Commit dbf8fe85 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'net-6.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 

Pull networking fixes from Paolo Abeni:
 "Including fixes from Bluetooth and WiFi. Notably this includes the fix
  for the iwlwifi issue you reported.

  Current release - regressions:

   - core: avoid prefetching NULL pointers

   - wifi:
      - iwlwifi: implement settime64 as stub for MVM/MLD PTP
      - mac80211: fix list iteration in ieee80211_add_virtual_monitor()

   - handshake: fix null-ptr-deref in handshake_complete()

   - eth: mana: fix use-after-free in reset service rescan path

  Previous releases - regressions:

   - openvswitch: avoid needlessly taking the RTNL on vport destroy

   - dsa: properly keep track of conduit reference

   - ipv4:
      - fix error route reference count leak with nexthop objects
      - fib: restore ECMP balance from loopback

   - mptcp: ensure context reset on disconnect()

   - bluetooth: fix potential UaF in btusb

   - nfc: fix deadlock between nfc_unregister_device and
     rfkill_fop_write

   - eth:
      - gve: defer interrupt enabling until NAPI registration
      - i40e: fix scheduling in set_rx_mode
      - macb: relocate mog_init_rings() callback from macb_mac_link_up()
        to macb_open()
      - rtl8150: fix memory leak on usb_submit_urb() failure

   - wifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()

  Previous releases - always broken:

   - ip6_gre: make ip6gre_header() robust

   - ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT

   - af_unix: don't post cmsg for SO_INQ unless explicitly asked for

   - phy: mediatek: fix nvmem cell reference leak in
     mt798x_phy_calibration

   - wifi: mac80211: discard beacon frames to non-broadcast address

   - eth:
      - iavf: fix off-by-one issues in iavf_config_rss_reg()
      - stmmac: fix the crash issue for zero copy XDP_TX action
      - team: fix check for port enabled when priority changes"

* tag 'net-6.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (64 commits)
  ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT
  net: rose: fix invalid array index in rose_kill_by_device()
  net: enetc: do not print error log if addr is 0
  net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open()
  selftests: fib_test: Add test case for ipv4 multi nexthops
  net: fib: restore ECMP balance from loopback
  selftests: fib_nexthops: Add test cases for error routes deletion
  ipv4: Fix reference count leak when using error routes with nexthop objects
  net: usb: sr9700: fix incorrect command used to write single register
  ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
  usbnet: avoid a possible crash in dql_completed()
  gve: defer interrupt enabling until NAPI registration
  net: stmmac: fix the crash issue for zero copy XDP_TX action
  octeontx2-pf: fix "UBSAN: shift-out-of-bounds error"
  af_unix: don't post cmsg for SO_INQ unless explicitly asked for
  net: mana: Fix use-after-free in reset service rescan path
  net: avoid prefetching NULL pointers
  net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct
  net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
  net: usb: asix: validate PHY address before use
  ...
parents 8640b745 1adaea51

drivers/bluetooth/btusb.c

+9 −3
Original line number Diff line number Diff line
@@ -4052,7 +4052,7 @@ static int btusb_probe(struct usb_interface *intf, 
			return -ENODEV;

	}



	data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);

	data = kzalloc(sizeof(*data), GFP_KERNEL);

	if (!data)

		return -ENOMEM;
@@ -4075,8 +4075,10 @@ static int btusb_probe(struct usb_interface *intf, 
		}

	}



	if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep)

	if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep) {

		kfree(data);

		return -ENODEV;

	}



	if (id->driver_info & BTUSB_AMP) {

		data->cmdreq_type = USB_TYPE_CLASS | 0x01;
@@ -4131,8 +4133,10 @@ static int btusb_probe(struct usb_interface *intf, 
	data->recv_acl = hci_recv_frame;



	hdev = hci_alloc_dev_priv(priv_size);

	if (!hdev)

	if (!hdev) {

		kfree(data);

		return -ENOMEM;

	}



	hdev->bus = HCI_USB;

	hci_set_drvdata(hdev, data);
@@ -4406,6 +4410,7 @@ static int btusb_probe(struct usb_interface *intf, 
	if (data->reset_gpio)

		gpiod_put(data->reset_gpio);

	hci_free_dev(hdev);

	kfree(data);

	return err;

}
@@ -4454,6 +4459,7 @@ static void btusb_disconnect(struct usb_interface *intf) 
	}



	hci_free_dev(hdev);

	kfree(data);

}



#ifdef CONFIG_PM

drivers/net/dsa/b53/b53_common.c

+3 −0
Original line number Diff line number Diff line
@@ -2169,6 +2169,9 @@ static int b53_fdb_copy(int port, const struct b53_arl_entry *ent, 
	if (!ent->is_valid)

		return 0;



	if (is_multicast_ether_addr(ent->mac))

		return 0;



	if (port != ent->port)

		return 0;

drivers/net/ethernet/airoha/airoha_eth.c

+26 −13
Original line number Diff line number Diff line
@@ -2924,21 +2924,28 @@ static int airoha_alloc_gdm_port(struct airoha_eth *eth, 
	port->id = id;

	eth->ports[p] = port;



	err = airoha_metadata_dst_alloc(port);

	if (err)

		return err;

	return airoha_metadata_dst_alloc(port);

}



	err = register_netdev(dev);

	if (err)

		goto free_metadata_dst;

static int airoha_register_gdm_devices(struct airoha_eth *eth)

{

	int i;



	return 0;

	for (i = 0; i < ARRAY_SIZE(eth->ports); i++) {

		struct airoha_gdm_port *port = eth->ports[i];

		int err;



free_metadata_dst:

	airoha_metadata_dst_free(port);

		if (!port)

			continue;



		err = register_netdev(port->dev);

		if (err)

			return err;

	}



	return 0;

}



static int airoha_probe(struct platform_device *pdev)

{

	struct reset_control_bulk_data *xsi_rsts;
@@ -3027,6 +3034,10 @@ static int airoha_probe(struct platform_device *pdev) 
		}

	}



	err = airoha_register_gdm_devices(eth);

	if (err)

		goto error_napi_stop;



	return 0;



error_napi_stop:
@@ -3040,11 +3051,13 @@ static int airoha_probe(struct platform_device *pdev) 
	for (i = 0; i < ARRAY_SIZE(eth->ports); i++) {

		struct airoha_gdm_port *port = eth->ports[i];



		if (port && port->dev->reg_state == NETREG_REGISTERED) {

		if (!port)

			continue;



		if (port->dev->reg_state == NETREG_REGISTERED)

			unregister_netdev(port->dev);

		airoha_metadata_dst_free(port);

	}

	}

	free_netdev(eth->napi_dev);

	platform_set_drvdata(pdev, NULL);

drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c

+2 −0
Original line number Diff line number Diff line
@@ -1928,6 +1928,7 @@ static void xgbe_set_rx_adap_mode(struct xgbe_prv_data *pdata, 
{

	if (pdata->rx_adapt_retries++ >= MAX_RX_ADAPT_RETRIES) {

		pdata->rx_adapt_retries = 0;

		pdata->mode_set = false;

		return;

	}
@@ -1974,6 +1975,7 @@ static void xgbe_rx_adaptation(struct xgbe_prv_data *pdata) 
		 */

		netif_dbg(pdata, link, pdata->netdev, "Block_lock done");

		pdata->rx_adapt_done = true;

		pdata->rx_adapt_retries = 0;

		pdata->mode_set = false;

		return;

	}

drivers/net/ethernet/broadcom/Kconfig

+4 −4
Original line number Diff line number Diff line
@@ -255,14 +255,14 @@ config BNXT_HWMON 
	  devices, via the hwmon sysfs interface.



config BNGE

	tristate "Broadcom Ethernet device support"

	tristate "Broadcom ThorUltra Ethernet device support"

	depends on PCI

	select NET_DEVLINK

	select PAGE_POOL

	help

	  This driver supports Broadcom 50/100/200/400/800 gigabit Ethernet cards.

	  The module will be called bng_en. To compile this driver as a module,

	  choose M here.

	  This driver supports Broadcom ThorUltra 50/100/200/400/800 gigabit

	  Ethernet cards. The module will be called bng_en. To compile this

	  driver as a module, choose M here.



config BCMASP

	tristate "Broadcom ASP 2.0 Ethernet support"