Commit f87d6431 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'net-5.14-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 

Pull networking fixes from Jakub Kicinski:
 "Networking fixes, including fixes from bpf, wireless and mac80211
  trees.

  Current release - regressions:

   - tipc: call tipc_wait_for_connect only when dlen is not 0

   - mac80211: fix locking in ieee80211_restart_work()

  Current release - new code bugs:

   - bpf: add rcu_read_lock in bpf_get_current_[ancestor_]cgroup_id()

   - ethernet: ice: fix perout start time rounding

   - wwan: iosm: prevent underflow in ipc_chnl_cfg_get()

  Previous releases - regressions:

   - bpf: clear zext_dst of dead insns

   - sch_cake: fix srchost/dsthost hashing mode

   - vrf: reset skb conntrack connection on VRF rcv

   - net/rds: dma_map_sg is entitled to merge entries

  Previous releases - always broken:

   - ethernet: bnxt: fix Tx path locking and races, add Rx path
     barriers"

* tag 'net-5.14-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (42 commits)
  net: dpaa2-switch: disable the control interface on error path
  Revert "flow_offload: action should not be NULL when it is referenced"
  iavf: Fix ping is lost after untrusted VF had tried to change MAC
  i40e: Fix ATR queue selection
  r8152: fix the maximum number of PLA bp for RTL8153C
  r8152: fix writing USB_BP2_EN
  mptcp: full fully established support after ADD_ADDR
  mptcp: fix memory leak on address flush
  net/rds: dma_map_sg is entitled to merge entries
  net: mscc: ocelot: allow forwarding from bridge ports to the tag_8021q CPU port
  net: asix: fix uninit value bugs
  ovs: clear skb->tstamp in forwarding path
  net: mdio-mux: Handle -EPROBE_DEFER correctly
  net: mdio-mux: Don't ignore memory allocation errors
  net: mdio-mux: Delete unnecessary devm_kfree
  net: dsa: sja1105: fix use-after-free after calling of_find_compatible_node, or worse
  sch_cake: fix srchost/dsthost hashing mode
  ixgbe, xsk: clean up the resources in ixgbe_xsk_pool_enable error path
  net: qlcnic: add missed unlock in qlcnic_83xx_flash_read32
  mac80211: fix locking in ieee80211_restart_work()
  ...
parents e649e4c8 cd0a719f

drivers/net/dsa/sja1105/sja1105_mdio.c

+2 −4
Original line number Diff line number Diff line
@@ -284,8 +284,7 @@ static int sja1105_mdiobus_base_tx_register(struct sja1105_private *priv, 
	struct mii_bus *bus;

	int rc = 0;



	np = of_find_compatible_node(mdio_node, NULL,

				     "nxp,sja1110-base-tx-mdio");

	np = of_get_compatible_child(mdio_node, "nxp,sja1110-base-tx-mdio");

	if (!np)

		return 0;
@@ -339,8 +338,7 @@ static int sja1105_mdiobus_base_t1_register(struct sja1105_private *priv, 
	struct mii_bus *bus;

	int rc = 0;



	np = of_find_compatible_node(mdio_node, NULL,

				     "nxp,sja1110-base-t1-mdio");

	np = of_get_compatible_child(mdio_node, "nxp,sja1110-base-t1-mdio");

	if (!np)

		return 0;

drivers/net/ethernet/broadcom/bnxt/bnxt.c

+76 −37
Original line number Diff line number Diff line
@@ -72,7 +72,8 @@ 
#include "bnxt_debugfs.h"



#define BNXT_TX_TIMEOUT		(5 * HZ)

#define BNXT_DEF_MSG_ENABLE	(NETIF_MSG_DRV | NETIF_MSG_HW)

#define BNXT_DEF_MSG_ENABLE	(NETIF_MSG_DRV | NETIF_MSG_HW | \

				 NETIF_MSG_TX_ERR)



MODULE_LICENSE("GPL");

MODULE_DESCRIPTION("Broadcom BCM573xx network driver");
@@ -365,6 +366,33 @@ static u16 bnxt_xmit_get_cfa_action(struct sk_buff *skb) 
	return md_dst->u.port_info.port_id;

}



static void bnxt_txr_db_kick(struct bnxt *bp, struct bnxt_tx_ring_info *txr,

			     u16 prod)

{

	bnxt_db_write(bp, &txr->tx_db, prod);

	txr->kick_pending = 0;

}



static bool bnxt_txr_netif_try_stop_queue(struct bnxt *bp,

					  struct bnxt_tx_ring_info *txr,

					  struct netdev_queue *txq)

{

	netif_tx_stop_queue(txq);



	/* netif_tx_stop_queue() must be done before checking

	 * tx index in bnxt_tx_avail() below, because in

	 * bnxt_tx_int(), we update tx index before checking for

	 * netif_tx_queue_stopped().

	 */

	smp_mb();

	if (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh) {

		netif_tx_wake_queue(txq);

		return false;

	}



	return true;

}



static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)

{

	struct bnxt *bp = netdev_priv(dev);
@@ -384,6 +412,7 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) 
	i = skb_get_queue_mapping(skb);

	if (unlikely(i >= bp->tx_nr_rings)) {

		dev_kfree_skb_any(skb);

		atomic_long_inc(&dev->tx_dropped);

		return NETDEV_TX_OK;

	}
@@ -393,7 +422,11 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) 


	free_size = bnxt_tx_avail(bp, txr);

	if (unlikely(free_size < skb_shinfo(skb)->nr_frags + 2)) {

		netif_tx_stop_queue(txq);

		/* We must have raced with NAPI cleanup */

		if (net_ratelimit() && txr->kick_pending)

			netif_warn(bp, tx_err, dev,

				   "bnxt: ring busy w/ flush pending!\n");

		if (bnxt_txr_netif_try_stop_queue(bp, txr, txq))

			return NETDEV_TX_BUSY;

	}
@@ -517,21 +550,16 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) 
normal_tx:

	if (length < BNXT_MIN_PKT_SIZE) {

		pad = BNXT_MIN_PKT_SIZE - length;

		if (skb_pad(skb, pad)) {

		if (skb_pad(skb, pad))

			/* SKB already freed. */

			tx_buf->skb = NULL;

			return NETDEV_TX_OK;

		}

			goto tx_kick_pending;

		length = BNXT_MIN_PKT_SIZE;

	}



	mapping = dma_map_single(&pdev->dev, skb->data, len, DMA_TO_DEVICE);



	if (unlikely(dma_mapping_error(&pdev->dev, mapping))) {

		dev_kfree_skb_any(skb);

		tx_buf->skb = NULL;

		return NETDEV_TX_OK;

	}

	if (unlikely(dma_mapping_error(&pdev->dev, mapping)))

		goto tx_free;



	dma_unmap_addr_set(tx_buf, mapping, mapping);

	flags = (len << TX_BD_LEN_SHIFT) | TX_BD_TYPE_LONG_TX_BD |
@@ -618,24 +646,17 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) 
	txr->tx_prod = prod;



	if (!netdev_xmit_more() || netif_xmit_stopped(txq))

		bnxt_db_write(bp, &txr->tx_db, prod);

		bnxt_txr_db_kick(bp, txr, prod);

	else

		txr->kick_pending = 1;



tx_done:



	if (unlikely(bnxt_tx_avail(bp, txr) <= MAX_SKB_FRAGS + 1)) {

		if (netdev_xmit_more() && !tx_buf->is_push)

			bnxt_db_write(bp, &txr->tx_db, prod);



		netif_tx_stop_queue(txq);

			bnxt_txr_db_kick(bp, txr, prod);



		/* netif_tx_stop_queue() must be done before checking

		 * tx index in bnxt_tx_avail() below, because in

		 * bnxt_tx_int(), we update tx index before checking for

		 * netif_tx_queue_stopped().

		 */

		smp_mb();

		if (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh)

			netif_tx_wake_queue(txq);

		bnxt_txr_netif_try_stop_queue(bp, txr, txq);

	}

	return NETDEV_TX_OK;
@@ -648,7 +669,6 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) 
	/* start back at beginning and unmap skb */

	prod = txr->tx_prod;

	tx_buf = &txr->tx_buf_ring[prod];

	tx_buf->skb = NULL;

	dma_unmap_single(&pdev->dev, dma_unmap_addr(tx_buf, mapping),

			 skb_headlen(skb), PCI_DMA_TODEVICE);

	prod = NEXT_TX(prod);
@@ -662,7 +682,13 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) 
			       PCI_DMA_TODEVICE);

	}



tx_free:

	dev_kfree_skb_any(skb);

tx_kick_pending:

	if (txr->kick_pending)

		bnxt_txr_db_kick(bp, txr, txr->tx_prod);

	txr->tx_buf_ring[txr->tx_prod].skb = NULL;

	atomic_long_inc(&dev->tx_dropped);

	return NETDEV_TX_OK;

}
@@ -732,14 +758,9 @@ static void bnxt_tx_int(struct bnxt *bp, struct bnxt_napi *bnapi, int nr_pkts) 
	smp_mb();



	if (unlikely(netif_tx_queue_stopped(txq)) &&

	    (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh)) {

		__netif_tx_lock(txq, smp_processor_id());

		if (netif_tx_queue_stopped(txq) &&

	    bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh &&

		    txr->dev_state != BNXT_DEV_STATE_CLOSING)

	    READ_ONCE(txr->dev_state) != BNXT_DEV_STATE_CLOSING)

		netif_tx_wake_queue(txq);

		__netif_tx_unlock(txq);

	}

}



static struct page *__bnxt_alloc_rx_page(struct bnxt *bp, dma_addr_t *mapping,
@@ -1767,6 +1788,10 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, 
	if (!RX_CMP_VALID(rxcmp1, tmp_raw_cons))

		return -EBUSY;



	/* The valid test of the entry must be done first before

	 * reading any further.

	 */

	dma_rmb();

	prod = rxr->rx_prod;



	if (cmp_type == CMP_TYPE_RX_L2_TPA_START_CMP) {
@@ -1989,6 +2014,10 @@ static int bnxt_force_rx_discard(struct bnxt *bp, 
	if (!RX_CMP_VALID(rxcmp1, tmp_raw_cons))

		return -EBUSY;



	/* The valid test of the entry must be done first before

	 * reading any further.

	 */

	dma_rmb();

	cmp_type = RX_CMP_TYPE(rxcmp);

	if (cmp_type == CMP_TYPE_RX_L2_CMP) {

		rxcmp1->rx_cmp_cfa_code_errors_v2 |=
@@ -2454,6 +2483,10 @@ static int bnxt_poll_nitroa0(struct napi_struct *napi, int budget) 
		if (!TX_CMP_VALID(txcmp, raw_cons))

			break;



		/* The valid test of the entry must be done first before

		 * reading any further.

		 */

		dma_rmb();

		if ((TX_CMP_TYPE(txcmp) & 0x30) == 0x10) {

			tmp_raw_cons = NEXT_RAW_CMP(raw_cons);

			cp_cons = RING_CMP(tmp_raw_cons);
@@ -9128,10 +9161,9 @@ static void bnxt_disable_napi(struct bnxt *bp) 
	for (i = 0; i < bp->cp_nr_rings; i++) {

		struct bnxt_cp_ring_info *cpr = &bp->bnapi[i]->cp_ring;



		napi_disable(&bp->bnapi[i]->napi);

		if (bp->bnapi[i]->rx_ring)

			cancel_work_sync(&cpr->dim.work);



		napi_disable(&bp->bnapi[i]->napi);

	}

}
@@ -9165,9 +9197,11 @@ void bnxt_tx_disable(struct bnxt *bp) 
	if (bp->tx_ring) {

		for (i = 0; i < bp->tx_nr_rings; i++) {

			txr = &bp->tx_ring[i];

			txr->dev_state = BNXT_DEV_STATE_CLOSING;

			WRITE_ONCE(txr->dev_state, BNXT_DEV_STATE_CLOSING);

		}

	}

	/* Make sure napi polls see @dev_state change */

	synchronize_net();

	/* Drop carrier first to prevent TX timeout */

	netif_carrier_off(bp->dev);

	/* Stop all TX queues */
@@ -9181,8 +9215,10 @@ void bnxt_tx_enable(struct bnxt *bp) 


	for (i = 0; i < bp->tx_nr_rings; i++) {

		txr = &bp->tx_ring[i];

		txr->dev_state = 0;

		WRITE_ONCE(txr->dev_state, 0);

	}

	/* Make sure napi polls see @dev_state change */

	synchronize_net();

	netif_tx_wake_all_queues(bp->dev);

	if (bp->link_info.link_up)

		netif_carrier_on(bp->dev);
@@ -10768,6 +10804,9 @@ static bool bnxt_rfs_supported(struct bnxt *bp) 
			return true;

		return false;

	}

	/* 212 firmware is broken for aRFS */

	if (BNXT_FW_MAJ(bp) == 212)

		return false;

	if (BNXT_PF(bp) && !BNXT_CHIP_TYPE_NITRO_A0(bp))

		return true;

	if (bp->flags & BNXT_FLAG_NEW_RSS_CAP)

drivers/net/ethernet/broadcom/bnxt/bnxt.h

+1 −0
Original line number Diff line number Diff line
@@ -786,6 +786,7 @@ struct bnxt_tx_ring_info { 
	u16			tx_prod;

	u16			tx_cons;

	u16			txq_index;

	u8			kick_pending;

	struct bnxt_db_info	tx_db;



	struct tx_bd		*tx_desc_ring[MAX_TX_PAGES];

drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c

+18 −18
Original line number Diff line number Diff line
@@ -3038,26 +3038,30 @@ static int dpaa2_switch_port_init(struct ethsw_port_priv *port_priv, u16 port) 
	return err;

}



static void dpaa2_switch_takedown(struct fsl_mc_device *sw_dev)

static void dpaa2_switch_ctrl_if_teardown(struct ethsw_core *ethsw)

{

	dpsw_ctrl_if_disable(ethsw->mc_io, 0, ethsw->dpsw_handle);

	dpaa2_switch_free_dpio(ethsw);

	dpaa2_switch_destroy_rings(ethsw);

	dpaa2_switch_drain_bp(ethsw);

	dpaa2_switch_free_dpbp(ethsw);

}



static void dpaa2_switch_teardown(struct fsl_mc_device *sw_dev)

{

	struct device *dev = &sw_dev->dev;

	struct ethsw_core *ethsw = dev_get_drvdata(dev);

	int err;



	dpaa2_switch_ctrl_if_teardown(ethsw);



	destroy_workqueue(ethsw->workqueue);



	err = dpsw_close(ethsw->mc_io, 0, ethsw->dpsw_handle);

	if (err)

		dev_warn(dev, "dpsw_close err %d\n", err);

}



static void dpaa2_switch_ctrl_if_teardown(struct ethsw_core *ethsw)

{

	dpsw_ctrl_if_disable(ethsw->mc_io, 0, ethsw->dpsw_handle);

	dpaa2_switch_free_dpio(ethsw);

	dpaa2_switch_destroy_rings(ethsw);

	dpaa2_switch_drain_bp(ethsw);

	dpaa2_switch_free_dpbp(ethsw);

}



static int dpaa2_switch_remove(struct fsl_mc_device *sw_dev)

{

	struct ethsw_port_priv *port_priv;
@@ -3068,8 +3072,6 @@ static int dpaa2_switch_remove(struct fsl_mc_device *sw_dev) 
	dev = &sw_dev->dev;

	ethsw = dev_get_drvdata(dev);



	dpaa2_switch_ctrl_if_teardown(ethsw);



	dpaa2_switch_teardown_irqs(sw_dev);



	dpsw_disable(ethsw->mc_io, 0, ethsw->dpsw_handle);
@@ -3084,9 +3086,7 @@ static int dpaa2_switch_remove(struct fsl_mc_device *sw_dev) 
	kfree(ethsw->acls);

	kfree(ethsw->ports);



	dpaa2_switch_takedown(sw_dev);



	destroy_workqueue(ethsw->workqueue);

	dpaa2_switch_teardown(sw_dev);



	fsl_mc_portal_free(ethsw->mc_io);
@@ -3199,7 +3199,7 @@ static int dpaa2_switch_probe(struct fsl_mc_device *sw_dev) 
			       GFP_KERNEL);

	if (!(ethsw->ports)) {

		err = -ENOMEM;

		goto err_takedown;

		goto err_teardown;

	}



	ethsw->fdbs = kcalloc(ethsw->sw_attr.num_ifs, sizeof(*ethsw->fdbs),
@@ -3270,8 +3270,8 @@ static int dpaa2_switch_probe(struct fsl_mc_device *sw_dev) 
err_free_ports:

	kfree(ethsw->ports);



err_takedown:

	dpaa2_switch_takedown(sw_dev);

err_teardown:

	dpaa2_switch_teardown(sw_dev);



err_free_cmdport:

	fsl_mc_portal_free(ethsw->mc_io);

drivers/net/ethernet/intel/i40e/i40e_txrx.c

+1 −2
Original line number Diff line number Diff line
@@ -3663,8 +3663,7 @@ u16 i40e_lan_select_queue(struct net_device *netdev, 


	/* is DCB enabled at all? */

	if (vsi->tc_config.numtc == 1)

		return i40e_swdcb_skb_tx_hash(netdev, skb,

					      netdev->real_num_tx_queues);

		return netdev_pick_tx(netdev, skb, sb_dev);



	prio = skb->priority;

	hw = &vsi->back->hw;