Commit fcee7d82 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'net-7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 

Pull networking fixes from Jakub Kicinski:
 "Including fixes from Netfilter, IPsec, Bluetooth and WiFi.

  Current release - fix to a fix:

   - ipmr: add __rcu to netns_ipv4.mrt, make sure we hold the RCU lock
     in all relevant places

  Current release - new code bugs:

   - fixes for the recently added resizable hash tables

   - ipv6: make sure we default IPv6 tunnel drivers to =m now that IPv6
     itself is built in

   - drv: octeontx2-af: fixes for parser/CAM fixes

  Previous releases - regressions:

   - phy: micrel: fix LAN8814 QSGMII soft reset

   - wifi:
       - cw1200: revert "Fix locking in error paths"
       - ath12k: fix crash on WCN7850, due to adding the same queue
         buffer to a list multiple times

  Previous releases - always broken:

   - number of info leak fixes

   - ipv6: implement limits on extension header parsing

   - wifi: number of fixes for missing bound checks in the drivers

   - Bluetooth: fixes for races and locking issues

   - af_unix:
       - fix an issue between garbage collection and PEEK
       - fix yet another issue with OOB data

   - xfrm: esp: avoid in-place decrypt on shared skb frags

   - netfilter: replace skb_try_make_writable() by skb_ensure_writable()

   - openvswitch: vport: fix race between tunnel creation and linking
     leading to invalid memory accesses (type confusion)

   - drv: amd-xgbe: fix PTP addend overflow causing frozen clock

  Misc:

   - sched/isolation: make HK_TYPE_KTHREAD an alias of HK_TYPE_DOMAIN
     (for relevant IPVS change)"

* tag 'net-7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (190 commits)
  net: sparx5: configure serdes for 1000BASE-X in sparx5_port_init()
  net: sparx5: fix wrong chip ids for TSN SKUs
  net: stmmac: dwmac-nuvoton: fix NULL pointer dereference in nvt_set_phy_intf_sel()
  tcp: Fix dst leak in tcp_v6_connect().
  ipmr: Call ipmr_fib_lookup() under RCU.
  net: phy: broadcom: Save PHY counters during suspend
  net/smc: fix missing sk_err when TCP handshake fails
  af_unix: Reject SIOCATMARK on non-stream sockets
  veth: fix OOB txq access in veth_poll() with asymmetric queue counts
  eth: fbnic: fix double-free of PCS on phylink creation failure
  net: ethernet: cortina: Drop half-assembled SKB
  selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl
  selftests: mptcp: check output: catch cmd errors
  mptcp: pm: prio: skip closed subflows
  mptcp: pm: ADD_ADDR rtx: return early if no retrans
  mptcp: pm: ADD_ADDR rtx: skip inactive subflows
  mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker
  mptcp: pm: ADD_ADDR rtx: free sk if last
  mptcp: pm: ADD_ADDR rtx: always decrease sk refcount
  mptcp: pm: ADD_ADDR rtx: fix potential data-race
  ...
parents 19cbc75c 41ae1407

MAINTAINERS

+6 −0
Original line number Diff line number Diff line
@@ -7077,6 +7077,12 @@ T: git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git core/debugobjec 
F:	include/linux/debugobjects.h

F:	lib/debugobjects.c









DEC LANCE NETWORK DRIVER









M:	"Maciej W. Rozycki" <macro@orcam.me.uk>









L:	netdev@vger.kernel.org









S:	Maintained









F:	drivers/net/ethernet/amd/declance.c

















DECSTATION PLATFORM SUPPORT









M:	"Maciej W. Rozycki" <macro@orcam.me.uk>









L:	linux-mips@vger.kernel.org
































drivers/bluetooth/btintel_pcie.c



+10
−3






























Original line number
Diff line number
Diff line







@@ -289,6 +289,9 @@ static inline void btintel_pcie_dump_debug_registers(struct hci_dev *hdev)







	skb_put_data(skb, buf, strlen(buf));









	data->boot_stage_cache = reg;



















	if (reg & BTINTEL_PCIE_CSR_BOOT_STAGE_DEVICE_WARNING)









		bt_dev_warn(hdev, "Controller device warning (boot_stage: 0x%8.8x)", reg);



















	reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_IPC_STATUS_REG);









	snprintf(buf, sizeof(buf), "ipc status: 0x%8.8x", reg);









	skb_put_data(skb, buf, strlen(buf));








@@ -880,8 +883,11 @@ static inline bool btintel_pcie_in_lockdown(struct btintel_pcie_data *data)

















static inline bool btintel_pcie_in_error(struct btintel_pcie_data *data)









{









	return (data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_DEVICE_ERR) ||









		(data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_ABORT_HANDLER);









	if (data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_DEVICE_WARNING)









		bt_dev_warn(data->hdev, "Controller device warning (boot_stage: 0x%8.8x)",









			    data->boot_stage_cache);



















	return	data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_ABORT_HANDLER;









}



















static void btintel_pcie_msix_gp1_handler(struct btintel_pcie_data *data)








@@ -914,7 +920,8 @@ static void btintel_pcie_msix_gp0_handler(struct btintel_pcie_data *data)







		data->img_resp_cache = reg;



















	if (btintel_pcie_in_error(data)) {









		bt_dev_err(data->hdev, "Controller in error state");









		bt_dev_err(data->hdev, "Controller in error state (boot_stage: 0x%8.8x)",









			   data->boot_stage_cache);









		btintel_pcie_dump_debug_registers(data->hdev);









		return;









	}
































drivers/bluetooth/btintel_pcie.h



+1
−1






























Original line number
Diff line number
Diff line







@@ -48,7 +48,7 @@







#define BTINTEL_PCIE_CSR_BOOT_STAGE_OPFW		(BIT(2))









#define BTINTEL_PCIE_CSR_BOOT_STAGE_ROM_LOCKDOWN	(BIT(10))









#define BTINTEL_PCIE_CSR_BOOT_STAGE_IML_LOCKDOWN	(BIT(11))









#define BTINTEL_PCIE_CSR_BOOT_STAGE_DEVICE_ERR		(BIT(12))









#define BTINTEL_PCIE_CSR_BOOT_STAGE_DEVICE_WARNING	(BIT(12))









#define BTINTEL_PCIE_CSR_BOOT_STAGE_ABORT_HANDLER	(BIT(13))









#define BTINTEL_PCIE_CSR_BOOT_STAGE_DEVICE_HALTED	(BIT(14))









#define BTINTEL_PCIE_CSR_BOOT_STAGE_MAC_ACCESS_ON	(BIT(16))
































drivers/bluetooth/btmtk.c



+13
−2






























Original line number
Diff line number
Diff line







@@ -695,8 +695,13 @@ static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,







	if (data->evt_skb == NULL)









		goto err_free_wc;



















	/* Parse and handle the return WMT event */









	wmt_evt = (struct btmtk_hci_wmt_evt *)data->evt_skb->data;









	wmt_evt = skb_pull_data(data->evt_skb, sizeof(*wmt_evt));









	if (!wmt_evt) {









		bt_dev_err(hdev, "WMT event too short (%u bytes)",









			   data->evt_skb->len);









		err = -EINVAL;









		goto err_free_skb;









	}









	if (wmt_evt->whdr.op != hdr->op) {









		bt_dev_err(hdev, "Wrong op received %d expected %d",









			   wmt_evt->whdr.op, hdr->op);








@@ -712,6 +717,12 @@ static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,







			status = BTMTK_WMT_PATCH_DONE;









		break;









	case BTMTK_WMT_FUNC_CTRL:









		if (!skb_pull_data(data->evt_skb,









				   sizeof(wmt_evt_funcc->status))) {









			err = -EINVAL;









			goto err_free_skb;









		}



















		wmt_evt_funcc = (struct btmtk_hci_wmt_evt_funcc *)wmt_evt;









		if (be16_to_cpu(wmt_evt_funcc->status) == 0x404)









			status = BTMTK_WMT_ON_DONE;
































drivers/bluetooth/hci_ath.c



+3
−0






























Original line number
Diff line number
Diff line







@@ -191,6 +191,9 @@ static int ath_recv(struct hci_uart *hu, const void *data, int count)







{









	struct ath_struct *ath = hu->priv;



















	if (!ath)









		return -ENODEV;



















	ath->rx_skb = h4_recv_buf(hu, ath->rx_skb, data, count,









				  ath_recv_pkts, ARRAY_SIZE(ath_recv_pkts));









	if (IS_ERR(ath->rx_skb)) {