Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 926af627 authored by Linus Torvalds's avatar Linus Torvalds
Browse files
Pull networking fixes from David Miller:

 1) Load correct firmware in rtl8192ce wireless driver, from Jurij
    Smakov.

 2) Fix leak of tx_ring and tx_cq due to overwriting in mlx4 driver,
    from Martin KaFai Lau.

 3) Need to reference count PHY driver module when it is attached, from
    Mao Wenan.

 4) Don't do zero length vzalloc() in ethtool register dump, from
    Stanislaw Gruszka.

 5) Defer net_disable_timestamp() to a workqueue to get out of locking
    issues, from Eric Dumazet.

 6) We cannot drop the SKB dst when IP options refer to them, fix also
    from Eric Dumazet.

 7) Incorrect packet header offset calculations in ip6_gre, again from
    Eric Dumazet.

 8) Missing tcp_v6_restore_cb() causes use-after-free, from Eric too.

 9) tcp_splice_read() can get into an infinite loop with URG, and hey
    it's from Eric once more.

10) vnet_hdr_sz can change asynchronously, so read it once during
    decision making in macvtap and tun, from Willem de Bruijn.

11) Can't use kernel stack for DMA transfers in USB networking drivers,
    from Ben Hutchings.

12) Handle csum errors properly in UDP by calling the proper destructor,
    from Eric Dumazet.

13) For non-deterministic softirq run when scheduling NAPI from a
    workqueue in mlx4, from Benjamin Poirier.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (28 commits)
  sctp: check af before verify address in sctp_addr_id2transport
  sctp: avoid BUG_ON on sctp_wait_for_sndbuf
  mlx4: Invoke softirqs after napi_reschedule
  udp: properly cope with csum errors
  catc: Use heap buffer for memory size test
  catc: Combine failure cleanup code in catc_probe()
  rtl8150: Use heap buffers for all register access
  pegasus: Use heap buffers for all register access
  macvtap: read vnet_hdr_size once
  tun: read vnet_hdr_sz once
  tcp: avoid infinite loop in tcp_splice_read()
  hns: avoid stack overflow with CONFIG_KASAN
  ipv6: Fix IPv6 packet loss in scenarios involving roaming + snooping switches
  ipv6: tcp: add a missing tcp_v6_restore_cb()
  nl80211: Fix mesh HT operation check
  mac80211: Fix adding of mesh vendor IEs
  mac80211: Allocate a sync skcipher explicitly for FILS AEAD
  mac80211: Fix FILS AEAD protection in Association Request frame
  ip6_gre: fix ip6gre_err() invalid reads
  netlabel: out of bound access in cipso_v4_validate()
  ...
parents b6789123 912964ea
Loading
Loading
Loading
Loading
+2 −6
Original line number Original line Diff line number Diff line
@@ -1014,9 +1014,7 @@


static inline void dsaf_write_reg(void __iomem *base, u32 reg, u32 value)
static inline void dsaf_write_reg(void __iomem *base, u32 reg, u32 value)
{
{
	u8 __iomem *reg_addr = ACCESS_ONCE(base);
	writel(value, base + reg);

	writel(value, reg_addr + reg);
}
}


#define dsaf_write_dev(a, reg, value) \
#define dsaf_write_dev(a, reg, value) \
@@ -1024,9 +1022,7 @@ static inline void dsaf_write_reg(void __iomem *base, u32 reg, u32 value)


static inline u32 dsaf_read_reg(u8 __iomem *base, u32 reg)
static inline u32 dsaf_read_reg(u8 __iomem *base, u32 reg)
{
{
	u8 __iomem *reg_addr = ACCESS_ONCE(base);
	return readl(base + reg);

	return readl(reg_addr + reg);
}
}


static inline void dsaf_write_syscon(struct regmap *base, u32 reg, u32 value)
static inline void dsaf_write_syscon(struct regmap *base, u32 reg, u32 value)
+2 −2
Original line number Original line Diff line number Diff line
@@ -1099,7 +1099,7 @@ static int mlx4_en_set_ringparam(struct net_device *dev,
	memcpy(&new_prof, priv->prof, sizeof(struct mlx4_en_port_profile));
	memcpy(&new_prof, priv->prof, sizeof(struct mlx4_en_port_profile));
	new_prof.tx_ring_size = tx_size;
	new_prof.tx_ring_size = tx_size;
	new_prof.rx_ring_size = rx_size;
	new_prof.rx_ring_size = rx_size;
	err = mlx4_en_try_alloc_resources(priv, tmp, &new_prof);
	err = mlx4_en_try_alloc_resources(priv, tmp, &new_prof, true);
	if (err)
	if (err)
		goto out;
		goto out;


@@ -1774,7 +1774,7 @@ static int mlx4_en_set_channels(struct net_device *dev,
	new_prof.tx_ring_num[TX_XDP] = xdp_count;
	new_prof.tx_ring_num[TX_XDP] = xdp_count;
	new_prof.rx_ring_num = channel->rx_count;
	new_prof.rx_ring_num = channel->rx_count;


	err = mlx4_en_try_alloc_resources(priv, tmp, &new_prof);
	err = mlx4_en_try_alloc_resources(priv, tmp, &new_prof, true);
	if (err)
	if (err)
		goto out;
		goto out;


+25 −10
Original line number Original line Diff line number Diff line
@@ -2042,6 +2042,8 @@ static void mlx4_en_free_resources(struct mlx4_en_priv *priv)
			if (priv->tx_cq[t] && priv->tx_cq[t][i])
			if (priv->tx_cq[t] && priv->tx_cq[t][i])
				mlx4_en_destroy_cq(priv, &priv->tx_cq[t][i]);
				mlx4_en_destroy_cq(priv, &priv->tx_cq[t][i]);
		}
		}
		kfree(priv->tx_ring[t]);
		kfree(priv->tx_cq[t]);
	}
	}


	for (i = 0; i < priv->rx_ring_num; i++) {
	for (i = 0; i < priv->rx_ring_num; i++) {
@@ -2184,9 +2186,11 @@ static void mlx4_en_update_priv(struct mlx4_en_priv *dst,


int mlx4_en_try_alloc_resources(struct mlx4_en_priv *priv,
int mlx4_en_try_alloc_resources(struct mlx4_en_priv *priv,
				struct mlx4_en_priv *tmp,
				struct mlx4_en_priv *tmp,
				struct mlx4_en_port_profile *prof)
				struct mlx4_en_port_profile *prof,
				bool carry_xdp_prog)
{
{
	int t;
	struct bpf_prog *xdp_prog;
	int i, t;


	mlx4_en_copy_priv(tmp, priv, prof);
	mlx4_en_copy_priv(tmp, priv, prof);


@@ -2200,6 +2204,23 @@ int mlx4_en_try_alloc_resources(struct mlx4_en_priv *priv,
		}
		}
		return -ENOMEM;
		return -ENOMEM;
	}
	}

	/* All rx_rings has the same xdp_prog.  Pick the first one. */
	xdp_prog = rcu_dereference_protected(
		priv->rx_ring[0]->xdp_prog,
		lockdep_is_held(&priv->mdev->state_lock));

	if (xdp_prog && carry_xdp_prog) {
		xdp_prog = bpf_prog_add(xdp_prog, tmp->rx_ring_num);
		if (IS_ERR(xdp_prog)) {
			mlx4_en_free_resources(tmp);
			return PTR_ERR(xdp_prog);
		}
		for (i = 0; i < tmp->rx_ring_num; i++)
			rcu_assign_pointer(tmp->rx_ring[i]->xdp_prog,
					   xdp_prog);
	}

	return 0;
	return 0;
}
}


@@ -2214,7 +2235,6 @@ void mlx4_en_destroy_netdev(struct net_device *dev)
{
{
	struct mlx4_en_priv *priv = netdev_priv(dev);
	struct mlx4_en_priv *priv = netdev_priv(dev);
	struct mlx4_en_dev *mdev = priv->mdev;
	struct mlx4_en_dev *mdev = priv->mdev;
	int t;


	en_dbg(DRV, priv, "Destroying netdev on port:%d\n", priv->port);
	en_dbg(DRV, priv, "Destroying netdev on port:%d\n", priv->port);


@@ -2248,11 +2268,6 @@ void mlx4_en_destroy_netdev(struct net_device *dev)
	mlx4_en_free_resources(priv);
	mlx4_en_free_resources(priv);
	mutex_unlock(&mdev->state_lock);
	mutex_unlock(&mdev->state_lock);


	for (t = 0; t < MLX4_EN_NUM_TX_TYPES; t++) {
		kfree(priv->tx_ring[t]);
		kfree(priv->tx_cq[t]);
	}

	free_netdev(dev);
	free_netdev(dev);
}
}


@@ -2755,7 +2770,7 @@ static int mlx4_xdp_set(struct net_device *dev, struct bpf_prog *prog)
		en_warn(priv, "Reducing the number of TX rings, to not exceed the max total rings number.\n");
		en_warn(priv, "Reducing the number of TX rings, to not exceed the max total rings number.\n");
	}
	}


	err = mlx4_en_try_alloc_resources(priv, tmp, &new_prof);
	err = mlx4_en_try_alloc_resources(priv, tmp, &new_prof, false);
	if (err) {
	if (err) {
		if (prog)
		if (prog)
			bpf_prog_sub(prog, priv->rx_ring_num - 1);
			bpf_prog_sub(prog, priv->rx_ring_num - 1);
@@ -3499,7 +3514,7 @@ int mlx4_en_reset_config(struct net_device *dev,
	memcpy(&new_prof, priv->prof, sizeof(struct mlx4_en_port_profile));
	memcpy(&new_prof, priv->prof, sizeof(struct mlx4_en_port_profile));
	memcpy(&new_prof.hwtstamp_config, &ts_config, sizeof(ts_config));
	memcpy(&new_prof.hwtstamp_config, &ts_config, sizeof(ts_config));


	err = mlx4_en_try_alloc_resources(priv, tmp, &new_prof);
	err = mlx4_en_try_alloc_resources(priv, tmp, &new_prof, true);
	if (err)
	if (err)
		goto out;
		goto out;


+4 −1
Original line number Original line Diff line number Diff line
@@ -514,8 +514,11 @@ void mlx4_en_recover_from_oom(struct mlx4_en_priv *priv)
		return;
		return;


	for (ring = 0; ring < priv->rx_ring_num; ring++) {
	for (ring = 0; ring < priv->rx_ring_num; ring++) {
		if (mlx4_en_is_ring_empty(priv->rx_ring[ring]))
		if (mlx4_en_is_ring_empty(priv->rx_ring[ring])) {
			local_bh_disable();
			napi_reschedule(&priv->rx_cq[ring]->napi);
			napi_reschedule(&priv->rx_cq[ring]->napi);
			local_bh_enable();
		}
	}
	}
}
}


+2 −1
Original line number Original line Diff line number Diff line
@@ -679,7 +679,8 @@ void mlx4_en_set_stats_bitmap(struct mlx4_dev *dev,


int mlx4_en_try_alloc_resources(struct mlx4_en_priv *priv,
int mlx4_en_try_alloc_resources(struct mlx4_en_priv *priv,
				struct mlx4_en_priv *tmp,
				struct mlx4_en_priv *tmp,
				struct mlx4_en_port_profile *prof);
				struct mlx4_en_port_profile *prof,
				bool carry_xdp_prog);
void mlx4_en_safe_replace_resources(struct mlx4_en_priv *priv,
void mlx4_en_safe_replace_resources(struct mlx4_en_priv *priv,
				    struct mlx4_en_priv *tmp);
				    struct mlx4_en_priv *tmp);


Loading