Commit 2c7e63d7 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'net-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 

Pull networking fixes from Paolo Abeni:
 "Including fixes from CAN and netfilter.

  Current release - regressions:

   - eth: mana: Null service_wq on setup error to prevent double destroy

  Previous releases - regressions:

   - nexthop: fix percpu use-after-free in remove_nh_grp_entry

   - sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit

   - bpf: fix nd_tbl NULL dereference when IPv6 is disabled

   - neighbour: restore protocol != 0 check in pneigh update

   - tipc: fix divide-by-zero in tipc_sk_filter_connect()

   - eth:
      - mlx5:
         - fix crash when moving to switchdev mode
         - fix DMA FIFO desync on error CQE SQ recovery
      - iavf: fix PTP use-after-free during reset
      - bonding: fix type confusion in bond_setup_by_slave()
      - lan78xx: fix WARN in __netif_napi_del_locked on disconnect

  Previous releases - always broken:

   - core: add xmit recursion limit to tunnel xmit functions

   - net-shapers: don't free reply skb after genlmsg_reply()

   - netfilter:
      - fix stack out-of-bounds read in pipapo_drop()
      - fix OOB read in nfnl_cthelper_dump_table()

   - mctp:
      - fix device leak on probe failure
      - i2c: fix skb memory leak in receive path

   - can: keep the max bitrate error at 5%

   - eth:
      - bonding: fix nd_tbl NULL dereference when IPv6 is disabled
      - bnxt_en: fix RSS table size check when changing ethtool channels
      - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled
      - octeontx2-af: devlink: fix NIX RAS reporter recovery condition"

* tag 'net-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (71 commits)
  net: prevent NULL deref in ip[6]tunnel_xmit()
  octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status
  octeontx2-af: devlink: fix NIX RAS reporter recovery condition
  net: ethernet: ti: am65-cpsw-nuss: Fix rx_filter value for PTP support
  net/mana: Null service_wq on setup error to prevent double destroy
  selftests: rtnetlink: add neighbour update test
  neighbour: restore protocol != 0 check in pneigh update
  net: dsa: realtek: Fix LED group port bit for non-zero LED group
  tipc: fix divide-by-zero in tipc_sk_filter_connect()
  net: dsa: microchip: Fix error path in PTP IRQ setup
  bpf: bpf_out_neigh_v6: Fix nd_tbl NULL dereference when IPv6 is disabled
  bpf: bpf_out_neigh_v4: Fix nd_tbl NULL dereference when IPv6 is disabled
  net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled
  ipv6: move the disable_ipv6_mod knob to core code
  net: bcmgenet: fix broken EEE by converting to phylib-managed state
  net-shapers: don't free reply skb after genlmsg_reply()
  net: dsa: mxl862xx: don't set user_mii_bus
  net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
  page_pool: store detach_time as ktime_t to avoid false-negatives
  net: macb: Shuffle the tx ring before enabling tx
  ...
parents 281f36d4 c38b8f5f

MAINTAINERS

+1 −1
Original line number Diff line number Diff line
@@ -16358,7 +16358,6 @@ F: net/dsa/tag_mtk.c 








MEDIATEK T7XX 5G WWAN MODEM DRIVER









M:	Chandrashekar Devegowda <chandrashekar.devegowda@intel.com>









R:	Chiranjeevi Rapolu <chiranjeevi.rapolu@linux.intel.com>









R:	Liu Haijun <haijun.liu@mediatek.com>









R:	Ricardo Martinez <ricardo.martinez@linux.intel.com>









L:	netdev@vger.kernel.org








@@ -25759,6 +25758,7 @@ F:	include/net/pkt_cls.h







F:	include/net/pkt_sched.h









F:	include/net/sch_priv.h









F:	include/net/tc_act/









F:	include/net/tc_wrapper.h









F:	include/uapi/linux/pkt_cls.h









F:	include/uapi/linux/pkt_sched.h









F:	include/uapi/linux/tc_act/

























drivers/net/bonding/bond_main.c



+63
−7






























Original line number
Diff line number
Diff line







@@ -1509,6 +1509,50 @@ static netdev_features_t bond_fix_features(struct net_device *dev,







	return features;









}



















static int bond_header_create(struct sk_buff *skb, struct net_device *bond_dev,









			      unsigned short type, const void *daddr,









			      const void *saddr, unsigned int len)









{









	struct bonding *bond = netdev_priv(bond_dev);









	const struct header_ops *slave_ops;









	struct slave *slave;









	int ret = 0;



















	rcu_read_lock();









	slave = rcu_dereference(bond->curr_active_slave);









	if (slave) {









		slave_ops = READ_ONCE(slave->dev->header_ops);









		if (slave_ops && slave_ops->create)









			ret = slave_ops->create(skb, slave->dev,









						type, daddr, saddr, len);









	}









	rcu_read_unlock();









	return ret;









}



















static int bond_header_parse(const struct sk_buff *skb, unsigned char *haddr)









{









	struct bonding *bond = netdev_priv(skb->dev);









	const struct header_ops *slave_ops;









	struct slave *slave;









	int ret = 0;



















	rcu_read_lock();









	slave = rcu_dereference(bond->curr_active_slave);









	if (slave) {









		slave_ops = READ_ONCE(slave->dev->header_ops);









		if (slave_ops && slave_ops->parse)









			ret = slave_ops->parse(skb, haddr);









	}









	rcu_read_unlock();









	return ret;









}



















static const struct header_ops bond_header_ops = {









	.create	= bond_header_create,









	.parse	= bond_header_parse,









};



















static void bond_setup_by_slave(struct net_device *bond_dev,









				struct net_device *slave_dev)









{








@@ -1516,7 +1560,8 @@ static void bond_setup_by_slave(struct net_device *bond_dev,

















	dev_close(bond_dev);



















	bond_dev->header_ops	    = slave_dev->header_ops;









	bond_dev->header_ops	    = slave_dev->header_ops ?









				      &bond_header_ops : NULL;



















	bond_dev->type		    = slave_dev->type;









	bond_dev->hard_header_len   = slave_dev->hard_header_len;








@@ -2801,8 +2846,14 @@ static void bond_miimon_commit(struct bonding *bond)

















			continue;



















		case BOND_LINK_FAIL:









		case BOND_LINK_BACK:









			slave_dbg(bond->dev, slave->dev, "link_new_state %d on slave\n",









				  slave->link_new_state);









			continue;



















		default:









			slave_err(bond->dev, slave->dev, "invalid new link %d on slave\n",









			slave_err(bond->dev, slave->dev, "invalid link_new_state %d on slave\n",









				  slave->link_new_state);









			bond_propose_link_state(slave, BOND_LINK_NOCHANGE);


















@@ -3377,7 +3428,7 @@ int bond_rcv_validate(const struct sk_buff *skb, struct bonding *bond,







	} else if (is_arp) {









		return bond_arp_rcv(skb, bond, slave);









#if IS_ENABLED(CONFIG_IPV6)









	} else if (is_ipv6) {









	} else if (is_ipv6 && likely(ipv6_mod_enabled())) {









		return bond_na_rcv(skb, bond, slave);









#endif









	} else {








@@ -5069,13 +5120,18 @@ static void bond_set_slave_arr(struct bonding *bond,







{









	struct bond_up_slave *usable, *all;



















	usable = rtnl_dereference(bond->usable_slaves);









	rcu_assign_pointer(bond->usable_slaves, usable_slaves);









	kfree_rcu(usable, rcu);



















	all = rtnl_dereference(bond->all_slaves);









	rcu_assign_pointer(bond->all_slaves, all_slaves);









	kfree_rcu(all, rcu);



















	if (BOND_MODE(bond) == BOND_MODE_BROADCAST) {









		kfree_rcu(usable_slaves, rcu);









		return;









	}



















	usable = rtnl_dereference(bond->usable_slaves);









	rcu_assign_pointer(bond->usable_slaves, usable_slaves);









	kfree_rcu(usable, rcu);









}



















static void bond_reset_slave_arr(struct bonding *bond)
































drivers/net/caif/caif_serial.c



+3
−0






























Original line number
Diff line number
Diff line







@@ -297,6 +297,7 @@ static void ser_release(struct work_struct *work)







			dev_close(ser->dev);









			unregister_netdevice(ser->dev);









			debugfs_deinit(ser);









			tty_kref_put(tty->link);









			tty_kref_put(tty);









		}









		rtnl_unlock();








@@ -331,6 +332,7 @@ static int ldisc_open(struct tty_struct *tty)

















	ser = netdev_priv(dev);









	ser->tty = tty_kref_get(tty);









	tty_kref_get(tty->link);









	ser->dev = dev;









	debugfs_init(ser, tty);









	tty->receive_room = 4096;








@@ -339,6 +341,7 @@ static int ldisc_open(struct tty_struct *tty)







	rtnl_lock();









	result = register_netdevice(dev);









	if (result) {









		tty_kref_put(tty->link);









		tty_kref_put(tty);









		rtnl_unlock();









		free_netdev(dev);
































drivers/net/can/dev/calc_bittiming.c



+1
−1






























Original line number
Diff line number
Diff line







@@ -8,7 +8,7 @@







#include <linux/units.h>









#include <linux/can/dev.h>



















#define CAN_CALC_MAX_ERROR 50 /* in one-tenth of a percent */









#define CAN_CALC_MAX_ERROR 500 /* max error 5% */



















/* CiA recommended sample points for Non Return to Zero encoding. */









static int can_calc_sample_point_nrz(const struct can_bittiming *bt)
































drivers/net/can/spi/hi311x.c



+4
−1






























Original line number
Diff line number
Diff line







@@ -755,7 +755,9 @@ static int hi3110_open(struct net_device *net)







		return ret;



















	mutex_lock(&priv->hi3110_lock);









	hi3110_power_enable(priv->transceiver, 1);









	ret = hi3110_power_enable(priv->transceiver, 1);









	if (ret)









		goto out_close_candev;



















	priv->force_quit = 0;









	priv->tx_skb = NULL;








@@ -790,6 +792,7 @@ static int hi3110_open(struct net_device *net)







	hi3110_hw_sleep(spi);









 out_close:









	hi3110_power_enable(priv->transceiver, 0);









 out_close_candev:









	close_candev(net);









	mutex_unlock(&priv->hi3110_lock);









	return ret;