Skip to content

Commit 57f1f9d

Browse files
torvaldstorvalds
committed
Merge tag 'net-6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Jakub Kicinski: "Including fixes from BPF, netfilter, bluetooth and CAN. Current release - regressions: - eth: r8169: multiple fixes for PCIe ASPM-related problems - vrf: fix RCU lockdep splat in output path Previous releases - regressions: - gso: fall back to SW segmenting with GSO_UDP_L4 dodgy bit set - dsa: mv88e6xxx: do a final check before timing out when polling - nf_tables: fix sleep in atomic in nft_chain_validate Previous releases - always broken: - sched: fix undoing tcf_bind_filter() in multiple classifiers - bpf, arm64: fix BTI type used for freplace attached functions - can: gs_usb: fix time stamp counter initialization - nft_set_pipapo: fix improper element removal (leading to UAF) Misc: - net: support STP on bridge in non-root netns, STP prevents packet loops so not supporting it results in freezing systems of unsuspecting users, and in turn very upset noises being made - fix kdoc warnings - annotate various bits of TCP state to prevent data races" * tag 'net-6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (95 commits) net: phy: prevent stale pointer dereference in phy_init() tcp: annotate data-races around fastopenq.max_qlen tcp: annotate data-races around icsk->icsk_user_timeout tcp: annotate data-races around tp->notsent_lowat tcp: annotate data-races around rskq_defer_accept tcp: annotate data-races around tp->linger2 tcp: annotate data-races around icsk->icsk_syn_retries tcp: annotate data-races around tp->keepalive_probes tcp: annotate data-races around tp->keepalive_intvl tcp: annotate data-races around tp->keepalive_time tcp: annotate data-races around tp->tsoffset tcp: annotate data-races around tp->tcp_tx_delay Bluetooth: MGMT: Use correct address for memcpy() Bluetooth: btusb: Fix bluetooth on Intel Macbook 2014 Bluetooth: SCO: fix sco_conn related locking and validity issues Bluetooth: hci_conn: return ERR_PTR instead of NULL when there is no link Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() Bluetooth: coredump: fix building with coredump disabled Bluetooth: ISO: fix iso_conn related locking and validity issues Bluetooth: hci_event: call disconnect callback before deleting conn ...
2 parents e599e16 + 75d42b3 commit 57f1f9d

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

84 files changed

+1152
-713
lines changed

‎.mailmap

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -241,6 +241,7 @@ Jisheng Zhang <jszhang@kernel.org> <Jisheng.Zhang@synaptics.com>
241241
Johan Hovold <johan@kernel.org> <jhovold@gmail.com>
242242
Johan Hovold <johan@kernel.org> <johan@hovoldconsulting.com>
243243
John Crispin <john@phrozen.org> <blogic@openwrt.org>
244+
John Fastabend <john.fastabend@gmail.com> <john.r.fastabend@intel.com>
244245
John Keeping <john@keeping.me.uk> <john@metanate.com>
245246
John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
246247
John Stultz <johnstul@us.ibm.com>
@@ -454,6 +455,8 @@ Sebastian Reichel <sre@kernel.org> <sre@debian.org>
454455
Sedat Dilek <sedat.dilek@gmail.com> <sedat.dilek@credativ.de>
455456
Seth Forshee <sforshee@kernel.org> <seth.forshee@canonical.com>
456457
Shannon Nelson <shannon.nelson@amd.com> <snelson@pensando.io>
458+
Shannon Nelson <shannon.nelson@amd.com> <shannon.nelson@intel.com>
459+
Shannon Nelson <shannon.nelson@amd.com> <shannon.nelson@oracle.com>
457460
Shiraz Hashim <shiraz.linux.kernel@gmail.com> <shiraz.hashim@st.com>
458461
Shuah Khan <shuah@kernel.org> <shuahkhan@gmail.com>
459462
Shuah Khan <shuah@kernel.org> <shuah.khan@hp.com>

‎arch/arm64/net/bpf_jit_comp.c

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -322,7 +322,13 @@ static int build_prologue(struct jit_ctx *ctx, bool ebpf_from_cbpf)
322322
*
323323
*/
324324

325-
emit_bti(A64_BTI_C, ctx);
325+
/* bpf function may be invoked by 3 instruction types:
326+
* 1. bl, attached via freplace to bpf prog via short jump
327+
* 2. br, attached via freplace to bpf prog via long jump
328+
* 3. blr, working as a function pointer, used by emit_call.
329+
* So BTI_JC should used here to support both br and blr.
330+
*/
331+
emit_bti(A64_BTI_JC, ctx);
326332

327333
emit(A64_MOV(1, A64_R(9), A64_LR), ctx);
328334
emit(A64_NOP, ctx);

‎drivers/bluetooth/btusb.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4104,6 +4104,7 @@ static int btusb_probe(struct usb_interface *intf,
41044104
BT_DBG("intf %p id %p", intf, id);
41054105

41064106
if ((id->driver_info & BTUSB_IFNUM_2) &&
4107+
(intf->cur_altsetting->desc.bInterfaceNumber != 0) &&
41074108
(intf->cur_altsetting->desc.bInterfaceNumber != 2))
41084109
return -ENODEV;
41094110

‎drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -227,6 +227,8 @@ static int
227227
__mcp251xfd_chip_set_mode(const struct mcp251xfd_priv *priv,
228228
const u8 mode_req, bool nowait)
229229
{
230+
const struct can_bittiming *bt = &priv->can.bittiming;
231+
unsigned long timeout_us = MCP251XFD_POLL_TIMEOUT_US;
230232
u32 con = 0, con_reqop, osc = 0;
231233
u8 mode;
232234
int err;
@@ -246,12 +248,16 @@ __mcp251xfd_chip_set_mode(const struct mcp251xfd_priv *priv,
246248
if (mode_req == MCP251XFD_REG_CON_MODE_SLEEP || nowait)
247249
return 0;
248250

251+
if (bt->bitrate)
252+
timeout_us = max_t(unsigned long, timeout_us,
253+
MCP251XFD_FRAME_LEN_MAX_BITS * USEC_PER_SEC /
254+
bt->bitrate);
255+
249256
err = regmap_read_poll_timeout(priv->map_reg, MCP251XFD_REG_CON, con,
250257
!mcp251xfd_reg_invalid(con) &&
251258
FIELD_GET(MCP251XFD_REG_CON_OPMOD_MASK,
252259
con) == mode_req,
253-
MCP251XFD_POLL_SLEEP_US,
254-
MCP251XFD_POLL_TIMEOUT_US);
260+
MCP251XFD_POLL_SLEEP_US, timeout_us);
255261
if (err != -ETIMEDOUT && err != -EBADMSG)
256262
return err;
257263

‎drivers/net/can/spi/mcp251xfd/mcp251xfd.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -387,6 +387,7 @@ static_assert(MCP251XFD_TIMESTAMP_WORK_DELAY_SEC <
387387
#define MCP251XFD_OSC_STAB_TIMEOUT_US (10 * MCP251XFD_OSC_STAB_SLEEP_US)
388388
#define MCP251XFD_POLL_SLEEP_US (10)
389389
#define MCP251XFD_POLL_TIMEOUT_US (USEC_PER_MSEC)
390+
#define MCP251XFD_FRAME_LEN_MAX_BITS (736)
390391

391392
/* Misc */
392393
#define MCP251XFD_NAPI_WEIGHT 32

‎drivers/net/can/usb/gs_usb.c

Lines changed: 74 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -303,12 +303,6 @@ struct gs_can {
303303
struct can_bittiming_const bt_const, data_bt_const;
304304
unsigned int channel; /* channel number */
305305

306-
/* time counter for hardware timestamps */
307-
struct cyclecounter cc;
308-
struct timecounter tc;
309-
spinlock_t tc_lock; /* spinlock to guard access tc->cycle_last */
310-
struct delayed_work timestamp;
311-
312306
u32 feature;
313307
unsigned int hf_size_tx;
314308

@@ -325,6 +319,13 @@ struct gs_usb {
325319
struct gs_can *canch[GS_MAX_INTF];
326320
struct usb_anchor rx_submitted;
327321
struct usb_device *udev;
322+
323+
/* time counter for hardware timestamps */
324+
struct cyclecounter cc;
325+
struct timecounter tc;
326+
spinlock_t tc_lock; /* spinlock to guard access tc->cycle_last */
327+
struct delayed_work timestamp;
328+
328329
unsigned int hf_size_rx;
329330
u8 active_channels;
330331
};
@@ -388,15 +389,15 @@ static int gs_cmd_reset(struct gs_can *dev)
388389
GFP_KERNEL);
389390
}
390391

391-
static inline int gs_usb_get_timestamp(const struct gs_can *dev,
392+
static inline int gs_usb_get_timestamp(const struct gs_usb *parent,
392393
u32 *timestamp_p)
393394
{
394395
__le32 timestamp;
395396
int rc;
396397

397-
rc = usb_control_msg_recv(dev->udev, 0, GS_USB_BREQ_TIMESTAMP,
398+
rc = usb_control_msg_recv(parent->udev, 0, GS_USB_BREQ_TIMESTAMP,
398399
USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
399-
dev->channel, 0,
400+
0, 0,
400401
&timestamp, sizeof(timestamp),
401402
USB_CTRL_GET_TIMEOUT,
402403
GFP_KERNEL);
@@ -410,73 +411,74 @@ static inline int gs_usb_get_timestamp(const struct gs_can *dev,
410411

411412
static u64 gs_usb_timestamp_read(const struct cyclecounter *cc) __must_hold(&dev->tc_lock)
412413
{
413-
struct gs_can *dev = container_of(cc, struct gs_can, cc);
414+
struct gs_usb *parent = container_of(cc, struct gs_usb, cc);
414415
u32 timestamp = 0;
415416
int err;
416417

417-
lockdep_assert_held(&dev->tc_lock);
418+
lockdep_assert_held(&parent->tc_lock);
418419

419420
/* drop lock for synchronous USB transfer */
420-
spin_unlock_bh(&dev->tc_lock);
421-
err = gs_usb_get_timestamp(dev, &timestamp);
422-
spin_lock_bh(&dev->tc_lock);
421+
spin_unlock_bh(&parent->tc_lock);
422+
err = gs_usb_get_timestamp(parent, &timestamp);
423+
spin_lock_bh(&parent->tc_lock);
423424
if (err)
424-
netdev_err(dev->netdev,
425-
"Error %d while reading timestamp. HW timestamps may be inaccurate.",
426-
err);
425+
dev_err(&parent->udev->dev,
426+
"Error %d while reading timestamp. HW timestamps may be inaccurate.",
427+
err);
427428

428429
return timestamp;
429430
}
430431

431432
static void gs_usb_timestamp_work(struct work_struct *work)
432433
{
433434
struct delayed_work *delayed_work = to_delayed_work(work);
434-
struct gs_can *dev;
435+
struct gs_usb *parent;
435436

436-
dev = container_of(delayed_work, struct gs_can, timestamp);
437-
spin_lock_bh(&dev->tc_lock);
438-
timecounter_read(&dev->tc);
439-
spin_unlock_bh(&dev->tc_lock);
437+
parent = container_of(delayed_work, struct gs_usb, timestamp);
438+
spin_lock_bh(&parent->tc_lock);
439+
timecounter_read(&parent->tc);
440+
spin_unlock_bh(&parent->tc_lock);
440441

441-
schedule_delayed_work(&dev->timestamp,
442+
schedule_delayed_work(&parent->timestamp,
442443
GS_USB_TIMESTAMP_WORK_DELAY_SEC * HZ);
443444
}
444445

445446
static void gs_usb_skb_set_timestamp(struct gs_can *dev,
446447
struct sk_buff *skb, u32 timestamp)
447448
{
448449
struct skb_shared_hwtstamps *hwtstamps = skb_hwtstamps(skb);
450+
struct gs_usb *parent = dev->parent;
449451
u64 ns;
450452

451-
spin_lock_bh(&dev->tc_lock);
452-
ns = timecounter_cyc2time(&dev->tc, timestamp);
453-
spin_unlock_bh(&dev->tc_lock);
453+
spin_lock_bh(&parent->tc_lock);
454+
ns = timecounter_cyc2time(&parent->tc, timestamp);
455+
spin_unlock_bh(&parent->tc_lock);
454456

455457
hwtstamps->hwtstamp = ns_to_ktime(ns);
456458
}
457459

458-
static void gs_usb_timestamp_init(struct gs_can *dev)
460+
static void gs_usb_timestamp_init(struct gs_usb *parent)
459461
{
460-
struct cyclecounter *cc = &dev->cc;
462+
struct cyclecounter *cc = &parent->cc;
461463

462464
cc->read = gs_usb_timestamp_read;
463465
cc->mask = CYCLECOUNTER_MASK(32);
464466
cc->shift = 32 - bits_per(NSEC_PER_SEC / GS_USB_TIMESTAMP_TIMER_HZ);
465467
cc->mult = clocksource_hz2mult(GS_USB_TIMESTAMP_TIMER_HZ, cc->shift);
466468

467-
spin_lock_init(&dev->tc_lock);
468-
spin_lock_bh(&dev->tc_lock);
469-
timecounter_init(&dev->tc, &dev->cc, ktime_get_real_ns());
470-
spin_unlock_bh(&dev->tc_lock);
469+
spin_lock_init(&parent->tc_lock);
470+
spin_lock_bh(&parent->tc_lock);
471+
timecounter_init(&parent->tc, &parent->cc, ktime_get_real_ns());
472+
spin_unlock_bh(&parent->tc_lock);
471473

472-
INIT_DELAYED_WORK(&dev->timestamp, gs_usb_timestamp_work);
473-
schedule_delayed_work(&dev->timestamp,
474+
INIT_DELAYED_WORK(&parent->timestamp, gs_usb_timestamp_work);
475+
schedule_delayed_work(&parent->timestamp,
474476
GS_USB_TIMESTAMP_WORK_DELAY_SEC * HZ);
475477
}
476478

477-
static void gs_usb_timestamp_stop(struct gs_can *dev)
479+
static void gs_usb_timestamp_stop(struct gs_usb *parent)
478480
{
479-
cancel_delayed_work_sync(&dev->timestamp);
481+
cancel_delayed_work_sync(&parent->timestamp);
480482
}
481483

482484
static void gs_update_state(struct gs_can *dev, struct can_frame *cf)
@@ -560,6 +562,9 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
560562
if (!netif_device_present(netdev))
561563
return;
562564

565+
if (!netif_running(netdev))
566+
goto resubmit_urb;
567+
563568
if (hf->echo_id == -1) { /* normal rx */
564569
if (hf->flags & GS_CAN_FLAG_FD) {
565570
skb = alloc_canfd_skb(dev->netdev, &cfd);
@@ -833,6 +838,7 @@ static int gs_can_open(struct net_device *netdev)
833838
.mode = cpu_to_le32(GS_CAN_MODE_START),
834839
};
835840
struct gs_host_frame *hf;
841+
struct urb *urb = NULL;
836842
u32 ctrlmode;
837843
u32 flags = 0;
838844
int rc, i;
@@ -855,23 +861,27 @@ static int gs_can_open(struct net_device *netdev)
855861
}
856862

857863
if (!parent->active_channels) {
864+
if (dev->feature & GS_CAN_FEATURE_HW_TIMESTAMP)
865+
gs_usb_timestamp_init(parent);
866+
858867
for (i = 0; i < GS_MAX_RX_URBS; i++) {
859-
struct urb *urb;
860868
u8 *buf;
861869

862870
/* alloc rx urb */
863871
urb = usb_alloc_urb(0, GFP_KERNEL);
864-
if (!urb)
865-
return -ENOMEM;
872+
if (!urb) {
873+
rc = -ENOMEM;
874+
goto out_usb_kill_anchored_urbs;
875+
}
866876

867877
/* alloc rx buffer */
868878
buf = kmalloc(dev->parent->hf_size_rx,
869879
GFP_KERNEL);
870880
if (!buf) {
871881
netdev_err(netdev,
872882
"No memory left for USB buffer\n");
873-
usb_free_urb(urb);
874-
return -ENOMEM;
883+
rc = -ENOMEM;
884+
goto out_usb_free_urb;
875885
}
876886

877887
/* fill, anchor, and submit rx urb */
@@ -894,9 +904,7 @@ static int gs_can_open(struct net_device *netdev)
894904
netdev_err(netdev,
895905
"usb_submit failed (err=%d)\n", rc);
896906

897-
usb_unanchor_urb(urb);
898-
usb_free_urb(urb);
899-
break;
907+
goto out_usb_unanchor_urb;
900908
}
901909

902910
/* Drop reference,
@@ -926,13 +934,9 @@ static int gs_can_open(struct net_device *netdev)
926934
flags |= GS_CAN_MODE_FD;
927935

928936
/* if hardware supports timestamps, enable it */
929-
if (dev->feature & GS_CAN_FEATURE_HW_TIMESTAMP) {
937+
if (dev->feature & GS_CAN_FEATURE_HW_TIMESTAMP)
930938
flags |= GS_CAN_MODE_HW_TIMESTAMP;
931939

932-
/* start polling timestamp */
933-
gs_usb_timestamp_init(dev);
934-
}
935-
936940
/* finally start device */
937941
dev->can.state = CAN_STATE_ERROR_ACTIVE;
938942
dm.flags = cpu_to_le32(flags);
@@ -942,17 +946,32 @@ static int gs_can_open(struct net_device *netdev)
942946
GFP_KERNEL);
943947
if (rc) {
944948
netdev_err(netdev, "Couldn't start device (err=%d)\n", rc);
945-
if (dev->feature & GS_CAN_FEATURE_HW_TIMESTAMP)
946-
gs_usb_timestamp_stop(dev);
947949
dev->can.state = CAN_STATE_STOPPED;
948-
return rc;
950+
951+
goto out_usb_kill_anchored_urbs;
949952
}
950953

951954
parent->active_channels++;
952955
if (!(dev->can.ctrlmode & CAN_CTRLMODE_LISTENONLY))
953956
netif_start_queue(netdev);
954957

955958
return 0;
959+
960+
out_usb_unanchor_urb:
961+
usb_unanchor_urb(urb);
962+
out_usb_free_urb:
963+
usb_free_urb(urb);
964+
out_usb_kill_anchored_urbs:
965+
if (!parent->active_channels) {
966+
usb_kill_anchored_urbs(&dev->tx_submitted);
967+
968+
if (dev->feature & GS_CAN_FEATURE_HW_TIMESTAMP)
969+
gs_usb_timestamp_stop(parent);
970+
}
971+
972+
close_candev(netdev);
973+
974+
return rc;
956975
}
957976

958977
static int gs_usb_get_state(const struct net_device *netdev,
@@ -998,14 +1017,13 @@ static int gs_can_close(struct net_device *netdev)
9981017

9991018
netif_stop_queue(netdev);
10001019

1001-
/* stop polling timestamp */
1002-
if (dev->feature & GS_CAN_FEATURE_HW_TIMESTAMP)
1003-
gs_usb_timestamp_stop(dev);
1004-
10051020
/* Stop polling */
10061021
parent->active_channels--;
10071022
if (!parent->active_channels) {
10081023
usb_kill_anchored_urbs(&parent->rx_submitted);
1024+
1025+
if (dev->feature & GS_CAN_FEATURE_HW_TIMESTAMP)
1026+
gs_usb_timestamp_stop(parent);
10091027
}
10101028

10111029
/* Stop sending URBs */

‎drivers/net/dsa/microchip/ksz8795.c

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -506,7 +506,13 @@ static int ksz8_r_sta_mac_table(struct ksz_device *dev, u16 addr,
506506
(data_hi & masks[STATIC_MAC_TABLE_FWD_PORTS]) >>
507507
shifts[STATIC_MAC_FWD_PORTS];
508508
alu->is_override = (data_hi & masks[STATIC_MAC_TABLE_OVERRIDE]) ? 1 : 0;
509-
data_hi >>= 1;
509+
510+
/* KSZ8795 family switches have STATIC_MAC_TABLE_USE_FID and
511+
* STATIC_MAC_TABLE_FID definitions off by 1 when doing read on the
512+
* static MAC table compared to doing write.
513+
*/
514+
if (ksz_is_ksz87xx(dev))
515+
data_hi >>= 1;
510516
alu->is_static = true;
511517
alu->is_use_fid = (data_hi & masks[STATIC_MAC_TABLE_USE_FID]) ? 1 : 0;
512518
alu->fid = (data_hi & masks[STATIC_MAC_TABLE_FID]) >>

‎drivers/net/dsa/microchip/ksz_common.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -331,13 +331,13 @@ static const u32 ksz8795_masks[] = {
331331
[STATIC_MAC_TABLE_VALID] = BIT(21),
332332
[STATIC_MAC_TABLE_USE_FID] = BIT(23),
333333
[STATIC_MAC_TABLE_FID] = GENMASK(30, 24),
334-
[STATIC_MAC_TABLE_OVERRIDE] = BIT(26),
335-
[STATIC_MAC_TABLE_FWD_PORTS] = GENMASK(24, 20),
334+
[STATIC_MAC_TABLE_OVERRIDE] = BIT(22),
335+
[STATIC_MAC_TABLE_FWD_PORTS] = GENMASK(20, 16),
336336
[DYNAMIC_MAC_TABLE_ENTRIES_H] = GENMASK(6, 0),
337-
[DYNAMIC_MAC_TABLE_MAC_EMPTY] = BIT(8),
337+
[DYNAMIC_MAC_TABLE_MAC_EMPTY] = BIT(7),
338338
[DYNAMIC_MAC_TABLE_NOT_READY] = BIT(7),
339339
[DYNAMIC_MAC_TABLE_ENTRIES] = GENMASK(31, 29),
340-
[DYNAMIC_MAC_TABLE_FID] = GENMASK(26, 20),
340+
[DYNAMIC_MAC_TABLE_FID] = GENMASK(22, 16),
341341
[DYNAMIC_MAC_TABLE_SRC_PORT] = GENMASK(26, 24),
342342
[DYNAMIC_MAC_TABLE_TIMESTAMP] = GENMASK(28, 27),
343343
[P_MII_TX_FLOW_CTRL] = BIT(5),

0 commit comments

Comments
 (0)