1. 19 May, 2023 9 commits
  2. 18 May, 2023 10 commits
    • Linus Torvalds's avatar
      Merge tag 'net-6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 1f594fe7
      Linus Torvalds authored
      Pull networking fixes from Paolo Abeni:
       "Including fixes from can, xfrm, bluetooth and netfilter.
      
        Current release - regressions:
      
         - ipv6: fix RCU splat in ipv6_route_seq_show()
      
         - wifi: iwlwifi: disable RFI feature
      
        Previous releases - regressions:
      
         - tcp: fix possible sk_priority leak in tcp_v4_send_reset()
      
         - tipc: do not update mtu if msg_max is too small in mtu negotiation
      
         - netfilter: fix null deref on element insertion
      
         - devlink: change per-devlink netdev notifier to static one
      
         - phylink: fix ksettings_set() ethtool call
      
         - wifi: mac80211: fortify the spinlock against deadlock by interrupt
      
         - wifi: brcmfmac: check for probe() id argument being NULL
      
         - eth: ice:
            - fix undersized tx_flags variable
            - fix ice VF reset during iavf initialization
      
         - eth: hns3: fix sending pfc frames after reset issue
      
        Previous releases - always broken:
      
         - xfrm: release all offloaded policy memory
      
         - nsh: use correct mac_offset to unwind gso skb in nsh_gso_segment()
      
         - vsock: avoid to close connected socket after the timeout
      
         - dsa: rzn1-a5psw: enable management frames for CPU port
      
         - eth: virtio_net: fix error unwinding of XDP initialization
      
         - eth: tun: fix memory leak for detached NAPI queue.
      
        Misc:
      
         - MAINTAINERS: sctp: move Neil to CREDITS"
      
      * tag 'net-6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (107 commits)
        MAINTAINERS: skip CCing netdev for Bluetooth patches
        mdio_bus: unhide mdio_bus_init prototype
        bridge: always declare tunnel functions
        atm: hide unused procfs functions
        net: isa: include net/Space.h
        Revert "ARM: dts: stm32: add CAN support on stm32f746"
        netfilter: nft_set_rbtree: fix null deref on element insertion
        netfilter: nf_tables: fix nft_trans type confusion
        netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT
        net: wwan: t7xx: Ensure init is completed before system sleep
        net: selftests: Fix optstring
        net: pcs: xpcs: fix C73 AN not getting enabled
        net: wwan: iosm: fix NULL pointer dereference when removing device
        vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit()
        mailmap: add entries for Nikolay Aleksandrov
        igb: fix bit_shift to be in [1..8] range
        net: dsa: mv88e6xxx: Fix mv88e6393x EPC write command offset
        cassini: Fix a memory leak in the error handling path of cas_init_one()
        tun: Fix memory leak for detached NAPI queue.
        can: kvaser_pciefd: Disable interrupts in probe error path
        ...
      1f594fe7
    • Linus Torvalds's avatar
      Merge tag 'media/v6.4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media · b802651b
      Linus Torvalds authored
      Pull media fixes from Mauro Carvalho Chehab:
       "Several fixes for the dvb core and drivers:
      
         - fix UAF and null pointer de-reference in DVB core
      
         - fix kernel runtime warning for blocking operation in wait_event*()
           in dvb core
      
         - fix write size bug in DVB conditional access core
      
         - fix dvb demux continuity counter debug check logic
      
         - randconfig build fixes in pvrusb2 and mn88443x
      
         - fix memory leak in ttusb-dec
      
         - fix netup_unidvb probe-time error check logic
      
         - improve error handling in dw2102 if it can't retrieve DVB MAC
           address"
      
      * tag 'media/v6.4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
        media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
        media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
        media: dvb-core: Fix use-after-free due to race at dvb_register_device()
        media: dvb-core: Fix use-after-free due on race condition at dvb_net
        media: dvb-core: Fix use-after-free on race condition at dvb_frontend
        media: mn88443x: fix !CONFIG_OF error by drop of_match_ptr from ID table
        media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb()
        media: dvb_ca_en50221: fix a size write bug
        media: netup_unidvb: fix irq init by register it at the end of probe
        media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address
        media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer()
        media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer
        media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer()
        media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer()
        media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer()
        media: netup_unidvb: fix use-after-free at del_timer()
        media: dvb_demux: fix a bug for the continuity counter
        media: pvrusb2: fix DVB_CORE dependency
      b802651b
    • Paolo Abeni's avatar
      Merge tag 'linux-can-fixes-for-6.4-20230518' of... · 6e42fae0
      Paolo Abeni authored
      Merge tag 'linux-can-fixes-for-6.4-20230518' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can
      
      Marc Kleine-Budde says:
      
      ====================
      pull-request: can 2023-05-18
      
      this is a pull request of 7 patches for net/master.
      
      The first 6 patches are by Jimmy Assarsson and fix several bugs in the
      kvaser_pciefd driver.
      
      The latest patch is from me and reverts a change in stm32f746.dtsi
      that causes build errors due to a missing dependent patch.
      
      * tag 'linux-can-fixes-for-6.4-20230518' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can:
        Revert "ARM: dts: stm32: add CAN support on stm32f746"
        can: kvaser_pciefd: Disable interrupts in probe error path
        can: kvaser_pciefd: Do not send EFLUSH command on TFD interrupt
        can: kvaser_pciefd: Empty SRB buffer in probe
        can: kvaser_pciefd: Call request_irq() before enabling interrupts
        can: kvaser_pciefd: Clear listen-only bit if not explicitly requested
        can: kvaser_pciefd: Set CAN_STATE_STOPPED in kvaser_pciefd_stop()
      ====================
      
      Link: https://lore.kernel.org/r/20230518073241.1110453-1-mkl@pengutronix.deSigned-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      6e42fae0
    • Jakub Kicinski's avatar
      Merge tag 'nf-23-05-17' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf · 30a0f49d
      Jakub Kicinski authored
      Florian Westphal says:
      
      ====================
      Netfilter fixes for net
      
      1. Silence warning about unused variable when CONFIG_NF_NAT=n, from Tom Rix.
      2. nftables: Fix possible out-of-bounds access, from myself.
      3. nftables: fix null deref+UAF during element insertion into rbtree,
         also from myself.
      
      * tag 'nf-23-05-17' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
        netfilter: nft_set_rbtree: fix null deref on element insertion
        netfilter: nf_tables: fix nft_trans type confusion
        netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT
      ====================
      
      Link: https://lore.kernel.org/r/20230517123756.7353-1-fw@strlen.deSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      30a0f49d
    • Jakub Kicinski's avatar
      Merge tag 'wireless-2023-05-17' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless · c259ad11
      Jakub Kicinski authored
      Kalle Valo says:
      
      ====================
      wireless fixes for v6.4
      
      A lot of fixes this time, for both the stack and the drivers. The
      brcmfmac resume fix has been reported by several people so I would say
      it's the most important here. The iwlwifi RFI workaround is also
      something which was reported as a regression recently.
      
      * tag 'wireless-2023-05-17' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: (31 commits)
        wifi: b43: fix incorrect __packed annotation
        wifi: rtw88: sdio: Always use two consecutive bytes for word operations
        mac80211_hwsim: fix memory leak in hwsim_new_radio_nl
        wifi: iwlwifi: mvm: Add locking to the rate read flow
        wifi: iwlwifi: Don't use valid_links to iterate sta links
        wifi: iwlwifi: mvm: don't trust firmware n_channels
        wifi: iwlwifi: mvm: fix OEM's name in the tas approved list
        wifi: iwlwifi: fix OEM's name in the ppag approved list
        wifi: iwlwifi: mvm: fix initialization of a return value
        wifi: iwlwifi: mvm: fix access to fw_id_to_mac_id
        wifi: iwlwifi: fw: fix DBGI dump
        wifi: iwlwifi: mvm: fix number of concurrent link checks
        wifi: iwlwifi: mvm: fix cancel_delayed_work_sync() deadlock
        wifi: iwlwifi: mvm: don't double-init spinlock
        wifi: iwlwifi: mvm: always free dup_data
        wifi: mac80211: recalc chanctx mindef before assigning
        wifi: mac80211: consider reserved chanctx for mindef
        wifi: mac80211: simplify chanctx allocation
        wifi: mac80211: Abort running color change when stopping the AP
        wifi: mac80211: fix min center freq offset tracing
        ...
      ====================
      
      Link: https://lore.kernel.org/r/20230517151914.B0AF6C433EF@smtp.kernel.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      c259ad11
    • Jakub Kicinski's avatar
      MAINTAINERS: skip CCing netdev for Bluetooth patches · bfa00d8f
      Jakub Kicinski authored
      As requested by Marcel skip netdev for Bluetooth patches.
      Bluetooth has its own mailing list and overloading netdev
      leads to fewer people reading it.
      
      Link: https://lore.kernel.org/netdev/639C8EA4-1F6E-42BE-8F04-E4A753A6EFFC@holtmann.org/Reviewed-by: default avatarSimon Horman <simon.horman@corigine.com>
      Link: https://lore.kernel.org/r/20230517014253.1233333-1-kuba@kernel.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      bfa00d8f
    • Arnd Bergmann's avatar
      mdio_bus: unhide mdio_bus_init prototype · 2e9f8ab6
      Arnd Bergmann authored
      mdio_bus_init() is either used as a local module_init() entry,
      or it gets called in phy_device.c. In the former case, there
      is no declaration, which causes a warning:
      
      drivers/net/phy/mdio_bus.c:1371:12: error: no previous prototype for 'mdio_bus_init' [-Werror=missing-prototypes]
      
      Remove the #ifdef around the declaration to avoid the warning..
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Link: https://lore.kernel.org/r/20230516194625.549249-4-arnd@kernel.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      2e9f8ab6
    • Arnd Bergmann's avatar
      bridge: always declare tunnel functions · 89dcd87c
      Arnd Bergmann authored
      When CONFIG_BRIDGE_VLAN_FILTERING is disabled, two functions are still
      defined but have no prototype or caller. This causes a W=1 warning for
      the missing prototypes:
      
      net/bridge/br_netlink_tunnel.c:29:6: error: no previous prototype for 'vlan_tunid_inrange' [-Werror=missing-prototypes]
      net/bridge/br_netlink_tunnel.c:199:5: error: no previous prototype for 'br_vlan_tunnel_info' [-Werror=missing-prototypes]
      
      The functions are already contitional on CONFIG_BRIDGE_VLAN_FILTERING,
      and I coulnd't easily figure out the right set of #ifdefs, so just
      move the declarations out of the #ifdef to avoid the warning,
      at a small cost in code size over a more elaborate fix.
      
      Fixes: 188c67dd ("net: bridge: vlan options: add support for tunnel id dumping")
      Fixes: 569da082 ("net: bridge: vlan options: add support for tunnel mapping set/del")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Acked-by: default avatarNikolay Aleksandrov <razor@blackwall.org>
      Link: https://lore.kernel.org/r/20230516194625.549249-3-arnd@kernel.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      89dcd87c
    • Arnd Bergmann's avatar
      atm: hide unused procfs functions · fb1b7be9
      Arnd Bergmann authored
      When CONFIG_PROC_FS is disabled, the function declarations for some
      procfs functions are hidden, but the definitions are still build,
      as shown by this compiler warning:
      
      net/atm/resources.c:403:7: error: no previous prototype for 'atm_dev_seq_start' [-Werror=missing-prototypes]
      net/atm/resources.c:409:6: error: no previous prototype for 'atm_dev_seq_stop' [-Werror=missing-prototypes]
      net/atm/resources.c:414:7: error: no previous prototype for 'atm_dev_seq_next' [-Werror=missing-prototypes]
      
      Add another #ifdef to leave these out of the build.
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Link: https://lore.kernel.org/r/20230516194625.549249-2-arnd@kernel.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      fb1b7be9
    • Arnd Bergmann's avatar
      net: isa: include net/Space.h · 067dee65
      Arnd Bergmann authored
      The legacy drivers that still get called from net/Space.c have prototypes
      in net/Space, but this header is not included in most of the files that
      define those functions:
      
      drivers/net/ethernet/cirrus/cs89x0.c:1649:28: error: no previous prototype for 'cs89x0_probe' [-Werror=missing-prototypes]
      drivers/net/ethernet/8390/ne.c:947:28: error: no previous prototype for 'ne_probe' [-Werror=missing-prototypes]
      drivers/net/ethernet/8390/smc-ultra.c:167:28: error: no previous prototype for 'ultra_probe' [-Werror=missing-prototypes]
      drivers/net/ethernet/amd/lance.c:438:28: error: no previous prototype for 'lance_probe' [-Werror=missing-prototypes]
      drivers/net/ethernet/3com/3c515.c:422:20: error: no previous prototype for 'tc515_probe' [-Werror=missing-prototypes]
      
      Add the inclusion to avoids the warnings.
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Link: https://lore.kernel.org/r/20230516194625.549249-1-arnd@kernel.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      067dee65
  3. 17 May, 2023 21 commits
    • Marc Kleine-Budde's avatar
      Revert "ARM: dts: stm32: add CAN support on stm32f746" · 36a6418b
      Marc Kleine-Budde authored
      This reverts commit 0920ccdf.
      
      The commit 0920ccdf ("ARM: dts: stm32: add CAN support on
      stm32f746") depends on the patch "dt-bindings: mfd: stm32f7: add
      binding definition for CAN3" [1], which is not in net/main, yet. This
      results in a parsing error of "stm32f746.dtsi".
      
      So revert this commit.
      
      [1] https://lore.kernel.org/all/20230423172528.1398158-2-dario.binacchi@amarulasolutions.com
      
      Cc: Dario Binacchi <dario.binacchi@amarulasolutions.com>
      Cc: Alexandre TORGUE <alexandre.torgue@foss.st.com>
      Reported-by: default avatarkernel test robot <lkp@intel.com>
      Closes: https://lore.kernel.org/oe-kbuild-all/202305172108.x5acbaQG-lkp@intel.com
      Closes: https://lore.kernel.org/oe-kbuild-all/202305172130.eGGEUhpi-lkp@intel.com
      Fixes: 0920ccdf ("ARM: dts: stm32: add CAN support on stm32f746")
      Suggested-by: default avatarKrzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
      Link: https://lore.kernel.org/20230517181950.1106697-1-mkl@pengutronix.deSigned-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      36a6418b
    • Linus Torvalds's avatar
      Merge tag 'linux-kselftest-fixes-6.4-rc3' of... · 4d6d4c7f
      Linus Torvalds authored
      Merge tag 'linux-kselftest-fixes-6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest
      
      Pull Kselftest fixes from Shuah Khan:
      
       - sgx test fix for false negatives
      
       - ftrace output is hard to parses and it masks inappropriate skips etc.
         This fix addresses the problems by integrating with kselftest runner
      
      * tag 'linux-kselftest-fixes-6.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
        selftests/ftrace: Improve integration with kselftest runner
        selftests/sgx: Add "test_encl.elf" to TEST_FILES
      4d6d4c7f
    • Linus Torvalds's avatar
      Merge tag 'nfsd-6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux · 1b66c114
      Linus Torvalds authored
      Pull nfsd fixes from Chuck Lever:
      
       - A collection of minor bug fixes
      
      * tag 'nfsd-6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux:
        NFSD: Remove open coding of string copy
        SUNRPC: Fix trace_svc_register() call site
        SUNRPC: always free ctxt when freeing deferred request
        SUNRPC: double free xprt_ctxt while still in use
        SUNRPC: Fix error handling in svc_setup_socket()
        SUNRPC: Fix encoding of accepted but unsuccessful RPC replies
        lockd: define nlm_port_min,max with CONFIG_SYSCTL
        nfsd: define exports_proc_ops with CONFIG_PROC_FS
        SUNRPC: Avoid relying on crypto API to derive CBC-CTS output IV
      1b66c114
    • Linus Torvalds's avatar
      Merge tag 'tpmdd-v6.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd · cba58263
      Linus Torvalds authored
      Pull tpm fixes from Jarkko Sakkinen:
       "Three bug fixes for recently discovered issues"
      
      * tag 'tpmdd-v6.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
        tpm/tpm_tis: Disable interrupts for more Lenovo devices
        tpm: Prevent hwrng from activating during resume
        tpm_tis: Use tpm_chip_{start,stop} decoration inside tpm_tis_resume
      cba58263
    • Arnd Bergmann's avatar
      tracing: make ftrace_likely_update() declaration visible · a18ef64f
      Arnd Bergmann authored
      This function is only used when CONFIG_TRACE_BRANCH_PROFILING is set and
      DISABLE_BRANCH_PROFILING is not set, and the declaration is hidden
      behind this combination of tests.
      
      But that causes a warning when building with CONFIG_TRACING_BRANCHES,
      since that sets DISABLE_BRANCH_PROFILING for the tracing code, and the
      declaration is thus hidden:
      
        kernel/trace/trace_branch.c:205:6: error: no previous prototype for 'ftrace_likely_update' [-Werror=missing-prototypes]
      
      Move the declaration out of the #ifdef to avoid the warning.
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      a18ef64f
    • Florian Westphal's avatar
      netfilter: nft_set_rbtree: fix null deref on element insertion · 61ae320a
      Florian Westphal authored
      There is no guarantee that rb_prev() will not return NULL in nft_rbtree_gc_elem():
      
      general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN
      KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
       nft_add_set_elem+0x14b0/0x2990
        nf_tables_newsetelem+0x528/0xb30
      
      Furthermore, there is a possible use-after-free while iterating,
      'node' can be free'd so we need to cache the next value to use.
      
      Fixes: c9e6978e ("netfilter: nft_set_rbtree: Switch to node list walk for overlap detection")
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      61ae320a
    • Florian Westphal's avatar
      netfilter: nf_tables: fix nft_trans type confusion · e3c361b8
      Florian Westphal authored
      nft_trans_FOO objects all share a common nft_trans base structure, but
      trailing fields depend on the real object size. Access is only safe after
      trans->msg_type check.
      
      Check for rule type first.  Found by code inspection.
      
      Fixes: 1a94e38d ("netfilter: nf_tables: add NFTA_RULE_ID attribute")
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      e3c361b8
    • Tom Rix's avatar
      netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT · 224a876e
      Tom Rix authored
      gcc with W=1 and ! CONFIG_NF_NAT
      net/netfilter/nf_conntrack_netlink.c:3463:32: error:
        ‘exp_nat_nla_policy’ defined but not used [-Werror=unused-const-variable=]
       3463 | static const struct nla_policy exp_nat_nla_policy[CTA_EXPECT_NAT_MAX+1] = {
            |                                ^~~~~~~~~~~~~~~~~~
      net/netfilter/nf_conntrack_netlink.c:2979:33: error:
        ‘any_addr’ defined but not used [-Werror=unused-const-variable=]
       2979 | static const union nf_inet_addr any_addr;
            |                                 ^~~~~~~~
      
      These variables use is controlled by CONFIG_NF_NAT, so should their definitions.
      Signed-off-by: default avatarTom Rix <trix@redhat.com>
      Reviewed-by: default avatarSimon Horman <simon.horman@corigine.com>
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      224a876e
    • Kai-Heng Feng's avatar
      net: wwan: t7xx: Ensure init is completed before system sleep · ab87603b
      Kai-Heng Feng authored
      When the system attempts to sleep while mtk_t7xx is not ready, the driver
      cannot put the device to sleep:
      [   12.472918] mtk_t7xx 0000:57:00.0: [PM] Exiting suspend, modem in invalid state
      [   12.472936] mtk_t7xx 0000:57:00.0: PM: pci_pm_suspend(): t7xx_pci_pm_suspend+0x0/0x20 [mtk_t7xx] returns -14
      [   12.473678] mtk_t7xx 0000:57:00.0: PM: dpm_run_callback(): pci_pm_suspend+0x0/0x1b0 returns -14
      [   12.473711] mtk_t7xx 0000:57:00.0: PM: failed to suspend async: error -14
      [   12.764776] PM: Some devices failed to suspend, or early wake event detected
      
      Mediatek confirmed the device can take a rather long time to complete
      its initialization, so wait for up to 20 seconds until init is done.
      Signed-off-by: default avatarKai-Heng Feng <kai.heng.feng@canonical.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ab87603b
    • Benjamin Poirier's avatar
      net: selftests: Fix optstring · 9ba9485b
      Benjamin Poirier authored
      The cited commit added a stray colon to the 'v' option. That makes the
      option work incorrectly.
      
      ex:
      tools/testing/selftests/net# ./fib_nexthops.sh -v
      (should enable verbose mode, instead it shows help text due to missing arg)
      
      Fixes: 5feba472 ("selftests: fib_nexthops: Make ping timeout configurable")
      Reviewed-by: default avatarIdo Schimmel <idosch@nvidia.com>
      Signed-off-by: default avatarBenjamin Poirier <bpoirier@nvidia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9ba9485b
    • Vladimir Oltean's avatar
      net: pcs: xpcs: fix C73 AN not getting enabled · c46e78ba
      Vladimir Oltean authored
      The XPCS expects clause 73 (copper backplane) autoneg to follow the
      ethtool autoneg bit. It actually did that until the blamed
      commit inaptly replaced state->an_enabled (coming from ethtool) with
      phylink_autoneg_inband() (coming from the device tree or struct
      phylink_config), as part of an unrelated phylink_pcs API conversion.
      
      Russell King suggests that state->an_enabled from the original code was
      just a proxy for the ethtool Autoneg bit, and that the correct way of
      restoring the functionality is to check for this bit in the advertising
      mask.
      
      Fixes: 11059740 ("net: pcs: xpcs: convert to phylink_pcs_ops")
      Link: https://lore.kernel.org/netdev/ZGNt2MFeRolKGFck@shell.armlinux.org.uk/Suggested-by: default avatarRussell King (Oracle) <linux@armlinux.org.uk>
      Signed-off-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c46e78ba
    • M Chetan Kumar's avatar
      net: wwan: iosm: fix NULL pointer dereference when removing device · 60829145
      M Chetan Kumar authored
      In suspend and resume cycle, the removal and rescan of device ends
      up in NULL pointer dereference.
      
      During driver initialization, if the ipc_imem_wwan_channel_init()
      fails to get the valid device capabilities it returns an error and
      further no resource (wwan struct) will be allocated. Now in this
      situation if driver removal procedure is initiated it would result
      in NULL pointer exception since unallocated wwan struct is dereferenced
      inside ipc_wwan_deinit().
      
      ipc_imem_run_state_worker() to handle the called functions return value
      and to release the resource in failure case. It also reports the link
      down event in failure cases. The user space application can handle this
      event to do a device reset for restoring the device communication.
      
      Fixes: 3670970d ("net: iosm: shared memory IPC interface")
      Reported-by: default avatarSamuel Wein PhD <sam@samwein.com>
      Closes: https://lore.kernel.org/netdev/20230427140819.1310f4bd@kernel.org/T/Signed-off-by: default avatarM Chetan Kumar <m.chetan.kumar@linux.intel.com>
      Reviewed-by: default avatarSimon Horman <simon.horman@corigine.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      60829145
    • Eric Dumazet's avatar
      vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit() · dacab578
      Eric Dumazet authored
      syzbot triggered the following splat [1], sending an empty message
      through pppoe_sendmsg().
      
      When VLAN_FLAG_REORDER_HDR flag is set, vlan_dev_hard_header()
      does not push extra bytes for the VLAN header, because vlan is offloaded.
      
      Unfortunately vlan_dev_hard_start_xmit() first reads veth->h_vlan_proto
      before testing (vlan->flags & VLAN_FLAG_REORDER_HDR).
      
      We need to swap the two conditions.
      
      [1]
      BUG: KMSAN: uninit-value in vlan_dev_hard_start_xmit+0x171/0x7f0 net/8021q/vlan_dev.c:111
      vlan_dev_hard_start_xmit+0x171/0x7f0 net/8021q/vlan_dev.c:111
      __netdev_start_xmit include/linux/netdevice.h:4883 [inline]
      netdev_start_xmit include/linux/netdevice.h:4897 [inline]
      xmit_one net/core/dev.c:3580 [inline]
      dev_hard_start_xmit+0x253/0xa20 net/core/dev.c:3596
      __dev_queue_xmit+0x3c7f/0x5ac0 net/core/dev.c:4246
      dev_queue_xmit include/linux/netdevice.h:3053 [inline]
      pppoe_sendmsg+0xa93/0xb80 drivers/net/ppp/pppoe.c:900
      sock_sendmsg_nosec net/socket.c:724 [inline]
      sock_sendmsg net/socket.c:747 [inline]
      ____sys_sendmsg+0xa24/0xe40 net/socket.c:2501
      ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2555
      __sys_sendmmsg+0x411/0xa50 net/socket.c:2641
      __do_sys_sendmmsg net/socket.c:2670 [inline]
      __se_sys_sendmmsg net/socket.c:2667 [inline]
      __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2667
      do_syscall_x64 arch/x86/entry/common.c:50 [inline]
      do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
      entry_SYSCALL_64_after_hwframe+0x63/0xcd
      
      Uninit was created at:
      slab_post_alloc_hook+0x12d/0xb60 mm/slab.h:774
      slab_alloc_node mm/slub.c:3452 [inline]
      kmem_cache_alloc_node+0x543/0xab0 mm/slub.c:3497
      kmalloc_reserve+0x148/0x470 net/core/skbuff.c:520
      __alloc_skb+0x3a7/0x850 net/core/skbuff.c:606
      alloc_skb include/linux/skbuff.h:1277 [inline]
      sock_wmalloc+0xfe/0x1a0 net/core/sock.c:2583
      pppoe_sendmsg+0x3af/0xb80 drivers/net/ppp/pppoe.c:867
      sock_sendmsg_nosec net/socket.c:724 [inline]
      sock_sendmsg net/socket.c:747 [inline]
      ____sys_sendmsg+0xa24/0xe40 net/socket.c:2501
      ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2555
      __sys_sendmmsg+0x411/0xa50 net/socket.c:2641
      __do_sys_sendmmsg net/socket.c:2670 [inline]
      __se_sys_sendmmsg net/socket.c:2667 [inline]
      __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2667
      do_syscall_x64 arch/x86/entry/common.c:50 [inline]
      do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
      entry_SYSCALL_64_after_hwframe+0x63/0xcd
      
      CPU: 0 PID: 29770 Comm: syz-executor.0 Not tainted 6.3.0-rc6-syzkaller-gc478e5b17829 #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
      
      Fixes: 1da177e4 ("Linux-2.6.12-rc2")
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      dacab578
    • Nikolay Aleksandrov's avatar
      mailmap: add entries for Nikolay Aleksandrov · 66353baf
      Nikolay Aleksandrov authored
      Turns out I missed a few patches due to use of old addresses by
      senders. Add a mailmap entry with my old addresses.
      Signed-off-by: default avatarNikolay Aleksandrov <razor@blackwall.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      66353baf
    • Aleksandr Loktionov's avatar
      igb: fix bit_shift to be in [1..8] range · 60d75865
      Aleksandr Loktionov authored
      In igb_hash_mc_addr() the expression:
              "mc_addr[4] >> 8 - bit_shift", right shifting "mc_addr[4]"
      shift by more than 7 bits always yields zero, so hash becomes not so different.
      Add initialization with bit_shift = 1 and add a loop condition to ensure
      bit_shift will be always in [1..8] range.
      
      Fixes: 9d5c8243 ("igb: PCI-Express 82575 Gigabit Ethernet driver")
      Signed-off-by: default avatarAleksandr Loktionov <aleksandr.loktionov@intel.com>
      Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      60d75865
    • David S. Miller's avatar
      Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue · 5ad3bd84
      David S. Miller authored
      Tony nguyen says:
      
      ====================
      Intel Wired LAN Driver Updates 2023-05-16
      
      This series contains updates to ice and iavf drivers.
      
      Ahmed adds setting of missed condition for statistics which caused
      incorrect reporting of values for ice. For iavf, he removes a call to set
      VLAN offloads during re-initialization which can cause incorrect values
      to be set.
      
      Dawid adds checks to ensure VF is ready to be reset before executing
      commands that will require it to be reset on ice.
      ---
      v2:
      Patch 2
      - Redo commit message
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5ad3bd84
    • Marco Migliore's avatar
      net: dsa: mv88e6xxx: Fix mv88e6393x EPC write command offset · 1323e0c6
      Marco Migliore authored
      According to datasheet, the command opcode must be specified
      into bits [14:12] of the Extended Port Control register (EPC).
      
      Fixes: de776d0d ("net: dsa: mv88e6xxx: add support for mv88e6393x family")
      Signed-off-by: default avatarMarco Migliore <m.migliore@tiesse.com>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1323e0c6
    • Christophe JAILLET's avatar
      cassini: Fix a memory leak in the error handling path of cas_init_one() · 412cd77a
      Christophe JAILLET authored
      cas_saturn_firmware_init() allocates some memory using vmalloc(). This
      memory is freed in the .remove() function but not it the error handling
      path of the probe.
      
      Add the missing vfree() to avoid a memory leak, should an error occur.
      
      Fixes: fcaa4066 ("cassini: use request_firmware")
      Signed-off-by: default avatarChristophe JAILLET <christophe.jaillet@wanadoo.fr>
      Reviewed-by: default avatarPavan Chebbi <pavan.chebbi@broadcom.com>
      Reviewed-by: default avatarSimon Horman <simon.horman@corigine.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      412cd77a
    • Kuniyuki Iwashima's avatar
      tun: Fix memory leak for detached NAPI queue. · 82b2bc27
      Kuniyuki Iwashima authored
      syzkaller reported [0] memory leaks of sk and skb related to the TUN
      device with no repro, but we can reproduce it easily with:
      
        struct ifreq ifr = {}
        int fd_tun, fd_tmp;
        char buf[4] = {};
      
        fd_tun = openat(AT_FDCWD, "/dev/net/tun", O_WRONLY, 0);
        ifr.ifr_flags = IFF_TUN | IFF_NAPI | IFF_MULTI_QUEUE;
        ioctl(fd_tun, TUNSETIFF, &ifr);
      
        ifr.ifr_flags = IFF_DETACH_QUEUE;
        ioctl(fd_tun, TUNSETQUEUE, &ifr);
      
        fd_tmp = socket(AF_PACKET, SOCK_PACKET, 0);
        ifr.ifr_flags = IFF_UP;
        ioctl(fd_tmp, SIOCSIFFLAGS, &ifr);
      
        write(fd_tun, buf, sizeof(buf));
        close(fd_tun);
      
      If we enable NAPI and multi-queue on a TUN device, we can put skb into
      tfile->sk.sk_write_queue after the queue is detached.  We should prevent
      it by checking tfile->detached before queuing skb.
      
      Note this must be done under tfile->sk.sk_write_queue.lock because write()
      and ioctl(IFF_DETACH_QUEUE) can run concurrently.  Otherwise, there would
      be a small race window:
      
        write()                             ioctl(IFF_DETACH_QUEUE)
        `- tun_get_user                     `- __tun_detach
           |- if (tfile->detached)             |- tun_disable_queue
           |  `-> false                        |  `- tfile->detached = tun
           |                                   `- tun_queue_purge
           |- spin_lock_bh(&queue->lock)
           `- __skb_queue_tail(queue, skb)
      
      Another solution is to call tun_queue_purge() when closing and
      reattaching the detached queue, but it could paper over another
      problems.  Also, we do the same kind of test for IFF_NAPI_FRAGS.
      
      [0]:
      unreferenced object 0xffff88801edbc800 (size 2048):
        comm "syz-executor.1", pid 33269, jiffies 4295743834 (age 18.756s)
        hex dump (first 32 bytes):
          00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
          00 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00  ...@............
        backtrace:
          [<000000008c16ea3d>] __do_kmalloc_node mm/slab_common.c:965 [inline]
          [<000000008c16ea3d>] __kmalloc+0x4a/0x130 mm/slab_common.c:979
          [<000000003addde56>] kmalloc include/linux/slab.h:563 [inline]
          [<000000003addde56>] sk_prot_alloc+0xef/0x1b0 net/core/sock.c:2035
          [<000000003e20621f>] sk_alloc+0x36/0x2f0 net/core/sock.c:2088
          [<0000000028e43843>] tun_chr_open+0x3d/0x190 drivers/net/tun.c:3438
          [<000000001b0f1f28>] misc_open+0x1a6/0x1f0 drivers/char/misc.c:165
          [<000000004376f706>] chrdev_open+0x111/0x300 fs/char_dev.c:414
          [<00000000614d379f>] do_dentry_open+0x2f9/0x750 fs/open.c:920
          [<000000008eb24774>] do_open fs/namei.c:3636 [inline]
          [<000000008eb24774>] path_openat+0x143f/0x1a30 fs/namei.c:3791
          [<00000000955077b5>] do_filp_open+0xce/0x1c0 fs/namei.c:3818
          [<00000000b78973b0>] do_sys_openat2+0xf0/0x260 fs/open.c:1356
          [<00000000057be699>] do_sys_open fs/open.c:1372 [inline]
          [<00000000057be699>] __do_sys_openat fs/open.c:1388 [inline]
          [<00000000057be699>] __se_sys_openat fs/open.c:1383 [inline]
          [<00000000057be699>] __x64_sys_openat+0x83/0xf0 fs/open.c:1383
          [<00000000a7d2182d>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
          [<00000000a7d2182d>] do_syscall_64+0x3c/0x90 arch/x86/entry/common.c:80
          [<000000004cc4e8c4>] entry_SYSCALL_64_after_hwframe+0x72/0xdc
      
      unreferenced object 0xffff88802f671700 (size 240):
        comm "syz-executor.1", pid 33269, jiffies 4295743854 (age 18.736s)
        hex dump (first 32 bytes):
          68 c9 db 1e 80 88 ff ff 68 c9 db 1e 80 88 ff ff  h.......h.......
          00 c0 7b 2f 80 88 ff ff 00 c8 db 1e 80 88 ff ff  ..{/............
        backtrace:
          [<00000000e9d9fdb6>] __alloc_skb+0x223/0x250 net/core/skbuff.c:644
          [<000000002c3e4e0b>] alloc_skb include/linux/skbuff.h:1288 [inline]
          [<000000002c3e4e0b>] alloc_skb_with_frags+0x6f/0x350 net/core/skbuff.c:6378
          [<00000000825f98d7>] sock_alloc_send_pskb+0x3ac/0x3e0 net/core/sock.c:2729
          [<00000000e9eb3df3>] tun_alloc_skb drivers/net/tun.c:1529 [inline]
          [<00000000e9eb3df3>] tun_get_user+0x5e1/0x1f90 drivers/net/tun.c:1841
          [<0000000053096912>] tun_chr_write_iter+0xac/0x120 drivers/net/tun.c:2035
          [<00000000b9282ae0>] call_write_iter include/linux/fs.h:1868 [inline]
          [<00000000b9282ae0>] new_sync_write fs/read_write.c:491 [inline]
          [<00000000b9282ae0>] vfs_write+0x40f/0x530 fs/read_write.c:584
          [<00000000524566e4>] ksys_write+0xa1/0x170 fs/read_write.c:637
          [<00000000a7d2182d>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
          [<00000000a7d2182d>] do_syscall_64+0x3c/0x90 arch/x86/entry/common.c:80
          [<000000004cc4e8c4>] entry_SYSCALL_64_after_hwframe+0x72/0xdc
      
      Fixes: cde8b15f ("tuntap: add ioctl to attach or detach a file form tuntap device")
      Reported-by: default avatarsyzkaller <syzkaller@googlegroups.com>
      Signed-off-by: default avatarKuniyuki Iwashima <kuniyu@amazon.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      82b2bc27
    • Marc Kleine-Budde's avatar
      Merge patch series "can: kvaser_pciefd: Bug fixes" · c1e4f5a4
      Marc Kleine-Budde authored
      Jimmy Assarsson <extja@kvaser.com> says:
      
      This patch series contains various bug fixes for the kvaser_pciefd
      driver.
      
      Link: https://lore.kernel.org/r/20230516134318.104279-1-extja@kvaser.comSigned-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      c1e4f5a4
    • Jimmy Assarsson's avatar
      can: kvaser_pciefd: Disable interrupts in probe error path · 11164bc3
      Jimmy Assarsson authored
      Disable interrupts in error path of probe function.
      
      Fixes: 26ad340e ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarJimmy Assarsson <extja@kvaser.com>
      Link: https://lore.kernel.org/r/20230516134318.104279-7-extja@kvaser.comSigned-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      11164bc3