Commit 9ed13a17 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'net-5.13-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 

Pull networking fixes from Jakub Kicinski:
 "Networking fixes for 5.13-rc7, including fixes from wireless, bpf,
  bluetooth, netfilter and can.

  Current release - regressions:

   - mlxsw: spectrum_qdisc: Pass handle, not band number to find_class()
     to fix modifying offloaded qdiscs

   - lantiq: net: fix duplicated skb in rx descriptor ring

   - rtnetlink: fix regression in bridge VLAN configuration, empty info
     is not an error, bot-generated "fix" was not needed

   - libbpf: s/rx/tx/ typo on umem->rx_ring_setup_done to fix umem
     creation

  Current release - new code bugs:

   - ethtool: fix NULL pointer dereference during module EEPROM dump via
     the new netlink API

   - mlx5e: don't update netdev RQs with PTP-RQ, the special purpose
     queue should not be visible to the stack

   - mlx5e: select special PTP queue only for SKBTX_HW_TSTAMP skbs

   - mlx5e: verify dev is present in get devlink port ndo, avoid a panic

  Previous releases - regressions:

   - neighbour: allow NUD_NOARP entries to be force GCed

   - further fixes for fallout from reorg of WiFi locking (staging:
     rtl8723bs, mac80211, cfg80211)

   - skbuff: fix incorrect msg_zerocopy copy notifications

   - mac80211: fix NULL ptr deref for injected rate info

   - Revert "net/mlx5: Arm only EQs with EQEs" it may cause missed IRQs

  Previous releases - always broken:

   - bpf: more speculative execution fixes

   - netfilter: nft_fib_ipv6: skip ipv6 packets from any to link-local

   - udp: fix race between close() and udp_abort() resulting in a panic

   - fix out of bounds when parsing TCP options before packets are
     validated (in netfilter: synproxy, tc: sch_cake and mptcp)

   - mptcp: improve operation under memory pressure, add missing
     wake-ups

   - mptcp: fix double-lock/soft lookup in subflow_error_report()

   - bridge: fix races (null pointer deref and UAF) in vlan tunnel
     egress

   - ena: fix DMA mapping function issues in XDP

   - rds: fix memory leak in rds_recvmsg

  Misc:

   - vrf: allow larger MTUs

   - icmp: don't send out ICMP messages with a source address of 0.0.0.0

   - cdc_ncm: switch to eth%d interface naming"

* tag 'net-5.13-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (139 commits)
  net: ethernet: fix potential use-after-free in ec_bhf_remove
  selftests/net: Add icmp.sh for testing ICMP dummy address responses
  icmp: don't send out ICMP messages with a source address of 0.0.0.0
  net: ll_temac: Avoid ndo_start_xmit returning NETDEV_TX_BUSY
  net: ll_temac: Fix TX BD buffer overwrite
  net: ll_temac: Add memory-barriers for TX BD access
  net: ll_temac: Make sure to free skb when it is completely used
  MAINTAINERS: add Guvenc as SMC maintainer
  bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path
  bnxt_en: Fix TQM fastpath ring backing store computation
  bnxt_en: Rediscover PHY capabilities after firmware reset
  cxgb4: fix wrong shift.
  mac80211: handle various extensible elements correctly
  mac80211: reset profile_periodicity/ema_ap
  cfg80211: avoid double free of PMSR request
  cfg80211: make certificate generation more robust
  mac80211: minstrel_ht: fix sample time check
  net: qed: Fix memcpy() overflow of qed_dcbx_params()
  net: cdc_eem: fix tx fixup skb leak
  net: hamradio: fix memory leak in mkiss_close
  ...
parents 6fab154a 9cca0c2d

MAINTAINERS

+1 −0
Original line number Diff line number Diff line
@@ -16560,6 +16560,7 @@ F: drivers/misc/sgi-xp/ 








SHARED MEMORY COMMUNICATIONS (SMC) SOCKETS









M:	Karsten Graul <kgraul@linux.ibm.com>









M:	Guvenc Gulce <guvenc@linux.ibm.com>









L:	linux-s390@vger.kernel.org









S:	Supported









W:	http://www.ibm.com/developerworks/linux/linux390/
































drivers/net/caif/caif_serial.c



+1
−0






























Original line number
Diff line number
Diff line







@@ -350,6 +350,7 @@ static int ldisc_open(struct tty_struct *tty)







	rtnl_lock();









	result = register_netdevice(dev);









	if (result) {









		tty_kref_put(tty);









		rtnl_unlock();









		free_netdev(dev);









		return -ENODEV;
































drivers/net/can/usb/mcba_usb.c



+15
−2






























Original line number
Diff line number
Diff line







@@ -82,6 +82,8 @@ struct mcba_priv {







	bool can_ka_first_pass;









	bool can_speed_check;









	atomic_t free_ctx_cnt;









	void *rxbuf[MCBA_MAX_RX_URBS];









	dma_addr_t rxbuf_dma[MCBA_MAX_RX_URBS];









};



















/* CAN frame */








@@ -633,6 +635,7 @@ static int mcba_usb_start(struct mcba_priv *priv)







	for (i = 0; i < MCBA_MAX_RX_URBS; i++) {









		struct urb *urb = NULL;









		u8 *buf;









		dma_addr_t buf_dma;



















		/* create a URB, and a buffer for it */









		urb = usb_alloc_urb(0, GFP_KERNEL);








@@ -642,7 +645,7 @@ static int mcba_usb_start(struct mcba_priv *priv)







		}



















		buf = usb_alloc_coherent(priv->udev, MCBA_USB_RX_BUFF_SIZE,









					 GFP_KERNEL, &urb->transfer_dma);









					 GFP_KERNEL, &buf_dma);









		if (!buf) {









			netdev_err(netdev, "No memory left for USB buffer\n");









			usb_free_urb(urb);








@@ -661,11 +664,14 @@ static int mcba_usb_start(struct mcba_priv *priv)







		if (err) {









			usb_unanchor_urb(urb);









			usb_free_coherent(priv->udev, MCBA_USB_RX_BUFF_SIZE,









					  buf, urb->transfer_dma);









					  buf, buf_dma);









			usb_free_urb(urb);









			break;









		}



















		priv->rxbuf[i] = buf;









		priv->rxbuf_dma[i] = buf_dma;



















		/* Drop reference, USB core will take care of freeing it */









		usb_free_urb(urb);









	}








@@ -708,7 +714,14 @@ static int mcba_usb_open(struct net_device *netdev)

















static void mcba_urb_unlink(struct mcba_priv *priv)









{









	int i;



















	usb_kill_anchored_urbs(&priv->rx_submitted);



















	for (i = 0; i < MCBA_MAX_RX_URBS; ++i)









		usb_free_coherent(priv->udev, MCBA_USB_RX_BUFF_SIZE,









				  priv->rxbuf[i], priv->rxbuf_dma[i]);



















	usb_kill_anchored_urbs(&priv->tx_submitted);









}










































drivers/net/ethernet/amazon/ena/ena_netdev.c



+28
−26






























Original line number
Diff line number
Diff line







@@ -236,37 +236,49 @@ static int ena_xdp_io_poll(struct napi_struct *napi, int budget)







static int ena_xdp_tx_map_frame(struct ena_ring *xdp_ring,









				struct ena_tx_buffer *tx_info,









				struct xdp_frame *xdpf,









				void **push_hdr,









				u32 *push_len)









				struct ena_com_tx_ctx *ena_tx_ctx)









{









	struct ena_adapter *adapter = xdp_ring->adapter;









	struct ena_com_buf *ena_buf;









	dma_addr_t dma = 0;









	int push_len = 0;









	dma_addr_t dma;









	void *data;









	u32 size;



















	tx_info->xdpf = xdpf;









	data = tx_info->xdpf->data;









	size = tx_info->xdpf->len;









	ena_buf = tx_info->bufs;



















	/* llq push buffer */









	*push_len = min_t(u32, size, xdp_ring->tx_max_header_size);









	*push_hdr = tx_info->xdpf->data;









	if (xdp_ring->tx_mem_queue_type == ENA_ADMIN_PLACEMENT_POLICY_DEV) {









		/* Designate part of the packet for LLQ */









		push_len = min_t(u32, size, xdp_ring->tx_max_header_size);



















		ena_tx_ctx->push_header = data;



















		size -= push_len;









		data += push_len;









	}



















	ena_tx_ctx->header_len = push_len;



















	if (size - *push_len > 0) {









	if (size > 0) {









		dma = dma_map_single(xdp_ring->dev,









				     *push_hdr + *push_len,









				     size - *push_len,









				     data,









				     size,









				     DMA_TO_DEVICE);









		if (unlikely(dma_mapping_error(xdp_ring->dev, dma)))









			goto error_report_dma_error;



















		tx_info->map_linear_data = 1;









		tx_info->num_of_bufs = 1;









	}









		tx_info->map_linear_data = 0;



















		ena_buf = tx_info->bufs;









		ena_buf->paddr = dma;









		ena_buf->len = size;



















		ena_tx_ctx->ena_bufs = ena_buf;









		ena_tx_ctx->num_bufs = tx_info->num_of_bufs = 1;









	}



















	return 0;



















error_report_dma_error:








@@ -274,10 +286,6 @@ static int ena_xdp_tx_map_frame(struct ena_ring *xdp_ring,







			  &xdp_ring->syncp);









	netif_warn(adapter, tx_queued, adapter->netdev, "Failed to map xdp buff\n");



















	xdp_return_frame_rx_napi(tx_info->xdpf);









	tx_info->xdpf = NULL;









	tx_info->num_of_bufs = 0;



















	return -EINVAL;









}


















@@ -289,8 +297,6 @@ static int ena_xdp_xmit_frame(struct ena_ring *xdp_ring,







	struct ena_com_tx_ctx ena_tx_ctx = {};









	struct ena_tx_buffer *tx_info;









	u16 next_to_use, req_id;









	void *push_hdr;









	u32 push_len;









	int rc;



















	next_to_use = xdp_ring->next_to_use;








@@ -298,15 +304,11 @@ static int ena_xdp_xmit_frame(struct ena_ring *xdp_ring,







	tx_info = &xdp_ring->tx_buffer_info[req_id];









	tx_info->num_of_bufs = 0;



















	rc = ena_xdp_tx_map_frame(xdp_ring, tx_info, xdpf, &push_hdr, &push_len);









	rc = ena_xdp_tx_map_frame(xdp_ring, tx_info, xdpf, &ena_tx_ctx);









	if (unlikely(rc))









		return rc;



















	ena_tx_ctx.ena_bufs = tx_info->bufs;









	ena_tx_ctx.push_header = push_hdr;









	ena_tx_ctx.num_bufs = tx_info->num_of_bufs;









	ena_tx_ctx.req_id = req_id;









	ena_tx_ctx.header_len = push_len;



















	rc = ena_xmit_common(dev,









			     xdp_ring,
































drivers/net/ethernet/atheros/alx/main.c



+1
−0






























Original line number
Diff line number
Diff line







@@ -1849,6 +1849,7 @@ static int alx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)







	free_netdev(netdev);









out_pci_release:









	pci_release_mem_regions(pdev);









	pci_disable_pcie_error_reporting(pdev);









out_pci_disable:









	pci_disable_device(pdev);









	return err;