Skip to content

Commit 869e330

Browse files
torvaldstorvalds
committed
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking fixes from David Miller: 1) Off by one and bounds checking fixes in NFC, from Dan Carpenter. 2) There have been many weird regressions in r8169 since we turned ASPM support on, some are still not understood nor completely resolved. Let's turn this back off for now. From Heiner Kallweit. 3) Signess fixes for ethtool speed value handling, from Michael Zhivich. 4) Handle timestamps properly in macb driver, from Paul Thomas. 5) Two erspan fixes, it's the usual "skb ->data potentially reallocated and we're holding a stale protocol header pointer". From Lorenzo Bianconi. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: bnxt_en: Reset device on RX buffer errors. bnxt_en: Improve RX consumer index validity check. net: macb driver, check for SKBTX_HW_TSTAMP qlogic: qlcnic: fix use of SPEED_UNKNOWN ethtool constant broadcom: tg3: fix use of SPEED_UNKNOWN ethtool constant ethtool: avoid signed-unsigned comparison in ethtool_validate_speed() net: ip6_gre: fix possible use-after-free in ip6erspan_rcv net: ip_gre: fix possible use-after-free in erspan_rcv r8169: disable ASPM again MAINTAINERS: ieee802154: update documentation file pattern net: vrf: Fix ping failed when vrf mtu is set to 0 selftests: add a tc matchall test case nfc: nci: Potential off by one in ->pipes[] array NFC: nci: Add some bounds checking in nci_hci_cmd_received()
2 parents a556810 + e063f45 commit 869e330

File tree

14 files changed

+89
-28
lines changed

14 files changed

+89
-28
lines changed

‎MAINTAINERS

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7516,7 +7516,7 @@ F: include/net/mac802154.h
75167516
F: include/net/af_ieee802154.h
75177517
F: include/net/cfg802154.h
75187518
F: include/net/ieee802154_netdev.h
7519-
F: Documentation/networking/ieee802154.txt
7519+
F: Documentation/networking/ieee802154.rst
75207520

75217521
IFE PROTOCOL
75227522
M: Yotam Gigi <yotam.gi@gmail.com>

‎drivers/net/ethernet/broadcom/bnxt/bnxt.c

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1133,6 +1133,8 @@ static void bnxt_tpa_start(struct bnxt *bp, struct bnxt_rx_ring_info *rxr,
11331133
tpa_info = &rxr->rx_tpa[agg_id];
11341134

11351135
if (unlikely(cons != rxr->rx_next_cons)) {
1136+
netdev_warn(bp->dev, "TPA cons %x != expected cons %x\n",
1137+
cons, rxr->rx_next_cons);
11361138
bnxt_sched_reset(bp, rxr);
11371139
return;
11381140
}
@@ -1585,15 +1587,17 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
15851587
}
15861588

15871589
cons = rxcmp->rx_cmp_opaque;
1588-
rx_buf = &rxr->rx_buf_ring[cons];
1589-
data = rx_buf->data;
1590-
data_ptr = rx_buf->data_ptr;
15911590
if (unlikely(cons != rxr->rx_next_cons)) {
15921591
int rc1 = bnxt_discard_rx(bp, cpr, raw_cons, rxcmp);
15931592

1593+
netdev_warn(bp->dev, "RX cons %x != expected cons %x\n",
1594+
cons, rxr->rx_next_cons);
15941595
bnxt_sched_reset(bp, rxr);
15951596
return rc1;
15961597
}
1598+
rx_buf = &rxr->rx_buf_ring[cons];
1599+
data = rx_buf->data;
1600+
data_ptr = rx_buf->data_ptr;
15971601
prefetch(data_ptr);
15981602

15991603
misc = le32_to_cpu(rxcmp->rx_cmp_misc_v1);
@@ -1610,11 +1614,17 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
16101614

16111615
rx_buf->data = NULL;
16121616
if (rxcmp1->rx_cmp_cfa_code_errors_v2 & RX_CMP_L2_ERRORS) {
1617+
u32 rx_err = le32_to_cpu(rxcmp1->rx_cmp_cfa_code_errors_v2);
1618+
16131619
bnxt_reuse_rx_data(rxr, cons, data);
16141620
if (agg_bufs)
16151621
bnxt_reuse_rx_agg_bufs(cpr, cp_cons, agg_bufs);
16161622

16171623
rc = -EIO;
1624+
if (rx_err & RX_CMPL_ERRORS_BUFFER_ERROR_MASK) {
1625+
netdev_warn(bp->dev, "RX buffer error %x\n", rx_err);
1626+
bnxt_sched_reset(bp, rxr);
1627+
}
16181628
goto next_rx;
16191629
}
16201630

‎drivers/net/ethernet/broadcom/tg3.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4283,7 +4283,7 @@ static void tg3_power_down(struct tg3 *tp)
42834283
pci_set_power_state(tp->pdev, PCI_D3hot);
42844284
}
42854285

4286-
static void tg3_aux_stat_to_speed_duplex(struct tg3 *tp, u32 val, u16 *speed, u8 *duplex)
4286+
static void tg3_aux_stat_to_speed_duplex(struct tg3 *tp, u32 val, u32 *speed, u8 *duplex)
42874287
{
42884288
switch (val & MII_TG3_AUX_STAT_SPDMASK) {
42894289
case MII_TG3_AUX_STAT_10HALF:
@@ -4787,7 +4787,7 @@ static int tg3_setup_copper_phy(struct tg3 *tp, bool force_reset)
47874787
bool current_link_up;
47884788
u32 bmsr, val;
47894789
u32 lcl_adv, rmt_adv;
4790-
u16 current_speed;
4790+
u32 current_speed;
47914791
u8 current_duplex;
47924792
int i, err;
47934793

@@ -5719,7 +5719,7 @@ static bool tg3_setup_fiber_by_hand(struct tg3 *tp, u32 mac_status)
57195719
static int tg3_setup_fiber_phy(struct tg3 *tp, bool force_reset)
57205720
{
57215721
u32 orig_pause_cfg;
5722-
u16 orig_active_speed;
5722+
u32 orig_active_speed;
57235723
u8 orig_active_duplex;
57245724
u32 mac_status;
57255725
bool current_link_up;
@@ -5823,7 +5823,7 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset)
58235823
{
58245824
int err = 0;
58255825
u32 bmsr, bmcr;
5826-
u16 current_speed = SPEED_UNKNOWN;
5826+
u32 current_speed = SPEED_UNKNOWN;
58275827
u8 current_duplex = DUPLEX_UNKNOWN;
58285828
bool current_link_up = false;
58295829
u32 local_adv, remote_adv, sgsr;

‎drivers/net/ethernet/broadcom/tg3.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2873,7 +2873,7 @@ struct tg3_tx_ring_info {
28732873
struct tg3_link_config {
28742874
/* Describes what we're trying to get. */
28752875
u32 advertising;
2876-
u16 speed;
2876+
u32 speed;
28772877
u8 duplex;
28782878
u8 autoneg;
28792879
u8 flowctrl;
@@ -2882,7 +2882,7 @@ struct tg3_link_config {
28822882
u8 active_flowctrl;
28832883

28842884
u8 active_duplex;
2885-
u16 active_speed;
2885+
u32 active_speed;
28862886
u32 rmt_adv;
28872887
};
28882888

‎drivers/net/ethernet/cadence/macb_main.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -898,7 +898,9 @@ static void macb_tx_interrupt(struct macb_queue *queue)
898898

899899
/* First, update TX stats if needed */
900900
if (skb) {
901-
if (gem_ptp_do_txstamp(queue, skb, desc) == 0) {
901+
if (unlikely(skb_shinfo(skb)->tx_flags &
902+
SKBTX_HW_TSTAMP) &&
903+
gem_ptp_do_txstamp(queue, skb, desc) == 0) {
902904
/* skb now belongs to timestamp buffer
903905
* and will be removed later
904906
*/

‎drivers/net/ethernet/qlogic/qlcnic/qlcnic.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -497,7 +497,7 @@ struct qlcnic_hardware_context {
497497
u16 board_type;
498498
u16 supported_type;
499499

500-
u16 link_speed;
500+
u32 link_speed;
501501
u16 link_duplex;
502502
u16 link_autoneg;
503503
u16 module_type;

‎drivers/net/ethernet/realtek/r8169.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
#include <linux/pm_runtime.h>
2929
#include <linux/firmware.h>
3030
#include <linux/prefetch.h>
31+
#include <linux/pci-aspm.h>
3132
#include <linux/ipv6.h>
3233
#include <net/ip6_checksum.h>
3334

@@ -7352,6 +7353,11 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
73527353
if (rc)
73537354
return rc;
73547355

7356+
/* Disable ASPM completely as that cause random device stop working
7357+
* problems as well as full system hangs for some PCIe devices users.
7358+
*/
7359+
pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1);
7360+
73557361
/* enable device (incl. PCI PM wakeup and hotplug setup) */
73567362
rc = pcim_enable_device(pdev);
73577363
if (rc < 0) {

‎drivers/net/vrf.c

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1275,8 +1275,12 @@ static void vrf_setup(struct net_device *dev)
12751275
dev->priv_flags |= IFF_NO_QUEUE;
12761276
dev->priv_flags |= IFF_NO_RX_HANDLER;
12771277

1278-
dev->min_mtu = 0;
1279-
dev->max_mtu = 0;
1278+
/* VRF devices do not care about MTU, but if the MTU is set
1279+
* too low then the ipv4 and ipv6 protocols are disabled
1280+
* which breaks networking.
1281+
*/
1282+
dev->min_mtu = IPV6_MIN_MTU;
1283+
dev->max_mtu = ETH_MAX_MTU;
12801284
}
12811285

12821286
static int vrf_validate(struct nlattr *tb[], struct nlattr *data[],

‎include/net/nfc/nci_core.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -166,7 +166,7 @@ struct nci_conn_info {
166166
* According to specification 102 622 chapter 4.4 Pipes,
167167
* the pipe identifier is 7 bits long.
168168
*/
169-
#define NCI_HCI_MAX_PIPES 127
169+
#define NCI_HCI_MAX_PIPES 128
170170

171171
struct nci_hci_gate {
172172
u8 gate;

‎include/uapi/linux/ethtool.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1591,7 +1591,7 @@ enum ethtool_link_mode_bit_indices {
15911591

15921592
static inline int ethtool_validate_speed(__u32 speed)
15931593
{
1594-
return speed <= INT_MAX || speed == SPEED_UNKNOWN;
1594+
return speed <= INT_MAX || speed == (__u32)SPEED_UNKNOWN;
15951595
}
15961596

15971597
/* Duplex, half or full. */

‎net/ipv4/ip_gre.c

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -259,7 +259,6 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
259259
struct net *net = dev_net(skb->dev);
260260
struct metadata_dst *tun_dst = NULL;
261261
struct erspan_base_hdr *ershdr;
262-
struct erspan_metadata *pkt_md;
263262
struct ip_tunnel_net *itn;
264263
struct ip_tunnel *tunnel;
265264
const struct iphdr *iph;
@@ -282,18 +281,16 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
282281
if (unlikely(!pskb_may_pull(skb, len)))
283282
return PACKET_REJECT;
284283

285-
ershdr = (struct erspan_base_hdr *)(skb->data + gre_hdr_len);
286-
pkt_md = (struct erspan_metadata *)(ershdr + 1);
287-
288284
if (__iptunnel_pull_header(skb,
289285
len,
290286
htons(ETH_P_TEB),
291287
false, false) < 0)
292288
goto drop;
293289

294290
if (tunnel->collect_md) {
291+
struct erspan_metadata *pkt_md, *md;
295292
struct ip_tunnel_info *info;
296-
struct erspan_metadata *md;
293+
unsigned char *gh;
297294
__be64 tun_id;
298295
__be16 flags;
299296

@@ -306,6 +303,14 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
306303
if (!tun_dst)
307304
return PACKET_REJECT;
308305

306+
/* skb can be uncloned in __iptunnel_pull_header, so
307+
* old pkt_md is no longer valid and we need to reset
308+
* it
309+
*/
310+
gh = skb_network_header(skb) +
311+
skb_network_header_len(skb);
312+
pkt_md = (struct erspan_metadata *)(gh + gre_hdr_len +
313+
sizeof(*ershdr));
309314
md = ip_tunnel_info_opts(&tun_dst->u.tun_info);
310315
md->version = ver;
311316
md2 = &md->u.md2;

‎net/ipv6/ip6_gre.c

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -525,10 +525,10 @@ static int ip6gre_rcv(struct sk_buff *skb, const struct tnl_ptk_info *tpi)
525525
}
526526

527527
static int ip6erspan_rcv(struct sk_buff *skb,
528-
struct tnl_ptk_info *tpi)
528+
struct tnl_ptk_info *tpi,
529+
int gre_hdr_len)
529530
{
530531
struct erspan_base_hdr *ershdr;
531-
struct erspan_metadata *pkt_md;
532532
const struct ipv6hdr *ipv6h;
533533
struct erspan_md2 *md2;
534534
struct ip6_tnl *tunnel;
@@ -547,18 +547,16 @@ static int ip6erspan_rcv(struct sk_buff *skb,
547547
if (unlikely(!pskb_may_pull(skb, len)))
548548
return PACKET_REJECT;
549549

550-
ershdr = (struct erspan_base_hdr *)skb->data;
551-
pkt_md = (struct erspan_metadata *)(ershdr + 1);
552-
553550
if (__iptunnel_pull_header(skb, len,
554551
htons(ETH_P_TEB),
555552
false, false) < 0)
556553
return PACKET_REJECT;
557554

558555
if (tunnel->parms.collect_md) {
556+
struct erspan_metadata *pkt_md, *md;
559557
struct metadata_dst *tun_dst;
560558
struct ip_tunnel_info *info;
561-
struct erspan_metadata *md;
559+
unsigned char *gh;
562560
__be64 tun_id;
563561
__be16 flags;
564562

@@ -571,6 +569,14 @@ static int ip6erspan_rcv(struct sk_buff *skb,
571569
if (!tun_dst)
572570
return PACKET_REJECT;
573571

572+
/* skb can be uncloned in __iptunnel_pull_header, so
573+
* old pkt_md is no longer valid and we need to reset
574+
* it
575+
*/
576+
gh = skb_network_header(skb) +
577+
skb_network_header_len(skb);
578+
pkt_md = (struct erspan_metadata *)(gh + gre_hdr_len +
579+
sizeof(*ershdr));
574580
info = &tun_dst->u.tun_info;
575581
md = ip_tunnel_info_opts(info);
576582
md->version = ver;
@@ -607,7 +613,7 @@ static int gre_rcv(struct sk_buff *skb)
607613

608614
if (unlikely(tpi.proto == htons(ETH_P_ERSPAN) ||
609615
tpi.proto == htons(ETH_P_ERSPAN2))) {
610-
if (ip6erspan_rcv(skb, &tpi) == PACKET_RCVD)
616+
if (ip6erspan_rcv(skb, &tpi, hdr_len) == PACKET_RCVD)
611617
return 0;
612618
goto out;
613619
}

‎net/nfc/nci/hci.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -312,6 +312,10 @@ static void nci_hci_cmd_received(struct nci_dev *ndev, u8 pipe,
312312
create_info = (struct nci_hci_create_pipe_resp *)skb->data;
313313
dest_gate = create_info->dest_gate;
314314
new_pipe = create_info->pipe;
315+
if (new_pipe >= NCI_HCI_MAX_PIPES) {
316+
status = NCI_HCI_ANY_E_NOK;
317+
goto exit;
318+
}
315319

316320
/* Save the new created pipe and bind with local gate,
317321
* the description for skb->data[3] is destination gate id
@@ -336,6 +340,10 @@ static void nci_hci_cmd_received(struct nci_dev *ndev, u8 pipe,
336340
goto exit;
337341
}
338342
delete_info = (struct nci_hci_delete_pipe_noti *)skb->data;
343+
if (delete_info->pipe >= NCI_HCI_MAX_PIPES) {
344+
status = NCI_HCI_ANY_E_NOK;
345+
goto exit;
346+
}
339347

340348
ndev->hci_dev->pipes[delete_info->pipe].gate =
341349
NCI_HCI_INVALID_GATE;

‎tools/testing/selftests/tc-testing/tc-tests/filters/tests.json

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,26 @@
1818
"$TC qdisc del dev $DEV1 ingress"
1919
]
2020
},
21+
{
22+
"id": "2638",
23+
"name": "Add matchall and try to get it",
24+
"category": [
25+
"filter",
26+
"matchall"
27+
],
28+
"setup": [
29+
"$TC qdisc add dev $DEV1 clsact",
30+
"$TC filter add dev $DEV1 protocol all pref 1 ingress handle 0x1234 matchall action ok"
31+
],
32+
"cmdUnderTest": "$TC filter get dev $DEV1 protocol all pref 1 ingress handle 0x1234 matchall",
33+
"expExitCode": "0",
34+
"verifyCmd": "$TC filter show dev $DEV1 ingress",
35+
"matchPattern": "filter protocol all pref 1 matchall chain 0 handle 0x1234",
36+
"matchCount": "1",
37+
"teardown": [
38+
"$TC qdisc del dev $DEV1 clsact"
39+
]
40+
},
2141
{
2242
"id": "d052",
2343
"name": "Add 1M filters with the same action",

0 commit comments

Comments
 (0)