *((__u8 *) skb->data);
203205
skb_pull(skb, 1);
204206

205207
switch (pkt_type) {
206208
case HCI_EVENT_PKT:
209+
min_hdr = sizeof(struct hci_event_hdr);
210+
break;
207211
case HCI_ACLDATA_PKT:
212+
min_hdr = sizeof(struct hci_acl_hdr);
213+
break;
208214
case HCI_SCODATA_PKT:
215+
min_hdr = sizeof(struct hci_sco_hdr);
216+
break;
209217
case HCI_ISODATA_PKT:
210-
hci_skb_pkt_type(skb) = pkt_type;
211-
hci_recv_frame(vbt->hdev, skb);
218+
min_hdr = sizeof(struct hci_iso_hdr);
212219
break;
213220
default:
214221
kfree_skb(skb);
215-
break;
222+
return;
223+
}
224+
225+
if (skb->len < min_hdr) {
226+
bt_dev_err_ratelimited(vbt->hdev,
227+
"rx pkt_type 0x%02x payload %u < hdr %zu\n",
228+
pkt_type, skb->len, min_hdr);
229+
kfree_skb(skb);
230+
return;
216231
}
232+
233+
hci_skb_pkt_type(skb) = pkt_type;
234+
hci_recv_frame(vbt->hdev, skb);
217235
}
218236

219237
static void virtbt_rx_work(struct work_struct *work)
@@ -227,8 +245,15 @@ static void virtbt_rx_work(struct work_struct *work)
227245
if (!skb)
228246
return;
229247

230-
skb_put(skb, len);
231-
virtbt_rx_handle(vbt, skb);
248+
if (!len || len > VIRTBT_RX_BUF_SIZE) {
249+
bt_dev_err_ratelimited(vbt->hdev,
250+
"rx reply len %u outside [1, %u]\n",
251+
len, VIRTBT_RX_BUF_SIZE);
252+
kfree_skb(skb);
253+
} else {
254+
skb_put(skb, len);
255+
virtbt_rx_handle(vbt, skb);
256+
}
232257

233258
if (virtbt_add_inbuf(vbt) < 0)
234259
return;

‎drivers/net/dsa/mt7530.c‎

Lines changed: 72 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,9 @@
2525

2626
#include "mt7530.h"
2727

28+
#define MT7530_STATS_POLL_INTERVAL (1 * HZ)
29+
#define MT7530_STATS_RATE_LIMIT (HZ / 10)
30+
2831
static struct mt753x_pcs *pcs_to_mt753x_pcs(struct phylink_pcs *pcs)
2932
{
3033
return container_of(pcs, struct mt753x_pcs, pcs);
@@ -906,10 +909,9 @@ static void mt7530_get_rmon_stats(struct dsa_switch *ds, int port,
906909
*ranges = mt7530_rmon_ranges;
907910
}
908911

909-
static void mt7530_get_stats64(struct dsa_switch *ds, int port,
910-
struct rtnl_link_stats64 *storage)
912+
static void mt7530_read_port_stats64(struct mt7530_priv *priv, int port,
913+
struct rtnl_link_stats64 *storage)
911914
{
912-
struct mt7530_priv *priv = ds->priv;
913915
uint64_t data;
914916

915917
/* MIB counter doesn't provide a FramesTransmittedOK but instead
@@ -951,6 +953,54 @@ static void mt7530_get_stats64(struct dsa_switch *ds, int port,
951953
&storage->rx_crc_errors);
952954
}
953955

956+
static void mt7530_stats_refresh(struct mt7530_priv *priv)
957+
{
958+
struct rtnl_link_stats64 stats = {};
959+
struct dsa_port *dp;
960+
int port;
961+
962+
dsa_switch_for_each_user_port(dp, priv->ds) {
963+
port = dp->index;
964+
965+
mt7530_read_port_stats64(priv, port, &stats);
966+
967+
spin_lock_bh(&priv->stats_lock);
968+
priv->ports[port].stats = stats;
969+
priv->stats_last = jiffies;
970+
spin_unlock_bh(&priv->stats_lock);
971+
}
972+
}
973+
974+
static void mt7530_stats_poll(struct work_struct *work)
975+
{
976+
struct mt7530_priv *priv = container_of(work, struct mt7530_priv,
977+
stats_work.work);
978+
979+
mt7530_stats_refresh(priv);
980+
schedule_delayed_work(&priv->stats_work,
981+
MT7530_STATS_POLL_INTERVAL);
982+
}
983+
984+
static void mt7530_get_stats64(struct dsa_switch *ds, int port,
985+
struct rtnl_link_stats64 *storage)
986+
{
987+
struct mt7530_priv *priv = ds->priv;
988+
bool refresh;
989+
990+
if (priv->bus) {
991+
spin_lock_bh(&priv->stats_lock);
992+
*storage = priv->ports[port].stats;
993+
refresh = time_after(jiffies, priv->stats_last +
994+
MT7530_STATS_RATE_LIMIT);
995+
spin_unlock_bh(&priv->stats_lock);
996+
if (refresh)
997+
mod_delayed_work(system_percpu_wq,
998+
&priv->stats_work, 0);
999+
} else {
1000+
mt7530_read_port_stats64(priv, port, storage);
1001+
}
1002+
}
1003+
9541004
static void mt7530_get_eth_ctrl_stats(struct dsa_switch *ds, int port,
9551005
struct ethtool_eth_ctrl_stats *ctrl_stats)
9561006
{
@@ -3137,9 +3187,24 @@ mt753x_setup(struct dsa_switch *ds)
31373187
if (ret && priv->irq_domain)
31383188
mt7530_free_mdio_irq(priv);
31393189

3190+
if (!ret && priv->bus) {
3191+
mt7530_stats_refresh(priv);
3192+
schedule_delayed_work(&priv->stats_work,
3193+
MT7530_STATS_POLL_INTERVAL);
3194+
}
3195+
31403196
return ret;
31413197
}
31423198

3199+
static void
3200+
mt753x_teardown(struct dsa_switch *ds)
3201+
{
3202+
struct mt7530_priv *priv = ds->priv;
3203+
3204+
if (priv->bus)
3205+
cancel_delayed_work_sync(&priv->stats_work);
3206+
}
3207+
31433208
static int mt753x_set_mac_eee(struct dsa_switch *ds, int port,
31443209
struct ethtool_keee *e)
31453210
{
@@ -3257,6 +3322,7 @@ static int mt7988_setup(struct dsa_switch *ds)
32573322
static const struct dsa_switch_ops mt7530_switch_ops = {
32583323
.get_tag_protocol = mtk_get_tag_protocol,
32593324
.setup = mt753x_setup,
3325+
.teardown = mt753x_teardown,
32603326
.preferred_default_local_cpu_port = mt753x_preferred_default_local_cpu_port,
32613327
.get_strings = mt7530_get_strings,
32623328
.get_ethtool_stats = mt7530_get_ethtool_stats,
@@ -3395,6 +3461,9 @@ mt7530_probe_common(struct mt7530_priv *priv)
33953461
priv->ds->ops = &mt7530_switch_ops;
33963462
priv->ds->phylink_mac_ops = &mt753x_phylink_mac_ops;
33973463
mutex_init(&priv->reg_mutex);
3464+
spin_lock_init(&priv->stats_lock);
3465+
INIT_DELAYED_WORK(&priv->stats_work, mt7530_stats_poll);
3466+
33983467
dev_set_drvdata(dev, priv);
33993468

34003469
return 0;

0 commit comments

Comments
 (0)