Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller: 1) Need to access netdev->num_rx_queues behind an accessor in netvsc driver otherwise the build breaks with some configs, from Arnd Bergmann. 2) Add dummy xfrm_dev_event() so that build doesn't fail when CONFIG_XFRM_OFFLOAD is not set. From Hangbin Liu. 3) Don't OOPS when pfkey_msg2xfrm_state() signals an erros, from Dan Carpenter. 4) Fix MCDI command size for filter operations in sfc driver, from Martin Habets. 5) Fix UFO segmenting so that we don't calculate incorrect checksums, from Michal Kubecek. 6) When ipv6 datagram connects fail, reset destination address and port. From Wei Wang. 7) TCP disconnect must reset the cached receive DST, from WANG Cong. 8) Fix sign extension bug on 32-bit in dev_get_stats(), from Eric Dumazet. 9) fman driver has to depend on HAS_DMA, from Madalin Bucur. 10) Fix bpf pointer leak with xadd in verifier, from Daniel Borkmann. 11) Fix negative page counts with GFO, from Michal Kubecek. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (41 commits) sfc: fix attempt to translate invalid filter ID net: handle NAPI_GRO_FREE_STOLEN_HEAD case also in napi_frags_finish() bpf: prevent leaking pointer via xadd on unpriviledged arcnet: com20020-pci: add missing pdev setup in netdev structure arcnet: com20020-pci: fix dev_id calculation arcnet: com20020: remove needless base_addr assignment Trivial fix to spelling mistake in arc_printk message arcnet: change irq handler to lock irqsave rocker: move dereference before free mlxsw: spectrum_router: Fix NULL pointer dereference net: sched: Fix one possible panic when no destroy callback virtio-net: serialize tx routine during reset net: usb: asix88179_178a: Add support for the Belkin B2B128 fsl/fman: add dependency on HAS_DMA net: prevent sign extension in dev_get_stats() tcp: reset sk_rx_dst in tcp_disconnect() net: ipv6: reset daddr and dport in sk if connect() fails bnx2x: Don't log mc removal needlessly bnxt_en: Fix netpoll handling. bnxt_en: Add missing logic to handle TPA end error conditions. ...

Linus Torvalds committed 9 years ago

Commit 4d8a9912 parents 27bc344 d58299a42 files · +350 −84Browse files

Unified · Split

42 files

drivers/net/arcnet/arcnet.c +4 −3
drivers/net/arcnet/capmode.c +1 −1
drivers/net/arcnet/com20020-pci.c +4 −2
drivers/net/arcnet/com20020.c +0 −2
drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +1 −1
drivers/net/ethernet/broadcom/bnxt/bnxt.c +52 −9
drivers/net/ethernet/broadcom/bnxt/bnxt.h +5 −1
drivers/net/ethernet/freescale/fman/Kconfig +1 −0
drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +3 −0
drivers/net/ethernet/rocker/rocker_ofdpa.c +1 −1
drivers/net/ethernet/sfc/ef10.c +8 −7
drivers/net/ethernet/ti/cpsw-common.c +1 −1
drivers/net/hyperv/netvsc_drv.c +2 −2
drivers/net/macvlan.c +71 −14
drivers/net/phy/dp83640.c +1 −1
drivers/net/phy/micrel.c +2 −0
drivers/net/usb/ax88179_178a.c +16 −0
drivers/net/veth.c +2 −2
drivers/net/virtio_net.c +1 −0
drivers/net/xen-netback/common.h +1 −0
drivers/net/xen-netback/interface.c +5 −1
drivers/net/xen-netback/netback.c +5 −1
include/net/xfrm.h +2 −5
kernel/bpf/verifier.c +5 −0
net/core/dev.c +20 −10
net/ipv4/ip_output.c +2 −1
net/ipv4/tcp.c +2 −0
net/ipv6/addrconf.c +3 −2
net/ipv6/datagram.c +7 −1
net/ipv6/esp6_offload.c +25 −0
net/ipv6/ip6_output.c +1 −1
net/ipv6/route.c +5 −1
net/ipv6/sit.c +1 −1
net/ipv6/udp.c +2 −1
net/ipv6/xfrm6_input.c +1 −1
net/key/af_key.c +15 −4
net/sched/sch_api.c +2 −1
net/xfrm/Makefile +1 −2
net/xfrm/xfrm_device.c +2 −0
net/xfrm/xfrm_policy.c +0 −4
net/xfrm/xfrm_user.c +1 −0
tools/testing/selftests/bpf/test_verifier.c +66 −0

drivers/net/arcnet/arcnet.c+4−3

@@ -756,6 +756,7 @@ irqreturn_t arcnet_interrupt(int irq, void *dev_id) · 755 unmodified lines
756	756	struct net_device *dev = dev_id;
757	757	struct arcnet_local *lp;
758	758	int recbuf, status, diagstatus, didsomething, boguscount;
	759	+ unsigned long flags;
759	760	int retval = IRQ_NONE;
760	761
761	762	arc_printk(D_DURING, dev, "\n");
@@ -765,7 +766,7 @@ irqreturn_t arcnet_interrupt(int irq, void *dev_id) · 3 unmodified lines
765	766	lp = netdev_priv(dev);
766	767	BUG_ON(!lp);
767	768
768		− spin_lock(&lp->lock);
	769	+ spin_lock_irqsave(&lp->lock, flags);
769	770
770	771	/* RESET flag was enabled - if device is not running, we must
771	772	* clear it right away (but nothing else).
@@ -774,7 +775,7 @@ irqreturn_t arcnet_interrupt(int irq, void *dev_id) · 2 unmodified lines
774	775	if (lp->hw.status(dev) & RESETflag)
775	776	lp->hw.command(dev, CFLAGScmd \| RESETclear);
776	777	lp->hw.intmask(dev, 0);
777		− spin_unlock(&lp->lock);
	778	+ spin_unlock_irqrestore(&lp->lock, flags);
778	779	return retval;
779	780	}
780	781
@@ -998,7 +999,7 @@ irqreturn_t arcnet_interrupt(int irq, void *dev_id) · 217 unmodified lines
998	999	udelay(1);
999	1000	lp->hw.intmask(dev, lp->intmask);
1000	1001
1001		− spin_unlock(&lp->lock);
	1002	+ spin_unlock_irqrestore(&lp->lock, flags);
1002	1003	return retval;
1003	1004	}
1004	1005	EXPORT_SYMBOL(arcnet_interrupt);

drivers/net/arcnet/capmode.c+1−1

@@ -212,7 +212,7 @@ static int ack_tx(struct net_device *dev, int acked) · 211 unmodified lines
212	212	ackpkt->soft.cap.proto = 0; /* using protocol 0 for acknowledge */
213	213	ackpkt->soft.cap.mes.ack = acked;
214	214
215		− arc_printk(D_PROTO, dev, "Ackknowledge for cap packet %x.\n",
	215	+ arc_printk(D_PROTO, dev, "Acknowledge for cap packet %x.\n",
216	216	((int )&ackpkt->soft.cap.cookie[0]));
217	217
218	218	ackskb->protocol = cpu_to_be16(ETH_P_ARCNET);

drivers/net/arcnet/com20020-pci.c+4−2

@@ -135,6 +135,7 @@ static int com20020pci_probe(struct pci_dev *pdev, · 134 unmodified lines
135	135	for (i = 0; i < ci->devcount; i++) {
136	136	struct com20020_pci_channel_map *cm = &ci->chan_map_tbl[i];
137	137	struct com20020_dev *card;
	138	+ int dev_id_mask = 0xf;
138	139
139	140	dev = alloc_arcdev(device);
140	141	if (!dev) {
@@ -166,6 +167,7 @@ static int com20020pci_probe(struct pci_dev *pdev, · 25 unmodified lines
166	167	arcnet_outb(0x00, ioaddr, COM20020_REG_W_COMMAND);
167	168	arcnet_inb(ioaddr, COM20020_REG_R_DIAGSTAT);
168	169
	170	+ SET_NETDEV_DEV(dev, &pdev->dev);
169	171	dev->base_addr = ioaddr;
170	172	dev->dev_addr[0] = node;
171	173	dev->irq = pdev->irq;
@@ -179,8 +181,8 @@ static int com20020pci_probe(struct pci_dev *pdev, · 7 unmodified lines
179	181
180	182	/* Get the dev_id from the PLX rotary coder */
181	183	if (!strncmp(ci->name, "EAE PLX-PCI MA1", 15))
182		− dev->dev_id = 0xc;
183		− dev->dev_id ^= inb(priv->misc + ci->rotary) >> 4;
	184	+ dev_id_mask = 0x3;
	185	+ dev->dev_id = (inb(priv->misc + ci->rotary) >> 4) & dev_id_mask;
184	186
185	187	snprintf(dev->name, sizeof(dev->name), "arc%d-%d", dev->dev_id, i);
186	188

drivers/net/arcnet/com20020.c+0−2

@@ -246,8 +246,6 @@ int com20020_found(struct net_device *dev, int shared) · 245 unmodified lines
246	246	return -ENODEV;
247	247	}
248	248
249		− dev->base_addr = ioaddr;
250		−
251	249	arc_printk(D_NORMAL, dev, "%s: station %02Xh found at %03lXh, IRQ %d.\n",
252	250	lp->card_name, dev->dev_addr[0], dev->base_addr, dev->irq);
253	251

drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c+1−1

@@ -12729,7 +12729,7 @@ static int bnx2x_set_mc_list(struct bnx2x *bp) · 12728 unmodified lines
12729	12729	} else {
12730	12730	/* If no mc addresses are required, flush the configuration */
12731	12731	rc = bnx2x_config_mcast(bp, &rparam, BNX2X_MCAST_CMD_DEL);
12732		− if (rc)
	12732	+ if (rc < 0)
12733	12733	BNX2X_ERR("Failed to clear multicast configuration %d\n",
12734	12734	rc);
12735	12735	}

drivers/net/ethernet/broadcom/bnxt/bnxt.c+52−9

@@ -1301,10 +1301,11 @@ static inline struct sk_buff bnxt_tpa_end(struct bnxt bp, · 1300 unmodified lines
1301	1301	cp_cons = NEXT_CMP(cp_cons);
1302	1302	}
1303	1303
1304		− if (unlikely(agg_bufs > MAX_SKB_FRAGS)) {
	1304	+ if (unlikely(agg_bufs > MAX_SKB_FRAGS \|\| TPA_END_ERRORS(tpa_end1))) {
1305	1305	bnxt_abort_tpa(bp, bnapi, cp_cons, agg_bufs);
1306		− netdev_warn(bp->dev, "TPA frags %d exceeded MAX_SKB_FRAGS %d\n",
1307		− agg_bufs, (int)MAX_SKB_FRAGS);
	1306	+ if (agg_bufs > MAX_SKB_FRAGS)
	1307	+ netdev_warn(bp->dev, "TPA frags %d exceeded MAX_SKB_FRAGS %d\n",
	1308	+ agg_bufs, (int)MAX_SKB_FRAGS);
1308	1309	return NULL;
1309	1310	}
1310	1311
@@ -1562,6 +1563,45 @@ next_rx_no_prod: · 251 unmodified lines
1562	1563	return rc;
1563	1564	}
1564	1565
	1566	+/* In netpoll mode, if we are using a combined completion ring, we need to
	1567	+ * discard the rx packets and recycle the buffers.
	1568	+ */
	1569	+static int bnxt_force_rx_discard(struct bnxt bp, struct bnxt_napi bnapi,
	1570	+ u32 raw_cons, u8 event)
	1571	+{
	1572	+ struct bnxt_cp_ring_info *cpr = &bnapi->cp_ring;
	1573	+ u32 tmp_raw_cons = *raw_cons;
	1574	+ struct rx_cmp_ext *rxcmp1;
	1575	+ struct rx_cmp *rxcmp;
	1576	+ u16 cp_cons;
	1577	+ u8 cmp_type;
	1578	+
	1579	+ cp_cons = RING_CMP(tmp_raw_cons);
	1580	+ rxcmp = (struct rx_cmp *)
	1581	+ &cpr->cp_desc_ring[CP_RING(cp_cons)][CP_IDX(cp_cons)];
	1582	+
	1583	+ tmp_raw_cons = NEXT_RAW_CMP(tmp_raw_cons);
	1584	+ cp_cons = RING_CMP(tmp_raw_cons);
	1585	+ rxcmp1 = (struct rx_cmp_ext *)
	1586	+ &cpr->cp_desc_ring[CP_RING(cp_cons)][CP_IDX(cp_cons)];
	1587	+
	1588	+ if (!RX_CMP_VALID(rxcmp1, tmp_raw_cons))
	1589	+ return -EBUSY;
	1590	+
	1591	+ cmp_type = RX_CMP_TYPE(rxcmp);
	1592	+ if (cmp_type == CMP_TYPE_RX_L2_CMP) {
	1593	+ rxcmp1->rx_cmp_cfa_code_errors_v2 \|=
	1594	+ cpu_to_le32(RX_CMPL_ERRORS_CRC_ERROR);
	1595	+ } else if (cmp_type == CMP_TYPE_RX_L2_TPA_END_CMP) {
	1596	+ struct rx_tpa_end_cmp_ext *tpa_end1;
	1597	+
	1598	+ tpa_end1 = (struct rx_tpa_end_cmp_ext *)rxcmp1;
	1599	+ tpa_end1->rx_tpa_end_cmp_errors_v2 \|=
	1600	+ cpu_to_le32(RX_TPA_END_CMP_ERRORS);
	1601	+ }
	1602	+ return bnxt_rx_pkt(bp, bnapi, raw_cons, event);
	1603	+}
	1604	+
1565	1605	#define BNXT_GET_EVENT_PORT(data) \
1566	1606	((data) & \
1567	1607	ASYNC_EVENT_CMPL_PORT_CONN_NOT_ALLOWED_EVENT_DATA1_PORT_ID_MASK)
@@ -1744,7 +1784,11 @@ static int bnxt_poll_work(struct bnxt bp, struct bnxt_napi bnapi, int budget) · 176 unmodified lines
1744	1784	if (unlikely(tx_pkts > bp->tx_wake_thresh))
1745	1785	rx_pkts = budget;
1746	1786	} else if ((TX_CMP_TYPE(txcmp) & 0x30) == 0x10) {
1747		− rc = bnxt_rx_pkt(bp, bnapi, &raw_cons, &event);
	1787	+ if (likely(budget))
	1788	+ rc = bnxt_rx_pkt(bp, bnapi, &raw_cons, &event);
	1789	+ else
	1790	+ rc = bnxt_force_rx_discard(bp, bnapi, &raw_cons,
	1791	+ &event);
1748	1792	if (likely(rc >= 0))
1749	1793	rx_pkts += rc;
1750	1794	else if (rc == -EBUSY) /* partial completion */
@@ -6663,12 +6707,11 @@ static void bnxt_poll_controller(struct net_device *dev) · 4912 unmodified lines
6663	6707	struct bnxt *bp = netdev_priv(dev);
6664	6708	int i;
6665	6709
6666		− for (i = 0; i < bp->cp_nr_rings; i++) {
6667		− struct bnxt_irq *irq = &bp->irq_tbl[i];
	6710	+ /* Only process tx rings/combined rings in netpoll mode. */
	6711	+ for (i = 0; i < bp->tx_nr_rings; i++) {
	6712	+ struct bnxt_tx_ring_info *txr = &bp->tx_ring[i];
6668	6713
6669		− disable_irq(irq->vector);
6670		− irq->handler(irq->vector, bp->bnapi[i]);
6671		− enable_irq(irq->vector);
	6714	+ napi_schedule(&txr->bnapi->napi);
6672	6715	}
6673	6716	}
6674	6717	#endif

drivers/net/ethernet/broadcom/bnxt/bnxt.h+5−1

@@ -374,12 +374,16 @@ struct rx_tpa_end_cmp_ext { · 373 unmodified lines
374	374
375	375	__le32 rx_tpa_end_cmp_errors_v2;
376	376	#define RX_TPA_END_CMP_V2 (0x1 << 0)
377		− #define RX_TPA_END_CMP_ERRORS (0x7fff << 1)
	377	+ #define RX_TPA_END_CMP_ERRORS (0x3 << 1)
378	378	#define RX_TPA_END_CMPL_ERRORS_SHIFT 1
379	379
380	380	u32 rx_tpa_end_cmp_start_opaque;
381	381	};
382	382
	383	+#define TPA_END_ERRORS(rx_tpa_end_ext) \
	384	+ ((rx_tpa_end_ext)->rx_tpa_end_cmp_errors_v2 & \
	385	+ cpu_to_le32(RX_TPA_END_CMP_ERRORS))
	386	+
383	387	#define DB_IDX_MASK 0xffffff
384	388	#define DB_IDX_VALID (0x1 << 26)
385	389	#define DB_IRQ_DIS (0x1 << 27)

drivers/net/ethernet/freescale/fman/Kconfig+1−0

@@ -2,6 +2,7 @@ config FSL_FMAN · 1 unmodified line
2	2	tristate "FMan support"
3	3	depends on FSL_SOC \|\| ARCH_LAYERSCAPE \|\| COMPILE_TEST
4	4	select GENERIC_ALLOCATOR
	5	+ depends on HAS_DMA
5	6	select PHYLIB
6	7	default n
7	8	help

drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c+3−0

@@ -3334,6 +3334,9 @@ static int mlxsw_sp_inetaddr_vlan_event(struct net_device *vlan_dev, · 3333 unmodified lines
3334	3334	struct mlxsw_sp *mlxsw_sp = mlxsw_sp_lower_get(vlan_dev);
3335	3335	u16 vid = vlan_dev_vlan_id(vlan_dev);
3336	3336
	3337	+ if (netif_is_bridge_port(vlan_dev))
	3338	+ return 0;
	3339	+
3337	3340	if (mlxsw_sp_port_dev_check(real_dev))
3338	3341	return mlxsw_sp_inetaddr_vport_event(vlan_dev, real_dev, event,
3339	3342	vid);

drivers/net/ethernet/rocker/rocker_ofdpa.c+1−1

@@ -1505,8 +1505,8 @@ static int ofdpa_port_ipv4_nh(struct ofdpa_port *ofdpa_port, · 1504 unmodified lines
1505	1505	*index = entry->index;
1506	1506	resolved = false;
1507	1507	} else if (removing) {
1508		− ofdpa_neigh_del(trans, found);
1509	1508	*index = found->index;
	1509	+ ofdpa_neigh_del(trans, found);
1510	1510	} else if (updating) {
1511	1511	ofdpa_neigh_update(found, trans, NULL, false);
1512	1512	resolved = !is_zero_ether_addr(found->eth_dst);

drivers/net/ethernet/sfc/ef10.c+8−7

@@ -4172,7 +4172,7 @@ found: · 4171 unmodified lines
4172	4172	* recipients
4173	4173	*/
4174	4174	if (is_mc_recip) {
4175		− MCDI_DECLARE_BUF(inbuf, MC_CMD_FILTER_OP_IN_LEN);
	4175	+ MCDI_DECLARE_BUF(inbuf, MC_CMD_FILTER_OP_EXT_IN_LEN);
4176	4176	unsigned int depth, i;
4177	4177
4178	4178	memset(inbuf, 0, sizeof(inbuf));
@@ -4320,7 +4320,7 @@ static int efx_ef10_filter_remove_internal(struct efx_nic *efx, · 141 unmodified lines
4320	4320	efx_ef10_filter_set_entry(table, filter_idx, NULL, 0);
4321	4321	} else {
4322	4322	efx_mcdi_display_error(efx, MC_CMD_FILTER_OP,
4323		− MC_CMD_FILTER_OP_IN_LEN,
	4323	+ MC_CMD_FILTER_OP_EXT_IN_LEN,
4324	4324	NULL, 0, rc);
4325	4325	}
4326	4326	}
@@ -4453,7 +4453,7 @@ static s32 efx_ef10_filter_rfs_insert(struct efx_nic *efx, · 126 unmodified lines
4453	4453	struct efx_filter_spec *spec)
4454	4454	{
4455	4455	struct efx_ef10_filter_table *table = efx->filter_state;
4456		− MCDI_DECLARE_BUF(inbuf, MC_CMD_FILTER_OP_IN_LEN);
	4456	+ MCDI_DECLARE_BUF(inbuf, MC_CMD_FILTER_OP_EXT_IN_LEN);
4457	4457	struct efx_filter_spec *saved_spec;
4458	4458	unsigned int hash, i, depth = 1;
4459	4459	bool replacing = false;
@@ -4940,7 +4940,7 @@ not_restored: · 480 unmodified lines
4940	4940	static void efx_ef10_filter_table_remove(struct efx_nic *efx)
4941	4941	{
4942	4942	struct efx_ef10_filter_table *table = efx->filter_state;
4943		− MCDI_DECLARE_BUF(inbuf, MC_CMD_FILTER_OP_IN_LEN);
	4943	+ MCDI_DECLARE_BUF(inbuf, MC_CMD_FILTER_OP_EXT_IN_LEN);
4944	4944	struct efx_filter_spec *spec;
4945	4945	unsigned int filter_idx;
4946	4946	int rc;
@@ -5105,6 +5105,7 @@ static int efx_ef10_filter_insert_addr_list(struct efx_nic *efx, · 158 unmodified lines
5105	5105
5106	5106	/* Insert/renew filters */
5107	5107	for (i = 0; i < addr_count; i++) {
	5108	+ EFX_WARN_ON_PARANOID(ids[i] != EFX_EF10_FILTER_ID_INVALID);
5108	5109	efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO, filter_flags, 0);
5109	5110	efx_filter_set_eth_local(&spec, vlan->vid, addr_list[i].addr);
5110	5111	rc = efx_ef10_filter_insert(efx, &spec, true);
@@ -5122,11 +5123,11 @@ static int efx_ef10_filter_insert_addr_list(struct efx_nic *efx, · 11 unmodified lines
5122	5123	}
5123	5124	return rc;
5124	5125	} else {
5125		− /* mark as not inserted, and carry on */
5126		− rc = EFX_EF10_FILTER_ID_INVALID;
	5126	+ /* keep invalid ID, and carry on */
5127	5127	}
	5128	+ } else {
	5129	+ ids[i] = efx_ef10_filter_get_unsafe_id(rc);
5128	5130	}
5129		− ids[i] = efx_ef10_filter_get_unsafe_id(rc);
5130	5131	}
5131	5132
5132	5133	if (multicast && rollback) {

drivers/net/ethernet/ti/cpsw-common.c+1−1

@@ -90,7 +90,7 @@ int ti_cm_get_macid(struct device dev, int slave, u8 mac_addr) · 89 unmodified lines
90	90	if (of_device_is_compatible(dev->of_node, "ti,dm816-emac"))
91	91	return cpsw_am33xx_cm_get_macid(dev, 0x30, slave, mac_addr);
92	92
93		− if (of_machine_is_compatible("ti,am4372"))
	93	+ if (of_machine_is_compatible("ti,am43"))
94	94	return cpsw_am33xx_cm_get_macid(dev, 0x630, slave, mac_addr);
95	95
96	96	if (of_machine_is_compatible("ti,dra7"))

drivers/net/hyperv/netvsc_drv.c+2−2

@@ -776,7 +776,7 @@ static int netvsc_set_channels(struct net_device *net, · 775 unmodified lines
776	776	channels->rx_count \|\| channels->tx_count \|\| channels->other_count)
777	777	return -EINVAL;
778	778
779		− if (count > net->num_tx_queues \|\| count > net->num_rx_queues)
	779	+ if (count > net->num_tx_queues \|\| count > VRSS_CHANNEL_MAX)
780	780	return -EINVAL;
781	781
782	782	if (!nvdev \|\| nvdev->destroy)
@@ -1203,7 +1203,7 @@ static int netvsc_set_rxfh(struct net_device dev, const u32 indir, · 420 unmodified lines
1203	1203	rndis_dev = ndev->extension;
1204	1204	if (indir) {
1205	1205	for (i = 0; i < ITAB_NUM; i++)
1206		− if (indir[i] >= dev->num_rx_queues)
	1206	+ if (indir[i] >= VRSS_CHANNEL_MAX)
1207	1207	return -EINVAL;
1208	1208
1209	1209	for (i = 0; i < ITAB_NUM; i++)

drivers/net/macvlan.c+71−14

@@ -39,16 +39,20 @@ · 38 unmodified lines
39	39	#define MACVLAN_HASH_SIZE (1<<MACVLAN_HASH_BITS)
40	40	#define MACVLAN_BC_QUEUE_LEN 1000
41	41
	42	+#define MACVLAN_F_PASSTHRU 1
	43	+#define MACVLAN_F_ADDRCHANGE 2
	44	+
42	45	struct macvlan_port {
43	46	struct net_device *dev;
44	47	struct hlist_head vlan_hash[MACVLAN_HASH_SIZE];
45	48	struct list_head vlans;
46	49	struct sk_buff_head bc_queue;
47	50	struct work_struct bc_work;
48		− bool passthru;
	51	+ u32 flags;
49	52	int count;
50	53	struct hlist_head vlan_source_hash[MACVLAN_HASH_SIZE];
51	54	DECLARE_BITMAP(mc_filter, MACVLAN_MC_FILTER_SZ);
	55	+ unsigned char perm_addr[ETH_ALEN];
52	56	};
53	57
54	58	struct macvlan_source_entry {
@@ -66,6 +70,31 @@ struct macvlan_skb_cb { · 11 unmodified lines
66	70
67	71	static void macvlan_port_destroy(struct net_device *dev);
68	72
	73	+static inline bool macvlan_passthru(const struct macvlan_port *port)
	74	+{
	75	+ return port->flags & MACVLAN_F_PASSTHRU;
	76	+}
	77	+
	78	+static inline void macvlan_set_passthru(struct macvlan_port *port)
	79	+{
	80	+ port->flags \|= MACVLAN_F_PASSTHRU;
	81	+}
	82	+
	83	+static inline bool macvlan_addr_change(const struct macvlan_port *port)
	84	+{
	85	+ return port->flags & MACVLAN_F_ADDRCHANGE;
	86	+}
	87	+
	88	+static inline void macvlan_set_addr_change(struct macvlan_port *port)
	89	+{
	90	+ port->flags \|= MACVLAN_F_ADDRCHANGE;
	91	+}
	92	+
	93	+static inline void macvlan_clear_addr_change(struct macvlan_port *port)
	94	+{
	95	+ port->flags &= ~MACVLAN_F_ADDRCHANGE;
	96	+}
	97	+
69	98	/* Hash Ethernet address */
70	99	static u32 macvlan_eth_hash(const unsigned char *addr)
71	100	{
@@ -181,11 +210,12 @@ static void macvlan_hash_change_addr(struct macvlan_dev *vlan, · 109 unmodified lines
181	210	static bool macvlan_addr_busy(const struct macvlan_port *port,
182	211	const unsigned char *addr)
183	212	{
184		− /* Test to see if the specified multicast address is
	213	+ /* Test to see if the specified address is
185	214	* currently in use by the underlying device or
186	215	* another macvlan.
187	216	*/
188		− if (ether_addr_equal_64bits(port->dev->dev_addr, addr))
	217	+ if (!macvlan_passthru(port) && !macvlan_addr_change(port) &&
	218	+ ether_addr_equal_64bits(port->dev->dev_addr, addr))
189	219	return true;
190	220
191	221	if (macvlan_hash_lookup(port, addr))
@@ -445,7 +475,7 @@ static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb) · 253 unmodified lines
445	475	}
446	476
447	477	macvlan_forward_source(skb, port, eth->h_source);
448		− if (port->passthru)
	478	+ if (macvlan_passthru(port))
449	479	vlan = list_first_or_null_rcu(&port->vlans,
450	480	struct macvlan_dev, list);
451	481	else
@@ -574,7 +604,7 @@ static int macvlan_open(struct net_device *dev) · 122 unmodified lines
574	604	struct net_device *lowerdev = vlan->lowerdev;
575	605	int err;
576	606
577		− if (vlan->port->passthru) {
	607	+ if (macvlan_passthru(vlan->port)) {
578	608	if (!(vlan->flags & MACVLAN_FLAG_NOPROMISC)) {
579	609	err = dev_set_promiscuity(lowerdev, 1);
580	610	if (err < 0)
@@ -649,7 +679,7 @@ static int macvlan_stop(struct net_device *dev) · 68 unmodified lines
649	679	dev_uc_unsync(lowerdev, dev);
650	680	dev_mc_unsync(lowerdev, dev);
651	681
652		− if (vlan->port->passthru) {
	682	+ if (macvlan_passthru(vlan->port)) {
653	683	if (!(vlan->flags & MACVLAN_FLAG_NOPROMISC))
654	684	dev_set_promiscuity(lowerdev, -1);
655	685	goto hash_del;
@@ -672,6 +702,7 @@ static int macvlan_sync_address(struct net_device dev, unsigned char addr) · 16 unmodified lines
672	702	{
673	703	struct macvlan_dev *vlan = netdev_priv(dev);
674	704	struct net_device *lowerdev = vlan->lowerdev;
	705	+ struct macvlan_port *port = vlan->port;
675	706	int err;
676	707
677	708	if (!(dev->flags & IFF_UP)) {
@@ -682,7 +713,7 @@ static int macvlan_sync_address(struct net_device dev, unsigned char addr) · 4 unmodified lines
682	713	if (macvlan_addr_busy(vlan->port, addr))
683	714	return -EBUSY;
684	715
685		− if (!vlan->port->passthru) {
	716	+ if (!macvlan_passthru(port)) {
686	717	err = dev_uc_add(lowerdev, addr);
687	718	if (err)
688	719	return err;
@@ -692,6 +723,15 @@ static int macvlan_sync_address(struct net_device dev, unsigned char addr) · 3 unmodified lines
692	723
693	724	macvlan_hash_change_addr(vlan, addr);
694	725	}
	726	+ if (macvlan_passthru(port) && !macvlan_addr_change(port)) {
	727	+ /* Since addr_change isn't set, we are here due to lower
	728	+ * device change. Save the lower-dev address so we can
	729	+ * restore it later.
	730	+ */
	731	+ ether_addr_copy(vlan->port->perm_addr,
	732	+ lowerdev->dev_addr);
	733	+ }
	734	+ macvlan_clear_addr_change(port);
695	735	return 0;
696	736	}
697	737
@@ -703,7 +743,12 @@ static int macvlan_set_mac_address(struct net_device dev, void p) · 5 unmodified lines
703	743	if (!is_valid_ether_addr(addr->sa_data))
704	744	return -EADDRNOTAVAIL;
705	745
	746	+ /* If the addresses are the same, this is a no-op */
	747	+ if (ether_addr_equal(dev->dev_addr, addr->sa_data))
	748	+ return 0;
	749	+
706	750	if (vlan->mode == MACVLAN_MODE_PASSTHRU) {
	751	+ macvlan_set_addr_change(vlan->port);
707	752	dev_set_mac_address(vlan->lowerdev, addr);
708	753	return 0;
709	754	}
@@ -928,7 +973,7 @@ static int macvlan_fdb_add(struct ndmsg ndm, struct nlattr tb[], · 218 unmodified lines
928	973	/* Support unicast filter only on passthru devices.
929	974	* Multicast filter should be allowed on all devices.
930	975	*/
931		− if (!vlan->port->passthru && is_unicast_ether_addr(addr))
	976	+ if (!macvlan_passthru(vlan->port) && is_unicast_ether_addr(addr))
932	977	return -EOPNOTSUPP;
933	978
934	979	if (flags & NLM_F_REPLACE)
@@ -952,7 +997,7 @@ static int macvlan_fdb_del(struct ndmsg ndm, struct nlattr tb[], · 17 unmodified lines
952	997	/* Support unicast filter only on passthru devices.
953	998	* Multicast filter should be allowed on all devices.
954	999	*/
955		− if (!vlan->port->passthru && is_unicast_ether_addr(addr))
	1000	+ if (!macvlan_passthru(vlan->port) && is_unicast_ether_addr(addr))
956	1001	return -EOPNOTSUPP;
957	1002
958	1003	if (is_unicast_ether_addr(addr))
@@ -1120,8 +1165,8 @@ static int macvlan_port_create(struct net_device *dev) · 161 unmodified lines
1120	1165	if (port == NULL)
1121	1166	return -ENOMEM;
1122	1167
1123		− port->passthru = false;
1124	1168	port->dev = dev;
	1169	+ ether_addr_copy(port->perm_addr, dev->dev_addr);
1125	1170	INIT_LIST_HEAD(&port->vlans);
1126	1171	for (i = 0; i < MACVLAN_HASH_SIZE; i++)
1127	1172	INIT_HLIST_HEAD(&port->vlan_hash[i]);
@@ -1161,6 +1206,18 @@ static void macvlan_port_destroy(struct net_device *dev) · 33 unmodified lines
1161	1206	kfree_skb(skb);
1162	1207	}
1163	1208
	1209	+ /* If the lower device address has been changed by passthru
	1210	+ * macvlan, put it back.
	1211	+ */
	1212	+ if (macvlan_passthru(port) &&
	1213	+ !ether_addr_equal(port->dev->dev_addr, port->perm_addr)) {
	1214	+ struct sockaddr sa;
	1215	+
	1216	+ sa.sa_family = port->dev->type;
	1217	+ memcpy(&sa.sa_data, port->perm_addr, port->dev->addr_len);
	1218	+ dev_set_mac_address(port->dev, &sa);
	1219	+ }
	1220	+
1164	1221	kfree(port);
1165	1222	}
1166	1223
@@ -1326,7 +1383,7 @@ int macvlan_common_newlink(struct net src_net, struct net_device dev, · 159 unmodified lines
1326	1383	port = macvlan_port_get_rtnl(lowerdev);
1327	1384
1328	1385	/* Only 1 macvlan device can be created in passthru mode */
1329		− if (port->passthru) {
	1386	+ if (macvlan_passthru(port)) {
1330	1387	/* The macvlan port must be not created this time,
1331	1388	* still goto destroy_macvlan_port for readability.
1332	1389	*/
@@ -1352,7 +1409,7 @@ int macvlan_common_newlink(struct net src_net, struct net_device dev, · 19 unmodified lines
1352	1409	err = -EINVAL;
1353	1410	goto destroy_macvlan_port;
1354	1411	}
1355		− port->passthru = true;
	1412	+ macvlan_set_passthru(port);
1356	1413	eth_hw_addr_inherit(dev, lowerdev);
1357	1414	}
1358	1415
@@ -1434,7 +1491,7 @@ static int macvlan_changelink(struct net_device *dev, · 75 unmodified lines
1434	1491	if (data && data[IFLA_MACVLAN_FLAGS]) {
1435	1492	__u16 flags = nla_get_u16(data[IFLA_MACVLAN_FLAGS]);
1436	1493	bool promisc = (flags ^ vlan->flags) & MACVLAN_FLAG_NOPROMISC;
1437		− if (vlan->port->passthru && promisc) {
	1494	+ if (macvlan_passthru(vlan->port) && promisc) {
1438	1495	int err;
1439	1496
1440	1497	if (flags & MACVLAN_FLAG_NOPROMISC)
@@ -1597,7 +1654,7 @@ static int macvlan_device_event(struct notifier_block *unused, · 156 unmodified lines
1597	1654	}
1598	1655	break;
1599	1656	case NETDEV_CHANGEADDR:
1600		− if (!port->passthru)
	1657	+ if (!macvlan_passthru(port))
1601	1658	return NOTIFY_DONE;
1602	1659
1603	1660	vlan = list_first_entry_or_null(&port->vlans,

drivers/net/phy/dp83640.c+1−1

@@ -908,7 +908,7 @@ static void decode_txts(struct dp83640_private *dp83640, · 907 unmodified lines
908	908	if (overflow) {
909	909	pr_debug("tx timestamp queue overflow, count %d\n", overflow);
910	910	while (skb) {
911		− skb_complete_tx_timestamp(skb, NULL);
	911	+ kfree_skb(skb);
912	912	skb = skb_dequeue(&dp83640->tx_queue);
913	913	}
914	914	return;

drivers/net/phy/micrel.c+2−0

@@ -619,6 +619,8 @@ static int ksz9031_read_status(struct phy_device *phydev) · 618 unmodified lines
619	619	if ((regval & 0xFF) == 0xFF) {
620	620	phy_init_hw(phydev);
621	621	phydev->link = 0;
	622	+ if (phydev->drv->config_intr && phy_interrupt_is_valid(phydev))
	623	+ phydev->drv->config_intr(phydev);
622	624	}
623	625
624	626	return 0;

drivers/net/usb/ax88179_178a.c+16−0

@@ -1722,6 +1722,18 @@ static const struct driver_info lenovo_info = { · 1721 unmodified lines
1722	1722	.tx_fixup = ax88179_tx_fixup,
1723	1723	};
1724	1724
	1725	+static const struct driver_info belkin_info = {
	1726	+ .description = "Belkin USB Ethernet Adapter",
	1727	+ .bind = ax88179_bind,
	1728	+ .unbind = ax88179_unbind,
	1729	+ .status = ax88179_status,
	1730	+ .link_reset = ax88179_link_reset,
	1731	+ .reset = ax88179_reset,
	1732	+ .flags = FLAG_ETHER \| FLAG_FRAMING_AX,
	1733	+ .rx_fixup = ax88179_rx_fixup,
	1734	+ .tx_fixup = ax88179_tx_fixup,
	1735	+};
	1736	+
1725	1737	static const struct usb_device_id products[] = {
1726	1738	{
1727	1739	/* ASIX AX88179 10/100/1000 */
@@ -1751,6 +1763,10 @@ static const struct usb_device_id products[] = { · 23 unmodified lines
1751	1763	/* Lenovo OneLinkDock Gigabit LAN */
1752	1764	USB_DEVICE(0x17ef, 0x304b),
1753	1765	.driver_info = (unsigned long)&lenovo_info,
	1766	+}, {
	1767	+ /* Belkin B2B128 USB 3.0 Hub + Gigabit Ethernet Adapter */
	1768	+ USB_DEVICE(0x050d, 0x0128),
	1769	+ .driver_info = (unsigned long)&belkin_info,
1754	1770	},
1755	1771	{ },
1756	1772	};

drivers/net/veth.c+2−2

@@ -383,7 +383,7 @@ static int veth_newlink(struct net src_net, struct net_device dev, · 382 unmodified lines
383	383	tbp = tb;
384	384	}
385	385
386		− if (tbp[IFLA_IFNAME]) {
	386	+ if (ifmp && tbp[IFLA_IFNAME]) {
387	387	nla_strlcpy(ifname, tbp[IFLA_IFNAME], IFNAMSIZ);
388	388	name_assign_type = NET_NAME_USER;
389	389	} else {
@@ -402,7 +402,7 @@ static int veth_newlink(struct net src_net, struct net_device dev, · 12 unmodified lines
402	402	return PTR_ERR(peer);
403	403	}
404	404
405		− if (tbp[IFLA_ADDRESS] == NULL)
	405	+ if (!ifmp \|\| !tbp[IFLA_ADDRESS])
406	406	eth_hw_addr_random(peer);
407	407
408	408	if (ifmp && (dev->ifindex != 0))

drivers/net/virtio_net.c+1−0

@@ -1797,6 +1797,7 @@ static void virtnet_freeze_down(struct virtio_device *vdev) · 1796 unmodified lines
1797	1797	flush_work(&vi->config_work);
1798	1798
1799	1799	netif_device_detach(vi->dev);
	1800	+ netif_tx_disable(vi->dev);
1800	1801	cancel_delayed_work_sync(&vi->refill);
1801	1802
1802	1803	if (netif_running(vi->dev)) {

drivers/net/xen-netback/common.h+1−0

@@ -199,6 +199,7 @@ struct xenvif_queue { /* Per-queue data for xenvif */ · 198 unmodified lines
199	199	unsigned long remaining_credit;
200	200	struct timer_list credit_timeout;
201	201	u64 credit_window_start;
	202	+ bool rate_limited;
202	203
203	204	/* Statistics */
204	205	struct xenvif_stats stats;

drivers/net/xen-netback/interface.c+5−1

@@ -106,7 +106,11 @@ static int xenvif_poll(struct napi_struct *napi, int budget) · 105 unmodified lines
106	106
107	107	if (work_done < budget) {
108	108	napi_complete_done(napi, work_done);
109		− xenvif_napi_schedule_or_enable_events(queue);
	109	+ /* If the queue is rate-limited, it shall be
	110	+ * rescheduled in the timer callback.
	111	+ */
	112	+ if (likely(!queue->rate_limited))
	113	+ xenvif_napi_schedule_or_enable_events(queue);
110	114	}
111	115
112	116	return work_done;

drivers/net/xen-netback/netback.c+5−1

@@ -180,6 +180,7 @@ static void tx_add_credit(struct xenvif_queue *queue) · 179 unmodified lines
180	180	max_credit = ULONG_MAX; /* wrapped: clamp to ULONG_MAX */
181	181
182	182	queue->remaining_credit = min(max_credit, max_burst);
	183	+ queue->rate_limited = false;
183	184	}
184	185
185	186	void xenvif_tx_credit_callback(unsigned long data)
@@ -686,8 +687,10 @@ static bool tx_credit_exceeded(struct xenvif_queue *queue, unsigned size) · 500 unmodified lines
686	687	msecs_to_jiffies(queue->credit_usec / 1000);
687	688
688	689	/* Timer could already be pending in rare cases. */
689		− if (timer_pending(&queue->credit_timeout))
	690	+ if (timer_pending(&queue->credit_timeout)) {
	691	+ queue->rate_limited = true;
690	692	return true;
	693	+ }
691	694
692	695	/* Passed the point where we can replenish credit? */
693	696	if (time_after_eq64(now, next_credit)) {
@@ -702,6 +705,7 @@ static bool tx_credit_exceeded(struct xenvif_queue *queue, unsigned size) · 8 unmodified lines
702	705	mod_timer(&queue->credit_timeout,
703	706	next_credit);
704	707	queue->credit_window_start = next_credit;
	708	+ queue->rate_limited = true;
705	709
706	710	return true;
707	711	}

include/net/xfrm.h+2−5

@@ -1850,8 +1850,9 @@ static inline struct xfrm_offload xfrm_offload(struct sk_buff skb) · 1849 unmodified lines
1850	1850	}
1851	1851	#endif
1852	1852
1853		−#ifdef CONFIG_XFRM_OFFLOAD
1854	1853	void __net_init xfrm_dev_init(void);
	1854	+
	1855	+#ifdef CONFIG_XFRM_OFFLOAD
1855	1856	int validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features);
1856	1857	int xfrm_dev_state_add(struct net net, struct xfrm_state x,
1857	1858	struct xfrm_user_offload *xuo);
@@ -1877,10 +1878,6 @@ static inline void xfrm_dev_state_free(struct xfrm_state *x) · 19 unmodified lines
1877	1878	}
1878	1879	}
1879	1880	#else
1880		−static inline void __net_init xfrm_dev_init(void)
1881		−{
1882		−}
1883		−
1884	1881	static inline int validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features)
1885	1882	{
1886	1883	return 0;

kernel/bpf/verifier.c+5−0

@@ -989,6 +989,11 @@ static int check_xadd(struct bpf_verifier_env env, struct bpf_insn insn) · 988 unmodified lines
989	989	if (err)
990	990	return err;
991	991
	992	+ if (is_pointer_value(env, insn->src_reg)) {
	993	+ verbose("R%d leaks addr into mem\n", insn->src_reg);
	994	+ return -EACCES;
	995	+ }
	996	+
992	997	/* check whether atomic_add can read the memory */
993	998	err = check_mem_access(env, insn->dst_reg, insn->off,
994	999	BPF_SIZE(insn->code), BPF_READ, -1);

net/core/dev.c+20−10

@@ -4767,6 +4767,13 @@ struct packet_offload *gro_find_complete_by_type(__be16 type) · 4766 unmodified lines
4767	4767	}
4768	4768	EXPORT_SYMBOL(gro_find_complete_by_type);
4769	4769
	4770	+static void napi_skb_free_stolen_head(struct sk_buff *skb)
	4771	+{
	4772	+ skb_dst_drop(skb);
	4773	+ secpath_reset(skb);
	4774	+ kmem_cache_free(skbuff_head_cache, skb);
	4775	+}
	4776	+
4770	4777	static gro_result_t napi_skb_finish(gro_result_t ret, struct sk_buff *skb)
4771	4778	{
4772	4779	switch (ret) {
@@ -4780,13 +4787,10 @@ static gro_result_t napi_skb_finish(gro_result_t ret, struct sk_buff *skb) · 7 unmodified lines
4780	4787	break;
4781	4788
4782	4789	case GRO_MERGED_FREE:
4783		− if (NAPI_GRO_CB(skb)->free == NAPI_GRO_FREE_STOLEN_HEAD) {
4784		− skb_dst_drop(skb);
4785		− secpath_reset(skb);
4786		− kmem_cache_free(skbuff_head_cache, skb);
4787		− } else {
	4790	+ if (NAPI_GRO_CB(skb)->free == NAPI_GRO_FREE_STOLEN_HEAD)
	4791	+ napi_skb_free_stolen_head(skb);
	4792	+ else
4788	4793	__kfree_skb(skb);
4789		− }
4790	4794	break;
4791	4795
4792	4796	case GRO_HELD:
@@ -4858,10 +4862,16 @@ static gro_result_t napi_frags_finish(struct napi_struct *napi, · 65 unmodified lines
4858	4862	break;
4859	4863
4860	4864	case GRO_DROP:
4861		− case GRO_MERGED_FREE:
4862	4865	napi_reuse_skb(napi, skb);
4863	4866	break;
4864	4867
	4868	+ case GRO_MERGED_FREE:
	4869	+ if (NAPI_GRO_CB(skb)->free == NAPI_GRO_FREE_STOLEN_HEAD)
	4870	+ napi_skb_free_stolen_head(skb);
	4871	+ else
	4872	+ napi_reuse_skb(napi, skb);
	4873	+ break;
	4874	+
4865	4875	case GRO_MERGED:
4866	4876	case GRO_CONSUMED:
4867	4877	break;
@@ -7783,9 +7793,9 @@ struct rtnl_link_stats64 dev_get_stats(struct net_device dev, · 2915 unmodified lines
7783	7793	} else {
7784	7794	netdev_stats_to_stats64(storage, &dev->stats);
7785	7795	}
7786		− storage->rx_dropped += atomic_long_read(&dev->rx_dropped);
7787		− storage->tx_dropped += atomic_long_read(&dev->tx_dropped);
7788		− storage->rx_nohandler += atomic_long_read(&dev->rx_nohandler);
	7796	+ storage->rx_dropped += (unsigned long)atomic_long_read(&dev->rx_dropped);
	7797	+ storage->tx_dropped += (unsigned long)atomic_long_read(&dev->tx_dropped);
	7798	+ storage->rx_nohandler += (unsigned long)atomic_long_read(&dev->rx_nohandler);
7789	7799	return storage;
7790	7800	}
7791	7801	EXPORT_SYMBOL(dev_get_stats);

net/ipv4/ip_output.c+2−1

@@ -964,7 +964,8 @@ static int __ip_append_data(struct sock *sk, · 963 unmodified lines
964	964	csummode = CHECKSUM_PARTIAL;
965	965
966	966	cork->length += length;
967		− if ((((length + fragheaderlen) > mtu) \|\| (skb && skb_is_gso(skb))) &&
	967	+ if ((((length + (skb ? skb->len : fragheaderlen)) > mtu) \|\|
	968	+ (skb && skb_is_gso(skb))) &&
968	969	(sk->sk_protocol == IPPROTO_UDP) &&
969	970	(rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
970	971	(sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx) {

net/ipv4/tcp.c+2−0

@@ -2330,6 +2330,8 @@ int tcp_disconnect(struct sock *sk, int flags) · 2329 unmodified lines
2330	2330	tcp_init_send_head(sk);
2331	2331	memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
2332	2332	__sk_dst_reset(sk);
	2333	+ dst_release(sk->sk_rx_dst);
	2334	+ sk->sk_rx_dst = NULL;
2333	2335	tcp_saved_syn_free(tp);
2334	2336
2335	2337	/* Clean up fastopen related fields */

net/ipv6/addrconf.c+3−2

@@ -3369,6 +3369,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event, · 3368 unmodified lines
3369	3369	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
3370	3370	struct netdev_notifier_changeupper_info *info;
3371	3371	struct inet6_dev *idev = __in6_dev_get(dev);
	3372	+ struct net *net = dev_net(dev);
3372	3373	int run_pending = 0;
3373	3374	int err;
3374	3375
@@ -3384,7 +3385,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event, · 9 unmodified lines
3384	3385	case NETDEV_CHANGEMTU:
3385	3386	/* if MTU under IPV6_MIN_MTU stop IPv6 on this interface. */
3386	3387	if (dev->mtu < IPV6_MIN_MTU) {
3387		− addrconf_ifdown(dev, 1);
	3388	+ addrconf_ifdown(dev, dev != net->loopback_dev);
3388	3389	break;
3389	3390	}
3390	3391
@@ -3500,7 +3501,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event, · 109 unmodified lines
3500	3501	* IPV6_MIN_MTU stop IPv6 on this interface.
3501	3502	*/
3502	3503	if (dev->mtu < IPV6_MIN_MTU)
3503		− addrconf_ifdown(dev, 1);
	3504	+ addrconf_ifdown(dev, dev != net->loopback_dev);
3504	3505	}
3505	3506	break;
3506	3507

net/ipv6/datagram.c+7−1

@@ -250,8 +250,14 @@ ipv4_connected: · 249 unmodified lines
250	250	*/
251	251
252	252	err = ip6_datagram_dst_update(sk, true);
253		− if (err)
	253	+ if (err) {
	254	+ /* Reset daddr and dport so that udp_v6_early_demux()
	255	+ * fails to find this socket
	256	+ */
	257	+ memset(&sk->sk_v6_daddr, 0, sizeof(sk->sk_v6_daddr));
	258	+ inet->inet_dport = 0;
254	259	goto out;
	260	+ }
255	261
256	262	sk->sk_state = TCP_ESTABLISHED;
257	263	sk_set_txhash(sk);

net/ipv6/esp6_offload.c+25−0

@@ -30,6 +30,25 @@ · 29 unmodified lines
30	30	#include <net/ipv6.h>
31	31	#include <linux/icmpv6.h>
32	32
	33	+static __u16 esp6_nexthdr_esp_offset(struct ipv6hdr *ipv6_hdr, int nhlen)
	34	+{
	35	+ int off = sizeof(struct ipv6hdr);
	36	+ struct ipv6_opt_hdr *exthdr;
	37	+
	38	+ if (likely(ipv6_hdr->nexthdr == NEXTHDR_ESP))
	39	+ return offsetof(struct ipv6hdr, nexthdr);
	40	+
	41	+ while (off < nhlen) {
	42	+ exthdr = (void *)ipv6_hdr + off;
	43	+ if (exthdr->nexthdr == NEXTHDR_ESP)
	44	+ return off;
	45	+
	46	+ off += ipv6_optlen(exthdr);
	47	+ }
	48	+
	49	+ return 0;
	50	+}
	51	+
33	52	static struct sk_buff esp6_gro_receive(struct sk_buff head,
34	53	struct sk_buff *skb)
35	54	{
@@ -38,6 +57,7 @@ static struct sk_buff esp6_gro_receive(struct sk_buff head, · 2 unmodified lines
38	57	struct xfrm_state *x;
39	58	__be32 seq;
40	59	__be32 spi;
	60	+ int nhoff;
41	61	int err;
42	62
43	63	skb_pull(skb, offset);
@@ -72,6 +92,11 @@ static struct sk_buff esp6_gro_receive(struct sk_buff head, · 28 unmodified lines
72	92
73	93	xo->flags \|= XFRM_GRO;
74	94
	95	+ nhoff = esp6_nexthdr_esp_offset(ipv6_hdr(skb), offset);
	96	+ if (!nhoff)
	97	+ goto out;
	98	+
	99	+ IP6CB(skb)->nhoff = nhoff;
75	100	XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = NULL;
76	101	XFRM_SPI_SKB_CB(skb)->family = AF_INET6;
77	102	XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr);

net/ipv6/ip6_output.c+1−1

@@ -1390,7 +1390,7 @@ emsgsize: · 1389 unmodified lines
1390	1390	*/
1391	1391
1392	1392	cork->length += length;
1393		− if ((((length + fragheaderlen) > mtu) \|\|
	1393	+ if ((((length + (skb ? skb->len : headersize)) > mtu) \|\|
1394	1394	(skb && skb_is_gso(skb))) &&
1395	1395	(sk->sk_protocol == IPPROTO_UDP) &&
1396	1396	(rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&

net/ipv6/route.c+5−1

@@ -3722,7 +3722,11 @@ static int ip6_route_dev_notify(struct notifier_block *this, · 3721 unmodified lines
3722	3722	net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
3723	3723	net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
3724	3724	#endif
3725		− } else if (event == NETDEV_UNREGISTER) {
	3725	+ } else if (event == NETDEV_UNREGISTER &&
	3726	+ dev->reg_state != NETREG_UNREGISTERED) {
	3727	+ /* NETDEV_UNREGISTER could be fired for multiple times by
	3728	+ * netdev_wait_allrefs(). Make sure we only call this once.
	3729	+ */
3726	3730	in6_dev_put(net->ipv6.ip6_null_entry->rt6i_idev);
3727	3731	#ifdef CONFIG_IPV6_MULTIPLE_TABLES
3728	3732	in6_dev_put(net->ipv6.ip6_prohibit_entry->rt6i_idev);

net/ipv6/sit.c+1−1

@@ -305,7 +305,7 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t, · 304 unmodified lines
305	305	* we try harder to allocate.
306	306	*/
307	307	kp = (cmax <= 1 \|\| capable(CAP_NET_ADMIN)) ?
308		− kcalloc(cmax, sizeof(*kp), GFP_KERNEL) :
	308	+ kcalloc(cmax, sizeof(*kp), GFP_KERNEL \| __GFP_NOWARN) :
309	309	NULL;
310	310
311	311	rcu_read_lock();

net/ipv6/udp.c+2−1

@@ -879,7 +879,8 @@ static struct sock __udp6_lib_demux_lookup(struct net net, · 878 unmodified lines
879	879	struct sock *sk;
880	880
881	881	udp_portaddr_for_each_entry_rcu(sk, &hslot2->head) {
882		− if (INET6_MATCH(sk, net, rmt_addr, loc_addr, ports, dif))
	882	+ if (sk->sk_state == TCP_ESTABLISHED &&
	883	+ INET6_MATCH(sk, net, rmt_addr, loc_addr, ports, dif))
883	884	return sk;
884	885	/* Only check first socket in chain */
885	886	break;

net/ipv6/xfrm6_input.c+1−1

@@ -43,8 +43,8 @@ int xfrm6_transport_finish(struct sk_buff *skb, int async) · 42 unmodified lines
43	43	return 1;
44	44	#endif
45	45
46		− ipv6_hdr(skb)->payload_len = htons(skb->len);
47	46	__skb_push(skb, skb->data - skb_network_header(skb));
	47	+ ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr));
48	48
49	49	if (xo && (xo->flags & XFRM_GRO)) {
50	50	skb_mac_header_rebuild(skb);

net/key/af_key.c+15−4

@@ -1157,6 +1157,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net, · 1156 unmodified lines
1157	1157	goto out;
1158	1158	}
1159	1159
	1160	+ err = -ENOBUFS;
1160	1161	key = ext_hdrs[SADB_EXT_KEY_AUTH - 1];
1161	1162	if (sa->sadb_sa_auth) {
1162	1163	int keysize = 0;
@@ -1168,8 +1169,10 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net, · 5 unmodified lines
1168	1169	if (key)
1169	1170	keysize = (key->sadb_key_bits + 7) / 8;
1170	1171	x->aalg = kmalloc(sizeof(*x->aalg) + keysize, GFP_KERNEL);
1171		− if (!x->aalg)
	1172	+ if (!x->aalg) {
	1173	+ err = -ENOMEM;
1172	1174	goto out;
	1175	+ }
1173	1176	strcpy(x->aalg->alg_name, a->name);
1174	1177	x->aalg->alg_key_len = 0;
1175	1178	if (key) {
@@ -1188,8 +1191,10 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net, · 12 unmodified lines
1188	1191	goto out;
1189	1192	}
1190	1193	x->calg = kmalloc(sizeof(*x->calg), GFP_KERNEL);
1191		− if (!x->calg)
	1194	+ if (!x->calg) {
	1195	+ err = -ENOMEM;
1192	1196	goto out;
	1197	+ }
1193	1198	strcpy(x->calg->alg_name, a->name);
1194	1199	x->props.calgo = sa->sadb_sa_encrypt;
1195	1200	} else {
@@ -1203,8 +1208,10 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net, · 7 unmodified lines
1203	1208	if (key)
1204	1209	keysize = (key->sadb_key_bits + 7) / 8;
1205	1210	x->ealg = kmalloc(sizeof(*x->ealg) + keysize, GFP_KERNEL);
1206		− if (!x->ealg)
	1211	+ if (!x->ealg) {
	1212	+ err = -ENOMEM;
1207	1213	goto out;
	1214	+ }
1208	1215	strcpy(x->ealg->alg_name, a->name);
1209	1216	x->ealg->alg_key_len = 0;
1210	1217	if (key) {
@@ -1249,8 +1256,10 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net, · 38 unmodified lines
1249	1256	struct xfrm_encap_tmpl *natt;
1250	1257
1251	1258	x->encap = kmalloc(sizeof(*x->encap), GFP_KERNEL);
1252		− if (!x->encap)
	1259	+ if (!x->encap) {
	1260	+ err = -ENOMEM;
1253	1261	goto out;
	1262	+ }
1254	1263
1255	1264	natt = x->encap;
1256	1265	n_type = ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1];
@@ -2755,6 +2764,8 @@ static int pfkey_spdflush(struct sock sk, struct sk_buff skb, const struct sad · 1498 unmodified lines
2755	2764	int err, err2;
2756	2765
2757	2766	err = xfrm_policy_flush(net, XFRM_POLICY_TYPE_MAIN, true);
	2767	+ if (!err)
	2768	+ xfrm_garbage_collect(net);
2758	2769	err2 = unicast_flush_resp(sk, hdr);
2759	2770	if (err \|\| err2) {
2760	2771	if (err == -ESRCH) /* empty table - old silent behavior */

net/sched/sch_api.c+2−1

@@ -1019,7 +1019,8 @@ static struct Qdisc qdisc_create(struct net_device dev, · 1018 unmodified lines
1019	1019	return sch;
1020	1020	}
1021	1021	/* ops->init() failed, we call ->destroy() like qdisc_create_dflt() */
1022		− ops->destroy(sch);
	1022	+ if (ops->destroy)
	1023	+ ops->destroy(sch);
1023	1024	err_out3:
1024	1025	dev_put(dev);
1025	1026	kfree((char *) sch - sch->padded);

net/xfrm/Makefile+1−2

@@ -4,8 +4,7 @@ · 3 unmodified lines
4	4
5	5	obj-$(CONFIG_XFRM) := xfrm_policy.o xfrm_state.o xfrm_hash.o \
6	6	xfrm_input.o xfrm_output.o \
7		− xfrm_sysctl.o xfrm_replay.o
8		−obj-$(CONFIG_XFRM_OFFLOAD) += xfrm_device.o
	7	+ xfrm_sysctl.o xfrm_replay.o xfrm_device.o
9	8	obj-$(CONFIG_XFRM_STATISTICS) += xfrm_proc.o
10	9	obj-$(CONFIG_XFRM_ALGO) += xfrm_algo.o
11	10	obj-$(CONFIG_XFRM_USER) += xfrm_user.o

net/xfrm/xfrm_device.c+2−0

@@ -22,6 +22,7 @@ · 21 unmodified lines
22	22	#include <net/xfrm.h>
23	23	#include <linux/notifier.h>
24	24
	25	+#ifdef CONFIG_XFRM_OFFLOAD
25	26	int validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features)
26	27	{
27	28	int err;
@@ -137,6 +138,7 @@ ok: · 109 unmodified lines
137	138	return true;
138	139	}
139	140	EXPORT_SYMBOL_GPL(xfrm_dev_offload_ok);
	141	+#endif
140	142
141	143	int xfrm_dev_register(struct net_device *dev)
142	144	{

net/xfrm/xfrm_policy.c+0−4

@@ -1006,10 +1006,6 @@ int xfrm_policy_flush(struct net *net, u8 type, bool task_valid) · 1005 unmodified lines
1006	1006	err = -ESRCH;
1007	1007	out:
1008	1008	spin_unlock_bh(&net->xfrm.xfrm_policy_lock);
1009		−
1010		− if (cnt)
1011		− xfrm_garbage_collect(net);
1012		−
1013	1009	return err;
1014	1010	}
1015	1011	EXPORT_SYMBOL(xfrm_policy_flush);

net/xfrm/xfrm_user.c+1−0

@@ -2027,6 +2027,7 @@ static int xfrm_flush_policy(struct sk_buff skb, struct nlmsghdr nlh, · 2026 unmodified lines
2027	2027	return 0;
2028	2028	return err;
2029	2029	}
	2030	+ xfrm_garbage_collect(net);
2030	2031
2031	2032	c.data.type = type;
2032	2033	c.event = nlh->nlmsg_type;

tools/testing/selftests/bpf/test_verifier.c+66−0

@@ -3748,6 +3748,72 @@ static struct bpf_test tests[] = { · 3747 unmodified lines
3748	3748	.result = REJECT,
3749	3749	.errstr = "invalid bpf_context access",
3750	3750	},
	3751	+ {
	3752	+ "leak pointer into ctx 1",
	3753	+ .insns = {
	3754	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	3755	+ BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
	3756	+ offsetof(struct __sk_buff, cb[0])),
	3757	+ BPF_LD_MAP_FD(BPF_REG_2, 0),
	3758	+ BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_2,
	3759	+ offsetof(struct __sk_buff, cb[0])),
	3760	+ BPF_EXIT_INSN(),
	3761	+ },
	3762	+ .fixup_map1 = { 2 },
	3763	+ .errstr_unpriv = "R2 leaks addr into mem",
	3764	+ .result_unpriv = REJECT,
	3765	+ .result = ACCEPT,
	3766	+ },
	3767	+ {
	3768	+ "leak pointer into ctx 2",
	3769	+ .insns = {
	3770	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	3771	+ BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
	3772	+ offsetof(struct __sk_buff, cb[0])),
	3773	+ BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_10,
	3774	+ offsetof(struct __sk_buff, cb[0])),
	3775	+ BPF_EXIT_INSN(),
	3776	+ },
	3777	+ .errstr_unpriv = "R10 leaks addr into mem",
	3778	+ .result_unpriv = REJECT,
	3779	+ .result = ACCEPT,
	3780	+ },
	3781	+ {
	3782	+ "leak pointer into ctx 3",
	3783	+ .insns = {
	3784	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	3785	+ BPF_LD_MAP_FD(BPF_REG_2, 0),
	3786	+ BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2,
	3787	+ offsetof(struct __sk_buff, cb[0])),
	3788	+ BPF_EXIT_INSN(),
	3789	+ },
	3790	+ .fixup_map1 = { 1 },
	3791	+ .errstr_unpriv = "R2 leaks addr into ctx",
	3792	+ .result_unpriv = REJECT,
	3793	+ .result = ACCEPT,
	3794	+ },
	3795	+ {
	3796	+ "leak pointer into map val",
	3797	+ .insns = {
	3798	+ BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
	3799	+ BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
	3800	+ BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
	3801	+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
	3802	+ BPF_LD_MAP_FD(BPF_REG_1, 0),
	3803	+ BPF_RAW_INSN(BPF_JMP \| BPF_CALL, 0, 0, 0,
	3804	+ BPF_FUNC_map_lookup_elem),
	3805	+ BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
	3806	+ BPF_MOV64_IMM(BPF_REG_3, 0),
	3807	+ BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
	3808	+ BPF_STX_XADD(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
	3809	+ BPF_MOV64_IMM(BPF_REG_0, 0),
	3810	+ BPF_EXIT_INSN(),
	3811	+ },
	3812	+ .fixup_map1 = { 4 },
	3813	+ .errstr_unpriv = "R6 leaks addr into mem",
	3814	+ .result_unpriv = REJECT,
	3815	+ .result = ACCEPT,
	3816	+ },
3751	3817	{
3752	3818	"helper access to map: full range",
3753	3819	.insns = {