Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d1041cdc authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 

Pull networking fixes from David Miller:

 1) Fix use-after-free in IPSEC input parsing, desintation address
    pointer was loaded before pskb_may_pull() which can change the SKB
    data pointers. From Florian Westphal.

 2) Stack out-of-bounds read in xfrm_state_find(), from Steffen
    Klassert.

 3) IPVS state of SKB is not properly reset when moving between
    namespaces, from Ye Yin.

 4) Fix crash in asix driver suspend and resume, from Andrey Konovalov.

 5) Don't deliver ipv6 l2tp tunnel packets to ipv4 l2tp tunnels, and
    vice versa, from Guillaume Nault.

 6) Fix DSACK undo on non-dup ACKs, from Priyaranjan Jha.

 7) Fix regression in bond_xmit_hash()'s behavior after the TCP port
    selection changes back in 4.2, from Hangbin Liu.

 8) Two divide by zero bugs in USB networking drivers when parsing
    descriptors, from Bjorn Mork.

 9) Fix bonding slaves being stuck in BOND_LINK_FAIL state, from Jay
    Vosburgh.

10) Missing skb_reset_mac_header() in qmi_wwan, from Kristian Evensen.

11) Fix the destruction of tc action object races properly, from Cong
    Wang.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (31 commits)
  cls_u32: use tcf_exts_get_net() before call_rcu()
  cls_tcindex: use tcf_exts_get_net() before call_rcu()
  cls_rsvp: use tcf_exts_get_net() before call_rcu()
  cls_route: use tcf_exts_get_net() before call_rcu()
  cls_matchall: use tcf_exts_get_net() before call_rcu()
  cls_fw: use tcf_exts_get_net() before call_rcu()
  cls_flower: use tcf_exts_get_net() before call_rcu()
  cls_flow: use tcf_exts_get_net() before call_rcu()
  cls_cgroup: use tcf_exts_get_net() before call_rcu()
  cls_bpf: use tcf_exts_get_net() before call_rcu()
  cls_basic: use tcf_exts_get_net() before call_rcu()
  net_sched: introduce tcf_exts_get_net() and tcf_exts_put_net()
  Revert "net_sched: hold netns refcnt for each action"
  net: usb: asix: fill null-ptr-deref in asix_suspend
  Revert "net: usb: asix: fill null-ptr-deref in asix_suspend"
  qmi_wwan: Add missing skb_reset_mac_header-call
  bonding: fix slave stuck in BOND_LINK_FAIL state
  qrtr: Move to postcore_initcall
  net: qmi_wwan: fix divide by 0 on bad descriptors
  net: cdc_ether: fix divide by 0 on bad descriptors
  ...
parents 87df2617 6a172802

drivers/net/bonding/bond_main.c

+2 −1
Original line number Diff line number Diff line
@@ -2042,6 +2042,7 @@ static int bond_miimon_inspect(struct bonding *bond) 


	bond_for_each_slave_rcu(bond, slave, iter) {

		slave->new_link = BOND_LINK_NOCHANGE;

		slave->link_new_state = slave->link;



		link_state = bond_check_dev_link(bond, slave->dev, 0);
@@ -3253,7 +3254,7 @@ u32 bond_xmit_hash(struct bonding *bond, struct sk_buff *skb) 
	hash ^= (hash >> 16);

	hash ^= (hash >> 8);



	return hash;

	return hash >> 1;

}



/*-------------------------- Device entry points ----------------------------*/

drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h

+3 −3
Original line number Diff line number Diff line
@@ -37,7 +37,7 @@ 


#define T4FW_VERSION_MAJOR 0x01

#define T4FW_VERSION_MINOR 0x10

#define T4FW_VERSION_MICRO 0x2D

#define T4FW_VERSION_MICRO 0x3F

#define T4FW_VERSION_BUILD 0x00



#define T4FW_MIN_VERSION_MAJOR 0x01
@@ -46,7 +46,7 @@ 


#define T5FW_VERSION_MAJOR 0x01

#define T5FW_VERSION_MINOR 0x10

#define T5FW_VERSION_MICRO 0x2D

#define T5FW_VERSION_MICRO 0x3F

#define T5FW_VERSION_BUILD 0x00



#define T5FW_MIN_VERSION_MAJOR 0x00
@@ -55,7 +55,7 @@ 


#define T6FW_VERSION_MAJOR 0x01

#define T6FW_VERSION_MINOR 0x10

#define T6FW_VERSION_MICRO 0x2D

#define T6FW_VERSION_MICRO 0x3F

#define T6FW_VERSION_BUILD 0x00



#define T6FW_MIN_VERSION_MAJOR 0x00

drivers/net/ethernet/marvell/mvpp2.c

+4 −0
Original line number Diff line number Diff line
@@ -6747,6 +6747,9 @@ static int mvpp2_irqs_init(struct mvpp2_port *port) 
	for (i = 0; i < port->nqvecs; i++) {

		struct mvpp2_queue_vector *qv = port->qvecs + i;



		if (qv->type == MVPP2_QUEUE_VECTOR_PRIVATE)

			irq_set_status_flags(qv->irq, IRQ_NO_BALANCING);



		err = request_irq(qv->irq, mvpp2_isr, 0, port->dev->name, qv);

		if (err)

			goto err;
@@ -6776,6 +6779,7 @@ static void mvpp2_irqs_deinit(struct mvpp2_port *port) 
		struct mvpp2_queue_vector *qv = port->qvecs + i;



		irq_set_affinity_hint(qv->irq, NULL);

		irq_clear_status_flags(qv->irq, IRQ_NO_BALANCING);

		free_irq(qv->irq, qv);

	}

}

drivers/net/ethernet/mellanox/mlx5/core/en_fs.c

+8 −5
Original line number Diff line number Diff line
@@ -365,21 +365,24 @@ static void mlx5e_execute_l2_action(struct mlx5e_priv *priv, 
				    struct mlx5e_l2_hash_node *hn)

{

	u8 action = hn->action;

	u8 mac_addr[ETH_ALEN];

	int l2_err = 0;



	ether_addr_copy(mac_addr, hn->ai.addr);



	switch (action) {

	case MLX5E_ACTION_ADD:

		mlx5e_add_l2_flow_rule(priv, &hn->ai, MLX5E_FULLMATCH);

		if (!is_multicast_ether_addr(hn->ai.addr)) {

			l2_err = mlx5_mpfs_add_mac(priv->mdev, hn->ai.addr);

		if (!is_multicast_ether_addr(mac_addr)) {

			l2_err = mlx5_mpfs_add_mac(priv->mdev, mac_addr);

			hn->mpfs = !l2_err;

		}

		hn->action = MLX5E_ACTION_NONE;

		break;



	case MLX5E_ACTION_DEL:

		if (!is_multicast_ether_addr(hn->ai.addr) && hn->mpfs)

			l2_err = mlx5_mpfs_del_mac(priv->mdev, hn->ai.addr);

		if (!is_multicast_ether_addr(mac_addr) && hn->mpfs)

			l2_err = mlx5_mpfs_del_mac(priv->mdev, mac_addr);

		mlx5e_del_l2_flow_rule(priv, &hn->ai);

		mlx5e_del_l2_from_hash(hn);

		break;
@@ -387,7 +390,7 @@ static void mlx5e_execute_l2_action(struct mlx5e_priv *priv, 


	if (l2_err)

		netdev_warn(priv->netdev, "MPFS, failed to %s mac %pM, err(%d)\n",

			    action == MLX5E_ACTION_ADD ? "add" : "del", hn->ai.addr, l2_err);

			    action == MLX5E_ACTION_ADD ? "add" : "del", mac_addr, l2_err);

}



static void mlx5e_sync_netdev_addr(struct mlx5e_priv *priv)

drivers/net/usb/asix_devices.c

+2 −2
Original line number Diff line number Diff line
@@ -626,7 +626,7 @@ static int asix_suspend(struct usb_interface *intf, pm_message_t message) 
	struct usbnet *dev = usb_get_intfdata(intf);

	struct asix_common_private *priv = dev->driver_priv;



	if (priv->suspend)

	if (priv && priv->suspend)

		priv->suspend(dev);



	return usbnet_suspend(intf, message);
@@ -678,7 +678,7 @@ static int asix_resume(struct usb_interface *intf) 
	struct usbnet *dev = usb_get_intfdata(intf);

	struct asix_common_private *priv = dev->driver_priv;



	if (priv->resume)

	if (priv && priv->resume)

		priv->resume(dev);



	return usbnet_resume(intf);