Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fca83168 authored by Linus Torvalds's avatar Linus Torvalds
Browse files
Pull networking fixes from David Miller:

 1) Fix erroneous netfilter drop of SIP packets generated by some Cisco
    phones, from Patrick McHardy.

 2) Fix netfilter IPSET refcounting in list_set_add(), from Jozsef
    Kadlecsik.

 3) Fix TCP syncookies route lookup key, we don't use the same values we
    would use for the usual SYN receive processing, from Dmitry Popov.

 4) Fix NULL deref in bond_slave_netdev_event(), from Nikolay
    Aleksandrov.

 5) When bonding enslave fails, we can forget to clear the IFF_BONDING
    bit, fix also from Nikolay Aleksandrov.

 6) skb->csum_start is 16-bits, which is almost always just fine.  But
    if we reallocate the headroom of an SKB this can push the
    skb->csum_start value outside of it's valid range.  This can easily
    happen when collapsing multiple SKBs from the retransmit queue
    together.

    Fix from Thomas Graf.

 7) Fix NULL deref in be2net driver due to missing check of
    __vlan_put_tag() return value, from Ivan Vecera.

 8) tun_set_iff() returns zero instead of error code on failure, fix
    from Wei Yongjun.

 9) Like GARP, 802 MRP needs to hold the app->lock when adding MAD
    events and queueing PDUs.  Fix from David Ward.

10) Build fix, MVMDIO needs PHYLIB, from Thomas Petazzoni..

11) Fix mac80211 static with ipv6 modular build, from Cong Wang.

12) If userland specifies a path cost explicitly, do not override it
    when the carrier state changes.  From Stephen Hemminger.

13) mvnets calculates the TX queue to use incorrectly resulting in
    garbage pointer derefs and crashes, fix from Willy Tarreau.

14) cdc_mbim does erroneous sizeof(ETH_HLEN).  Fix from Bjorn Mork.

15) IP fragmentation can leak a refcount-less route out from an RCU
    protected section.  This results in crashes and all sorts of hard to
    diagnose behavior.  Fix from Eric Dumazet.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (24 commits)
  qlcnic: fix beaconing test for 82xx adapter
  net: drop dst before queueing fragments
  net: fec: fix regression in link change accounting
  net: cdc_mbim: remove bogus sizeof()
  drivers: net: ethernet: cpsw: get slave VLAN id from slave node instead of cpsw node
  net: mvneta: fix improper tx queue usage in mvneta_tx()
  esp4: fix error return code in esp_output()
  bridge: make user modified path cost sticky
  ipv6: statically link register_inet6addr_notifier()
  net: mvmdio: add select PHYLIB
  net/802/mrp: fix possible race condition when calling mrp_pdu_queue()
  tuntap: fix error return code in tun_set_iff()
  be2net: take care of __vlan_put_tag return value
  can: sja1000: fix handling on dt properties on little endian systems
  can: mcp251x: add missing IRQF_ONESHOT to request_threaded_irq
  netfilter: nf_nat: fix race when unloading protocol modules
  tcp: Reallocate headroom if it would overflow csum_start
  stmmac: prevent interrupt loop with MMC RX IPC Counter
  bonding: IFF_BONDING is not stripped on enslave failure
  bonding: fix netdev event NULL pointer dereference
  ...
parents 4f2e2903 361cd29c
Loading
Loading
Loading
Loading
+12 −2
Original line number Original line Diff line number Diff line
@@ -1906,6 +1906,7 @@ err_detach:
	write_unlock_bh(&bond->lock);
	write_unlock_bh(&bond->lock);


err_close:
err_close:
	slave_dev->priv_flags &= ~IFF_BONDING;
	dev_close(slave_dev);
	dev_close(slave_dev);


err_unset_master:
err_unset_master:
@@ -3168,11 +3169,20 @@ static int bond_slave_netdev_event(unsigned long event,
				   struct net_device *slave_dev)
				   struct net_device *slave_dev)
{
{
	struct slave *slave = bond_slave_get_rtnl(slave_dev);
	struct slave *slave = bond_slave_get_rtnl(slave_dev);
	struct bonding *bond = slave->bond;
	struct bonding *bond;
	struct net_device *bond_dev = slave->bond->dev;
	struct net_device *bond_dev;
	u32 old_speed;
	u32 old_speed;
	u8 old_duplex;
	u8 old_duplex;


	/* A netdev event can be generated while enslaving a device
	 * before netdev_rx_handler_register is called in which case
	 * slave will be NULL
	 */
	if (!slave)
		return NOTIFY_DONE;
	bond_dev = slave->bond->dev;
	bond = slave->bond;

	switch (event) {
	switch (event) {
	case NETDEV_UNREGISTER:
	case NETDEV_UNREGISTER:
		if (bond->setup_by_slave)
		if (bond->setup_by_slave)
+8 −2
Original line number Original line Diff line number Diff line
@@ -929,6 +929,7 @@ static int mcp251x_open(struct net_device *net)
	struct mcp251x_priv *priv = netdev_priv(net);
	struct mcp251x_priv *priv = netdev_priv(net);
	struct spi_device *spi = priv->spi;
	struct spi_device *spi = priv->spi;
	struct mcp251x_platform_data *pdata = spi->dev.platform_data;
	struct mcp251x_platform_data *pdata = spi->dev.platform_data;
	unsigned long flags;
	int ret;
	int ret;


	ret = open_candev(net);
	ret = open_candev(net);
@@ -945,9 +946,14 @@ static int mcp251x_open(struct net_device *net)
	priv->tx_skb = NULL;
	priv->tx_skb = NULL;
	priv->tx_len = 0;
	priv->tx_len = 0;


	flags = IRQF_ONESHOT;
	if (pdata->irq_flags)
		flags |= pdata->irq_flags;
	else
		flags |= IRQF_TRIGGER_FALLING;

	ret = request_threaded_irq(spi->irq, NULL, mcp251x_can_ist,
	ret = request_threaded_irq(spi->irq, NULL, mcp251x_can_ist,
		  pdata->irq_flags ? pdata->irq_flags : IRQF_TRIGGER_FALLING,
				   flags, DEVICE_NAME, priv);
		  DEVICE_NAME, priv);
	if (ret) {
	if (ret) {
		dev_err(&spi->dev, "failed to acquire irq %d\n", spi->irq);
		dev_err(&spi->dev, "failed to acquire irq %d\n", spi->irq);
		if (pdata->transceiver_enable)
		if (pdata->transceiver_enable)
+15 −16
Original line number Original line Diff line number Diff line
@@ -96,8 +96,8 @@ static int sja1000_ofp_probe(struct platform_device *ofdev)
	struct net_device *dev;
	struct net_device *dev;
	struct sja1000_priv *priv;
	struct sja1000_priv *priv;
	struct resource res;
	struct resource res;
	const u32 *prop;
	u32 prop;
	int err, irq, res_size, prop_size;
	int err, irq, res_size;
	void __iomem *base;
	void __iomem *base;


	err = of_address_to_resource(np, 0, &res);
	err = of_address_to_resource(np, 0, &res);
@@ -138,27 +138,27 @@ static int sja1000_ofp_probe(struct platform_device *ofdev)
	priv->read_reg = sja1000_ofp_read_reg;
	priv->read_reg = sja1000_ofp_read_reg;
	priv->write_reg = sja1000_ofp_write_reg;
	priv->write_reg = sja1000_ofp_write_reg;


	prop = of_get_property(np, "nxp,external-clock-frequency", &prop_size);
	err = of_property_read_u32(np, "nxp,external-clock-frequency", &prop);
	if (prop && (prop_size ==  sizeof(u32)))
	if (!err)
		priv->can.clock.freq = *prop / 2;
		priv->can.clock.freq = prop / 2;
	else
	else
		priv->can.clock.freq = SJA1000_OFP_CAN_CLOCK; /* default */
		priv->can.clock.freq = SJA1000_OFP_CAN_CLOCK; /* default */


	prop = of_get_property(np, "nxp,tx-output-mode", &prop_size);
	err = of_property_read_u32(np, "nxp,tx-output-mode", &prop);
	if (prop && (prop_size == sizeof(u32)))
	if (!err)
		priv->ocr |= *prop & OCR_MODE_MASK;
		priv->ocr |= prop & OCR_MODE_MASK;
	else
	else
		priv->ocr |= OCR_MODE_NORMAL; /* default */
		priv->ocr |= OCR_MODE_NORMAL; /* default */


	prop = of_get_property(np, "nxp,tx-output-config", &prop_size);
	err = of_property_read_u32(np, "nxp,tx-output-config", &prop);
	if (prop && (prop_size == sizeof(u32)))
	if (!err)
		priv->ocr |= (*prop << OCR_TX_SHIFT) & OCR_TX_MASK;
		priv->ocr |= (prop << OCR_TX_SHIFT) & OCR_TX_MASK;
	else
	else
		priv->ocr |= OCR_TX0_PULLDOWN; /* default */
		priv->ocr |= OCR_TX0_PULLDOWN; /* default */


	prop = of_get_property(np, "nxp,clock-out-frequency", &prop_size);
	err = of_property_read_u32(np, "nxp,clock-out-frequency", &prop);
	if (prop && (prop_size == sizeof(u32)) && *prop) {
	if (!err && prop) {
		u32 divider = priv->can.clock.freq * 2 / *prop;
		u32 divider = priv->can.clock.freq * 2 / prop;


		if (divider > 1)
		if (divider > 1)
			priv->cdr |= divider / 2 - 1;
			priv->cdr |= divider / 2 - 1;
@@ -168,8 +168,7 @@ static int sja1000_ofp_probe(struct platform_device *ofdev)
		priv->cdr |= CDR_CLK_OFF; /* default */
		priv->cdr |= CDR_CLK_OFF; /* default */
	}
	}


	prop = of_get_property(np, "nxp,no-comparator-bypass", NULL);
	if (!of_property_read_bool(np, "nxp,no-comparator-bypass"))
	if (!prop)
		priv->cdr |= CDR_CBP; /* default */
		priv->cdr |= CDR_CBP; /* default */


	priv->irq_flags = IRQF_SHARED;
	priv->irq_flags = IRQF_SHARED;
+3 −2
Original line number Original line Diff line number Diff line
@@ -759,7 +759,8 @@ static struct sk_buff *be_insert_vlan_in_pkt(struct be_adapter *adapter,


	if (vlan_tx_tag_present(skb)) {
	if (vlan_tx_tag_present(skb)) {
		vlan_tag = be_get_tx_vlan_tag(adapter, skb);
		vlan_tag = be_get_tx_vlan_tag(adapter, skb);
		__vlan_put_tag(skb, vlan_tag);
		skb = __vlan_put_tag(skb, vlan_tag);
		if (skb)
			skb->vlan_tci = 0;
			skb->vlan_tci = 0;
	}
	}


+1 −0
Original line number Original line Diff line number Diff line
@@ -1002,6 +1002,7 @@ static void fec_enet_adjust_link(struct net_device *ndev)
	} else {
	} else {
		if (fep->link) {
		if (fep->link) {
			fec_stop(ndev);
			fec_stop(ndev);
			fep->link = phy_dev->link;
			status_change = 1;
			status_change = 1;
		}
		}
	}
	}
Loading