1. 17 Aug, 2020 7 commits
    • Yonghong Song's avatar
      bpf: Use get_file_rcu() instead of get_file() for task_file iterator · cf28f3bb
      Yonghong Song authored
      With latest `bpftool prog` command, we observed the following kernel
      panic.
          BUG: kernel NULL pointer dereference, address: 0000000000000000
          #PF: supervisor instruction fetch in kernel mode
          #PF: error_code(0x0010) - not-present page
          PGD dfe894067 P4D dfe894067 PUD deb663067 PMD 0
          Oops: 0010 [#1] SMP
          CPU: 9 PID: 6023 ...
          RIP: 0010:0x0
          Code: Bad RIP value.
          RSP: 0000:ffffc900002b8f18 EFLAGS: 00010286
          RAX: ffff8883a405f400 RBX: ffff888e46a6bf00 RCX: 000000008020000c
          RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8883a405f400
          RBP: ffff888e46a6bf50 R08: 0000000000000000 R09: ffffffff81129600
          R10: ffff8883a405f300 R11: 0000160000000000 R12: 0000000000002710
          R13: 000000e9494b690c R14: 0000000000000202 R15: 0000000000000009
          FS:  00007fd9187fe700(0000) GS:ffff888e46a40000(0000) knlGS:0000000000000000
          CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
          CR2: ffffffffffffffd6 CR3: 0000000de5d33002 CR4: 0000000000360ee0
          DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
          DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
          Call Trace:
           <IRQ>
           rcu_core+0x1a4/0x440
           __do_softirq+0xd3/0x2c8
           irq_exit+0x9d/0xa0
           smp_apic_timer_interrupt+0x68/0x120
           apic_timer_interrupt+0xf/0x20
           </IRQ>
          RIP: 0033:0x47ce80
          Code: Bad RIP value.
          RSP: 002b:00007fd9187fba40 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff13
          RAX: 0000000000000002 RBX: 00007fd931789160 RCX: 000000000000010c
          RDX: 00007fd9308cdfb4 RSI: 00007fd9308cdfb4 RDI: 00007ffedd1ea0a8
          RBP: 00007fd9187fbab0 R08: 000000000000000e R09: 000000000000002a
          R10: 0000000000480210 R11: 00007fd9187fc570 R12: 00007fd9316cc400
          R13: 0000000000000118 R14: 00007fd9308cdfb4 R15: 00007fd9317a9380
      
      After further analysis, the bug is triggered by
      Commit eaaacd23 ("bpf: Add task and task/file iterator targets")
      which introduced task_file bpf iterator, which traverses all open file
      descriptors for all tasks in the current namespace.
      The latest `bpftool prog` calls a task_file bpf program to traverse
      all files in the system in order to associate processes with progs/maps, etc.
      When traversing files for a given task, rcu read_lock is taken to
      access all files in a file_struct. But it used get_file() to grab
      a file, which is not right. It is possible file->f_count is 0 and
      get_file() will unconditionally increase it.
      Later put_file() may cause all kind of issues with the above
      as one of sympotoms.
      
      The failure can be reproduced with the following steps in a few seconds:
          $ cat t.c
          #include <stdio.h>
          #include <sys/types.h>
          #include <sys/stat.h>
          #include <fcntl.h>
          #include <unistd.h>
      
          #define N 10000
          int fd[N];
          int main() {
            int i;
      
            for (i = 0; i < N; i++) {
              fd[i] = open("./note.txt", 'r');
              if (fd[i] < 0) {
                 fprintf(stderr, "failed\n");
                 return -1;
              }
            }
            for (i = 0; i < N; i++)
              close(fd[i]);
      
            return 0;
          }
          $ gcc -O2 t.c
          $ cat run.sh
          #/bin/bash
          for i in {1..100}
          do
            while true; do ./a.out; done &
          done
          $ ./run.sh
          $ while true; do bpftool prog >& /dev/null; done
      
      This patch used get_file_rcu() which only grabs a file if the
      file->f_count is not zero. This is to ensure the file pointer
      is always valid. The above reproducer did not fail for more
      than 30 minutes.
      
      Fixes: eaaacd23 ("bpf: Add task and task/file iterator targets")
      Suggested-by: default avatarJosef Bacik <josef@toxicpanda.com>
      Signed-off-by: default avatarYonghong Song <yhs@fb.com>
      Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      Reviewed-by: default avatarJosef Bacik <josef@toxicpanda.com>
      Link: https://lore.kernel.org/bpf/20200817174214.252601-1-yhs@fb.com
      cf28f3bb
    • David S. Miller's avatar
      Revert "net: xdp: pull ethernet header off packet after computing skb->protocol" · 7f9bf6e8
      David S. Miller authored
      This reverts commit f8414a8d.
      
      eth_type_trans() does the necessary pull on the skb.
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7f9bf6e8
    • Randy Dunlap's avatar
      phylink: <linux/phylink.h>: fix function prototype kernel-doc warning · 0b76e642
      Randy Dunlap authored
      Fix a kernel-doc warning for the pcs_config() function prototype:
      
      ../include/linux/phylink.h:406: warning: Excess function parameter 'permit_pause_to_mac' description in 'pcs_config'
      
      Fixes: 7137e18f ("net: phylink: add struct phylink_pcs")
      Signed-off-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Cc: Russell King <linux@armlinux.org.uk>
      Cc: David S. Miller <davem@davemloft.net>
      Cc: netdev@vger.kernel.org
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0b76e642
    • Florian Westphal's avatar
      mptcp: sendmsg: reset iter on error redux · b3b2854d
      Florian Westphal authored
      This fix wasn't correct: When this function is invoked from the
      retransmission worker, the iterator contains garbage and resetting
      it causes a crash.
      
      As the work queue should not be performance critical also zero the
      msghdr struct.
      
      Fixes: 35759383 "(mptcp: sendmsg: reset iter on error)"
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b3b2854d
    • Andrew Lunn's avatar
      net: devlink: Remove overzealous WARN_ON with snapshots · bd71ea60
      Andrew Lunn authored
      It is possible to trigger this WARN_ON from user space by triggering a
      devlink snapshot with an ID which already exists. We don't need both
      -EEXISTS being reported and spamming the kernel log.
      Signed-off-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Tested-by: default avatarChris Healy <cphealy@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bd71ea60
    • Xin Long's avatar
      tipc: not enable tipc when ipv6 works as a module · c5301899
      Xin Long authored
      When using ipv6_dev_find() in one module, it requires ipv6 not to
      work as a module. Otherwise, this error occurs in build:
      
        undefined reference to `ipv6_dev_find'.
      
      So fix it by adding "depends on IPV6 || IPV6=n" to tipc/Kconfig,
      as it does in sctp/Kconfig.
      
      Fixes: 5a6f6f57 ("tipc: set ub->ifindex for local ipv6 address")
      Reported-by: default avatarkernel test robot <lkp@intel.com>
      Acked-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c5301899
    • Cong Wang's avatar
      tipc: fix uninit skb->data in tipc_nl_compat_dumpit() · 47733f9d
      Cong Wang authored
      __tipc_nl_compat_dumpit() has two callers, and it expects them to
      pass a valid nlmsghdr via arg->data. This header is artificial and
      crafted just for __tipc_nl_compat_dumpit().
      
      tipc_nl_compat_publ_dump() does so by putting a genlmsghdr as well
      as some nested attribute, TIPC_NLA_SOCK. But the other caller
      tipc_nl_compat_dumpit() does not, this leaves arg->data uninitialized
      on this call path.
      
      Fix this by just adding a similar nlmsghdr without any payload in
      tipc_nl_compat_dumpit().
      
      This bug exists since day 1, but the recent commit 6ea67769
      ("net: tipc: prepare attrs in __tipc_nl_compat_dumpit()") makes it
      easier to appear.
      
      Reported-and-tested-by: syzbot+0e7181deafa7e0b79923@syzkaller.appspotmail.com
      Fixes: d0796d1e ("tipc: convert legacy nl bearer dump to nl compat")
      Cc: Jon Maloy <jmaloy@redhat.com>
      Cc: Ying Xue <ying.xue@windriver.com>
      Cc: Richard Alpe <richard.alpe@ericsson.com>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Acked-by: default avatarYing Xue <ying.xue@windriver.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      47733f9d
  2. 16 Aug, 2020 6 commits
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf · 8c26544f
      David S. Miller authored
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter fixes for net
      
      The following patchset contains Netfilter fixes for net:
      
      1) Endianness issue in IPv4 option support in nft_exthdr,
         from Stephen Suryaputra.
      
      2) Removes the waitcount optimization in nft_compat,
         from Florian Westphal.
      
      3) Remove ipv6 -> nf_defrag_ipv6 module dependency, from
         Florian Westphal.
      
      4) Memleak in chain binding support, also from Florian.
      
      5) Simplify nft_flowtable.sh selftest, from Fabian Frederick.
      
      6) Optional MTU arguments for selftest nft_flowtable.sh,
         also from Fabian.
      
      7) Remove noise error report when killing process in
         selftest nft_flowtable.sh, from Fabian Frederick.
      
      8) Reject bogus getsockopt option length in ebtables,
         from Florian Westphal.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8c26544f
    • David S. Miller's avatar
      Merge tag 'linux-can-fixes-for-5.9-20200815' of... · 71a50419
      David S. Miller authored
      Merge tag 'linux-can-fixes-for-5.9-20200815' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can
      
      Marc Kleine-Budde says:
      
      ====================
      pull-request: can 2020-08-15
      
      this is a pull request of 4 patches for net/master.
      
      All patches are by Zhang Changzhong and fix broadcast related problems in the
      j1939 CAN networking stack.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      71a50419
    • Miaohe Lin's avatar
      net: Fix potential wrong skb->protocol in skb_vlan_untag() · 55eff0eb
      Miaohe Lin authored
      We may access the two bytes after vlan_hdr in vlan_set_encap_proto(). So
      we should pull VLAN_HLEN + sizeof(unsigned short) in skb_vlan_untag() or
      we may access the wrong data.
      
      Fixes: 0d5501c1 ("net: Always untag vlan-tagged traffic on input.")
      Signed-off-by: default avatarMiaohe Lin <linmiaohe@huawei.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      55eff0eb
    • Jason A. Donenfeld's avatar
      net: xdp: pull ethernet header off packet after computing skb->protocol · f8414a8d
      Jason A. Donenfeld authored
      When an XDP program changes the ethernet header protocol field,
      eth_type_trans is used to recalculate skb->protocol. In order for
      eth_type_trans to work correctly, the ethernet header must actually be
      part of the skb data segment, so the code first pushes that onto the
      head of the skb. However, it subsequently forgets to pull it back off,
      making the behavior of the passed-on packet inconsistent between the
      protocol modifying case and the static protocol case. This patch fixes
      the issue by simply pulling the ethernet header back off of the skb
      head.
      
      Fixes: 29724956 ("net: fix generic XDP to handle if eth header was mangled")
      Cc: Jesper Dangaard Brouer <brouer@redhat.com>
      Cc: David S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f8414a8d
    • Mahesh Bandewar's avatar
      ipvlan: fix device features · d0f5c707
      Mahesh Bandewar authored
      Processing NETDEV_FEAT_CHANGE causes IPvlan links to lose
      NETIF_F_LLTX feature because of the incorrect handling of
      features in ipvlan_fix_features().
      
      --before--
      lpaa10:~# ethtool -k ipvl0 | grep tx-lockless
      tx-lockless: on [fixed]
      lpaa10:~# ethtool -K ipvl0 tso off
      Cannot change tcp-segmentation-offload
      Actual changes:
      vlan-challenged: off [fixed]
      tx-lockless: off [fixed]
      lpaa10:~# ethtool -k ipvl0 | grep tx-lockless
      tx-lockless: off [fixed]
      lpaa10:~#
      
      --after--
      lpaa10:~# ethtool -k ipvl0 | grep tx-lockless
      tx-lockless: on [fixed]
      lpaa10:~# ethtool -K ipvl0 tso off
      Cannot change tcp-segmentation-offload
      Could not change any device features
      lpaa10:~# ethtool -k ipvl0 | grep tx-lockless
      tx-lockless: on [fixed]
      lpaa10:~#
      
      Fixes: 2ad7bf36 ("ipvlan: Initial check-in of the IPVLAN driver.")
      Signed-off-by: default avatarMahesh Bandewar <maheshb@google.com>
      Cc: Eric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d0f5c707
    • Cong Wang's avatar
      bonding: fix a potential double-unregister · 83270702
      Cong Wang authored
      When we tear down a network namespace, we unregister all
      the netdevices within it. So we may queue a slave device
      and a bonding device together in the same unregister queue.
      
      If the only slave device is non-ethernet, it would
      automatically unregister the bonding device as well. Thus,
      we may end up unregistering the bonding device twice.
      
      Workaround this special case by checking reg_state.
      
      Fixes: 9b5e383c ("net: Introduce unregister_netdevice_many()")
      Reported-by: syzbot+af23e7f3e0a7e10c8b67@syzkaller.appspotmail.com
      Cc: Eric Dumazet <eric.dumazet@gmail.com>
      Cc: Andy Gospodarek <andy@greyhouse.net>
      Cc: Jay Vosburgh <j.vosburgh@gmail.com>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      83270702
  3. 15 Aug, 2020 19 commits
    • Zhang Changzhong's avatar
      can: j1939: add rxtimer for multipacket broadcast session · 0ae18a82
      Zhang Changzhong authored
      According to SAE J1939/21 (Chapter 5.12.3 and APPENDIX C), for transmit side
      the required time interval between packets of a multipacket broadcast message
      is 50 to 200 ms, the responder shall use a timeout of 250ms (provides margin
      allowing for the maximumm spacing of 200ms). For receive side a timeout will
      occur when a time of greater than 750 ms elapsed between two message packets
      when more packets were expected.
      
      So this patch fix and add rxtimer for multipacket broadcast session.
      
      Fixes: 9d71dd0c ("can: add support of SAE J1939 protocol")
      Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
      Link: https://lore.kernel.org/r/1596599425-5534-5-git-send-email-zhangchangzhong@huawei.comAcked-by: default avatarOleksij Rempel <o.rempel@pengutronix.de>
      Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      0ae18a82
    • Zhang Changzhong's avatar
      can: j1939: abort multipacket broadcast session when timeout occurs · 2b8b2e31
      Zhang Changzhong authored
      If timeout occurs, j1939_tp_rxtimer() first calls hrtimer_start() to restart
      rxtimer, and then calls __j1939_session_cancel() to set session->state =
      J1939_SESSION_WAITING_ABORT. At next timeout expiration, because of the
      J1939_SESSION_WAITING_ABORT session state j1939_tp_rxtimer() will call
      j1939_session_deactivate_activate_next() to deactivate current session, and
      rxtimer won't be set.
      
      But for multipacket broadcast session, __j1939_session_cancel() don't set
      session->state = J1939_SESSION_WAITING_ABORT, thus current session won't be
      deactivate and hrtimer_start() is called to start new rxtimer again and again.
      
      So fix it by moving session->state = J1939_SESSION_WAITING_ABORT out of if
      (!j1939_cb_is_broadcast(&session->skcb)) statement.
      
      Fixes: 9d71dd0c ("can: add support of SAE J1939 protocol")
      Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
      Link: https://lore.kernel.org/r/1596599425-5534-4-git-send-email-zhangchangzhong@huawei.comAcked-by: default avatarOleksij Rempel <o.rempel@pengutronix.de>
      Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      2b8b2e31
    • Zhang Changzhong's avatar
      can: j1939: cancel rxtimer on multipacket broadcast session complete · e8b17653
      Zhang Changzhong authored
      If j1939_xtp_rx_dat_one() receive last frame of multipacket broadcast message,
      j1939_session_timers_cancel() should be called to cancel rxtimer.
      
      Fixes: 9d71dd0c ("can: add support of SAE J1939 protocol")
      Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
      Link: https://lore.kernel.org/r/1596599425-5534-3-git-send-email-zhangchangzhong@huawei.comAcked-by: default avatarOleksij Rempel <o.rempel@pengutronix.de>
      Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      e8b17653
    • Zhang Changzhong's avatar
      can: j1939: fix support for multipacket broadcast message · f4fd77fd
      Zhang Changzhong authored
      Currently j1939_tp_im_involved_anydir() in j1939_tp_recv() check the previously
      set flags J1939_ECU_LOCAL_DST and J1939_ECU_LOCAL_SRC of incoming skb, thus
      multipacket broadcast message was aborted by receive side because it may come
      from remote ECUs and have no exact dst address. Similarly, j1939_tp_cmd_recv()
      and j1939_xtp_rx_dat() didn't process broadcast message.
      
      So fix it by checking and process broadcast message in j1939_tp_recv(),
      j1939_tp_cmd_recv() and j1939_xtp_rx_dat().
      
      Fixes: 9d71dd0c ("can: add support of SAE J1939 protocol")
      Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
      Link: https://lore.kernel.org/r/1596599425-5534-2-git-send-email-zhangchangzhong@huawei.comAcked-by: default avatarOleksij Rempel <o.rempel@pengutronix.de>
      Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      f4fd77fd
    • Lee Jones's avatar
      net: fddi: skfp: cfm: Remove seemingly unused variable 'ID_sccs' · 81dbf219
      Lee Jones authored
      This variable is present in many source files and has not been used
      anywhere (at least internally) since it was introduced.
      
      Fixes the following W=1 kernel build warning(s):
      
       drivers/net/fddi/skfp/cfm.c: In function ‘cfm’:
       drivers/net/fddi/skfp/cfm.c:211:6: warning: variable ‘oldstate’ set but not used [-Wunused-but-set-variable]
       drivers/net/fddi/skfp/cfm.c:40:19: warning: ‘ID_sccs’ defined but not used [-Wunused-const-variable=]
      
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: Jakub Kicinski <kuba@kernel.org>
      Cc: Lee Jones <lee.jones@linaro.org>
      Cc: netdev@vger.kernel.org
      Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      81dbf219
    • Lee Jones's avatar
      net: fddi: skfp: cfm: Remove set but unused variable 'oldstate' · d1ad06ba
      Lee Jones authored
      While we're at it, remove some code which has never been invoked.
      
      Keep the comment though, as it seems potentially half useful.
      
      Fixes the following W=1 kernel build warning(s):
      
       drivers/net/fddi/skfp/cfm.c: In function ‘cfm’:
       drivers/net/fddi/skfp/cfm.c:211:6: warning: variable ‘oldstate’ set but not used [-Wunused-but-set-variable]
      
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: Jakub Kicinski <kuba@kernel.org>
      Cc: netdev@vger.kernel.org
      Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d1ad06ba
    • Lee Jones's avatar
      net: fddi: skfp: smt: Remove seemingly unused variable 'ID_sccs' · 7b1af34f
      Lee Jones authored
      This variable is present in many source files and has not been used
      anywhere (at least internally) since it was introduced.
      
      Fixes the following W=1 kernel build warning(s):
      
       drivers/net/fddi/skfp/smt.c:24:19: warning: ‘ID_sccs’ defined but not used [-Wunused-const-variable=]
      
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: Jakub Kicinski <kuba@kernel.org>
      Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
      Cc: netdev@vger.kernel.org
      Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7b1af34f
    • Lee Jones's avatar
      net: fddi: skfp: smt: Place definition of 'smt_pdef' under same stipulations as its use · 327afdd7
      Lee Jones authored
      The variable 'smt_pdef' is only used if LITTLE_ENDIAN is set, so only
      define it if this is the case.
      
      Fixes the following W=1 kernel build warning(s):
      
       drivers/net/fddi/skfp/smt.c:1572:3: warning: ‘smt_pdef’ defined but not used [-Wunused-const-variable=]
      
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: Jakub Kicinski <kuba@kernel.org>
      Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
      Cc: netdev@vger.kernel.org
      Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      327afdd7
    • Lee Jones's avatar
      net: fddi: skfp: fplustm: Remove seemingly unused variable 'ID_sccs' · 026ff46b
      Lee Jones authored
      This variable is present in many source files and has not been used
      anywhere (at least internally) since it was introduced.
      
      Fixes the following W=1 kernel build warning(s):
      
       drivers/net/fddi/skfp/fplustm.c:25:19: warning: ‘ID_sccs’ defined but not used [-Wunused-const-variable=]
      
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: Jakub Kicinski <kuba@kernel.org>
      Cc: Maxime Coquelin <mcoquelin.stm32@gmail.com>
      Cc: Alexandre Torgue <alexandre.torgue@st.com>
      Cc: netdev@vger.kernel.org
      Cc: linux-stm32@st-md-mailman.stormreply.com
      Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      026ff46b
    • Lee Jones's avatar
      net: fddi: skfp: hwmtm: Remove seemingly unused variable 'ID_sccs' · 0d9b5645
      Lee Jones authored
      This variable is present in many source files and has not been used
      anywhere (at least internally) since it was introduced.
      
      Fixes the following W=1 kernel build warning(s):
      
       drivers/net/fddi/skfp/hwmtm.c:14:19: warning: ‘ID_sccs’ defined but not used [-Wunused-const-variable=]
      
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: Jakub Kicinski <kuba@kernel.org>
      Cc: netdev@vger.kernel.org
      Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0d9b5645
    • Lee Jones's avatar
      net: wan: dlci: Remove set but not used variable 'err' · 1a2c2668
      Lee Jones authored
      Fixes the following W=1 kernel build warning(s):
      
       drivers/net/wan/dlci.c: In function ‘dlci_close’:
       drivers/net/wan/dlci.c:298:8: warning: variable ‘err’ set but not used [-Wunused-but-set-variable]
      
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: Jakub Kicinski <kuba@kernel.org>
      Cc: Mike McLagan <mike.mclagan@linux.org>
      Cc: netdev@vger.kernel.org
      Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1a2c2668
    • Lee Jones's avatar
      net: ethernet: 8390: axnet_cs: Document unused parameter 'txqueue' · fd29aeee
      Lee Jones authored
      Fixes the following W=1 kernel build warning(s):
      
       drivers/net/ethernet/8390/axnet_cs.c:907: warning: Function parameter or member 'txqueue' not described in 'axnet_tx_timeout'
      
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: Jakub Kicinski <kuba@kernel.org>
      Cc: Martin Habets <mhabets@solarflare.com>
      Cc: Shannon Nelson <snelson@pensando.io>
      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: William Lee <william@asix.com.tw>
      Cc: "A. Hinds --" <dahinds@users.sourceforge.net>
      Cc: reached at <becker@scyld.com>
      Cc: netdev@vger.kernel.org
      Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fd29aeee
    • Lee Jones's avatar
      net: bonding: bond_alb: Describe alb_handle_addr_collision_on_attach()'s 'bond' and 'addr' params · f6e81b89
      Lee Jones authored
      Fixes the following W=1 kernel build warning(s):
      
       drivers/net/bonding/bond_alb.c:1222: warning: Function parameter or member 'bond' not described in 'alb_set_mac_address'
      
      Cc: Jay Vosburgh <j.vosburgh@gmail.com>
      Cc: Veaceslav Falico <vfalico@gmail.com>
      Cc: Andy Gospodarek <andy@greyhouse.net>
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: Jakub Kicinski <kuba@kernel.org>
      Cc: netdev@vger.kernel.org
      Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f6e81b89
    • Lee Jones's avatar
      net: ethernet: 3com: 3c574_cs: Remove set but unused variables 'tx' and 'rx' · 2083bebc
      Lee Jones authored
      Fixes the following W=1 kernel build warning(s):
      
       drivers/net/ethernet/3com/3c574_cs.c: In function ‘update_stats’:
       drivers/net/ethernet/3com/3c574_cs.c:954:9: warning: variable ‘tx’ set but not used [-Wunused-but-set-variable]
       954 | u8 rx, tx, up;
       | ^~
       drivers/net/ethernet/3com/3c574_cs.c:954:5: warning: variable ‘rx’ set but not used [-Wunused-but-set-variable]
       954 | u8 rx, tx, up;
       | ^~
      
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: Jakub Kicinski <kuba@kernel.org>
      Cc: Shannon Nelson <snelson@pensando.io>
      Cc: Heiner Kallweit <hkallweit1@gmail.com>
      Cc: Martin Habets <mhabets@solarflare.com>
      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Donald Becker <becker@scyld.com>
      Cc: David Hinds <dahinds@users.sourceforge.net>
      Cc: netdev@vger.kernel.org
      Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2083bebc
    • Lee Jones's avatar
      net: bonding: bond_main: Document 'proto' and rename 'new_active' parameters · 45a1553b
      Lee Jones authored
      Fixes the following W=1 kernel build warning(s):
      
       drivers/net/bonding/bond_main.c:329: warning: Function parameter or member 'proto' not described in 'bond_vlan_rx_add_vid'
       drivers/net/bonding/bond_main.c:362: warning: Function parameter or member 'proto' not described in 'bond_vlan_rx_kill_vid'
       drivers/net/bonding/bond_main.c:964: warning: Function parameter or member 'new_active' not described in 'bond_change_active_slave'
       drivers/net/bonding/bond_main.c:964: warning: Excess function parameter 'new' description in 'bond_change_active_slave'
      
      Cc: Jay Vosburgh <j.vosburgh@gmail.com>
      Cc: Veaceslav Falico <vfalico@gmail.com>
      Cc: Andy Gospodarek <andy@greyhouse.net>
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: Jakub Kicinski <kuba@kernel.org>
      Cc: Thomas Davis <tadavis@lbl.gov>
      Cc: netdev@vger.kernel.org
      Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      45a1553b
    • Lee Jones's avatar
      net: bonding: bond_3ad: Fix a bunch of kerneldoc parameter issues · a35e5478
      Lee Jones authored
      Renames and missing descriptions.
      
      Fixes the following W=1 kernel build warning(s):
      
       drivers/net/bonding/bond_3ad.c:140: warning: Function parameter or member 'port' not described in '__get_first_agg'
       drivers/net/bonding/bond_3ad.c:140: warning: Excess function parameter 'bond' description in '__get_first_agg'
       drivers/net/bonding/bond_3ad.c:1655: warning: Function parameter or member 'agg' not described in 'ad_agg_selection_logic'
       drivers/net/bonding/bond_3ad.c:1655: warning: Excess function parameter 'aggregator' description in 'ad_agg_selection_logic'
       drivers/net/bonding/bond_3ad.c:1817: warning: Function parameter or member 'port' not described in 'ad_initialize_port'
       drivers/net/bonding/bond_3ad.c:1817: warning: Excess function parameter 'aggregator' description in 'ad_initialize_port'
       drivers/net/bonding/bond_3ad.c:1976: warning: Function parameter or member 'timeout' not described in 'bond_3ad_initiate_agg_selection'
       drivers/net/bonding/bond_3ad.c:2274: warning: Function parameter or member 'work' not described in 'bond_3ad_state_machine_handler'
       drivers/net/bonding/bond_3ad.c:2274: warning: Excess function parameter 'bond' description in 'bond_3ad_state_machine_handler'
       drivers/net/bonding/bond_3ad.c:2508: warning: Function parameter or member 'link' not described in 'bond_3ad_handle_link_change'
       drivers/net/bonding/bond_3ad.c:2508: warning: Excess function parameter 'status' description in 'bond_3ad_handle_link_change'
       drivers/net/bonding/bond_3ad.c:2566: warning: Function parameter or member 'bond' not described in 'bond_3ad_set_carrier'
       drivers/net/bonding/bond_3ad.c:2677: warning: Function parameter or member 'bond' not described in 'bond_3ad_update_lacp_rate'
       drivers/net/bonding/bond_3ad.c:1655: warning: Function parameter or member 'agg' not described in 'ad_agg_selection_logic'
       drivers/net/bonding/bond_3ad.c:1655: warning: Excess function parameter 'aggregator' description in 'ad_agg_selection_logic'
       drivers/net/bonding/bond_3ad.c:1817: warning: Function parameter or member 'port' not described in 'ad_initialize_port'
       drivers/net/bonding/bond_3ad.c:1817: warning: Excess function parameter 'aggregator' description in 'ad_initialize_port'
       drivers/net/bonding/bond_3ad.c:1976: warning: Function parameter or member 'timeout' not described in 'bond_3ad_initiate_agg_selection'
       drivers/net/bonding/bond_3ad.c:2274: warning: Function parameter or member 'work' not described in 'bond_3ad_state_machine_handler'
       drivers/net/bonding/bond_3ad.c:2274: warning: Excess function parameter 'bond' description in 'bond_3ad_state_machine_handler'
       drivers/net/bonding/bond_3ad.c:2508: warning: Function parameter or member 'link' not described in 'bond_3ad_handle_link_change'
       drivers/net/bonding/bond_3ad.c:2508: warning: Excess function parameter 'status' description in 'bond_3ad_handle_link_change'
       drivers/net/bonding/bond_3ad.c:2566: warning: Function parameter or member 'bond' not described in 'bond_3ad_set_carrier'
       drivers/net/bonding/bond_3ad.c:2677: warning: Function parameter or member 'bond' not described in 'bond_3ad_update_lacp_rate'
      
      Cc: Jay Vosburgh <j.vosburgh@gmail.com>
      Cc: Veaceslav Falico <vfalico@gmail.com>
      Cc: Andy Gospodarek <andy@greyhouse.net>
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: Jakub Kicinski <kuba@kernel.org>
      Cc: netdev@vger.kernel.org
      Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a35e5478
    • Xie He's avatar
      drivers/net/wan/hdlc_x25: Added needed_headroom and a skb->len check · 77b981c8
      Xie He authored
      1. Added a skb->len check
      
      This driver expects upper layers to include a pseudo header of 1 byte
      when passing down a skb for transmission. This driver will read this
      1-byte header. This patch added a skb->len check before reading the
      header to make sure the header exists.
      
      2. Added needed_headroom and set hard_header_len to 0
      
      When this driver transmits data,
        first this driver will remove a pseudo header of 1 byte,
        then the lapb module will prepend the LAPB header of 2 or 3 bytes.
      So the value of needed_headroom in this driver should be 3 - 1.
      
      Because this driver has no header_ops, according to the logic of
      af_packet.c, the value of hard_header_len should be 0.
      
      Reason of setting needed_headroom and hard_header_len at this place:
      
      This driver is written using the API of the hdlc module, the hdlc
      module enables this driver (the protocol driver) to run on any hardware
      that has a driver (the hardware driver) written using the API of the
      hdlc module.
      
      Two other hdlc protocol drivers - hdlc_ppp and hdlc_raw_eth, also set
      things like hard_header_len at this place. In hdlc_ppp, it sets
      hard_header_len after attach_hdlc_protocol and before setting dev->type.
      In hdlc_raw_eth, it sets hard_header_len by calling ether_setup after
      attach_hdlc_protocol and after memcpy the settings.
      
      3. Reset needed_headroom when detaching protocols (in hdlc.c)
      
      When detaching a protocol from a hardware device, the hdlc module will
      reset various parameters of the device (including hard_header_len) to
      the default values. We add needed_headroom here so that needed_headroom
      will also be reset.
      
      Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
      Cc: Martin Schiller <ms@dev.tdt.de>
      Cc: Andrew Hendry <andrew.hendry@gmail.com>
      Signed-off-by: default avatarXie He <xie.he.0141@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      77b981c8
    • Jarod Wilson's avatar
      bonding: show saner speed for broadcast mode · 4ca0d9ac
      Jarod Wilson authored
      Broadcast mode bonds transmit a copy of all traffic simultaneously out of
      all interfaces, so the "speed" of the bond isn't really the aggregate of
      all interfaces, but rather, the speed of the slowest active interface.
      
      Also, the type of the speed field is u32, not unsigned long, so adjust
      that accordingly, as required to make min() function here without
      complaining about mismatching types.
      
      Fixes: bb5b052f ("bond: add support to read speed and duplex via ethtool")
      CC: Jay Vosburgh <j.vosburgh@gmail.com>
      CC: Veaceslav Falico <vfalico@gmail.com>
      CC: Andy Gospodarek <andy@greyhouse.net>
      CC: "David S. Miller" <davem@davemloft.net>
      CC: netdev@vger.kernel.org
      Acked-by: default avatarJay Vosburgh <jay.vosburgh@canonical.com>
      Signed-off-by: default avatarJarod Wilson <jarod@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4ca0d9ac
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf · 10a3b7c1
      David S. Miller authored
      Daniel Borkmann says:
      
      ====================
      pull-request: bpf 2020-08-15
      
      The following pull-request contains BPF updates for your *net* tree.
      
      We've added 23 non-merge commits during the last 4 day(s) which contain
      a total of 32 files changed, 421 insertions(+), 141 deletions(-).
      
      The main changes are:
      
      1) Fix sock_ops ctx access splat due to register override, from John Fastabend.
      
      2) Batch of various fixes to libbpf, bpftool, and selftests when testing build
         in 32-bit mode, from Andrii Nakryiko.
      
      3) Fix vmlinux.h generation on ARM by mapping GCC built-in types (__Poly*_t)
         to equivalent ones clang can work with, from Jean-Philippe Brucker.
      
      4) Fix build_id lookup in bpf_get_stackid() helper by walking all NOTE ELF
         sections instead of just first, from Jiri Olsa.
      
      5) Avoid use of __builtin_offsetof() in libbpf for CO-RE, from Yonghong Song.
      
      6) Fix segfault in test_mmap due to inconsistent length params, from Jianlin Lv.
      
      7) Don't override errno in libbpf when logging errors, from Toke Høiland-Jørgensen.
      
      8) Fix v4_to_v6 sockaddr conversion in sk_lookup test, from Stanislav Fomichev.
      
      9) Add link to bpf-helpers(7) man page to BPF doc, from Joe Stringer.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      10a3b7c1
  4. 14 Aug, 2020 8 commits
    • Fugang Duan's avatar
      net: fec: correct the error path for regulator disable in probe · c6165cf0
      Fugang Duan authored
      Correct the error path for regulator disable.
      
      Fixes: 9269e556 ("net: fec: add phy-reset-gpios PROBE_DEFER check")
      Signed-off-by: default avatarFugang Duan <fugang.duan@nxp.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c6165cf0
    • Nivedita Singhvi's avatar
      docs: networking: bonding.rst resources section cleanup · b07e2a86
      Nivedita Singhvi authored
      Removed obsolete resources from bonding.rst doc:
         - bonding-devel@lists.sourceforge.net hasn't been used since 2008
         - admin interface is 404
         - Donald Becker's domain/content no longer online
      Signed-off-by: default avatarNivedita Singhvi <nivedita.singhvi@canonical.com>
      Acked-by: default avatarJay Vosburgh <jay.vosburgh@canonical.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b07e2a86
    • David S. Miller's avatar
      Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue · 0b32ce68
      David S. Miller authored
      Tony Nguyen says:
      
      ====================
      Intel Wired LAN Driver Updates 2020-08-14
      
      This series contains updates to i40e and igc drivers.
      
      Vinicius fixes an issue with PTP spinlock being accessed before
      initialization.
      
      Przemyslaw fixes an issue with trusted VFs seeing additional traffic.
      
      Grzegorz adds a wait for pending resets on driver removal to prevent
      null pointer dereference.
      
      v2: Fix function parameter for hw/aq in patch 2. Fix fixes tag in patch 3.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0b32ce68
    • Grzegorz Szczurek's avatar
      i40e: Fix crash during removing i40e driver · 5b6d4a7f
      Grzegorz Szczurek authored
      Fix the reason of crashing system by add waiting time to finish reset
      recovery process before starting remove driver procedure.
      Now VSI is releasing if VSI is not in reset recovery mode.
      Without this fix it was possible to start remove driver if other
      processing command need reset recovery procedure which resulted in
      null pointer dereference. VSI used by the ethtool process has been
      cleared by remove driver process.
      
      [ 6731.508665] BUG: kernel NULL pointer dereference, address: 0000000000000000
      [ 6731.508668] #PF: supervisor read access in kernel mode
      [ 6731.508670] #PF: error_code(0x0000) - not-present page
      [ 6731.508671] PGD 0 P4D 0
      [ 6731.508674] Oops: 0000 [#1] SMP PTI
      [ 6731.508679] Hardware name: Intel Corporation S2600WT2R/S2600WT2R, BIOS SE5C610.86B.01.01.0021.032120170601 03/21/2017
      [ 6731.508694] RIP: 0010:i40e_down+0x252/0x310 [i40e]
      [ 6731.508696] Code: c7 78 de fa c0 e8 61 02 3a c1 66 83 bb f6 0c 00 00 00 0f 84 bf 00 00 00 45 31 e4 45 31 ff eb 03 41 89 c7 48 8b 83 98 0c 00 00 <4a> 8b 3c 20 e8 a5 79 02 00 48 83 bb d0 0c 00 00 00 74 10 48 8b 83
      [ 6731.508698] RSP: 0018:ffffb75ac7b3faf0 EFLAGS: 00010246
      [ 6731.508700] RAX: 0000000000000000 RBX: ffff9c9874bd5000 RCX: 0000000000000007
      [ 6731.508701] RDX: 0000000000000000 RSI: 0000000000000096 RDI: ffff9c987f4d9780
      [ 6731.508703] RBP: ffffb75ac7b3fb30 R08: 0000000000005b60 R09: 0000000000000004
      [ 6731.508704] R10: ffffb75ac64fbd90 R11: 0000000000000001 R12: 0000000000000000
      [ 6731.508706] R13: ffff9c97a08e0000 R14: ffff9c97a08e0a68 R15: 0000000000000000
      [ 6731.508708] FS:  00007f2617cd2740(0000) GS:ffff9c987f4c0000(0000) knlGS:0000000000000000
      [ 6731.508710] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [ 6731.508711] CR2: 0000000000000000 CR3: 0000001e765c4006 CR4: 00000000003606e0
      [ 6731.508713] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      [ 6731.508714] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      [ 6731.508715] Call Trace:
      [ 6731.508734]  i40e_vsi_close+0x84/0x90 [i40e]
      [ 6731.508742]  i40e_quiesce_vsi.part.98+0x3c/0x40 [i40e]
      [ 6731.508749]  i40e_pf_quiesce_all_vsi+0x55/0x60 [i40e]
      [ 6731.508757]  i40e_prep_for_reset+0x59/0x130 [i40e]
      [ 6731.508765]  i40e_reconfig_rss_queues+0x5a/0x120 [i40e]
      [ 6731.508774]  i40e_set_channels+0xda/0x170 [i40e]
      [ 6731.508778]  ethtool_set_channels+0xe9/0x150
      [ 6731.508781]  dev_ethtool+0x1b94/0x2920
      [ 6731.508805]  dev_ioctl+0xc2/0x590
      [ 6731.508811]  sock_do_ioctl+0xae/0x150
      [ 6731.508813]  sock_ioctl+0x34f/0x3c0
      [ 6731.508821]  ksys_ioctl+0x98/0xb0
      [ 6731.508828]  __x64_sys_ioctl+0x1a/0x20
      [ 6731.508831]  do_syscall_64+0x57/0x1c0
      [ 6731.508835]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      
      Fixes: 4b816446 ("i40e: Add common function for finding VSI by type")
      Signed-off-by: default avatarGrzegorz Szczurek <grzegorzx.szczurek@intel.com>
      Signed-off-by: default avatarArkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
      Tested-by: default avatarAaron Brown <aaron.f.brown@intel.com>
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      5b6d4a7f
    • Przemyslaw Patynowski's avatar
      i40e: Set RX_ONLY mode for unicast promiscuous on VLAN · 4bd5e02a
      Przemyslaw Patynowski authored
      Trusted VF with unicast promiscuous mode set, could listen to TX
      traffic of other VFs.
      Set unicast promiscuous mode to RX traffic, if VSI has port VLAN
      configured. Rename misleading I40E_AQC_SET_VSI_PROMISC_TX bit to
      I40E_AQC_SET_VSI_PROMISC_RX_ONLY. Aligned unicast promiscuous with
      VLAN to the one without VLAN.
      
      Fixes: 6c41a760 ("i40e: Add promiscuous on VLAN support")
      Fixes: 3b120089 ("i40e: When in promisc mode apply promisc mode to Tx Traffic as well")
      Signed-off-by: default avatarPrzemyslaw Patynowski <przemyslawx.patynowski@intel.com>
      Signed-off-by: default avatarAleksandr Loktionov <aleksandr.loktionov@intel.com>
      Signed-off-by: default avatarArkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
      Tested-by: default avatarAndrew Bowers <andrewx.bowers@intel.com>
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      4bd5e02a
    • Florian Westphal's avatar
      mptcp: sendmsg: reset iter on error · 35759383
      Florian Westphal authored
      Once we've copied data from the iterator we need to revert in case we
      end up not sending any data.
      
      This bug doesn't trigger with normal 'poll' based tests, because
      we only feed a small chunk of data to kernel after poll indicated
      POLLOUT.  With blocking IO and large writes this triggers. Receiver
      ends up with less data than it should get.
      
      Fixes: 72511aab ("mptcp: avoid blocking in tcp_sendpages")
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Reviewed-by: default avatarMat Martineau <mathew.j.martineau@linux.intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      35759383
    • Edward Cree's avatar
      sfc: check hash is valid before using it · 06888543
      Edward Cree authored
      On EF100, the RX hash field in the packet prefix may not be valid (e.g.
       if the header parse failed), and this is indicated by a one-bit flag
       elsewhere in the packet prefix.  Only call skb_set_hash() if the
       RSS_HASH_VALID bit is set.
      Signed-off-by: default avatarEdward Cree <ecree@solarflare.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      06888543
    • David S. Miller's avatar
      Merge tag 'linux-can-fixes-for-5.9-20200814' of... · e591d298
      David S. Miller authored
      Merge tag 'linux-can-fixes-for-5.9-20200814' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can
      
      Marc Kleine-Budde says:
      
      ====================
      pull-request: can 2020-08-14
      
      this is a pull request of 6 patches for net/master. All patches fix problems in
      the j1939 CAN networking stack.
      
      The first patch is by Eric Dumazet fixes a kernel-infoleak in
      j1939_sk_sock2sockaddr_can().
      
      The remaining 5 patches are by Oleksij Rempel and fix recption of j1939
      messages not orginated by the stack, a use-after-free in j1939_tp_txtimer(),
      ensure that the CAN driver has a ml_priv allocated. These problem were found by
      google's syzbot. Further ETP sessions with block size of less than 255 are
      fixed and a sanity check was added to j1939_xtp_rx_dat_one() to detect packet
      corruption.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e591d298