Skip to content

Commit c5dfd65

Browse files
torvaldstorvalds
committed
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking fixes from David Miller: 1) Don't use shared bluetooth antenna in iwlwifi driver for management frames, from Emmanuel Grumbach. 2) Fix device ID check in ath9k driver, from Felix Fietkau. 3) Off by one in xen-netback BUG checks, from Dan Carpenter. 4) Fix IFLA_VF_PORT netlink attribute validation, from Daniel Borkmann. 5) Fix races in setting peeked bit flag in SKBs during datagram receive. If it's shared we have to clone it otherwise the value can easily be corrupted. Fix from Herbert Xu. 6) Revert fec clock handling change, causes regressions. From Fabio Estevam. 7) Fix use after free in fq_codel and sfq packet schedulers, from WANG Cong. 8) ipvlan bug fixes (memory leaks, missing rcu_dereference_bh, etc.) from WANG Cong and Konstantin Khlebnikov. 9) Memory leak in act_bpf packet action, from Alexei Starovoitov. 10) ARM bpf JIT bug fixes from Nicolas Schichan. 11) Fix backwards compat of ANY_LAYOUT in virtio_net driver, from Michael S Tsirkin. 12) Destruction of bond with different ARP header types not handled correctly, fix from Nikolay Aleksandrov. 13) Revert GRO receive support in ipv6 SIT tunnel driver, causes regressions because the GRO packets created cannot be processed properly on the GSO side if we forward the frame. From Herbert Xu. 14) TCCR update race and other fixes to ravb driver from Sergei Shtylyov. 15) Fix SKB leaks in caif_queue_rcv_skb(), from Eric Dumazet. 16) Fix panics on packet scheduler filter replace, from Daniel Borkmann. 17) Make sure AF_PACKET sees properly IP headers in defragmented frames (via PACKET_FANOUT_FLAG_DEFRAG option), from Edward Hyunkoo Jee. 18) AF_NETLINK cannot hold mutex in RCU callback, fix from Florian Westphal. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (84 commits) ravb: fix ring memory allocation net: phy: dp83867: Fix warning check for setting the internal delay openvswitch: allocate nr_node_ids flow_stats instead of num_possible_nodes netlink: don't hold mutex in rcu callback when releasing mmapd ring ARM: net: fix vlan access instructions in ARM JIT. ARM: net: handle negative offsets in BPF JIT. ARM: net: fix condition for load_order > 0 when translating load instructions. tcp: suppress a division by zero warning drivers: net: cpsw: remove tx event processing in rx napi poll inet: frags: fix defragmented packet's IP header for af_packet net: mvneta: fix refilling for Rx DMA buffers stmmac: fix setting of driver data in stmmac_dvr_probe sched: cls_flow: fix panic on filter replace sched: cls_flower: fix panic on filter replace sched: cls_bpf: fix panic on filter replace net/mdio: fix mdio_bus_match for c45 PHY net: ratelimit warnings about dst entry refcount underflow or overflow caif: fix leaks and race in caif_queue_rcv_skb() qmi_wwan: add the second QMI/network interface for Sierra Wireless MC7305/MC7355 ravb: fix race updating TCCR ...
2 parents 5a5ca73 + d8b4891 commit c5dfd65

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

79 files changed

+714
-811
lines changed

‎arch/arm/net/bpf_jit_32.c

Lines changed: 44 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -74,32 +74,52 @@ struct jit_ctx {
7474

7575
int bpf_jit_enable __read_mostly;
7676

77-
static u64 jit_get_skb_b(struct sk_buff *skb, unsigned offset)
77+
static inline int call_neg_helper(struct sk_buff *skb, int offset, void *ret,
78+
unsigned int size)
79+
{
80+
void *ptr = bpf_internal_load_pointer_neg_helper(skb, offset, size);
81+
82+
if (!ptr)
83+
return -EFAULT;
84+
memcpy(ret, ptr, size);
85+
return 0;
86+
}
87+
88+
static u64 jit_get_skb_b(struct sk_buff *skb, int offset)
7889
{
7990
u8 ret;
8091
int err;
8192

82-
err = skb_copy_bits(skb, offset, &ret, 1);
93+
if (offset < 0)
94+
err = call_neg_helper(skb, offset, &ret, 1);
95+
else
96+
err = skb_copy_bits(skb, offset, &ret, 1);
8397

8498
return (u64)err << 32 | ret;
8599
}
86100

87-
static u64 jit_get_skb_h(struct sk_buff *skb, unsigned offset)
101+
static u64 jit_get_skb_h(struct sk_buff *skb, int offset)
88102
{
89103
u16 ret;
90104
int err;
91105

92-
err = skb_copy_bits(skb, offset, &ret, 2);
106+
if (offset < 0)
107+
err = call_neg_helper(skb, offset, &ret, 2);
108+
else
109+
err = skb_copy_bits(skb, offset, &ret, 2);
93110

94111
return (u64)err << 32 | ntohs(ret);
95112
}
96113

97-
static u64 jit_get_skb_w(struct sk_buff *skb, unsigned offset)
114+
static u64 jit_get_skb_w(struct sk_buff *skb, int offset)
98115
{
99116
u32 ret;
100117
int err;
101118

102-
err = skb_copy_bits(skb, offset, &ret, 4);
119+
if (offset < 0)
120+
err = call_neg_helper(skb, offset, &ret, 4);
121+
else
122+
err = skb_copy_bits(skb, offset, &ret, 4);
103123

104124
return (u64)err << 32 | ntohl(ret);
105125
}
@@ -536,9 +556,6 @@ static int build_body(struct jit_ctx *ctx)
536556
case BPF_LD | BPF_B | BPF_ABS:
537557
load_order = 0;
538558
load:
539-
/* the interpreter will deal with the negative K */
540-
if ((int)k < 0)
541-
return -ENOTSUPP;
542559
emit_mov_i(r_off, k, ctx);
543560
load_common:
544561
ctx->seen |= SEEN_DATA | SEEN_CALL;
@@ -547,12 +564,24 @@ static int build_body(struct jit_ctx *ctx)
547564
emit(ARM_SUB_I(r_scratch, r_skb_hl,
548565
1 << load_order), ctx);
549566
emit(ARM_CMP_R(r_scratch, r_off), ctx);
550-
condt = ARM_COND_HS;
567+
condt = ARM_COND_GE;
551568
} else {
552569
emit(ARM_CMP_R(r_skb_hl, r_off), ctx);
553570
condt = ARM_COND_HI;
554571
}
555572

573+
/*
574+
* test for negative offset, only if we are
575+
* currently scheduled to take the fast
576+
* path. this will update the flags so that
577+
* the slowpath instruction are ignored if the
578+
* offset is negative.
579+
*
580+
* for loard_order == 0 the HI condition will
581+
* make loads at offset 0 take the slow path too.
582+
*/
583+
_emit(condt, ARM_CMP_I(r_off, 0), ctx);
584+
556585
_emit(condt, ARM_ADD_R(r_scratch, r_off, r_skb_data),
557586
ctx);
558587

@@ -860,9 +889,11 @@ static int build_body(struct jit_ctx *ctx)
860889
off = offsetof(struct sk_buff, vlan_tci);
861890
emit(ARM_LDRH_I(r_A, r_skb, off), ctx);
862891
if (code == (BPF_ANC | SKF_AD_VLAN_TAG))
863-
OP_IMM3(ARM_AND, r_A, r_A, VLAN_VID_MASK, ctx);
864-
else
865-
OP_IMM3(ARM_AND, r_A, r_A, VLAN_TAG_PRESENT, ctx);
892+
OP_IMM3(ARM_AND, r_A, r_A, ~VLAN_TAG_PRESENT, ctx);
893+
else {
894+
OP_IMM3(ARM_LSR, r_A, r_A, 12, ctx);
895+
OP_IMM3(ARM_AND, r_A, r_A, 0x1, ctx);
896+
}
866897
break;
867898
case BPF_ANC | SKF_AD_QUEUE:
868899
ctx->seen |= SEEN_SKB;

‎drivers/bluetooth/btbcm.c

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -472,12 +472,11 @@ int btbcm_setup_apple(struct hci_dev *hdev)
472472

473473
/* Read Verbose Config Version Info */
474474
skb = btbcm_read_verbose_config(hdev);
475-
if (IS_ERR(skb))
476-
return PTR_ERR(skb);
477-
478-
BT_INFO("%s: BCM: chip id %u build %4.4u", hdev->name, skb->data[1],
479-
get_unaligned_le16(skb->data + 5));
480-
kfree_skb(skb);
475+
if (!IS_ERR(skb)) {
476+
BT_INFO("%s: BCM: chip id %u build %4.4u", hdev->name, skb->data[1],
477+
get_unaligned_le16(skb->data + 5));
478+
kfree_skb(skb);
479+
}
481480

482481
set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
483482

‎drivers/isdn/gigaset/ser-gigaset.c

Lines changed: 10 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -524,9 +524,18 @@ gigaset_tty_open(struct tty_struct *tty)
524524
cs->hw.ser->tty = tty;
525525
atomic_set(&cs->hw.ser->refcnt, 1);
526526
init_completion(&cs->hw.ser->dead_cmp);
527-
528527
tty->disc_data = cs;
529528

529+
/* Set the amount of data we're willing to receive per call
530+
* from the hardware driver to half of the input buffer size
531+
* to leave some reserve.
532+
* Note: We don't do flow control towards the hardware driver.
533+
* If more data is received than will fit into the input buffer,
534+
* it will be dropped and an error will be logged. This should
535+
* never happen as the device is slow and the buffer size ample.
536+
*/
537+
tty->receive_room = RBUFSIZE/2;
538+
530539
/* OK.. Initialization of the datastructures and the HW is done.. Now
531540
* startup system and notify the LL that we are ready to run
532541
*/
@@ -597,28 +606,6 @@ static int gigaset_tty_hangup(struct tty_struct *tty)
597606
return 0;
598607
}
599608

600-
/*
601-
* Read on the tty.
602-
* Unused, received data goes only to the Gigaset driver.
603-
*/
604-
static ssize_t
605-
gigaset_tty_read(struct tty_struct *tty, struct file *file,
606-
unsigned char __user *buf, size_t count)
607-
{
608-
return -EAGAIN;
609-
}
610-
611-
/*
612-
* Write on the tty.
613-
* Unused, transmit data comes only from the Gigaset driver.
614-
*/
615-
static ssize_t
616-
gigaset_tty_write(struct tty_struct *tty, struct file *file,
617-
const unsigned char *buf, size_t count)
618-
{
619-
return -EAGAIN;
620-
}
621-
622609
/*
623610
* Ioctl on the tty.
624611
* Called in process context only.
@@ -752,8 +739,6 @@ static struct tty_ldisc_ops gigaset_ldisc = {
752739
.open = gigaset_tty_open,
753740
.close = gigaset_tty_close,
754741
.hangup = gigaset_tty_hangup,
755-
.read = gigaset_tty_read,
756-
.write = gigaset_tty_write,
757742
.ioctl = gigaset_tty_ioctl,
758743
.receive_buf = gigaset_tty_receive,
759744
.write_wakeup = gigaset_tty_wakeup,

‎drivers/net/bonding/bond_main.c

Lines changed: 31 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -625,6 +625,23 @@ static void bond_set_dev_addr(struct net_device *bond_dev,
625625
call_netdevice_notifiers(NETDEV_CHANGEADDR, bond_dev);
626626
}
627627

628+
static struct slave *bond_get_old_active(struct bonding *bond,
629+
struct slave *new_active)
630+
{
631+
struct slave *slave;
632+
struct list_head *iter;
633+
634+
bond_for_each_slave(bond, slave, iter) {
635+
if (slave == new_active)
636+
continue;
637+
638+
if (ether_addr_equal(bond->dev->dev_addr, slave->dev->dev_addr))
639+
return slave;
640+
}
641+
642+
return NULL;
643+
}
644+
628645
/* bond_do_fail_over_mac
629646
*
630647
* Perform special MAC address swapping for fail_over_mac settings
@@ -652,6 +669,9 @@ static void bond_do_fail_over_mac(struct bonding *bond,
652669
if (!new_active)
653670
return;
654671

672+
if (!old_active)
673+
old_active = bond_get_old_active(bond, new_active);
674+
655675
if (old_active) {
656676
ether_addr_copy(tmp_mac, new_active->dev->dev_addr);
657677
ether_addr_copy(saddr.sa_data,
@@ -1725,9 +1745,16 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
17251745

17261746
err_undo_flags:
17271747
/* Enslave of first slave has failed and we need to fix master's mac */
1728-
if (!bond_has_slaves(bond) &&
1729-
ether_addr_equal_64bits(bond_dev->dev_addr, slave_dev->dev_addr))
1730-
eth_hw_addr_random(bond_dev);
1748+
if (!bond_has_slaves(bond)) {
1749+
if (ether_addr_equal_64bits(bond_dev->dev_addr,
1750+
slave_dev->dev_addr))
1751+
eth_hw_addr_random(bond_dev);
1752+
if (bond_dev->type != ARPHRD_ETHER) {
1753+
ether_setup(bond_dev);
1754+
bond_dev->flags |= IFF_MASTER;
1755+
bond_dev->priv_flags &= ~IFF_TX_SKB_SHARING;
1756+
}
1757+
}
17311758

17321759
return res;
17331760
}
@@ -1916,6 +1943,7 @@ static int bond_release_and_destroy(struct net_device *bond_dev,
19161943
bond_dev->priv_flags |= IFF_DISABLE_NETPOLL;
19171944
netdev_info(bond_dev, "Destroying bond %s\n",
19181945
bond_dev->name);
1946+
bond_remove_proc_entry(bond);
19191947
unregister_netdevice(bond_dev);
19201948
}
19211949
return ret;

‎drivers/net/can/at91_can.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -577,10 +577,10 @@ static void at91_rx_overflow_err(struct net_device *dev)
577577

578578
cf->can_id |= CAN_ERR_CRTL;
579579
cf->data[1] = CAN_ERR_CRTL_RX_OVERFLOW;
580-
netif_receive_skb(skb);
581580

582581
stats->rx_packets++;
583582
stats->rx_bytes += cf->can_dlc;
583+
netif_receive_skb(skb);
584584
}
585585

586586
/**
@@ -642,10 +642,10 @@ static void at91_read_msg(struct net_device *dev, unsigned int mb)
642642
}
643643

644644
at91_read_mb(dev, mb, cf);
645-
netif_receive_skb(skb);
646645

647646
stats->rx_packets++;
648647
stats->rx_bytes += cf->can_dlc;
648+
netif_receive_skb(skb);
649649

650650
can_led_event(dev, CAN_LED_EVENT_RX);
651651
}
@@ -802,10 +802,10 @@ static int at91_poll_err(struct net_device *dev, int quota, u32 reg_sr)
802802
return 0;
803803

804804
at91_poll_err_frame(dev, cf, reg_sr);
805-
netif_receive_skb(skb);
806805

807806
dev->stats.rx_packets++;
808807
dev->stats.rx_bytes += cf->can_dlc;
808+
netif_receive_skb(skb);
809809

810810
return 1;
811811
}
@@ -1067,10 +1067,10 @@ static void at91_irq_err(struct net_device *dev)
10671067
return;
10681068

10691069
at91_irq_err_state(dev, cf, new_state);
1070-
netif_rx(skb);
10711070

10721071
dev->stats.rx_packets++;
10731072
dev->stats.rx_bytes += cf->can_dlc;
1073+
netif_rx(skb);
10741074

10751075
priv->can.state = new_state;
10761076
}

‎drivers/net/can/bfin_can.c

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -424,10 +424,9 @@ static void bfin_can_rx(struct net_device *dev, u16 isrc)
424424
cf->data[6 - i] = (6 - i) < cf->can_dlc ? (val >> 8) : 0;
425425
}
426426

427-
netif_rx(skb);
428-
429427
stats->rx_packets++;
430428
stats->rx_bytes += cf->can_dlc;
429+
netif_rx(skb);
431430
}
432431

433432
static int bfin_can_err(struct net_device *dev, u16 isrc, u16 status)
@@ -508,10 +507,9 @@ static int bfin_can_err(struct net_device *dev, u16 isrc, u16 status)
508507

509508
priv->can.state = state;
510509

511-
netif_rx(skb);
512-
513510
stats->rx_packets++;
514511
stats->rx_bytes += cf->can_dlc;
512+
netif_rx(skb);
515513

516514
return 0;
517515
}

‎drivers/net/can/cc770/cc770.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -504,10 +504,10 @@ static void cc770_rx(struct net_device *dev, unsigned int mo, u8 ctrl1)
504504
for (i = 0; i < cf->can_dlc; i++)
505505
cf->data[i] = cc770_read_reg(priv, msgobj[mo].data[i]);
506506
}
507-
netif_rx(skb);
508507

509508
stats->rx_packets++;
510509
stats->rx_bytes += cf->can_dlc;
510+
netif_rx(skb);
511511
}
512512

513513
static int cc770_err(struct net_device *dev, u8 status)
@@ -584,10 +584,10 @@ static int cc770_err(struct net_device *dev, u8 status)
584584
}
585585
}
586586

587-
netif_rx(skb);
588587

589588
stats->rx_packets++;
590589
stats->rx_bytes += cf->can_dlc;
590+
netif_rx(skb);
591591

592592
return 0;
593593
}

‎drivers/net/can/flexcan.c

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -577,10 +577,10 @@ static int flexcan_poll_bus_err(struct net_device *dev, u32 reg_esr)
577577
return 0;
578578

579579
do_bus_err(dev, cf, reg_esr);
580-
netif_receive_skb(skb);
581580

582581
dev->stats.rx_packets++;
583582
dev->stats.rx_bytes += cf->can_dlc;
583+
netif_receive_skb(skb);
584584

585585
return 1;
586586
}
@@ -622,10 +622,9 @@ static int flexcan_poll_state(struct net_device *dev, u32 reg_esr)
622622
if (unlikely(new_state == CAN_STATE_BUS_OFF))
623623
can_bus_off(dev);
624624

625-
netif_receive_skb(skb);
626-
627625
dev->stats.rx_packets++;
628626
dev->stats.rx_bytes += cf->can_dlc;
627+
netif_receive_skb(skb);
629628

630629
return 1;
631630
}
@@ -670,10 +669,10 @@ static int flexcan_read_frame(struct net_device *dev)
670669
}
671670

672671
flexcan_read_fifo(dev, cf);
673-
netif_receive_skb(skb);
674672

675673
stats->rx_packets++;
676674
stats->rx_bytes += cf->can_dlc;
675+
netif_receive_skb(skb);
677676

678677
can_led_event(dev, CAN_LED_EVENT_RX);
679678

‎drivers/net/can/grcan.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1216,11 +1216,12 @@ static int grcan_receive(struct net_device *dev, int budget)
12161216
cf->data[i] = (u8)(slot[j] >> shift);
12171217
}
12181218
}
1219-
netif_receive_skb(skb);
12201219

12211220
/* Update statistics and read pointer */
12221221
stats->rx_packets++;
12231222
stats->rx_bytes += cf->can_dlc;
1223+
netif_receive_skb(skb);
1224+
12241225
rd = grcan_ring_add(rd, GRCAN_MSG_SIZE, dma->rx.size);
12251226
}
12261227

0 commit comments

Comments
 (0)