Commit 9521c9d6 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'net-6.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 

Pull networking fixes from Paolo Abeni:
 "Including fixes from bluetooth and netfilter.

  Current release - regressions:

   - net: several zerocopy flags fixes

   - netfilter: fix possible memory leak in nf_nat_init()

   - openvswitch: add missing .resv_start_op

  Previous releases - regressions:

   - neigh: fix null-ptr-deref in neigh_table_clear()

   - sched: fix use after free in red_enqueue()

   - dsa: fall back to default tagger if we can't load the one from DT

   - bluetooth: fix use-after-free in l2cap_conn_del()

  Previous releases - always broken:

   - netfilter: netlink notifier might race to release objects

   - nfc: fix potential memory leak of skb

   - bluetooth: fix use-after-free caused by l2cap_reassemble_sdu

   - bluetooth: use skb_put to set length

   - eth: tun: fix bugs for oversize packet when napi frags enabled

   - eth: lan966x: fixes for when MTU is changed

   - eth: dwmac-loongson: fix invalid mdio_node"

* tag 'net-6.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (53 commits)
  vsock: fix possible infinite sleep in vsock_connectible_wait_data()
  vsock: remove the unused 'wait' in vsock_connectible_recvmsg()
  ipv6: fix WARNING in ip6_route_net_exit_late()
  bridge: Fix flushing of dynamic FDB entries
  net, neigh: Fix null-ptr-deref in neigh_table_clear()
  net/smc: Fix possible leaked pernet namespace in smc_init()
  stmmac: dwmac-loongson: fix invalid mdio_node
  ibmvnic: Free rwi on reset success
  net: mdio: fix undefined behavior in bit shift for __mdiobus_register
  Bluetooth: L2CAP: Fix attempting to access uninitialized memory
  Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm
  Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM
  Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect
  Bluetooth: L2CAP: Fix memory leak in vhci_write
  Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del()
  Bluetooth: virtio_bt: Use skb_put to set length
  Bluetooth: hci_conn: Fix CIS connection dst_type handling
  Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu
  netfilter: ipset: enforce documented limit to prevent allocating huge memory
  isdn: mISDN: netjet: fix wrong check of device registration
  ...
parents 4d740391 715aee0f

MAINTAINERS

+5 −2
Original line number Diff line number Diff line
@@ -5041,7 +5041,7 @@ F: drivers/scsi/snic/ 








CISCO VIC ETHERNET NIC DRIVER









M:	Christian Benvenuti <benve@cisco.com>









M:	Govindarajulu Varadarajan <_govind@gmx.com>









M:	Satish Kharat <satishkh@cisco.com>









S:	Supported









F:	drivers/net/ethernet/cisco/enic/
















@@ -9778,7 +9778,10 @@ S:	Supported







F:	drivers/pci/hotplug/rpaphp*

















IBM Power SRIOV Virtual NIC Device Driver









M:	Dany Madden <drt@linux.ibm.com>









M:	Haren Myneni <haren@linux.ibm.com>









M:	Rick Lindsley <ricklind@linux.ibm.com>









R:	Nick Child <nnac123@linux.ibm.com>









R:	Dany Madden <danymadden@us.ibm.com>









R:	Thomas Falcon <tlfalcon@linux.ibm.com>









L:	netdev@vger.kernel.org









S:	Supported
































drivers/bluetooth/virtio_bt.c



+1
−1






























Original line number
Diff line number
Diff line







@@ -219,7 +219,7 @@ static void virtbt_rx_work(struct work_struct *work)







	if (!skb)









		return;



















	skb->len = len;









	skb_put(skb, len);









	virtbt_rx_handle(vbt, skb);



















	if (virtbt_add_inbuf(vbt) < 0)
































drivers/isdn/hardware/mISDN/netjet.c



+1
−1






























Original line number
Diff line number
Diff line







@@ -956,7 +956,7 @@ nj_release(struct tiger_hw *card)







	}









	if (card->irq > 0)









		free_irq(card->irq, card);









	if (card->isac.dch.dev.dev.class)









	if (device_is_registered(&card->isac.dch.dev.dev))









		mISDN_unregister_device(&card->isac.dch.dev);



















	for (i = 0; i < 2; i++) {
































drivers/isdn/mISDN/core.c



+3
−2






























Original line number
Diff line number
Diff line







@@ -233,11 +233,12 @@ mISDN_register_device(struct mISDNdevice *dev,







	if (debug & DEBUG_CORE)









		printk(KERN_DEBUG "mISDN_register %s %d\n",









		       dev_name(&dev->dev), dev->id);









	dev->dev.class = &mISDN_class;



















	err = create_stack(dev);









	if (err)









		goto error1;



















	dev->dev.class = &mISDN_class;









	dev->dev.platform_data = dev;









	dev->dev.parent = parent;









	dev_set_drvdata(&dev->dev, dev);








@@ -249,8 +250,8 @@ mISDN_register_device(struct mISDNdevice *dev,

















error3:









	delete_stack(dev);









	return err;









error1:









	put_device(&dev->dev);









	return err;



















}
































drivers/net/dsa/dsa_loop.c



+18
−7






























Original line number
Diff line number
Diff line







@@ -376,6 +376,17 @@ static struct mdio_driver dsa_loop_drv = {

















#define NUM_FIXED_PHYS	(DSA_LOOP_NUM_PORTS - 2)



















static void dsa_loop_phydevs_unregister(void)









{









	unsigned int i;



















	for (i = 0; i < NUM_FIXED_PHYS; i++)









		if (!IS_ERR(phydevs[i])) {









			fixed_phy_unregister(phydevs[i]);









			phy_device_free(phydevs[i]);









		}









}



















static int __init dsa_loop_init(void)









{









	struct fixed_phy_status status = {








@@ -383,23 +394,23 @@ static int __init dsa_loop_init(void)







		.speed = SPEED_100,









		.duplex = DUPLEX_FULL,









	};









	unsigned int i;









	unsigned int i, ret;



















	for (i = 0; i < NUM_FIXED_PHYS; i++)









		phydevs[i] = fixed_phy_register(PHY_POLL, &status, NULL);



















	return mdio_driver_register(&dsa_loop_drv);









	ret = mdio_driver_register(&dsa_loop_drv);









	if (ret)









		dsa_loop_phydevs_unregister();



















	return ret;









}









module_init(dsa_loop_init);



















static void __exit dsa_loop_exit(void)









{









	unsigned int i;



















	mdio_driver_unregister(&dsa_loop_drv);









	for (i = 0; i < NUM_FIXED_PHYS; i++)









		if (!IS_ERR(phydevs[i]))









			fixed_phy_unregister(phydevs[i]);









	dsa_loop_phydevs_unregister();









}









module_exit(dsa_loop_exit);