Skip to content

Commit 4ff71af

Browse files
torvaldstorvalds
committed
Merge tag 'net-6.17-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Paolo Abeni: "Including fixes from Bluetooth, IPsec and CAN. No known regressions at this point. Current release - regressions: - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI Previous releases - regressions: - xfrm: fix offloading of cross-family tunnels - bluetooth: fix several races leading to UaFs - dsa: lantiq_gswip: fix FDB entries creation for the CPU port - eth: - tun: update napi->skb after XDP process - mlx: fix UAF in flow counter release Previous releases - always broken: - core: forbid FDB status change while nexthop is in a group - smc: fix warning in smc_rx_splice() when calling get_page() - can: provide missing ndo_change_mtu(), to prevent buffer overflow. - eth: - i40e: fix VF config validation - broadcom: fix support for PTP_EXTTS_REQUEST2 ioctl" * tag 'net-6.17-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (40 commits) octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() libie: fix string names for AQ error codes net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD net/mlx5: HWS, ignore flow level for multi-dest table net/mlx5: fs, fix UAF in flow counter release selftests: fib_nexthops: Add test cases for FDB status change selftests: fib_nexthops: Fix creation of non-FDB nexthops nexthop: Forbid FDB status change while nexthop is in a group net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS bnxt_en: correct offset handling for IPv6 destination address ptp: document behavior of PTP_STRICT_FLAGS broadcom: fix support for PTP_EXTTS_REQUEST2 ioctl broadcom: fix support for PTP_PEROUT_DUTY_CYCLE Bluetooth: MGMT: Fix possible UAFs Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue Bluetooth: hci_sync: Fix hci_resume_advertising_sync Bluetooth: Fix build after header cleanup ...
2 parents 93a2744 + d9c70e9 commit 4ff71af

File tree

41 files changed

+548
-201
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+548
-201
lines changed

‎drivers/bluetooth/Kconfig‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -312,7 +312,9 @@ config BT_HCIBCM4377
312312

313313
config BT_HCIBPA10X
314314
tristate "HCI BPA10x USB driver"
315+
depends on BT_HCIUART
315316
depends on USB
317+
select BT_HCIUART_H4
316318
help
317319
Bluetooth HCI BPA10x USB driver.
318320
This driver provides support for the Digianswer BPA 100/105 Bluetooth
@@ -437,8 +439,10 @@ config BT_MTKSDIO
437439

438440
config BT_MTKUART
439441
tristate "MediaTek HCI UART driver"
442+
depends on BT_HCIUART
440443
depends on SERIAL_DEV_BUS
441444
depends on USB || !BT_HCIBTUSB_MTK
445+
select BT_HCIUART_H4
442446
select BT_MTK
443447
help
444448
MediaTek Bluetooth HCI UART driver.
@@ -483,7 +487,9 @@ config BT_VIRTIO
483487

484488
config BT_NXPUART
485489
tristate "NXP protocol support"
490+
depends on BT_HCIUART
486491
depends on SERIAL_DEV_BUS
492+
select BT_HCIUART_H4
487493
select CRC32
488494
select CRC8
489495
help

‎drivers/bluetooth/hci_uart.h‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -121,10 +121,6 @@ void hci_uart_set_flow_control(struct hci_uart *hu, bool enable);
121121
void hci_uart_set_speeds(struct hci_uart *hu, unsigned int init_speed,
122122
unsigned int oper_speed);
123123

124-
#ifdef CONFIG_BT_HCIUART_H4
125-
int h4_init(void);
126-
int h4_deinit(void);
127-
128124
struct h4_recv_pkt {
129125
u8 type; /* Packet type */
130126
u8 hlen; /* Header length */
@@ -162,6 +158,10 @@ struct h4_recv_pkt {
162158
.lsize = 2, \
163159
.maxlen = HCI_MAX_FRAME_SIZE \
164160

161+
#ifdef CONFIG_BT_HCIUART_H4
162+
int h4_init(void);
163+
int h4_deinit(void);
164+
165165
struct sk_buff *h4_recv_buf(struct hci_dev *hdev, struct sk_buff *skb,
166166
const unsigned char *buffer, int count,
167167
const struct h4_recv_pkt *pkts, int pkts_count);

‎drivers/net/can/rcar/rcar_canfd.c‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -823,9 +823,6 @@ static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv)
823823
/* Reset Global error flags */
824824
rcar_canfd_write(gpriv->base, RCANFD_GERFL, 0x0);
825825

826-
/* Set the controller into appropriate mode */
827-
rcar_canfd_set_mode(gpriv);
828-
829826
/* Transition all Channels to reset mode */
830827
for_each_set_bit(ch, &gpriv->channels_mask, gpriv->info->max_channels) {
831828
rcar_canfd_clear_bit(gpriv->base,
@@ -844,6 +841,10 @@ static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv)
844841
return err;
845842
}
846843
}
844+
845+
/* Set the controller into appropriate mode */
846+
rcar_canfd_set_mode(gpriv);
847+
847848
return 0;
848849
}
849850

‎drivers/net/can/spi/hi311x.c‎

Lines changed: 18 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -545,8 +545,6 @@ static int hi3110_stop(struct net_device *net)
545545

546546
priv->force_quit = 1;
547547
free_irq(spi->irq, priv);
548-
destroy_workqueue(priv->wq);
549-
priv->wq = NULL;
550548

551549
mutex_lock(&priv->hi3110_lock);
552550

@@ -770,34 +768,23 @@ static int hi3110_open(struct net_device *net)
770768
goto out_close;
771769
}
772770

773-
priv->wq = alloc_workqueue("hi3110_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM,
774-
0);
775-
if (!priv->wq) {
776-
ret = -ENOMEM;
777-
goto out_free_irq;
778-
}
779-
INIT_WORK(&priv->tx_work, hi3110_tx_work_handler);
780-
INIT_WORK(&priv->restart_work, hi3110_restart_work_handler);
781-
782771
ret = hi3110_hw_reset(spi);
783772
if (ret)
784-
goto out_free_wq;
773+
goto out_free_irq;
785774

786775
ret = hi3110_setup(net);
787776
if (ret)
788-
goto out_free_wq;
777+
goto out_free_irq;
789778

790779
ret = hi3110_set_normal_mode(spi);
791780
if (ret)
792-
goto out_free_wq;
781+
goto out_free_irq;
793782

794783
netif_wake_queue(net);
795784
mutex_unlock(&priv->hi3110_lock);
796785

797786
return 0;
798787

799-
out_free_wq:
800-
destroy_workqueue(priv->wq);
801788
out_free_irq:
802789
free_irq(spi->irq, priv);
803790
hi3110_hw_sleep(spi);
@@ -812,6 +799,7 @@ static const struct net_device_ops hi3110_netdev_ops = {
812799
.ndo_open = hi3110_open,
813800
.ndo_stop = hi3110_stop,
814801
.ndo_start_xmit = hi3110_hard_start_xmit,
802+
.ndo_change_mtu = can_change_mtu,
815803
};
816804

817805
static const struct ethtool_ops hi3110_ethtool_ops = {
@@ -908,6 +896,15 @@ static int hi3110_can_probe(struct spi_device *spi)
908896
if (ret)
909897
goto out_clk;
910898

899+
priv->wq = alloc_workqueue("hi3110_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM,
900+
0);
901+
if (!priv->wq) {
902+
ret = -ENOMEM;
903+
goto out_clk;
904+
}
905+
INIT_WORK(&priv->tx_work, hi3110_tx_work_handler);
906+
INIT_WORK(&priv->restart_work, hi3110_restart_work_handler);
907+
911908
priv->spi = spi;
912909
mutex_init(&priv->hi3110_lock);
913910

@@ -943,6 +940,8 @@ static int hi3110_can_probe(struct spi_device *spi)
943940
return 0;
944941

945942
error_probe:
943+
destroy_workqueue(priv->wq);
944+
priv->wq = NULL;
946945
hi3110_power_enable(priv->power, 0);
947946

948947
out_clk:
@@ -963,6 +962,9 @@ static void hi3110_can_remove(struct spi_device *spi)
963962

964963
hi3110_power_enable(priv->power, 0);
965964

965+
destroy_workqueue(priv->wq);
966+
priv->wq = NULL;
967+
966968
clk_disable_unprepare(priv->clk);
967969

968970
free_candev(net);

‎drivers/net/can/sun4i_can.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -768,6 +768,7 @@ static const struct net_device_ops sun4ican_netdev_ops = {
768768
.ndo_open = sun4ican_open,
769769
.ndo_stop = sun4ican_close,
770770
.ndo_start_xmit = sun4ican_start_xmit,
771+
.ndo_change_mtu = can_change_mtu,
771772
};
772773

773774
static const struct ethtool_ops sun4ican_ethtool_ops = {

‎drivers/net/can/usb/etas_es58x/es58x_core.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
*
88
* Copyright (c) 2019 Robert Bosch Engineering and Business Solutions. All rights reserved.
99
* Copyright (c) 2020 ETAS K.K.. All rights reserved.
10-
* Copyright (c) 2020-2022 Vincent Mailhol <mailhol.vincent@wanadoo.fr>
10+
* Copyright (c) 2020-2025 Vincent Mailhol <mailhol@kernel.org>
1111
*/
1212

1313
#include <linux/unaligned.h>
@@ -1977,6 +1977,7 @@ static const struct net_device_ops es58x_netdev_ops = {
19771977
.ndo_stop = es58x_stop,
19781978
.ndo_start_xmit = es58x_start_xmit,
19791979
.ndo_eth_ioctl = can_eth_ioctl_hwts,
1980+
.ndo_change_mtu = can_change_mtu,
19801981
};
19811982

19821983
static const struct ethtool_ops es58x_ethtool_ops = {

‎drivers/net/can/usb/mcba_usb.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -761,6 +761,7 @@ static const struct net_device_ops mcba_netdev_ops = {
761761
.ndo_open = mcba_usb_open,
762762
.ndo_stop = mcba_usb_close,
763763
.ndo_start_xmit = mcba_usb_start_xmit,
764+
.ndo_change_mtu = can_change_mtu,
764765
};
765766

766767
static const struct ethtool_ops mcba_ethtool_ops = {

‎drivers/net/can/usb/peak_usb/pcan_usb_core.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ void peak_usb_update_ts_now(struct peak_time_ref *time_ref, u32 ts_now)
111111
u32 delta_ts = time_ref->ts_dev_2 - time_ref->ts_dev_1;
112112

113113
if (time_ref->ts_dev_2 < time_ref->ts_dev_1)
114-
delta_ts &= (1 << time_ref->adapter->ts_used_bits) - 1;
114+
delta_ts &= (1ULL << time_ref->adapter->ts_used_bits) - 1;
115115

116116
time_ref->ts_total += delta_ts;
117117
}

‎drivers/net/dsa/lantiq_gswip.c‎

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -685,18 +685,27 @@ static int gswip_add_single_port_br(struct gswip_priv *priv, int port, bool add)
685685
return 0;
686686
}
687687

688-
static int gswip_port_enable(struct dsa_switch *ds, int port,
689-
struct phy_device *phydev)
688+
static int gswip_port_setup(struct dsa_switch *ds, int port)
690689
{
691690
struct gswip_priv *priv = ds->priv;
692691
int err;
693692

694693
if (!dsa_is_cpu_port(ds, port)) {
695-
u32 mdio_phy = 0;
696-
697694
err = gswip_add_single_port_br(priv, port, true);
698695
if (err)
699696
return err;
697+
}
698+
699+
return 0;
700+
}
701+
702+
static int gswip_port_enable(struct dsa_switch *ds, int port,
703+
struct phy_device *phydev)
704+
{
705+
struct gswip_priv *priv = ds->priv;
706+
707+
if (!dsa_is_cpu_port(ds, port)) {
708+
u32 mdio_phy = 0;
700709

701710
if (phydev)
702711
mdio_phy = phydev->mdio.addr & GSWIP_MDIO_PHY_ADDR_MASK;
@@ -1359,8 +1368,9 @@ static int gswip_port_fdb(struct dsa_switch *ds, int port,
13591368
int i;
13601369
int err;
13611370

1371+
/* Operation not supported on the CPU port, don't throw errors */
13621372
if (!bridge)
1363-
return -EINVAL;
1373+
return 0;
13641374

13651375
for (i = max_ports; i < ARRAY_SIZE(priv->vlans); i++) {
13661376
if (priv->vlans[i].bridge == bridge) {
@@ -1829,6 +1839,7 @@ static const struct phylink_mac_ops gswip_phylink_mac_ops = {
18291839
static const struct dsa_switch_ops gswip_xrx200_switch_ops = {
18301840
.get_tag_protocol = gswip_get_tag_protocol,
18311841
.setup = gswip_setup,
1842+
.port_setup = gswip_port_setup,
18321843
.port_enable = gswip_port_enable,
18331844
.port_disable = gswip_port_disable,
18341845
.port_bridge_join = gswip_port_bridge_join,

‎drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -244,7 +244,7 @@ bnxt_tc_parse_pedit(struct bnxt *bp, struct bnxt_tc_actions *actions,
244244
offset < offset_of_ip6_daddr + 16) {
245245
actions->nat.src_xlate = false;
246246
idx = (offset - offset_of_ip6_daddr) / 4;
247-
actions->nat.l3.ipv6.saddr.s6_addr32[idx] = htonl(val);
247+
actions->nat.l3.ipv6.daddr.s6_addr32[idx] = htonl(val);
248248
} else {
249249
netdev_err(bp->dev,
250250
"%s: IPv6_hdr: Invalid pedit field\n",

0 commit comments

Comments
 (0)