Commit 6832a931 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'net-6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 

Pull networking fixes from Jakub Kicinski:
 "Including fixes from Bluetooth, CAN, WiFi and Netfilter.

  More code here than I would have liked. That said, better now than
  next week. Nothing particularly scary stands out. The improvement to
  the OpenVPN input validation is a bit large but better get them in
  before the code makes it to a final release. Some of the changes we
  got from sub-trees could have been split better between the fix and
  -next refactoring, IMHO, that has been communicated.

  We have one known regression in a TI AM65 board not getting link. The
  investigation is going a bit slow, a number of people are on vacation.
  We'll try to wrap it up, but don't think it should hold up the
  release.

  Current release - fix to a fix:

   - Bluetooth: L2CAP: fix attempting to adjust outgoing MTU, it broke
     some headphones and speakers

  Current release - regressions:

   - wifi: ath12k: fix packets received in WBM error ring with REO LUT
     enabled, fix Rx performance regression

   - wifi: iwlwifi:
       - fix crash due to a botched indexing conversion
       - mask reserved bits in chan_state_active_bitmap, avoid FW assert()

  Current release - new code bugs:

   - nf_conntrack: fix crash due to removal of uninitialised entry

   - eth: airoha: fix potential UaF in airoha_npu_get()

  Previous releases - regressions:

   - net: fix segmentation after TCP/UDP fraglist GRO

   - af_packet: fix the SO_SNDTIMEO constraint not taking effect and a
     potential soft lockup waiting for a completion

   - rpl: fix UaF in rpl_do_srh_inline() for sneaky skb geometry

   - virtio-net: fix recursive rtnl_lock() during probe()

   - eth: stmmac: populate entire system_counterval_t in get_time_fn()

   - eth: libwx: fix a number of crashes in the driver Rx path

   - hv_netvsc: prevent IPv6 addrconf after IFF_SLAVE lost that meaning

  Previous releases - always broken:

   - mptcp: fix races in handling connection fallback to pure TCP

   - rxrpc: assorted error handling and race fixes

   - sched: another batch of "security" fixes for qdiscs (QFQ, HTB)

   - tls: always refresh the queue when reading sock, avoid UaF

   - phy: don't register LEDs for genphy, avoid deadlock

   - Bluetooth: btintel: check if controller is ISO capable on
     btintel_classify_pkt_type(), work around FW returning incorrect
     capabilities

  Misc:

   - make OpenVPN Netlink input checking more strict before it makes it
     to a final release

   - wifi: cfg80211: remove scan request n_channels __counted_by, it's
     only yielding false positives"

* tag 'net-6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (66 commits)
  rxrpc: Fix to use conn aborts for conn-wide failures
  rxrpc: Fix transmission of an abort in response to an abort
  rxrpc: Fix notification vs call-release vs recvmsg
  rxrpc: Fix recv-recv race of completed call
  rxrpc: Fix irq-disabled in local_bh_enable()
  selftests/tc-testing: Test htb_dequeue_tree with deactivation and row emptying
  net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
  net: bridge: Do not offload IGMP/MLD messages
  selftests: Add test cases for vlan_filter modification during runtime
  net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
  tls: always refresh the queue when reading sock
  virtio-net: fix recursived rtnl_lock() during probe()
  net/mlx5: Update the list of the PCI supported devices
  hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf
  phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()
  Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
  netfilter: nf_conntrack: fix crash due to removal of uninitialised entry
  net: fix segmentation after TCP/UDP fraglist GRO
  ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
  net: airoha: fix potential use-after-free in airoha_npu_get()
  ...
parents e6e82e5b a2bbaff6

Documentation/netlink/specs/ovpn.yaml

+147 −6
Original line number Diff line number Diff line
@@ -160,6 +160,66 @@ attribute-sets: 
        name: link-tx-packets

        type: uint

        doc: Number of packets transmitted at the transport level

  -

    name: peer-new-input

    subset-of: peer

    attributes:

      -

        name: id

      -

        name: remote-ipv4

      -

        name: remote-ipv6

      -

        name: remote-ipv6-scope-id

      -

        name: remote-port

      -

        name: socket

      -

        name: vpn-ipv4

      -

        name: vpn-ipv6

      -

        name: local-ipv4

      -

        name: local-ipv6

      -

        name: keepalive-interval

      -

        name: keepalive-timeout

  -

    name: peer-set-input

    subset-of: peer

    attributes:

      -

        name: id

      -

        name: remote-ipv4

      -

        name: remote-ipv6

      -

        name: remote-ipv6-scope-id

      -

        name: remote-port

      -

        name: vpn-ipv4

      -

        name: vpn-ipv6

      -

        name: local-ipv4

      -

        name: local-ipv6

      -

        name: keepalive-interval

      -

        name: keepalive-timeout

  -

    name: peer-del-input

    subset-of: peer

    attributes:

      -

        name: id

  -

    name: keyconf

    attributes:
@@ -216,6 +276,33 @@ attribute-sets: 
          obtain the actual cipher IV

        checks:

          exact-len: nonce-tail-size



  -

    name: keyconf-get

    subset-of: keyconf

    attributes:

      -

        name: peer-id

      -

        name: slot

      -

        name: key-id

      -

        name: cipher-alg

  -

    name: keyconf-swap-input

    subset-of: keyconf

    attributes:

      -

        name: peer-id

  -

    name: keyconf-del-input

    subset-of: keyconf

    attributes:

      -

        name: peer-id

      -

        name: slot

  -

    name: ovpn

    attributes:
@@ -235,12 +322,66 @@ attribute-sets: 
        type: nest

        doc: Peer specific cipher configuration

        nested-attributes: keyconf

  -

    name: ovpn-peer-new-input

    subset-of: ovpn

    attributes:

      -

        name: ifindex

      -

        name: peer

        nested-attributes: peer-new-input

  -

    name: ovpn-peer-set-input

    subset-of: ovpn

    attributes:

      -

        name: ifindex

      -

        name: peer

        nested-attributes: peer-set-input

  -

    name: ovpn-peer-del-input

    subset-of: ovpn

    attributes:

      -

        name: ifindex

      -

        name: peer

        nested-attributes: peer-del-input

  -

    name: ovpn-keyconf-get

    subset-of: ovpn

    attributes:

      -

        name: ifindex

      -

        name: keyconf

        nested-attributes: keyconf-get

  -

    name: ovpn-keyconf-swap-input

    subset-of: ovpn

    attributes:

      -

        name: ifindex

      -

        name: keyconf

        nested-attributes: keyconf-swap-input

  -

    name: ovpn-keyconf-del-input

    subset-of: ovpn

    attributes:

      -

        name: ifindex

      -

        name: keyconf

        nested-attributes: keyconf-del-input



operations:

  list:

    -

      name: peer-new

      attribute-set: ovpn

      attribute-set: ovpn-peer-new-input

      flags: [ admin-perm ]

      doc: Add a remote peer

      do:
@@ -252,7 +393,7 @@ operations: 
            - peer

    -

      name: peer-set

      attribute-set: ovpn

      attribute-set: ovpn-peer-set-input

      flags: [ admin-perm ]

      doc: modify a remote peer

      do:
@@ -286,7 +427,7 @@ operations: 
            - peer

    -

      name: peer-del

      attribute-set: ovpn

      attribute-set: ovpn-peer-del-input

      flags: [ admin-perm ]

      doc: Delete existing remote peer

      do:
@@ -316,7 +457,7 @@ operations: 
            - keyconf

    -

      name: key-get

      attribute-set: ovpn

      attribute-set: ovpn-keyconf-get

      flags: [ admin-perm ]

      doc: Retrieve non-sensitive data about peer key and cipher

      do:
@@ -331,7 +472,7 @@ operations: 
            - keyconf

    -

      name: key-swap

      attribute-set: ovpn

      attribute-set: ovpn-keyconf-swap-input

      flags: [ admin-perm ]

      doc: Swap primary and secondary session keys for a specific peer

      do:
@@ -350,7 +491,7 @@ operations: 
      mcgrp: peers

    -

      name: key-del

      attribute-set: ovpn

      attribute-set: ovpn-keyconf-del-input

      flags: [ admin-perm ]

      doc: Delete cipher key for a specific peer

      do:

drivers/bluetooth/bfusb.c

+1 −1
Original line number Diff line number Diff line
@@ -670,7 +670,7 @@ static int bfusb_probe(struct usb_interface *intf, const struct usb_device_id *i 
	hdev->flush = bfusb_flush;

	hdev->send  = bfusb_send_frame;



	set_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks);

	hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LOCAL_COMMANDS);



	if (hci_register_dev(hdev) < 0) {

		BT_ERR("Can't register HCI device");

drivers/bluetooth/bpa10x.c

+1 −1
Original line number Diff line number Diff line
@@ -398,7 +398,7 @@ static int bpa10x_probe(struct usb_interface *intf, 
	hdev->send     = bpa10x_send_frame;

	hdev->set_diag = bpa10x_set_diag;



	set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);

	hci_set_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE);



	err = hci_register_dev(hdev);

	if (err < 0) {

drivers/bluetooth/btbcm.c

+4 −4
Original line number Diff line number Diff line
@@ -135,7 +135,7 @@ int btbcm_check_bdaddr(struct hci_dev *hdev) 
		if (btbcm_set_bdaddr_from_efi(hdev) != 0) {

			bt_dev_info(hdev, "BCM: Using default device address (%pMR)",

				    &bda->bdaddr);

			set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);

			hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR);

		}

	}
@@ -467,7 +467,7 @@ static int btbcm_print_controller_features(struct hci_dev *hdev) 


	/* Read DMI and disable broken Read LE Min/Max Tx Power */

	if (dmi_first_match(disable_broken_read_transmit_power))

		set_bit(HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER, &hdev->quirks);

		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER);



	return 0;

}
@@ -706,7 +706,7 @@ int btbcm_finalize(struct hci_dev *hdev, bool *fw_load_done, bool use_autobaud_m 


	btbcm_check_bdaddr(hdev);



	set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);

	hci_set_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER);



	return 0;

}
@@ -769,7 +769,7 @@ int btbcm_setup_apple(struct hci_dev *hdev) 
		kfree_skb(skb);

	}



	set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);

	hci_set_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER);



	return 0;

}

drivers/bluetooth/btintel.c

+15 −15
Original line number Diff line number Diff line
@@ -88,7 +88,7 @@ int btintel_check_bdaddr(struct hci_dev *hdev) 
	if (!bacmp(&bda->bdaddr, BDADDR_INTEL)) {

		bt_dev_err(hdev, "Found Intel default device address (%pMR)",

			   &bda->bdaddr);

		set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);

		hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR);

	}



	kfree_skb(skb);
@@ -2027,7 +2027,7 @@ static int btintel_download_fw(struct hci_dev *hdev, 
	 */

	if (!bacmp(&params->otp_bdaddr, BDADDR_ANY)) {

		bt_dev_info(hdev, "No device address configured");

		set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);

		hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR);

	}



download:
@@ -2295,7 +2295,7 @@ static int btintel_prepare_fw_download_tlv(struct hci_dev *hdev, 
		 */

		if (!bacmp(&ver->otp_bd_addr, BDADDR_ANY)) {

			bt_dev_info(hdev, "No device address configured");

			set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);

			hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR);

		}

	}
@@ -2670,7 +2670,7 @@ static u8 btintel_classify_pkt_type(struct hci_dev *hdev, struct sk_buff *skb) 
	 * Distinguish ISO data packets form ACL data packets

	 * based on their connection handle value range.

	 */

	if (hci_skb_pkt_type(skb) == HCI_ACLDATA_PKT) {

	if (iso_capable(hdev) && hci_skb_pkt_type(skb) == HCI_ACLDATA_PKT) {

		__u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle);



		if (hci_handle(handle) >= BTINTEL_ISODATA_HANDLE_BASE)
@@ -3435,9 +3435,9 @@ static int btintel_setup_combined(struct hci_dev *hdev) 
	}



	/* Apply the common HCI quirks for Intel device */

	set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);

	set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);

	set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);

	hci_set_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER);

	hci_set_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY);

	hci_set_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_DIAG);



	/* Set up the quality report callback for Intel devices */

	hdev->set_quality_report = btintel_set_quality_report;
@@ -3475,8 +3475,8 @@ static int btintel_setup_combined(struct hci_dev *hdev) 
			 */

			if (!btintel_test_flag(hdev,

					       INTEL_ROM_LEGACY_NO_WBS_SUPPORT))

				set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,

					&hdev->quirks);

				hci_set_quirk(hdev,

					      HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED);



			err = btintel_legacy_rom_setup(hdev, &ver);

			break;
@@ -3491,11 +3491,11 @@ static int btintel_setup_combined(struct hci_dev *hdev) 
			 *

			 * All Legacy bootloader devices support WBS

			 */

			set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,

				&hdev->quirks);

			hci_set_quirk(hdev,

				      HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED);



			/* These variants don't seem to support LE Coded PHY */

			set_bit(HCI_QUIRK_BROKEN_LE_CODED, &hdev->quirks);

			hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_CODED);



			/* Setup MSFT Extension support */

			btintel_set_msft_opcode(hdev, ver.hw_variant);
@@ -3571,10 +3571,10 @@ static int btintel_setup_combined(struct hci_dev *hdev) 
		 *

		 * All Legacy bootloader devices support WBS

		 */

		set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks);

		hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED);



		/* These variants don't seem to support LE Coded PHY */

		set_bit(HCI_QUIRK_BROKEN_LE_CODED, &hdev->quirks);

		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_CODED);



		/* Setup MSFT Extension support */

		btintel_set_msft_opcode(hdev, ver.hw_variant);
@@ -3600,7 +3600,7 @@ static int btintel_setup_combined(struct hci_dev *hdev) 
		 *

		 * All TLV based devices support WBS

		 */

		set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks);

		hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED);



		/* Setup MSFT Extension support */

		btintel_set_msft_opcode(hdev,