1. 31 Aug, 2022 11 commits
  2. 30 Aug, 2022 2 commits
  3. 29 Aug, 2022 5 commits
    • David S. Miller's avatar
      Merge branch 'u64_stats-fixups' · cb10b0f9
      David S. Miller authored
      Sebastian Andrzej Siewior says:
      
      ====================
      net: u64_stats fixups for 32bit.
      
      while looking at the u64-stats patch
      	https://lore.kernel.org/all/20220817162703.728679-10-bigeasy@linutronix.de
      
      I noticed that u64_stats_fetch_begin() is used. That suspicious thing
      about it is that network processing, including stats update, is
      performed in NAPI and so I would expect to see
      u64_stats_fetch_begin_irq() in order to avoid updates from NAPI during
      the read. This is only needed on 32bit-UP where the seqcount is not
      used. This is address in 2/2. The remaining user take some kind of
      precaution and may use u64_stats_fetch_begin().
      
      I updated the previously mentioned patch to get rid of
      u64_stats_fetch_begin_irq(). If this is not considered stable patch
      worthy then it can be ignored and considred fixed by the other series
      which removes the special 32bit cases.
      
      The xrs700x driver reads and writes the counter from preemptible context
      so the only missing piece here is at least disable preemption on the
      writer side to avoid preemption while the writer is in progress. The
      possible reader would spin then until the writer completes its write
      critical section which is considered bad. This is addressed in 1/2 by
      using u64_stats_update_begin_irqsave() and so disable interrupts during
      the write critical section.
      The other closet resemblance I found is mdio_bus.c::mdiobus_stats_acct()
      where preemtion is disabled unconditionally. This is something I want to
      avoid since it also affects 64bit.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cb10b0f9
    • Sebastian Andrzej Siewior's avatar
      net: Use u64_stats_fetch_begin_irq() for stats fetch. · 278d3ba6
      Sebastian Andrzej Siewior authored
      On 32bit-UP u64_stats_fetch_begin() disables only preemption. If the
      reader is in preemptible context and the writer side
      (u64_stats_update_begin*()) runs in an interrupt context (IRQ or
      softirq) then the writer can update the stats during the read operation.
      This update remains undetected.
      
      Use u64_stats_fetch_begin_irq() to ensure the stats fetch on 32bit-UP
      are not interrupted by a writer. 32bit-SMP remains unaffected by this
      change.
      
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: Catherine Sullivan <csully@google.com>
      Cc: David Awogbemila <awogbemila@google.com>
      Cc: Dimitris Michailidis <dmichail@fungible.com>
      Cc: Eric Dumazet <edumazet@google.com>
      Cc: Hans Ulli Kroll <ulli.kroll@googlemail.com>
      Cc: Jakub Kicinski <kuba@kernel.org>
      Cc: Jeroen de Borst <jeroendb@google.com>
      Cc: Johannes Berg <johannes@sipsolutions.net>
      Cc: Linus Walleij <linus.walleij@linaro.org>
      Cc: Paolo Abeni <pabeni@redhat.com>
      Cc: Simon Horman <simon.horman@corigine.com>
      Cc: linux-arm-kernel@lists.infradead.org
      Cc: linux-wireless@vger.kernel.org
      Cc: netdev@vger.kernel.org
      Cc: oss-drivers@corigine.com
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarSebastian Andrzej Siewior <bigeasy@linutronix.de>
      Reviewed-by: default avatarSimon Horman <simon.horman@corigine.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      278d3ba6
    • Sebastian Andrzej Siewior's avatar
      net: dsa: xrs700x: Use irqsave variant for u64 stats update · 3f8ae9fe
      Sebastian Andrzej Siewior authored
      xrs700x_read_port_counters() updates the stats from a worker using the
      u64_stats_update_begin() version. This is okay on 32-UP since on the
      reader side preemption is disabled.
      On 32bit-SMP the writer can be preempted by the reader at which point
      the reader will spin on the seqcount until writer continues and
      completes the update.
      
      Assigning the mib_mutex mutex to the underlying seqcount would ensure
      proper synchronisation. The API for that on the u64_stats_init() side
      isn't available. Since it is the only user, just use disable interrupts
      during the update.
      
      Use u64_stats_update_begin_irqsave() on the writer side to ensure an
      uninterrupted update.
      
      Fixes: ee00b24f ("net: dsa: add Arrow SpeedChips XRS700x driver")
      Cc: Andrew Lunn <andrew@lunn.ch>
      Cc: Florian Fainelli <f.fainelli@gmail.com>
      Cc: George McCollister <george.mccollister@gmail.com>
      Cc: Vivien Didelot <vivien.didelot@gmail.com>
      Cc: Vladimir Oltean <olteanv@gmail.com>
      Signed-off-by: default avatarSebastian Andrzej Siewior <bigeasy@linutronix.de>
      Acked-by: default avatarGeorge McCollister <george.mccollister@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3f8ae9fe
    • Li Qiong's avatar
      ieee802154: cc2520: add rc code in cc2520_tx() · ffd7bddd
      Li Qiong authored
      The rc code is 0 at the error path "status & CC2520_STATUS_TX_UNDERFLOW".
      Assign rc code with '-EINVAL' at this error path to fix it.
      Signed-off-by: default avatarLi Qiong <liqiong@nfschina.com>
      Link: https://lore.kernel.org/r/20220829071259.18330-1-liqiong@nfschina.comSigned-off-by: default avatarStefan Schmidt <stefan@datenfreihafen.org>
      ffd7bddd
    • Miquel Raynal's avatar
      net: mac802154: Fix a condition in the receive path · f0da4711
      Miquel Raynal authored
      Upon reception, a packet must be categorized, either it's destination is
      the host, or it is another host. A packet with no destination addressing
      fields may be valid in two situations:
      - the packet has no source field: only ACKs are built like that, we
        consider the host as the destination.
      - the packet has a valid source field: it is directed to the PAN
        coordinator, as for know we don't have this information we consider we
        are not the PAN coordinator.
      
      There was likely a copy/paste error made during a previous cleanup
      because the if clause is now containing exactly the same condition as in
      the switch case, which can never be true. In the past the destination
      address was used in the switch and the source address was used in the
      if, which matches what the spec says.
      
      Cc: stable@vger.kernel.org
      Fixes: ae531b94 ("ieee802154: use ieee802154_addr instead of *_sa variants")
      Signed-off-by: default avatarMiquel Raynal <miquel.raynal@bootlin.com>
      Link: https://lore.kernel.org/r/20220826142954.254853-1-miquel.raynal@bootlin.comSigned-off-by: default avatarStefan Schmidt <stefan@datenfreihafen.org>
      f0da4711
  4. 27 Aug, 2022 7 commits
  5. 26 Aug, 2022 2 commits
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf · 2e085ec0
      David S. Miller authored
      Daniel borkmann says:
      
      ====================
      The following pull-request contains BPF updates for your *net* tree.
      
      We've added 11 non-merge commits during the last 14 day(s) which contain
      a total of 13 files changed, 61 insertions(+), 24 deletions(-).
      
      The main changes are:
      
      1) Fix BPF verifier's precision tracking around BPF ring buffer, from Kumar Kartikeya Dwivedi.
      
      2) Fix regression in tunnel key infra when passing FLOWI_FLAG_ANYSRC, from Eyal Birger.
      
      3) Fix insufficient permissions for bpf_sys_bpf() helper, from YiFei Zhu.
      
      4) Fix splat from hitting BUG when purging effective cgroup programs, from Pu Lehui.
      
      5) Fix range tracking for array poke descriptors, from Daniel Borkmann.
      
      6) Fix corrupted packets for XDP_SHARED_UMEM in aligned mode, from Magnus Karlsson.
      
      7) Fix NULL pointer splat in BPF sockmap sk_msg_recvmsg(), from Liu Jian.
      
      8) Add READ_ONCE() to bpf_jit_limit when reading from sysctl, from Kuniyuki Iwashima.
      
      9) Add BPF selftest lru_bug check to s390x deny list, from Daniel Müller.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2e085ec0
    • David S. Miller's avatar
      Merge tag 'wireless-2022-08-26' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless · 4ba9d38b
      David S. Miller authored
      Johannes Berg says:
      
      ====================
      pull-request: wireless-2022-08-26
      
      Here are a couple of fixes for the current cycle,
      see the tag description below.
      
      Just a couple of fixes:
       * two potential leaks
       * use-after-free in certain scan races
       * warning in IBSS code
       * error return from a debugfs file was wrong
       * possible NULL-ptr-deref when station lookup fails
      
      Please pull and let me know if there's any problem.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4ba9d38b
  6. 25 Aug, 2022 13 commits
    • Zhengping Jiang's avatar
      Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn · 2da8eb83
      Zhengping Jiang authored
      When disconnecting all devices, hci_conn_failed is used to cleanup
      hci_conn object when the hci_conn object cannot be aborted.
      The function hci_conn_failed requires the caller holds hdev->lock.
      
      Fixes: 9b3628d7 ("Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted")
      Signed-off-by: default avatarZhengping Jiang <jiangzp@google.com>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      2da8eb83
    • Wolfram Sang's avatar
      Bluetooth: move from strlcpy with unused retval to strscpy · cb0d160f
      Wolfram Sang authored
      Follow the advice of the below link and prefer 'strscpy' in this
      subsystem. Conversion is 1:1 because the return value is not used.
      Generated by a coccinelle script.
      
      Link: https://lore.kernel.org/r/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmknw@mail.gmail.com/Signed-off-by: default avatarWolfram Sang <wsa+renesas@sang-engineering.com>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      cb0d160f
    • Archie Pusaka's avatar
      Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt · f48735a9
      Archie Pusaka authored
      To prevent multiple conn complete events, we shouldn't look up the
      conn with hci_lookup_le_connect, since it requires the state to be
      BT_CONNECT. By the time the duplicate event is processed, the state
      might have changed, so we end up processing the new event anyway.
      
      Change the lookup function to hci_conn_hash_lookup_ba.
      
      Fixes: d5ebaa7c ("Bluetooth: hci_event: Ignore multiple conn complete events")
      Signed-off-by: default avatarArchie Pusaka <apusaka@chromium.org>
      Reviewed-by: default avatarSonny Sasaka <sonnysasaka@chromium.org>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      f48735a9
    • Luiz Augusto von Dentz's avatar
      Bluetooth: ISO: Fix not handling shutdown condition · c5729093
      Luiz Augusto von Dentz authored
      In order to properly handle shutdown syscall the code shall not assume
      that the how argument is always SHUT_RDWR resulting in SHUTDOWN_MASK as
      that would result in poll to immediately report EPOLLHUP instead of
      properly waiting for disconnect_cfm (Disconnect Complete) which is
      rather important for the likes of BAP as the CIG may need to be
      reprogrammed.
      
      Fixes: ccf74f23 ("Bluetooth: Add BTPROTO_ISO socket type")
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      c5729093
    • Tetsuo Handa's avatar
      Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() · 3cfbc6ac
      Tetsuo Handa authored
      syzbot is reporting double kfree() at remove_adv_monitor() [1], for
      commit 7cf5c297 ("Bluetooth: hci_sync: Refactor remove Adv
      Monitor") forgot to remove duplicated mgmt_pending_remove() when
      merging "if (err) {" path and "if (!pending) {" path.
      
      Link: https://syzkaller.appspot.com/bug?extid=915a8416bf15895b8e07 [1]
      Reported-by: default avatarsyzbot <syzbot+915a8416bf15895b8e07@syzkaller.appspotmail.com>
      Fixes: 7cf5c297 ("Bluetooth: hci_sync: Refactor remove Adv Monitor")
      Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      3cfbc6ac
    • Luiz Augusto von Dentz's avatar
      Bluetooth: MGMT: Fix Get Device Flags · 23b72814
      Luiz Augusto von Dentz authored
      Get Device Flags don't check if device does actually use an RPA in which
      case it shall only set HCI_CONN_FLAG_REMOTE_WAKEUP if LL Privacy is
      enabled.
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      23b72814
    • Luiz Augusto von Dentz's avatar
      Bluetooth: L2CAP: Fix build errors in some archs · b840304f
      Luiz Augusto von Dentz authored
      This attempts to fix the follow errors:
      
      In function 'memcmp',
          inlined from 'bacmp' at ./include/net/bluetooth/bluetooth.h:347:9,
          inlined from 'l2cap_global_chan_by_psm' at
          net/bluetooth/l2cap_core.c:2003:15:
      ./include/linux/fortify-string.h:44:33: error: '__builtin_memcmp'
      specified bound 6 exceeds source size 0 [-Werror=stringop-overread]
         44 | #define __underlying_memcmp     __builtin_memcmp
            |                                 ^
      ./include/linux/fortify-string.h:420:16: note: in expansion of macro
      '__underlying_memcmp'
        420 |         return __underlying_memcmp(p, q, size);
            |                ^~~~~~~~~~~~~~~~~~~
      In function 'memcmp',
          inlined from 'bacmp' at ./include/net/bluetooth/bluetooth.h:347:9,
          inlined from 'l2cap_global_chan_by_psm' at
          net/bluetooth/l2cap_core.c:2004:15:
      ./include/linux/fortify-string.h:44:33: error: '__builtin_memcmp'
      specified bound 6 exceeds source size 0 [-Werror=stringop-overread]
         44 | #define __underlying_memcmp     __builtin_memcmp
            |                                 ^
      ./include/linux/fortify-string.h:420:16: note: in expansion of macro
      '__underlying_memcmp'
        420 |         return __underlying_memcmp(p, q, size);
            |                ^~~~~~~~~~~~~~~~~~~
      
      Fixes: 332f1795 ("Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression")
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      b840304f
    • Luiz Augusto von Dentz's avatar
      Bluetooth: hci_sync: Fix suspend performance regression · 1fd02d56
      Luiz Augusto von Dentz authored
      This attempts to fix suspend performance when there is no connections by
      not updating the event mask.
      
      Fixes: ef61b6ea ("Bluetooth: Always set event mask on suspend")
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      1fd02d56
    • Hans de Goede's avatar
      Bluetooth: hci_event: Fix vendor (unknown) opcode status handling · b82a26d8
      Hans de Goede authored
      Commit c8992cff ("Bluetooth: hci_event: Use of a function table to
      handle Command Complete") was (presumably) meant to only refactor things
      without any functional changes.
      
      But it does have one undesirable side-effect, before *status would always
      be set to skb->data[0] and it might be overridden by some of the opcode
      specific handling. While now it always set by the opcode specific handlers.
      This means that if the opcode is not known *status does not get set any
      more at all!
      
      This behavior change has broken bluetooth support for BCM4343A0 HCIs,
      the hci_bcm.c code tries to configure UART attached HCIs at a higher
      baudraute using vendor specific opcodes. The BCM4343A0 does not
      support this and this used to simply fail:
      
      [   25.646442] Bluetooth: hci0: BCM: failed to write clock (-56)
      [   25.646481] Bluetooth: hci0: Failed to set baudrate
      
      After which things would continue with the initial baudraute. But now
      that hci_cmd_complete_evt() no longer sets status for unknown opcodes
      *status is left at 0. This causes the hci_bcm.c code to think the baudraute
      has been changed on the HCI side and to also adjust the UART baudrate,
      after which communication with the HCI is broken, leading to:
      
      [   28.579042] Bluetooth: hci0: command 0x0c03 tx timeout
      [   36.961601] Bluetooth: hci0: BCM: Reset failed (-110)
      
      And non working bluetooth. Fix this by restoring the previous
      default "*status = skb->data[0]" handling for unknown opcodes.
      
      Fixes: c8992cff ("Bluetooth: hci_event: Use of a function table to handle Command Complete")
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      b82a26d8
    • Daniel Borkmann's avatar
      bpf: Don't use tnum_range on array range checking for poke descriptors · a657182a
      Daniel Borkmann authored
      Hsin-Wei reported a KASAN splat triggered by their BPF runtime fuzzer which
      is based on a customized syzkaller:
      
        BUG: KASAN: slab-out-of-bounds in bpf_int_jit_compile+0x1257/0x13f0
        Read of size 8 at addr ffff888004e90b58 by task syz-executor.0/1489
        CPU: 1 PID: 1489 Comm: syz-executor.0 Not tainted 5.19.0 #1
        Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
        1.13.0-1ubuntu1.1 04/01/2014
        Call Trace:
         <TASK>
         dump_stack_lvl+0x9c/0xc9
         print_address_description.constprop.0+0x1f/0x1f0
         ? bpf_int_jit_compile+0x1257/0x13f0
         kasan_report.cold+0xeb/0x197
         ? kvmalloc_node+0x170/0x200
         ? bpf_int_jit_compile+0x1257/0x13f0
         bpf_int_jit_compile+0x1257/0x13f0
         ? arch_prepare_bpf_dispatcher+0xd0/0xd0
         ? rcu_read_lock_sched_held+0x43/0x70
         bpf_prog_select_runtime+0x3e8/0x640
         ? bpf_obj_name_cpy+0x149/0x1b0
         bpf_prog_load+0x102f/0x2220
         ? __bpf_prog_put.constprop.0+0x220/0x220
         ? find_held_lock+0x2c/0x110
         ? __might_fault+0xd6/0x180
         ? lock_downgrade+0x6e0/0x6e0
         ? lock_is_held_type+0xa6/0x120
         ? __might_fault+0x147/0x180
         __sys_bpf+0x137b/0x6070
         ? bpf_perf_link_attach+0x530/0x530
         ? new_sync_read+0x600/0x600
         ? __fget_files+0x255/0x450
         ? lock_downgrade+0x6e0/0x6e0
         ? fput+0x30/0x1a0
         ? ksys_write+0x1a8/0x260
         __x64_sys_bpf+0x7a/0xc0
         ? syscall_enter_from_user_mode+0x21/0x70
         do_syscall_64+0x3b/0x90
         entry_SYSCALL_64_after_hwframe+0x63/0xcd
        RIP: 0033:0x7f917c4e2c2d
      
      The problem here is that a range of tnum_range(0, map->max_entries - 1) has
      limited ability to represent the concrete tight range with the tnum as the
      set of resulting states from value + mask can result in a superset of the
      actual intended range, and as such a tnum_in(range, reg->var_off) check may
      yield true when it shouldn't, for example tnum_range(0, 2) would result in
      00XX -> v = 0000, m = 0011 such that the intended set of {0, 1, 2} is here
      represented by a less precise superset of {0, 1, 2, 3}. As the register is
      known const scalar, really just use the concrete reg->var_off.value for the
      upper index check.
      
      Fixes: d2e4c1e6 ("bpf: Constant map key tracking for prog array pokes")
      Reported-by: default avatarHsin-Wei Hung <hsinweih@uci.edu>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Cc: Shung-Hsi Yu <shung-hsi.yu@suse.com>
      Acked-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
      Link: https://lore.kernel.org/r/984b37f9fdf7ac36831d2137415a4a915744c1b6.1661462653.git.daniel@iogearbox.netSigned-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      a657182a
    • Linus Torvalds's avatar
      Merge tag 'net-6.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 4c612826
      Linus Torvalds authored
      Pull networking fixes from Jakub Kicinski:
       "Including fixes from ipsec and netfilter (with one broken Fixes tag).
      
        Current release - new code bugs:
      
         - dsa: don't dereference NULL extack in dsa_slave_changeupper()
      
         - dpaa: fix <1G ethernet on LS1046ARDB
      
         - neigh: don't call kfree_skb() under spin_lock_irqsave()
      
        Previous releases - regressions:
      
         - r8152: fix the RX FIFO settings when suspending
      
         - dsa: microchip: keep compatibility with device tree blobs with no
           phy-mode
      
         - Revert "net: macsec: update SCI upon MAC address change."
      
         - Revert "xfrm: update SA curlft.use_time", comply with RFC 2367
      
        Previous releases - always broken:
      
         - netfilter: conntrack: work around exceeded TCP receive window
      
         - ipsec: fix a null pointer dereference of dst->dev on a metadata dst
           in xfrm_lookup_with_ifid
      
         - moxa: get rid of asymmetry in DMA mapping/unmapping
      
         - dsa: microchip: make learning configurable and keep it off while
           standalone
      
         - ice: xsk: prohibit usage of non-balanced queue id
      
         - rxrpc: fix locking in rxrpc's sendmsg
      
        Misc:
      
         - another chunk of sysctl data race silencing"
      
      * tag 'net-6.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (87 commits)
        net: lantiq_xrx200: restore buffer if memory allocation failed
        net: lantiq_xrx200: fix lock under memory pressure
        net: lantiq_xrx200: confirm skb is allocated before using
        net: stmmac: work around sporadic tx issue on link-up
        ionic: VF initial random MAC address if no assigned mac
        ionic: fix up issues with handling EAGAIN on FW cmds
        ionic: clear broken state on generation change
        rxrpc: Fix locking in rxrpc's sendmsg
        net: ethernet: mtk_eth_soc: fix hw hash reporting for MTK_NETSYS_V2
        MAINTAINERS: rectify file entry in BONDING DRIVER
        i40e: Fix incorrect address type for IPv6 flow rules
        ixgbe: stop resetting SYSTIME in ixgbe_ptp_start_cyclecounter
        net: Fix a data-race around sysctl_somaxconn.
        net: Fix a data-race around netdev_unregister_timeout_secs.
        net: Fix a data-race around gro_normal_batch.
        net: Fix data-races around sysctl_devconf_inherit_init_net.
        net: Fix data-races around sysctl_fb_tunnels_only_for_init_net.
        net: Fix a data-race around netdev_budget_usecs.
        net: Fix data-races around sysctl_max_skb_frags.
        net: Fix a data-race around netdev_budget.
        ...
      4c612826
    • Jakub Kicinski's avatar
      Merge branch 'net-lantiq_xrx200-fix-errors-under-memory-pressure' · d974730c
      Jakub Kicinski authored
      Aleksander Jan Bajkowski says:
      
      ====================
      net: lantiq_xrx200: fix errors under memory pressure
      
      This series fixes issues that can occur in the driver under memory pressure.
      Situations when the system cannot allocate memory are rare, so the mentioned
      bugs have been fixed recently. The patches have been tested on a BT Home
      router with the Lantiq xRX200 chipset.
      
      Changelog:
        v3: - removed netdev_err() log from the first patch
        v2:
         - the second patch has been changed, so that under memory pressure situation
           the driver will not receive packets indefinitely regardless of the NAPI budget,
         - the third patch has been added.
      ====================
      
      Link: https://lore.kernel.org/r/20220824215408.4695-1-olek2@wp.plSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      d974730c
    • Aleksander Jan Bajkowski's avatar
      net: lantiq_xrx200: restore buffer if memory allocation failed · c9c3b177
      Aleksander Jan Bajkowski authored
      In a situation where memory allocation fails, an invalid buffer address
      is stored. When this descriptor is used again, the system panics in the
      build_skb() function when accessing memory.
      
      Fixes: 7ea6cd16 ("lantiq: net: fix duplicated skb in rx descriptor ring")
      Signed-off-by: default avatarAleksander Jan Bajkowski <olek2@wp.pl>
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      c9c3b177