Skip to content

Commit 057a650

Browse files
torvaldstorvalds
committed
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking fixes from David Miller: 1) Don't race in IPSEC dumps, from Yuejie Shi. 2) Verify lengths properly in IPSEC reqeusts, from Herbert Xu. 3) Fix out of bounds access in ipv6 segment routing code, from David Lebrun. 4) Don't write into the header of cloned SKBs in smsc95xx driver, from James Hughes. 5) Several other drivers have this bug too, fix them. From Eric Dumazet. 6) Fix access to uninitialized data in TC action cookie code, from Wolfgang Bumiller. 7) Fix double free in IPV6 segment routing, again from David Lebrun. 8) Don't let userspace set the RTF_PCPU flag, oops. From David Ahern. 9) Fix use after free in qrtr code, from Dan Carpenter. 10) Don't double-destroy devices in ip6mr code, from Nikolay Aleksandrov. 11) Don't pass out-of-range TX queue indices into drivers, from Tushar Dave. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (30 commits) netpoll: Check for skb->queue_mapping ip6mr: fix notification device destruction bpf, doc: update bpf maintainers entry net: qrtr: potential use after free in qrtr_sendmsg() bpf: Fix values type used in test_maps net: ipv6: RTF_PCPU should not be settable from userspace gso: Validate assumption of frag_list segementation kaweth: use skb_cow_head() to deal with cloned skbs ch9200: use skb_cow_head() to deal with cloned skbs lan78xx: use skb_cow_head() to deal with cloned skbs sr9700: use skb_cow_head() to deal with cloned skbs cx82310_eth: use skb_cow_head() to deal with cloned skbs smsc75xx: use skb_cow_head() to deal with cloned skbs ipv6: sr: fix double free of skb after handling invalid SRH MAINTAINERS: Add "B:" field for networking. net sched actions: allocate act cookie early qed: Fix issue in populating the PFC config paramters. qed: Fix possible system hang in the dcbnl-getdcbx() path. qed: Fix sending an invalid PFC error mask to MFW. qed: Fix possible error in populating max_tc field. ...
2 parents 92b4fc7 + c70b17b commit 057a650

File tree

25 files changed

+345
-210
lines changed

25 files changed

+345
-210
lines changed

‎MAINTAINERS

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2585,12 +2585,26 @@ F: include/uapi/linux/if_bonding.h
25852585

25862586
BPF (Safe dynamic programs and tools)
25872587
M: Alexei Starovoitov <ast@kernel.org>
2588+
M: Daniel Borkmann <daniel@iogearbox.net>
25882589
L: netdev@vger.kernel.org
25892590
L: linux-kernel@vger.kernel.org
25902591
S: Supported
2592+
F: arch/x86/net/bpf_jit*
2593+
F: Documentation/networking/filter.txt
2594+
F: include/linux/bpf*
2595+
F: include/linux/filter.h
2596+
F: include/uapi/linux/bpf*
2597+
F: include/uapi/linux/filter.h
25912598
F: kernel/bpf/
2592-
F: tools/testing/selftests/bpf/
2599+
F: kernel/trace/bpf_trace.c
25932600
F: lib/test_bpf.c
2601+
F: net/bpf/
2602+
F: net/core/filter.c
2603+
F: net/sched/act_bpf.c
2604+
F: net/sched/cls_bpf.c
2605+
F: samples/bpf/
2606+
F: tools/net/bpf*
2607+
F: tools/testing/selftests/bpf/
25942608

25952609
BROADCOM B44 10/100 ETHERNET DRIVER
25962610
M: Michael Chan <michael.chan@broadcom.com>
@@ -8761,6 +8775,7 @@ W: http://www.linuxfoundation.org/en/Net
87618775
Q: http://patchwork.ozlabs.org/project/netdev/list/
87628776
T: git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git
87638777
T: git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
8778+
B: mailto:netdev@vger.kernel.org
87648779
S: Maintained
87658780
F: net/
87668781
F: include/net/
@@ -12464,7 +12479,6 @@ F: drivers/clk/ti/
1246412479
F: include/linux/clk/ti.h
1246512480

1246612481
TI ETHERNET SWITCH DRIVER (CPSW)
12467-
M: Mugunthan V N <mugunthanvnm@ti.com>
1246812482
R: Grygorii Strashko <grygorii.strashko@ti.com>
1246912483
L: linux-omap@vger.kernel.org
1247012484
L: netdev@vger.kernel.org

‎drivers/net/ethernet/qlogic/qed/qed_dcbx.c

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -583,6 +583,13 @@ qed_dcbx_get_ets_data(struct qed_hwfn *p_hwfn,
583583
p_params->ets_cbs,
584584
p_ets->pri_tc_tbl[0], p_params->max_ets_tc);
585585

586+
if (p_params->ets_enabled && !p_params->max_ets_tc) {
587+
p_params->max_ets_tc = QED_MAX_PFC_PRIORITIES;
588+
DP_VERBOSE(p_hwfn, QED_MSG_DCB,
589+
"ETS params: max_ets_tc is forced to %d\n",
590+
p_params->max_ets_tc);
591+
}
592+
586593
/* 8 bit tsa and bw data corresponding to each of the 8 TC's are
587594
* encoded in a type u32 array of size 2.
588595
*/
@@ -1001,6 +1008,8 @@ qed_dcbx_set_pfc_data(struct qed_hwfn *p_hwfn,
10011008
u8 pfc_map = 0;
10021009
int i;
10031010

1011+
*pfc &= ~DCBX_PFC_ERROR_MASK;
1012+
10041013
if (p_params->pfc.willing)
10051014
*pfc |= DCBX_PFC_WILLING_MASK;
10061015
else
@@ -1255,7 +1264,7 @@ static struct qed_dcbx_get *qed_dcbnl_get_dcbx(struct qed_hwfn *hwfn,
12551264
{
12561265
struct qed_dcbx_get *dcbx_info;
12571266

1258-
dcbx_info = kzalloc(sizeof(*dcbx_info), GFP_KERNEL);
1267+
dcbx_info = kmalloc(sizeof(*dcbx_info), GFP_ATOMIC);
12591268
if (!dcbx_info)
12601269
return NULL;
12611270

@@ -2073,6 +2082,8 @@ static int qed_dcbnl_ieee_setpfc(struct qed_dev *cdev, struct ieee_pfc *pfc)
20732082
for (i = 0; i < QED_MAX_PFC_PRIORITIES; i++)
20742083
dcbx_set.config.params.pfc.prio[i] = !!(pfc->pfc_en & BIT(i));
20752084

2085+
dcbx_set.config.params.pfc.max_tc = pfc->pfc_cap;
2086+
20762087
ptt = qed_ptt_acquire(hwfn);
20772088
if (!ptt)
20782089
return -EINVAL;

‎drivers/net/ethernet/renesas/sh_eth.c

Lines changed: 67 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -1127,12 +1127,70 @@ static struct mdiobb_ops bb_ops = {
11271127
.get_mdio_data = sh_get_mdio,
11281128
};
11291129

1130+
/* free Tx skb function */
1131+
static int sh_eth_tx_free(struct net_device *ndev, bool sent_only)
1132+
{
1133+
struct sh_eth_private *mdp = netdev_priv(ndev);
1134+
struct sh_eth_txdesc *txdesc;
1135+
int free_num = 0;
1136+
int entry;
1137+
bool sent;
1138+
1139+
for (; mdp->cur_tx - mdp->dirty_tx > 0; mdp->dirty_tx++) {
1140+
entry = mdp->dirty_tx % mdp->num_tx_ring;
1141+
txdesc = &mdp->tx_ring[entry];
1142+
sent = !(txdesc->status & cpu_to_le32(TD_TACT));
1143+
if (sent_only && !sent)
1144+
break;
1145+
/* TACT bit must be checked before all the following reads */
1146+
dma_rmb();
1147+
netif_info(mdp, tx_done, ndev,
1148+
"tx entry %d status 0x%08x\n",
1149+
entry, le32_to_cpu(txdesc->status));
1150+
/* Free the original skb. */
1151+
if (mdp->tx_skbuff[entry]) {
1152+
dma_unmap_single(&ndev->dev, le32_to_cpu(txdesc->addr),
1153+
le32_to_cpu(txdesc->len) >> 16,
1154+
DMA_TO_DEVICE);
1155+
dev_kfree_skb_irq(mdp->tx_skbuff[entry]);
1156+
mdp->tx_skbuff[entry] = NULL;
1157+
free_num++;
1158+
}
1159+
txdesc->status = cpu_to_le32(TD_TFP);
1160+
if (entry >= mdp->num_tx_ring - 1)
1161+
txdesc->status |= cpu_to_le32(TD_TDLE);
1162+
1163+
if (sent) {
1164+
ndev->stats.tx_packets++;
1165+
ndev->stats.tx_bytes += le32_to_cpu(txdesc->len) >> 16;
1166+
}
1167+
}
1168+
return free_num;
1169+
}
1170+
11301171
/* free skb and descriptor buffer */
11311172
static void sh_eth_ring_free(struct net_device *ndev)
11321173
{
11331174
struct sh_eth_private *mdp = netdev_priv(ndev);
11341175
int ringsize, i;
11351176

1177+
if (mdp->rx_ring) {
1178+
for (i = 0; i < mdp->num_rx_ring; i++) {
1179+
if (mdp->rx_skbuff[i]) {
1180+
struct sh_eth_rxdesc *rxdesc = &mdp->rx_ring[i];
1181+
1182+
dma_unmap_single(&ndev->dev,
1183+
le32_to_cpu(rxdesc->addr),
1184+
ALIGN(mdp->rx_buf_sz, 32),
1185+
DMA_FROM_DEVICE);
1186+
}
1187+
}
1188+
ringsize = sizeof(struct sh_eth_rxdesc) * mdp->num_rx_ring;
1189+
dma_free_coherent(NULL, ringsize, mdp->rx_ring,
1190+
mdp->rx_desc_dma);
1191+
mdp->rx_ring = NULL;
1192+
}
1193+
11361194
/* Free Rx skb ringbuffer */
11371195
if (mdp->rx_skbuff) {
11381196
for (i = 0; i < mdp->num_rx_ring; i++)
@@ -1141,27 +1199,18 @@ static void sh_eth_ring_free(struct net_device *ndev)
11411199
kfree(mdp->rx_skbuff);
11421200
mdp->rx_skbuff = NULL;
11431201

1144-
/* Free Tx skb ringbuffer */
1145-
if (mdp->tx_skbuff) {
1146-
for (i = 0; i < mdp->num_tx_ring; i++)
1147-
dev_kfree_skb(mdp->tx_skbuff[i]);
1148-
}
1149-
kfree(mdp->tx_skbuff);
1150-
mdp->tx_skbuff = NULL;
1151-
1152-
if (mdp->rx_ring) {
1153-
ringsize = sizeof(struct sh_eth_rxdesc) * mdp->num_rx_ring;
1154-
dma_free_coherent(NULL, ringsize, mdp->rx_ring,
1155-
mdp->rx_desc_dma);
1156-
mdp->rx_ring = NULL;
1157-
}
1158-
11591202
if (mdp->tx_ring) {
1203+
sh_eth_tx_free(ndev, false);
1204+
11601205
ringsize = sizeof(struct sh_eth_txdesc) * mdp->num_tx_ring;
11611206
dma_free_coherent(NULL, ringsize, mdp->tx_ring,
11621207
mdp->tx_desc_dma);
11631208
mdp->tx_ring = NULL;
11641209
}
1210+
1211+
/* Free Tx skb ringbuffer */
1212+
kfree(mdp->tx_skbuff);
1213+
mdp->tx_skbuff = NULL;
11651214
}
11661215

11671216
/* format skb and descriptor buffer */
@@ -1409,43 +1458,6 @@ static void sh_eth_dev_exit(struct net_device *ndev)
14091458
update_mac_address(ndev);
14101459
}
14111460

1412-
/* free Tx skb function */
1413-
static int sh_eth_txfree(struct net_device *ndev)
1414-
{
1415-
struct sh_eth_private *mdp = netdev_priv(ndev);
1416-
struct sh_eth_txdesc *txdesc;
1417-
int free_num = 0;
1418-
int entry;
1419-
1420-
for (; mdp->cur_tx - mdp->dirty_tx > 0; mdp->dirty_tx++) {
1421-
entry = mdp->dirty_tx % mdp->num_tx_ring;
1422-
txdesc = &mdp->tx_ring[entry];
1423-
if (txdesc->status & cpu_to_le32(TD_TACT))
1424-
break;
1425-
/* TACT bit must be checked before all the following reads */
1426-
dma_rmb();
1427-
netif_info(mdp, tx_done, ndev,
1428-
"tx entry %d status 0x%08x\n",
1429-
entry, le32_to_cpu(txdesc->status));
1430-
/* Free the original skb. */
1431-
if (mdp->tx_skbuff[entry]) {
1432-
dma_unmap_single(&ndev->dev, le32_to_cpu(txdesc->addr),
1433-
le32_to_cpu(txdesc->len) >> 16,
1434-
DMA_TO_DEVICE);
1435-
dev_kfree_skb_irq(mdp->tx_skbuff[entry]);
1436-
mdp->tx_skbuff[entry] = NULL;
1437-
free_num++;
1438-
}
1439-
txdesc->status = cpu_to_le32(TD_TFP);
1440-
if (entry >= mdp->num_tx_ring - 1)
1441-
txdesc->status |= cpu_to_le32(TD_TDLE);
1442-
1443-
ndev->stats.tx_packets++;
1444-
ndev->stats.tx_bytes += le32_to_cpu(txdesc->len) >> 16;
1445-
}
1446-
return free_num;
1447-
}
1448-
14491461
/* Packet receive function */
14501462
static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
14511463
{
@@ -1690,7 +1702,7 @@ static void sh_eth_error(struct net_device *ndev, u32 intr_status)
16901702
intr_status, mdp->cur_tx, mdp->dirty_tx,
16911703
(u32)ndev->state, edtrr);
16921704
/* dirty buffer free */
1693-
sh_eth_txfree(ndev);
1705+
sh_eth_tx_free(ndev, true);
16941706

16951707
/* SH7712 BUG */
16961708
if (edtrr ^ sh_eth_get_edtrr_trns(mdp)) {
@@ -1751,7 +1763,7 @@ static irqreturn_t sh_eth_interrupt(int irq, void *netdev)
17511763
/* Clear Tx interrupts */
17521764
sh_eth_write(ndev, intr_status & cd->tx_check, EESR);
17531765

1754-
sh_eth_txfree(ndev);
1766+
sh_eth_tx_free(ndev, true);
17551767
netif_wake_queue(ndev);
17561768
}
17571769

@@ -2412,7 +2424,7 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
24122424

24132425
spin_lock_irqsave(&mdp->lock, flags);
24142426
if ((mdp->cur_tx - mdp->dirty_tx) >= (mdp->num_tx_ring - 4)) {
2415-
if (!sh_eth_txfree(ndev)) {
2427+
if (!sh_eth_tx_free(ndev, true)) {
24162428
netif_warn(mdp, tx_queued, ndev, "TxFD exhausted.\n");
24172429
netif_stop_queue(ndev);
24182430
spin_unlock_irqrestore(&mdp->lock, flags);

‎drivers/net/phy/dp83640.c

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1438,8 +1438,6 @@ static bool dp83640_rxtstamp(struct phy_device *phydev,
14381438
skb_info->tmo = jiffies + SKB_TIMESTAMP_TIMEOUT;
14391439
skb_queue_tail(&dp83640->rx_queue, skb);
14401440
schedule_delayed_work(&dp83640->ts_work, SKB_TIMESTAMP_TIMEOUT);
1441-
} else {
1442-
netif_rx_ni(skb);
14431441
}
14441442

14451443
return true;

‎drivers/net/usb/ch9200.c

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -254,14 +254,9 @@ static struct sk_buff *ch9200_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
254254
tx_overhead = 0x40;
255255

256256
len = skb->len;
257-
if (skb_headroom(skb) < tx_overhead) {
258-
struct sk_buff *skb2;
259-
260-
skb2 = skb_copy_expand(skb, tx_overhead, 0, flags);
257+
if (skb_cow_head(skb, tx_overhead)) {
261258
dev_kfree_skb_any(skb);
262-
skb = skb2;
263-
if (!skb)
264-
return NULL;
259+
return NULL;
265260
}
266261

267262
__skb_push(skb, tx_overhead);

‎drivers/net/usb/cx82310_eth.c

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -293,12 +293,9 @@ static struct sk_buff *cx82310_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
293293
{
294294
int len = skb->len;
295295

296-
if (skb_headroom(skb) < 2) {
297-
struct sk_buff *skb2 = skb_copy_expand(skb, 2, 0, flags);
296+
if (skb_cow_head(skb, 2)) {
298297
dev_kfree_skb_any(skb);
299-
skb = skb2;
300-
if (!skb)
301-
return NULL;
298+
return NULL;
302299
}
303300
skb_push(skb, 2);
304301

‎drivers/net/usb/kaweth.c

Lines changed: 6 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -803,18 +803,12 @@ static netdev_tx_t kaweth_start_xmit(struct sk_buff *skb,
803803
}
804804

805805
/* We now decide whether we can put our special header into the sk_buff */
806-
if (skb_cloned(skb) || skb_headroom(skb) < 2) {
807-
/* no such luck - we make our own */
808-
struct sk_buff *copied_skb;
809-
copied_skb = skb_copy_expand(skb, 2, 0, GFP_ATOMIC);
810-
dev_kfree_skb_irq(skb);
811-
skb = copied_skb;
812-
if (!copied_skb) {
813-
kaweth->stats.tx_errors++;
814-
netif_start_queue(net);
815-
spin_unlock_irq(&kaweth->device_lock);
816-
return NETDEV_TX_OK;
817-
}
806+
if (skb_cow_head(skb, 2)) {
807+
kaweth->stats.tx_errors++;
808+
netif_start_queue(net);
809+
spin_unlock_irq(&kaweth->device_lock);
810+
dev_kfree_skb_any(skb);
811+
return NETDEV_TX_OK;
818812
}
819813

820814
private_header = (__le16 *)__skb_push(skb, 2);

‎drivers/net/usb/lan78xx.c

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2607,14 +2607,9 @@ static struct sk_buff *lan78xx_tx_prep(struct lan78xx_net *dev,
26072607
{
26082608
u32 tx_cmd_a, tx_cmd_b;
26092609

2610-
if (skb_headroom(skb) < TX_OVERHEAD) {
2611-
struct sk_buff *skb2;
2612-
2613-
skb2 = skb_copy_expand(skb, TX_OVERHEAD, 0, flags);
2610+
if (skb_cow_head(skb, TX_OVERHEAD)) {
26142611
dev_kfree_skb_any(skb);
2615-
skb = skb2;
2616-
if (!skb)
2617-
return NULL;
2612+
return NULL;
26182613
}
26192614

26202615
if (lan78xx_linearize(skb) < 0)

‎drivers/net/usb/smsc75xx.c

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2203,13 +2203,9 @@ static struct sk_buff *smsc75xx_tx_fixup(struct usbnet *dev,
22032203
{
22042204
u32 tx_cmd_a, tx_cmd_b;
22052205

2206-
if (skb_headroom(skb) < SMSC75XX_TX_OVERHEAD) {
2207-
struct sk_buff *skb2 =
2208-
skb_copy_expand(skb, SMSC75XX_TX_OVERHEAD, 0, flags);
2206+
if (skb_cow_head(skb, SMSC75XX_TX_OVERHEAD)) {
22092207
dev_kfree_skb_any(skb);
2210-
skb = skb2;
2211-
if (!skb)
2212-
return NULL;
2208+
return NULL;
22132209
}
22142210

22152211
tx_cmd_a = (u32)(skb->len & TX_CMD_A_LEN) | TX_CMD_A_FCS;

‎drivers/net/usb/smsc95xx.c

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2001,13 +2001,13 @@ static struct sk_buff *smsc95xx_tx_fixup(struct usbnet *dev,
20012001
/* We do not advertise SG, so skbs should be already linearized */
20022002
BUG_ON(skb_shinfo(skb)->nr_frags);
20032003

2004-
if (skb_headroom(skb) < overhead) {
2005-
struct sk_buff *skb2 = skb_copy_expand(skb,
2006-
overhead, 0, flags);
2004+
/* Make writable and expand header space by overhead if required */
2005+
if (skb_cow_head(skb, overhead)) {
2006+
/* Must deallocate here as returning NULL to indicate error
2007+
* means the skb won't be deallocated in the caller.
2008+
*/
20072009
dev_kfree_skb_any(skb);
2008-
skb = skb2;
2009-
if (!skb)
2010-
return NULL;
2010+
return NULL;
20112011
}
20122012

20132013
if (csum) {

‎drivers/net/usb/sr9700.c

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -456,14 +456,9 @@ static struct sk_buff *sr9700_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
456456

457457
len = skb->len;
458458

459-
if (skb_headroom(skb) < SR_TX_OVERHEAD) {
460-
struct sk_buff *skb2;
461-
462-
skb2 = skb_copy_expand(skb, SR_TX_OVERHEAD, 0, flags);
459+
if (skb_cow_head(skb, SR_TX_OVERHEAD)) {
463460
dev_kfree_skb_any(skb);
464-
skb = skb2;
465-
if (!skb)
466-
return NULL;
461+
return NULL;
467462
}
468463

469464
__skb_push(skb, SR_TX_OVERHEAD);

0 commit comments

Comments
 (0)