Skip to content

Commit c1d84a1

Browse files
committed
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Dave writes: "Networking fixes: 1) Fix truncation of 32-bit right shift in bpf, from Jann Horn. 2) Fix memory leak in wireless wext compat, from Stefan Seyfried. 3) Use after free in cfg80211's reg_process_hint(), from Yu Zhao. 4) Need to cancel pending work when unbinding in smsc75xx otherwise we oops, also from Yu Zhao. 5) Don't allow enslaving a team device to itself, from Ido Schimmel. 6) Fix backwards compat with older userspace for rtnetlink FDB dumps. From Mauricio Faria. 7) Add validation of tc policy netlink attributes, from David Ahern. 8) Fix RCU locking in rawv6_send_hdrinc(), from Wei Wang." * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (26 commits) net: mvpp2: Extract the correct ethtype from the skb for tx csum offload ipv6: take rcu lock in rawv6_send_hdrinc() net: sched: Add policy validation for tc attributes rtnetlink: fix rtnl_fdb_dump() for ndmsg header yam: fix a missing-check bug net: bpfilter: Fix type cast and pointer warnings net: cxgb3_main: fix a missing-check bug bpf: 32-bit RSH verification must truncate input before the ALU op net: phy: phylink: fix SFP interface autodetection be2net: don't flip hw_features when VXLANs are added/deleted net/packet: fix packet drop as of virtio gso net: dsa: b53: Keep CPU port as tagged in all VLANs openvswitch: load NAT helper bnxt_en: get the reduced max_irqs by the ones used by RDMA bnxt_en: free hwrm resources, if driver probe fails. bnxt_en: Fix enables field in HWRM_QUEUE_COS2BW_CFG request bnxt_en: Fix VNIC reservations on the PF. team: Forbid enslaving team device to itself net/usb: cancel pending work when unbinding smsc75xx mlxsw: spectrum: Delete RIF when VLAN device is removed ...
2 parents 091a1ea + 35f3625 commit c1d84a1

File tree

24 files changed

+203
-81
lines changed

24 files changed

+203
-81
lines changed

drivers/net/dsa/b53/b53_common.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1107,7 +1107,7 @@ void b53_vlan_add(struct dsa_switch *ds, int port,
11071107
b53_get_vlan_entry(dev, vid, vl);
11081108

11091109
vl->members |= BIT(port);
1110-
if (untagged)
1110+
if (untagged && !dsa_is_cpu_port(ds, port))
11111111
vl->untag |= BIT(port);
11121112
else
11131113
vl->untag &= ~BIT(port);
@@ -1149,7 +1149,7 @@ int b53_vlan_del(struct dsa_switch *ds, int port,
11491149
pvid = 0;
11501150
}
11511151

1152-
if (untagged)
1152+
if (untagged && !dsa_is_cpu_port(ds, port))
11531153
vl->untag &= ~(BIT(port));
11541154

11551155
b53_set_vlan_entry(dev, vid, vl);

drivers/net/ethernet/broadcom/bnxt/bnxt.c

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3017,10 +3017,11 @@ static void bnxt_free_hwrm_resources(struct bnxt *bp)
30173017
{
30183018
struct pci_dev *pdev = bp->pdev;
30193019

3020-
dma_free_coherent(&pdev->dev, PAGE_SIZE, bp->hwrm_cmd_resp_addr,
3021-
bp->hwrm_cmd_resp_dma_addr);
3022-
3023-
bp->hwrm_cmd_resp_addr = NULL;
3020+
if (bp->hwrm_cmd_resp_addr) {
3021+
dma_free_coherent(&pdev->dev, PAGE_SIZE, bp->hwrm_cmd_resp_addr,
3022+
bp->hwrm_cmd_resp_dma_addr);
3023+
bp->hwrm_cmd_resp_addr = NULL;
3024+
}
30243025
}
30253026

30263027
static int bnxt_alloc_hwrm_resources(struct bnxt *bp)
@@ -4650,7 +4651,7 @@ __bnxt_hwrm_reserve_pf_rings(struct bnxt *bp, struct hwrm_func_cfg_input *req,
46504651
FUNC_CFG_REQ_ENABLES_NUM_STAT_CTXS : 0;
46514652
enables |= ring_grps ?
46524653
FUNC_CFG_REQ_ENABLES_NUM_HW_RING_GRPS : 0;
4653-
enables |= vnics ? FUNC_VF_CFG_REQ_ENABLES_NUM_VNICS : 0;
4654+
enables |= vnics ? FUNC_CFG_REQ_ENABLES_NUM_VNICS : 0;
46544655

46554656
req->num_rx_rings = cpu_to_le16(rx_rings);
46564657
req->num_hw_ring_grps = cpu_to_le16(ring_grps);
@@ -8621,7 +8622,7 @@ static void _bnxt_get_max_rings(struct bnxt *bp, int *max_rx, int *max_tx,
86218622
*max_tx = hw_resc->max_tx_rings;
86228623
*max_rx = hw_resc->max_rx_rings;
86238624
*max_cp = min_t(int, bnxt_get_max_func_cp_rings_for_en(bp),
8624-
hw_resc->max_irqs);
8625+
hw_resc->max_irqs - bnxt_get_ulp_msix_num(bp));
86258626
*max_cp = min_t(int, *max_cp, hw_resc->max_stat_ctxs);
86268627
max_ring_grps = hw_resc->max_hw_ring_grps;
86278628
if (BNXT_CHIP_TYPE_NITRO_A0(bp) && BNXT_PF(bp)) {
@@ -9057,6 +9058,7 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
90579058
bnxt_clear_int_mode(bp);
90589059

90599060
init_err_pci_clean:
9061+
bnxt_free_hwrm_resources(bp);
90609062
bnxt_cleanup_pci(bp);
90619063

90629064
init_err_free:

drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -98,13 +98,13 @@ static int bnxt_hwrm_queue_cos2bw_cfg(struct bnxt *bp, struct ieee_ets *ets,
9898

9999
bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_QUEUE_COS2BW_CFG, -1, -1);
100100
for (i = 0; i < max_tc; i++) {
101-
u8 qidx;
101+
u8 qidx = bp->tc_to_qidx[i];
102102

103103
req.enables |= cpu_to_le32(
104-
QUEUE_COS2BW_CFG_REQ_ENABLES_COS_QUEUE_ID0_VALID << i);
104+
QUEUE_COS2BW_CFG_REQ_ENABLES_COS_QUEUE_ID0_VALID <<
105+
qidx);
105106

106107
memset(&cos2bw, 0, sizeof(cos2bw));
107-
qidx = bp->tc_to_qidx[i];
108108
cos2bw.queue_id = bp->q_info[qidx].queue_id;
109109
if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_STRICT) {
110110
cos2bw.tsa =

drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2159,6 +2159,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)
21592159
return -EPERM;
21602160
if (copy_from_user(&t, useraddr, sizeof(t)))
21612161
return -EFAULT;
2162+
if (t.cmd != CHELSIO_SET_QSET_PARAMS)
2163+
return -EINVAL;
21622164
if (t.qset_idx >= SGE_QSETS)
21632165
return -EINVAL;
21642166
if (!in_range(t.intr_lat, 0, M_NEWTIMER) ||
@@ -2258,6 +2260,9 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)
22582260
if (copy_from_user(&t, useraddr, sizeof(t)))
22592261
return -EFAULT;
22602262

2263+
if (t.cmd != CHELSIO_GET_QSET_PARAMS)
2264+
return -EINVAL;
2265+
22612266
/* Display qsets for all ports when offload enabled */
22622267
if (test_bit(OFFLOAD_DEVMAP_BIT, &adapter->open_device_map)) {
22632268
q1 = 0;
@@ -2303,6 +2308,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)
23032308
return -EBUSY;
23042309
if (copy_from_user(&edata, useraddr, sizeof(edata)))
23052310
return -EFAULT;
2311+
if (edata.cmd != CHELSIO_SET_QSET_NUM)
2312+
return -EINVAL;
23062313
if (edata.val < 1 ||
23072314
(edata.val > 1 && !(adapter->flags & USING_MSIX)))
23082315
return -EINVAL;
@@ -2343,6 +2350,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)
23432350
return -EPERM;
23442351
if (copy_from_user(&t, useraddr, sizeof(t)))
23452352
return -EFAULT;
2353+
if (t.cmd != CHELSIO_LOAD_FW)
2354+
return -EINVAL;
23462355
/* Check t.len sanity ? */
23472356
fw_data = memdup_user(useraddr + sizeof(t), t.len);
23482357
if (IS_ERR(fw_data))
@@ -2366,6 +2375,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)
23662375
return -EBUSY;
23672376
if (copy_from_user(&m, useraddr, sizeof(m)))
23682377
return -EFAULT;
2378+
if (m.cmd != CHELSIO_SETMTUTAB)
2379+
return -EINVAL;
23692380
if (m.nmtus != NMTUS)
23702381
return -EINVAL;
23712382
if (m.mtus[0] < 81) /* accommodate SACK */
@@ -2407,6 +2418,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)
24072418
return -EBUSY;
24082419
if (copy_from_user(&m, useraddr, sizeof(m)))
24092420
return -EFAULT;
2421+
if (m.cmd != CHELSIO_SET_PM)
2422+
return -EINVAL;
24102423
if (!is_power_of_2(m.rx_pg_sz) ||
24112424
!is_power_of_2(m.tx_pg_sz))
24122425
return -EINVAL; /* not power of 2 */
@@ -2440,6 +2453,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)
24402453
return -EIO; /* need the memory controllers */
24412454
if (copy_from_user(&t, useraddr, sizeof(t)))
24422455
return -EFAULT;
2456+
if (t.cmd != CHELSIO_GET_MEM)
2457+
return -EINVAL;
24432458
if ((t.addr & 7) || (t.len & 7))
24442459
return -EINVAL;
24452460
if (t.mem_id == MEM_CM)
@@ -2492,6 +2507,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)
24922507
return -EAGAIN;
24932508
if (copy_from_user(&t, useraddr, sizeof(t)))
24942509
return -EFAULT;
2510+
if (t.cmd != CHELSIO_SET_TRACE_FILTER)
2511+
return -EINVAL;
24952512

24962513
tp = (const struct trace_params *)&t.sip;
24972514
if (t.config_tx)

drivers/net/ethernet/emulex/benet/be_main.c

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4002,8 +4002,6 @@ static int be_enable_vxlan_offloads(struct be_adapter *adapter)
40024002
netdev->hw_enc_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
40034003
NETIF_F_TSO | NETIF_F_TSO6 |
40044004
NETIF_F_GSO_UDP_TUNNEL;
4005-
netdev->hw_features |= NETIF_F_GSO_UDP_TUNNEL;
4006-
netdev->features |= NETIF_F_GSO_UDP_TUNNEL;
40074005

40084006
dev_info(dev, "Enabled VxLAN offloads for UDP port %d\n",
40094007
be16_to_cpu(port));
@@ -4025,8 +4023,6 @@ static void be_disable_vxlan_offloads(struct be_adapter *adapter)
40254023
adapter->vxlan_port = 0;
40264024

40274025
netdev->hw_enc_features = 0;
4028-
netdev->hw_features &= ~(NETIF_F_GSO_UDP_TUNNEL);
4029-
netdev->features &= ~(NETIF_F_GSO_UDP_TUNNEL);
40304026
}
40314027

40324028
static void be_calculate_vf_res(struct be_adapter *adapter, u16 num_vfs,
@@ -5320,6 +5316,7 @@ static void be_netdev_init(struct net_device *netdev)
53205316
struct be_adapter *adapter = netdev_priv(netdev);
53215317

53225318
netdev->hw_features |= NETIF_F_SG | NETIF_F_TSO | NETIF_F_TSO6 |
5319+
NETIF_F_GSO_UDP_TUNNEL |
53235320
NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | NETIF_F_RXCSUM |
53245321
NETIF_F_HW_VLAN_CTAG_TX;
53255322
if ((be_if_cap_flags(adapter) & BE_IF_FLAGS_RSS))

drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1725,7 +1725,7 @@ static void mvpp2_txq_desc_put(struct mvpp2_tx_queue *txq)
17251725
}
17261726

17271727
/* Set Tx descriptors fields relevant for CSUM calculation */
1728-
static u32 mvpp2_txq_desc_csum(int l3_offs, int l3_proto,
1728+
static u32 mvpp2_txq_desc_csum(int l3_offs, __be16 l3_proto,
17291729
int ip_hdr_len, int l4_proto)
17301730
{
17311731
u32 command;
@@ -2600,14 +2600,15 @@ static u32 mvpp2_skb_tx_csum(struct mvpp2_port *port, struct sk_buff *skb)
26002600
if (skb->ip_summed == CHECKSUM_PARTIAL) {
26012601
int ip_hdr_len = 0;
26022602
u8 l4_proto;
2603+
__be16 l3_proto = vlan_get_protocol(skb);
26032604

2604-
if (skb->protocol == htons(ETH_P_IP)) {
2605+
if (l3_proto == htons(ETH_P_IP)) {
26052606
struct iphdr *ip4h = ip_hdr(skb);
26062607

26072608
/* Calculate IPv4 checksum and L4 checksum */
26082609
ip_hdr_len = ip4h->ihl;
26092610
l4_proto = ip4h->protocol;
2610-
} else if (skb->protocol == htons(ETH_P_IPV6)) {
2611+
} else if (l3_proto == htons(ETH_P_IPV6)) {
26112612
struct ipv6hdr *ip6h = ipv6_hdr(skb);
26122613

26132614
/* Read l4_protocol from one of IPv6 extra headers */
@@ -2619,7 +2620,7 @@ static u32 mvpp2_skb_tx_csum(struct mvpp2_port *port, struct sk_buff *skb)
26192620
}
26202621

26212622
return mvpp2_txq_desc_csum(skb_network_offset(skb),
2622-
skb->protocol, ip_hdr_len, l4_proto);
2623+
l3_proto, ip_hdr_len, l4_proto);
26232624
}
26242625

26252626
return MVPP2_TXD_L4_CSUM_NOT | MVPP2_TXD_IP_CSUM_DISABLE;

drivers/net/ethernet/mellanox/mlxsw/pci.c

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -718,14 +718,17 @@ static void mlxsw_pci_eq_tasklet(unsigned long data)
718718
memset(&active_cqns, 0, sizeof(active_cqns));
719719

720720
while ((eqe = mlxsw_pci_eq_sw_eqe_get(q))) {
721-
u8 event_type = mlxsw_pci_eqe_event_type_get(eqe);
722721

723-
switch (event_type) {
724-
case MLXSW_PCI_EQE_EVENT_TYPE_CMD:
722+
/* Command interface completion events are always received on
723+
* queue MLXSW_PCI_EQ_ASYNC_NUM (EQ0) and completion events
724+
* are mapped to queue MLXSW_PCI_EQ_COMP_NUM (EQ1).
725+
*/
726+
switch (q->num) {
727+
case MLXSW_PCI_EQ_ASYNC_NUM:
725728
mlxsw_pci_eq_cmd_event(mlxsw_pci, eqe);
726729
q->u.eq.ev_cmd_count++;
727730
break;
728-
case MLXSW_PCI_EQE_EVENT_TYPE_COMP:
731+
case MLXSW_PCI_EQ_COMP_NUM:
729732
cqn = mlxsw_pci_eqe_cqn_get(eqe);
730733
set_bit(cqn, active_cqns);
731734
cq_handle = true;

drivers/net/ethernet/mellanox/mlxsw/spectrum.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4845,6 +4845,8 @@ static int mlxsw_sp_netdevice_bridge_event(struct net_device *br_dev,
48454845
upper_dev = info->upper_dev;
48464846
if (info->linking)
48474847
break;
4848+
if (is_vlan_dev(upper_dev))
4849+
mlxsw_sp_rif_destroy_by_dev(mlxsw_sp, upper_dev);
48484850
if (netif_is_macvlan(upper_dev))
48494851
mlxsw_sp_rif_macvlan_del(mlxsw_sp, upper_dev);
48504852
break;

drivers/net/hamradio/yam.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -966,6 +966,8 @@ static int yam_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
966966
sizeof(struct yamdrv_ioctl_mcs));
967967
if (IS_ERR(ym))
968968
return PTR_ERR(ym);
969+
if (ym->cmd != SIOCYAMSMCS)
970+
return -EINVAL;
969971
if (ym->bitrate > YAM_MAXBITRATE) {
970972
kfree(ym);
971973
return -EINVAL;
@@ -981,6 +983,8 @@ static int yam_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
981983
if (copy_from_user(&yi, ifr->ifr_data, sizeof(struct yamdrv_ioctl_cfg)))
982984
return -EFAULT;
983985

986+
if (yi.cmd != SIOCYAMSCFG)
987+
return -EINVAL;
984988
if ((yi.cfg.mask & YAM_IOBASE) && netif_running(dev))
985989
return -EINVAL; /* Cannot change this parameter when up */
986990
if ((yi.cfg.mask & YAM_IRQ) && netif_running(dev))

drivers/net/phy/phylink.c

Lines changed: 28 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -717,6 +717,30 @@ static int phylink_bringup_phy(struct phylink *pl, struct phy_device *phy)
717717
return 0;
718718
}
719719

720+
static int __phylink_connect_phy(struct phylink *pl, struct phy_device *phy,
721+
phy_interface_t interface)
722+
{
723+
int ret;
724+
725+
if (WARN_ON(pl->link_an_mode == MLO_AN_FIXED ||
726+
(pl->link_an_mode == MLO_AN_INBAND &&
727+
phy_interface_mode_is_8023z(interface))))
728+
return -EINVAL;
729+
730+
if (pl->phydev)
731+
return -EBUSY;
732+
733+
ret = phy_attach_direct(pl->netdev, phy, 0, interface);
734+
if (ret)
735+
return ret;
736+
737+
ret = phylink_bringup_phy(pl, phy);
738+
if (ret)
739+
phy_detach(phy);
740+
741+
return ret;
742+
}
743+
720744
/**
721745
* phylink_connect_phy() - connect a PHY to the phylink instance
722746
* @pl: a pointer to a &struct phylink returned from phylink_create()
@@ -734,31 +758,13 @@ static int phylink_bringup_phy(struct phylink *pl, struct phy_device *phy)
734758
*/
735759
int phylink_connect_phy(struct phylink *pl, struct phy_device *phy)
736760
{
737-
int ret;
738-
739-
if (WARN_ON(pl->link_an_mode == MLO_AN_FIXED ||
740-
(pl->link_an_mode == MLO_AN_INBAND &&
741-
phy_interface_mode_is_8023z(pl->link_interface))))
742-
return -EINVAL;
743-
744-
if (pl->phydev)
745-
return -EBUSY;
746-
747761
/* Use PHY device/driver interface */
748762
if (pl->link_interface == PHY_INTERFACE_MODE_NA) {
749763
pl->link_interface = phy->interface;
750764
pl->link_config.interface = pl->link_interface;
751765
}
752766

753-
ret = phy_attach_direct(pl->netdev, phy, 0, pl->link_interface);
754-
if (ret)
755-
return ret;
756-
757-
ret = phylink_bringup_phy(pl, phy);
758-
if (ret)
759-
phy_detach(phy);
760-
761-
return ret;
767+
return __phylink_connect_phy(pl, phy, pl->link_interface);
762768
}
763769
EXPORT_SYMBOL_GPL(phylink_connect_phy);
764770

@@ -1672,7 +1678,9 @@ static void phylink_sfp_link_up(void *upstream)
16721678

16731679
static int phylink_sfp_connect_phy(void *upstream, struct phy_device *phy)
16741680
{
1675-
return phylink_connect_phy(upstream, phy);
1681+
struct phylink *pl = upstream;
1682+
1683+
return __phylink_connect_phy(upstream, phy, pl->link_config.interface);
16761684
}
16771685

16781686
static void phylink_sfp_disconnect_phy(void *upstream)

drivers/net/team/team.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1167,6 +1167,12 @@ static int team_port_add(struct team *team, struct net_device *port_dev,
11671167
return -EBUSY;
11681168
}
11691169

1170+
if (dev == port_dev) {
1171+
NL_SET_ERR_MSG(extack, "Cannot enslave team device to itself");
1172+
netdev_err(dev, "Cannot enslave team device to itself\n");
1173+
return -EINVAL;
1174+
}
1175+
11701176
if (port_dev->features & NETIF_F_VLAN_CHALLENGED &&
11711177
vlan_uses_dev(dev)) {
11721178
NL_SET_ERR_MSG(extack, "Device is VLAN challenged and team device has VLAN set up");

drivers/net/usb/smsc75xx.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1520,6 +1520,7 @@ static void smsc75xx_unbind(struct usbnet *dev, struct usb_interface *intf)
15201520
{
15211521
struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0]);
15221522
if (pdata) {
1523+
cancel_work_sync(&pdata->set_multicast);
15231524
netif_dbg(dev, ifdown, dev->net, "free pdata\n");
15241525
kfree(pdata);
15251526
pdata = NULL;

include/linux/virtio_net.h

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,24 @@
55
#include <linux/if_vlan.h>
66
#include <uapi/linux/virtio_net.h>
77

8+
static inline int virtio_net_hdr_set_proto(struct sk_buff *skb,
9+
const struct virtio_net_hdr *hdr)
10+
{
11+
switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
12+
case VIRTIO_NET_HDR_GSO_TCPV4:
13+
case VIRTIO_NET_HDR_GSO_UDP:
14+
skb->protocol = cpu_to_be16(ETH_P_IP);
15+
break;
16+
case VIRTIO_NET_HDR_GSO_TCPV6:
17+
skb->protocol = cpu_to_be16(ETH_P_IPV6);
18+
break;
19+
default:
20+
return -EINVAL;
21+
}
22+
23+
return 0;
24+
}
25+
826
static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
927
const struct virtio_net_hdr *hdr,
1028
bool little_endian)

0 commit comments

Comments
 (0)