Commit 8c3b7565 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'net-6.9-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 

Pull networking fixes from Paolo Abeni:
 "Including fixes from bluetooth and IPsec.

  The bridge patch is actually a follow-up to a recent fix in the same
  area. We have a pending v6.8 AF_UNIX regression; it should be solved
  soon, but not in time for this PR.

  Current release - regressions:

   - eth: ks8851: Queue RX packets in IRQ handler instead of disabling
     BHs

   - net: bridge: fix corrupted ethernet header on multicast-to-unicast

  Current release - new code bugs:

   - xfrm: fix possible bad pointer derferencing in error path

  Previous releases - regressionis:

   - core: fix out-of-bounds access in ops_init

   - ipv6:
      - fix potential uninit-value access in __ip6_make_skb()
      - fib6_rules: avoid possible NULL dereference in fib6_rule_action()

   - tcp: use refcount_inc_not_zero() in tcp_twsk_unique().

   - rtnetlink: correct nested IFLA_VF_VLAN_LIST attribute validation

   - rxrpc: fix congestion control algorithm

   - bluetooth:
      - l2cap: fix slab-use-after-free in l2cap_connect()
      - msft: fix slab-use-after-free in msft_do_close()

   - eth: hns3: fix kernel crash when devlink reload during
     initialization

   - eth: dsa: mv88e6xxx: add phylink_get_caps for the mv88e6320/21
     family

  Previous releases - always broken:

   - xfrm: preserve vlan tags for transport mode software GRO

   - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets

   - eth: hns3: keep using user config after hardware reset"

* tag 'net-6.9-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (47 commits)
  net: dsa: mv88e6xxx: read cmode on mv88e6320/21 serdes only ports
  net: dsa: mv88e6xxx: add phylink_get_caps for the mv88e6320/21 family
  net: hns3: fix kernel crash when devlink reload during initialization
  net: hns3: fix port vlan filter not disabled issue
  net: hns3: use appropriate barrier function after setting a bit value
  net: hns3: release PTP resources if pf initialization failed
  net: hns3: change type of numa_node_mask as nodemask_t
  net: hns3: direct return when receive a unknown mailbox message
  net: hns3: using user configure after hardware reset
  net/smc: fix neighbour and rtable leak in smc_ib_find_route()
  ipv6: prevent NULL dereference in ip6_output()
  hsr: Simplify code for announcing HSR nodes timer setup
  ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
  dt-bindings: net: mediatek: remove wrongly added clocks and SerDes
  rxrpc: Only transmit one ACK per jumbo packet received
  rxrpc: Fix congestion control algorithm
  selftests: test_bridge_neigh_suppress.sh: Fix failures due to duplicate MAC
  ipv6: Fix potential uninit-value access in __ip6_make_skb()
  net: phy: marvell-88q2xxx: add support for Rev B1 and B2
  appletalk: Improve handling of broadcast packets
  ...
parents 62788b0f 6e7ffa18

Documentation/devicetree/bindings/net/mediatek,net.yaml

+2 −20
Original line number Diff line number Diff line
@@ -337,8 +337,8 @@ allOf: 
          minItems: 4



        clocks:

          minItems: 34

          maxItems: 34

          minItems: 24

          maxItems: 24



        clock-names:

          items:
@@ -351,18 +351,6 @@ allOf: 
            - const: ethwarp_wocpu1

            - const: ethwarp_wocpu0

            - const: esw

            - const: netsys0

            - const: netsys1

            - const: sgmii_tx250m

            - const: sgmii_rx250m

            - const: sgmii2_tx250m

            - const: sgmii2_rx250m

            - const: top_usxgmii0_sel

            - const: top_usxgmii1_sel

            - const: top_sgm0_sel

            - const: top_sgm1_sel

            - const: top_xfi_phy0_xtal_sel

            - const: top_xfi_phy1_xtal_sel

            - const: top_eth_gmii_sel

            - const: top_eth_refck_50m_sel

            - const: top_eth_sys_200m_sel
@@ -375,16 +363,10 @@ allOf: 
            - const: top_netsys_sync_250m_sel

            - const: top_netsys_ppefb_250m_sel

            - const: top_netsys_warp_sel

            - const: wocpu1

            - const: wocpu0

            - const: xgp1

            - const: xgp2

            - const: xgp3



        mediatek,sgmiisys:

          minItems: 2

          maxItems: 2



patternProperties:

  "^mac@[0-1]$":

    type: object

Documentation/netlink/specs/rt_link.yaml

+6 −0
Original line number Diff line number Diff line
@@ -1144,6 +1144,12 @@ attribute-sets: 
      -

        name: mcast-querier-state

        type: binary

      -

        name: fdb-n-learned

        type: u32

      -

        name: fdb-max-learned

        type: u32

  -

    name: linkinfo-brport-attrs

    name-prefix: ifla-brport-

MAINTAINERS

+3 −3
Original line number Diff line number Diff line
@@ -5709,7 +5709,7 @@ Q: http://patchwork.linuxtv.org/project/linux-media/list/ 
F:	drivers/media/dvb-frontends/cxd2820r*









CXGB3 ETHERNET DRIVER (CXGB3)









M:	Raju Rangoju <rajur@chelsio.com>









M:	Potnuri Bharat Teja <bharat@chelsio.com>









L:	netdev@vger.kernel.org









S:	Supported









W:	http://www.chelsio.com








@@ -5730,7 +5730,7 @@ W:	http://www.chelsio.com







F:	drivers/crypto/chelsio

















CXGB4 ETHERNET DRIVER (CXGB4)









M:	Raju Rangoju <rajur@chelsio.com>









M:	Potnuri Bharat Teja <bharat@chelsio.com>









L:	netdev@vger.kernel.org









S:	Supported









W:	http://www.chelsio.com








@@ -5759,7 +5759,7 @@ F:	drivers/infiniband/hw/cxgb4/







F:	include/uapi/rdma/cxgb4-abi.h

















CXGB4VF ETHERNET DRIVER (CXGB4VF)









M:	Raju Rangoju <rajur@chelsio.com>









M:	Potnuri Bharat Teja <bharat@chelsio.com>









L:	netdev@vger.kernel.org









S:	Supported









W:	http://www.chelsio.com
































arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-pico6.dts



+2
−1






























Original line number
Diff line number
Diff line







@@ -82,7 +82,8 @@ pins-clk {







};



















&mmc1 {









	bt_reset: bt-reset {









	bluetooth@2 {









		reg = <2>;









		compatible = "mediatek,mt7921s-bluetooth";









		pinctrl-names = "default";









		pinctrl-0 = <&bt_pins_reset>;
































drivers/bluetooth/btqca.c



+92
−18






























Original line number
Diff line number
Diff line







@@ -15,8 +15,6 @@

















#define VERSION "0.1"



















#define QCA_BDADDR_DEFAULT (&(bdaddr_t) {{ 0xad, 0x5a, 0x00, 0x00, 0x00, 0x00 }})



















int qca_read_soc_version(struct hci_dev *hdev, struct qca_btsoc_version *ver,









			 enum qca_btsoc_type soc_type)









{








@@ -101,7 +99,8 @@ static int qca_read_fw_build_info(struct hci_dev *hdev)







{









	struct sk_buff *skb;









	struct edl_event_hdr *edl;









	char cmd, build_label[QCA_FW_BUILD_VER_LEN];









	char *build_label;









	char cmd;









	int build_lbl_len, err = 0;



















	bt_dev_dbg(hdev, "QCA read fw build info");








@@ -116,6 +115,11 @@ static int qca_read_fw_build_info(struct hci_dev *hdev)







		return err;









	}



















	if (skb->len < sizeof(*edl)) {









		err = -EILSEQ;









		goto out;









	}



















	edl = (struct edl_event_hdr *)(skb->data);









	if (!edl) {









		bt_dev_err(hdev, "QCA read fw build info with no header");








@@ -131,14 +135,25 @@ static int qca_read_fw_build_info(struct hci_dev *hdev)







		goto out;









	}



















	if (skb->len < sizeof(*edl) + 1) {









		err = -EILSEQ;









		goto out;









	}



















	build_lbl_len = edl->data[0];









	if (build_lbl_len <= QCA_FW_BUILD_VER_LEN - 1) {









		memcpy(build_label, edl->data + 1, build_lbl_len);









		*(build_label + build_lbl_len) = '\0';



















	if (skb->len < sizeof(*edl) + 1 + build_lbl_len) {









		err = -EILSEQ;









		goto out;









	}



















	build_label = kstrndup(&edl->data[1], build_lbl_len, GFP_KERNEL);









	if (!build_label)









		goto out;



















	hci_set_fw_info(hdev, "%s", build_label);



















	kfree(build_label);









out:









	kfree_skb(skb);









	return err;








@@ -237,6 +252,11 @@ static int qca_read_fw_board_id(struct hci_dev *hdev, u16 *bid)







		goto out;









	}



















	if (skb->len < 3) {









		err = -EILSEQ;









		goto out;









	}



















	*bid = (edl->data[1] << 8) + edl->data[2];









	bt_dev_dbg(hdev, "%s: bid = %x", __func__, *bid);


















@@ -267,9 +287,10 @@ int qca_send_pre_shutdown_cmd(struct hci_dev *hdev)







}









EXPORT_SYMBOL_GPL(qca_send_pre_shutdown_cmd);



















static void qca_tlv_check_data(struct hci_dev *hdev,









static int qca_tlv_check_data(struct hci_dev *hdev,









			       struct qca_fw_config *config,









		u8 *fw_data, enum qca_btsoc_type soc_type)









			       u8 *fw_data, size_t fw_size,









			       enum qca_btsoc_type soc_type)









{









	const u8 *data;









	u32 type_len;








@@ -279,12 +300,16 @@ static void qca_tlv_check_data(struct hci_dev *hdev,







	struct tlv_type_patch *tlv_patch;









	struct tlv_type_nvm *tlv_nvm;









	uint8_t nvm_baud_rate = config->user_baud_rate;









	u8 type;



















	config->dnld_mode = QCA_SKIP_EVT_NONE;









	config->dnld_type = QCA_SKIP_EVT_NONE;



















	switch (config->type) {









	case ELF_TYPE_PATCH:









		if (fw_size < 7)









			return -EINVAL;



















		config->dnld_mode = QCA_SKIP_EVT_VSE_CC;









		config->dnld_type = QCA_SKIP_EVT_VSE_CC;


















@@ -293,6 +318,9 @@ static void qca_tlv_check_data(struct hci_dev *hdev,







		bt_dev_dbg(hdev, "File version      : 0x%x", fw_data[6]);









		break;









	case TLV_TYPE_PATCH:









		if (fw_size < sizeof(struct tlv_type_hdr) + sizeof(struct tlv_type_patch))









			return -EINVAL;



















		tlv = (struct tlv_type_hdr *)fw_data;









		type_len = le32_to_cpu(tlv->type_len);









		tlv_patch = (struct tlv_type_patch *)tlv->data;








@@ -332,25 +360,64 @@ static void qca_tlv_check_data(struct hci_dev *hdev,







		break;



















	case TLV_TYPE_NVM:









		if (fw_size < sizeof(struct tlv_type_hdr))









			return -EINVAL;



















		tlv = (struct tlv_type_hdr *)fw_data;



















		type_len = le32_to_cpu(tlv->type_len);









		length = (type_len >> 8) & 0x00ffffff;









		length = type_len >> 8;









		type = type_len & 0xff;



















		BT_DBG("TLV Type\t\t : 0x%x", type_len & 0x000000ff);









		/* Some NVM files have more than one set of tags, only parse









		 * the first set when it has type 2 for now. When there is









		 * more than one set there is an enclosing header of type 4.









		 */









		if (type == 4) {









			if (fw_size < 2 * sizeof(struct tlv_type_hdr))









				return -EINVAL;



















			tlv++;



















			type_len = le32_to_cpu(tlv->type_len);









			length = type_len >> 8;









			type = type_len & 0xff;









		}



















		BT_DBG("TLV Type\t\t : 0x%x", type);









		BT_DBG("Length\t\t : %d bytes", length);



















		if (type != 2)









			break;



















		if (fw_size < length + (tlv->data - fw_data))









			return -EINVAL;



















		idx = 0;









		data = tlv->data;









		while (idx < length) {









		while (idx < length - sizeof(struct tlv_type_nvm)) {









			tlv_nvm = (struct tlv_type_nvm *)(data + idx);



















			tag_id = le16_to_cpu(tlv_nvm->tag_id);









			tag_len = le16_to_cpu(tlv_nvm->tag_len);



















			if (length < idx + sizeof(struct tlv_type_nvm) + tag_len)









				return -EINVAL;



















			/* Update NVM tags as needed */









			switch (tag_id) {









			case EDL_TAG_ID_BD_ADDR:









				if (tag_len != sizeof(bdaddr_t))









					return -EINVAL;



















				memcpy(&config->bdaddr, tlv_nvm->data, sizeof(bdaddr_t));



















				break;



















			case EDL_TAG_ID_HCI:









				if (tag_len < 3)









					return -EINVAL;



















				/* HCI transport layer parameters









				 * enabling software inband sleep









				 * onto controller side.








@@ -366,6 +433,9 @@ static void qca_tlv_check_data(struct hci_dev *hdev,







				break;



















			case EDL_TAG_ID_DEEP_SLEEP:









				if (tag_len < 1)









					return -EINVAL;



















				/* Sleep enable mask









				 * enabling deep sleep feature on controller.









				 */








@@ -374,14 +444,16 @@ static void qca_tlv_check_data(struct hci_dev *hdev,







				break;









			}



















			idx += (sizeof(u16) + sizeof(u16) + 8 + tag_len);









			idx += sizeof(struct tlv_type_nvm) + tag_len;









		}









		break;



















	default:









		BT_ERR("Unknown TLV type %d", config->type);









		break;









		return -EINVAL;









	}



















	return 0;









}



















static int qca_tlv_send_segment(struct hci_dev *hdev, int seg_size,








@@ -531,7 +603,9 @@ static int qca_download_firmware(struct hci_dev *hdev,







	memcpy(data, fw->data, size);









	release_firmware(fw);



















	qca_tlv_check_data(hdev, config, data, soc_type);









	ret = qca_tlv_check_data(hdev, config, data, size, soc_type);









	if (ret)









		goto out;



















	segment = data;









	remain = size;








@@ -614,7 +688,7 @@ int qca_set_bdaddr_rome(struct hci_dev *hdev, const bdaddr_t *bdaddr)







}









EXPORT_SYMBOL_GPL(qca_set_bdaddr_rome);



















static int qca_check_bdaddr(struct hci_dev *hdev)









static int qca_check_bdaddr(struct hci_dev *hdev, const struct qca_fw_config *config)









{









	struct hci_rp_read_bd_addr *bda;









	struct sk_buff *skb;








@@ -638,7 +712,7 @@ static int qca_check_bdaddr(struct hci_dev *hdev)







	}



















	bda = (struct hci_rp_read_bd_addr *)skb->data;









	if (!bacmp(&bda->bdaddr, QCA_BDADDR_DEFAULT))









	if (!bacmp(&bda->bdaddr, &config->bdaddr))









		set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks);



















	kfree_skb(skb);








@@ -667,7 +741,7 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,







		   enum qca_btsoc_type soc_type, struct qca_btsoc_version ver,









		   const char *firmware_name)









{









	struct qca_fw_config config;









	struct qca_fw_config config = {};









	int err;









	u8 rom_ver = 0;









	u32 soc_ver;








@@ -852,7 +926,7 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,







		break;









	}



















	err = qca_check_bdaddr(hdev);









	err = qca_check_bdaddr(hdev, &config);









	if (err)









		return err;