Commit 4ff71af0 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'net-6.17-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 

Pull networking fixes from Paolo Abeni:
 "Including fixes from Bluetooth, IPsec and CAN.

  No known regressions at this point.

  Current release - regressions:

   - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI

  Previous releases - regressions:

   - xfrm: fix offloading of cross-family tunnels

   - bluetooth: fix several races leading to UaFs

   - dsa: lantiq_gswip: fix FDB entries creation for the CPU port

   - eth:
       - tun: update napi->skb after XDP process
       - mlx: fix UAF in flow counter release

  Previous releases - always broken:

   - core: forbid FDB status change while nexthop is in a group

   - smc: fix warning in smc_rx_splice() when calling get_page()

   - can: provide missing ndo_change_mtu(), to prevent buffer overflow.

   - eth:
       - i40e: fix VF config validation
       - broadcom: fix support for PTP_EXTTS_REQUEST2 ioctl"

* tag 'net-6.17-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (40 commits)
  octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()
  net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port
  net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup()
  libie: fix string names for AQ error codes
  net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD
  net/mlx5: HWS, ignore flow level for multi-dest table
  net/mlx5: fs, fix UAF in flow counter release
  selftests: fib_nexthops: Add test cases for FDB status change
  selftests: fib_nexthops: Fix creation of non-FDB nexthops
  nexthop: Forbid FDB status change while nexthop is in a group
  net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS
  bnxt_en: correct offset handling for IPv6 destination address
  ptp: document behavior of PTP_STRICT_FLAGS
  broadcom: fix support for PTP_EXTTS_REQUEST2 ioctl
  broadcom: fix support for PTP_PEROUT_DUTY_CYCLE
  Bluetooth: MGMT: Fix possible UAFs
  Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
  Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue
  Bluetooth: hci_sync: Fix hci_resume_advertising_sync
  Bluetooth: Fix build after header cleanup
  ...
parents 93a27445 d9c70e93

drivers/bluetooth/Kconfig

+6 −0
Original line number Diff line number Diff line
@@ -312,7 +312,9 @@ config BT_HCIBCM4377 


config BT_HCIBPA10X

	tristate "HCI BPA10x USB driver"

	depends on BT_HCIUART

	depends on USB

	select BT_HCIUART_H4

	help

	  Bluetooth HCI BPA10x USB driver.

	  This driver provides support for the Digianswer BPA 100/105 Bluetooth
@@ -437,8 +439,10 @@ config BT_MTKSDIO 


config BT_MTKUART

	tristate "MediaTek HCI UART driver"

	depends on BT_HCIUART

	depends on SERIAL_DEV_BUS

	depends on USB || !BT_HCIBTUSB_MTK

	select BT_HCIUART_H4

	select BT_MTK

	help

	  MediaTek Bluetooth HCI UART driver.
@@ -483,7 +487,9 @@ config BT_VIRTIO 


config BT_NXPUART

	tristate "NXP protocol support"

	depends on BT_HCIUART

	depends on SERIAL_DEV_BUS

	select BT_HCIUART_H4

	select CRC32

	select CRC8

	help

drivers/bluetooth/hci_uart.h

+4 −4
Original line number Diff line number Diff line
@@ -121,10 +121,6 @@ void hci_uart_set_flow_control(struct hci_uart *hu, bool enable); 
void hci_uart_set_speeds(struct hci_uart *hu, unsigned int init_speed,

			 unsigned int oper_speed);



#ifdef CONFIG_BT_HCIUART_H4

int h4_init(void);

int h4_deinit(void);



struct h4_recv_pkt {

	u8  type;	/* Packet type */

	u8  hlen;	/* Header length */
@@ -162,6 +158,10 @@ struct h4_recv_pkt { 
	.lsize = 2, \

	.maxlen = HCI_MAX_FRAME_SIZE \



#ifdef CONFIG_BT_HCIUART_H4

int h4_init(void);

int h4_deinit(void);



struct sk_buff *h4_recv_buf(struct hci_dev *hdev, struct sk_buff *skb,

			    const unsigned char *buffer, int count,

			    const struct h4_recv_pkt *pkts, int pkts_count);

drivers/net/can/rcar/rcar_canfd.c

+4 −3
Original line number Diff line number Diff line
@@ -823,9 +823,6 @@ static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv) 
	/* Reset Global error flags */

	rcar_canfd_write(gpriv->base, RCANFD_GERFL, 0x0);



	/* Set the controller into appropriate mode */

	rcar_canfd_set_mode(gpriv);



	/* Transition all Channels to reset mode */

	for_each_set_bit(ch, &gpriv->channels_mask, gpriv->info->max_channels) {

		rcar_canfd_clear_bit(gpriv->base,
@@ -844,6 +841,10 @@ static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv) 
			return err;

		}

	}



	/* Set the controller into appropriate mode */

	rcar_canfd_set_mode(gpriv);



	return 0;

}

drivers/net/can/spi/hi311x.c

+18 −16
Original line number Diff line number Diff line
@@ -545,8 +545,6 @@ static int hi3110_stop(struct net_device *net) 


	priv->force_quit = 1;

	free_irq(spi->irq, priv);

	destroy_workqueue(priv->wq);

	priv->wq = NULL;



	mutex_lock(&priv->hi3110_lock);
@@ -770,34 +768,23 @@ static int hi3110_open(struct net_device *net) 
		goto out_close;

	}



	priv->wq = alloc_workqueue("hi3110_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM,

				   0);

	if (!priv->wq) {

		ret = -ENOMEM;

		goto out_free_irq;

	}

	INIT_WORK(&priv->tx_work, hi3110_tx_work_handler);

	INIT_WORK(&priv->restart_work, hi3110_restart_work_handler);



	ret = hi3110_hw_reset(spi);

	if (ret)

		goto out_free_wq;

		goto out_free_irq;



	ret = hi3110_setup(net);

	if (ret)

		goto out_free_wq;

		goto out_free_irq;



	ret = hi3110_set_normal_mode(spi);

	if (ret)

		goto out_free_wq;

		goto out_free_irq;



	netif_wake_queue(net);

	mutex_unlock(&priv->hi3110_lock);



	return 0;



 out_free_wq:

	destroy_workqueue(priv->wq);

 out_free_irq:

	free_irq(spi->irq, priv);

	hi3110_hw_sleep(spi);
@@ -812,6 +799,7 @@ static const struct net_device_ops hi3110_netdev_ops = { 
	.ndo_open = hi3110_open,

	.ndo_stop = hi3110_stop,

	.ndo_start_xmit = hi3110_hard_start_xmit,

	.ndo_change_mtu = can_change_mtu,

};



static const struct ethtool_ops hi3110_ethtool_ops = {
@@ -908,6 +896,15 @@ static int hi3110_can_probe(struct spi_device *spi) 
	if (ret)

		goto out_clk;



	priv->wq = alloc_workqueue("hi3110_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM,

				   0);

	if (!priv->wq) {

		ret = -ENOMEM;

		goto out_clk;

	}

	INIT_WORK(&priv->tx_work, hi3110_tx_work_handler);

	INIT_WORK(&priv->restart_work, hi3110_restart_work_handler);



	priv->spi = spi;

	mutex_init(&priv->hi3110_lock);
@@ -943,6 +940,8 @@ static int hi3110_can_probe(struct spi_device *spi) 
	return 0;



 error_probe:

	destroy_workqueue(priv->wq);

	priv->wq = NULL;

	hi3110_power_enable(priv->power, 0);



 out_clk:
@@ -963,6 +962,9 @@ static void hi3110_can_remove(struct spi_device *spi) 


	hi3110_power_enable(priv->power, 0);



	destroy_workqueue(priv->wq);

	priv->wq = NULL;



	clk_disable_unprepare(priv->clk);



	free_candev(net);

drivers/net/can/sun4i_can.c

+1 −0
Original line number Diff line number Diff line
@@ -768,6 +768,7 @@ static const struct net_device_ops sun4ican_netdev_ops = { 
	.ndo_open = sun4ican_open,

	.ndo_stop = sun4ican_close,

	.ndo_start_xmit = sun4ican_start_xmit,

	.ndo_change_mtu = can_change_mtu,

};



static const struct ethtool_ops sun4ican_ethtool_ops = {