Pull networking fixes from Paolo Abeni: "Including fixes from Bluetooth, IPsec and CAN. No known regressions at this point. Current release - regressions: - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI Previous releases - regressions: - xfrm: fix offloading of cross-family tunnels - bluetooth: fix several races leading to UaFs - dsa: lantiq_gswip: fix FDB entries creation for the CPU port - eth: - tun: update napi->skb after XDP process - mlx: fix UAF in flow counter release Previous releases - always broken: - core: forbid FDB status change while nexthop is in a group - smc: fix warning in smc_rx_splice() when calling get_page() - can: provide missing ndo_change_mtu(), to prevent buffer overflow. - eth: - i40e: fix VF config validation - broadcom: fix support for PTP_EXTTS_REQUEST2 ioctl" * tag 'net-6.17-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (40 commits) octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() libie: fix string names for AQ error codes net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD net/mlx5: HWS, ignore flow level for multi-dest table net/mlx5: fs, fix UAF in flow counter release selftests: fib_nexthops: Add test cases for FDB status change selftests: fib_nexthops: Fix creation of non-FDB nexthops nexthop: Forbid FDB status change while nexthop is in a group net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS bnxt_en: correct offset handling for IPv6 destination address ptp: document behavior of PTP_STRICT_FLAGS broadcom: fix support for PTP_EXTTS_REQUEST2 ioctl broadcom: fix support for PTP_PEROUT_DUTY_CYCLE Bluetooth: MGMT: Fix possible UAFs Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue Bluetooth: hci_sync: Fix hci_resume_advertising_sync Bluetooth: Fix build after header cleanup ...
Showing the changes to include (3 of 41 files). Show all
Unified · Split
| @@ -308,6 +308,8 @@ struct mlx5_fc *mlx5_fc_create(struct mlx5_core_dev *dev, bool aging); · 307 unmodified lines | |||
| 308 | void mlx5_fc_destroy(struct mlx5_core_dev *dev, struct mlx5_fc *counter); | 308 | void mlx5_fc_destroy(struct mlx5_core_dev *dev, struct mlx5_fc *counter); |
| 309 | struct mlx5_fc *mlx5_fc_local_create(u32 counter_id, u32 offset, u32 bulk_size); | 309 | struct mlx5_fc *mlx5_fc_local_create(u32 counter_id, u32 offset, u32 bulk_size); |
| 310 | void mlx5_fc_local_destroy(struct mlx5_fc *counter); | 310 | void mlx5_fc_local_destroy(struct mlx5_fc *counter); |
| 311 | void mlx5_fc_local_get(struct mlx5_fc *counter); | ||
| 312 | void mlx5_fc_local_put(struct mlx5_fc *counter); | ||
| 311 | u64 mlx5_fc_query_lastuse(struct mlx5_fc *counter); | 313 | u64 mlx5_fc_query_lastuse(struct mlx5_fc *counter); |
| 312 | void mlx5_fc_query_cached(struct mlx5_fc *counter, | 314 | void mlx5_fc_query_cached(struct mlx5_fc *counter, |
| 313 | u64 *bytes, u64 *packets, u64 *lastuse); | 315 | u64 *bytes, u64 *packets, u64 *lastuse); |
| @@ -1245,6 +1245,27 @@ static inline struct hci_conn *hci_conn_hash_lookup_ba(struct hci_dev *hdev, · 1244 unmodified lines | |||
| 1245 | return NULL; | 1245 | return NULL; |
| 1246 | } | 1246 | } |
| 1247 | 1247 | ||
| 1248 | static inline struct hci_conn *hci_conn_hash_lookup_role(struct hci_dev *hdev, | ||
| 1249 | __u8 type, __u8 role, | ||
| 1250 | bdaddr_t *ba) | ||
| 1251 | { | ||
| 1252 | struct hci_conn_hash *h = &hdev->conn_hash; | ||
| 1253 | struct hci_conn *c; | ||
| 1254 | |||
| 1255 | rcu_read_lock(); | ||
| 1256 | |||
| 1257 | list_for_each_entry_rcu(c, &h->list, list) { | ||
| 1258 | if (c->type == type && c->role == role && !bacmp(&c->dst, ba)) { | ||
| 1259 | rcu_read_unlock(); | ||
| 1260 | return c; | ||
| 1261 | } | ||
| 1262 | } | ||
| 1263 | |||
| 1264 | rcu_read_unlock(); | ||
| 1265 | |||
| 1266 | return NULL; | ||
| 1267 | } | ||
| 1268 | |||
| 1248 | static inline struct hci_conn *hci_conn_hash_lookup_le(struct hci_dev *hdev, | 1269 | static inline struct hci_conn *hci_conn_hash_lookup_le(struct hci_dev *hdev, |
| 1249 | bdaddr_t *ba, | 1270 | bdaddr_t *ba, |
| 1250 | __u8 ba_type) | 1271 | __u8 ba_type) |
| @@ -37,6 +37,9 @@ · 36 unmodified lines | |||
| 37 | 37 | ||
| 38 | /* | 38 | /* |
| 39 | * flag fields valid for the new PTP_EXTTS_REQUEST2 ioctl. | 39 | * flag fields valid for the new PTP_EXTTS_REQUEST2 ioctl. |
| 40 | * | ||
| 41 | * Note: PTP_STRICT_FLAGS is always enabled by the kernel for | ||
| 42 | * PTP_EXTTS_REQUEST2 regardless of whether it is set by userspace. | ||
| 40 | */ | 43 | */ |
| 41 | #define PTP_EXTTS_VALID_FLAGS (PTP_ENABLE_FEATURE | \ | 44 | #define PTP_EXTTS_VALID_FLAGS (PTP_ENABLE_FEATURE | \ |
| 42 | PTP_RISING_EDGE | \ | 45 | PTP_RISING_EDGE | \ |