lael-labs/linux

.mailmap+1−0

@@ -376,6 +376,7 @@ Juha Yrjola <juha.yrjola@solidboot.com> · 375 unmodified lines
376	Julien Thierry <julien.thierry.kdev@gmail.com> <julien.thierry@arm.com>	376	Julien Thierry <julien.thierry.kdev@gmail.com> <julien.thierry@arm.com>
377	Iskren Chernev <me@iskren.info> <iskren.chernev@gmail.com>	377	Iskren Chernev <me@iskren.info> <iskren.chernev@gmail.com>
378	Kalle Valo <kvalo@kernel.org> <kvalo@codeaurora.org>	378	Kalle Valo <kvalo@kernel.org> <kvalo@codeaurora.org>
		379	Kalle Valo <kvalo@kernel.org> <quic_kvalo@quicinc.com>
379	Kalyan Thota <quic_kalyant@quicinc.com> <kalyan_t@codeaurora.org>	380	Kalyan Thota <quic_kalyant@quicinc.com> <kalyan_t@codeaurora.org>
380	Karthikeyan Periyasamy <quic_periyasa@quicinc.com> <periyasa@codeaurora.org>	381	Karthikeyan Periyasamy <quic_periyasa@quicinc.com> <periyasa@codeaurora.org>
381	Kathiravan T <quic_kathirav@quicinc.com> <kathirav@codeaurora.org>	382	Kathiravan T <quic_kathirav@quicinc.com> <kathirav@codeaurora.org>

Documentation/devicetree/bindings/net/wireless/qcom,ath10k.yaml+0−1

@@ -7,7 +7,6 @@ $schema: http://devicetree.org/meta-schemas/core.yaml# · 6 unmodified lines
7	title: Qualcomm Technologies ath10k wireless devices	7	title: Qualcomm Technologies ath10k wireless devices
8		8
9	maintainers:	9	maintainers:
10	- Kalle Valo <kvalo@kernel.org>
11	- Jeff Johnson <jjohnson@kernel.org>	10	- Jeff Johnson <jjohnson@kernel.org>
12		11
13	description:	12	description:

Documentation/devicetree/bindings/net/wireless/qcom,ath11k-pci.yaml+0−1

@@ -8,7 +8,6 @@ $schema: http://devicetree.org/meta-schemas/core.yaml# · 7 unmodified lines
8	title: Qualcomm Technologies ath11k wireless devices (PCIe)	8	title: Qualcomm Technologies ath11k wireless devices (PCIe)
9		9
10	maintainers:	10	maintainers:
11	- Kalle Valo <kvalo@kernel.org>
12	- Jeff Johnson <jjohnson@kernel.org>	11	- Jeff Johnson <jjohnson@kernel.org>
13		12
14	description: \|	13	description: \|

Documentation/devicetree/bindings/net/wireless/qcom,ath11k.yaml+0−1

@@ -8,7 +8,6 @@ $schema: http://devicetree.org/meta-schemas/core.yaml# · 7 unmodified lines
8	title: Qualcomm Technologies ath11k wireless devices	8	title: Qualcomm Technologies ath11k wireless devices
9		9
10	maintainers:	10	maintainers:
11	- Kalle Valo <kvalo@kernel.org>
12	- Jeff Johnson <jjohnson@kernel.org>	11	- Jeff Johnson <jjohnson@kernel.org>
13		12
14	description: \|	13	description: \|

Documentation/devicetree/bindings/net/wireless/qcom,ath12k-wsi.yaml+0−1

@@ -9,7 +9,6 @@ title: Qualcomm Technologies ath12k wireless devices (PCIe) with WSI interface · 8 unmodified lines
9		9
10	maintainers:	10	maintainers:
11	- Jeff Johnson <jjohnson@kernel.org>	11	- Jeff Johnson <jjohnson@kernel.org>
12	- Kalle Valo <kvalo@kernel.org>
13		12
14	description: \|	13	description: \|
15	Qualcomm Technologies IEEE 802.11be PCIe devices with WSI interface.	14	Qualcomm Technologies IEEE 802.11be PCIe devices with WSI interface.

Documentation/devicetree/bindings/net/wireless/qcom,ath12k.yaml+0−1

@@ -9,7 +9,6 @@ title: Qualcomm Technologies ath12k wireless devices (PCIe) · 8 unmodified lines
9		9
10	maintainers:	10	maintainers:
11	- Jeff Johnson <quic_jjohnson@quicinc.com>	11	- Jeff Johnson <quic_jjohnson@quicinc.com>
12	- Kalle Valo <kvalo@kernel.org>
13		12
14	description:	13	description:
15	Qualcomm Technologies IEEE 802.11be PCIe devices.	14	Qualcomm Technologies IEEE 802.11be PCIe devices.

Documentation/netlink/specs/ethtool.yaml+2−1

@@ -1524,7 +1524,8 @@ attribute-sets: · 1523 unmodified lines
1524	nested-attributes: bitset	1524	nested-attributes: bitset
1525	-	1525	-
1526	name: hwtstamp-flags	1526	name: hwtstamp-flags
1527	type: u32	1527	type: nest
		1528	nested-attributes: bitset
1528		1529
1529	operations:	1530	operations:
1530	enum-model: directional	1531	enum-model: directional

Documentation/networking/iso15765-2.rst+2−2

@@ -369,8 +369,8 @@ to their default. · 368 unmodified lines
369		369
370	addr.can_family = AF_CAN;	370	addr.can_family = AF_CAN;
371	addr.can_ifindex = if_nametoindex("can0");	371	addr.can_ifindex = if_nametoindex("can0");
372	addr.tp.tx_id = 0x18DA42F1 \| CAN_EFF_FLAG;	372	addr.can_addr.tp.tx_id = 0x18DA42F1 \| CAN_EFF_FLAG;
373	addr.tp.rx_id = 0x18DAF142 \| CAN_EFF_FLAG;	373	addr.can_addr.tp.rx_id = 0x18DAF142 \| CAN_EFF_FLAG;
374		374
375	ret = bind(s, (struct sockaddr *)&addr, sizeof(addr));	375	ret = bind(s, (struct sockaddr *)&addr, sizeof(addr));
376	if (ret < 0)	376	if (ret < 0)

MAINTAINERS+3−5

@@ -3654,7 +3654,6 @@ F: Documentation/devicetree/bindings/phy/phy-ath79-usb.txt · 3653 unmodified lines
3654	F: drivers/phy/qualcomm/phy-ath79-usb.c	3654	F: drivers/phy/qualcomm/phy-ath79-usb.c
3655		3655
3656	ATHEROS ATH GENERIC UTILITIES	3656	ATHEROS ATH GENERIC UTILITIES
3657	M: Kalle Valo <kvalo@kernel.org>
3658	M: Jeff Johnson <jjohnson@kernel.org>	3657	M: Jeff Johnson <jjohnson@kernel.org>
3659	L: linux-wireless@vger.kernel.org	3658	L: linux-wireless@vger.kernel.org
3660	S: Supported	3659	S: Supported
@@ -16438,7 +16437,7 @@ X: drivers/net/can/ · 12777 unmodified lines
16438	X: drivers/net/wireless/	16437	X: drivers/net/wireless/
16439		16438
16440	NETWORKING DRIVERS (WIRELESS)	16439	NETWORKING DRIVERS (WIRELESS)
16441	M: Kalle Valo <kvalo@kernel.org>	16440	M: Johannes Berg <johannes@sipsolutions.net>
16442	L: linux-wireless@vger.kernel.org	16441	L: linux-wireless@vger.kernel.org
16443	S: Maintained	16442	S: Maintained
16444	W: https://wireless.wiki.kernel.org/	16443	W: https://wireless.wiki.kernel.org/
@@ -16509,6 +16508,7 @@ F: include/linux/netdev* · 64 unmodified lines
16509	F: include/linux/netlink.h	16508	F: include/linux/netlink.h
16510	F: include/linux/netpoll.h	16509	F: include/linux/netpoll.h
16511	F: include/linux/rtnetlink.h	16510	F: include/linux/rtnetlink.h
		16511	F: include/linux/sctp.h
16512	F: include/linux/seq_file_net.h	16512	F: include/linux/seq_file_net.h
16513	F: include/linux/skbuff*	16513	F: include/linux/skbuff*
16514	F: include/net/	16514	F: include/net/
@@ -16525,6 +16525,7 @@ F: include/uapi/linux/netdev* · 10 unmodified lines
16525	F: include/uapi/linux/netlink.h	16525	F: include/uapi/linux/netlink.h
16526	F: include/uapi/linux/netlink_diag.h	16526	F: include/uapi/linux/netlink_diag.h
16527	F: include/uapi/linux/rtnetlink.h	16527	F: include/uapi/linux/rtnetlink.h
		16528	F: include/uapi/linux/sctp.h
16528	F: lib/net_utils.c	16529	F: lib/net_utils.c
16529	F: lib/random32.c	16530	F: lib/random32.c
16530	F: net/	16531	F: net/
@@ -19355,7 +19356,6 @@ Q: http://patchwork.linuxtv.org/project/linux-media/list/ · 2824 unmodified lines
19355	F: drivers/media/tuners/qt1010*	19356	F: drivers/media/tuners/qt1010*
19356		19357
19357	QUALCOMM ATH12K WIRELESS DRIVER	19358	QUALCOMM ATH12K WIRELESS DRIVER
19358	M: Kalle Valo <kvalo@kernel.org>
19359	M: Jeff Johnson <jjohnson@kernel.org>	19359	M: Jeff Johnson <jjohnson@kernel.org>
19360	L: ath12k@lists.infradead.org	19360	L: ath12k@lists.infradead.org
19361	S: Supported	19361	S: Supported
@@ -19365,7 +19365,6 @@ F: drivers/net/wireless/ath/ath12k/ · 3 unmodified lines
19365	N: ath12k	19365	N: ath12k
19366		19366
19367	QUALCOMM ATHEROS ATH10K WIRELESS DRIVER	19367	QUALCOMM ATHEROS ATH10K WIRELESS DRIVER
19368	M: Kalle Valo <kvalo@kernel.org>
19369	M: Jeff Johnson <jjohnson@kernel.org>	19368	M: Jeff Johnson <jjohnson@kernel.org>
19370	L: ath10k@lists.infradead.org	19369	L: ath10k@lists.infradead.org
19371	S: Supported	19370	S: Supported
@@ -19375,7 +19374,6 @@ F: drivers/net/wireless/ath/ath10k/ · 3 unmodified lines
19375	N: ath10k	19374	N: ath10k
19376		19375
19377	QUALCOMM ATHEROS ATH11K WIRELESS DRIVER	19376	QUALCOMM ATHEROS ATH11K WIRELESS DRIVER
19378	M: Kalle Valo <kvalo@kernel.org>
19379	M: Jeff Johnson <jjohnson@kernel.org>	19377	M: Jeff Johnson <jjohnson@kernel.org>
19380	L: ath11k@lists.infradead.org	19378	L: ath11k@lists.infradead.org
19381	S: Supported	19379	S: Supported

drivers/bluetooth/btintel_pcie.c+4−1

 			if (opcode == 0xfc01)
 				btintel_pcie_inject_cmd_complete(hdev, opcode);
 		}
+		/* Firmware raises alive interrupt on HCI_OP_RESET */
+		if (opcode == HCI_OP_RESET)
+			data->gp0_received = false;
 		hdev->stat.cmd_tx++;
 		break;
 	case HCI_ACLDATA_PKT:
 			   opcode, btintel_pcie_alivectxt_state2str(old_ctxt),
 			   btintel_pcie_alivectxt_state2str(data->alive_intr_ctxt));
 		if (opcode == HCI_OP_RESET) {
-			data->gp0_received = false;
 			ret = wait_event_timeout(data->gp0_wait_q,
 						 data->gp0_received,
 						 msecs_to_jiffies(BTINTEL_DEFAULT_INTR_TIMEOUT_MS));

drivers/net/can/c_can/c_can_platform.c+3−2

 	if (ret) {
 		dev_err(&pdev->dev, "registering %s failed (err=%d)\n",
 			KBUILD_MODNAME, ret);
-		goto exit_free_device;
+		goto exit_pm_runtime;
 	}
 	dev_info(&pdev->dev, "%s device registered (regs=%p, irq=%d)\n",
 		 KBUILD_MODNAME, priv->base, dev->irq);
 	return 0;
-exit_free_device:
+exit_pm_runtime:
 	pm_runtime_disable(priv->device);
+exit_free_device:
 	free_c_can_dev(dev);
 exit:
 	dev_err(&pdev->dev, "probe failed\n");

drivers/net/can/ctucanfd/ctucanfd_base.c+6−4

 			}
 			break;
 		case CAN_STATE_ERROR_ACTIVE:
-			cf->can_id |= CAN_ERR_CNT;
+			if (skb) {
-			cf->data[1] = CAN_ERR_CRTL_ACTIVE;
+				cf->can_id |= CAN_ERR_CNT;
-			cf->data[6] = bec.txerr;
+				cf->data[1] = CAN_ERR_CRTL_ACTIVE;
-			cf->data[7] = bec.rxerr;
+				cf->data[6] = bec.txerr;
+				cf->data[7] = bec.rxerr;
+			}
 			break;
 		default:
 			netdev_warn(ndev, "unhandled error state (%d:%s)!\n",

drivers/net/can/rockchip/rockchip_canfd-core.c+1−1

@@ -622,7 +622,7 @@ rkcanfd_handle_rx_fifo_overflow_int(struct rkcanfd_priv *priv) · 621 unmodified lines
622	netdev_dbg(priv->ndev, "RX-FIFO overflow\n");	622	netdev_dbg(priv->ndev, "RX-FIFO overflow\n");
623		623
624	skb = rkcanfd_alloc_can_err_skb(priv, &cf, &timestamp);	624	skb = rkcanfd_alloc_can_err_skb(priv, &cf, &timestamp);
625	if (skb)	625	if (!skb)
626	return 0;	626	return 0;
627		627
628	rkcanfd_get_berr_counter_corrected(priv, &bec);	628	rkcanfd_get_berr_counter_corrected(priv, &bec);

drivers/net/can/usb/etas_es58x/es58x_devlink.c+5−1

 			return ret;
 	}
-	return devlink_info_serial_number_put(req, es58x_dev->udev->serial);
+	if (es58x_dev->udev->serial)
+		ret = devlink_info_serial_number_put(req,
+						     es58x_dev->udev->serial);
+	return ret;
 }
 const struct devlink_ops es58x_dl_ops = {

drivers/net/ethernet/intel/iavf/iavf_main.c+1−1

 	}
 	mutex_unlock(&adapter->crit_lock);
-	netdev_unlock(netdev);
 restart_watchdog:
+	netdev_unlock(netdev);
 	if (adapter->state >= __IAVF_DOWN)
 		queue_work(adapter->wq, &adapter->adminq_task);
 	if (adapter->aq_required)

drivers/net/ethernet/intel/idpf/idpf_lib.c+5−0

 	idpf_vport_ctrl_lock(netdev);
 	vport = idpf_netdev_to_vport(netdev);
+	err = idpf_set_real_num_queues(vport);
+	if (err)
+		goto unlock;
 	err = idpf_vport_open(vport);
+unlock:
 	idpf_vport_ctrl_unlock(netdev);
 	return err;

drivers/net/ethernet/intel/idpf/idpf_txrx.c+1−4

 		return -EINVAL;
 	rsc_segments = DIV_ROUND_UP(skb->data_len, rsc_seg_len);
-	if (unlikely(rsc_segments == 1))
-		return 0;
 	NAPI_GRO_CB(skb)->count = rsc_segments;
 	skb_shinfo(skb)->gso_size = rsc_seg_len;
 	idpf_rx_hash(rxq, skb, rx_desc, decoded);
 	skb->protocol = eth_type_trans(skb, rxq->netdev);
+	skb_record_rx_queue(skb, rxq->idx);
 	if (le16_get_bits(rx_desc->hdrlen_flags,
 			  VIRTCHNL2_RX_FLEX_DESC_ADV_RSC_M))
 	csum_bits = idpf_rx_splitq_extract_csum_bits(rx_desc);
 	idpf_rx_csum(rxq, skb, csum_bits, decoded);
-	skb_record_rx_queue(skb, rxq->idx);
 	return 0;
 }

drivers/net/ethernet/intel/igc/igc_main.c+13−9

 		return -ENOMEM;
 	}
+	buffer->type = IGC_TX_BUFFER_TYPE_SKB;
 	buffer->skb = skb;
 	buffer->protocol = 0;
 	buffer->bytecount = skb->len;
 }
 static struct sk_buff *igc_construct_skb_zc(struct igc_ring *ring,
-					    struct xdp_buff *xdp)
+					    struct igc_xdp_buff *ctx)
 {
+	struct xdp_buff *xdp = &ctx->xdp;
 	unsigned int totalsize = xdp->data_end - xdp->data_meta;
 	unsigned int metasize = xdp->data - xdp->data_meta;
 	struct sk_buff *skb;
 		__skb_pull(skb, metasize);
 	}
+	if (ctx->rx_ts) {
+		skb_shinfo(skb)->tx_flags |= SKBTX_HW_TSTAMP_NETDEV;
+		skb_hwtstamps(skb)->netdev_data = ctx->rx_ts;
+	}
 	return skb;
 }
 static void igc_dispatch_skb_zc(struct igc_q_vector *q_vector,
 				union igc_adv_rx_desc *desc,
-				struct xdp_buff *xdp,
+				struct igc_xdp_buff *ctx)
-				ktime_t timestamp)
 {
 	struct igc_ring *ring = q_vector->rx.ring;
 	struct sk_buff *skb;
-	skb = igc_construct_skb_zc(ring, xdp);
+	skb = igc_construct_skb_zc(ring, ctx);
 	if (!skb) {
 		ring->rx_stats.alloc_failed++;
 		set_bit(IGC_RING_FLAG_RX_ALLOC_FAILED, &ring->flags);
 		return;
 	}
-	if (timestamp)
-		skb_hwtstamps(skb)->hwtstamp = timestamp;
 	if (igc_cleanup_headers(ring, desc, skb))
 		return;
 		union igc_adv_rx_desc *desc;
 		struct igc_rx_buffer *bi;
 		struct igc_xdp_buff *ctx;
-		ktime_t timestamp = 0;
 		unsigned int size;
 		int res;
 			 */
 			bi->xdp->data_meta += IGC_TS_HDR_LEN;
 			size -= IGC_TS_HDR_LEN;
+		} else {
+			ctx->rx_ts = NULL;
 		}
 		bi->xdp->data_end = bi->xdp->data + size;
 		res = __igc_xdp_run_prog(adapter, prog, bi->xdp);
 		switch (res) {
 		case IGC_XDP_PASS:
-			igc_dispatch_skb_zc(q_vector, desc, bi->xdp, timestamp);
+			igc_dispatch_skb_zc(q_vector, desc, ctx);
 			fallthrough;
 		case IGC_XDP_CONSUMED:
 			xsk_buff_free(bi->xdp);

drivers/net/ethernet/intel/ixgbe/ixgbe_main.c+1−1

@@ -2105,7 +2105,7 @@ static void ixgbe_put_rx_buffer(struct ixgbe_ring *rx_ring, · 2104 unmodified lines
2105	/* hand second half of page back to the ring */	2105	/* hand second half of page back to the ring */
2106	ixgbe_reuse_rx_page(rx_ring, rx_buffer);	2106	ixgbe_reuse_rx_page(rx_ring, rx_buffer);
2107	} else {	2107	} else {
2108	if (!IS_ERR(skb) && IXGBE_CB(skb)->dma == rx_buffer->dma) {	2108	if (skb && IXGBE_CB(skb)->dma == rx_buffer->dma) {
2109	/* the page has been released from the ring */	2109	/* the page has been released from the ring */
2110	IXGBE_CB(skb)->page_released = true;	2110	IXGBE_CB(skb)->page_released = true;
2111	} else {	2111	} else {

drivers/net/ethernet/mellanox/mlxsw/spectrum_ethtool.c+3−1

 	err = mlxsw_sp_get_hw_stats_by_group(&hw_stats, &len, grp);
 	if (err)
 		return;
-	mlxsw_sp_port_get_stats_raw(dev, grp, prio, ppcnt_pl);
+	err = mlxsw_sp_port_get_stats_raw(dev, grp, prio, ppcnt_pl);
+	if (err)
+		return;
 	for (i = 0; i < len; i++) {
 		data[data_index + i] = hw_stats[i].getter(ppcnt_pl);
 		if (!hw_stats[i].cells_bytes)

drivers/net/ethernet/stmicro/stmmac/stmmac_main.c+5−0

 	pp_params.offset = stmmac_rx_offset(priv);
 	pp_params.max_len = dma_conf->dma_buf_sz;
+	if (priv->sph) {
+		pp_params.offset = 0;
+		pp_params.max_len += stmmac_rx_offset(priv);
+	}
 	rx_q->page_pool = page_pool_create(&pp_params);
 	if (IS_ERR(rx_q->page_pool)) {
 		ret = PTR_ERR(rx_q->page_pool);

drivers/net/ethernet/ti/am65-cpsw-nuss.c+31−19

 static void am65_cpsw_nuss_tx_cleanup(void *data, dma_addr_t desc_dma)
 {
 	struct am65_cpsw_tx_chn *tx_chn = data;
+	enum am65_cpsw_tx_buf_type buf_type;
 	struct cppi5_host_desc_t *desc_tx;
+	struct xdp_frame *xdpf;
 	struct sk_buff *skb;
 	void **swdata;
 	desc_tx = k3_cppi_desc_pool_dma2virt(tx_chn->desc_pool, desc_dma);
 	swdata = cppi5_hdesc_get_swdata(desc_tx);
-	skb = *(swdata);
+	buf_type = am65_cpsw_nuss_buf_type(tx_chn, desc_dma);
-	am65_cpsw_nuss_xmit_free(tx_chn, desc_tx);
+	if (buf_type == AM65_CPSW_TX_BUF_TYPE_SKB) {
+		skb = *(swdata);
+		dev_kfree_skb_any(skb);
+	} else {
+		xdpf = *(swdata);
+		xdp_return_frame(xdpf);
+	}
-	dev_kfree_skb_any(skb);
+	am65_cpsw_nuss_xmit_free(tx_chn, desc_tx);
 }
 static struct sk_buff *am65_cpsw_build_skb(void *page_addr,
 					   struct net_device *ndev,
-					   unsigned int len)
+					   unsigned int len,
+					   unsigned int headroom)
 {
 	struct sk_buff *skb;
 	if (unlikely(!skb))
 		return NULL;
-	skb_reserve(skb, AM65_CPSW_HEADROOM);
+	skb_reserve(skb, headroom);
 	skb->dev = ndev;
 	return skb;
 	struct xdp_frame *xdpf;
 	struct bpf_prog *prog;
 	struct page *page;
+	int pkt_len;
 	u32 act;
 	int err;
+	pkt_len = *len;
 	prog = READ_ONCE(port->xdp_prog);
 	if (!prog)
 		return AM65_CPSW_XDP_PASS;
 		netif_txq = netdev_get_tx_queue(ndev, tx_chn->id);
 		xdpf = xdp_convert_buff_to_frame(xdp);
-		if (unlikely(!xdpf))
+		if (unlikely(!xdpf)) {
+			ndev->stats.tx_dropped++;
 			goto drop;
+		}
 		__netif_tx_lock(netif_txq, cpu);
 		err = am65_cpsw_xdp_tx_frame(ndev, tx_chn, xdpf,
 		if (err)
 			goto drop;
-		dev_sw_netstats_tx_add(ndev, 1, *len);
+		dev_sw_netstats_rx_add(ndev, pkt_len);
 		ret = AM65_CPSW_XDP_CONSUMED;
 		goto out;
 	case XDP_REDIRECT:
 		if (unlikely(xdp_do_redirect(ndev, xdp, prog)))
 			goto drop;
-		dev_sw_netstats_rx_add(ndev, *len);
+		dev_sw_netstats_rx_add(ndev, pkt_len);
 		ret = AM65_CPSW_XDP_REDIRECT;
 		goto out;
 	default:
 	dev_dbg(dev, "%s rx csum_info:%#x\n", __func__, csum_info);
 	dma_unmap_single(rx_chn->dma_dev, buf_dma, buf_dma_len, DMA_FROM_DEVICE);
 	k3_cppi_desc_pool_free(rx_chn->desc_pool, desc_rx);
-	skb = am65_cpsw_build_skb(page_addr, ndev,
-				  AM65_CPSW_MAX_PACKET_SIZE);
-	if (unlikely(!skb)) {
-		new_page = page;
-		goto requeue;
-	}
 	if (port->xdp_prog) {
 		xdp_init_buff(&xdp, PAGE_SIZE, &port->xdp_rxq[flow->id]);
 		xdp_prepare_buff(&xdp, page_addr, AM65_CPSW_HEADROOM,
 		if (*xdp_state != AM65_CPSW_XDP_PASS)
 			goto allocate;
-		/* Compute additional headroom to be reserved */
+		headroom = xdp.data - xdp.data_hard_start;
-		headroom = (xdp.data - xdp.data_hard_start) - skb_headroom(skb);
+	} else {
-		skb_reserve(skb, headroom);
+		headroom = AM65_CPSW_HEADROOM;
+	}
+	skb = am65_cpsw_build_skb(page_addr, ndev,
+				  AM65_CPSW_MAX_PACKET_SIZE, headroom);
+	if (unlikely(!skb)) {
+		new_page = page;
+		goto requeue;
 	}
 	ndev_priv = netdev_priv(ndev);

drivers/net/phy/phylink.c+9−6

@@ -2265,12 +2265,15 @@ static int phylink_bringup_phy(struct phylink pl, struct phy_device phy, · 2264 unmodified lines
2265	/* Allow the MAC to stop its clock if the PHY has the capability */	2265	/* Allow the MAC to stop its clock if the PHY has the capability */
2266	pl->mac_tx_clk_stop = phy_eee_tx_clock_stop_capable(phy) > 0;	2266	pl->mac_tx_clk_stop = phy_eee_tx_clock_stop_capable(phy) > 0;
2267		2267
2268	/* Explicitly configure whether the PHY is allowed to stop it's	2268	if (pl->mac_supports_eee_ops) {
2269	* receive clock.	2269	/* Explicitly configure whether the PHY is allowed to stop it's
2270	*/	2270	* receive clock.
2271	ret = phy_eee_rx_clock_stop(phy, pl->config->eee_rx_clk_stop_enable);	2271	*/
2272	if (ret == -EOPNOTSUPP)	2272	ret = phy_eee_rx_clock_stop(phy,
2273	ret = 0;	2273	pl->config->eee_rx_clk_stop_enable);
		2274	if (ret == -EOPNOTSUPP)
		2275	ret = 0;
		2276	}
2274		2277
2275	return ret;	2278	return ret;
2276	}	2279	}

drivers/net/pse-pd/pse_core.c+2−2

@@ -319,7 +319,7 @@ static int pse_pi_get_current_limit(struct regulator_dev *rdev) · 318 unmodified lines
319	goto out;	319	goto out;
320	mW = ret;	320	mW = ret;
321		321
322	ret = pse_pi_get_voltage(rdev);	322	ret = _pse_pi_get_voltage(rdev);
323	if (!ret) {	323	if (!ret) {
324	dev_err(pcdev->dev, "Voltage null\n");	324	dev_err(pcdev->dev, "Voltage null\n");
325	ret = -ERANGE;	325	ret = -ERANGE;
@@ -356,7 +356,7 @@ static int pse_pi_set_current_limit(struct regulator_dev *rdev, int min_uA, · 30 unmodified lines
356		356
357	id = rdev_get_id(rdev);	357	id = rdev_get_id(rdev);
358	mutex_lock(&pcdev->lock);	358	mutex_lock(&pcdev->lock);
359	ret = pse_pi_get_voltage(rdev);	359	ret = _pse_pi_get_voltage(rdev);
360	if (!ret) {	360	if (!ret) {
361	dev_err(pcdev->dev, "Voltage null\n");	361	dev_err(pcdev->dev, "Voltage null\n");
362	ret = -ERANGE;	362	ret = -ERANGE;

drivers/net/team/team_core.c+3−1

 				ctx.data.u32_val = nla_get_u32(attr_data);
 				break;
 			case TEAM_OPTION_TYPE_STRING:
-				if (nla_len(attr_data) > TEAM_STRING_MAX_LEN) {
+				if (nla_len(attr_data) > TEAM_STRING_MAX_LEN ||
+				    !memchr(nla_data(attr_data), '\0',
+					    nla_len(attr_data))) {
 					err = -EINVAL;
 					goto team_put;
 				}

drivers/net/vxlan/vxlan_core.c+5−2

 	struct vxlan_dev *vxlan = netdev_priv(dev);
 	int err;
-	if (vxlan->cfg.flags & VXLAN_F_VNIFILTER)
+	if (vxlan->cfg.flags & VXLAN_F_VNIFILTER) {
-		vxlan_vnigroup_init(vxlan);
+		err = vxlan_vnigroup_init(vxlan);
+		if (err)
+			return err;
+	}
 	err = gro_cells_init(&vxlan->gro_cells, dev);
 	if (err)

drivers/net/wireless/ath/ath12k/wmi.c+45−16

 	return reg_rule_ptr;
 }
+static u8 ath12k_wmi_ignore_num_extra_rules(struct ath12k_wmi_reg_rule_ext_params *rule,
+					    u32 num_reg_rules)
+{
+	u8 num_invalid_5ghz_rules = 0;
+	u32 count, start_freq;
+	for (count = 0; count < num_reg_rules; count++) {
+		start_freq = le32_get_bits(rule[count].freq_info, REG_RULE_START_FREQ);
+		if (start_freq >= ATH12K_MIN_6G_FREQ)
+			num_invalid_5ghz_rules++;
+	}
+	return num_invalid_5ghz_rules;
+}
 static int ath12k_pull_reg_chan_list_ext_update_ev(struct ath12k_base *ab,
 						   struct sk_buff *skb,
 						   struct ath12k_reg_info *reg_info)
 	u32 num_2g_reg_rules, num_5g_reg_rules;
 	u32 num_6g_reg_rules_ap[WMI_REG_CURRENT_MAX_AP_TYPE];
 	u32 num_6g_reg_rules_cl[WMI_REG_CURRENT_MAX_AP_TYPE][WMI_REG_MAX_CLIENT_TYPE];
+	u8 num_invalid_5ghz_ext_rules;
 	u32 total_reg_rules = 0;
 	int ret, i, j;
 	memcpy(reg_info->alpha2, &ev->alpha2, REG_ALPHA2_LEN);
-	/* FIXME: Currently FW includes 6G reg rule also in 5G rule
-	 * list for country US.
-	 * Having same 6G reg rule in 5G and 6G rules list causes
-	 * intersect check to be true, and same rules will be shown
-	 * multiple times in iw cmd. So added hack below to avoid
-	 * parsing 6G rule from 5G reg rule list, and this can be
-	 * removed later, after FW updates to remove 6G reg rule
-	 * from 5G rules list.
-	 */
-	if (memcmp(reg_info->alpha2, "US", 2) == 0) {
-		reg_info->num_5g_reg_rules = REG_US_5G_NUM_REG_RULES;
-		num_5g_reg_rules = reg_info->num_5g_reg_rules;
-	}
 	reg_info->dfs_region = le32_to_cpu(ev->dfs_region);
 	reg_info->phybitmap = le32_to_cpu(ev->phybitmap);
 	reg_info->num_phy = le32_to_cpu(ev->num_phy);
 		}
 	}
+	ext_wmi_reg_rule += num_2g_reg_rules;
+	/* Firmware might include 6 GHz reg rule in 5 GHz rule list
+	 * for few countries along with separate 6 GHz rule.
+	 * Having same 6 GHz reg rule in 5 GHz and 6 GHz rules list
+	 * causes intersect check to be true, and same rules will be
+	 * shown multiple times in iw cmd.
+	 * Hence, avoid parsing 6 GHz rule from 5 GHz reg rule list
+	 */
+	num_invalid_5ghz_ext_rules = ath12k_wmi_ignore_num_extra_rules(ext_wmi_reg_rule,
+								       num_5g_reg_rules);
+	if (num_invalid_5ghz_ext_rules) {
+		ath12k_dbg(ab, ATH12K_DBG_WMI,
+			   "CC: %s 5 GHz reg rules number %d from fw, %d number of invalid 5 GHz rules",
+			   reg_info->alpha2, reg_info->num_5g_reg_rules,
+			   num_invalid_5ghz_ext_rules);
+		num_5g_reg_rules = num_5g_reg_rules - num_invalid_5ghz_ext_rules;
+		reg_info->num_5g_reg_rules = num_5g_reg_rules;
+	}
 	if (num_5g_reg_rules) {
-		ext_wmi_reg_rule += num_2g_reg_rules;
 		reg_info->reg_rules_5g_ptr =
 			create_ext_reg_rules_from_wmi(num_5g_reg_rules,
 						      ext_wmi_reg_rule);
 		}
 	}
-	ext_wmi_reg_rule += num_5g_reg_rules;
+	/* We have adjusted the number of 5 GHz reg rules above. But still those
+	 * many rules needs to be adjusted in ext_wmi_reg_rule.
+	 *
+	 * NOTE: num_invalid_5ghz_ext_rules will be 0 for rest other cases.
+	 */
+	ext_wmi_reg_rule += (num_5g_reg_rules + num_invalid_5ghz_ext_rules);
 	for (i = 0; i < WMI_REG_CURRENT_MAX_AP_TYPE; i++) {
 		reg_info->reg_rules_6g_ap_ptr[i] =

drivers/net/wireless/ath/ath12k/wmi.h+0−1

@@ -4073,7 +4073,6 @@ struct ath12k_wmi_eht_rate_set_params { · 4072 unmodified lines
4073	#define MAX_REG_RULES 10	4073	#define MAX_REG_RULES 10
4074	#define REG_ALPHA2_LEN 2	4074	#define REG_ALPHA2_LEN 2
4075	#define MAX_6G_REG_RULES 5	4075	#define MAX_6G_REG_RULES 5
4076	#define REG_US_5G_NUM_REG_RULES 4
4077		4076
4078	enum wmi_start_event_param {	4077	enum wmi_start_event_param {
4079	WMI_VDEV_START_RESP_EVENT = 0,	4078	WMI_VDEV_START_RESP_EVENT = 0,

drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c+2−2

drivers/ptp/ptp_vmclock.c+21−26

@@ -414,16 +414,16 @@ static ssize_t vmclock_miscdev_read(struct file fp, char __user buf, · 413 unmodified lines
414	}	414	}
415		415
416	static const struct file_operations vmclock_miscdev_fops = {	416	static const struct file_operations vmclock_miscdev_fops = {
		417	.owner = THIS_MODULE,
417	.mmap = vmclock_miscdev_mmap,	418	.mmap = vmclock_miscdev_mmap,
418	.read = vmclock_miscdev_read,	419	.read = vmclock_miscdev_read,
419	};	420	};
420		421
421	/* module operations */	422	/* module operations */
422		423
423	static void vmclock_remove(struct platform_device *pdev)	424	static void vmclock_remove(void *data)
424	{	425	{
425	struct device *dev = &pdev->dev;	426	struct vmclock_state *st = data;
426	struct vmclock_state *st = dev_get_drvdata(dev);
427		427
428	if (st->ptp_clock)	428	if (st->ptp_clock)
429	ptp_clock_unregister(st->ptp_clock);	429	ptp_clock_unregister(st->ptp_clock);
@@ -506,14 +506,13 @@ static int vmclock_probe(struct platform_device *pdev) · 76 unmodified lines
506		506
507	if (ret) {	507	if (ret) {
508	dev_info(dev, "Failed to obtain physical address: %d\n", ret);	508	dev_info(dev, "Failed to obtain physical address: %d\n", ret);
509	goto out;	509	return ret;
510	}	510	}
511		511
512	if (resource_size(&st->res) < VMCLOCK_MIN_SIZE) {	512	if (resource_size(&st->res) < VMCLOCK_MIN_SIZE) {
513	dev_info(dev, "Region too small (0x%llx)\n",	513	dev_info(dev, "Region too small (0x%llx)\n",
514	resource_size(&st->res));	514	resource_size(&st->res));
515	ret = -EINVAL;	515	return -EINVAL;
516	goto out;
517	}	516	}
518	st->clk = devm_memremap(dev, st->res.start, resource_size(&st->res),	517	st->clk = devm_memremap(dev, st->res.start, resource_size(&st->res),
519	MEMREMAP_WB \| MEMREMAP_DEC);	518	MEMREMAP_WB \| MEMREMAP_DEC);
@@ -521,31 +520,34 @@ static int vmclock_probe(struct platform_device *pdev) · 1 unmodified line
521	ret = PTR_ERR(st->clk);	520	ret = PTR_ERR(st->clk);
522	dev_info(dev, "failed to map shared memory\n");	521	dev_info(dev, "failed to map shared memory\n");
523	st->clk = NULL;	522	st->clk = NULL;
524	goto out;	523	return ret;
525	}	524	}
526		525
527	if (le32_to_cpu(st->clk->magic) != VMCLOCK_MAGIC \|\|	526	if (le32_to_cpu(st->clk->magic) != VMCLOCK_MAGIC \|\|
528	le32_to_cpu(st->clk->size) > resource_size(&st->res) \|\|	527	le32_to_cpu(st->clk->size) > resource_size(&st->res) \|\|
529	le16_to_cpu(st->clk->version) != 1) {	528	le16_to_cpu(st->clk->version) != 1) {
530	dev_info(dev, "vmclock magic fields invalid\n");	529	dev_info(dev, "vmclock magic fields invalid\n");
531	ret = -EINVAL;	530	return -EINVAL;
532	goto out;
533	}	531	}
534		532
535	ret = ida_alloc(&vmclock_ida, GFP_KERNEL);	533	ret = ida_alloc(&vmclock_ida, GFP_KERNEL);
536	if (ret < 0)	534	if (ret < 0)
537	goto out;	535	return ret;
538		536
539	st->index = ret;	537	st->index = ret;
540	ret = devm_add_action_or_reset(&pdev->dev, vmclock_put_idx, st);	538	ret = devm_add_action_or_reset(&pdev->dev, vmclock_put_idx, st);
541	if (ret)	539	if (ret)
542	goto out;	540	return ret;
543		541
544	st->name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "vmclock%d", st->index);	542	st->name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "vmclock%d", st->index);
545	if (!st->name) {	543	if (!st->name)
546	ret = -ENOMEM;	544	return -ENOMEM;
547	goto out;	545
548	}	546	st->miscdev.minor = MISC_DYNAMIC_MINOR;
		547
		548	ret = devm_add_action_or_reset(&pdev->dev, vmclock_remove, st);
		549	if (ret)
		550	return ret;
549		551
550	/*	552	/*
551	* If the structure is big enough, it can be mapped to userspace.	553	* If the structure is big enough, it can be mapped to userspace.
@@ -554,13 +556,12 @@ static int vmclock_probe(struct platform_device *pdev) · 2 unmodified lines
554	* cross that bridge if/when we come to it.	556	* cross that bridge if/when we come to it.
555	*/	557	*/
556	if (le32_to_cpu(st->clk->size) >= PAGE_SIZE) {	558	if (le32_to_cpu(st->clk->size) >= PAGE_SIZE) {
557	st->miscdev.minor = MISC_DYNAMIC_MINOR;
558	st->miscdev.fops = &vmclock_miscdev_fops;	559	st->miscdev.fops = &vmclock_miscdev_fops;
559	st->miscdev.name = st->name;	560	st->miscdev.name = st->name;
560		561
561	ret = misc_register(&st->miscdev);	562	ret = misc_register(&st->miscdev);
562	if (ret)	563	if (ret)
563	goto out;	564	return ret;
564	}	565	}
565		566
566	/* If there is valid clock information, register a PTP clock */	567	/* If there is valid clock information, register a PTP clock */
@@ -570,16 +571,14 @@ static int vmclock_probe(struct platform_device *pdev) · 3 unmodified lines
570	if (IS_ERR(st->ptp_clock)) {	571	if (IS_ERR(st->ptp_clock)) {
571	ret = PTR_ERR(st->ptp_clock);	572	ret = PTR_ERR(st->ptp_clock);
572	st->ptp_clock = NULL;	573	st->ptp_clock = NULL;
573	vmclock_remove(pdev);	574	return ret;
574	goto out;
575	}	575	}
576	}	576	}
577		577
578	if (!st->miscdev.minor && !st->ptp_clock) {	578	if (!st->miscdev.minor && !st->ptp_clock) {
579	/* Neither miscdev nor PTP registered */	579	/* Neither miscdev nor PTP registered */
580	dev_info(dev, "vmclock: Neither miscdev nor PTP available; not registering\n");	580	dev_info(dev, "vmclock: Neither miscdev nor PTP available; not registering\n");
581	ret = -ENODEV;	581	return -ENODEV;
582	goto out;
583	}	582	}
584		583
585	dev_info(dev, "%s: registered %s%s%s\n", st->name,	584	dev_info(dev, "%s: registered %s%s%s\n", st->name,
@@ -587,10 +586,7 @@ static int vmclock_probe(struct platform_device *pdev) · 1 unmodified line
587	(st->miscdev.minor && st->ptp_clock) ? ", " : "",	586	(st->miscdev.minor && st->ptp_clock) ? ", " : "",
588	st->ptp_clock ? "PTP" : "");	587	st->ptp_clock ? "PTP" : "");
589		588
590	dev_set_drvdata(dev, st);	589	return 0;
591
592	out:
593	return ret;
594	}	590	}
595		591
596	static const struct acpi_device_id vmclock_acpi_ids[] = {	592	static const struct acpi_device_id vmclock_acpi_ids[] = {
@@ -601,7 +597,6 @@ MODULE_DEVICE_TABLE(acpi, vmclock_acpi_ids); · 4 unmodified lines
601		597
602	static struct platform_driver vmclock_platform_driver = {	598	static struct platform_driver vmclock_platform_driver = {
603	.probe = vmclock_probe,	599	.probe = vmclock_probe,
604	.remove = vmclock_remove,
605	.driver = {	600	.driver = {
606	.name = "vmclock",	601	.name = "vmclock",
607	.acpi_match_table = vmclock_acpi_ids,	602	.acpi_match_table = vmclock_acpi_ids,

drivers/s390/net/qeth_core_main.c+5−3

 	card->data.state = CH_STATE_UP;
 	netif_tx_start_all_queues(dev);
-	local_bh_disable();
 	qeth_for_each_output_queue(card, queue, i) {
 		netif_napi_add_tx(dev, &queue->napi, qeth_tx_poll);
 		napi_enable(&queue->napi);
-		napi_schedule(&queue->napi);
 	}
 	napi_enable(&card->napi);
+	local_bh_disable();
+	qeth_for_each_output_queue(card, queue, i) {
+		napi_schedule(&queue->napi);
+	}
 	napi_schedule(&card->napi);
 	/* kick-start the NAPI softirq: */
 	local_bh_enable();

include/linux/netdevice.h+6−0

 	return read_pnet(&dev->nd_net);
 }
+static inline
+struct net *dev_net_rcu(const struct net_device *dev)
+{
+	return read_pnet_rcu(&dev->nd_net);
+}
 static inline
 void dev_net_set(struct net_device *dev, struct net *net)
 {

include/net/bluetooth/l2cap.h+2−1

 	struct l2cap_chan	*smp;
 	struct list_head	chan_l;
-	struct mutex		chan_lock;
+	struct mutex		lock;
 	struct kref		ref;
 	struct list_head	users;
 };
 void l2cap_send_conn_req(struct l2cap_chan *chan);
 struct l2cap_conn *l2cap_conn_get(struct l2cap_conn *conn);
+struct l2cap_conn *l2cap_conn_hold_unless_zero(struct l2cap_conn *conn);
 void l2cap_conn_put(struct l2cap_conn *conn);
 int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user);

include/net/ip.h+10−3

 						    bool forwarding)
 {
 	const struct rtable *rt = dst_rtable(dst);
-	struct net *net = dev_net(dst->dev);
+	unsigned int mtu, res;
-	unsigned int mtu;
+	struct net *net;
+	rcu_read_lock();
+	net = dev_net_rcu(dst->dev);
 	if (READ_ONCE(net->ipv4.sysctl_ip_fwd_use_pmtu) ||
 	    ip_mtu_locked(dst) ||
 	    !forwarding) {
 out:
 	mtu = min_t(unsigned int, mtu, IP_MAX_MTU);
-	return mtu - lwtunnel_headroom(dst->lwtstate, mtu);
+	res = mtu - lwtunnel_headroom(dst->lwtstate, mtu);
+	rcu_read_unlock();
+	return res;
 }
 static inline unsigned int ip_skb_dst_mtu(struct sock *sk,

include/net/l3mdev.h+2−0

 	if (netif_is_l3_slave(dev)) {
 		struct net_device *master;
+		rcu_read_lock();
 		master = netdev_master_upper_dev_get_rcu(dev);
 		if (master && master->l3mdev_ops->l3mdev_l3_out)
 			skb = master->l3mdev_ops->l3mdev_l3_out(master, sk,
 								skb, proto);
+		rcu_read_unlock();
 	}
 	return skb;

include/net/net_namespace.h+1−1

@@ -398,7 +398,7 @@ static inline struct net read_pnet(const possible_net_t pnet) · 397 unmodified lines
398	#endif	398	#endif
399	}	399	}
400		400
401	static inline struct net read_pnet_rcu(possible_net_t pnet)	401	static inline struct net read_pnet_rcu(const possible_net_t pnet)
402	{	402	{
403	#ifdef CONFIG_NET_NS	403	#ifdef CONFIG_NET_NS
404	return rcu_dereference(pnet->net);	404	return rcu_dereference(pnet->net);

include/net/route.h+7−2

 static inline int ip4_dst_hoplimit(const struct dst_entry *dst)
 {
 	int hoplimit = dst_metric_raw(dst, RTAX_HOPLIMIT);
-	struct net *net = dev_net(dst->dev);
-	if (hoplimit == 0)
+	if (hoplimit == 0) {
+		const struct net *net;
+		rcu_read_lock();
+		net = dev_net_rcu(dst->dev);
 		hoplimit = READ_ONCE(net->ipv4.sysctl_ip_default_ttl);
+		rcu_read_unlock();
+	}
 	return hoplimit;
 }

include/uapi/linux/ethtool.h+2−0

  * @ETH_SS_STATS_ETH_CTRL: names of IEEE 802.3 MAC Control statistics
  * @ETH_SS_STATS_RMON: names of RMON statistics
  * @ETH_SS_STATS_PHY: names of PHY(dev) statistics
+ * @ETH_SS_TS_FLAGS: hardware timestamping flags
  *
  * @ETH_SS_COUNT: number of defined string sets
  */
 	ETH_SS_STATS_ETH_CTRL,
 	ETH_SS_STATS_RMON,
 	ETH_SS_STATS_PHY,
+	ETH_SS_TS_FLAGS,
 	/* add new constants above here */
 	ETH_SS_COUNT

net/ax25/af_ax25.c+11−0

 			break;
 		}
+		if (ax25->ax25_dev) {
+			if (dev == ax25->ax25_dev->dev) {
+				rcu_read_unlock();
+				break;
+			}
+			netdev_put(ax25->ax25_dev->dev, &ax25->dev_tracker);
+			ax25_dev_put(ax25->ax25_dev);
+		}
 		ax25->ax25_dev = ax25_dev_ax25dev(dev);
 		if (!ax25->ax25_dev) {
 			rcu_read_unlock();
 			break;
 		}
 		ax25_fillin_cb(ax25, ax25->ax25_dev);
+		netdev_hold(dev, &ax25->dev_tracker, GFP_ATOMIC);
+		ax25_dev_hold(ax25->ax25_dev);
 		rcu_read_unlock();
 		break;

net/batman-adv/bat_v.c+0−2

@@ -113,8 +113,6 @@ static void · 112 unmodified lines
113	batadv_v_hardif_neigh_init(struct batadv_hardif_neigh_node *hardif_neigh)	113	batadv_v_hardif_neigh_init(struct batadv_hardif_neigh_node *hardif_neigh)
114	{	114	{
115	ewma_throughput_init(&hardif_neigh->bat_v.throughput);	115	ewma_throughput_init(&hardif_neigh->bat_v.throughput);
116	INIT_WORK(&hardif_neigh->bat_v.metric_work,
117	batadv_v_elp_throughput_metric_update);
118	}	116	}
119		117
120	/**	118	/**

net/batman-adv/bat_v_elp.c+86−36

 #include <linux/if_ether.h>
 #include <linux/jiffies.h>
 #include <linux/kref.h>
+#include <linux/list.h>
 #include <linux/minmax.h>
 #include <linux/netdevice.h>
 #include <linux/nl80211.h>
 #include <linux/rcupdate.h>
 #include <linux/rtnetlink.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <linux/stddef.h>
 #include <linux/string.h>
 #include <linux/types.h>
 #include "routing.h"
 #include "send.h"
+/**
+ * struct batadv_v_metric_queue_entry - list of hardif neighbors which require
+ *  and metric update
+ */
+struct batadv_v_metric_queue_entry {
+	/** @hardif_neigh: hardif neighbor scheduled for metric update */
+	struct batadv_hardif_neigh_node *hardif_neigh;
+	/** @list: list node for metric_queue */
+	struct list_head list;
+};
 /**
  * batadv_v_elp_start_timer() - restart timer for ELP periodic work
  * @hard_iface: the interface for which the timer has to be reset
 /**
  * batadv_v_elp_get_throughput() - get the throughput towards a neighbour
  * @neigh: the neighbour for which the throughput has to be obtained
+ * @pthroughput: calculated throughput towards the given neighbour in multiples
+ *  of 100kpbs (a value of '1' equals 0.1Mbps, '10' equals 1Mbps, etc).
  *
- * Return: The throughput towards the given neighbour in multiples of 100kpbs
+ * Return: true when value behind @pthroughput was set
- *         (a value of '1' equals 0.1Mbps, '10' equals 1Mbps, etc).
  */
-static u32 batadv_v_elp_get_throughput(struct batadv_hardif_neigh_node *neigh)
+static bool batadv_v_elp_get_throughput(struct batadv_hardif_neigh_node *neigh,
+					u32 *pthroughput)
 {
 	struct batadv_hard_iface *hard_iface = neigh->if_incoming;
+	struct net_device *soft_iface = hard_iface->soft_iface;
 	struct ethtool_link_ksettings link_settings;
 	struct net_device *real_netdev;
 	struct station_info sinfo;
 	u32 throughput;
 	int ret;
+	/* don't query throughput when no longer associated with any
+	 * batman-adv interface
+	 */
+	if (!soft_iface)
+		return false;
 	/* if the user specified a customised value for this interface, then
 	 * return it directly
 	 */
 	throughput =  atomic_read(&hard_iface->bat_v.throughput_override);
-	if (throughput != 0)
+	if (throughput != 0) {
-		return throughput;
+		*pthroughput = throughput;
+		return true;
+	}
 	/* if this is a wireless device, then ask its throughput through
 	 * cfg80211 API
 			 * possible to delete this neighbor. For now set
 			 * the throughput metric to 0.
 			 */
-			return 0;
+			*pthroughput = 0;
+			return true;
 		}
 		if (ret)
 			goto default_throughput;
-		if (sinfo.filled & BIT(NL80211_STA_INFO_EXPECTED_THROUGHPUT))
+		if (sinfo.filled & BIT(NL80211_STA_INFO_EXPECTED_THROUGHPUT)) {
-			return sinfo.expected_throughput / 100;
+			*pthroughput = sinfo.expected_throughput / 100;
+			return true;
+		}
 		/* try to estimate the expected throughput based on reported tx
 		 * rates
 		 */
-		if (sinfo.filled & BIT(NL80211_STA_INFO_TX_BITRATE))
+		if (sinfo.filled & BIT(NL80211_STA_INFO_TX_BITRATE)) {
-			return cfg80211_calculate_bitrate(&sinfo.txrate) / 3;
+			*pthroughput = cfg80211_calculate_bitrate(&sinfo.txrate) / 3;
+			return true;
+		}
 		goto default_throughput;
 	}
+	/* only use rtnl_trylock because the elp worker will be cancelled while
+	 * the rntl_lock is held. the cancel_delayed_work_sync() would otherwise
+	 * wait forever when the elp work_item was started and it is then also
+	 * trying to rtnl_lock
+	 */
+	if (!rtnl_trylock())
+		return false;
 	/* if not a wifi interface, check if this device provides data via
 	 * ethtool (e.g. an Ethernet adapter)
 	 */
-	rtnl_lock();
 	ret = __ethtool_get_link_ksettings(hard_iface->net_dev, &link_settings);
 	rtnl_unlock();
 	if (ret == 0) {
 			hard_iface->bat_v.flags &= ~BATADV_FULL_DUPLEX;
 		throughput = link_settings.base.speed;
-		if (throughput && throughput != SPEED_UNKNOWN)
+		if (throughput && throughput != SPEED_UNKNOWN) {
-			return throughput * 10;
+			*pthroughput = throughput * 10;
+			return true;
+		}
 	}
 default_throughput:
 	if (!(hard_iface->bat_v.flags & BATADV_WARNING_DEFAULT)) {
-		batadv_info(hard_iface->soft_iface,
+		batadv_info(soft_iface,
 			    "WiFi driver or ethtool info does not provide information about link speeds on interface %s, therefore defaulting to hardcoded throughput values of %u.%1u Mbps. Consider overriding the throughput manually or checking your driver.\n",
 			    hard_iface->net_dev->name,
 			    BATADV_THROUGHPUT_DEFAULT_VALUE / 10,
 	}
 	/* if none of the above cases apply, return the base_throughput */
-	return BATADV_THROUGHPUT_DEFAULT_VALUE;
+	*pthroughput = BATADV_THROUGHPUT_DEFAULT_VALUE;
+	return true;
 }
 /**
  * batadv_v_elp_throughput_metric_update() - worker updating the throughput
  *  metric of a single hop neighbour
- * @work: the work queue item
+ * @neigh: the neighbour to probe
  */
-void batadv_v_elp_throughput_metric_update(struct work_struct *work)
+static void
+batadv_v_elp_throughput_metric_update(struct batadv_hardif_neigh_node *neigh)
 {
-	struct batadv_hardif_neigh_node_bat_v *neigh_bat_v;
+	u32 throughput;
-	struct batadv_hardif_neigh_node *neigh;
+	bool valid;
-	neigh_bat_v = container_of(work, struct batadv_hardif_neigh_node_bat_v,
-				   metric_work);
-	neigh = container_of(neigh_bat_v, struct batadv_hardif_neigh_node,
-			     bat_v);
-	ewma_throughput_add(&neigh->bat_v.throughput,
+	valid = batadv_v_elp_get_throughput(neigh, &throughput);
-			    batadv_v_elp_get_throughput(neigh));
+	if (!valid)
+		return;
-	/* decrement refcounter to balance increment performed before scheduling
+	ewma_throughput_add(&neigh->bat_v.throughput, throughput);
-	 * this task
-	 */
-	batadv_hardif_neigh_put(neigh);
 }
 /**
  */
 static void batadv_v_elp_periodic_work(struct work_struct *work)
 {
+	struct batadv_v_metric_queue_entry *metric_entry;
+	struct batadv_v_metric_queue_entry *metric_safe;
 	struct batadv_hardif_neigh_node *hardif_neigh;
 	struct batadv_hard_iface *hard_iface;
 	struct batadv_hard_iface_bat_v *bat_v;
 	struct batadv_elp_packet *elp_packet;
+	struct list_head metric_queue;
 	struct batadv_priv *bat_priv;
 	struct sk_buff *skb;
 	u32 elp_interval;
-	bool ret;
 	bat_v = container_of(work, struct batadv_hard_iface_bat_v, elp_wq.work);
 	hard_iface = container_of(bat_v, struct batadv_hard_iface, bat_v);
 	atomic_inc(&hard_iface->bat_v.elp_seqno);
+	INIT_LIST_HEAD(&metric_queue);
 	/* The throughput metric is updated on each sent packet. This way, if a
 	 * node is dead and no longer sends packets, batman-adv is still able to
 	 * react timely to its death.
 		/* Reading the estimated throughput from cfg80211 is a task that
 		 * may sleep and that is not allowed in an rcu protected
-		 * context. Therefore schedule a task for that.
+		 * context. Therefore add it to metric_queue and process it
+		 * outside rcu protected context.
 		 */
-		ret = queue_work(batadv_event_workqueue,
+		metric_entry = kzalloc(sizeof(*metric_entry), GFP_ATOMIC);
-				 &hardif_neigh->bat_v.metric_work);
+		if (!metric_entry) {
-		if (!ret)
 			batadv_hardif_neigh_put(hardif_neigh);
+			continue;
+		}
+		metric_entry->hardif_neigh = hardif_neigh;
+		list_add(&metric_entry->list, &metric_queue);
 	}
 	rcu_read_unlock();
+	list_for_each_entry_safe(metric_entry, metric_safe, &metric_queue, list) {
+		batadv_v_elp_throughput_metric_update(metric_entry->hardif_neigh);
+		batadv_hardif_neigh_put(metric_entry->hardif_neigh);
+		list_del(&metric_entry->list);
+		kfree(metric_entry);
+	}
 restart_timer:
 	batadv_v_elp_start_timer(hard_iface);
 out:

net/batman-adv/bat_v_elp.h+0−2

 #include "main.h"
 #include <linux/skbuff.h>
-#include <linux/workqueue.h>
 int batadv_v_elp_iface_enable(struct batadv_hard_iface *hard_iface);
 void batadv_v_elp_iface_disable(struct batadv_hard_iface *hard_iface);
 void batadv_v_elp_primary_iface_set(struct batadv_hard_iface *primary_iface);
 int batadv_v_elp_packet_recv(struct sk_buff *skb,
 			     struct batadv_hard_iface *if_incoming);
-void batadv_v_elp_throughput_metric_update(struct work_struct *work);
 #endif /* _NET_BATMAN_ADV_BAT_V_ELP_H_ */

net/batman-adv/translation-table.c+5−7

 	struct batadv_tvlv_tt_change *tt_change;
 	struct batadv_tvlv_tt_data *tt_data;
 	u16 num_entries, num_vlan;
-	size_t flex_size;
+	size_t tt_data_sz;
 	if (tvlv_value_len < sizeof(*tt_data))
 		return;
 	tt_data = tvlv_value;
-	tvlv_value_len -= sizeof(*tt_data);
 	num_vlan = ntohs(tt_data->num_vlan);
-	flex_size = flex_array_size(tt_data, vlan_data, num_vlan);
+	tt_data_sz = struct_size(tt_data, vlan_data, num_vlan);
-	if (tvlv_value_len < flex_size)
+	if (tvlv_value_len < tt_data_sz)
 		return;
 	tt_change = (struct batadv_tvlv_tt_change *)((void *)tt_data
-						     + flex_size);
+						     + tt_data_sz);
-	tvlv_value_len -= flex_size;
+	tvlv_value_len -= tt_data_sz;
 	num_entries = batadv_tt_entries(tvlv_value_len);

net/batman-adv/types.h+0−3

@@ -596,9 +596,6 @@ struct batadv_hardif_neigh_node_bat_v { · 595 unmodified lines
596	* neighbor	596	* neighbor
597	*/	597	*/
598	unsigned long last_unicast_tx;	598	unsigned long last_unicast_tx;
599
600	/** @metric_work: work queue callback item for metric update */
601	struct work_struct metric_work;
602	};	599	};
603		600
604	/**	601	/**

net/bluetooth/l2cap_core.c+79−90

@@ -119,7 +119,6 @@ static struct l2cap_chan l2cap_get_chan_by_scid(struct l2cap_conn conn, · 118 unmodified lines
119	{	119	{
120	struct l2cap_chan *c;	120	struct l2cap_chan *c;
121		121
122	mutex_lock(&conn->chan_lock);
123	c = __l2cap_get_chan_by_scid(conn, cid);	122	c = __l2cap_get_chan_by_scid(conn, cid);
124	if (c) {	123	if (c) {
125	/* Only lock if chan reference is not 0 */	124	/* Only lock if chan reference is not 0 */
@@ -127,7 +126,6 @@ static struct l2cap_chan l2cap_get_chan_by_scid(struct l2cap_conn conn, · 1 unmodified line
127	if (c)	126	if (c)
128	l2cap_chan_lock(c);	127	l2cap_chan_lock(c);
129	}	128	}
130	mutex_unlock(&conn->chan_lock);
131		129
132	return c;	130	return c;
133	}	131	}
@@ -140,7 +138,6 @@ static struct l2cap_chan l2cap_get_chan_by_dcid(struct l2cap_conn conn, · 6 unmodified lines
140	{	138	{
141	struct l2cap_chan *c;	139	struct l2cap_chan *c;
142		140
143	mutex_lock(&conn->chan_lock);
144	c = __l2cap_get_chan_by_dcid(conn, cid);	141	c = __l2cap_get_chan_by_dcid(conn, cid);
145	if (c) {	142	if (c) {
146	/* Only lock if chan reference is not 0 */	143	/* Only lock if chan reference is not 0 */
@@ -148,7 +145,6 @@ static struct l2cap_chan l2cap_get_chan_by_dcid(struct l2cap_conn conn, · 1 unmodified line
148	if (c)	145	if (c)
149	l2cap_chan_lock(c);	146	l2cap_chan_lock(c);
150	}	147	}
151	mutex_unlock(&conn->chan_lock);
152		148
153	return c;	149	return c;
154	}	150	}
@@ -418,7 +414,7 @@ static void l2cap_chan_timeout(struct work_struct *work) · 263 unmodified lines
418	if (!conn)	414	if (!conn)
419	return;	415	return;
420		416
421	mutex_lock(&conn->chan_lock);	417	mutex_lock(&conn->lock);
422	/* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling	418	/* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling
423	* this work. No need to call l2cap_chan_hold(chan) here again.	419	* this work. No need to call l2cap_chan_hold(chan) here again.
424	*/	420	*/
@@ -439,7 +435,7 @@ static void l2cap_chan_timeout(struct work_struct *work) · 14 unmodified lines
439	l2cap_chan_unlock(chan);	435	l2cap_chan_unlock(chan);
440	l2cap_chan_put(chan);	436	l2cap_chan_put(chan);
441		437
442	mutex_unlock(&conn->chan_lock);	438	mutex_unlock(&conn->lock);
443	}	439	}
444		440
445	struct l2cap_chan *l2cap_chan_create(void)	441	struct l2cap_chan *l2cap_chan_create(void)
@@ -641,9 +637,9 @@ void __l2cap_chan_add(struct l2cap_conn conn, struct l2cap_chan chan) · 195 unmodified lines
641		637
642	void l2cap_chan_add(struct l2cap_conn conn, struct l2cap_chan chan)	638	void l2cap_chan_add(struct l2cap_conn conn, struct l2cap_chan chan)
643	{	639	{
644	mutex_lock(&conn->chan_lock);	640	mutex_lock(&conn->lock);
645	__l2cap_chan_add(conn, chan);	641	__l2cap_chan_add(conn, chan);
646	mutex_unlock(&conn->chan_lock);	642	mutex_unlock(&conn->lock);
647	}	643	}
648		644
649	void l2cap_chan_del(struct l2cap_chan *chan, int err)	645	void l2cap_chan_del(struct l2cap_chan *chan, int err)
@@ -731,9 +727,9 @@ void l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func, · 81 unmodified lines
731	if (!conn)	727	if (!conn)
732	return;	728	return;
733		729
734	mutex_lock(&conn->chan_lock);	730	mutex_lock(&conn->lock);
735	__l2cap_chan_list(conn, func, data);	731	__l2cap_chan_list(conn, func, data);
736	mutex_unlock(&conn->chan_lock);	732	mutex_unlock(&conn->lock);
737	}	733	}
738		734
739	EXPORT_SYMBOL_GPL(l2cap_chan_list);	735	EXPORT_SYMBOL_GPL(l2cap_chan_list);
@@ -745,7 +741,7 @@ static void l2cap_conn_update_id_addr(struct work_struct *work) · 5 unmodified lines
745	struct hci_conn *hcon = conn->hcon;	741	struct hci_conn *hcon = conn->hcon;
746	struct l2cap_chan *chan;	742	struct l2cap_chan *chan;
747		743
748	mutex_lock(&conn->chan_lock);	744	mutex_lock(&conn->lock);
749		745
750	list_for_each_entry(chan, &conn->chan_l, list) {	746	list_for_each_entry(chan, &conn->chan_l, list) {
751	l2cap_chan_lock(chan);	747	l2cap_chan_lock(chan);
@@ -754,7 +750,7 @@ static void l2cap_conn_update_id_addr(struct work_struct *work) · 2 unmodified lines
754	l2cap_chan_unlock(chan);	750	l2cap_chan_unlock(chan);
755	}	751	}
756		752
757	mutex_unlock(&conn->chan_lock);	753	mutex_unlock(&conn->lock);
758	}	754	}
759		755
760	static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan)	756	static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan)
@@ -948,6 +944,16 @@ static u8 l2cap_get_ident(struct l2cap_conn *conn) · 187 unmodified lines
948	return id;	944	return id;
949	}	945	}
950		946
		947	static void l2cap_send_acl(struct l2cap_conn conn, struct sk_buff skb,
		948	u8 flags)
		949	{
		950	/* Check if the hcon still valid before attempting to send */
		951	if (hci_conn_valid(conn->hcon->hdev, conn->hcon))
		952	hci_send_acl(conn->hchan, skb, flags);
		953	else
		954	kfree_skb(skb);
		955	}
		956
951	static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,	957	static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
952	void *data)	958	void *data)
953	{	959	{
@@ -970,7 +976,7 @@ static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, · 16 unmodified lines
970	bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;	976	bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
971	skb->priority = HCI_PRIO_MAX;	977	skb->priority = HCI_PRIO_MAX;
972		978
973	hci_send_acl(conn->hchan, skb, flags);	979	l2cap_send_acl(conn, skb, flags);
974	}	980	}
975		981
976	static void l2cap_do_send(struct l2cap_chan chan, struct sk_buff skb)	982	static void l2cap_do_send(struct l2cap_chan chan, struct sk_buff skb)
@@ -1497,8 +1503,6 @@ static void l2cap_conn_start(struct l2cap_conn *conn) · 520 unmodified lines
1497		1503
1498	BT_DBG("conn %p", conn);	1504	BT_DBG("conn %p", conn);
1499		1505
1500	mutex_lock(&conn->chan_lock);
1501
1502	list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {	1506	list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
1503	l2cap_chan_lock(chan);	1507	l2cap_chan_lock(chan);
1504		1508
@@ -1567,8 +1571,6 @@ static void l2cap_conn_start(struct l2cap_conn *conn) · 62 unmodified lines
1567		1571
1568	l2cap_chan_unlock(chan);	1572	l2cap_chan_unlock(chan);
1569	}	1573	}
1570
1571	mutex_unlock(&conn->chan_lock);
1572	}	1574	}
1573		1575
1574	static void l2cap_le_conn_ready(struct l2cap_conn *conn)	1576	static void l2cap_le_conn_ready(struct l2cap_conn *conn)
@@ -1614,7 +1616,7 @@ static void l2cap_conn_ready(struct l2cap_conn *conn) · 39 unmodified lines
1614	if (hcon->type == ACL_LINK)	1616	if (hcon->type == ACL_LINK)
1615	l2cap_request_info(conn);	1617	l2cap_request_info(conn);
1616		1618
1617	mutex_lock(&conn->chan_lock);	1619	mutex_lock(&conn->lock);
1618		1620
1619	list_for_each_entry(chan, &conn->chan_l, list) {	1621	list_for_each_entry(chan, &conn->chan_l, list) {
1620		1622
@@ -1632,7 +1634,7 @@ static void l2cap_conn_ready(struct l2cap_conn *conn) · 11 unmodified lines
1632	l2cap_chan_unlock(chan);	1634	l2cap_chan_unlock(chan);
1633	}	1635	}
1634		1636
1635	mutex_unlock(&conn->chan_lock);	1637	mutex_unlock(&conn->lock);
1636		1638
1637	if (hcon->type == LE_LINK)	1639	if (hcon->type == LE_LINK)
1638	l2cap_le_conn_ready(conn);	1640	l2cap_le_conn_ready(conn);
@@ -1647,14 +1649,10 @@ static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err) · 8 unmodified lines
1647		1649
1648	BT_DBG("conn %p", conn);	1650	BT_DBG("conn %p", conn);
1649		1651
1650	mutex_lock(&conn->chan_lock);
1651
1652	list_for_each_entry(chan, &conn->chan_l, list) {	1652	list_for_each_entry(chan, &conn->chan_l, list) {
1653	if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))	1653	if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
1654	l2cap_chan_set_err(chan, err);	1654	l2cap_chan_set_err(chan, err);
1655	}	1655	}
1656
1657	mutex_unlock(&conn->chan_lock);
1658	}	1656	}
1659		1657
1660	static void l2cap_info_timeout(struct work_struct *work)	1658	static void l2cap_info_timeout(struct work_struct *work)
@@ -1665,7 +1663,9 @@ static void l2cap_info_timeout(struct work_struct *work) · 4 unmodified lines
1665	conn->info_state \|= L2CAP_INFO_FEAT_MASK_REQ_DONE;	1663	conn->info_state \|= L2CAP_INFO_FEAT_MASK_REQ_DONE;
1666	conn->info_ident = 0;	1664	conn->info_ident = 0;
1667		1665
		1666	mutex_lock(&conn->lock);
1668	l2cap_conn_start(conn);	1667	l2cap_conn_start(conn);
		1668	mutex_unlock(&conn->lock);
1669	}	1669	}
1670		1670
1671	/*	1671	/*
@@ -1757,6 +1757,8 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err) · 85 unmodified lines
1757		1757
1758	BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);	1758	BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
1759		1759
		1760	mutex_lock(&conn->lock);
		1761
1760	kfree_skb(conn->rx_skb);	1762	kfree_skb(conn->rx_skb);
1761		1763
1762	skb_queue_purge(&conn->pending_rx);	1764	skb_queue_purge(&conn->pending_rx);
@@ -1775,8 +1777,6 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err) · 12 unmodified lines
1775	/* Force the connection to be immediately dropped */	1777	/* Force the connection to be immediately dropped */
1776	hcon->disc_timeout = 0;	1778	hcon->disc_timeout = 0;
1777		1779
1778	mutex_lock(&conn->chan_lock);
1779
1780	/* Kill channels */	1780	/* Kill channels */
1781	list_for_each_entry_safe(chan, l, &conn->chan_l, list) {	1781	list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
1782	l2cap_chan_hold(chan);	1782	l2cap_chan_hold(chan);
@@ -1790,15 +1790,14 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err) · 7 unmodified lines
1790	l2cap_chan_put(chan);	1790	l2cap_chan_put(chan);
1791	}	1791	}
1792		1792
1793	mutex_unlock(&conn->chan_lock);
1794
1795	hci_chan_del(conn->hchan);
1796
1797	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)	1793	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
1798	cancel_delayed_work_sync(&conn->info_timer);	1794	cancel_delayed_work_sync(&conn->info_timer);
1799		1795
1800	hcon->l2cap_data = NULL;	1796	hci_chan_del(conn->hchan);
1801	conn->hchan = NULL;	1797	conn->hchan = NULL;
		1798
		1799	hcon->l2cap_data = NULL;
		1800	mutex_unlock(&conn->lock);
1802	l2cap_conn_put(conn);	1801	l2cap_conn_put(conn);
1803	}	1802	}
1804		1803
@@ -2916,8 +2915,6 @@ static void l2cap_raw_recv(struct l2cap_conn conn, struct sk_buff skb) · 1111 unmodified lines
2916		2915
2917	BT_DBG("conn %p", conn);	2916	BT_DBG("conn %p", conn);
2918		2917
2919	mutex_lock(&conn->chan_lock);
2920
2921	list_for_each_entry(chan, &conn->chan_l, list) {	2918	list_for_each_entry(chan, &conn->chan_l, list) {
2922	if (chan->chan_type != L2CAP_CHAN_RAW)	2919	if (chan->chan_type != L2CAP_CHAN_RAW)
2923	continue;	2920	continue;
@@ -2932,8 +2929,6 @@ static void l2cap_raw_recv(struct l2cap_conn conn, struct sk_buff skb) · 8 unmodified lines
2932	if (chan->ops->recv(chan, nskb))	2929	if (chan->ops->recv(chan, nskb))
2933	kfree_skb(nskb);	2930	kfree_skb(nskb);
2934	}	2931	}
2935
2936	mutex_unlock(&conn->chan_lock);
2937	}	2932	}
2938		2933
2939	/* ---- L2CAP signalling commands ---- */	2934	/* ---- L2CAP signalling commands ---- */
@@ -3952,7 +3947,6 @@ static void l2cap_connect(struct l2cap_conn conn, struct l2cap_cmd_hdr cmd, · 1012 unmodified lines
3952	goto response;	3947	goto response;
3953	}	3948	}
3954		3949
3955	mutex_lock(&conn->chan_lock);
3956	l2cap_chan_lock(pchan);	3950	l2cap_chan_lock(pchan);
3957		3951
3958	/* Check if the ACL is secure enough (if not SDP) */	3952	/* Check if the ACL is secure enough (if not SDP) */
@@ -4059,7 +4053,6 @@ response: · 100 unmodified lines
4059	}	4053	}
4060		4054
4061	l2cap_chan_unlock(pchan);	4055	l2cap_chan_unlock(pchan);
4062	mutex_unlock(&conn->chan_lock);
4063	l2cap_chan_put(pchan);	4056	l2cap_chan_put(pchan);
4064	}	4057	}
4065		4058
@@ -4098,27 +4091,19 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn, · 32 unmodified lines
4098	BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",	4091	BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
4099	dcid, scid, result, status);	4092	dcid, scid, result, status);
4100		4093
4101	mutex_lock(&conn->chan_lock);
4102
4103	if (scid) {	4094	if (scid) {
4104	chan = __l2cap_get_chan_by_scid(conn, scid);	4095	chan = __l2cap_get_chan_by_scid(conn, scid);
4105	if (!chan) {	4096	if (!chan)
4106	err = -EBADSLT;	4097	return -EBADSLT;
4107	goto unlock;
4108	}
4109	} else {	4098	} else {
4110	chan = __l2cap_get_chan_by_ident(conn, cmd->ident);	4099	chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
4111	if (!chan) {	4100	if (!chan)
4112	err = -EBADSLT;	4101	return -EBADSLT;
4113	goto unlock;
4114	}
4115	}	4102	}
4116		4103
4117	chan = l2cap_chan_hold_unless_zero(chan);	4104	chan = l2cap_chan_hold_unless_zero(chan);
4118	if (!chan) {	4105	if (!chan)
4119	err = -EBADSLT;	4106	return -EBADSLT;
4120	goto unlock;
4121	}
4122		4107
4123	err = 0;	4108	err = 0;
4124		4109
@@ -4156,9 +4141,6 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn, · 31 unmodified lines
4156	l2cap_chan_unlock(chan);	4141	l2cap_chan_unlock(chan);
4157	l2cap_chan_put(chan);	4142	l2cap_chan_put(chan);
4158		4143
4159	unlock:
4160	mutex_unlock(&conn->chan_lock);
4161
4162	return err;	4144	return err;
4163	}	4145	}
4164		4146
@@ -4446,11 +4428,7 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn, · 281 unmodified lines
4446		4428
4447	chan->ops->set_shutdown(chan);	4429	chan->ops->set_shutdown(chan);
4448		4430
4449	l2cap_chan_unlock(chan);
4450	mutex_lock(&conn->chan_lock);
4451	l2cap_chan_lock(chan);
4452	l2cap_chan_del(chan, ECONNRESET);	4431	l2cap_chan_del(chan, ECONNRESET);
4453	mutex_unlock(&conn->chan_lock);
4454		4432
4455	chan->ops->close(chan);	4433	chan->ops->close(chan);
4456		4434
@@ -4487,11 +4465,7 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, · 30 unmodified lines
4487	return 0;	4465	return 0;
4488	}	4466	}
4489		4467
4490	l2cap_chan_unlock(chan);
4491	mutex_lock(&conn->chan_lock);
4492	l2cap_chan_lock(chan);
4493	l2cap_chan_del(chan, 0);	4468	l2cap_chan_del(chan, 0);
4494	mutex_unlock(&conn->chan_lock);
4495		4469
4496	chan->ops->close(chan);	4470	chan->ops->close(chan);
4497		4471
@@ -4689,13 +4663,9 @@ static int l2cap_le_connect_rsp(struct l2cap_conn *conn, · 191 unmodified lines
4689	BT_DBG("dcid 0x%4.4x mtu %u mps %u credits %u result 0x%2.2x",	4663	BT_DBG("dcid 0x%4.4x mtu %u mps %u credits %u result 0x%2.2x",
4690	dcid, mtu, mps, credits, result);	4664	dcid, mtu, mps, credits, result);
4691		4665
4692	mutex_lock(&conn->chan_lock);
4693
4694	chan = __l2cap_get_chan_by_ident(conn, cmd->ident);	4666	chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
4695	if (!chan) {	4667	if (!chan)
4696	err = -EBADSLT;	4668	return -EBADSLT;
4697	goto unlock;
4698	}
4699		4669
4700	err = 0;	4670	err = 0;
4701		4671
@@ -4743,9 +4713,6 @@ static int l2cap_le_connect_rsp(struct l2cap_conn *conn, · 41 unmodified lines
4743		4713
4744	l2cap_chan_unlock(chan);	4714	l2cap_chan_unlock(chan);
4745		4715
4746	unlock:
4747	mutex_unlock(&conn->chan_lock);
4748
4749	return err;	4716	return err;
4750	}	4717	}
4751		4718
@@ -4857,7 +4824,6 @@ static int l2cap_le_connect_req(struct l2cap_conn *conn, · 105 unmodified lines
4857	goto response;	4824	goto response;
4858	}	4825	}
4859		4826
4860	mutex_lock(&conn->chan_lock);
4861	l2cap_chan_lock(pchan);	4827	l2cap_chan_lock(pchan);
4862		4828
4863	if (!smp_sufficient_security(conn->hcon, pchan->sec_level,	4829	if (!smp_sufficient_security(conn->hcon, pchan->sec_level,
@@ -4923,7 +4889,6 @@ static int l2cap_le_connect_req(struct l2cap_conn *conn, · 59 unmodified lines
4923		4889
4924	response_unlock:	4890	response_unlock:
4925	l2cap_chan_unlock(pchan);	4891	l2cap_chan_unlock(pchan);
4926	mutex_unlock(&conn->chan_lock);
4927	l2cap_chan_put(pchan);	4892	l2cap_chan_put(pchan);
4928		4893
4929	if (result == L2CAP_CR_PEND)	4894	if (result == L2CAP_CR_PEND)
@@ -5057,7 +5022,6 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn, · 127 unmodified lines
5057	goto response;	5022	goto response;
5058	}	5023	}
5059		5024
5060	mutex_lock(&conn->chan_lock);
5061	l2cap_chan_lock(pchan);	5025	l2cap_chan_lock(pchan);
5062		5026
5063	if (!smp_sufficient_security(conn->hcon, pchan->sec_level,	5027	if (!smp_sufficient_security(conn->hcon, pchan->sec_level,
@@ -5132,7 +5096,6 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn, · 68 unmodified lines
5132		5096
5133	unlock:	5097	unlock:
5134	l2cap_chan_unlock(pchan);	5098	l2cap_chan_unlock(pchan);
5135	mutex_unlock(&conn->chan_lock);
5136	l2cap_chan_put(pchan);	5099	l2cap_chan_put(pchan);
5137		5100
5138	response:	5101	response:
@@ -5169,8 +5132,6 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn, · 30 unmodified lines
5169	BT_DBG("mtu %u mps %u credits %u result 0x%4.4x", mtu, mps, credits,	5132	BT_DBG("mtu %u mps %u credits %u result 0x%4.4x", mtu, mps, credits,
5170	result);	5133	result);
5171		5134
5172	mutex_lock(&conn->chan_lock);
5173
5174	cmd_len -= sizeof(*rsp);	5135	cmd_len -= sizeof(*rsp);
5175		5136
5176	list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {	5137	list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
@@ -5256,8 +5217,6 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn, · 79 unmodified lines
5256	l2cap_chan_unlock(chan);	5217	l2cap_chan_unlock(chan);
5257	}	5218	}
5258		5219
5259	mutex_unlock(&conn->chan_lock);
5260
5261	return err;	5220	return err;
5262	}	5221	}
5263		5222
@@ -5370,8 +5329,6 @@ static inline int l2cap_le_command_rej(struct l2cap_conn *conn, · 106 unmodified lines
5370	if (cmd_len < sizeof(*rej))	5329	if (cmd_len < sizeof(*rej))
5371	return -EPROTO;	5330	return -EPROTO;
5372		5331
5373	mutex_lock(&conn->chan_lock);
5374
5375	chan = __l2cap_get_chan_by_ident(conn, cmd->ident);	5332	chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
5376	if (!chan)	5333	if (!chan)
5377	goto done;	5334	goto done;
@@ -5386,7 +5343,6 @@ static inline int l2cap_le_command_rej(struct l2cap_conn *conn, · 8 unmodified lines
5386	l2cap_chan_put(chan);	5343	l2cap_chan_put(chan);
5387		5344
5388	done:	5345	done:
5389	mutex_unlock(&conn->chan_lock);
5390	return 0;	5346	return 0;
5391	}	5347	}
5392		5348
@@ -6841,8 +6797,12 @@ static void process_pending_rx(struct work_struct *work) · 1448 unmodified lines
6841		6797
6842	BT_DBG("");	6798	BT_DBG("");
6843		6799
		6800	mutex_lock(&conn->lock);
		6801
6844	while ((skb = skb_dequeue(&conn->pending_rx)))	6802	while ((skb = skb_dequeue(&conn->pending_rx)))
6845	l2cap_recv_frame(conn, skb);	6803	l2cap_recv_frame(conn, skb);
		6804
		6805	mutex_unlock(&conn->lock);
6846	}	6806	}
6847		6807
6848	static struct l2cap_conn l2cap_conn_add(struct hci_conn hcon)	6808	static struct l2cap_conn l2cap_conn_add(struct hci_conn hcon)
@@ -6881,7 +6841,7 @@ static struct l2cap_conn l2cap_conn_add(struct hci_conn hcon) · 32 unmodified lines
6881	conn->local_fixed_chan \|= L2CAP_FC_SMP_BREDR;	6841	conn->local_fixed_chan \|= L2CAP_FC_SMP_BREDR;
6882		6842
6883	mutex_init(&conn->ident_lock);	6843	mutex_init(&conn->ident_lock);
6884	mutex_init(&conn->chan_lock);	6844	mutex_init(&conn->lock);
6885		6845
6886	INIT_LIST_HEAD(&conn->chan_l);	6846	INIT_LIST_HEAD(&conn->chan_l);
6887	INIT_LIST_HEAD(&conn->users);	6847	INIT_LIST_HEAD(&conn->users);
@@ -7072,7 +7032,7 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, · 184 unmodified lines
7072	}	7032	}
7073	}	7033	}
7074		7034
7075	mutex_lock(&conn->chan_lock);	7035	mutex_lock(&conn->lock);
7076	l2cap_chan_lock(chan);	7036	l2cap_chan_lock(chan);
7077		7037
7078	if (cid && __l2cap_get_chan_by_dcid(conn, cid)) {	7038	if (cid && __l2cap_get_chan_by_dcid(conn, cid)) {
@@ -7113,7 +7073,7 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, · 34 unmodified lines
7113		7073
7114	chan_unlock:	7074	chan_unlock:
7115	l2cap_chan_unlock(chan);	7075	l2cap_chan_unlock(chan);
7116	mutex_unlock(&conn->chan_lock);	7076	mutex_unlock(&conn->lock);
7117	done:	7077	done:
7118	hci_dev_unlock(hdev);	7078	hci_dev_unlock(hdev);
7119	hci_dev_put(hdev);	7079	hci_dev_put(hdev);
@@ -7325,7 +7285,7 @@ static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt) · 205 unmodified lines
7325		7285
7326	BT_DBG("conn %p status 0x%2.2x encrypt %u", conn, status, encrypt);	7286	BT_DBG("conn %p status 0x%2.2x encrypt %u", conn, status, encrypt);
7327		7287
7328	mutex_lock(&conn->chan_lock);	7288	mutex_lock(&conn->lock);
7329		7289
7330	list_for_each_entry(chan, &conn->chan_l, list) {	7290	list_for_each_entry(chan, &conn->chan_l, list) {
7331	l2cap_chan_lock(chan);	7291	l2cap_chan_lock(chan);
@@ -7399,7 +7359,7 @@ static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt) · 67 unmodified lines
7399	l2cap_chan_unlock(chan);	7359	l2cap_chan_unlock(chan);
7400	}	7360	}
7401		7361
7402	mutex_unlock(&conn->chan_lock);	7362	mutex_unlock(&conn->lock);
7403	}	7363	}
7404		7364
7405	/* Append fragment into frame respecting the maximum len of rx_skb */	7365	/* Append fragment into frame respecting the maximum len of rx_skb */
@@ -7466,19 +7426,45 @@ static void l2cap_recv_reset(struct l2cap_conn *conn) · 60 unmodified lines
7466	conn->rx_len = 0;	7426	conn->rx_len = 0;
7467	}	7427	}
7468		7428
		7429	struct l2cap_conn l2cap_conn_hold_unless_zero(struct l2cap_conn c)
		7430	{
		7431	if (!c)
		7432	return NULL;
		7433
		7434	BT_DBG("conn %p orig refcnt %u", c, kref_read(&c->ref));
		7435
		7436	if (!kref_get_unless_zero(&c->ref))
		7437	return NULL;
		7438
		7439	return c;
		7440	}
		7441
7469	void l2cap_recv_acldata(struct hci_conn hcon, struct sk_buff skb, u16 flags)	7442	void l2cap_recv_acldata(struct hci_conn hcon, struct sk_buff skb, u16 flags)
7470	{	7443	{
7471	struct l2cap_conn *conn = hcon->l2cap_data;	7444	struct l2cap_conn *conn;
7472	int len;	7445	int len;
7473		7446
		7447	/* Lock hdev to access l2cap_data to avoid race with l2cap_conn_del */
		7448	hci_dev_lock(hcon->hdev);
		7449
		7450	conn = hcon->l2cap_data;
		7451
7474	if (!conn)	7452	if (!conn)
7475	conn = l2cap_conn_add(hcon);	7453	conn = l2cap_conn_add(hcon);
7476		7454
7477	if (!conn)	7455	conn = l2cap_conn_hold_unless_zero(conn);
7478	goto drop;	7456
		7457	hci_dev_unlock(hcon->hdev);
		7458
		7459	if (!conn) {
		7460	kfree_skb(skb);
		7461	return;
		7462	}
7479		7463
7480	BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);	7464	BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);
7481		7465
		7466	mutex_lock(&conn->lock);
		7467
7482	switch (flags) {	7468	switch (flags) {
7483	case ACL_START:	7469	case ACL_START:
7484	case ACL_START_NO_FLUSH:	7470	case ACL_START_NO_FLUSH:
@@ -7503,7 +7489,7 @@ void l2cap_recv_acldata(struct hci_conn hcon, struct sk_buff skb, u16 flags) · 18 unmodified lines
7503	if (len == skb->len) {	7489	if (len == skb->len) {
7504	/* Complete frame received */	7490	/* Complete frame received */
7505	l2cap_recv_frame(conn, skb);	7491	l2cap_recv_frame(conn, skb);
7506	return;	7492	goto unlock;
7507	}	7493	}
7508		7494
7509	BT_DBG("Start: total len %d, frag len %u", len, skb->len);	7495	BT_DBG("Start: total len %d, frag len %u", len, skb->len);
@@ -7567,6 +7553,9 @@ void l2cap_recv_acldata(struct hci_conn hcon, struct sk_buff skb, u16 flags) · 57 unmodified lines
7567		7553
7568	drop:	7554	drop:
7569	kfree_skb(skb);	7555	kfree_skb(skb);
		7556	unlock:
		7557	mutex_unlock(&conn->lock);
		7558	l2cap_conn_put(conn);
7570	}	7559	}
7571		7560
7572	static struct hci_cb l2cap_cb = {	7561	static struct hci_cb l2cap_cb = {

net/bluetooth/l2cap_sock.c+7−8

 	/* prevent sk structure from being freed whilst unlocked */
 	sock_hold(sk);
-	chan = l2cap_pi(sk)->chan;
 	/* prevent chan structure from being freed whilst unlocked */
-	l2cap_chan_hold(chan);
+	chan = l2cap_chan_hold_unless_zero(l2cap_pi(sk)->chan);
+	if (!chan)
+		goto shutdown_already;
 	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
 	release_sock(sk);
 	l2cap_chan_lock(chan);
-	conn = chan->conn;
+	/* prevent conn structure from being freed */
-	if (conn)
+	conn = l2cap_conn_hold_unless_zero(chan->conn);
-		/* prevent conn structure from being freed */
-		l2cap_conn_get(conn);
 	l2cap_chan_unlock(chan);
 	if (conn)
 		/* mutex lock must be taken before l2cap_chan_lock() */
-		mutex_lock(&conn->chan_lock);
+		mutex_lock(&conn->lock);
 	l2cap_chan_lock(chan);
 	l2cap_chan_close(chan, 0);
 	l2cap_chan_unlock(chan);
 	if (conn) {
-		mutex_unlock(&conn->chan_lock);
+		mutex_unlock(&conn->lock);
 		l2cap_conn_put(conn);
 	}

net/can/j1939/socket.c+2−2

@@ -1132,7 +1132,7 @@ static int j1939_sk_send_loop(struct j1939_priv priv, struct sock sk, · 1131 unmodified lines
1132		1132
1133	todo_size = size;	1133	todo_size = size;
1134		1134
1135	while (todo_size) {	1135	do {
1136	struct j1939_sk_buff_cb *skcb;	1136	struct j1939_sk_buff_cb *skcb;
1137		1137
1138	segment_size = min_t(size_t, J1939_MAX_TP_PACKET_SIZE,	1138	segment_size = min_t(size_t, J1939_MAX_TP_PACKET_SIZE,
@@ -1177,7 +1177,7 @@ static int j1939_sk_send_loop(struct j1939_priv priv, struct sock sk, · 38 unmodified lines
1177		1177
1178	todo_size -= segment_size;	1178	todo_size -= segment_size;
1179	session->total_queued_size += segment_size;	1179	session->total_queued_size += segment_size;
1180	}	1180	} while (todo_size);
1181		1181
1182	switch (ret) {	1182	switch (ret) {
1183	case 0: /* OK */	1183	case 0: /* OK */

net/can/j1939/transport.c+3−2

 	skb_queue_walk(&session->skb_queue, do_skb) {
 		do_skcb = j1939_skb_to_cb(do_skb);
-		if (offset_start >= do_skcb->offset &&
+		if ((offset_start >= do_skcb->offset &&
-		    offset_start < (do_skcb->offset + do_skb->len)) {
+		     offset_start < (do_skcb->offset + do_skb->len)) ||
+		     (offset_start == 0 && do_skcb->offset == 0 && do_skb->len == 0)) {
 			skb = do_skb;
 		}
 	}

net/core/fib_rules.c+13−11

 bool fib_rule_matchall(const struct fib_rule *rule)
 {
-	if (rule->iifindex || rule->oifindex || rule->mark || rule->tun_id ||
+	if (READ_ONCE(rule->iifindex) || READ_ONCE(rule->oifindex) ||
-	    rule->flags)
+	    rule->mark || rule->tun_id || rule->flags)
 		return false;
 	if (rule->suppress_ifgroup != -1 || rule->suppress_prefixlen != -1)
 		return false;
 			  struct flowi *fl, int flags,
 			  struct fib_lookup_arg *arg)
 {
-	int ret = 0;
+	int iifindex, oifindex, ret = 0;
-	if (rule->iifindex && (rule->iifindex != fl->flowi_iif))
+	iifindex = READ_ONCE(rule->iifindex);
+	if (iifindex && (iifindex != fl->flowi_iif))
 		goto out;
-	if (rule->oifindex && (rule->oifindex != fl->flowi_oif))
+	oifindex = READ_ONCE(rule->oifindex);
+	if (oifindex && (oifindex != fl->flowi_oif))
 		goto out;
 	if ((rule->mark ^ fl->flowi_mark) & rule->mark_mask)
 	if (rule->iifname[0]) {
 		if (nla_put_string(skb, FRA_IIFNAME, rule->iifname))
 			goto nla_put_failure;
-		if (rule->iifindex == -1)
+		if (READ_ONCE(rule->iifindex) == -1)
 			frh->flags |= FIB_RULE_IIF_DETACHED;
 	}
 	if (rule->oifname[0]) {
 		if (nla_put_string(skb, FRA_OIFNAME, rule->oifname))
 			goto nla_put_failure;
-		if (rule->oifindex == -1)
+		if (READ_ONCE(rule->oifindex) == -1)
 			frh->flags |= FIB_RULE_OIF_DETACHED;
 	}
 	list_for_each_entry(rule, rules, list) {
 		if (rule->iifindex == -1 &&
 		    strcmp(dev->name, rule->iifname) == 0)
-			rule->iifindex = dev->ifindex;
+			WRITE_ONCE(rule->iifindex, dev->ifindex);
 		if (rule->oifindex == -1 &&
 		    strcmp(dev->name, rule->oifname) == 0)
-			rule->oifindex = dev->ifindex;
+			WRITE_ONCE(rule->oifindex, dev->ifindex);
 	}
 }
 	list_for_each_entry(rule, rules, list) {
 		if (rule->iifindex == dev->ifindex)
-			rule->iifindex = -1;
+			WRITE_ONCE(rule->iifindex, -1);
 		if (rule->oifindex == dev->ifindex)
-			rule->oifindex = -1;
+			WRITE_ONCE(rule->oifindex, -1);
 	}
 }

net/core/flow_dissector.c+11−10

 					      FLOW_DISSECTOR_KEY_BASIC,
 					      target_container);
+	rcu_read_lock();
 	if (skb) {
 		if (!net) {
 			if (skb->dev)
-				net = dev_net(skb->dev);
+				net = dev_net_rcu(skb->dev);
 			else if (skb->sk)
 				net = sock_net(skb->sk);
 		}
 		enum netns_bpf_attach_type type = NETNS_BPF_FLOW_DISSECTOR;
 		struct bpf_prog_array *run_array;
-		rcu_read_lock();
 		run_array = rcu_dereference(init_net.bpf.run_array[type]);
 		if (!run_array)
 			run_array = rcu_dereference(net->bpf.run_array[type]);
 			prog = READ_ONCE(run_array->items[0].prog);
 			result = bpf_flow_dissect(prog, &ctx, n_proto, nhoff,
 						  hlen, flags);
-			if (result == BPF_FLOW_DISSECTOR_CONTINUE)
+			if (result != BPF_FLOW_DISSECTOR_CONTINUE) {
-				goto dissect_continue;
+				__skb_flow_bpf_to_target(&flow_keys, flow_dissector,
-			__skb_flow_bpf_to_target(&flow_keys, flow_dissector,
+							 target_container);
-						 target_container);
+				rcu_read_unlock();
-			rcu_read_unlock();
+				return result == BPF_OK;
-			return result == BPF_OK;
+			}
 		}
-dissect_continue:
-		rcu_read_unlock();
 	}
+	rcu_read_unlock();
 	if (dissector_uses_key(flow_dissector,
 			       FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
 		struct ethhdr *eth = eth_hdr(skb);

net/core/neighbour.c+6−2

 static void __neigh_notify(struct neighbour *n, int type, int flags,
 			   u32 pid)
 {
-	struct net *net = dev_net(n->dev);
 	struct sk_buff *skb;
 	int err = -ENOBUFS;
+	struct net *net;
+	rcu_read_lock();
+	net = dev_net_rcu(n->dev);
 	skb = nlmsg_new(neigh_nlmsg_size(), GFP_ATOMIC);
 	if (skb == NULL)
 		goto errout;
 		goto errout;
 	}
 	rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
-	return;
+	goto out;
 errout:
 	rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
+out:
+	rcu_read_unlock();
 }
 void neigh_app_ns(struct neighbour *n)

net/core/rtnetlink.c+1−0

@@ -3432,6 +3432,7 @@ static int rtnl_setlink(struct sk_buff skb, struct nlmsghdr nlh, · 3431 unmodified lines
3432	err = -ENODEV;	3432	err = -ENODEV;
3433		3433
3434	rtnl_nets_unlock(&rtnl_nets);	3434	rtnl_nets_unlock(&rtnl_nets);
		3435	rtnl_nets_destroy(&rtnl_nets);
3435	errout:	3436	errout:
3436	return err;	3437	return err;
3437	}	3438	}

net/ethtool/common.c+5−0

 };
 static_assert(ARRAY_SIZE(ts_rx_filter_names) == __HWTSTAMP_FILTER_CNT);
+const char ts_flags_names[][ETH_GSTRING_LEN] = {
+	[const_ilog2(HWTSTAMP_FLAG_BONDED_PHC_INDEX)] = "bonded-phc-index",
+};
+static_assert(ARRAY_SIZE(ts_flags_names) == __HWTSTAMP_FLAG_CNT);
 const char udp_tunnel_type_names[][ETH_GSTRING_LEN] = {
 	[ETHTOOL_UDP_TUNNEL_TYPE_VXLAN]		= "vxlan",
 	[ETHTOOL_UDP_TUNNEL_TYPE_GENEVE]	= "geneve",

net/ethtool/common.h+2−0

 	ETHTOOL_LINK_MODE_ ## speed ## base ## type ## _ ## duplex ## _BIT
 #define __SOF_TIMESTAMPING_CNT (const_ilog2(SOF_TIMESTAMPING_LAST) + 1)
+#define __HWTSTAMP_FLAG_CNT (const_ilog2(HWTSTAMP_FLAG_LAST) + 1)
 struct link_mode_info {
 	int				speed;
 extern const char sof_timestamping_names[][ETH_GSTRING_LEN];
 extern const char ts_tx_type_names[][ETH_GSTRING_LEN];
 extern const char ts_rx_filter_names[][ETH_GSTRING_LEN];
+extern const char ts_flags_names[][ETH_GSTRING_LEN];
 extern const char udp_tunnel_type_names[][ETH_GSTRING_LEN];
 int __ethtool_get_link(struct net_device *dev);

net/ethtool/strset.c+5−0

 		.count		= __HWTSTAMP_FILTER_CNT,
 		.strings	= ts_rx_filter_names,
 	},
+	[ETH_SS_TS_FLAGS] = {
+		.per_dev	= false,
+		.count		= __HWTSTAMP_FLAG_CNT,
+		.strings	= ts_flags_names,
+	},
 	[ETH_SS_UDP_TUNNEL_TYPES] = {
 		.per_dev	= false,
 		.count		= __ETHTOOL_UDP_TUNNEL_TYPE_CNT,

net/ethtool/tsconfig.c+23−10

 	data->hwtst_config.tx_type = BIT(cfg.tx_type);
 	data->hwtst_config.rx_filter = BIT(cfg.rx_filter);
-	data->hwtst_config.flags = BIT(cfg.flags);
+	data->hwtst_config.flags = cfg.flags;
 	data->hwprov_desc.index = -1;
 	hwprov = rtnl_dereference(dev->hwprov);
 	BUILD_BUG_ON(__HWTSTAMP_TX_CNT > 32);
 	BUILD_BUG_ON(__HWTSTAMP_FILTER_CNT > 32);
+	BUILD_BUG_ON(__HWTSTAMP_FLAG_CNT > 32);
-	if (data->hwtst_config.flags)
+	if (data->hwtst_config.flags) {
-		/* _TSCONFIG_HWTSTAMP_FLAGS */
+		ret = ethnl_bitset32_size(&data->hwtst_config.flags,
-		len += nla_total_size(sizeof(u32));
+					  NULL, __HWTSTAMP_FLAG_CNT,
+					  ts_flags_names, compact);
+		if (ret < 0)
+			return ret;
+		len += ret;	/* _TSCONFIG_HWTSTAMP_FLAGS */
+	}
 	if (data->hwtst_config.tx_type) {
 		ret = ethnl_bitset32_size(&data->hwtst_config.tx_type,
 	int ret;
 	if (data->hwtst_config.flags) {
-		ret = nla_put_u32(skb, ETHTOOL_A_TSCONFIG_HWTSTAMP_FLAGS,
+		ret = ethnl_put_bitset32(skb, ETHTOOL_A_TSCONFIG_HWTSTAMP_FLAGS,
-				  data->hwtst_config.flags);
+					 &data->hwtst_config.flags, NULL,
+					 __HWTSTAMP_FLAG_CNT,
+					 ts_flags_names, compact);
 		if (ret < 0)
 			return ret;
 	}
 	[ETHTOOL_A_TSCONFIG_HEADER] = NLA_POLICY_NESTED(ethnl_header_policy),
 	[ETHTOOL_A_TSCONFIG_HWTSTAMP_PROVIDER] =
 		NLA_POLICY_NESTED(ethnl_ts_hwtst_prov_policy),
-	[ETHTOOL_A_TSCONFIG_HWTSTAMP_FLAGS] = { .type = NLA_U32 },
+	[ETHTOOL_A_TSCONFIG_HWTSTAMP_FLAGS] = { .type = NLA_NESTED },
 	[ETHTOOL_A_TSCONFIG_RX_FILTERS] = { .type = NLA_NESTED },
 	[ETHTOOL_A_TSCONFIG_TX_TYPES] = { .type = NLA_NESTED },
 };
 	BUILD_BUG_ON(__HWTSTAMP_TX_CNT >= 32);
 	BUILD_BUG_ON(__HWTSTAMP_FILTER_CNT >= 32);
+	BUILD_BUG_ON(__HWTSTAMP_FLAG_CNT > 32);
 	if (!netif_device_present(dev))
 		return -ENODEV;
 	}
 	if (tb[ETHTOOL_A_TSCONFIG_HWTSTAMP_FLAGS]) {
-		ethnl_update_u32(&hwtst_config.flags,
+		ret = ethnl_update_bitset32(&hwtst_config.flags,
-				 tb[ETHTOOL_A_TSCONFIG_HWTSTAMP_FLAGS],
+					    __HWTSTAMP_FLAG_CNT,
-				 &config_mod);
+					    tb[ETHTOOL_A_TSCONFIG_HWTSTAMP_FLAGS],
+					    ts_flags_names, info->extack,
+					    &config_mod);
+		if (ret < 0)
+			goto err_free_hwprov;
 	}
 	ret = net_hwtstamp_validate(&hwtst_config);

net/ipv4/arp.c+3−1

  */
 void arp_xmit(struct sk_buff *skb)
 {
+	rcu_read_lock();
 	/* Send it off, maybe filter it using firewalling first.  */
 	NF_HOOK(NFPROTO_ARP, NF_ARP_OUT,
-		dev_net(skb->dev), NULL, skb, NULL, skb->dev,
+		dev_net_rcu(skb->dev), NULL, skb, NULL, skb->dev,
 		arp_xmit_finish);
+	rcu_read_unlock();
 }
 EXPORT_SYMBOL(arp_xmit);

net/ipv4/devinet.c+2−1

 	__be32 addr = 0;
 	unsigned char localnet_scope = RT_SCOPE_HOST;
 	struct in_device *in_dev;
-	struct net *net = dev_net(dev);
+	struct net *net;
 	int master_idx;
 	rcu_read_lock();
+	net = dev_net_rcu(dev);
 	in_dev = __in_dev_get_rcu(dev);
 	if (!in_dev)
 		goto no_in_dev;

net/ipv4/icmp.c+17−14

 static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
 {
-	struct ipcm_cookie ipc;
 	struct rtable *rt = skb_rtable(skb);
-	struct net *net = dev_net(rt->dst.dev);
+	struct net *net = dev_net_rcu(rt->dst.dev);
 	bool apply_ratelimit = false;
+	struct ipcm_cookie ipc;
 	struct flowi4 fl4;
 	struct sock *sk;
 	struct inet_sock *inet;
 	struct sock *sk;
 	if (!rt)
-		goto out;
+		return;
+	rcu_read_lock();
 	if (rt->dst.dev)
-		net = dev_net(rt->dst.dev);
+		net = dev_net_rcu(rt->dst.dev);
 	else if (skb_in->dev)
-		net = dev_net(skb_in->dev);
+		net = dev_net_rcu(skb_in->dev);
 	else
 		goto out;
 	icmp_xmit_unlock(sk);
 out_bh_enable:
 	local_bh_enable();
-out:;
+out:
+	rcu_read_unlock();
 }
 EXPORT_SYMBOL(__icmp_send);
 	 * avoid additional coding at protocol handlers.
 	 */
 	if (!pskb_may_pull(skb, iph->ihl * 4 + 8)) {
-		__ICMP_INC_STATS(dev_net(skb->dev), ICMP_MIB_INERRORS);
+		__ICMP_INC_STATS(dev_net_rcu(skb->dev), ICMP_MIB_INERRORS);
 		return;
 	}
 	struct net *net;
 	u32 info = 0;
-	net = dev_net(skb_dst(skb)->dev);
+	net = dev_net_rcu(skb_dst(skb)->dev);
 	/*
 	 *	Incomplete header ?
 static enum skb_drop_reason icmp_redirect(struct sk_buff *skb)
 {
 	if (skb->len < sizeof(struct iphdr)) {
-		__ICMP_INC_STATS(dev_net(skb->dev), ICMP_MIB_INERRORS);
+		__ICMP_INC_STATS(dev_net_rcu(skb->dev), ICMP_MIB_INERRORS);
 		return SKB_DROP_REASON_PKT_TOO_SMALL;
 	}
 	struct icmp_bxm icmp_param;
 	struct net *net;
-	net = dev_net(skb_dst(skb)->dev);
+	net = dev_net_rcu(skb_dst(skb)->dev);
 	/* should there be an ICMP stat for ignored echos? */
 	if (READ_ONCE(net->ipv4.sysctl_icmp_echo_ignore_all))
 		return SKB_NOT_DROPPED_YET;
 bool icmp_build_probe(struct sk_buff *skb, struct icmphdr *icmphdr)
 {
+	struct net *net = dev_net_rcu(skb->dev);
 	struct icmp_ext_hdr *ext_hdr, _ext_hdr;
 	struct icmp_ext_echo_iio *iio, _iio;
-	struct net *net = dev_net(skb->dev);
 	struct inet6_dev *in6_dev;
 	struct in_device *in_dev;
 	struct net_device *dev;
 	return SKB_NOT_DROPPED_YET;
 out_err:
-	__ICMP_INC_STATS(dev_net(skb_dst(skb)->dev), ICMP_MIB_INERRORS);
+	__ICMP_INC_STATS(dev_net_rcu(skb_dst(skb)->dev), ICMP_MIB_INERRORS);
 	return SKB_DROP_REASON_PKT_TOO_SMALL;
 }
 {
 	enum skb_drop_reason reason = SKB_DROP_REASON_NOT_SPECIFIED;
 	struct rtable *rt = skb_rtable(skb);
-	struct net *net = dev_net(rt->dst.dev);
+	struct net *net = dev_net_rcu(rt->dst.dev);
 	struct icmphdr *icmph;
 	if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
 	struct iphdr *iph = (struct iphdr *)skb->data;
 	int offset = iph->ihl<<2;
 	struct icmphdr *icmph = (struct icmphdr *)(skb->data + offset);
+	struct net *net = dev_net_rcu(skb->dev);
 	int type = icmp_hdr(skb)->type;
 	int code = icmp_hdr(skb)->code;
-	struct net *net = dev_net(skb->dev);
 	/*
 	 * Use ping_err to handle all icmp errors except those

net/ipv4/route.c+21−9

 static inline bool rt_is_expired(const struct rtable *rth)
 {
-	return rth->rt_genid != rt_genid_ipv4(dev_net(rth->dst.dev));
+	bool res;
+	rcu_read_lock();
+	res = rth->rt_genid != rt_genid_ipv4(dev_net_rcu(rth->dst.dev));
+	rcu_read_unlock();
+	return res;
 }
 void rt_cache_flush(struct net *net)
 static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
 {
 	struct dst_entry *dst = &rt->dst;
-	struct net *net = dev_net(dst->dev);
 	struct fib_result res;
 	bool lock = false;
+	struct net *net;
 	u32 old_mtu;
 	if (ip_mtu_locked(dst))
 	if (old_mtu < mtu)
 		return;
+	rcu_read_lock();
+	net = dev_net_rcu(dst->dev);
 	if (mtu < net->ipv4.ip_rt_min_pmtu) {
 		lock = true;
 		mtu = min(old_mtu, net->ipv4.ip_rt_min_pmtu);
 	if (rt->rt_pmtu == mtu && !lock &&
 	    time_before(jiffies, dst->expires - net->ipv4.ip_rt_mtu_expires / 2))
-		return;
+		goto out;
-	rcu_read_lock();
 	if (fib_lookup(net, fl4, &res, 0) == 0) {
 		struct fib_nh_common *nhc;
 				update_or_create_fnhe(nhc, fl4->daddr, 0, mtu, lock,
 						      jiffies + net->ipv4.ip_rt_mtu_expires);
 			}
-			rcu_read_unlock();
+			goto out;
-			return;
 		}
 #endif /* CONFIG_IP_ROUTE_MULTIPATH */
 		nhc = FIB_RES_NHC(res);
 		update_or_create_fnhe(nhc, fl4->daddr, 0, mtu, lock,
 				      jiffies + net->ipv4.ip_rt_mtu_expires);
 	}
+out:
 	rcu_read_unlock();
 }
 static unsigned int ipv4_default_advmss(const struct dst_entry *dst)
 {
-	struct net *net = dev_net(dst->dev);
 	unsigned int header_size = sizeof(struct tcphdr) + sizeof(struct iphdr);
-	unsigned int advmss = max_t(unsigned int, ipv4_mtu(dst) - header_size,
+	unsigned int advmss;
-				    net->ipv4.ip_rt_min_advmss);
+	struct net *net;
+	rcu_read_lock();
+	net = dev_net_rcu(dst->dev);
+	advmss = max_t(unsigned int, ipv4_mtu(dst) - header_size,
+				   net->ipv4.ip_rt_min_advmss);
+	rcu_read_unlock();
 	return min(advmss, IPV4_MAX_PMTU - header_size);
 }

net/ipv6/icmp.c+23−19

@@ -76,7 +76,7 @@ static int icmpv6_err(struct sk_buff skb, struct inet6_skb_parm opt, · 75 unmodified lines
76	{	76	{
77	/* icmpv6_notify checks 8 bytes can be pulled, icmp6hdr is 8 bytes */	77	/* icmpv6_notify checks 8 bytes can be pulled, icmp6hdr is 8 bytes */
78	struct icmp6hdr icmp6 = (struct icmp6hdr ) (skb->data + offset);	78	struct icmp6hdr icmp6 = (struct icmp6hdr ) (skb->data + offset);
79	struct net *net = dev_net(skb->dev);	79	struct net *net = dev_net_rcu(skb->dev);
80		80
81	if (type == ICMPV6_PKT_TOOBIG)	81	if (type == ICMPV6_PKT_TOOBIG)
82	ip6_update_pmtu(skb, net, info, skb->dev->ifindex, 0, sock_net_uid(net, NULL));	82	ip6_update_pmtu(skb, net, info, skb->dev->ifindex, 0, sock_net_uid(net, NULL));
@@ -473,7 +473,10 @@ void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info, · 390 unmodified lines
473		473
474	if (!skb->dev)	474	if (!skb->dev)
475	return;	475	return;
476	net = dev_net(skb->dev);	476
		477	rcu_read_lock();
		478
		479	net = dev_net_rcu(skb->dev);
477	mark = IP6_REPLY_MARK(net, skb->mark);	480	mark = IP6_REPLY_MARK(net, skb->mark);
478	/*	481	/*
479	* Make sure we respect the rules	482	* Make sure we respect the rules
@@ -496,7 +499,7 @@ void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info, · 16 unmodified lines
496	!(type == ICMPV6_PARAMPROB &&	499	!(type == ICMPV6_PARAMPROB &&
497	code == ICMPV6_UNK_OPTION &&	500	code == ICMPV6_UNK_OPTION &&
498	(opt_unrec(skb, info))))	501	(opt_unrec(skb, info))))
499	return;	502	goto out;
500		503
501	saddr = NULL;	504	saddr = NULL;
502	}	505	}
@@ -526,7 +529,7 @@ void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info, · 23 unmodified lines
526	if ((addr_type == IPV6_ADDR_ANY) \|\| (addr_type & IPV6_ADDR_MULTICAST)) {	529	if ((addr_type == IPV6_ADDR_ANY) \|\| (addr_type & IPV6_ADDR_MULTICAST)) {
527	net_dbg_ratelimited("icmp6_send: addr_any/mcast source [%pI6c > %pI6c]\n",	530	net_dbg_ratelimited("icmp6_send: addr_any/mcast source [%pI6c > %pI6c]\n",
528	&hdr->saddr, &hdr->daddr);	531	&hdr->saddr, &hdr->daddr);
529	return;	532	goto out;
530	}	533	}
531		534
532	/*	535	/*
@@ -535,7 +538,7 @@ void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info, · 2 unmodified lines
535	if (is_ineligible(skb)) {	538	if (is_ineligible(skb)) {
536	net_dbg_ratelimited("icmp6_send: no reply to icmp error [%pI6c > %pI6c]\n",	539	net_dbg_ratelimited("icmp6_send: no reply to icmp error [%pI6c > %pI6c]\n",
537	&hdr->saddr, &hdr->daddr);	540	&hdr->saddr, &hdr->daddr);
538	return;	541	goto out;
539	}	542	}
540		543
541	/* Needed by both icmpv6_global_allow and icmpv6_xmit_lock */	544	/* Needed by both icmpv6_global_allow and icmpv6_xmit_lock */
@@ -582,7 +585,7 @@ void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info, · 40 unmodified lines
582	np = inet6_sk(sk);	585	np = inet6_sk(sk);
583		586
584	if (!icmpv6_xrlim_allow(sk, type, &fl6, apply_ratelimit))	587	if (!icmpv6_xrlim_allow(sk, type, &fl6, apply_ratelimit))
585	goto out;	588	goto out_unlock;
586		589
587	tmp_hdr.icmp6_type = type;	590	tmp_hdr.icmp6_type = type;
588	tmp_hdr.icmp6_code = code;	591	tmp_hdr.icmp6_code = code;
@@ -600,7 +603,7 @@ void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info, · 11 unmodified lines
600		603
601	dst = icmpv6_route_lookup(net, skb, sk, &fl6);	604	dst = icmpv6_route_lookup(net, skb, sk, &fl6);
602	if (IS_ERR(dst))	605	if (IS_ERR(dst))
603	goto out;	606	goto out_unlock;
604		607
605	ipc6.hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);	608	ipc6.hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);
606		609
@@ -616,7 +619,6 @@ void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info, · 9 unmodified lines
616	goto out_dst_release;	619	goto out_dst_release;
617	}	620	}
618		621
619	rcu_read_lock();
620	idev = __in6_dev_get(skb->dev);	622	idev = __in6_dev_get(skb->dev);
621		623
622	if (ip6_append_data(sk, icmpv6_getfrag, &msg,	624	if (ip6_append_data(sk, icmpv6_getfrag, &msg,
@@ -630,13 +632,15 @@ void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info, · 7 unmodified lines
630	icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,	632	icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
631	len + sizeof(struct icmp6hdr));	633	len + sizeof(struct icmp6hdr));
632	}	634	}
633	rcu_read_unlock();	635
634	out_dst_release:	636	out_dst_release:
635	dst_release(dst);	637	dst_release(dst);
636	out:	638	out_unlock:
637	icmpv6_xmit_unlock(sk);	639	icmpv6_xmit_unlock(sk);
638	out_bh_enable:	640	out_bh_enable:
639	local_bh_enable();	641	local_bh_enable();
		642	out:
		643	rcu_read_unlock();
640	}	644	}
641	EXPORT_SYMBOL(icmp6_send);	645	EXPORT_SYMBOL(icmp6_send);
642		646
@@ -679,8 +683,8 @@ int ip6_err_gen_icmpv6_unreach(struct sk_buff *skb, int nhs, int type, · 36 unmodified lines
679	skb_pull(skb2, nhs);	683	skb_pull(skb2, nhs);
680	skb_reset_network_header(skb2);	684	skb_reset_network_header(skb2);
681		685
682	rt = rt6_lookup(dev_net(skb->dev), &ipv6_hdr(skb2)->saddr, NULL, 0,	686	rt = rt6_lookup(dev_net_rcu(skb->dev), &ipv6_hdr(skb2)->saddr,
683	skb, 0);	687	NULL, 0, skb, 0);
684		688
685	if (rt && rt->dst.dev)	689	if (rt && rt->dst.dev)
686	skb2->dev = rt->dst.dev;	690	skb2->dev = rt->dst.dev;
@@ -717,7 +721,7 @@ EXPORT_SYMBOL(ip6_err_gen_icmpv6_unreach); · 30 unmodified lines
717		721
718	static enum skb_drop_reason icmpv6_echo_reply(struct sk_buff *skb)	722	static enum skb_drop_reason icmpv6_echo_reply(struct sk_buff *skb)
719	{	723	{
720	struct net *net = dev_net(skb->dev);	724	struct net *net = dev_net_rcu(skb->dev);
721	struct sock *sk;	725	struct sock *sk;
722	struct inet6_dev *idev;	726	struct inet6_dev *idev;
723	struct ipv6_pinfo *np;	727	struct ipv6_pinfo *np;
@@ -832,7 +836,7 @@ enum skb_drop_reason icmpv6_notify(struct sk_buff *skb, u8 type, · 108 unmodified lines
832	u8 code, __be32 info)	836	u8 code, __be32 info)
833	{	837	{
834	struct inet6_skb_parm *opt = IP6CB(skb);	838	struct inet6_skb_parm *opt = IP6CB(skb);
835	struct net *net = dev_net(skb->dev);	839	struct net *net = dev_net_rcu(skb->dev);
836	const struct inet6_protocol *ipprot;	840	const struct inet6_protocol *ipprot;
837	enum skb_drop_reason reason;	841	enum skb_drop_reason reason;
838	int inner_offset;	842	int inner_offset;
@@ -889,7 +893,7 @@ out: · 50 unmodified lines
889	static int icmpv6_rcv(struct sk_buff *skb)	893	static int icmpv6_rcv(struct sk_buff *skb)
890	{	894	{
891	enum skb_drop_reason reason = SKB_DROP_REASON_NOT_SPECIFIED;	895	enum skb_drop_reason reason = SKB_DROP_REASON_NOT_SPECIFIED;
892	struct net *net = dev_net(skb->dev);	896	struct net *net = dev_net_rcu(skb->dev);
893	struct net_device *dev = icmp6_dev(skb);	897	struct net_device *dev = icmp6_dev(skb);
894	struct inet6_dev *idev = __in6_dev_get(dev);	898	struct inet6_dev *idev = __in6_dev_get(dev);
895	const struct in6_addr saddr, daddr;	899	const struct in6_addr saddr, daddr;
@@ -921,7 +925,7 @@ static int icmpv6_rcv(struct sk_buff *skb) · 25 unmodified lines
921	skb_set_network_header(skb, nh);	925	skb_set_network_header(skb, nh);
922	}	926	}
923		927
924	__ICMP6_INC_STATS(dev_net(dev), idev, ICMP6_MIB_INMSGS);	928	__ICMP6_INC_STATS(dev_net_rcu(dev), idev, ICMP6_MIB_INMSGS);
925		929
926	saddr = &ipv6_hdr(skb)->saddr;	930	saddr = &ipv6_hdr(skb)->saddr;
927	daddr = &ipv6_hdr(skb)->daddr;	931	daddr = &ipv6_hdr(skb)->daddr;
@@ -939,7 +943,7 @@ static int icmpv6_rcv(struct sk_buff *skb) · 11 unmodified lines
939		943
940	type = hdr->icmp6_type;	944	type = hdr->icmp6_type;
941		945
942	ICMP6MSGIN_INC_STATS(dev_net(dev), idev, type);	946	ICMP6MSGIN_INC_STATS(dev_net_rcu(dev), idev, type);
943		947
944	switch (type) {	948	switch (type) {
945	case ICMPV6_ECHO_REQUEST:	949	case ICMPV6_ECHO_REQUEST:
@@ -1034,9 +1038,9 @@ static int icmpv6_rcv(struct sk_buff *skb) · 88 unmodified lines
1034		1038
1035	csum_error:	1039	csum_error:
1036	reason = SKB_DROP_REASON_ICMP_CSUM;	1040	reason = SKB_DROP_REASON_ICMP_CSUM;
1037	__ICMP6_INC_STATS(dev_net(dev), idev, ICMP6_MIB_CSUMERRORS);	1041	__ICMP6_INC_STATS(dev_net_rcu(dev), idev, ICMP6_MIB_CSUMERRORS);
1038	discard_it:	1042	discard_it:
1039	__ICMP6_INC_STATS(dev_net(dev), idev, ICMP6_MIB_INERRORS);	1043	__ICMP6_INC_STATS(dev_net_rcu(dev), idev, ICMP6_MIB_INERRORS);
1040	drop_no_count:	1044	drop_no_count:
1041	kfree_skb_reason(skb, reason);	1045	kfree_skb_reason(skb, reason);
1042	return 0;	1046	return 0;

net/ipv6/ip6_input.c+9−5

@@ -477,9 +477,7 @@ discard: · 476 unmodified lines
477	static int ip6_input_finish(struct net net, struct sock sk, struct sk_buff *skb)	477	static int ip6_input_finish(struct net net, struct sock sk, struct sk_buff *skb)
478	{	478	{
479	skb_clear_delivery_time(skb);	479	skb_clear_delivery_time(skb);
480	rcu_read_lock();
481	ip6_protocol_deliver_rcu(net, skb, 0, false);	480	ip6_protocol_deliver_rcu(net, skb, 0, false);
482	rcu_read_unlock();
483		481
484	return 0;	482	return 0;
485	}	483	}
@@ -487,9 +485,15 @@ static int ip6_input_finish(struct net net, struct sock sk, struct sk_buff *sk · 1 unmodified line
487		485
488	int ip6_input(struct sk_buff *skb)	486	int ip6_input(struct sk_buff *skb)
489	{	487	{
490	return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_IN,	488	int res;
491	dev_net(skb->dev), NULL, skb, skb->dev, NULL,	489
492	ip6_input_finish);	490	rcu_read_lock();
		491	res = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_IN,
		492	dev_net_rcu(skb->dev), NULL, skb, skb->dev, NULL,
		493	ip6_input_finish);
		494	rcu_read_unlock();
		495
		496	return res;
493	}	497	}
494	EXPORT_SYMBOL_GPL(ip6_input);	498	EXPORT_SYMBOL_GPL(ip6_input);
495		499

net/ipv6/mcast.c+25−20

 	struct net_device *dev = idev->dev;
 	int hlen = LL_RESERVED_SPACE(dev);
 	int tlen = dev->needed_tailroom;
-	struct net *net = dev_net(dev);
 	const struct in6_addr *saddr;
 	struct in6_addr addr_buf;
 	struct mld2_report *pmr;
 	struct sk_buff *skb;
 	unsigned int size;
 	struct sock *sk;
-	int err;
+	struct net *net;
-	sk = net->ipv6.igmp_sk;
 	/* we assume size > sizeof(ra) here
 	 * Also try to not allocate high-order pages for big MTU
 	 */
 	size = min_t(int, mtu, PAGE_SIZE / 2) + hlen + tlen;
-	skb = sock_alloc_send_skb(sk, size, 1, &err);
+	skb = alloc_skb(size, GFP_KERNEL);
 	if (!skb)
 		return NULL;
 	skb_reserve(skb, hlen);
 	skb_tailroom_reserve(skb, mtu, tlen);
+	rcu_read_lock();
+	net = dev_net_rcu(dev);
+	sk = net->ipv6.igmp_sk;
+	skb_set_owner_w(skb, sk);
 	if (ipv6_get_lladdr(dev, &addr_buf, IFA_F_TENTATIVE)) {
 		/* <draft-ietf-magma-mld-source-05.txt>:
 		 * use unspecified address as the source address
 	ip6_mc_hdr(sk, skb, dev, saddr, &mld2_all_mcr, NEXTHDR_HOP, 0);
+	rcu_read_unlock();
 	skb_put_data(skb, ra, sizeof(ra));
 	skb_set_transport_header(skb, skb_tail_pointer(skb) - skb->data);
 static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
 {
-	struct net *net = dev_net(dev);
+	const struct in6_addr *snd_addr, *saddr;
-	struct sock *sk = net->ipv6.igmp_sk;
+	int err, len, payload_len, full_len;
+	struct in6_addr addr_buf;
 	struct inet6_dev *idev;
 	struct sk_buff *skb;
 	struct mld_msg *hdr;
-	const struct in6_addr *snd_addr, *saddr;
-	struct in6_addr addr_buf;
 	int hlen = LL_RESERVED_SPACE(dev);
 	int tlen = dev->needed_tailroom;
-	int err, len, payload_len, full_len;
 	u8 ra[8] = { IPPROTO_ICMPV6, 0,
 		     IPV6_TLV_ROUTERALERT, 2, 0, 0,
 		     IPV6_TLV_PADN, 0 };
-	struct flowi6 fl6;
 	struct dst_entry *dst;
+	struct flowi6 fl6;
+	struct net *net;
+	struct sock *sk;
 	if (type == ICMPV6_MGM_REDUCTION)
 		snd_addr = &in6addr_linklocal_allrouters;
 	payload_len = len + sizeof(ra);
 	full_len = sizeof(struct ipv6hdr) + payload_len;
-	rcu_read_lock();
+	skb = alloc_skb(hlen + tlen + full_len, GFP_KERNEL);
-	IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_OUTREQUESTS);
-	rcu_read_unlock();
-	skb = sock_alloc_send_skb(sk, hlen + tlen + full_len, 1, &err);
+	rcu_read_lock();
+	net = dev_net_rcu(dev);
+	idev = __in6_dev_get(dev);
+	IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTREQUESTS);
 	if (!skb) {
-		rcu_read_lock();
+		IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
-		IP6_INC_STATS(net, __in6_dev_get(dev),
-			      IPSTATS_MIB_OUTDISCARDS);
 		rcu_read_unlock();
 		return;
 	}
+	sk = net->ipv6.igmp_sk;
+	skb_set_owner_w(skb, sk);
 	skb->priority = TC_PRIO_CONTROL;
 	skb_reserve(skb, hlen);
 					 IPPROTO_ICMPV6,
 					 csum_partial(hdr, len, 0));
-	rcu_read_lock();
-	idev = __in6_dev_get(skb->dev);
 	icmpv6_flow_init(sk, &fl6, type,
 			 &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr,
 			 skb->dev->ifindex);

net/ipv6/ndisc.c+13−11

 {
 	int hlen = LL_RESERVED_SPACE(dev);
 	int tlen = dev->needed_tailroom;
-	struct sock *sk = dev_net(dev)->ipv6.ndisc_sk;
 	struct sk_buff *skb;
 	skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC);
-	if (!skb) {
+	if (!skb)
-		ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n",
-			  __func__);
 		return NULL;
-	}
 	skb->protocol = htons(ETH_P_IPV6);
 	skb->dev = dev;
 	/* Manually assign socket ownership as we avoid calling
 	 * sock_alloc_send_pskb() to bypass wmem buffer limits
 	 */
-	skb_set_owner_w(skb, sk);
+	rcu_read_lock();
+	skb_set_owner_w(skb, dev_net_rcu(dev)->ipv6.ndisc_sk);
+	rcu_read_unlock();
 	return skb;
 }
 void ndisc_send_skb(struct sk_buff *skb, const struct in6_addr *daddr,
 		    const struct in6_addr *saddr)
 {
+	struct icmp6hdr *icmp6h = icmp6_hdr(skb);
 	struct dst_entry *dst = skb_dst(skb);
-	struct net *net = dev_net(skb->dev);
-	struct sock *sk = net->ipv6.ndisc_sk;
 	struct inet6_dev *idev;
+	struct net *net;
+	struct sock *sk;
 	int err;
-	struct icmp6hdr *icmp6h = icmp6_hdr(skb);
 	u8 type;
 	type = icmp6h->icmp6_type;
+	rcu_read_lock();
+	net = dev_net_rcu(skb->dev);
+	sk = net->ipv6.ndisc_sk;
 	if (!dst) {
 		struct flowi6 fl6;
 		int oif = skb->dev->ifindex;
 		icmpv6_flow_init(sk, &fl6, type, saddr, daddr, oif);
 		dst = icmp6_dst_alloc(skb->dev, &fl6);
 		if (IS_ERR(dst)) {
+			rcu_read_unlock();
 			kfree_skb(skb);
 			return;
 		}
 	ip6_nd_hdr(skb, saddr, daddr, READ_ONCE(inet6_sk(sk)->hop_limit), skb->len);
-	rcu_read_lock();
 	idev = __in6_dev_get(dst->dev);
 	IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTREQUESTS);
 	bool ret;
 	if (netif_is_l3_master(skb->dev)) {
-		dev = __dev_get_by_index(dev_net(skb->dev), IPCB(skb)->iif);
+		dev = dev_get_by_index_rcu(dev_net(skb->dev), IPCB(skb)->iif);
 		if (!dev)
 			return;
 	}

net/ipv6/route.c+6−1

 {
 	struct net_device *dev = dst->dev;
 	unsigned int mtu = dst_mtu(dst);
-	struct net *net = dev_net(dev);
+	struct net *net;
 	mtu -= sizeof(struct ipv6hdr) + sizeof(struct tcphdr);
+	rcu_read_lock();
+	net = dev_net_rcu(dev);
 	if (mtu < net->ipv6.sysctl.ip6_rt_min_advmss)
 		mtu = net->ipv6.sysctl.ip6_rt_min_advmss;
+	rcu_read_unlock();
 	/*
 	 * Maximal non-jumbo IPv6 payload is IPV6_MAXPLEN and
 	 * corresponding MSS is IPV6_MAXPLEN - tcp_header_size.

net/netfilter/nf_flow_table_ip.c+2−6

 	flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
 	mtu = flow->tuplehash[dir].tuple.mtu + ctx->offset;
-	if (unlikely(nf_flow_exceeds_mtu(skb, mtu))) {
+	if (unlikely(nf_flow_exceeds_mtu(skb, mtu)))
-		flow_offload_teardown(flow);
 		return 0;
-	}
 	iph = (struct iphdr *)(skb_network_header(skb) + ctx->offset);
 	thoff = (iph->ihl * 4) + ctx->offset;
 	flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
 	mtu = flow->tuplehash[dir].tuple.mtu + ctx->offset;
-	if (unlikely(nf_flow_exceeds_mtu(skb, mtu))) {
+	if (unlikely(nf_flow_exceeds_mtu(skb, mtu)))
-		flow_offload_teardown(flow);
 		return 0;
-	}
 	ip6h = (struct ipv6hdr *)(skb_network_header(skb) + ctx->offset);
 	thoff = sizeof(*ip6h) + ctx->offset;

net/openvswitch/datapath.c+9−3

 {
 	struct ovs_header *ovs_header;
 	struct ovs_vport_stats vport_stats;
+	struct net *net_vport;
 	int err;
 	ovs_header = genlmsg_put(skb, portid, seq, &dp_vport_genl_family,
 	    nla_put_u32(skb, OVS_VPORT_ATTR_IFINDEX, vport->dev->ifindex))
 		goto nla_put_failure;
-	if (!net_eq(net, dev_net(vport->dev))) {
+	rcu_read_lock();
-		int id = peernet2id_alloc(net, dev_net(vport->dev), gfp);
+	net_vport = dev_net_rcu(vport->dev);
+	if (!net_eq(net, net_vport)) {
+		int id = peernet2id_alloc(net, net_vport, GFP_ATOMIC);
 		if (nla_put_s32(skb, OVS_VPORT_ATTR_NETNSID, id))
-			goto nla_put_failure;
+			goto nla_put_failure_unlock;
 	}
+	rcu_read_unlock();
 	ovs_vport_get_stats(vport, &vport_stats);
 	if (nla_put_64bit(skb, OVS_VPORT_ATTR_STATS,
 	genlmsg_end(skb, ovs_header);
 	return 0;
+nla_put_failure_unlock:
+	rcu_read_unlock();
 nla_put_failure:
 	err = -EMSGSIZE;
 error:

net/rxrpc/ar-internal.h+3−4

 	 * packet with a maximum set of jumbo subpackets or a PING ACK padded
 	 * out to 64K with zeropages for PMTUD.
 	 */
-	struct kvec		kvec[RXRPC_MAX_NR_JUMBO > 3 + 16 ?
+	struct kvec		kvec[1 + RXRPC_MAX_NR_JUMBO > 3 + 16 ?
-				     RXRPC_MAX_NR_JUMBO : 3 + 16];
+				     1 + RXRPC_MAX_NR_JUMBO : 3 + 16];
 };
 /*
 #define RXRPC_TXBUF_RESENT	0x100		/* Set if has been resent */
 	__be16			cksum;		/* Checksum to go in header */
 	bool			jumboable;	/* Can be non-terminal jumbo subpacket */
-	u8			nr_kvec;	/* Amount of kvec[] used */
+	void			*data;		/* Data with preceding jumbo header */
-	struct kvec		kvec[1];
 };
 static inline bool rxrpc_sending_to_server(const struct rxrpc_txbuf *txb)

net/rxrpc/output.c+35−15

 static size_t rxrpc_prepare_data_subpacket(struct rxrpc_call *call,
 					   struct rxrpc_send_data_req *req,
 					   struct rxrpc_txbuf *txb,
+					   struct rxrpc_wire_header *whdr,
 					   rxrpc_serial_t serial, int subpkt)
 {
-	struct rxrpc_wire_header *whdr = txb->kvec[0].iov_base;
+	struct rxrpc_jumbo_header *jumbo = txb->data - sizeof(*jumbo);
-	struct rxrpc_jumbo_header *jumbo = (void *)(whdr + 1) - sizeof(*jumbo);
 	enum rxrpc_req_ack_trace why;
 	struct rxrpc_connection *conn = call->conn;
-	struct kvec *kv = &call->local->kvec[subpkt];
+	struct kvec *kv = &call->local->kvec[1 + subpkt];
 	size_t len = txb->pkt_len;
 	bool last;
 	u8 flags;
 	}
 dont_set_request_ack:
-	/* The jumbo header overlays the wire header in the txbuf. */
+	/* There's a jumbo header prepended to the data if we need it. */
 	if (subpkt < req->n - 1)
 		flags |= RXRPC_JUMBO_PACKET;
 	else
 		flags &= ~RXRPC_JUMBO_PACKET;
 	if (subpkt == 0) {
 		whdr->flags	= flags;
-		whdr->serial	= htonl(txb->serial);
 		whdr->cksum	= txb->cksum;
-		whdr->serviceId	= htons(conn->service_id);
+		kv->iov_base	= txb->data;
-		kv->iov_base	= whdr;
-		len += sizeof(*whdr);
 	} else {
 		jumbo->flags	= flags;
 		jumbo->pad	= 0;
 /*
  * Prepare a (jumbo) packet for transmission.
  */
-static size_t rxrpc_prepare_data_packet(struct rxrpc_call *call, struct rxrpc_send_data_req *req)
+static size_t rxrpc_prepare_data_packet(struct rxrpc_call *call,
+					struct rxrpc_send_data_req *req,
+					struct rxrpc_wire_header *whdr)
 {
 	struct rxrpc_txqueue *tq = req->tq;
 	rxrpc_serial_t serial;
 	/* Each transmission of a Tx packet needs a new serial number */
 	serial = rxrpc_get_next_serials(call->conn, req->n);
+	whdr->epoch		= htonl(call->conn->proto.epoch);
+	whdr->cid		= htonl(call->cid);
+	whdr->callNumber	= htonl(call->call_id);
+	whdr->seq		= htonl(seq);
+	whdr->serial		= htonl(serial);
+	whdr->type		= RXRPC_PACKET_TYPE_DATA;
+	whdr->flags		= 0;
+	whdr->userStatus	= 0;
+	whdr->securityIndex	= call->security_ix;
+	whdr->_rsvd		= 0;
+	whdr->serviceId		= htons(call->conn->service_id);
 	call->tx_last_serial = serial + req->n - 1;
 	call->tx_last_sent = req->now;
 	xmit_ts = rxrpc_prepare_txqueue(tq, req);
 		if (i + 1 == req->n)
 			/* Only sample the last subpacket in a jumbo. */
 			__set_bit(ix, &tq->rtt_samples);
-		len += rxrpc_prepare_data_subpacket(call, req, txb, serial, i);
+		len += rxrpc_prepare_data_subpacket(call, req, txb, whdr, serial, i);
 		serial++;
 		seq++;
 		i++;
 	}
 	rxrpc_set_keepalive(call, req->now);
+	page_frag_free(whdr);
 	return len;
 }
  */
 void rxrpc_send_data_packet(struct rxrpc_call *call, struct rxrpc_send_data_req *req)
 {
+	struct rxrpc_wire_header *whdr;
 	struct rxrpc_connection *conn = call->conn;
 	enum rxrpc_tx_point frag;
 	struct rxrpc_txqueue *tq = req->tq;
 	struct rxrpc_txbuf *txb;
 	struct msghdr msg;
 	rxrpc_seq_t seq = req->seq;
-	size_t len;
+	size_t len = sizeof(*whdr);
 	bool new_call = test_bit(RXRPC_CALL_BEGAN_RX_TIMER, &call->flags);
 	int ret, stat_ix;
 	_enter("%x,%x-%x", tq->qbase, seq, seq + req->n - 1);
+	whdr = page_frag_alloc(&call->local->tx_alloc, sizeof(*whdr), GFP_NOFS);
+	if (!whdr)
+		return; /* Drop the packet if no memory. */
+	call->local->kvec[0].iov_base = whdr;
+	call->local->kvec[0].iov_len = sizeof(*whdr);
 	stat_ix = umin(req->n, ARRAY_SIZE(call->rxnet->stat_tx_jumbo)) - 1;
 	atomic_inc(&call->rxnet->stat_tx_jumbo[stat_ix]);
-	len = rxrpc_prepare_data_packet(call, req);
+	len += rxrpc_prepare_data_packet(call, req, whdr);
 	txb = tq->bufs[seq & RXRPC_TXQ_MASK];
-	iov_iter_kvec(&msg.msg_iter, WRITE, call->local->kvec, req->n, len);
+	iov_iter_kvec(&msg.msg_iter, WRITE, call->local->kvec, 1 + req->n, len);
 	msg.msg_name	= &call->peer->srx.transport;
 	msg.msg_namelen	= call->peer->srx.transport_len;
 	if (ret == -EMSGSIZE) {
 		rxrpc_inc_stat(call->rxnet, stat_tx_data_send_msgsize);
-		trace_rxrpc_tx_packet(call->debug_id, call->local->kvec[0].iov_base, frag);
+		trace_rxrpc_tx_packet(call->debug_id, whdr, frag);
 		ret = 0;
 	} else if (ret < 0) {
 		rxrpc_inc_stat(call->rxnet, stat_tx_data_send_fail);
 		trace_rxrpc_tx_fail(call->debug_id, txb->serial, ret, frag);
 	} else {
-		trace_rxrpc_tx_packet(call->debug_id, call->local->kvec[0].iov_base, frag);
+		trace_rxrpc_tx_packet(call->debug_id, whdr, frag);
 	}
 	rxrpc_tx_backoff(call, ret);

net/rxrpc/peer_event.c+7−0

@@ -169,6 +169,13 @@ void rxrpc_input_error(struct rxrpc_local local, struct sk_buff skb) · 168 unmodified lines
169	goto out;	169	goto out;
170	}	170	}
171		171
		172	if ((serr->ee.ee_origin == SO_EE_ORIGIN_ICMP6 &&
		173	serr->ee.ee_type == ICMPV6_PKT_TOOBIG &&
		174	serr->ee.ee_code == 0)) {
		175	rxrpc_adjust_mtu(peer, serr->ee.ee_info);
		176	goto out;
		177	}
		178
172	rxrpc_store_error(peer, skb);	179	rxrpc_store_error(peer, skb);
173	out:	180	out:
174	rxrpc_put_peer(peer, rxrpc_peer_put_input_error);	181	rxrpc_put_peer(peer, rxrpc_peer_put_input_error);

net/rxrpc/rxkad.c+5−8

 				    struct rxrpc_txbuf *txb,
 				    struct skcipher_request *req)
 {
-	struct rxrpc_wire_header *whdr = txb->kvec[0].iov_base;
+	struct rxkad_level1_hdr *hdr = txb->data;
-	struct rxkad_level1_hdr *hdr = (void *)(whdr + 1);
 	struct rxrpc_crypt iv;
 	struct scatterlist sg;
 	size_t pad;
 	pad = RXKAD_ALIGN - pad;
 	pad &= RXKAD_ALIGN - 1;
 	if (pad) {
-		memset(txb->kvec[0].iov_base + txb->offset, 0, pad);
+		memset(txb->data + txb->offset, 0, pad);
 		txb->pkt_len += pad;
 	}
 				       struct skcipher_request *req)
 {
 	const struct rxrpc_key_token *token;
-	struct rxrpc_wire_header *whdr = txb->kvec[0].iov_base;
+	struct rxkad_level2_hdr *rxkhdr = txb->data;
-	struct rxkad_level2_hdr *rxkhdr = (void *)(whdr + 1);
 	struct rxrpc_crypt iv;
 	struct scatterlist sg;
 	size_t content, pad;
 	txb->pkt_len = round_up(content, RXKAD_ALIGN);
 	pad = txb->pkt_len - content;
 	if (pad)
-		memset(txb->kvec[0].iov_base + txb->offset, 0, pad);
+		memset(txb->data + txb->offset, 0, pad);
 	/* encrypt from the session key */
 	token = call->conn->key->payload.data[0];
 	/* Clear excess space in the packet */
 	if (txb->pkt_len < txb->alloc_size) {
-		struct rxrpc_wire_header *whdr = txb->kvec[0].iov_base;
 		size_t gap = txb->alloc_size - txb->pkt_len;
-		void *p = whdr + 1;
+		void *p = txb->data;
 		memset(p + txb->pkt_len, 0, gap);
 	}

net/rxrpc/sendmsg.c+1−3

 			size_t copy = umin(txb->space, msg_data_left(msg));
 			_debug("add %zu", copy);
-			if (!copy_from_iter_full(txb->kvec[0].iov_base + txb->offset,
+			if (!copy_from_iter_full(txb->data + txb->offset,
 						 copy, &msg->msg_iter))
 				goto efault;
 			_debug("added");
 			ret = call->security->secure_packet(call, txb);
 			if (ret < 0)
 				goto out;
-			txb->kvec[0].iov_len += txb->len;
 			rxrpc_queue_packet(rx, call, txb, notify_end_tx);
 			txb = NULL;
 		}

net/rxrpc/txbuf.c+10−27

 struct rxrpc_txbuf *rxrpc_alloc_data_txbuf(struct rxrpc_call *call, size_t data_size,
 					   size_t data_align, gfp_t gfp)
 {
-	struct rxrpc_wire_header *whdr;
 	struct rxrpc_txbuf *txb;
-	size_t total, hoff;
+	size_t total, doff, jsize = sizeof(struct rxrpc_jumbo_header);
 	void *buf;
 	txb = kzalloc(sizeof(*txb), gfp);
 	if (!txb)
 		return NULL;
-	hoff = round_up(sizeof(*whdr), data_align) - sizeof(*whdr);
+	/* We put a jumbo header in the buffer, but not a full wire header to
-	total = hoff + sizeof(*whdr) + data_size;
+	 * avoid delayed-corruption problems with zerocopy.
+	 */
+	doff = round_up(jsize, data_align);
+	total = doff + data_size;
 	data_align = umax(data_align, L1_CACHE_BYTES);
 	mutex_lock(&call->conn->tx_data_alloc_lock);
 		return NULL;
 	}
-	whdr = buf + hoff;
 	refcount_set(&txb->ref, 1);
 	txb->call_debug_id	= call->debug_id;
 	txb->debug_id		= atomic_inc_return(&rxrpc_txbuf_debug_ids);
 	txb->alloc_size		= data_size;
 	txb->space		= data_size;
-	txb->offset		= sizeof(*whdr);
+	txb->offset		= 0;
 	txb->flags		= call->conn->out_clientflag;
 	txb->seq		= call->send_top + 1;
-	txb->nr_kvec		= 1;
+	txb->data		= buf + doff;
-	txb->kvec[0].iov_base	= whdr;
-	txb->kvec[0].iov_len	= sizeof(*whdr);
-	whdr->epoch		= htonl(call->conn->proto.epoch);
-	whdr->cid		= htonl(call->cid);
-	whdr->callNumber	= htonl(call->call_id);
-	whdr->seq		= htonl(txb->seq);
-	whdr->type		= RXRPC_PACKET_TYPE_DATA;
-	whdr->flags		= 0;
-	whdr->userStatus	= 0;
-	whdr->securityIndex	= call->security_ix;
-	whdr->_rsvd		= 0;
-	whdr->serviceId		= htons(call->dest_srx.srx_service);
 	trace_rxrpc_txbuf(txb->debug_id, txb->call_debug_id, txb->seq, 1,
 			  rxrpc_txbuf_alloc_data);
 static void rxrpc_free_txbuf(struct rxrpc_txbuf *txb)
 {
-	int i;
 	trace_rxrpc_txbuf(txb->debug_id, txb->call_debug_id, txb->seq, 0,
 			  rxrpc_txbuf_free);
-	for (i = 0; i < txb->nr_kvec; i++)
+	if (txb->data)
-		if (txb->kvec[i].iov_base &&
+		page_frag_free(txb->data);
-		    !is_zero_pfn(page_to_pfn(virt_to_page(txb->kvec[i].iov_base))))
-			page_frag_free(txb->kvec[i].iov_base);
 	kfree(txb);
 	atomic_dec(&rxrpc_nr_txbuf);
 }

net/vmw_vsock/af_vsock.c+7−1

 	 */
 	lock_sock_nested(sk, level);
-	sock_orphan(sk);
+	/* Indicate to vsock_remove_sock() that the socket is being released and
+	 * can be removed from the bound_table. Unlike transport reassignment
+	 * case, where the socket must remain bound despite vsock_remove_sock()
+	 * being called from the transport release() callback.
+	 */
+	sock_set_flag(sk, SOCK_DEAD);
 	if (vsk->transport)
 		vsk->transport->release(vsk);
 	else if (sock_type_connectible(sk->sk_type))
 		vsock_remove_sock(vsk);
+	sock_orphan(sk);
 	sk->sk_shutdown = SHUTDOWN_MASK;
 	skb_queue_purge(&sk->sk_receive_queue);

tools/testing/vsock/vsock_test.c+41−0

@@ -1788,6 +1788,42 @@ static void test_stream_connect_retry_server(const struct test_opts *opts) · 1787 unmodified lines
1788	close(fd);	1788	close(fd);
1789	}	1789	}
1790		1790
		1791	static void test_stream_linger_client(const struct test_opts *opts)
		1792	{
		1793	struct linger optval = {
		1794	.l_onoff = 1,
		1795	.l_linger = 1
		1796	};
		1797	int fd;
		1798
		1799	fd = vsock_stream_connect(opts->peer_cid, opts->peer_port);
		1800	if (fd < 0) {
		1801	perror("connect");
		1802	exit(EXIT_FAILURE);
		1803	}
		1804
		1805	if (setsockopt(fd, SOL_SOCKET, SO_LINGER, &optval, sizeof(optval))) {
		1806	perror("setsockopt(SO_LINGER)");
		1807	exit(EXIT_FAILURE);
		1808	}
		1809
		1810	close(fd);
		1811	}
		1812
		1813	static void test_stream_linger_server(const struct test_opts *opts)
		1814	{
		1815	int fd;
		1816
		1817	fd = vsock_stream_accept(VMADDR_CID_ANY, opts->peer_port, NULL);
		1818	if (fd < 0) {
		1819	perror("accept");
		1820	exit(EXIT_FAILURE);
		1821	}
		1822
		1823	vsock_wait_remote_close(fd);
		1824	close(fd);
		1825	}
		1826
1791	static struct test_case test_cases[] = {	1827	static struct test_case test_cases[] = {
1792	{	1828	{
1793	.name = "SOCK_STREAM connection reset",	1829	.name = "SOCK_STREAM connection reset",
@@ -1943,6 +1979,11 @@ static struct test_case test_cases[] = { · 149 unmodified lines
1943	.run_client = test_stream_connect_retry_client,	1979	.run_client = test_stream_connect_retry_client,
1944	.run_server = test_stream_connect_retry_server,	1980	.run_server = test_stream_connect_retry_server,
1945	},	1981	},
		1982	{
		1983	.name = "SOCK_STREAM SO_LINGER null-ptr-deref",
		1984	.run_client = test_stream_linger_client,
		1985	.run_server = test_stream_linger_server,
		1986	},
1946	{},	1987	{},
1947	};	1988	};
1948		1989

@@ -2712,7 +2712,7 @@ static const struct pci_device_id brcmf_pcie_devid_table[] = { · 2711 unmodified lines
2712	BRCMF_PCIE_DEVICE(BRCM_PCIE_4350_DEVICE_ID, WCC),	2712	BRCMF_PCIE_DEVICE(BRCM_PCIE_4350_DEVICE_ID, WCC),
2713	BRCMF_PCIE_DEVICE_SUB(0x4355, BRCM_PCIE_VENDOR_ID_BROADCOM, 0x4355, WCC),	2713	BRCMF_PCIE_DEVICE_SUB(0x4355, BRCM_PCIE_VENDOR_ID_BROADCOM, 0x4355, WCC),
2714	BRCMF_PCIE_DEVICE(BRCM_PCIE_4354_RAW_DEVICE_ID, WCC),	2714	BRCMF_PCIE_DEVICE(BRCM_PCIE_4354_RAW_DEVICE_ID, WCC),
2715	BRCMF_PCIE_DEVICE(BRCM_PCIE_4355_DEVICE_ID, WCC),	2715	BRCMF_PCIE_DEVICE(BRCM_PCIE_4355_DEVICE_ID, WCC_SEED),
2716	BRCMF_PCIE_DEVICE(BRCM_PCIE_4356_DEVICE_ID, WCC),	2716	BRCMF_PCIE_DEVICE(BRCM_PCIE_4356_DEVICE_ID, WCC),
2717	BRCMF_PCIE_DEVICE(BRCM_PCIE_43567_DEVICE_ID, WCC),	2717	BRCMF_PCIE_DEVICE(BRCM_PCIE_43567_DEVICE_ID, WCC),
2718	BRCMF_PCIE_DEVICE(BRCM_PCIE_43570_DEVICE_ID, WCC),	2718	BRCMF_PCIE_DEVICE(BRCM_PCIE_43570_DEVICE_ID, WCC),
@@ -2723,7 +2723,7 @@ static const struct pci_device_id brcmf_pcie_devid_table[] = { · 4 unmodified lines
2723	BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_2G_DEVICE_ID, WCC),	2723	BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_2G_DEVICE_ID, WCC),
2724	BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_5G_DEVICE_ID, WCC),	2724	BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_5G_DEVICE_ID, WCC),
2725	BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_RAW_DEVICE_ID, WCC),	2725	BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_RAW_DEVICE_ID, WCC),
2726	BRCMF_PCIE_DEVICE(BRCM_PCIE_4364_DEVICE_ID, WCC),	2726	BRCMF_PCIE_DEVICE(BRCM_PCIE_4364_DEVICE_ID, WCC_SEED),
2727	BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_DEVICE_ID, BCA),	2727	BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_DEVICE_ID, BCA),
2728	BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_2G_DEVICE_ID, BCA),	2728	BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_2G_DEVICE_ID, BCA),
2729	BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_5G_DEVICE_ID, BCA),	2729	BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_5G_DEVICE_ID, BCA),