lael-labs/linux

.mailmap+3−0

 Johan Hovold <johan@kernel.org> <jhovold@gmail.com>
 Johan Hovold <johan@kernel.org> <johan@hovoldconsulting.com>
 John Crispin <john@phrozen.org> <blogic@openwrt.org>
+John Fastabend <john.fastabend@gmail.com> <john.r.fastabend@intel.com>
 John Keeping <john@keeping.me.uk> <john@metanate.com>
 John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
 John Stultz <johnstul@us.ibm.com>
 Sedat Dilek <sedat.dilek@gmail.com> <sedat.dilek@credativ.de>
 Seth Forshee <sforshee@kernel.org> <seth.forshee@canonical.com>
 Shannon Nelson <shannon.nelson@amd.com> <snelson@pensando.io>
+Shannon Nelson <shannon.nelson@amd.com> <shannon.nelson@intel.com>
+Shannon Nelson <shannon.nelson@amd.com> <shannon.nelson@oracle.com>
 Shiraz Hashim <shiraz.linux.kernel@gmail.com> <shiraz.hashim@st.com>
 Shuah Khan <shuah@kernel.org> <shuahkhan@gmail.com>
 Shuah Khan <shuah@kernel.org> <shuah.khan@hp.com>

arch/arm64/net/bpf_jit_comp.c+7−1

 	 *
 	 */
-	emit_bti(A64_BTI_C, ctx);
+	/* bpf function may be invoked by 3 instruction types:
+	 * 1. bl, attached via freplace to bpf prog via short jump
+	 * 2. br, attached via freplace to bpf prog via long jump
+	 * 3. blr, working as a function pointer, used by emit_call.
+	 * So BTI_JC should used here to support both br and blr.
+	 */
+	emit_bti(A64_BTI_JC, ctx);
 	emit(A64_MOV(1, A64_R(9), A64_LR), ctx);
 	emit(A64_NOP, ctx);

drivers/bluetooth/btusb.c+1−0

@@ -4104,6 +4104,7 @@ static int btusb_probe(struct usb_interface *intf, · 4103 unmodified lines
4104	BT_DBG("intf %p id %p", intf, id);	4104	BT_DBG("intf %p id %p", intf, id);
4105		4105
4106	if ((id->driver_info & BTUSB_IFNUM_2) &&	4106	if ((id->driver_info & BTUSB_IFNUM_2) &&
		4107	(intf->cur_altsetting->desc.bInterfaceNumber != 0) &&
4107	(intf->cur_altsetting->desc.bInterfaceNumber != 2))	4108	(intf->cur_altsetting->desc.bInterfaceNumber != 2))
4108	return -ENODEV;	4109	return -ENODEV;
4109		4110

drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c+8−2

 __mcp251xfd_chip_set_mode(const struct mcp251xfd_priv *priv,
 			  const u8 mode_req, bool nowait)
 {
+	const struct can_bittiming *bt = &priv->can.bittiming;
+	unsigned long timeout_us = MCP251XFD_POLL_TIMEOUT_US;
 	u32 con = 0, con_reqop, osc = 0;
 	u8 mode;
 	int err;
 	if (mode_req == MCP251XFD_REG_CON_MODE_SLEEP || nowait)
 		return 0;
+	if (bt->bitrate)
+		timeout_us = max_t(unsigned long, timeout_us,
+				   MCP251XFD_FRAME_LEN_MAX_BITS * USEC_PER_SEC /
+				   bt->bitrate);
 	err = regmap_read_poll_timeout(priv->map_reg, MCP251XFD_REG_CON, con,
 				       !mcp251xfd_reg_invalid(con) &&
 				       FIELD_GET(MCP251XFD_REG_CON_OPMOD_MASK,
 						 con) == mode_req,
-				       MCP251XFD_POLL_SLEEP_US,
+				       MCP251XFD_POLL_SLEEP_US, timeout_us);
-				       MCP251XFD_POLL_TIMEOUT_US);
 	if (err != -ETIMEDOUT && err != -EBADMSG)
 		return err;

drivers/net/can/spi/mcp251xfd/mcp251xfd.h+1−0

@@ -387,6 +387,7 @@ static_assert(MCP251XFD_TIMESTAMP_WORK_DELAY_SEC < · 386 unmodified lines
387	#define MCP251XFD_OSC_STAB_TIMEOUT_US (10 * MCP251XFD_OSC_STAB_SLEEP_US)	387	#define MCP251XFD_OSC_STAB_TIMEOUT_US (10 * MCP251XFD_OSC_STAB_SLEEP_US)
388	#define MCP251XFD_POLL_SLEEP_US (10)	388	#define MCP251XFD_POLL_SLEEP_US (10)
389	#define MCP251XFD_POLL_TIMEOUT_US (USEC_PER_MSEC)	389	#define MCP251XFD_POLL_TIMEOUT_US (USEC_PER_MSEC)
		390	#define MCP251XFD_FRAME_LEN_MAX_BITS (736)
390		391
391	/* Misc */	392	/* Misc */
392	#define MCP251XFD_NAPI_WEIGHT 32	393	#define MCP251XFD_NAPI_WEIGHT 32

drivers/net/can/usb/gs_usb.c+74−56

@@ -303,12 +303,6 @@ struct gs_can { · 302 unmodified lines
303	struct can_bittiming_const bt_const, data_bt_const;	303	struct can_bittiming_const bt_const, data_bt_const;
304	unsigned int channel; /* channel number */	304	unsigned int channel; /* channel number */
305		305
306	/* time counter for hardware timestamps */
307	struct cyclecounter cc;
308	struct timecounter tc;
309	spinlock_t tc_lock; /* spinlock to guard access tc->cycle_last */
310	struct delayed_work timestamp;
311
312	u32 feature;	306	u32 feature;
313	unsigned int hf_size_tx;	307	unsigned int hf_size_tx;
314		308
@@ -325,6 +319,13 @@ struct gs_usb { · 10 unmodified lines
325	struct gs_can *canch[GS_MAX_INTF];	319	struct gs_can *canch[GS_MAX_INTF];
326	struct usb_anchor rx_submitted;	320	struct usb_anchor rx_submitted;
327	struct usb_device *udev;	321	struct usb_device *udev;
		322
		323	/* time counter for hardware timestamps */
		324	struct cyclecounter cc;
		325	struct timecounter tc;
		326	spinlock_t tc_lock; /* spinlock to guard access tc->cycle_last */
		327	struct delayed_work timestamp;
		328
328	unsigned int hf_size_rx;	329	unsigned int hf_size_rx;
329	u8 active_channels;	330	u8 active_channels;
330	};	331	};
@@ -388,15 +389,15 @@ static int gs_cmd_reset(struct gs_can *dev) · 57 unmodified lines
388	GFP_KERNEL);	389	GFP_KERNEL);
389	}	390	}
390		391
391	static inline int gs_usb_get_timestamp(const struct gs_can *dev,	392	static inline int gs_usb_get_timestamp(const struct gs_usb *parent,
392	u32 *timestamp_p)	393	u32 *timestamp_p)
393	{	394	{
394	__le32 timestamp;	395	__le32 timestamp;
395	int rc;	396	int rc;
396		397
397	rc = usb_control_msg_recv(dev->udev, 0, GS_USB_BREQ_TIMESTAMP,	398	rc = usb_control_msg_recv(parent->udev, 0, GS_USB_BREQ_TIMESTAMP,
398	USB_DIR_IN \| USB_TYPE_VENDOR \| USB_RECIP_INTERFACE,	399	USB_DIR_IN \| USB_TYPE_VENDOR \| USB_RECIP_INTERFACE,
399	dev->channel, 0,	400	0, 0,
400	&timestamp, sizeof(timestamp),	401	&timestamp, sizeof(timestamp),
401	USB_CTRL_GET_TIMEOUT,	402	USB_CTRL_GET_TIMEOUT,
402	GFP_KERNEL);	403	GFP_KERNEL);
@@ -410,20 +411,20 @@ static inline int gs_usb_get_timestamp(const struct gs_can *dev, · 7 unmodified lines
410		411
411	static u64 gs_usb_timestamp_read(const struct cyclecounter *cc) __must_hold(&dev->tc_lock)	412	static u64 gs_usb_timestamp_read(const struct cyclecounter *cc) __must_hold(&dev->tc_lock)
412	{	413	{
413	struct gs_can *dev = container_of(cc, struct gs_can, cc);	414	struct gs_usb *parent = container_of(cc, struct gs_usb, cc);
414	u32 timestamp = 0;	415	u32 timestamp = 0;
415	int err;	416	int err;
416		417
417	lockdep_assert_held(&dev->tc_lock);	418	lockdep_assert_held(&parent->tc_lock);
418		419
419	/* drop lock for synchronous USB transfer */	420	/* drop lock for synchronous USB transfer */
420	spin_unlock_bh(&dev->tc_lock);	421	spin_unlock_bh(&parent->tc_lock);
421	err = gs_usb_get_timestamp(dev, &timestamp);	422	err = gs_usb_get_timestamp(parent, &timestamp);
422	spin_lock_bh(&dev->tc_lock);	423	spin_lock_bh(&parent->tc_lock);
423	if (err)	424	if (err)
424	netdev_err(dev->netdev,	425	dev_err(&parent->udev->dev,
425	"Error %d while reading timestamp. HW timestamps may be inaccurate.",	426	"Error %d while reading timestamp. HW timestamps may be inaccurate.",
426	err);	427	err);
427		428
428	return timestamp;	429	return timestamp;
429	}	430	}
@@ -431,14 +432,14 @@ static u64 gs_usb_timestamp_read(const struct cyclecounter *cc) __must_hold(&dev · 1 unmodified line
431	static void gs_usb_timestamp_work(struct work_struct *work)	432	static void gs_usb_timestamp_work(struct work_struct *work)
432	{	433	{
433	struct delayed_work *delayed_work = to_delayed_work(work);	434	struct delayed_work *delayed_work = to_delayed_work(work);
434	struct gs_can *dev;	435	struct gs_usb *parent;
435		436
436	dev = container_of(delayed_work, struct gs_can, timestamp);	437	parent = container_of(delayed_work, struct gs_usb, timestamp);
437	spin_lock_bh(&dev->tc_lock);	438	spin_lock_bh(&parent->tc_lock);
438	timecounter_read(&dev->tc);	439	timecounter_read(&parent->tc);
439	spin_unlock_bh(&dev->tc_lock);	440	spin_unlock_bh(&parent->tc_lock);
440		441
441	schedule_delayed_work(&dev->timestamp,	442	schedule_delayed_work(&parent->timestamp,
442	GS_USB_TIMESTAMP_WORK_DELAY_SEC * HZ);	443	GS_USB_TIMESTAMP_WORK_DELAY_SEC * HZ);
443	}	444	}
444		445
@@ -446,37 +447,38 @@ static void gs_usb_skb_set_timestamp(struct gs_can *dev, · 1 unmodified line
446	struct sk_buff *skb, u32 timestamp)	447	struct sk_buff *skb, u32 timestamp)
447	{	448	{
448	struct skb_shared_hwtstamps *hwtstamps = skb_hwtstamps(skb);	449	struct skb_shared_hwtstamps *hwtstamps = skb_hwtstamps(skb);
		450	struct gs_usb *parent = dev->parent;
449	u64 ns;	451	u64 ns;
450		452
451	spin_lock_bh(&dev->tc_lock);	453	spin_lock_bh(&parent->tc_lock);
452	ns = timecounter_cyc2time(&dev->tc, timestamp);	454	ns = timecounter_cyc2time(&parent->tc, timestamp);
453	spin_unlock_bh(&dev->tc_lock);	455	spin_unlock_bh(&parent->tc_lock);
454		456
455	hwtstamps->hwtstamp = ns_to_ktime(ns);	457	hwtstamps->hwtstamp = ns_to_ktime(ns);
456	}	458	}
457		459
458	static void gs_usb_timestamp_init(struct gs_can *dev)	460	static void gs_usb_timestamp_init(struct gs_usb *parent)
459	{	461	{
460	struct cyclecounter *cc = &dev->cc;	462	struct cyclecounter *cc = &parent->cc;
461		463
462	cc->read = gs_usb_timestamp_read;	464	cc->read = gs_usb_timestamp_read;
463	cc->mask = CYCLECOUNTER_MASK(32);	465	cc->mask = CYCLECOUNTER_MASK(32);
464	cc->shift = 32 - bits_per(NSEC_PER_SEC / GS_USB_TIMESTAMP_TIMER_HZ);	466	cc->shift = 32 - bits_per(NSEC_PER_SEC / GS_USB_TIMESTAMP_TIMER_HZ);
465	cc->mult = clocksource_hz2mult(GS_USB_TIMESTAMP_TIMER_HZ, cc->shift);	467	cc->mult = clocksource_hz2mult(GS_USB_TIMESTAMP_TIMER_HZ, cc->shift);
466		468
467	spin_lock_init(&dev->tc_lock);	469	spin_lock_init(&parent->tc_lock);
468	spin_lock_bh(&dev->tc_lock);	470	spin_lock_bh(&parent->tc_lock);
469	timecounter_init(&dev->tc, &dev->cc, ktime_get_real_ns());	471	timecounter_init(&parent->tc, &parent->cc, ktime_get_real_ns());
470	spin_unlock_bh(&dev->tc_lock);	472	spin_unlock_bh(&parent->tc_lock);
471		473
472	INIT_DELAYED_WORK(&dev->timestamp, gs_usb_timestamp_work);	474	INIT_DELAYED_WORK(&parent->timestamp, gs_usb_timestamp_work);
473	schedule_delayed_work(&dev->timestamp,	475	schedule_delayed_work(&parent->timestamp,
474	GS_USB_TIMESTAMP_WORK_DELAY_SEC * HZ);	476	GS_USB_TIMESTAMP_WORK_DELAY_SEC * HZ);
475	}	477	}
476		478
477	static void gs_usb_timestamp_stop(struct gs_can *dev)	479	static void gs_usb_timestamp_stop(struct gs_usb *parent)
478	{	480	{
479	cancel_delayed_work_sync(&dev->timestamp);	481	cancel_delayed_work_sync(&parent->timestamp);
480	}	482	}
481		483
482	static void gs_update_state(struct gs_can dev, struct can_frame cf)	484	static void gs_update_state(struct gs_can dev, struct can_frame cf)
@@ -560,6 +562,9 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) · 77 unmodified lines
560	if (!netif_device_present(netdev))	562	if (!netif_device_present(netdev))
561	return;	563	return;
562		564
		565	if (!netif_running(netdev))
		566	goto resubmit_urb;
		567
563	if (hf->echo_id == -1) { /* normal rx */	568	if (hf->echo_id == -1) { /* normal rx */
564	if (hf->flags & GS_CAN_FLAG_FD) {	569	if (hf->flags & GS_CAN_FLAG_FD) {
565	skb = alloc_canfd_skb(dev->netdev, &cfd);	570	skb = alloc_canfd_skb(dev->netdev, &cfd);
@@ -833,6 +838,7 @@ static int gs_can_open(struct net_device *netdev) · 267 unmodified lines
833	.mode = cpu_to_le32(GS_CAN_MODE_START),	838	.mode = cpu_to_le32(GS_CAN_MODE_START),
834	};	839	};
835	struct gs_host_frame *hf;	840	struct gs_host_frame *hf;
		841	struct urb *urb = NULL;
836	u32 ctrlmode;	842	u32 ctrlmode;
837	u32 flags = 0;	843	u32 flags = 0;
838	int rc, i;	844	int rc, i;
@@ -855,14 +861,18 @@ static int gs_can_open(struct net_device *netdev) · 16 unmodified lines
855	}	861	}
856		862
857	if (!parent->active_channels) {	863	if (!parent->active_channels) {
		864	if (dev->feature & GS_CAN_FEATURE_HW_TIMESTAMP)
		865	gs_usb_timestamp_init(parent);
		866
858	for (i = 0; i < GS_MAX_RX_URBS; i++) {	867	for (i = 0; i < GS_MAX_RX_URBS; i++) {
859	struct urb *urb;
860	u8 *buf;	868	u8 *buf;
861		869
862	/* alloc rx urb */	870	/* alloc rx urb */
863	urb = usb_alloc_urb(0, GFP_KERNEL);	871	urb = usb_alloc_urb(0, GFP_KERNEL);
864	if (!urb)	872	if (!urb) {
865	return -ENOMEM;	873	rc = -ENOMEM;
		874	goto out_usb_kill_anchored_urbs;
		875	}
866		876
867	/* alloc rx buffer */	877	/* alloc rx buffer */
868	buf = kmalloc(dev->parent->hf_size_rx,	878	buf = kmalloc(dev->parent->hf_size_rx,
@@ -870,8 +880,8 @@ static int gs_can_open(struct net_device *netdev) · 1 unmodified line
870	if (!buf) {	880	if (!buf) {
871	netdev_err(netdev,	881	netdev_err(netdev,
872	"No memory left for USB buffer\n");	882	"No memory left for USB buffer\n");
873	usb_free_urb(urb);	883	rc = -ENOMEM;
874	return -ENOMEM;	884	goto out_usb_free_urb;
875	}	885	}
876		886
877	/* fill, anchor, and submit rx urb */	887	/* fill, anchor, and submit rx urb */
@@ -894,9 +904,7 @@ static int gs_can_open(struct net_device *netdev) · 16 unmodified lines
894	netdev_err(netdev,	904	netdev_err(netdev,
895	"usb_submit failed (err=%d)\n", rc);	905	"usb_submit failed (err=%d)\n", rc);
896		906
897	usb_unanchor_urb(urb);	907	goto out_usb_unanchor_urb;
898	usb_free_urb(urb);
899	break;
900	}	908	}
901		909
902	/* Drop reference,	910	/* Drop reference,
@@ -926,13 +934,9 @@ static int gs_can_open(struct net_device *netdev) · 23 unmodified lines
926	flags \|= GS_CAN_MODE_FD;	934	flags \|= GS_CAN_MODE_FD;
927		935
928	/* if hardware supports timestamps, enable it */	936	/* if hardware supports timestamps, enable it */
929	if (dev->feature & GS_CAN_FEATURE_HW_TIMESTAMP) {	937	if (dev->feature & GS_CAN_FEATURE_HW_TIMESTAMP)
930	flags \|= GS_CAN_MODE_HW_TIMESTAMP;	938	flags \|= GS_CAN_MODE_HW_TIMESTAMP;
931		939
932	/* start polling timestamp */
933	gs_usb_timestamp_init(dev);
934	}
935
936	/* finally start device */	940	/* finally start device */
937	dev->can.state = CAN_STATE_ERROR_ACTIVE;	941	dev->can.state = CAN_STATE_ERROR_ACTIVE;
938	dm.flags = cpu_to_le32(flags);	942	dm.flags = cpu_to_le32(flags);
@@ -942,10 +946,9 @@ static int gs_can_open(struct net_device *netdev) · 3 unmodified lines
942	GFP_KERNEL);	946	GFP_KERNEL);
943	if (rc) {	947	if (rc) {
944	netdev_err(netdev, "Couldn't start device (err=%d)\n", rc);	948	netdev_err(netdev, "Couldn't start device (err=%d)\n", rc);
945	if (dev->feature & GS_CAN_FEATURE_HW_TIMESTAMP)
946	gs_usb_timestamp_stop(dev);
947	dev->can.state = CAN_STATE_STOPPED;	949	dev->can.state = CAN_STATE_STOPPED;
948	return rc;	950
		951	goto out_usb_kill_anchored_urbs;
949	}	952	}
950		953
951	parent->active_channels++;	954	parent->active_channels++;
@@ -953,6 +956,22 @@ static int gs_can_open(struct net_device *netdev) · 1 unmodified line
953	netif_start_queue(netdev);	956	netif_start_queue(netdev);
954		957
955	return 0;	958	return 0;
		959
		960	out_usb_unanchor_urb:
		961	usb_unanchor_urb(urb);
		962	out_usb_free_urb:
		963	usb_free_urb(urb);
		964	out_usb_kill_anchored_urbs:
		965	if (!parent->active_channels) {
		966	usb_kill_anchored_urbs(&dev->tx_submitted);
		967
		968	if (dev->feature & GS_CAN_FEATURE_HW_TIMESTAMP)
		969	gs_usb_timestamp_stop(parent);
		970	}
		971
		972	close_candev(netdev);
		973
		974	return rc;
956	}	975	}
957		976
958	static int gs_usb_get_state(const struct net_device *netdev,	977	static int gs_usb_get_state(const struct net_device *netdev,
@@ -998,14 +1017,13 @@ static int gs_can_close(struct net_device *netdev) · 39 unmodified lines
998		1017
999	netif_stop_queue(netdev);	1018	netif_stop_queue(netdev);
1000		1019
1001	/* stop polling timestamp */
1002	if (dev->feature & GS_CAN_FEATURE_HW_TIMESTAMP)
1003	gs_usb_timestamp_stop(dev);
1004
1005	/* Stop polling */	1020	/* Stop polling */
1006	parent->active_channels--;	1021	parent->active_channels--;
1007	if (!parent->active_channels) {	1022	if (!parent->active_channels) {
1008	usb_kill_anchored_urbs(&parent->rx_submitted);	1023	usb_kill_anchored_urbs(&parent->rx_submitted);
		1024
		1025	if (dev->feature & GS_CAN_FEATURE_HW_TIMESTAMP)
		1026	gs_usb_timestamp_stop(parent);
1009	}	1027	}
1010		1028
1011	/* Stop sending URBs */	1029	/* Stop sending URBs */

drivers/net/dsa/microchip/ksz8795.c+7−1

@@ -506,7 +506,13 @@ static int ksz8_r_sta_mac_table(struct ksz_device *dev, u16 addr, · 505 unmodified lines
506	(data_hi & masks[STATIC_MAC_TABLE_FWD_PORTS]) >>	506	(data_hi & masks[STATIC_MAC_TABLE_FWD_PORTS]) >>
507	shifts[STATIC_MAC_FWD_PORTS];	507	shifts[STATIC_MAC_FWD_PORTS];
508	alu->is_override = (data_hi & masks[STATIC_MAC_TABLE_OVERRIDE]) ? 1 : 0;	508	alu->is_override = (data_hi & masks[STATIC_MAC_TABLE_OVERRIDE]) ? 1 : 0;
509	data_hi >>= 1;	509
		510	/* KSZ8795 family switches have STATIC_MAC_TABLE_USE_FID and
		511	* STATIC_MAC_TABLE_FID definitions off by 1 when doing read on the
		512	* static MAC table compared to doing write.
		513	*/
		514	if (ksz_is_ksz87xx(dev))
		515	data_hi >>= 1;
510	alu->is_static = true;	516	alu->is_static = true;
511	alu->is_use_fid = (data_hi & masks[STATIC_MAC_TABLE_USE_FID]) ? 1 : 0;	517	alu->is_use_fid = (data_hi & masks[STATIC_MAC_TABLE_USE_FID]) ? 1 : 0;
512	alu->fid = (data_hi & masks[STATIC_MAC_TABLE_FID]) >>	518	alu->fid = (data_hi & masks[STATIC_MAC_TABLE_FID]) >>

drivers/net/dsa/microchip/ksz_common.c+4−4

@@ -331,13 +331,13 @@ static const u32 ksz8795_masks[] = { · 330 unmodified lines
331	[STATIC_MAC_TABLE_VALID] = BIT(21),	331	[STATIC_MAC_TABLE_VALID] = BIT(21),
332	[STATIC_MAC_TABLE_USE_FID] = BIT(23),	332	[STATIC_MAC_TABLE_USE_FID] = BIT(23),
333	[STATIC_MAC_TABLE_FID] = GENMASK(30, 24),	333	[STATIC_MAC_TABLE_FID] = GENMASK(30, 24),
334	[STATIC_MAC_TABLE_OVERRIDE] = BIT(26),	334	[STATIC_MAC_TABLE_OVERRIDE] = BIT(22),
335	[STATIC_MAC_TABLE_FWD_PORTS] = GENMASK(24, 20),	335	[STATIC_MAC_TABLE_FWD_PORTS] = GENMASK(20, 16),
336	[DYNAMIC_MAC_TABLE_ENTRIES_H] = GENMASK(6, 0),	336	[DYNAMIC_MAC_TABLE_ENTRIES_H] = GENMASK(6, 0),
337	[DYNAMIC_MAC_TABLE_MAC_EMPTY] = BIT(8),	337	[DYNAMIC_MAC_TABLE_MAC_EMPTY] = BIT(7),
338	[DYNAMIC_MAC_TABLE_NOT_READY] = BIT(7),	338	[DYNAMIC_MAC_TABLE_NOT_READY] = BIT(7),
339	[DYNAMIC_MAC_TABLE_ENTRIES] = GENMASK(31, 29),	339	[DYNAMIC_MAC_TABLE_ENTRIES] = GENMASK(31, 29),
340	[DYNAMIC_MAC_TABLE_FID] = GENMASK(26, 20),	340	[DYNAMIC_MAC_TABLE_FID] = GENMASK(22, 16),
341	[DYNAMIC_MAC_TABLE_SRC_PORT] = GENMASK(26, 24),	341	[DYNAMIC_MAC_TABLE_SRC_PORT] = GENMASK(26, 24),
342	[DYNAMIC_MAC_TABLE_TIMESTAMP] = GENMASK(28, 27),	342	[DYNAMIC_MAC_TABLE_TIMESTAMP] = GENMASK(28, 27),
343	[P_MII_TX_FLOW_CTRL] = BIT(5),	343	[P_MII_TX_FLOW_CTRL] = BIT(5),

drivers/net/dsa/microchip/ksz_common.h+7−0

@@ -601,6 +601,13 @@ static inline void ksz_regmap_unlock(void *__mtx) · 600 unmodified lines
601	mutex_unlock(mtx);	601	mutex_unlock(mtx);
602	}	602	}
603		603
		604	static inline bool ksz_is_ksz87xx(struct ksz_device *dev)
		605	{
		606	return dev->chip_id == KSZ8795_CHIP_ID \|\|
		607	dev->chip_id == KSZ8794_CHIP_ID \|\|
		608	dev->chip_id == KSZ8765_CHIP_ID;
		609	}
		610
604	static inline bool ksz_is_ksz88x3(struct ksz_device *dev)	611	static inline bool ksz_is_ksz88x3(struct ksz_device *dev)
605	{	612	{
606	return dev->chip_id == KSZ8830_CHIP_ID;	613	return dev->chip_id == KSZ8830_CHIP_ID;

drivers/net/dsa/mv88e6xxx/chip.c+7−0

@@ -109,6 +109,13 @@ int mv88e6xxx_wait_mask(struct mv88e6xxx_chip *chip, int addr, int reg, · 108 unmodified lines
109	usleep_range(1000, 2000);	109	usleep_range(1000, 2000);
110	}	110	}
111		111
		112	err = mv88e6xxx_read(chip, addr, reg, &data);
		113	if (err)
		114	return err;
		115
		116	if ((data & mask) == val)
		117	return 0;
		118
112	dev_err(chip->dev, "Timeout while waiting for switch\n");	119	dev_err(chip->dev, "Timeout while waiting for switch\n");
113	return -ETIMEDOUT;	120	return -ETIMEDOUT;
114	}	121	}

drivers/net/dsa/qca/ar9331.c+2−2

 	.val_bits = 32,
 	.reg_stride = 4,
 	.max_register = AR9331_SW_REG_PAGE,
+	.use_single_read = true,
+	.use_single_write = true,
 	.ranges = ar9331_regmap_range,
 	.num_ranges = ARRAY_SIZE(ar9331_regmap_range),
 	.val_format_endian_default = REGMAP_ENDIAN_NATIVE,
 	.read = ar9331_mdio_read,
 	.write = ar9331_sw_bus_write,
-	.max_raw_read = 4,
-	.max_raw_write = 4,
 };
 static int ar9331_sw_probe(struct mdio_device *mdiodev)

drivers/net/ethernet/brocade/bna/bnad_debugfs.c+0−5

 	if (!bnad->port_debugfs_root) {
 		bnad->port_debugfs_root =
 			debugfs_create_dir(name, bna_debugfs_root);
-		if (!bnad->port_debugfs_root) {
-			netdev_warn(bnad->netdev,
-				    "debugfs root dir creation failed\n");
-			return;
-		}
 		atomic_inc(&bna_debugfs_port_count);

drivers/net/ethernet/intel/iavf/iavf.h+5−1

 	struct workqueue_struct *wq;
 	struct work_struct reset_task;
 	struct work_struct adminq_task;
+	struct work_struct finish_config;
 	struct delayed_work client_task;
 	wait_queue_head_t down_waitqueue;
+	wait_queue_head_t reset_waitqueue;
 	wait_queue_head_t vc_waitqueue;
 	struct iavf_q_vector *q_vectors;
 	struct list_head vlan_filter_list;
 void iavf_down(struct iavf_adapter *adapter);
 int iavf_process_config(struct iavf_adapter *adapter);
 int iavf_parse_vf_resource_msg(struct iavf_adapter *adapter);
-void iavf_schedule_reset(struct iavf_adapter *adapter);
+void iavf_schedule_reset(struct iavf_adapter *adapter, u64 flags);
 void iavf_schedule_request_stats(struct iavf_adapter *adapter);
+void iavf_schedule_finish_config(struct iavf_adapter *adapter);
 void iavf_reset(struct iavf_adapter *adapter);
 void iavf_set_ethtool_ops(struct net_device *netdev);
 void iavf_update_stats(struct iavf_adapter *adapter);
 void iavf_del_adv_rss_cfg(struct iavf_adapter *adapter);
 struct iavf_mac_filter *iavf_add_filter(struct iavf_adapter *adapter,
 					const u8 *macaddr);
+int iavf_wait_for_reset(struct iavf_adapter *adapter);
 #endif /* _IAVF_H_ */

drivers/net/ethernet/intel/iavf/iavf_ethtool.c+18−21

 {
 	struct iavf_adapter *adapter = netdev_priv(netdev);
 	u32 orig_flags, new_flags, changed_flags;
+	int ret = 0;
 	u32 i;
 	orig_flags = READ_ONCE(adapter->flags);
 	/* issue a reset to force legacy-rx change to take effect */
 	if (changed_flags & IAVF_FLAG_LEGACY_RX) {
 		if (netif_running(netdev)) {
-			adapter->flags |= IAVF_FLAG_RESET_NEEDED;
+			iavf_schedule_reset(adapter, IAVF_FLAG_RESET_NEEDED);
-			queue_work(adapter->wq, &adapter->reset_task);
+			ret = iavf_wait_for_reset(adapter);
+			if (ret)
+				netdev_warn(netdev, "Changing private flags timeout or interrupted waiting for reset");
 		}
 	}
-	return 0;
+	return ret;
 }
 /**
 {
 	struct iavf_adapter *adapter = netdev_priv(netdev);
 	u32 new_rx_count, new_tx_count;
+	int ret = 0;
 	if ((ring->rx_mini_pending) || (ring->rx_jumbo_pending))
 		return -EINVAL;
 	}
 	if (netif_running(netdev)) {
-		adapter->flags |= IAVF_FLAG_RESET_NEEDED;
+		iavf_schedule_reset(adapter, IAVF_FLAG_RESET_NEEDED);
-		queue_work(adapter->wq, &adapter->reset_task);
+		ret = iavf_wait_for_reset(adapter);
+		if (ret)
+			netdev_warn(netdev, "Changing ring parameters timeout or interrupted waiting for reset");
 	}
-	return 0;
+	return ret;
 }
 /**
 {
 	struct iavf_adapter *adapter = netdev_priv(netdev);
 	u32 num_req = ch->combined_count;
-	int i;
+	int ret = 0;
 	if ((adapter->vf_res->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_ADQ) &&
 	    adapter->num_tc) {
 	adapter->num_req_queues = num_req;
 	adapter->flags |= IAVF_FLAG_REINIT_ITR_NEEDED;
-	iavf_schedule_reset(adapter);
+	iavf_schedule_reset(adapter, IAVF_FLAG_RESET_NEEDED);
-	/* wait for the reset is done */
+	ret = iavf_wait_for_reset(adapter);
-	for (i = 0; i < IAVF_RESET_WAIT_COMPLETE_COUNT; i++) {
+	if (ret)
-		msleep(IAVF_RESET_WAIT_MS);
+		netdev_warn(netdev, "Changing channel count timeout or interrupted waiting for reset");
-		if (adapter->flags & IAVF_FLAG_RESET_PENDING)
-			continue;
-		break;
-	}
-	if (i == IAVF_RESET_WAIT_COMPLETE_COUNT) {
-		adapter->flags &= ~IAVF_FLAG_REINIT_ITR_NEEDED;
-		adapter->num_active_queues = num_req;
-		return -EOPNOTSUPP;
-	}
-	return 0;
+	return ret;
 }
 /**

drivers/net/ethernet/intel/iavf/iavf_main.c+150−87

 	return netdev_priv(pci_get_drvdata(pdev));
 }
+/**
+ * iavf_is_reset_in_progress - Check if a reset is in progress
+ * @adapter: board private structure
+ */
+static bool iavf_is_reset_in_progress(struct iavf_adapter *adapter)
+{
+	if (adapter->state == __IAVF_RESETTING ||
+	    adapter->flags & (IAVF_FLAG_RESET_PENDING |
+			      IAVF_FLAG_RESET_NEEDED))
+		return true;
+	return false;
+}
+/**
+ * iavf_wait_for_reset - Wait for reset to finish.
+ * @adapter: board private structure
+ *
+ * Returns 0 if reset finished successfully, negative on timeout or interrupt.
+ */
+int iavf_wait_for_reset(struct iavf_adapter *adapter)
+{
+	int ret = wait_event_interruptible_timeout(adapter->reset_waitqueue,
+					!iavf_is_reset_in_progress(adapter),
+					msecs_to_jiffies(5000));
+	/* If ret < 0 then it means wait was interrupted.
+	 * If ret == 0 then it means we got a timeout while waiting
+	 * for reset to finish.
+	 * If ret > 0 it means reset has finished.
+	 */
+	if (ret > 0)
+		return 0;
+	else if (ret < 0)
+		return -EINTR;
+	else
+		return -EBUSY;
+}
 /**
  * iavf_allocate_dma_mem_d - OS specific memory alloc for shared code
  * @hw:   pointer to the HW structure
 /**
  * iavf_schedule_reset - Set the flags and schedule a reset event
  * @adapter: board private structure
+ * @flags: IAVF_FLAG_RESET_PENDING or IAVF_FLAG_RESET_NEEDED
  **/
-void iavf_schedule_reset(struct iavf_adapter *adapter)
+void iavf_schedule_reset(struct iavf_adapter *adapter, u64 flags)
 {
-	if (!(adapter->flags &
+	if (!test_bit(__IAVF_IN_REMOVE_TASK, &adapter->crit_section) &&
-	      (IAVF_FLAG_RESET_PENDING | IAVF_FLAG_RESET_NEEDED))) {
+	    !(adapter->flags &
-		adapter->flags |= IAVF_FLAG_RESET_NEEDED;
+	    (IAVF_FLAG_RESET_PENDING | IAVF_FLAG_RESET_NEEDED))) {
+		adapter->flags |= flags;
 		queue_work(adapter->wq, &adapter->reset_task);
 	}
 }
 	struct iavf_adapter *adapter = netdev_priv(netdev);
 	adapter->tx_timeout_count++;
-	iavf_schedule_reset(adapter);
+	iavf_schedule_reset(adapter, IAVF_FLAG_RESET_NEEDED);
 }
 /**
 		adapter->msix_entries[vector].entry = vector;
 	err = iavf_acquire_msix_vectors(adapter, v_budget);
+	if (!err)
+		iavf_schedule_finish_config(adapter);
 out:
-	netif_set_real_num_rx_queues(adapter->netdev, pairs);
-	netif_set_real_num_tx_queues(adapter->netdev, pairs);
 	return err;
 }
 static void iavf_free_q_vectors(struct iavf_adapter *adapter)
 {
 	int q_idx, num_q_vectors;
-	int napi_vectors;
 	if (!adapter->q_vectors)
 		return;
 	num_q_vectors = adapter->num_msix_vectors - NONQ_VECS;
-	napi_vectors = adapter->num_active_queues;
 	for (q_idx = 0; q_idx < num_q_vectors; q_idx++) {
 		struct iavf_q_vector *q_vector = &adapter->q_vectors[q_idx];
-		if (q_idx < napi_vectors)
+		netif_napi_del(&q_vector->napi);
-			netif_napi_del(&q_vector->napi);
 	}
 	kfree(adapter->q_vectors);
 	adapter->q_vectors = NULL;
 		goto err_alloc_queues;
 	}
-	rtnl_lock();
 	err = iavf_set_interrupt_capability(adapter);
-	rtnl_unlock();
 	if (err) {
 		dev_err(&adapter->pdev->dev,
 			"Unable to setup interrupt capabilities\n");
 /**
  * iavf_reinit_interrupt_scheme - Reallocate queues and vectors
  * @adapter: board private structure
+ * @running: true if adapter->state == __IAVF_RUNNING
  *
  * Returns 0 on success, negative on failure
  **/
-static int iavf_reinit_interrupt_scheme(struct iavf_adapter *adapter)
+static int iavf_reinit_interrupt_scheme(struct iavf_adapter *adapter, bool running)
 {
 	struct net_device *netdev = adapter->netdev;
 	int err;
-	if (netif_running(netdev))
+	if (running)
 		iavf_free_traffic_irqs(adapter);
 	iavf_free_misc_irq(adapter);
 	iavf_reset_interrupt_capability(adapter);
 	return err;
 }
+/**
+ * iavf_finish_config - do all netdev work that needs RTNL
+ * @work: our work_struct
+ *
+ * Do work that needs both RTNL and crit_lock.
+ **/
+static void iavf_finish_config(struct work_struct *work)
+{
+	struct iavf_adapter *adapter;
+	int pairs, err;
+	adapter = container_of(work, struct iavf_adapter, finish_config);
+	/* Always take RTNL first to prevent circular lock dependency */
+	rtnl_lock();
+	mutex_lock(&adapter->crit_lock);
+	if ((adapter->flags & IAVF_FLAG_SETUP_NETDEV_FEATURES) &&
+	    adapter->netdev_registered &&
+	    !test_bit(__IAVF_IN_REMOVE_TASK, &adapter->crit_section)) {
+		netdev_update_features(adapter->netdev);
+		adapter->flags &= ~IAVF_FLAG_SETUP_NETDEV_FEATURES;
+	}
+	switch (adapter->state) {
+	case __IAVF_DOWN:
+		if (!adapter->netdev_registered) {
+			err = register_netdevice(adapter->netdev);
+			if (err) {
+				dev_err(&adapter->pdev->dev, "Unable to register netdev (%d)\n",
+					err);
+				/* go back and try again.*/
+				iavf_free_rss(adapter);
+				iavf_free_misc_irq(adapter);
+				iavf_reset_interrupt_capability(adapter);
+				iavf_change_state(adapter,
+						  __IAVF_INIT_CONFIG_ADAPTER);
+				goto out;
+			}
+			adapter->netdev_registered = true;
+		}
+		/* Set the real number of queues when reset occurs while
+		 * state == __IAVF_DOWN
+		 */
+		fallthrough;
+	case __IAVF_RUNNING:
+		pairs = adapter->num_active_queues;
+		netif_set_real_num_rx_queues(adapter->netdev, pairs);
+		netif_set_real_num_tx_queues(adapter->netdev, pairs);
+		break;
+	default:
+		break;
+	}
+out:
+	mutex_unlock(&adapter->crit_lock);
+	rtnl_unlock();
+}
+/**
+ * iavf_schedule_finish_config - Set the flags and schedule a reset event
+ * @adapter: board private structure
+ **/
+void iavf_schedule_finish_config(struct iavf_adapter *adapter)
+{
+	if (!test_bit(__IAVF_IN_REMOVE_TASK, &adapter->crit_section))
+		queue_work(adapter->wq, &adapter->finish_config);
+}
 /**
  * iavf_process_aq_command - process aq_required flags
  * and sends aq command
 			adapter->vsi_res->num_queue_pairs);
 		adapter->flags |= IAVF_FLAG_REINIT_MSIX_NEEDED;
 		adapter->num_req_queues = adapter->vsi_res->num_queue_pairs;
-		iavf_schedule_reset(adapter);
+		iavf_schedule_reset(adapter, IAVF_FLAG_RESET_NEEDED);
 		return -EAGAIN;
 	}
 	netif_carrier_off(netdev);
 	adapter->link_up = false;
-	/* set the semaphore to prevent any callbacks after device registration
-	 * up to time when state of driver will be set to __IAVF_DOWN
-	 */
-	rtnl_lock();
-	if (!adapter->netdev_registered) {
-		err = register_netdevice(netdev);
-		if (err) {
-			rtnl_unlock();
-			goto err_register;
-		}
-	}
-	adapter->netdev_registered = true;
 	netif_tx_stop_all_queues(netdev);
 	if (CLIENT_ALLOWED(adapter)) {
 		err = iavf_lan_add_device(adapter);
 		if (err)
 	iavf_change_state(adapter, __IAVF_DOWN);
 	set_bit(__IAVF_VSI_DOWN, adapter->vsi.state);
-	rtnl_unlock();
 	iavf_misc_irq_enable(adapter);
 	wake_up(&adapter->down_waitqueue);
 		/* request initial VLAN offload settings */
 		iavf_set_vlan_offload_features(adapter, 0, netdev->features);
+	iavf_schedule_finish_config(adapter);
 	return;
 err_mem:
 	iavf_free_rss(adapter);
-err_register:
 	iavf_free_misc_irq(adapter);
 err_sw_init:
 	iavf_reset_interrupt_capability(adapter);
 		goto restart_watchdog;
 	}
-	if ((adapter->flags & IAVF_FLAG_SETUP_NETDEV_FEATURES) &&
-	    adapter->netdev_registered &&
-	    !test_bit(__IAVF_IN_REMOVE_TASK, &adapter->crit_section) &&
-	    rtnl_trylock()) {
-		netdev_update_features(adapter->netdev);
-		rtnl_unlock();
-		adapter->flags &= ~IAVF_FLAG_SETUP_NETDEV_FEATURES;
-	}
 	if (adapter->flags & IAVF_FLAG_PF_COMMS_FAILED)
 		iavf_change_state(adapter, __IAVF_COMM_FAILED);
-	if (adapter->flags & IAVF_FLAG_RESET_NEEDED) {
-		adapter->aq_required = 0;
-		adapter->current_op = VIRTCHNL_OP_UNKNOWN;
-		mutex_unlock(&adapter->crit_lock);
-		queue_work(adapter->wq, &adapter->reset_task);
-		return;
-	}
 	switch (adapter->state) {
 	case __IAVF_STARTUP:
 		iavf_startup(adapter);
 	/* check for hw reset */
 	reg_val = rd32(hw, IAVF_VF_ARQLEN1) & IAVF_VF_ARQLEN1_ARQENABLE_MASK;
 	if (!reg_val) {
-		adapter->flags |= IAVF_FLAG_RESET_PENDING;
 		adapter->aq_required = 0;
 		adapter->current_op = VIRTCHNL_OP_UNKNOWN;
 		dev_err(&adapter->pdev->dev, "Hardware reset detected\n");
-		queue_work(adapter->wq, &adapter->reset_task);
+		iavf_schedule_reset(adapter, IAVF_FLAG_RESET_PENDING);
 		mutex_unlock(&adapter->crit_lock);
 		queue_delayed_work(adapter->wq,
 				   &adapter->watchdog_task, HZ * 2);
 	int i = 0, err;
 	bool running;
-	/* Detach interface to avoid subsequent NDO callbacks */
-	rtnl_lock();
-	netif_device_detach(netdev);
-	rtnl_unlock();
 	/* When device is being removed it doesn't make sense to run the reset
 	 * task, just return in such a case.
 	 */
 		if (adapter->state != __IAVF_REMOVE)
 			queue_work(adapter->wq, &adapter->reset_task);
-		goto reset_finish;
+		return;
 	}
 	while (!mutex_trylock(&adapter->client_lock))
 		iavf_disable_vf(adapter);
 		mutex_unlock(&adapter->client_lock);
 		mutex_unlock(&adapter->crit_lock);
-		if (netif_running(netdev)) {
-			rtnl_lock();
-			dev_close(netdev);
-			rtnl_unlock();
-		}
 		return; /* Do not attempt to reinit. It's dead, Jim. */
 	}
 	if ((adapter->flags & IAVF_FLAG_REINIT_MSIX_NEEDED) ||
 	    (adapter->flags & IAVF_FLAG_REINIT_ITR_NEEDED)) {
-		err = iavf_reinit_interrupt_scheme(adapter);
+		err = iavf_reinit_interrupt_scheme(adapter, running);
 		if (err)
 			goto reset_err;
 	}
 	adapter->flags &= ~IAVF_FLAG_REINIT_ITR_NEEDED;
+	wake_up(&adapter->reset_waitqueue);
 	mutex_unlock(&adapter->client_lock);
 	mutex_unlock(&adapter->crit_lock);
-	goto reset_finish;
+	return;
 reset_err:
 	if (running) {
 		set_bit(__IAVF_VSI_DOWN, adapter->vsi.state);
 	mutex_unlock(&adapter->client_lock);
 	mutex_unlock(&adapter->crit_lock);
-	if (netif_running(netdev)) {
-		/* Close device to ensure that Tx queues will not be started
-		 * during netif_device_attach() at the end of the reset task.
-		 */
-		rtnl_lock();
-		dev_close(netdev);
-		rtnl_unlock();
-	}
 	dev_err(&adapter->pdev->dev, "failed to allocate resources during reinit\n");
-reset_finish:
-	rtnl_lock();
-	netif_device_attach(netdev);
-	rtnl_unlock();
 }
 /**
 	} while (pending);
 	mutex_unlock(&adapter->crit_lock);
-	if ((adapter->flags &
+	if (iavf_is_reset_in_progress(adapter))
-	     (IAVF_FLAG_RESET_PENDING | IAVF_FLAG_RESET_NEEDED)) ||
-	    adapter->state == __IAVF_RESETTING)
 		goto freedom;
 	/* check for error indications */
 static int iavf_change_mtu(struct net_device *netdev, int new_mtu)
 {
 	struct iavf_adapter *adapter = netdev_priv(netdev);
+	int ret = 0;
 	netdev_dbg(netdev, "changing MTU from %d to %d\n",
 		   netdev->mtu, new_mtu);
 	}
 	if (netif_running(netdev)) {
-		adapter->flags |= IAVF_FLAG_RESET_NEEDED;
+		iavf_schedule_reset(adapter, IAVF_FLAG_RESET_NEEDED);
-		queue_work(adapter->wq, &adapter->reset_task);
+		ret = iavf_wait_for_reset(adapter);
+		if (ret < 0)
+			netdev_warn(netdev, "MTU change interrupted waiting for reset");
+		else if (ret)
+			netdev_warn(netdev, "MTU change timed out waiting for reset");
 	}
-	return 0;
+	return ret;
 }
 #define NETIF_VLAN_OFFLOAD_FEATURES	(NETIF_F_HW_VLAN_CTAG_RX | \
 	INIT_WORK(&adapter->reset_task, iavf_reset_task);
 	INIT_WORK(&adapter->adminq_task, iavf_adminq_task);
+	INIT_WORK(&adapter->finish_config, iavf_finish_config);
 	INIT_DELAYED_WORK(&adapter->watchdog_task, iavf_watchdog_task);
 	INIT_DELAYED_WORK(&adapter->client_task, iavf_client_task);
 	queue_delayed_work(adapter->wq, &adapter->watchdog_task,
 	/* Setup the wait queue for indicating transition to down status */
 	init_waitqueue_head(&adapter->down_waitqueue);
+	/* Setup the wait queue for indicating transition to running state */
+	init_waitqueue_head(&adapter->reset_waitqueue);
 	/* Setup the wait queue for indicating virtchannel events */
 	init_waitqueue_head(&adapter->vc_waitqueue);
 		usleep_range(500, 1000);
 	}
 	cancel_delayed_work_sync(&adapter->watchdog_task);
+	cancel_work_sync(&adapter->finish_config);
+	rtnl_lock();
 	if (adapter->netdev_registered) {
-		rtnl_lock();
 		unregister_netdevice(netdev);
 		adapter->netdev_registered = false;
-		rtnl_unlock();
 	}
+	rtnl_unlock();
 	if (CLIENT_ALLOWED(adapter)) {
 		err = iavf_lan_del_device(adapter);
 		if (err)

drivers/net/ethernet/intel/iavf/iavf_virtchnl.c+3−2

 		case VIRTCHNL_EVENT_RESET_IMPENDING:
 			dev_info(&adapter->pdev->dev, "Reset indication received from the PF\n");
 			if (!(adapter->flags & IAVF_FLAG_RESET_PENDING)) {
-				adapter->flags |= IAVF_FLAG_RESET_PENDING;
 				dev_info(&adapter->pdev->dev, "Scheduling reset task\n");
-				queue_work(adapter->wq, &adapter->reset_task);
+				iavf_schedule_reset(adapter, IAVF_FLAG_RESET_PENDING);
 			}
 			break;
 		default:
 		iavf_process_config(adapter);
 		adapter->flags |= IAVF_FLAG_SETUP_NETDEV_FEATURES;
+		iavf_schedule_finish_config(adapter);
 		iavf_set_queue_vlan_tag_loc(adapter);
 	case VIRTCHNL_OP_ENABLE_QUEUES:
 		/* enable transmits */
 		iavf_irq_enable(adapter, true);
+		wake_up(&adapter->reset_waitqueue);
 		adapter->flags &= ~IAVF_FLAG_QUEUES_DISABLED;
 		break;
 	case VIRTCHNL_OP_DISABLE_QUEUES:

drivers/net/ethernet/intel/ice/ice_base.c+2−0

@@ -800,6 +800,8 @@ void ice_vsi_free_q_vectors(struct ice_vsi *vsi) · 799 unmodified lines
800		800
801	ice_for_each_q_vector(vsi, v_idx)	801	ice_for_each_q_vector(vsi, v_idx)
802	ice_free_q_vector(vsi, v_idx);	802	ice_free_q_vector(vsi, v_idx);
		803
		804	vsi->num_q_vectors = 0;
803	}	805	}
804		806
805	/**	807	/**

drivers/net/ethernet/intel/ice/ice_ethtool.c+11−2

 	ring->rx_max_pending = ICE_MAX_NUM_DESC;
 	ring->tx_max_pending = ICE_MAX_NUM_DESC;
-	ring->rx_pending = vsi->rx_rings[0]->count;
+	if (vsi->tx_rings && vsi->rx_rings) {
-	ring->tx_pending = vsi->tx_rings[0]->count;
+		ring->rx_pending = vsi->rx_rings[0]->count;
+		ring->tx_pending = vsi->tx_rings[0]->count;
+	} else {
+		ring->rx_pending = 0;
+		ring->tx_pending = 0;
+	}
 	/* Rx mini and jumbo rings are not supported */
 	ring->rx_mini_max_pending = 0;
 		return -EINVAL;
 	}
+	/* Return if there is no rings (device is reloading) */
+	if (!vsi->tx_rings || !vsi->rx_rings)
+		return -EBUSY;
 	new_tx_cnt = ALIGN(ring->tx_pending, ICE_REQ_DESC_MULTIPLE);
 	if (new_tx_cnt != ring->tx_pending)
 		netdev_info(netdev, "Requested Tx descriptor count rounded up to %d\n",

drivers/net/ethernet/intel/ice/ice_lib.c+0−27

@@ -2972,39 +2972,12 @@ int ice_vsi_release(struct ice_vsi *vsi) · 2971 unmodified lines
2972	return -ENODEV;	2972	return -ENODEV;
2973	pf = vsi->back;	2973	pf = vsi->back;
2974		2974
2975	/* do not unregister while driver is in the reset recovery pending
2976	* state. Since reset/rebuild happens through PF service task workqueue,
2977	* it's not a good idea to unregister netdev that is associated to the
2978	* PF that is running the work queue items currently. This is done to
2979	* avoid check_flush_dependency() warning on this wq
2980	*/
2981	if (vsi->netdev && !ice_is_reset_in_progress(pf->state) &&
2982	(test_bit(ICE_VSI_NETDEV_REGISTERED, vsi->state))) {
2983	unregister_netdev(vsi->netdev);
2984	clear_bit(ICE_VSI_NETDEV_REGISTERED, vsi->state);
2985	}
2986
2987	if (vsi->type == ICE_VSI_PF)
2988	ice_devlink_destroy_pf_port(pf);
2989
2990	if (test_bit(ICE_FLAG_RSS_ENA, pf->flags))	2975	if (test_bit(ICE_FLAG_RSS_ENA, pf->flags))
2991	ice_rss_clean(vsi);	2976	ice_rss_clean(vsi);
2992		2977
2993	ice_vsi_close(vsi);	2978	ice_vsi_close(vsi);
2994	ice_vsi_decfg(vsi);	2979	ice_vsi_decfg(vsi);
2995		2980
2996	if (vsi->netdev) {
2997	if (test_bit(ICE_VSI_NETDEV_REGISTERED, vsi->state)) {
2998	unregister_netdev(vsi->netdev);
2999	clear_bit(ICE_VSI_NETDEV_REGISTERED, vsi->state);
3000	}
3001	if (test_bit(ICE_VSI_NETDEV_ALLOCD, vsi->state)) {
3002	free_netdev(vsi->netdev);
3003	vsi->netdev = NULL;
3004	clear_bit(ICE_VSI_NETDEV_ALLOCD, vsi->state);
3005	}
3006	}
3007
3008	/* retain SW VSI data structure since it is needed to unregister and	2981	/* retain SW VSI data structure since it is needed to unregister and
3009	* free VSI netdev when PF is not in reset recovery pending state,\	2982	* free VSI netdev when PF is not in reset recovery pending state,\
3010	* for ex: during rmmod.	2983	* for ex: during rmmod.

drivers/net/ethernet/intel/ice/ice_main.c+8−2

 	if (err)
 		return err;
-	rtnl_lock();
 	err = ice_vsi_open(vsi);
-	rtnl_unlock();
+	if (err)
+		ice_fltr_remove_all(vsi);
 	return err;
 }
 	params = ice_vsi_to_params(vsi);
 	params.flags = ICE_VSI_FLAG_INIT;
+	rtnl_lock();
 	err = ice_vsi_cfg(vsi, &params);
 	if (err)
 		goto err_vsi_cfg;
 	err = ice_start_eth(ice_get_main_vsi(pf));
 	if (err)
 		goto err_start_eth;
+	rtnl_unlock();
 	err = ice_init_rdma(pf);
 	if (err)
 err_init_rdma:
 	ice_vsi_close(ice_get_main_vsi(pf));
+	rtnl_lock();
 err_start_eth:
 	ice_vsi_decfg(ice_get_main_vsi(pf));
 err_vsi_cfg:
+	rtnl_unlock();
 	ice_deinit_dev(pf);
 	return err;
 }
 {
 	ice_deinit_features(pf);
 	ice_deinit_rdma(pf);
+	rtnl_lock();
 	ice_stop_eth(ice_get_main_vsi(pf));
 	ice_vsi_decfg(ice_get_main_vsi(pf));
+	rtnl_unlock();
 	ice_deinit_dev(pf);
 }

drivers/net/ethernet/intel/igc/igc_main.c+2−2

 	struct netdev_queue *nq = txring_txq(ring);
 	union igc_adv_tx_desc *tx_desc = NULL;
 	int cpu = smp_processor_id();
-	u16 ntu = ring->next_to_use;
 	struct xdp_desc xdp_desc;
-	u16 budget;
+	u16 budget, ntu;
 	if (!netif_carrier_ok(ring->netdev))
 		return;
 	/* Avoid transmit queue timeout since we share it with the slow path */
 	txq_trans_cond_update(nq);
+	ntu = ring->next_to_use;
 	budget = igc_desc_unused(ring);
 	while (xsk_tx_peek_desc(pool, &xdp_desc) && budget--) {

drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c+100−37

@@ -4,6 +4,7 @@ · 3 unmodified lines
4	* Copyright (C) 2022 Marvell.	4	* Copyright (C) 2022 Marvell.
5	*/	5	*/
6		6
		7	#include <crypto/skcipher.h>
7	#include <linux/rtnetlink.h>	8	#include <linux/rtnetlink.h>
8	#include <linux/bitfield.h>	9	#include <linux/bitfield.h>
9	#include "otx2_common.h"	10	#include "otx2_common.h"
@@ -42,6 +43,56 @@ · 32 unmodified lines
42	#define MCS_TCI_E 0x08 /* encryption */	43	#define MCS_TCI_E 0x08 /* encryption */
43	#define MCS_TCI_C 0x04 /* changed text */	44	#define MCS_TCI_C 0x04 /* changed text */
44		45
		46	#define CN10K_MAX_HASH_LEN 16
		47	#define CN10K_MAX_SAK_LEN 32
		48
		49	static int cn10k_ecb_aes_encrypt(struct otx2_nic pfvf, u8 sak,
		50	u16 sak_len, u8 *hash)
		51	{
		52	u8 data[CN10K_MAX_HASH_LEN] = { 0 };
		53	struct skcipher_request *req = NULL;
		54	struct scatterlist sg_src, sg_dst;
		55	struct crypto_skcipher *tfm;
		56	DECLARE_CRYPTO_WAIT(wait);
		57	int err;
		58
		59	tfm = crypto_alloc_skcipher("ecb(aes)", 0, 0);
		60	if (IS_ERR(tfm)) {
		61	dev_err(pfvf->dev, "failed to allocate transform for ecb-aes\n");
		62	return PTR_ERR(tfm);
		63	}
		64
		65	req = skcipher_request_alloc(tfm, GFP_KERNEL);
		66	if (!req) {
		67	dev_err(pfvf->dev, "failed to allocate request for skcipher\n");
		68	err = -ENOMEM;
		69	goto free_tfm;
		70	}
		71
		72	err = crypto_skcipher_setkey(tfm, sak, sak_len);
		73	if (err) {
		74	dev_err(pfvf->dev, "failed to set key for skcipher\n");
		75	goto free_req;
		76	}
		77
		78	/* build sg list */
		79	sg_init_one(&sg_src, data, CN10K_MAX_HASH_LEN);
		80	sg_init_one(&sg_dst, hash, CN10K_MAX_HASH_LEN);
		81
		82	skcipher_request_set_callback(req, 0, crypto_req_done, &wait);
		83	skcipher_request_set_crypt(req, &sg_src, &sg_dst,
		84	CN10K_MAX_HASH_LEN, NULL);
		85
		86	err = crypto_skcipher_encrypt(req);
		87	err = crypto_wait_req(err, &wait);
		88
		89	free_req:
		90	skcipher_request_free(req);
		91	free_tfm:
		92	crypto_free_skcipher(tfm);
		93	return err;
		94	}
		95
45	static struct cn10k_mcs_txsc cn10k_mcs_get_txsc(struct cn10k_mcs_cfg cfg,	96	static struct cn10k_mcs_txsc cn10k_mcs_get_txsc(struct cn10k_mcs_cfg cfg,
46	struct macsec_secy *secy)	97	struct macsec_secy *secy)
47	{	98	{
@@ -330,19 +381,53 @@ fail: · 282 unmodified lines
330	return ret;	381	return ret;
331	}	382	}
332		383
		384	static int cn10k_mcs_write_keys(struct otx2_nic *pfvf,
		385	struct macsec_secy *secy,
		386	struct mcs_sa_plcy_write_req *req,
		387	u8 sak, u8 salt, ssci_t ssci)
		388	{
		389	u8 hash_rev[CN10K_MAX_HASH_LEN];
		390	u8 sak_rev[CN10K_MAX_SAK_LEN];
		391	u8 salt_rev[MACSEC_SALT_LEN];
		392	u8 hash[CN10K_MAX_HASH_LEN];
		393	u32 ssci_63_32;
		394	int err, i;
		395
		396	err = cn10k_ecb_aes_encrypt(pfvf, sak, secy->key_len, hash);
		397	if (err) {
		398	dev_err(pfvf->dev, "Generating hash using ECB(AES) failed\n");
		399	return err;
		400	}
		401
		402	for (i = 0; i < secy->key_len; i++)
		403	sak_rev[i] = sak[secy->key_len - 1 - i];
		404
		405	for (i = 0; i < CN10K_MAX_HASH_LEN; i++)
		406	hash_rev[i] = hash[CN10K_MAX_HASH_LEN - 1 - i];
		407
		408	for (i = 0; i < MACSEC_SALT_LEN; i++)
		409	salt_rev[i] = salt[MACSEC_SALT_LEN - 1 - i];
		410
		411	ssci_63_32 = (__force u32)cpu_to_be32((__force u32)ssci);
		412
		413	memcpy(&req->plcy[0][0], sak_rev, secy->key_len);
		414	memcpy(&req->plcy[0][4], hash_rev, CN10K_MAX_HASH_LEN);
		415	memcpy(&req->plcy[0][6], salt_rev, MACSEC_SALT_LEN);
		416	req->plcy[0][7] \|= (u64)ssci_63_32 << 32;
		417
		418	return 0;
		419	}
		420
333	static int cn10k_mcs_write_rx_sa_plcy(struct otx2_nic *pfvf,	421	static int cn10k_mcs_write_rx_sa_plcy(struct otx2_nic *pfvf,
334	struct macsec_secy *secy,	422	struct macsec_secy *secy,
335	struct cn10k_mcs_rxsc *rxsc,	423	struct cn10k_mcs_rxsc *rxsc,
336	u8 assoc_num, bool sa_in_use)	424	u8 assoc_num, bool sa_in_use)
337	{	425	{
338	unsigned char *src = rxsc->sa_key[assoc_num];
339	struct mcs_sa_plcy_write_req *plcy_req;	426	struct mcs_sa_plcy_write_req *plcy_req;
340	u8 *salt_p = rxsc->salt[assoc_num];	427	u8 *sak = rxsc->sa_key[assoc_num];
		428	u8 *salt = rxsc->salt[assoc_num];
341	struct mcs_rx_sc_sa_map *map_req;	429	struct mcs_rx_sc_sa_map *map_req;
342	struct mbox *mbox = &pfvf->mbox;	430	struct mbox *mbox = &pfvf->mbox;
343	u64 ssci_salt_95_64 = 0;
344	u8 reg, key_len;
345	u64 salt_63_0;
346	int ret;	431	int ret;
347		432
348	mutex_lock(&mbox->lock);	433	mutex_lock(&mbox->lock);
@@ -360,20 +445,10 @@ static int cn10k_mcs_write_rx_sa_plcy(struct otx2_nic *pfvf, · 11 unmodified lines
360	goto fail;	445	goto fail;
361	}	446	}
362		447
363	for (reg = 0, key_len = 0; key_len < secy->key_len; key_len += 8) {	448	ret = cn10k_mcs_write_keys(pfvf, secy, plcy_req, sak,
364	memcpy((u8 *)&plcy_req->plcy[0][reg],	449	salt, rxsc->ssci[assoc_num]);
365	(src + reg * 8), 8);	450	if (ret)
366	reg++;	451	goto fail;
367	}
368
369	if (secy->xpn) {
370	memcpy((u8 *)&salt_63_0, salt_p, 8);
371	memcpy((u8 *)&ssci_salt_95_64, salt_p + 8, 4);
372	ssci_salt_95_64 \|= (__force u64)rxsc->ssci[assoc_num] << 32;
373
374	plcy_req->plcy[0][6] = salt_63_0;
375	plcy_req->plcy[0][7] = ssci_salt_95_64;
376	}
377		452
378	plcy_req->sa_index[0] = rxsc->hw_sa_id[assoc_num];	453	plcy_req->sa_index[0] = rxsc->hw_sa_id[assoc_num];
379	plcy_req->sa_cnt = 1;	454	plcy_req->sa_cnt = 1;
@@ -586,13 +661,10 @@ static int cn10k_mcs_write_tx_sa_plcy(struct otx2_nic *pfvf, · 206 unmodified lines
586	struct cn10k_mcs_txsc *txsc,	661	struct cn10k_mcs_txsc *txsc,
587	u8 assoc_num)	662	u8 assoc_num)
588	{	663	{
589	unsigned char *src = txsc->sa_key[assoc_num];
590	struct mcs_sa_plcy_write_req *plcy_req;	664	struct mcs_sa_plcy_write_req *plcy_req;
591	u8 *salt_p = txsc->salt[assoc_num];	665	u8 *sak = txsc->sa_key[assoc_num];
		666	u8 *salt = txsc->salt[assoc_num];
592	struct mbox *mbox = &pfvf->mbox;	667	struct mbox *mbox = &pfvf->mbox;
593	u64 ssci_salt_95_64 = 0;
594	u8 reg, key_len;
595	u64 salt_63_0;
596	int ret;	668	int ret;
597		669
598	mutex_lock(&mbox->lock);	670	mutex_lock(&mbox->lock);
@@ -603,19 +675,10 @@ static int cn10k_mcs_write_tx_sa_plcy(struct otx2_nic *pfvf, · 4 unmodified lines
603	goto fail;	675	goto fail;
604	}	676	}
605		677
606	for (reg = 0, key_len = 0; key_len < secy->key_len; key_len += 8) {	678	ret = cn10k_mcs_write_keys(pfvf, secy, plcy_req, sak,
607	memcpy((u8 )&plcy_req->plcy[0][reg], (src + reg 8), 8);	679	salt, txsc->ssci[assoc_num]);
608	reg++;	680	if (ret)
609	}	681	goto fail;
610
611	if (secy->xpn) {
612	memcpy((u8 *)&salt_63_0, salt_p, 8);
613	memcpy((u8 *)&ssci_salt_95_64, salt_p + 8, 4);
614	ssci_salt_95_64 \|= (__force u64)txsc->ssci[assoc_num] << 32;
615
616	plcy_req->plcy[0][6] = salt_63_0;
617	plcy_req->plcy[0][7] = ssci_salt_95_64;
618	}
619		682
620	plcy_req->plcy[0][8] = assoc_num;	683	plcy_req->plcy[0][8] = assoc_num;
621	plcy_req->sa_index[0] = txsc->hw_sa_id[assoc_num];	684	plcy_req->sa_index[0] = txsc->hw_sa_id[assoc_num];

drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c+3−2

@@ -1454,8 +1454,9 @@ static int otx2_init_hw_resources(struct otx2_nic *pf) · 1453 unmodified lines
1454	if (err)	1454	if (err)
1455	goto err_free_npa_lf;	1455	goto err_free_npa_lf;
1456		1456
1457	/* Enable backpressure */	1457	/* Enable backpressure for CGX mapped PF/VFs */
1458	otx2_nix_config_bp(pf, true);	1458	if (!is_otx2_lbkvf(pf->pdev))
		1459	otx2_nix_config_bp(pf, true);
1459		1460
1460	/* Init Auras and pools used by NIX RQ, for free buffer ptrs */	1461	/* Init Auras and pools used by NIX RQ, for free buffer ptrs */
1461	err = otx2_rq_aura_pool_init(pf);	1462	err = otx2_rq_aura_pool_init(pf);

drivers/net/ethernet/mediatek/mtk_eth_soc.c+11−18

 	return 0;
 }
-static int __init mtk_init(struct net_device *dev)
-{
-	struct mtk_mac *mac = netdev_priv(dev);
-	struct mtk_eth *eth = mac->hw;
-	int ret;
-	ret = of_get_ethdev_address(mac->of_node, dev);
-	if (ret) {
-		/* If the mac address is invalid, use random mac address */
-		eth_hw_addr_random(dev);
-		dev_err(eth->dev, "generated random MAC address %pM\n",
-			dev->dev_addr);
-	}
-	return 0;
-}
 static void mtk_uninit(struct net_device *dev)
 {
 	struct mtk_mac *mac = netdev_priv(dev);
 };
 static const struct net_device_ops mtk_netdev_ops = {
-	.ndo_init		= mtk_init,
 	.ndo_uninit		= mtk_uninit,
 	.ndo_open		= mtk_open,
 	.ndo_stop		= mtk_stop,
 	mac->hw = eth;
 	mac->of_node = np;
+	err = of_get_ethdev_address(mac->of_node, eth->netdev[id]);
+	if (err == -EPROBE_DEFER)
+		return err;
+	if (err) {
+		/* If the mac address is invalid, use random mac address */
+		eth_hw_addr_random(eth->netdev[id]);
+		dev_err(eth->dev, "generated random MAC address %pM\n",
+			eth->netdev[id]->dev_addr);
+	}
 	memset(mac->hwlro_ip, 0, sizeof(mac->hwlro_ip));
 	mac->hwlro_ip_cnt = 0;

drivers/net/ethernet/mediatek/mtk_ppe_debugfs.c+1−1

@@ -98,7 +98,7 @@ mtk_ppe_debugfs_foe_show(struct seq_file m, void private, bool bind) · 97 unmodified lines
98		98
99	acct = mtk_foe_entry_get_mib(ppe, i, NULL);	99	acct = mtk_foe_entry_get_mib(ppe, i, NULL);
100		100
101	type = FIELD_GET(MTK_FOE_IB1_PACKET_TYPE, entry->ib1);	101	type = mtk_get_ib1_pkt_type(ppe->eth, entry->ib1);
102	seq_printf(m, "%05x %s %7s", i,	102	seq_printf(m, "%05x %s %7s", i,
103	mtk_foe_entry_state_str(state),	103	mtk_foe_entry_state_str(state),
104	mtk_foe_pkt_type_str(type));	104	mtk_foe_pkt_type_str(type));

drivers/net/ethernet/mscc/ocelot_fdma.c+2−1

@@ -368,7 +368,8 @@ static bool ocelot_fdma_receive_skb(struct ocelot ocelot, struct sk_buff skb) · 367 unmodified lines
368	if (unlikely(!ndev))	368	if (unlikely(!ndev))
369	return false;	369	return false;
370		370
371	pskb_trim(skb, skb->len - ETH_FCS_LEN);	371	if (pskb_trim(skb, skb->len - ETH_FCS_LEN))
		372	return false;
372		373
373	skb->dev = ndev;	374	skb->dev = ndev;
374	skb->protocol = eth_type_trans(skb, skb->dev);	375	skb->protocol = eth_type_trans(skb, skb->dev);

drivers/net/ethernet/qualcomm/emac/emac-mac.c+5−2

 		if (skb->protocol == htons(ETH_P_IP)) {
 			u32 pkt_len = ((unsigned char *)ip_hdr(skb) - skb->data)
 				       + ntohs(ip_hdr(skb)->tot_len);
-			if (skb->len > pkt_len)
+			if (skb->len > pkt_len) {
-				pskb_trim(skb, pkt_len);
+				ret = pskb_trim(skb, pkt_len);
+				if (unlikely(ret))
+					return ret;
+			}
 		}
 		hdr_len = skb_tcp_all_headers(skb);

drivers/net/ethernet/realtek/r8169_main.c+34−11

 	int cfg9346_usage_count;
 	unsigned supports_gmii:1;
+	unsigned aspm_manageable:1;
 	dma_addr_t counters_phys_addr;
 	struct rtl8169_counters *counters;
 	struct rtl8169_tc_offsets tc_offset;
 	if (tp->mac_version < RTL_GIGA_MAC_VER_32)
 		return;
-	if (enable) {
+	/* Don't enable ASPM in the chip if OS can't control ASPM */
+	if (enable && tp->aspm_manageable) {
+		/* On these chip versions ASPM can even harm
+		 * bus communication of other PCI devices.
+		 */
+		if (tp->mac_version == RTL_GIGA_MAC_VER_42 ||
+		    tp->mac_version == RTL_GIGA_MAC_VER_43)
+			return;
 		rtl_mod_config5(tp, 0, ASPM_en);
 		rtl_mod_config2(tp, 0, ClkReqEn);
 	}
 	if (napi_schedule_prep(&tp->napi)) {
-		rtl_unlock_config_regs(tp);
-		rtl_hw_aspm_clkreq_enable(tp, false);
-		rtl_lock_config_regs(tp);
 		rtl_irq_disable(tp);
 		__napi_schedule(&tp->napi);
 	}
 	work_done = rtl_rx(dev, tp, budget);
-	if (work_done < budget && napi_complete_done(napi, work_done)) {
+	if (work_done < budget && napi_complete_done(napi, work_done))
 		rtl_irq_enable(tp);
-		rtl_unlock_config_regs(tp);
-		rtl_hw_aspm_clkreq_enable(tp, true);
-		rtl_lock_config_regs(tp);
-	}
 	return work_done;
 }
 	rtl_rar_set(tp, mac_addr);
 }
+/* register is set if system vendor successfully tested ASPM 1.2 */
+static bool rtl_aspm_is_safe(struct rtl8169_private *tp)
+{
+	if (tp->mac_version >= RTL_GIGA_MAC_VER_61 &&
+	    r8168_mac_ocp_read(tp, 0xc0b2) & 0xf)
+		return true;
+	return false;
+}
 static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
 	struct rtl8169_private *tp;
 				     xid);
 	tp->mac_version = chipset;
+	/* Disable ASPM L1 as that cause random device stop working
+	 * problems as well as full system hangs for some PCIe devices users.
+	 * Chips from RTL8168h partially have issues with L1.2, but seem
+	 * to work fine with L1 and L1.1.
+	 */
+	if (rtl_aspm_is_safe(tp))
+		rc = 0;
+	else if (tp->mac_version >= RTL_GIGA_MAC_VER_46)
+		rc = pci_disable_link_state(pdev, PCIE_LINK_STATE_L1_2);
+	else
+		rc = pci_disable_link_state(pdev, PCIE_LINK_STATE_L1);
+	tp->aspm_manageable = !rc;
 	tp->dash_type = rtl_check_dash(tp);
 	tp->cp_cmd = RTL_R16(tp, CPlusCmd) & CPCMD_MASK;

drivers/net/ethernet/ti/cpsw_ale.c+19−5

 static inline int cpsw_ale_get_field(u32 *ale_entry, u32 start, u32 bits)
 {
-	int idx;
+	int idx, idx2;
+	u32 hi_val = 0;
 	idx    = start / 32;
+	idx2 = (start + bits - 1) / 32;
+	/* Check if bits to be fetched exceed a word */
+	if (idx != idx2) {
+		idx2 = 2 - idx2; /* flip */
+		hi_val = ale_entry[idx2] << ((idx2 * 32) - start);
+	}
 	start -= idx * 32;
 	idx    = 2 - idx; /* flip */
-	return (ale_entry[idx] >> start) & BITMASK(bits);
+	return (hi_val + (ale_entry[idx] >> start)) & BITMASK(bits);
 }
 static inline void cpsw_ale_set_field(u32 *ale_entry, u32 start, u32 bits,
 				      u32 value)
 {
-	int idx;
+	int idx, idx2;
 	value &= BITMASK(bits);
-	idx    = start / 32;
+	idx = start / 32;
+	idx2 = (start + bits - 1) / 32;
+	/* Check if bits to be set exceed a word */
+	if (idx != idx2) {
+		idx2 = 2 - idx2; /* flip */
+		ale_entry[idx2] &= ~(BITMASK(bits + start - (idx2 * 32)));
+		ale_entry[idx2] |= (value >> ((idx2 * 32) - start));
+	}
 	start -= idx * 32;
-	idx    = 2 - idx; /* flip */
+	idx = 2 - idx; /* flip */
 	ale_entry[idx] &= ~(BITMASK(bits) << start);
 	ale_entry[idx] |=  (value << start);
 }

drivers/net/ethernet/wangxun/libwx/wx_hw.c+0−1

@@ -1511,7 +1511,6 @@ static void wx_configure_rx(struct wx *wx) · 1510 unmodified lines
1511	psrtype = WX_RDB_PL_CFG_L4HDR \|	1511	psrtype = WX_RDB_PL_CFG_L4HDR \|
1512	WX_RDB_PL_CFG_L3HDR \|	1512	WX_RDB_PL_CFG_L3HDR \|
1513	WX_RDB_PL_CFG_L2HDR \|	1513	WX_RDB_PL_CFG_L2HDR \|
1514	WX_RDB_PL_CFG_TUN_TUNHDR \|
1515	WX_RDB_PL_CFG_TUN_TUNHDR;	1514	WX_RDB_PL_CFG_TUN_TUNHDR;
1516	wr32(wx, WX_RDB_PL_CFG(0), psrtype);	1515	wr32(wx, WX_RDB_PL_CFG(0), psrtype);
1517		1516

drivers/net/phy/phy_device.c+14−7

 {
 	int rc;
+	ethtool_set_ethtool_phy_ops(&phy_ethtool_phy_ops);
 	rc = mdio_bus_init();
 	if (rc)
-		return rc;
+		goto err_ethtool_phy_ops;
-	ethtool_set_ethtool_phy_ops(&phy_ethtool_phy_ops);
 	features_init();
 	rc = phy_driver_register(&genphy_c45_driver, THIS_MODULE);
 	if (rc)
-		goto err_c45;
+		goto err_mdio_bus;
 	rc = phy_driver_register(&genphy_driver, THIS_MODULE);
-	if (rc) {
+	if (rc)
-		phy_driver_unregister(&genphy_c45_driver);
+		goto err_c45;
+	return 0;
 err_c45:
-		mdio_bus_exit();
+	phy_driver_unregister(&genphy_c45_driver);
-	}
+err_mdio_bus:
+	mdio_bus_exit();
+err_ethtool_phy_ops:
+	ethtool_set_ethtool_phy_ops(NULL);
 	return rc;
 }

drivers/net/usb/usbnet.c+6−0

 	} else if (!info->in || !info->out)
 		status = usbnet_get_endpoints (dev, udev);
 	else {
+		u8 ep_addrs[3] = {
+			info->in + USB_DIR_IN, info->out + USB_DIR_OUT, 0
+		};
 		dev->in = usb_rcvbulkpipe (xdev, info->in);
 		dev->out = usb_sndbulkpipe (xdev, info->out);
 		if (!(info->flags & FLAG_NO_SETINT))
 		else
 			status = 0;
+		if (status == 0 && !usb_check_bulk_endpoints(udev, ep_addrs))
+			status = -EINVAL;
 	}
 	if (status >= 0 && dev->status)
 		status = init_status (dev, udev);

drivers/net/vrf.c+6−6

@@ -664,7 +664,7 @@ static int vrf_finish_output6(struct net net, struct sock sk, · 663 unmodified lines
664	skb->protocol = htons(ETH_P_IPV6);	664	skb->protocol = htons(ETH_P_IPV6);
665	skb->dev = dev;	665	skb->dev = dev;
666		666
667	rcu_read_lock_bh();	667	rcu_read_lock();
668	nexthop = rt6_nexthop((struct rt6_info *)dst, &ipv6_hdr(skb)->daddr);	668	nexthop = rt6_nexthop((struct rt6_info *)dst, &ipv6_hdr(skb)->daddr);
669	neigh = __ipv6_neigh_lookup_noref(dst->dev, nexthop);	669	neigh = __ipv6_neigh_lookup_noref(dst->dev, nexthop);
670	if (unlikely(!neigh))	670	if (unlikely(!neigh))
@@ -672,10 +672,10 @@ static int vrf_finish_output6(struct net net, struct sock sk, · 1 unmodified line
672	if (!IS_ERR(neigh)) {	672	if (!IS_ERR(neigh)) {
673	sock_confirm_neigh(skb, neigh);	673	sock_confirm_neigh(skb, neigh);
674	ret = neigh_output(neigh, skb, false);	674	ret = neigh_output(neigh, skb, false);
675	rcu_read_unlock_bh();	675	rcu_read_unlock();
676	return ret;	676	return ret;
677	}	677	}
678	rcu_read_unlock_bh();	678	rcu_read_unlock();
679		679
680	IP6_INC_STATS(dev_net(dst->dev),	680	IP6_INC_STATS(dev_net(dst->dev),
681	ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);	681	ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
@@ -889,7 +889,7 @@ static int vrf_finish_output(struct net net, struct sock sk, struct sk_buff *s · 207 unmodified lines
889	}	889	}
890	}	890	}
891		891
892	rcu_read_lock_bh();	892	rcu_read_lock();
893		893
894	neigh = ip_neigh_for_gw(rt, skb, &is_v6gw);	894	neigh = ip_neigh_for_gw(rt, skb, &is_v6gw);
895	if (!IS_ERR(neigh)) {	895	if (!IS_ERR(neigh)) {
@@ -898,11 +898,11 @@ static int vrf_finish_output(struct net net, struct sock sk, struct sk_buff *s · 2 unmodified lines
898	sock_confirm_neigh(skb, neigh);	898	sock_confirm_neigh(skb, neigh);
899	/* if crossing protocols, can not use the cached header */	899	/* if crossing protocols, can not use the cached header */
900	ret = neigh_output(neigh, skb, is_v6gw);	900	ret = neigh_output(neigh, skb, is_v6gw);
901	rcu_read_unlock_bh();	901	rcu_read_unlock();
902	return ret;	902	return ret;
903	}	903	}
904		904
905	rcu_read_unlock_bh();	905	rcu_read_unlock();
906	vrf_tx_error(skb->dev, skb);	906	vrf_tx_error(skb->dev, skb);
907	return -EINVAL;	907	return -EINVAL;
908	}	908	}

include/linux/tcp.h+1−1

@@ -513,7 +513,7 @@ static inline void fastopen_queue_tune(struct sock *sk, int backlog) · 512 unmodified lines
513	struct request_sock_queue *queue = &inet_csk(sk)->icsk_accept_queue;	513	struct request_sock_queue *queue = &inet_csk(sk)->icsk_accept_queue;
514	int somaxconn = READ_ONCE(sock_net(sk)->core.sysctl_somaxconn);	514	int somaxconn = READ_ONCE(sock_net(sk)->core.sysctl_somaxconn);
515		515
516	queue->fastopenq.max_qlen = min_t(unsigned int, backlog, somaxconn);	516	WRITE_ONCE(queue->fastopenq.max_qlen, min_t(unsigned int, backlog, somaxconn));
517	}	517	}
518		518
519	static inline void tcp_move_syn(struct tcp_sock *tp,	519	static inline void tcp_move_syn(struct tcp_sock *tp,

include/net/bluetooth/hci_core.h+5−2

 	const char		*fw_info;
 	struct dentry		*debugfs;
-#ifdef CONFIG_DEV_COREDUMP
 	struct hci_devcoredump	dump;
-#endif
 	struct device		dev;
 	struct hci_conn *conn;
 	bool explicit_connect;
+	/* Accessed without hdev->lock: */
 	hci_conn_flags_t flags;
 	u8  privacy_mode;
 };
 					    bdaddr_t *addr, u8 addr_type);
 void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type);
 void hci_conn_params_clear_disabled(struct hci_dev *hdev);
+void hci_conn_params_free(struct hci_conn_params *param);
+void hci_pend_le_list_del_init(struct hci_conn_params *param);
+void hci_pend_le_list_add(struct hci_conn_params *param,
+			  struct list_head *list);
 struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
 						  bdaddr_t *addr,
 						  u8 addr_type);

include/net/bonding.h+1−1

@@ -277,7 +277,7 @@ struct bond_vlan_tag { · 276 unmodified lines
277	unsigned short vlan_id;	277	unsigned short vlan_id;
278	};	278	};
279		279
280	/**	280	/*
281	* Returns NULL if the net_device does not belong to any of the bond's slaves	281	* Returns NULL if the net_device does not belong to any of the bond's slaves
282	*	282	*
283	* Caller must hold bond lock for read	283	* Caller must hold bond lock for read

include/net/cfg802154.h+2−1

@@ -170,7 +170,8 @@ wpan_phy_cca_cmp(const struct wpan_phy_cca a, const struct wpan_phy_cca b) · 169 unmodified lines
170	}	170	}
171		171
172	/**	172	/**
173	* @WPAN_PHY_FLAG_TRANSMIT_POWER: Indicates that transceiver will support	173	* enum wpan_phy_flags - WPAN PHY state flags
		174	* @WPAN_PHY_FLAG_TXPOWER: Indicates that transceiver will support
174	* transmit power setting.	175	* transmit power setting.
175	* @WPAN_PHY_FLAG_CCA_ED_LEVEL: Indicates that transceiver will support cca ed	176	* @WPAN_PHY_FLAG_CCA_ED_LEVEL: Indicates that transceiver will support cca ed
176	* level setting.	177	* level setting.

include/net/codel.h+2−2

@@ -145,8 +145,8 @@ struct codel_vars { · 144 unmodified lines
145	* @maxpacket: largest packet we've seen so far	145	* @maxpacket: largest packet we've seen so far
146	* @drop_count: temp count of dropped packets in dequeue()	146	* @drop_count: temp count of dropped packets in dequeue()
147	* @drop_len: bytes of dropped packets in dequeue()	147	* @drop_len: bytes of dropped packets in dequeue()
148	* ecn_mark: number of packets we ECN marked instead of dropping	148	* @ecn_mark: number of packets we ECN marked instead of dropping
149	* ce_mark: number of packets CE marked because sojourn time was above ce_threshold	149	* @ce_mark: number of packets CE marked because sojourn time was above ce_threshold
150	*/	150	*/
151	struct codel_stats {	151	struct codel_stats {
152	u32 maxpacket;	152	u32 maxpacket;

include/net/devlink.h+16−12

 /**
  * struct devlink_dpipe_header - dpipe header object
  * @name: header name
- * @id: index, global/local detrmined by global bit
+ * @id: index, global/local determined by global bit
  * @fields: fields
  * @fields_count: number of fields
  * @global: indicates if header is shared like most protocol header
  * @header_index: header index (packets can have several headers of same
  *		  type like in case of tunnels)
  * @header: header
- * @fieled_id: field index
+ * @field_id: field index
  */
 struct devlink_dpipe_match {
 	enum devlink_dpipe_match_type type;
  * @header_index: header index (packets can have several headers of same
  *		  type like in case of tunnels)
  * @header: header
- * @fieled_id: field index
+ * @field_id: field index
  */
 struct devlink_dpipe_action {
 	enum devlink_dpipe_action_type type;
  * struct devlink_dpipe_entry - table entry object
  * @index: index of the entry in the table
  * @match_values: match values
- * @matche_values_count: count of matches tuples
+ * @match_values_count: count of matches tuples
  * @action_values: actions values
  * @action_values_count: count of actions values
  * @counter: value of counter
  */
 struct devlink_dpipe_table {
 	void *priv;
+	/* private: */
 	struct list_head list;
+	/* public: */
 	const char *name;
 	bool counters_enabled;
 	bool counter_control_extern;
 /**
  * struct devlink_dpipe_table_ops - dpipe_table ops
- * @actions_dump - dumps all tables actions
+ * @actions_dump: dumps all tables actions
- * @matches_dump - dumps all tables matches
+ * @matches_dump: dumps all tables matches
- * @entries_dump - dumps all active entries in the table
+ * @entries_dump: dumps all active entries in the table
- * @counters_set_update - when changing the counter status hardware sync
+ * @counters_set_update:  when changing the counter status hardware sync
  *			  maybe needed to allocate/free counter related
  *			  resources
- * @size_get - get size
+ * @size_get: get size
  */
 struct devlink_dpipe_table_ops {
 	int (*actions_dump)(void *priv, struct sk_buff *skb);
 /**
  * struct devlink_dpipe_headers - dpipe headers
- * @headers - header array can be shared (global bit) or driver specific
+ * @headers: header array can be shared (global bit) or driver specific
- * @headers_count - count of headers
+ * @headers_count: count of headers
  */
 struct devlink_dpipe_headers {
 	struct devlink_dpipe_header **headers;
  * @size_min: minimum size which can be set
  * @size_max: maximum size which can be set
  * @size_granularity: size granularity
- * @size_unit: resource's basic unit
+ * @unit: resource's basic unit
  */
 struct devlink_resource_size_params {
 	u64 size_min;
 /**
  * struct devlink_param - devlink configuration parameter data
+ * @id: devlink parameter id number
  * @name: name of the parameter
  * @generic: indicates if the parameter is generic or driver specific
  * @type: parameter type
  * struct devlink_flash_update_params - Flash Update parameters
  * @fw: pointer to the firmware data to update from
  * @component: the flash component to update
+ * @overwrite_mask: which types of flash update are supported (may be %0)
  *
  * With the exception of fw, drivers must opt-in to parameters by
  * setting the appropriate bit in the supported_flash_update_params field in

include/net/inet_frag.h+1−1

@@ -29,7 +29,7 @@ struct fqdir { · 28 unmodified lines
29	};	29	};
30		30
31	/**	31	/**
32	* fragment queue flags	32	* enum: fragment queue flags
33	*	33	*
34	* @INET_FRAG_FIRST_IN: first fragment has arrived	34	* @INET_FRAG_FIRST_IN: first fragment has arrived
35	* @INET_FRAG_LAST_IN: final fragment has arrived	35	* @INET_FRAG_LAST_IN: final fragment has arrived

include/net/llc_conn.h+1−1

@@ -111,7 +111,7 @@ void llc_conn_resend_i_pdu_as_cmd(struct sock *sk, u8 nr, u8 first_p_bit); · 110 unmodified lines
111	void llc_conn_resend_i_pdu_as_rsp(struct sock *sk, u8 nr, u8 first_f_bit);	111	void llc_conn_resend_i_pdu_as_rsp(struct sock *sk, u8 nr, u8 first_f_bit);
112	int llc_conn_remove_acked_pdus(struct sock conn, u8 nr, u16 how_many_unacked);	112	int llc_conn_remove_acked_pdus(struct sock conn, u8 nr, u16 how_many_unacked);
113	struct sock llc_lookup_established(struct llc_sap sap, struct llc_addr *daddr,	113	struct sock llc_lookup_established(struct llc_sap sap, struct llc_addr *daddr,
114	struct llc_addr *laddr);	114	struct llc_addr laddr, const struct net net);
115	void llc_sap_add_socket(struct llc_sap sap, struct sock sk);	115	void llc_sap_add_socket(struct llc_sap sap, struct sock sk);
116	void llc_sap_remove_socket(struct llc_sap sap, struct sock sk);	116	void llc_sap_remove_socket(struct llc_sap sap, struct sock sk);
117		117

include/net/llc_pdu.h+4−2

 /**
  *	llc_pdu_decode_da - extracts dest address of input frame
  *	@skb: input skb that destination address must be extracted from it
- *	@sa: pointer to destination address (6 byte array).
+ *	@da: pointer to destination address (6 byte array).
  *
  *	This function extracts destination address(MAC) of input frame.
  */
 /**
  *	llc_pdu_init_as_test_cmd - sets PDU as TEST
- *	@skb - Address of the skb to build
+ *	@skb: Address of the skb to build
  *
  * 	Sets a PDU as TEST
  */
 /**
  *	llc_pdu_init_as_xid_cmd - sets bytes 3, 4 & 5 of LLC header as XID
  *	@skb: input skb that header must be set into it.
+ *	@svcs_supported: The class of the LLC (I or II)
+ *	@rx_window: The size of the receive window of the LLC
  *
  *	This function sets third,fourth,fifth and sixth bytes of LLC header as
  *	a XID PDU.

include/net/nsh.h+1−1

@@ -192,7 +192,7 @@ · 191 unmodified lines
192		192
193	/**	193	/**
194	* struct nsh_md1_ctx - Keeps track of NSH context data	194	* struct nsh_md1_ctx - Keeps track of NSH context data
195	* @nshc<1-4>: NSH Contexts.	195	* @context: NSH Contexts.
196	*/	196	*/
197	struct nsh_md1_ctx {	197	struct nsh_md1_ctx {
198	__be32 context[4];	198	__be32 context[4];

include/net/pie.h+1−1

@@ -17,7 +17,7 @@ · 16 unmodified lines
17	/**	17	/**
18	* struct pie_params - contains pie parameters	18	* struct pie_params - contains pie parameters
19	* @target: target delay in pschedtime	19	* @target: target delay in pschedtime
20	* @tudpate: interval at which drop probability is calculated	20	* @tupdate: interval at which drop probability is calculated
21	* @limit: total number of packets that can be in the queue	21	* @limit: total number of packets that can be in the queue
22	* @alpha: parameter to control drop probability	22	* @alpha: parameter to control drop probability
23	* @beta: parameter to control drop probability	23	* @beta: parameter to control drop probability

include/net/rsi_91x.h+1−1

@@ -1,4 +1,4 @@
1	/**	1	/*
2	* Copyright (c) 2017 Redpine Signals Inc.	2	* Copyright (c) 2017 Redpine Signals Inc.
3	*	3	*
4	* Permission to use, copy, modify, and/or distribute this software for any	4	* Permission to use, copy, modify, and/or distribute this software for any

include/net/tcp.h+24−7

 static inline int keepalive_intvl_when(const struct tcp_sock *tp)
 {
 	struct net *net = sock_net((struct sock *)tp);
+	int val;
-	return tp->keepalive_intvl ? :
+	/* Paired with WRITE_ONCE() in tcp_sock_set_keepintvl()
-		READ_ONCE(net->ipv4.sysctl_tcp_keepalive_intvl);
+	 * and do_tcp_setsockopt().
+	 */
+	val = READ_ONCE(tp->keepalive_intvl);
+	return val ? : READ_ONCE(net->ipv4.sysctl_tcp_keepalive_intvl);
 }
 static inline int keepalive_time_when(const struct tcp_sock *tp)
 {
 	struct net *net = sock_net((struct sock *)tp);
+	int val;
-	return tp->keepalive_time ? :
+	/* Paired with WRITE_ONCE() in tcp_sock_set_keepidle_locked() */
-		READ_ONCE(net->ipv4.sysctl_tcp_keepalive_time);
+	val = READ_ONCE(tp->keepalive_time);
+	return val ? : READ_ONCE(net->ipv4.sysctl_tcp_keepalive_time);
 }
 static inline int keepalive_probes(const struct tcp_sock *tp)
 {
 	struct net *net = sock_net((struct sock *)tp);
+	int val;
-	return tp->keepalive_probes ? :
+	/* Paired with WRITE_ONCE() in tcp_sock_set_keepcnt()
-		READ_ONCE(net->ipv4.sysctl_tcp_keepalive_probes);
+	 * and do_tcp_setsockopt().
+	 */
+	val = READ_ONCE(tp->keepalive_probes);
+	return val ? : READ_ONCE(net->ipv4.sysctl_tcp_keepalive_probes);
 }
 static inline u32 keepalive_time_elapsed(const struct tcp_sock *tp)
 static inline u32 tcp_notsent_lowat(const struct tcp_sock *tp)
 {
 	struct net *net = sock_net((struct sock *)tp);
-	return tp->notsent_lowat ?: READ_ONCE(net->ipv4.sysctl_tcp_notsent_lowat);
+	u32 val;
+	val = READ_ONCE(tp->notsent_lowat);
+	return val ?: READ_ONCE(net->ipv4.sysctl_tcp_notsent_lowat);
 }
 bool tcp_stream_memory_free(const struct sock *sk, int wake);

kernel/bpf/verifier.c+25−7

  * Since recursion is prevented by check_cfg() this algorithm
  * only needs a local stack of MAX_CALL_FRAMES to remember callsites
  */
-static int check_max_stack_depth(struct bpf_verifier_env *env)
+static int check_max_stack_depth_subprog(struct bpf_verifier_env *env, int idx)
 {
-	int depth = 0, frame = 0, idx = 0, i = 0, subprog_end;
 	struct bpf_subprog_info *subprog = env->subprog_info;
 	struct bpf_insn *insn = env->prog->insnsi;
+	int depth = 0, frame = 0, i, subprog_end;
 	bool tail_call_reachable = false;
 	int ret_insn[MAX_CALL_FRAMES];
 	int ret_prog[MAX_CALL_FRAMES];
 	int j;
+	i = subprog[idx].start;
 process_func:
 	/* protect against potential stack overflow that might happen when
 	 * bpf2bpf calls get combined with tailcalls. Limit the caller's stack
 continue_func:
 	subprog_end = subprog[idx + 1].start;
 	for (; i < subprog_end; i++) {
-		int next_insn;
+		int next_insn, sidx;
 		if (!bpf_pseudo_call(insn + i) && !bpf_pseudo_func(insn + i))
 			continue;
 		/* find the callee */
 		next_insn = i + insn[i].imm + 1;
-		idx = find_subprog(env, next_insn);
+		sidx = find_subprog(env, next_insn);
-		if (idx < 0) {
+		if (sidx < 0) {
 			WARN_ONCE(1, "verifier bug. No program starts at insn %d\n",
 				  next_insn);
 			return -EFAULT;
 		}
-		if (subprog[idx].is_async_cb) {
+		if (subprog[sidx].is_async_cb) {
-			if (subprog[idx].has_tail_call) {
+			if (subprog[sidx].has_tail_call) {
 				verbose(env, "verifier bug. subprog has tail_call and async cb\n");
 				return -EFAULT;
 			}
 				continue;
 		}
 		i = next_insn;
+		idx = sidx;
 		if (subprog[idx].has_tail_call)
 			tail_call_reachable = true;
 	goto continue_func;
 }
+static int check_max_stack_depth(struct bpf_verifier_env *env)
+{
+	struct bpf_subprog_info *si = env->subprog_info;
+	int ret;
+	for (int i = 0; i < env->subprog_cnt; i++) {
+		if (!i || si[i].is_async_cb) {
+			ret = check_max_stack_depth_subprog(env, i);
+			if (ret < 0)
+				return ret;
+		}
+		continue;
+	}
+	return 0;
+}
 #ifndef CONFIG_BPF_JIT_ALWAYS_ON
 static int get_callee_stack_depth(struct bpf_verifier_env *env,
 				  const struct bpf_insn *insn, int idx)

net/bluetooth/hci_conn.c+7−7

@@ -118,7 +118,7 @@ static void hci_connect_le_scan_cleanup(struct hci_conn *conn, u8 status) · 117 unmodified lines
118	*/	118	*/
119	params->explicit_connect = false;	119	params->explicit_connect = false;
120		120
121	list_del_init(&params->action);	121	hci_pend_le_list_del_init(params);
122		122
123	switch (params->auto_connect) {	123	switch (params->auto_connect) {
124	case HCI_AUTO_CONN_EXPLICIT:	124	case HCI_AUTO_CONN_EXPLICIT:
@@ -127,10 +127,10 @@ static void hci_connect_le_scan_cleanup(struct hci_conn *conn, u8 status) · 2 unmodified lines
127	return;	127	return;
128	case HCI_AUTO_CONN_DIRECT:	128	case HCI_AUTO_CONN_DIRECT:
129	case HCI_AUTO_CONN_ALWAYS:	129	case HCI_AUTO_CONN_ALWAYS:
130	list_add(&params->action, &hdev->pend_le_conns);	130	hci_pend_le_list_add(params, &hdev->pend_le_conns);
131	break;	131	break;
132	case HCI_AUTO_CONN_REPORT:	132	case HCI_AUTO_CONN_REPORT:
133	list_add(&params->action, &hdev->pend_le_reports);	133	hci_pend_le_list_add(params, &hdev->pend_le_reports);
134	break;	134	break;
135	default:	135	default:
136	break;	136	break;
@@ -1426,8 +1426,8 @@ static int hci_explicit_conn_params_set(struct hci_dev *hdev, · 1289 unmodified lines
1426	if (params->auto_connect == HCI_AUTO_CONN_DISABLED \|\|	1426	if (params->auto_connect == HCI_AUTO_CONN_DISABLED \|\|
1427	params->auto_connect == HCI_AUTO_CONN_REPORT \|\|	1427	params->auto_connect == HCI_AUTO_CONN_REPORT \|\|
1428	params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {	1428	params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
1429	list_del_init(&params->action);	1429	hci_pend_le_list_del_init(params);
1430	list_add(&params->action, &hdev->pend_le_conns);	1430	hci_pend_le_list_add(params, &hdev->pend_le_conns);
1431	}	1431	}
1432		1432
1433	params->explicit_connect = true;	1433	params->explicit_connect = true;
@@ -1684,7 +1684,7 @@ struct hci_conn hci_connect_sco(struct hci_dev hdev, int type, bdaddr_t *dst, · 250 unmodified lines
1684	if (!link) {	1684	if (!link) {
1685	hci_conn_drop(acl);	1685	hci_conn_drop(acl);
1686	hci_conn_drop(sco);	1686	hci_conn_drop(sco);
1687	return NULL;	1687	return ERR_PTR(-ENOLINK);
1688	}	1688	}
1689		1689
1690	sco->setting = setting;	1690	sco->setting = setting;
@@ -2254,7 +2254,7 @@ struct hci_conn hci_connect_cis(struct hci_dev hdev, bdaddr_t *dst, · 563 unmodified lines
2254	if (!link) {	2254	if (!link) {
2255	hci_conn_drop(le);	2255	hci_conn_drop(le);
2256	hci_conn_drop(cis);	2256	hci_conn_drop(cis);
2257	return NULL;	2257	return ERR_PTR(-ENOLINK);
2258	}	2258	}
2259		2259
2260	/* If LE is already connected and CIS handle is already set proceed to	2260	/* If LE is already connected and CIS handle is already set proceed to

net/bluetooth/hci_core.c+34−8

 				  struct adv_monitor *monitor)
 {
 	int status = 0;
+	int handle;
 	switch (hci_get_adv_monitor_offload_ext(hdev)) {
 	case HCI_ADV_MONITOR_EXT_NONE: /* also goes here when powered off */
 		goto free_monitor;
 	case HCI_ADV_MONITOR_EXT_MSFT:
+		handle = monitor->handle;
 		status = msft_remove_monitor(hdev, monitor);
 		bt_dev_dbg(hdev, "%s remove monitor %d msft status %d",
-			   hdev->name, monitor->handle, status);
+			   hdev->name, handle, status);
 		break;
 	}
 	return NULL;
 }
-/* This function requires the caller holds hdev->lock */
+/* This function requires the caller holds hdev->lock or rcu_read_lock */
 struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
 						  bdaddr_t *addr, u8 addr_type)
 {
 	struct hci_conn_params *param;
-	list_for_each_entry(param, list, action) {
+	rcu_read_lock();
+	list_for_each_entry_rcu(param, list, action) {
 		if (bacmp(&param->addr, addr) == 0 &&
-		    param->addr_type == addr_type)
+		    param->addr_type == addr_type) {
+			rcu_read_unlock();
 			return param;
+		}
 	}
+	rcu_read_unlock();
 	return NULL;
 }
+/* This function requires the caller holds hdev->lock */
+void hci_pend_le_list_del_init(struct hci_conn_params *param)
+{
+	if (list_empty(&param->action))
+		return;
+	list_del_rcu(&param->action);
+	synchronize_rcu();
+	INIT_LIST_HEAD(&param->action);
+}
+/* This function requires the caller holds hdev->lock */
+void hci_pend_le_list_add(struct hci_conn_params *param,
+			  struct list_head *list)
+{
+	list_add_rcu(&param->action, list);
+}
 /* This function requires the caller holds hdev->lock */
 struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
 					    bdaddr_t *addr, u8 addr_type)
 	return params;
 }
-static void hci_conn_params_free(struct hci_conn_params *params)
+void hci_conn_params_free(struct hci_conn_params *params)
 {
+	hci_pend_le_list_del_init(params);
 	if (params->conn) {
 		hci_conn_drop(params->conn);
 		hci_conn_put(params->conn);
 	}
-	list_del(&params->action);
 	list_del(&params->list);
 	kfree(params);
 }
 			continue;
 		}
-		list_del(&params->list);
+		hci_conn_params_free(params);
-		kfree(params);
 	}
 	BT_DBG("All LE disabled connection parameters were removed");

net/bluetooth/hci_event.c+9−6

 	params = hci_conn_params_lookup(hdev, &cp->bdaddr, cp->bdaddr_type);
 	if (params)
-		params->privacy_mode = cp->mode;
+		WRITE_ONCE(params->privacy_mode, cp->mode);
 	hci_dev_unlock(hdev);
 			hci_enable_advertising(hdev);
 		}
+		/* Inform sockets conn is gone before we delete it */
+		hci_disconn_cfm(conn, HCI_ERROR_UNSPECIFIED);
 		goto done;
 	}
 		case HCI_AUTO_CONN_DIRECT:
 		case HCI_AUTO_CONN_ALWAYS:
-			list_del_init(&params->action);
+			hci_pend_le_list_del_init(params);
-			list_add(&params->action, &hdev->pend_le_conns);
+			hci_pend_le_list_add(params, &hdev->pend_le_conns);
 			break;
 		default:
 		case HCI_AUTO_CONN_DIRECT:
 		case HCI_AUTO_CONN_ALWAYS:
-			list_del_init(&params->action);
+			hci_pend_le_list_del_init(params);
-			list_add(&params->action, &hdev->pend_le_conns);
+			hci_pend_le_list_add(params, &hdev->pend_le_conns);
 			hci_update_passive_scan(hdev);
 			break;
 	params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
 					   conn->dst_type);
 	if (params) {
-		list_del_init(&params->action);
+		hci_pend_le_list_del_init(params);
 		if (params->conn) {
 			hci_conn_drop(params->conn);
 			hci_conn_put(params->conn);

net/bluetooth/hci_sync.c+106−11

@@ -2160,15 +2160,23 @@ static int hci_le_del_accept_list_sync(struct hci_dev *hdev, · 2159 unmodified lines
2160	return 0;	2160	return 0;
2161	}	2161	}
2162		2162
		2163	struct conn_params {
		2164	bdaddr_t addr;
		2165	u8 addr_type;
		2166	hci_conn_flags_t flags;
		2167	u8 privacy_mode;
		2168	};
		2169
2163	/* Adds connection to resolve list if needed.	2170	/* Adds connection to resolve list if needed.
2164	* Setting params to NULL programs local hdev->irk	2171	* Setting params to NULL programs local hdev->irk
2165	*/	2172	*/
2166	static int hci_le_add_resolve_list_sync(struct hci_dev *hdev,	2173	static int hci_le_add_resolve_list_sync(struct hci_dev *hdev,
2167	struct hci_conn_params *params)	2174	struct conn_params *params)
2168	{	2175	{
2169	struct hci_cp_le_add_to_resolv_list cp;	2176	struct hci_cp_le_add_to_resolv_list cp;
2170	struct smp_irk *irk;	2177	struct smp_irk *irk;
2171	struct bdaddr_list_with_irk *entry;	2178	struct bdaddr_list_with_irk *entry;
		2179	struct hci_conn_params *p;
2172		2180
2173	if (!use_ll_privacy(hdev))	2181	if (!use_ll_privacy(hdev))
2174	return 0;	2182	return 0;
@@ -2203,6 +2211,16 @@ static int hci_le_add_resolve_list_sync(struct hci_dev *hdev, · 28 unmodified lines
2203	/* Default privacy mode is always Network */	2211	/* Default privacy mode is always Network */
2204	params->privacy_mode = HCI_NETWORK_PRIVACY;	2212	params->privacy_mode = HCI_NETWORK_PRIVACY;
2205		2213
		2214	rcu_read_lock();
		2215	p = hci_pend_le_action_lookup(&hdev->pend_le_conns,
		2216	&params->addr, params->addr_type);
		2217	if (!p)
		2218	p = hci_pend_le_action_lookup(&hdev->pend_le_reports,
		2219	&params->addr, params->addr_type);
		2220	if (p)
		2221	WRITE_ONCE(p->privacy_mode, HCI_NETWORK_PRIVACY);
		2222	rcu_read_unlock();
		2223
2206	done:	2224	done:
2207	if (hci_dev_test_flag(hdev, HCI_PRIVACY))	2225	if (hci_dev_test_flag(hdev, HCI_PRIVACY))
2208	memcpy(cp.local_irk, hdev->irk, 16);	2226	memcpy(cp.local_irk, hdev->irk, 16);
@@ -2215,7 +2233,7 @@ done: · 6 unmodified lines
2215		2233
2216	/* Set Device Privacy Mode. */	2234	/* Set Device Privacy Mode. */
2217	static int hci_le_set_privacy_mode_sync(struct hci_dev *hdev,	2235	static int hci_le_set_privacy_mode_sync(struct hci_dev *hdev,
2218	struct hci_conn_params *params)	2236	struct conn_params *params)
2219	{	2237	{
2220	struct hci_cp_le_set_privacy_mode cp;	2238	struct hci_cp_le_set_privacy_mode cp;
2221	struct smp_irk *irk;	2239	struct smp_irk *irk;
@@ -2240,6 +2258,8 @@ static int hci_le_set_privacy_mode_sync(struct hci_dev *hdev, · 18 unmodified lines
2240	bacpy(&cp.bdaddr, &irk->bdaddr);	2258	bacpy(&cp.bdaddr, &irk->bdaddr);
2241	cp.mode = HCI_DEVICE_PRIVACY;	2259	cp.mode = HCI_DEVICE_PRIVACY;
2242		2260
		2261	/* Note: params->privacy_mode is not updated since it is a copy */
		2262
2243	return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_PRIVACY_MODE,	2263	return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_PRIVACY_MODE,
2244	sizeof(cp), &cp, HCI_CMD_TIMEOUT);	2264	sizeof(cp), &cp, HCI_CMD_TIMEOUT);
2245	}	2265	}
@@ -2249,7 +2269,7 @@ static int hci_le_set_privacy_mode_sync(struct hci_dev *hdev, · 3 unmodified lines
2249	* properly set the privacy mode.	2269	* properly set the privacy mode.
2250	*/	2270	*/
2251	static int hci_le_add_accept_list_sync(struct hci_dev *hdev,	2271	static int hci_le_add_accept_list_sync(struct hci_dev *hdev,
2252	struct hci_conn_params *params,	2272	struct conn_params *params,
2253	u8 *num_entries)	2273	u8 *num_entries)
2254	{	2274	{
2255	struct hci_cp_le_add_to_accept_list cp;	2275	struct hci_cp_le_add_to_accept_list cp;
@@ -2447,6 +2467,52 @@ struct sk_buff hci_read_local_oob_data_sync(struct hci_dev hdev, · 191 unmodified lines
2447	return __hci_cmd_sync_sk(hdev, opcode, 0, NULL, 0, HCI_CMD_TIMEOUT, sk);	2467	return __hci_cmd_sync_sk(hdev, opcode, 0, NULL, 0, HCI_CMD_TIMEOUT, sk);
2448	}	2468	}
2449		2469
		2470	static struct conn_params conn_params_copy(struct list_head list, size_t *n)
		2471	{
		2472	struct hci_conn_params *params;
		2473	struct conn_params *p;
		2474	size_t i;
		2475
		2476	rcu_read_lock();
		2477
		2478	i = 0;
		2479	list_for_each_entry_rcu(params, list, action)
		2480	++i;
		2481	*n = i;
		2482
		2483	rcu_read_unlock();
		2484
		2485	p = kvcalloc(*n, sizeof(struct conn_params), GFP_KERNEL);
		2486	if (!p)
		2487	return NULL;
		2488
		2489	rcu_read_lock();
		2490
		2491	i = 0;
		2492	list_for_each_entry_rcu(params, list, action) {
		2493	/* Racing adds are handled in next scan update */
		2494	if (i >= *n)
		2495	break;
		2496
		2497	/* No hdev->lock, but: addr, addr_type are immutable.
		2498	* privacy_mode is only written by us or in
		2499	* hci_cc_le_set_privacy_mode that we wait for.
		2500	* We should be idempotent so MGMT updating flags
		2501	* while we are processing is OK.
		2502	*/
		2503	bacpy(&p[i].addr, &params->addr);
		2504	p[i].addr_type = params->addr_type;
		2505	p[i].flags = READ_ONCE(params->flags);
		2506	p[i].privacy_mode = READ_ONCE(params->privacy_mode);
		2507	++i;
		2508	}
		2509
		2510	rcu_read_unlock();
		2511
		2512	*n = i;
		2513	return p;
		2514	}
		2515
2450	/* Device must not be scanning when updating the accept list.	2516	/* Device must not be scanning when updating the accept list.
2451	*	2517	*
2452	* Update is done using the following sequence:	2518	* Update is done using the following sequence:
@@ -2466,11 +2532,12 @@ struct sk_buff hci_read_local_oob_data_sync(struct hci_dev hdev, · 13 unmodified lines
2466	*/	2532	*/
2467	static u8 hci_update_accept_list_sync(struct hci_dev *hdev)	2533	static u8 hci_update_accept_list_sync(struct hci_dev *hdev)
2468	{	2534	{
2469	struct hci_conn_params *params;	2535	struct conn_params *params;
2470	struct bdaddr_list b, t;	2536	struct bdaddr_list b, t;
2471	u8 num_entries = 0;	2537	u8 num_entries = 0;
2472	bool pend_conn, pend_report;	2538	bool pend_conn, pend_report;
2473	u8 filter_policy;	2539	u8 filter_policy;
		2540	size_t i, n;
2474	int err;	2541	int err;
2475		2542
2476	/* Pause advertising if resolving list can be used as controllers	2543	/* Pause advertising if resolving list can be used as controllers
@@ -2504,6 +2571,7 @@ static u8 hci_update_accept_list_sync(struct hci_dev *hdev) · 27 unmodified lines
2504	if (hci_conn_hash_lookup_le(hdev, &b->bdaddr, b->bdaddr_type))	2571	if (hci_conn_hash_lookup_le(hdev, &b->bdaddr, b->bdaddr_type))
2505	continue;	2572	continue;
2506		2573
		2574	/* Pointers not dereferenced, no locks needed */
2507	pend_conn = hci_pend_le_action_lookup(&hdev->pend_le_conns,	2575	pend_conn = hci_pend_le_action_lookup(&hdev->pend_le_conns,
2508	&b->bdaddr,	2576	&b->bdaddr,
2509	b->bdaddr_type);	2577	b->bdaddr_type);
@@ -2532,23 +2600,50 @@ static u8 hci_update_accept_list_sync(struct hci_dev *hdev) · 22 unmodified lines
2532	* available accept list entries in the controller, then	2600	* available accept list entries in the controller, then
2533	* just abort and return filer policy value to not use the	2601	* just abort and return filer policy value to not use the
2534	* accept list.	2602	* accept list.
		2603	*
		2604	* The list and params may be mutated while we wait for events,
		2605	* so make a copy and iterate it.
2535	*/	2606	*/
2536	list_for_each_entry(params, &hdev->pend_le_conns, action) {	2607
2537	err = hci_le_add_accept_list_sync(hdev, params, &num_entries);	2608	params = conn_params_copy(&hdev->pend_le_conns, &n);
2538	if (err)	2609	if (!params) {
		2610	err = -ENOMEM;
		2611	goto done;
		2612	}
		2613
		2614	for (i = 0; i < n; ++i) {
		2615	err = hci_le_add_accept_list_sync(hdev, &params[i],
		2616	&num_entries);
		2617	if (err) {
		2618	kvfree(params);
2539	goto done;	2619	goto done;
		2620	}
2540	}	2621	}
2541		2622
		2623	kvfree(params);
		2624
2542	/* After adding all new pending connections, walk through	2625	/* After adding all new pending connections, walk through
2543	* the list of pending reports and also add these to the	2626	* the list of pending reports and also add these to the
2544	* accept list if there is still space. Abort if space runs out.	2627	* accept list if there is still space. Abort if space runs out.
2545	*/	2628	*/
2546	list_for_each_entry(params, &hdev->pend_le_reports, action) {	2629
2547	err = hci_le_add_accept_list_sync(hdev, params, &num_entries);	2630	params = conn_params_copy(&hdev->pend_le_reports, &n);
2548	if (err)	2631	if (!params) {
		2632	err = -ENOMEM;
		2633	goto done;
		2634	}
		2635
		2636	for (i = 0; i < n; ++i) {
		2637	err = hci_le_add_accept_list_sync(hdev, &params[i],
		2638	&num_entries);
		2639	if (err) {
		2640	kvfree(params);
2549	goto done;	2641	goto done;
		2642	}
2550	}	2643	}
2551		2644
		2645	kvfree(params);
		2646
2552	/* Use the allowlist unless the following conditions are all true:	2647	/* Use the allowlist unless the following conditions are all true:
2553	* - We are not currently suspending	2648	* - We are not currently suspending
2554	* - There are 1 or more ADV monitors registered and it's not offloaded	2649	* - There are 1 or more ADV monitors registered and it's not offloaded
@@ -4837,12 +4932,12 @@ static void hci_pend_le_actions_clear(struct hci_dev *hdev) · 2282 unmodified lines
4837	struct hci_conn_params *p;	4932	struct hci_conn_params *p;
4838		4933
4839	list_for_each_entry(p, &hdev->le_conn_params, list) {	4934	list_for_each_entry(p, &hdev->le_conn_params, list) {
		4935	hci_pend_le_list_del_init(p);
4840	if (p->conn) {	4936	if (p->conn) {
4841	hci_conn_drop(p->conn);	4937	hci_conn_drop(p->conn);
4842	hci_conn_put(p->conn);	4938	hci_conn_put(p->conn);
4843	p->conn = NULL;	4939	p->conn = NULL;
4844	}	4940	}
4845	list_del_init(&p->action);
4846	}	4941	}
4847		4942
4848	BT_DBG("All LE pending actions cleared");	4943	BT_DBG("All LE pending actions cleared");

net/bluetooth/iso.c+31−22

@@ -123,8 +123,11 @@ static struct iso_conn iso_conn_add(struct hci_conn hcon) · 122 unmodified lines
123	{	123	{
124	struct iso_conn *conn = hcon->iso_data;	124	struct iso_conn *conn = hcon->iso_data;
125		125
126	if (conn)	126	if (conn) {
		127	if (!conn->hcon)
		128	conn->hcon = hcon;
127	return conn;	129	return conn;
		130	}
128		131
129	conn = kzalloc(sizeof(*conn), GFP_KERNEL);	132	conn = kzalloc(sizeof(*conn), GFP_KERNEL);
130	if (!conn)	133	if (!conn)
@@ -300,14 +303,13 @@ static int iso_connect_bis(struct sock *sk) · 169 unmodified lines
300	goto unlock;	303	goto unlock;
301	}	304	}
302		305
303	hci_dev_unlock(hdev);	306	lock_sock(sk);
304	hci_dev_put(hdev);
305		307
306	err = iso_chan_add(conn, sk, NULL);	308	err = iso_chan_add(conn, sk, NULL);
307	if (err)	309	if (err) {
308	return err;	310	release_sock(sk);
309		311	goto unlock;
310	lock_sock(sk);	312	}
311		313
312	/* Update source addr of the socket */	314	/* Update source addr of the socket */
313	bacpy(&iso_pi(sk)->src, &hcon->src);	315	bacpy(&iso_pi(sk)->src, &hcon->src);
@@ -321,7 +323,6 @@ static int iso_connect_bis(struct sock *sk) · 7 unmodified lines
321	}	323	}
322		324
323	release_sock(sk);	325	release_sock(sk);
324	return err;
325		326
326	unlock:	327	unlock:
327	hci_dev_unlock(hdev);	328	hci_dev_unlock(hdev);
@@ -389,14 +390,13 @@ static int iso_connect_cis(struct sock *sk) · 61 unmodified lines
389	goto unlock;	390	goto unlock;
390	}	391	}
391		392
392	hci_dev_unlock(hdev);	393	lock_sock(sk);
393	hci_dev_put(hdev);
394		394
395	err = iso_chan_add(conn, sk, NULL);	395	err = iso_chan_add(conn, sk, NULL);
396	if (err)	396	if (err) {
397	return err;	397	release_sock(sk);
398		398	goto unlock;
399	lock_sock(sk);	399	}
400		400
401	/* Update source addr of the socket */	401	/* Update source addr of the socket */
402	bacpy(&iso_pi(sk)->src, &hcon->src);	402	bacpy(&iso_pi(sk)->src, &hcon->src);
@@ -413,7 +413,6 @@ static int iso_connect_cis(struct sock *sk) · 10 unmodified lines
413	}	413	}
414		414
415	release_sock(sk);	415	release_sock(sk);
416	return err;
417		416
418	unlock:	417	unlock:
419	hci_dev_unlock(hdev);	418	hci_dev_unlock(hdev);
@@ -1072,8 +1071,8 @@ static int iso_sock_sendmsg(struct socket sock, struct msghdr msg, · 652 unmodified lines
1072	size_t len)	1071	size_t len)
1073	{	1072	{
1074	struct sock *sk = sock->sk;	1073	struct sock *sk = sock->sk;
1075	struct iso_conn *conn = iso_pi(sk)->conn;
1076	struct sk_buff skb, *frag;	1074	struct sk_buff skb, *frag;
		1075	size_t mtu;
1077	int err;	1076	int err;
1078		1077
1079	BT_DBG("sock %p, sk %p", sock, sk);	1078	BT_DBG("sock %p, sk %p", sock, sk);
@@ -1085,11 +1084,18 @@ static int iso_sock_sendmsg(struct socket sock, struct msghdr msg, · 5 unmodified lines
1085	if (msg->msg_flags & MSG_OOB)	1084	if (msg->msg_flags & MSG_OOB)
1086	return -EOPNOTSUPP;	1085	return -EOPNOTSUPP;
1087		1086
1088	if (sk->sk_state != BT_CONNECTED)	1087	lock_sock(sk);
		1088
		1089	if (sk->sk_state != BT_CONNECTED) {
		1090	release_sock(sk);
1089	return -ENOTCONN;	1091	return -ENOTCONN;
		1092	}
		1093
		1094	mtu = iso_pi(sk)->conn->hcon->hdev->iso_mtu;
		1095
		1096	release_sock(sk);
1090		1097
1091	skb = bt_skb_sendmsg(sk, msg, len, conn->hcon->hdev->iso_mtu,	1098	skb = bt_skb_sendmsg(sk, msg, len, mtu, HCI_ISO_DATA_HDR_SIZE, 0);
1092	HCI_ISO_DATA_HDR_SIZE, 0);
1093	if (IS_ERR(skb))	1099	if (IS_ERR(skb))
1094	return PTR_ERR(skb);	1100	return PTR_ERR(skb);
1095		1101
@@ -1102,8 +1108,7 @@ static int iso_sock_sendmsg(struct socket sock, struct msghdr msg, · 6 unmodified lines
1102	while (len) {	1108	while (len) {
1103	struct sk_buff *tmp;	1109	struct sk_buff *tmp;
1104		1110
1105	tmp = bt_skb_sendmsg(sk, msg, len, conn->hcon->hdev->iso_mtu,	1111	tmp = bt_skb_sendmsg(sk, msg, len, mtu, 0, 0);
1106	0, 0);
1107	if (IS_ERR(tmp)) {	1112	if (IS_ERR(tmp)) {
1108	kfree_skb(skb);	1113	kfree_skb(skb);
1109	return PTR_ERR(tmp);	1114	return PTR_ERR(tmp);
@@ -1158,15 +1163,19 @@ static int iso_sock_recvmsg(struct socket sock, struct msghdr msg, · 48 unmodified lines
1158	BT_DBG("sk %p", sk);	1163	BT_DBG("sk %p", sk);
1159		1164
1160	if (test_and_clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {	1165	if (test_and_clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
		1166	lock_sock(sk);
1161	switch (sk->sk_state) {	1167	switch (sk->sk_state) {
1162	case BT_CONNECT2:	1168	case BT_CONNECT2:
1163	lock_sock(sk);
1164	iso_conn_defer_accept(pi->conn->hcon);	1169	iso_conn_defer_accept(pi->conn->hcon);
1165	sk->sk_state = BT_CONFIG;	1170	sk->sk_state = BT_CONFIG;
1166	release_sock(sk);	1171	release_sock(sk);
1167	return 0;	1172	return 0;
1168	case BT_CONNECT:	1173	case BT_CONNECT:
		1174	release_sock(sk);
1169	return iso_connect_cis(sk);	1175	return iso_connect_cis(sk);
		1176	default:
		1177	release_sock(sk);
		1178	break;
1170	}	1179	}
1171	}	1180	}
1172		1181

net/bluetooth/mgmt.c+12−16

 		/* Needed for AUTO_OFF case where might not "really"
 		 * have been powered off.
 		 */
-		list_del_init(&p->action);
+		hci_pend_le_list_del_init(p);
 		switch (p->auto_connect) {
 		case HCI_AUTO_CONN_DIRECT:
 		case HCI_AUTO_CONN_ALWAYS:
-			list_add(&p->action, &hdev->pend_le_conns);
+			hci_pend_le_list_add(p, &hdev->pend_le_conns);
 			break;
 		case HCI_AUTO_CONN_REPORT:
-			list_add(&p->action, &hdev->pend_le_reports);
+			hci_pend_le_list_add(p, &hdev->pend_le_reports);
 			break;
 		default:
 			break;
 		goto unlock;
 	}
-	params->flags = current_flags;
+	WRITE_ONCE(params->flags, current_flags);
 	status = MGMT_STATUS_SUCCESS;
 	/* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY
 	bt_dev_dbg(hdev, "err %d", err);
-	memcpy(&rp.addr, &cp->addr.bdaddr, sizeof(rp.addr));
+	memcpy(&rp.addr, &cp->addr, sizeof(rp.addr));
 	status = mgmt_status(err);
 	if (status == MGMT_STATUS_SUCCESS) {
 	if (params->auto_connect == auto_connect)
 		return 0;
-	list_del_init(&params->action);
+	hci_pend_le_list_del_init(params);
 	switch (auto_connect) {
 	case HCI_AUTO_CONN_DISABLED:
 		 * connect to device, keep connecting.
 		 */
 		if (params->explicit_connect)
-			list_add(&params->action, &hdev->pend_le_conns);
+			hci_pend_le_list_add(params, &hdev->pend_le_conns);
 		break;
 	case HCI_AUTO_CONN_REPORT:
 		if (params->explicit_connect)
-			list_add(&params->action, &hdev->pend_le_conns);
+			hci_pend_le_list_add(params, &hdev->pend_le_conns);
 		else
-			list_add(&params->action, &hdev->pend_le_reports);
+			hci_pend_le_list_add(params, &hdev->pend_le_reports);
 		break;
 	case HCI_AUTO_CONN_DIRECT:
 	case HCI_AUTO_CONN_ALWAYS:
 		if (!is_connected(hdev, addr, addr_type))
-			list_add(&params->action, &hdev->pend_le_conns);
+			hci_pend_le_list_add(params, &hdev->pend_le_conns);
 		break;
 	}
 			goto unlock;
 		}
-		list_del(&params->action);
+		hci_conn_params_free(params);
-		list_del(&params->list);
-		kfree(params);
 		device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
 	} else {
 				p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
 				continue;
 			}
-			list_del(&p->action);
+			hci_conn_params_free(p);
-			list_del(&p->list);
-			kfree(p);
 		}
 		bt_dev_dbg(hdev, "All LE connection parameters were removed");

net/bluetooth/sco.c+12−11

 	struct hci_dev *hdev = hcon->hdev;
 	struct sco_conn *conn = hcon->sco_data;
-	if (conn)
+	if (conn) {
+		if (!conn->hcon)
+			conn->hcon = hcon;
 		return conn;
+	}
 	conn = kzalloc(sizeof(struct sco_conn), GFP_KERNEL);
 	if (!conn)
 		goto unlock;
 	}
-	hci_dev_unlock(hdev);
-	hci_dev_put(hdev);
 	conn = sco_conn_add(hcon);
 	if (!conn) {
 		hci_conn_drop(hcon);
-		return -ENOMEM;
+		err = -ENOMEM;
+		goto unlock;
 	}
-	err = sco_chan_add(conn, sk, NULL);
-	if (err)
-		return err;
 	lock_sock(sk);
+	err = sco_chan_add(conn, sk, NULL);
+	if (err) {
+		release_sock(sk);
+		goto unlock;
+	}
 	/* Update source addr of the socket */
 	bacpy(&sco_pi(sk)->src, &hcon->src);
 	release_sock(sk);
-	return err;
 unlock:
 	hci_dev_unlock(hdev);
 	hci_dev_put(hdev);

net/can/bcm.c+6−6

 	lock_sock(sk);
+#if IS_ENABLED(CONFIG_PROC_FS)
+	/* remove procfs entry */
+	if (net->can.bcmproc_dir && bo->bcm_proc_read)
+		remove_proc_entry(bo->procname, net->can.bcmproc_dir);
+#endif /* CONFIG_PROC_FS */
 	list_for_each_entry_safe(op, next, &bo->tx_ops, list)
 		bcm_remove_op(op);
 	list_for_each_entry_safe(op, next, &bo->rx_ops, list)
 		bcm_remove_op(op);
-#if IS_ENABLED(CONFIG_PROC_FS)
-	/* remove procfs entry */
-	if (net->can.bcmproc_dir && bo->bcm_proc_read)
-		remove_proc_entry(bo->procname, net->can.bcmproc_dir);
-#endif /* CONFIG_PROC_FS */
 	/* remove device reference */
 	if (bo->bound) {
 		bo->bound   = 0;

net/can/raw.c+24−33

@@ -84,6 +84,7 @@ struct raw_sock { · 83 unmodified lines
84	struct sock sk;	84	struct sock sk;
85	int bound;	85	int bound;
86	int ifindex;	86	int ifindex;
		87	struct net_device *dev;
87	struct list_head notifier;	88	struct list_head notifier;
88	int loopback;	89	int loopback;
89	int recv_own_msgs;	90	int recv_own_msgs;
@@ -277,7 +278,7 @@ static void raw_notify(struct raw_sock *ro, unsigned long msg, · 187 unmodified lines
277	if (!net_eq(dev_net(dev), sock_net(sk)))	278	if (!net_eq(dev_net(dev), sock_net(sk)))
278	return;	279	return;
279		280
280	if (ro->ifindex != dev->ifindex)	281	if (ro->dev != dev)
281	return;	282	return;
282		283
283	switch (msg) {	284	switch (msg) {
@@ -292,6 +293,7 @@ static void raw_notify(struct raw_sock *ro, unsigned long msg, · 8 unmodified lines
292		293
293	ro->ifindex = 0;	294	ro->ifindex = 0;
294	ro->bound = 0;	295	ro->bound = 0;
		296	ro->dev = NULL;
295	ro->count = 0;	297	ro->count = 0;
296	release_sock(sk);	298	release_sock(sk);
297		299
@@ -337,6 +339,7 @@ static int raw_init(struct sock *sk) · 39 unmodified lines
337		339
338	ro->bound = 0;	340	ro->bound = 0;
339	ro->ifindex = 0;	341	ro->ifindex = 0;
		342	ro->dev = NULL;
340		343
341	/* set default filter to single entry dfilter */	344	/* set default filter to single entry dfilter */
342	ro->dfilter.can_id = 0;	345	ro->dfilter.can_id = 0;
@@ -385,19 +388,13 @@ static int raw_release(struct socket *sock) · 42 unmodified lines
385		388
386	lock_sock(sk);	389	lock_sock(sk);
387		390
		391	rtnl_lock();
388	/* remove current filters & unregister */	392	/* remove current filters & unregister */
389	if (ro->bound) {	393	if (ro->bound) {
390	if (ro->ifindex) {	394	if (ro->dev)
391	struct net_device *dev;	395	raw_disable_allfilters(dev_net(ro->dev), ro->dev, sk);
392		396	else
393	dev = dev_get_by_index(sock_net(sk), ro->ifindex);
394	if (dev) {
395	raw_disable_allfilters(dev_net(dev), dev, sk);
396	dev_put(dev);
397	}
398	} else {
399	raw_disable_allfilters(sock_net(sk), NULL, sk);	397	raw_disable_allfilters(sock_net(sk), NULL, sk);
400	}
401	}	398	}
402		399
403	if (ro->count > 1)	400	if (ro->count > 1)
@@ -405,8 +402,10 @@ static int raw_release(struct socket *sock) · 1 unmodified line
405		402
406	ro->ifindex = 0;	403	ro->ifindex = 0;
407	ro->bound = 0;	404	ro->bound = 0;
		405	ro->dev = NULL;
408	ro->count = 0;	406	ro->count = 0;
409	free_percpu(ro->uniq);	407	free_percpu(ro->uniq);
		408	rtnl_unlock();
410		409
411	sock_orphan(sk);	410	sock_orphan(sk);
412	sock->sk = NULL;	411	sock->sk = NULL;
@@ -422,6 +421,7 @@ static int raw_bind(struct socket sock, struct sockaddr uaddr, int len) · 9 unmodified lines
422	struct sockaddr_can addr = (struct sockaddr_can )uaddr;	421	struct sockaddr_can addr = (struct sockaddr_can )uaddr;
423	struct sock *sk = sock->sk;	422	struct sock *sk = sock->sk;
424	struct raw_sock *ro = raw_sk(sk);	423	struct raw_sock *ro = raw_sk(sk);
		424	struct net_device *dev = NULL;
425	int ifindex;	425	int ifindex;
426	int err = 0;	426	int err = 0;
427	int notify_enetdown = 0;	427	int notify_enetdown = 0;
@@ -431,14 +431,13 @@ static int raw_bind(struct socket sock, struct sockaddr uaddr, int len) · 3 unmodified lines
431	if (addr->can_family != AF_CAN)	431	if (addr->can_family != AF_CAN)
432	return -EINVAL;	432	return -EINVAL;
433		433
		434	rtnl_lock();
434	lock_sock(sk);	435	lock_sock(sk);
435		436
436	if (ro->bound && addr->can_ifindex == ro->ifindex)	437	if (ro->bound && addr->can_ifindex == ro->ifindex)
437	goto out;	438	goto out;
438		439
439	if (addr->can_ifindex) {	440	if (addr->can_ifindex) {
440	struct net_device *dev;
441
442	dev = dev_get_by_index(sock_net(sk), addr->can_ifindex);	441	dev = dev_get_by_index(sock_net(sk), addr->can_ifindex);
443	if (!dev) {	442	if (!dev) {
444	err = -ENODEV;	443	err = -ENODEV;
@@ -467,26 +466,20 @@ static int raw_bind(struct socket sock, struct sockaddr uaddr, int len) · 22 unmodified lines
467	if (!err) {	466	if (!err) {
468	if (ro->bound) {	467	if (ro->bound) {
469	/* unregister old filters */	468	/* unregister old filters */
470	if (ro->ifindex) {	469	if (ro->dev)
471	struct net_device *dev;	470	raw_disable_allfilters(dev_net(ro->dev),
472		471	ro->dev, sk);
473	dev = dev_get_by_index(sock_net(sk),	472	else
474	ro->ifindex);
475	if (dev) {
476	raw_disable_allfilters(dev_net(dev),
477	dev, sk);
478	dev_put(dev);
479	}
480	} else {
481	raw_disable_allfilters(sock_net(sk), NULL, sk);	473	raw_disable_allfilters(sock_net(sk), NULL, sk);
482	}
483	}	474	}
484	ro->ifindex = ifindex;	475	ro->ifindex = ifindex;
485	ro->bound = 1;	476	ro->bound = 1;
		477	ro->dev = dev;
486	}	478	}
487		479
488	out:	480	out:
489	release_sock(sk);	481	release_sock(sk);
		482	rtnl_unlock();
490		483
491	if (notify_enetdown) {	484	if (notify_enetdown) {
492	sk->sk_err = ENETDOWN;	485	sk->sk_err = ENETDOWN;
@@ -553,9 +546,9 @@ static int raw_setsockopt(struct socket *sock, int level, int optname, · 60 unmodified lines
553	rtnl_lock();	546	rtnl_lock();
554	lock_sock(sk);	547	lock_sock(sk);
555		548
556	if (ro->bound && ro->ifindex) {	549	dev = ro->dev;
557	dev = dev_get_by_index(sock_net(sk), ro->ifindex);	550	if (ro->bound && dev) {
558	if (!dev) {	551	if (dev->reg_state != NETREG_REGISTERED) {
559	if (count > 1)	552	if (count > 1)
560	kfree(filter);	553	kfree(filter);
561	err = -ENODEV;	554	err = -ENODEV;
@@ -596,7 +589,6 @@ static int raw_setsockopt(struct socket *sock, int level, int optname, · 34 unmodified lines
596	ro->count = count;	589	ro->count = count;
597		590
598	out_fil:	591	out_fil:
599	dev_put(dev);
600	release_sock(sk);	592	release_sock(sk);
601	rtnl_unlock();	593	rtnl_unlock();
602		594
@@ -614,9 +606,9 @@ static int raw_setsockopt(struct socket *sock, int level, int optname, · 11 unmodified lines
614	rtnl_lock();	606	rtnl_lock();
615	lock_sock(sk);	607	lock_sock(sk);
616		608
617	if (ro->bound && ro->ifindex) {	609	dev = ro->dev;
618	dev = dev_get_by_index(sock_net(sk), ro->ifindex);	610	if (ro->bound && dev) {
619	if (!dev) {	611	if (dev->reg_state != NETREG_REGISTERED) {
620	err = -ENODEV;	612	err = -ENODEV;
621	goto out_err;	613	goto out_err;
622	}	614	}
@@ -640,7 +632,6 @@ static int raw_setsockopt(struct socket *sock, int level, int optname, · 17 unmodified lines
640	ro->err_mask = err_mask;	632	ro->err_mask = err_mask;
641		633
642	out_err:	634	out_err:
643	dev_put(dev);
644	release_sock(sk);	635	release_sock(sk);
645	rtnl_unlock();	636	rtnl_unlock();
646		637

net/ipv4/esp4.c+1−1

@@ -1132,7 +1132,7 @@ static int esp_init_authenc(struct xfrm_state *x, · 1131 unmodified lines
1132	err = crypto_aead_setkey(aead, key, keylen);	1132	err = crypto_aead_setkey(aead, key, keylen);
1133		1133
1134	free_key:	1134	free_key:
1135	kfree(key);	1135	kfree_sensitive(key);
1136		1136
1137	error:	1137	error:
1138	return err;	1138	return err;

net/ipv4/inet_connection_sock.c+1−1

@@ -1019,7 +1019,7 @@ static void reqsk_timer_handler(struct timer_list *t) · 1018 unmodified lines
1019		1019
1020	icsk = inet_csk(sk_listener);	1020	icsk = inet_csk(sk_listener);
1021	net = sock_net(sk_listener);	1021	net = sock_net(sk_listener);
1022	max_syn_ack_retries = icsk->icsk_syn_retries ? :	1022	max_syn_ack_retries = READ_ONCE(icsk->icsk_syn_retries) ? :
1023	READ_ONCE(net->ipv4.sysctl_tcp_synack_retries);	1023	READ_ONCE(net->ipv4.sysctl_tcp_synack_retries);
1024	/* Normally all the openreqs are young and become mature	1024	/* Normally all the openreqs are young and become mature
1025	* (i.e. converted to established socket) for first timeout.	1025	* (i.e. converted to established socket) for first timeout.

net/ipv4/inet_hashtables.c+2−15

 	spin_lock(lock);
 	if (osk) {
 		WARN_ON_ONCE(sk->sk_hash != osk->sk_hash);
-		ret = sk_hashed(osk);
+		ret = sk_nulls_del_node_init_rcu(osk);
-		if (ret) {
+	} else if (found_dup_sk) {
-			/* Before deleting the node, we insert a new one to make
-			 * sure that the look-up-sk process would not miss either
-			 * of them and that at least one node would exist in ehash
-			 * table all the time. Otherwise there's a tiny chance
-			 * that lookup process could find nothing in ehash table.
-			 */
-			__sk_nulls_add_node_tail_rcu(sk, list);
-			sk_nulls_del_node_init_rcu(osk);
-		}
-		goto unlock;
-	}
-	if (found_dup_sk) {
 		*found_dup_sk = inet_ehash_lookup_by_sk(sk, list);
 		if (*found_dup_sk)
 			ret = false;
 	if (ret)
 		__sk_nulls_add_node_rcu(sk, list);
-unlock:
 	spin_unlock(lock);
 	return ret;

net/ipv4/inet_timewait_sock.c+4−4

@@ -88,10 +88,10 @@ void inet_twsk_put(struct inet_timewait_sock *tw) · 87 unmodified lines
88	}	88	}
89	EXPORT_SYMBOL_GPL(inet_twsk_put);	89	EXPORT_SYMBOL_GPL(inet_twsk_put);
90		90
91	static void inet_twsk_add_node_tail_rcu(struct inet_timewait_sock *tw,	91	static void inet_twsk_add_node_rcu(struct inet_timewait_sock *tw,
92	struct hlist_nulls_head *list)	92	struct hlist_nulls_head *list)
93	{	93	{
94	hlist_nulls_add_tail_rcu(&tw->tw_node, list);	94	hlist_nulls_add_head_rcu(&tw->tw_node, list);
95	}	95	}
96		96
97	static void inet_twsk_add_bind_node(struct inet_timewait_sock *tw,	97	static void inet_twsk_add_bind_node(struct inet_timewait_sock *tw,
@@ -144,7 +144,7 @@ void inet_twsk_hashdance(struct inet_timewait_sock tw, struct sock sk, · 46 unmodified lines
144		144
145	spin_lock(lock);	145	spin_lock(lock);
146		146
147	inet_twsk_add_node_tail_rcu(tw, &ehead->chain);	147	inet_twsk_add_node_rcu(tw, &ehead->chain);
148		148
149	/* Step 3: Remove SK from hash chain */	149	/* Step 3: Remove SK from hash chain */
150	if (__sk_nulls_del_node_init_rcu(sk))	150	if (__sk_nulls_del_node_init_rcu(sk))

net/ipv4/ip_gre.c+4−2

 		goto err_free_skb;
 	if (skb->len > dev->mtu + dev->hard_header_len) {
-		pskb_trim(skb, dev->mtu + dev->hard_header_len);
+		if (pskb_trim(skb, dev->mtu + dev->hard_header_len))
+			goto err_free_skb;
 		truncate = true;
 	}
 		goto free_skb;
 	if (skb->len > dev->mtu + dev->hard_header_len) {
-		pskb_trim(skb, dev->mtu + dev->hard_header_len);
+		if (pskb_trim(skb, dev->mtu + dev->hard_header_len))
+			goto free_skb;
 		truncate = true;
 	}

net/ipv4/tcp.c+30−27

 		return -EINVAL;
 	lock_sock(sk);
-	inet_csk(sk)->icsk_syn_retries = val;
+	WRITE_ONCE(inet_csk(sk)->icsk_syn_retries, val);
 	release_sock(sk);
 	return 0;
 }
 void tcp_sock_set_user_timeout(struct sock *sk, u32 val)
 {
 	lock_sock(sk);
-	inet_csk(sk)->icsk_user_timeout = val;
+	WRITE_ONCE(inet_csk(sk)->icsk_user_timeout, val);
 	release_sock(sk);
 }
 EXPORT_SYMBOL(tcp_sock_set_user_timeout);
 	if (val < 1 || val > MAX_TCP_KEEPIDLE)
 		return -EINVAL;
-	tp->keepalive_time = val * HZ;
+	/* Paired with WRITE_ONCE() in keepalive_time_when() */
+	WRITE_ONCE(tp->keepalive_time, val * HZ);
 	if (sock_flag(sk, SOCK_KEEPOPEN) &&
 	    !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
 		u32 elapsed = keepalive_time_elapsed(tp);
 		return -EINVAL;
 	lock_sock(sk);
-	tcp_sk(sk)->keepalive_intvl = val * HZ;
+	WRITE_ONCE(tcp_sk(sk)->keepalive_intvl, val * HZ);
 	release_sock(sk);
 	return 0;
 }
 		return -EINVAL;
 	lock_sock(sk);
-	tcp_sk(sk)->keepalive_probes = val;
+	/* Paired with READ_ONCE() in keepalive_probes() */
+	WRITE_ONCE(tcp_sk(sk)->keepalive_probes, val);
 	release_sock(sk);
 	return 0;
 }
 		if (val < 1 || val > MAX_TCP_KEEPINTVL)
 			err = -EINVAL;
 		else
-			tp->keepalive_intvl = val * HZ;
+			WRITE_ONCE(tp->keepalive_intvl, val * HZ);
 		break;
 	case TCP_KEEPCNT:
 		if (val < 1 || val > MAX_TCP_KEEPCNT)
 			err = -EINVAL;
 		else
-			tp->keepalive_probes = val;
+			WRITE_ONCE(tp->keepalive_probes, val);
 		break;
 	case TCP_SYNCNT:
 		if (val < 1 || val > MAX_TCP_SYNCNT)
 			err = -EINVAL;
 		else
-			icsk->icsk_syn_retries = val;
+			WRITE_ONCE(icsk->icsk_syn_retries, val);
 		break;
 	case TCP_SAVE_SYN:
 	case TCP_LINGER2:
 		if (val < 0)
-			tp->linger2 = -1;
+			WRITE_ONCE(tp->linger2, -1);
 		else if (val > TCP_FIN_TIMEOUT_MAX / HZ)
-			tp->linger2 = TCP_FIN_TIMEOUT_MAX;
+			WRITE_ONCE(tp->linger2, TCP_FIN_TIMEOUT_MAX);
 		else
-			tp->linger2 = val * HZ;
+			WRITE_ONCE(tp->linger2, val * HZ);
 		break;
 	case TCP_DEFER_ACCEPT:
 		/* Translate value in seconds to number of retransmits */
-		icsk->icsk_accept_queue.rskq_defer_accept =
+		WRITE_ONCE(icsk->icsk_accept_queue.rskq_defer_accept,
-			secs_to_retrans(val, TCP_TIMEOUT_INIT / HZ,
+			   secs_to_retrans(val, TCP_TIMEOUT_INIT / HZ,
-					TCP_RTO_MAX / HZ);
+					   TCP_RTO_MAX / HZ));
 		break;
 	case TCP_WINDOW_CLAMP:
 		if (val < 0)
 			err = -EINVAL;
 		else
-			icsk->icsk_user_timeout = val;
+			WRITE_ONCE(icsk->icsk_user_timeout, val);
 		break;
 	case TCP_FASTOPEN:
 		if (!tp->repair)
 			err = -EPERM;
 		else
-			tp->tsoffset = val - tcp_time_stamp_raw();
+			WRITE_ONCE(tp->tsoffset, val - tcp_time_stamp_raw());
 		break;
 	case TCP_REPAIR_WINDOW:
 		err = tcp_repair_set_window(tp, optval, optlen);
 		break;
 	case TCP_NOTSENT_LOWAT:
-		tp->notsent_lowat = val;
+		WRITE_ONCE(tp->notsent_lowat, val);
 		sk->sk_write_space(sk);
 		break;
 	case TCP_INQ:
 	case TCP_TX_DELAY:
 		if (val)
 			tcp_enable_tx_delay();
-		tp->tcp_tx_delay = val;
+		WRITE_ONCE(tp->tcp_tx_delay, val);
 		break;
 	default:
 		err = -ENOPROTOOPT;
 		val = keepalive_probes(tp);
 		break;
 	case TCP_SYNCNT:
-		val = icsk->icsk_syn_retries ? :
+		val = READ_ONCE(icsk->icsk_syn_retries) ? :
 			READ_ONCE(net->ipv4.sysctl_tcp_syn_retries);
 		break;
 	case TCP_LINGER2:
-		val = tp->linger2;
+		val = READ_ONCE(tp->linger2);
 		if (val >= 0)
 			val = (val ? : READ_ONCE(net->ipv4.sysctl_tcp_fin_timeout)) / HZ;
 		break;
 	case TCP_DEFER_ACCEPT:
-		val = retrans_to_secs(icsk->icsk_accept_queue.rskq_defer_accept,
+		val = READ_ONCE(icsk->icsk_accept_queue.rskq_defer_accept);
-				      TCP_TIMEOUT_INIT / HZ, TCP_RTO_MAX / HZ);
+		val = retrans_to_secs(val, TCP_TIMEOUT_INIT / HZ,
+				      TCP_RTO_MAX / HZ);
 		break;
 	case TCP_WINDOW_CLAMP:
 		val = tp->window_clamp;
 		break;
 	case TCP_USER_TIMEOUT:
-		val = icsk->icsk_user_timeout;
+		val = READ_ONCE(icsk->icsk_user_timeout);
 		break;
 	case TCP_FASTOPEN:
-		val = icsk->icsk_accept_queue.fastopenq.max_qlen;
+		val = READ_ONCE(icsk->icsk_accept_queue.fastopenq.max_qlen);
 		break;
 	case TCP_FASTOPEN_CONNECT:
 		break;
 	case TCP_TX_DELAY:
-		val = tp->tcp_tx_delay;
+		val = READ_ONCE(tp->tcp_tx_delay);
 		break;
 	case TCP_TIMESTAMP:
-		val = tcp_time_stamp_raw() + tp->tsoffset;
+		val = tcp_time_stamp_raw() + READ_ONCE(tp->tsoffset);
 		break;
 	case TCP_NOTSENT_LOWAT:
-		val = tp->notsent_lowat;
+		val = READ_ONCE(tp->notsent_lowat);
 		break;
 	case TCP_INQ:
 		val = tp->recvmsg_inq;

net/ipv4/tcp_fastopen.c+4−2

 static bool tcp_fastopen_queue_check(struct sock *sk)
 {
 	struct fastopen_queue *fastopenq;
+	int max_qlen;
 	/* Make sure the listener has enabled fastopen, and we don't
 	 * exceed the max # of pending TFO requests allowed before trying
 	 * temporarily vs a server not supporting Fast Open at all.
 	 */
 	fastopenq = &inet_csk(sk)->icsk_accept_queue.fastopenq;
-	if (fastopenq->max_qlen == 0)
+	max_qlen = READ_ONCE(fastopenq->max_qlen);
+	if (max_qlen == 0)
 		return false;
-	if (fastopenq->qlen >= fastopenq->max_qlen) {
+	if (fastopenq->qlen >= max_qlen) {
 		struct request_sock *req1;
 		spin_lock(&fastopenq->lock);
 		req1 = fastopenq->rskq_rst_head;

net/ipv4/tcp_ipv4.c+6−4

 						  inet->inet_daddr,
 						  inet->inet_sport,
 						  usin->sin_port));
-		tp->tsoffset = secure_tcp_ts_off(net, inet->inet_saddr,
+		WRITE_ONCE(tp->tsoffset,
-						 inet->inet_daddr);
+			   secure_tcp_ts_off(net, inet->inet_saddr,
+					     inet->inet_daddr));
 	}
 	inet->inet_id = get_random_u16();
 			tcp_rsk(req)->rcv_nxt,
 			req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale,
 			tcp_time_stamp_raw() + tcp_rsk(req)->ts_off,
-			req->ts_recent,
+			READ_ONCE(req->ts_recent),
 			0,
 			tcp_md5_do_lookup(sk, l3index, addr, AF_INET),
 			inet_rsk(req)->no_srccheck ? IP_REPLY_ARG_NOSRCCHECK : 0,
-			ip_hdr(skb)->tos, tcp_rsk(req)->txhash);
+			ip_hdr(skb)->tos,
+			READ_ONCE(tcp_rsk(req)->txhash));
 }
 /*

net/ipv4/tcp_minisocks.c+7−4

 	newicsk->icsk_ack.lrcvtime = tcp_jiffies32;
 	newtp->lsndtime = tcp_jiffies32;
-	newsk->sk_txhash = treq->txhash;
+	newsk->sk_txhash = READ_ONCE(treq->txhash);
 	newtp->total_retrans = req->num_retrans;
 	tcp_init_xmit_timers(newsk);
 	newtp->max_window = newtp->snd_wnd;
 	if (newtp->rx_opt.tstamp_ok) {
-		newtp->rx_opt.ts_recent = req->ts_recent;
+		newtp->rx_opt.ts_recent = READ_ONCE(req->ts_recent);
 		newtp->rx_opt.ts_recent_stamp = ktime_get_seconds();
 		newtp->tcp_header_len = sizeof(struct tcphdr) + TCPOLEN_TSTAMP_ALIGNED;
 	} else {
 		tcp_parse_options(sock_net(sk), skb, &tmp_opt, 0, NULL);
 		if (tmp_opt.saw_tstamp) {
-			tmp_opt.ts_recent = req->ts_recent;
+			tmp_opt.ts_recent = READ_ONCE(req->ts_recent);
 			if (tmp_opt.rcv_tsecr)
 				tmp_opt.rcv_tsecr -= tcp_rsk(req)->ts_off;
 			/* We do not store true stamp, but it is not required,
 	/* In sequence, PAWS is OK. */
+	/* TODO: We probably should defer ts_recent change once
+	 * we take ownership of @req.
+	 */
 	if (tmp_opt.saw_tstamp && !after(TCP_SKB_CB(skb)->seq, tcp_rsk(req)->rcv_nxt))
-		req->ts_recent = tmp_opt.rcv_tsval;
+		WRITE_ONCE(req->ts_recent, tmp_opt.rcv_tsval);
 	if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn) {
 		/* Truncate SYN, it is out of window starting

net/ipv4/tcp_output.c+3−3

@@ -878,7 +878,7 @@ static unsigned int tcp_synack_options(const struct sock *sk, · 877 unmodified lines
878	if (likely(ireq->tstamp_ok)) {	878	if (likely(ireq->tstamp_ok)) {
879	opts->options \|= OPTION_TS;	879	opts->options \|= OPTION_TS;
880	opts->tsval = tcp_skb_timestamp(skb) + tcp_rsk(req)->ts_off;	880	opts->tsval = tcp_skb_timestamp(skb) + tcp_rsk(req)->ts_off;
881	opts->tsecr = req->ts_recent;	881	opts->tsecr = READ_ONCE(req->ts_recent);
882	remaining -= TCPOLEN_TSTAMP_ALIGNED;	882	remaining -= TCPOLEN_TSTAMP_ALIGNED;
883	}	883	}
884	if (likely(ireq->sack_ok)) {	884	if (likely(ireq->sack_ok)) {
@@ -3660,7 +3660,7 @@ struct sk_buff tcp_make_synack(const struct sock sk, struct dst_entry *dst, · 2775 unmodified lines
3660	rcu_read_lock();	3660	rcu_read_lock();
3661	md5 = tcp_rsk(req)->af_specific->req_md5_lookup(sk, req_to_sk(req));	3661	md5 = tcp_rsk(req)->af_specific->req_md5_lookup(sk, req_to_sk(req));
3662	#endif	3662	#endif
3663	skb_set_hash(skb, tcp_rsk(req)->txhash, PKT_HASH_TYPE_L4);	3663	skb_set_hash(skb, READ_ONCE(tcp_rsk(req)->txhash), PKT_HASH_TYPE_L4);
3664	/* bpf program will be interested in the tcp_flags */	3664	/* bpf program will be interested in the tcp_flags */
3665	TCP_SKB_CB(skb)->tcp_flags = TCPHDR_SYN \| TCPHDR_ACK;	3665	TCP_SKB_CB(skb)->tcp_flags = TCPHDR_SYN \| TCPHDR_ACK;
3666	tcp_header_size = tcp_synack_options(sk, req, mss, skb, &opts, md5,	3666	tcp_header_size = tcp_synack_options(sk, req, mss, skb, &opts, md5,
@@ -4210,7 +4210,7 @@ int tcp_rtx_synack(const struct sock sk, struct request_sock req) · 543 unmodified lines
4210		4210
4211	/* Paired with WRITE_ONCE() in sock_setsockopt() */	4211	/* Paired with WRITE_ONCE() in sock_setsockopt() */
4212	if (READ_ONCE(sk->sk_txrehash) == SOCK_TXREHASH_ENABLED)	4212	if (READ_ONCE(sk->sk_txrehash) == SOCK_TXREHASH_ENABLED)
4213	tcp_rsk(req)->txhash = net_tx_rndhash();	4213	WRITE_ONCE(tcp_rsk(req)->txhash, net_tx_rndhash());
4214	res = af_ops->send_synack(sk, NULL, &fl, req, NULL, TCP_SYNACK_NORMAL,	4214	res = af_ops->send_synack(sk, NULL, &fl, req, NULL, TCP_SYNACK_NORMAL,
4215	NULL);	4215	NULL);
4216	if (!res) {	4216	if (!res) {

net/ipv4/udp_offload.c+11−5

 	__sum16 check;
 	__be16 newlen;
-	if (skb_shinfo(gso_skb)->gso_type & SKB_GSO_FRAGLIST)
-		return __udp_gso_segment_list(gso_skb, features, is_ipv6);
 	mss = skb_shinfo(gso_skb)->gso_size;
 	if (gso_skb->len <= sizeof(*uh) + mss)
 		return ERR_PTR(-EINVAL);
+	if (skb_gso_ok(gso_skb, features | NETIF_F_GSO_ROBUST)) {
+		/* Packet is from an untrusted source, reset gso_segs. */
+		skb_shinfo(gso_skb)->gso_segs = DIV_ROUND_UP(gso_skb->len - sizeof(*uh),
+							     mss);
+		return NULL;
+	}
+	if (skb_shinfo(gso_skb)->gso_type & SKB_GSO_FRAGLIST)
+		return __udp_gso_segment_list(gso_skb, features, is_ipv6);
 	skb_pull(gso_skb, sizeof(*uh));
 	/* clear destructor to avoid skb_segment assigning it to tail */
 	if (!pskb_may_pull(skb, sizeof(struct udphdr)))
 		goto out;
-	if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP_L4 &&
+	if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP_L4)
-	    !skb_gso_ok(skb, features | NETIF_F_GSO_ROBUST))
 		return __udp_gso_segment(skb, features, false);
 	mss = skb_shinfo(skb)->gso_size;

net/ipv6/ip6_gre.c+2−1

@@ -955,7 +955,8 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb, · 954 unmodified lines
955	goto tx_err;	955	goto tx_err;
956		956
957	if (skb->len > dev->mtu + dev->hard_header_len) {	957	if (skb->len > dev->mtu + dev->hard_header_len) {
958	pskb_trim(skb, dev->mtu + dev->hard_header_len);	958	if (pskb_trim(skb, dev->mtu + dev->hard_header_len))
		959	goto tx_err;
959	truncate = true;	960	truncate = true;
960	}	961	}
961		962

net/ipv6/tcp_ipv6.c+2−2

@@ -1126,10 +1126,10 @@ static void tcp_v6_reqsk_send_ack(const struct sock sk, struct sk_buff skb, · 1125 unmodified lines
1126	tcp_rsk(req)->rcv_nxt,	1126	tcp_rsk(req)->rcv_nxt,
1127	req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale,	1127	req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale,
1128	tcp_time_stamp_raw() + tcp_rsk(req)->ts_off,	1128	tcp_time_stamp_raw() + tcp_rsk(req)->ts_off,
1129	req->ts_recent, sk->sk_bound_dev_if,	1129	READ_ONCE(req->ts_recent), sk->sk_bound_dev_if,
1130	tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr, l3index),	1130	tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr, l3index),
1131	ipv6_get_dsfield(ipv6_hdr(skb)), 0, sk->sk_priority,	1131	ipv6_get_dsfield(ipv6_hdr(skb)), 0, sk->sk_priority,
1132	tcp_rsk(req)->txhash);	1132	READ_ONCE(tcp_rsk(req)->txhash));
1133	}	1133	}
1134		1134
1135		1135

net/ipv6/udp_offload.c+1−2

@@ -43,8 +43,7 @@ static struct sk_buff udp6_ufo_fragment(struct sk_buff skb, · 42 unmodified lines
43	if (!pskb_may_pull(skb, sizeof(struct udphdr)))	43	if (!pskb_may_pull(skb, sizeof(struct udphdr)))
44	goto out;	44	goto out;
45		45
46	if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP_L4 &&	46	if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP_L4)
47	!skb_gso_ok(skb, features \| NETIF_F_GSO_ROBUST))
48	return __udp_gso_segment(skb, features, true);	47	return __udp_gso_segment(skb, features, true);
49		48
50	mss = skb_shinfo(skb)->gso_size;	49	mss = skb_shinfo(skb)->gso_size;

net/llc/af_llc.c+1−1

@@ -402,7 +402,7 @@ static int llc_ui_bind(struct socket sock, struct sockaddr uaddr, int addrlen) · 401 unmodified lines
402	memcpy(laddr.mac, addr->sllc_mac, IFHWADDRLEN);	402	memcpy(laddr.mac, addr->sllc_mac, IFHWADDRLEN);
403	laddr.lsap = addr->sllc_sap;	403	laddr.lsap = addr->sllc_sap;
404	rc = -EADDRINUSE; /* mac + sap clash. */	404	rc = -EADDRINUSE; /* mac + sap clash. */
405	ask = llc_lookup_established(sap, &daddr, &laddr);	405	ask = llc_lookup_established(sap, &daddr, &laddr, &init_net);
406	if (ask) {	406	if (ask) {
407	sock_put(ask);	407	sock_put(ask);
408	goto out_put;	408	goto out_put;

net/llc/llc_conn.c+30−19

 static inline bool llc_estab_match(const struct llc_sap *sap,
 				   const struct llc_addr *daddr,
 				   const struct llc_addr *laddr,
-				   const struct sock *sk)
+				   const struct sock *sk,
+				   const struct net *net)
 {
 	struct llc_sock *llc = llc_sk(sk);
-	return llc->laddr.lsap == laddr->lsap &&
+	return net_eq(sock_net(sk), net) &&
+		llc->laddr.lsap == laddr->lsap &&
 		llc->daddr.lsap == daddr->lsap &&
 		ether_addr_equal(llc->laddr.mac, laddr->mac) &&
 		ether_addr_equal(llc->daddr.mac, daddr->mac);
  *	@sap: SAP
  *	@daddr: address of remote LLC (MAC + SAP)
  *	@laddr: address of local LLC (MAC + SAP)
+ *	@net: netns to look up a socket in
  *
  *	Search connection list of the SAP and finds connection using the remote
  *	mac, remote sap, local mac, and local sap. Returns pointer for
  */
 static struct sock *__llc_lookup_established(struct llc_sap *sap,
 					     struct llc_addr *daddr,
-					     struct llc_addr *laddr)
+					     struct llc_addr *laddr,
+					     const struct net *net)
 {
 	struct sock *rc;
 	struct hlist_nulls_node *node;
 	rcu_read_lock();
 again:
 	sk_nulls_for_each_rcu(rc, node, laddr_hb) {
-		if (llc_estab_match(sap, daddr, laddr, rc)) {
+		if (llc_estab_match(sap, daddr, laddr, rc, net)) {
 			/* Extra checks required by SLAB_TYPESAFE_BY_RCU */
 			if (unlikely(!refcount_inc_not_zero(&rc->sk_refcnt)))
 				goto again;
 			if (unlikely(llc_sk(rc)->sap != sap ||
-				     !llc_estab_match(sap, daddr, laddr, rc))) {
+				     !llc_estab_match(sap, daddr, laddr, rc, net))) {
 				sock_put(rc);
 				continue;
 			}
 struct sock *llc_lookup_established(struct llc_sap *sap,
 				    struct llc_addr *daddr,
-				    struct llc_addr *laddr)
+				    struct llc_addr *laddr,
+				    const struct net *net)
 {
 	struct sock *sk;
 	local_bh_disable();
-	sk = __llc_lookup_established(sap, daddr, laddr);
+	sk = __llc_lookup_established(sap, daddr, laddr, net);
 	local_bh_enable();
 	return sk;
 }
 static inline bool llc_listener_match(const struct llc_sap *sap,
 				      const struct llc_addr *laddr,
-				      const struct sock *sk)
+				      const struct sock *sk,
+				      const struct net *net)
 {
 	struct llc_sock *llc = llc_sk(sk);
-	return sk->sk_type == SOCK_STREAM && sk->sk_state == TCP_LISTEN &&
+	return net_eq(sock_net(sk), net) &&
+		sk->sk_type == SOCK_STREAM && sk->sk_state == TCP_LISTEN &&
 		llc->laddr.lsap == laddr->lsap &&
 		ether_addr_equal(llc->laddr.mac, laddr->mac);
 }
 static struct sock *__llc_lookup_listener(struct llc_sap *sap,
-					  struct llc_addr *laddr)
+					  struct llc_addr *laddr,
+					  const struct net *net)
 {
 	struct sock *rc;
 	struct hlist_nulls_node *node;
 	rcu_read_lock();
 again:
 	sk_nulls_for_each_rcu(rc, node, laddr_hb) {
-		if (llc_listener_match(sap, laddr, rc)) {
+		if (llc_listener_match(sap, laddr, rc, net)) {
 			/* Extra checks required by SLAB_TYPESAFE_BY_RCU */
 			if (unlikely(!refcount_inc_not_zero(&rc->sk_refcnt)))
 				goto again;
 			if (unlikely(llc_sk(rc)->sap != sap ||
-				     !llc_listener_match(sap, laddr, rc))) {
+				     !llc_listener_match(sap, laddr, rc, net))) {
 				sock_put(rc);
 				continue;
 			}
  *	llc_lookup_listener - Finds listener for local MAC + SAP
  *	@sap: SAP
  *	@laddr: address of local LLC (MAC + SAP)
+ *	@net: netns to look up a socket in
  *
  *	Search connection list of the SAP and finds connection listening on
  *	local mac, and local sap. Returns pointer for parent socket found,
  *	Caller has to make sure local_bh is disabled.
  */
 static struct sock *llc_lookup_listener(struct llc_sap *sap,
-					struct llc_addr *laddr)
+					struct llc_addr *laddr,
+					const struct net *net)
 {
+	struct sock *rc = __llc_lookup_listener(sap, laddr, net);
 	static struct llc_addr null_addr;
-	struct sock *rc = __llc_lookup_listener(sap, laddr);
 	if (!rc)
-		rc = __llc_lookup_listener(sap, &null_addr);
+		rc = __llc_lookup_listener(sap, &null_addr, net);
 	return rc;
 }
 static struct sock *__llc_lookup(struct llc_sap *sap,
 				 struct llc_addr *daddr,
-				 struct llc_addr *laddr)
+				 struct llc_addr *laddr,
+				 const struct net *net)
 {
-	struct sock *sk = __llc_lookup_established(sap, daddr, laddr);
+	struct sock *sk = __llc_lookup_established(sap, daddr, laddr, net);
-	return sk ? : llc_lookup_listener(sap, laddr);
+	return sk ? : llc_lookup_listener(sap, laddr, net);
 }
 /**
 	llc_pdu_decode_da(skb, daddr.mac);
 	llc_pdu_decode_dsap(skb, &daddr.lsap);
-	sk = __llc_lookup(sap, &saddr, &daddr);
+	sk = __llc_lookup(sap, &saddr, &daddr, dev_net(skb->dev));
 	if (!sk)
 		goto drop;

net/llc/llc_if.c+1−1

@@ -92,7 +92,7 @@ int llc_establish_connection(struct sock sk, const u8 lmac, u8 *dmac, u8 dsap) · 91 unmodified lines
92	daddr.lsap = dsap;	92	daddr.lsap = dsap;
93	memcpy(daddr.mac, dmac, sizeof(daddr.mac));	93	memcpy(daddr.mac, dmac, sizeof(daddr.mac));
94	memcpy(laddr.mac, lmac, sizeof(laddr.mac));	94	memcpy(laddr.mac, lmac, sizeof(laddr.mac));
95	existing = llc_lookup_established(llc->sap, &daddr, &laddr);	95	existing = llc_lookup_established(llc->sap, &daddr, &laddr, sock_net(sk));
96	if (existing) {	96	if (existing) {
97	if (existing->sk_state == TCP_ESTABLISHED) {	97	if (existing->sk_state == TCP_ESTABLISHED) {
98	sk = existing;	98	sk = existing;

net/llc/llc_input.c+0−3

@@ -163,9 +163,6 @@ int llc_rcv(struct sk_buff skb, struct net_device dev, · 162 unmodified lines
163	void (sta_handler)(struct sk_buff skb);	163	void (sta_handler)(struct sk_buff skb);
164	void (sap_handler)(struct llc_sap sap, struct sk_buff *skb);	164	void (sap_handler)(struct llc_sap sap, struct sk_buff *skb);
165		165
166	if (!net_eq(dev_net(dev), &init_net))
167	goto drop;
168
169	/*	166	/*
170	* When the interface is in promisc. mode, drop all the crap that it	167	* When the interface is in promisc. mode, drop all the crap that it
171	* receives, do not try to analyse it.	168	* receives, do not try to analyse it.

net/llc/llc_sap.c+11−7

 static inline bool llc_dgram_match(const struct llc_sap *sap,
 				   const struct llc_addr *laddr,
-				   const struct sock *sk)
+				   const struct sock *sk,
+				   const struct net *net)
 {
      struct llc_sock *llc = llc_sk(sk);
      return sk->sk_type == SOCK_DGRAM &&
-	  llc->laddr.lsap == laddr->lsap &&
+	     net_eq(sock_net(sk), net) &&
-	  ether_addr_equal(llc->laddr.mac, laddr->mac);
+	     llc->laddr.lsap == laddr->lsap &&
+	     ether_addr_equal(llc->laddr.mac, laddr->mac);
 }
 /**
  *	llc_lookup_dgram - Finds dgram socket for the local sap/mac
  *	@sap: SAP
  *	@laddr: address of local LLC (MAC + SAP)
+ *	@net: netns to look up a socket in
  *
  *	Search socket list of the SAP and finds connection using the local
  *	mac, and local sap. Returns pointer for socket found, %NULL otherwise.
  */
 static struct sock *llc_lookup_dgram(struct llc_sap *sap,
-				     const struct llc_addr *laddr)
+				     const struct llc_addr *laddr,
+				     const struct net *net)
 {
 	struct sock *rc;
 	struct hlist_nulls_node *node;
 	rcu_read_lock_bh();
 again:
 	sk_nulls_for_each_rcu(rc, node, laddr_hb) {
-		if (llc_dgram_match(sap, laddr, rc)) {
+		if (llc_dgram_match(sap, laddr, rc, net)) {
 			/* Extra checks required by SLAB_TYPESAFE_BY_RCU */
 			if (unlikely(!refcount_inc_not_zero(&rc->sk_refcnt)))
 				goto again;
 			if (unlikely(llc_sk(rc)->sap != sap ||
-				     !llc_dgram_match(sap, laddr, rc))) {
+				     !llc_dgram_match(sap, laddr, rc, net))) {
 				sock_put(rc);
 				continue;
 			}
 		llc_sap_mcast(sap, &laddr, skb);
 		kfree_skb(skb);
 	} else {
-		struct sock *sk = llc_lookup_dgram(sap, &laddr);
+		struct sock *sk = llc_lookup_dgram(sap, &laddr, dev_net(skb->dev));
 		if (sk) {
 			llc_sap_rcv(sap, skb, sk);
 			sock_put(sk);

net/netfilter/nf_tables_api.c+10−2

 			if (err < 0)
 				return err;
 		}
-		cond_resched();
 	}
 	return 0;
 		err = nft_chain_validate(&ctx, chain);
 		if (err < 0)
 			return err;
+		cond_resched();
 	}
 	return 0;
 		list_for_each_entry(chain, &table->chains, list) {
 			if (!nft_is_active_next(net, chain))
 				continue;
+			if (nft_chain_is_bound(chain))
+				continue;
 			ctx.chain = chain;
 			err = nft_delrule_by_chain(&ctx);
 	if (!tb[NFTA_VERDICT_CODE])
 		return -EINVAL;
+	/* zero padding hole for memcmp */
+	memset(data, 0, sizeof(*data));
 	data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
 	switch (data->verdict.code) {
 	ctx.family = table->family;
 	ctx.table = table;
 	list_for_each_entry(chain, &table->chains, list) {
+		if (nft_chain_is_bound(chain))
+			continue;
 		ctx.chain = chain;
 		list_for_each_entry_safe(rule, nr, &chain->rules, list) {
 			list_del(&rule->list);

net/netfilter/nft_set_pipapo.c+5−1

@@ -1929,7 +1929,11 @@ static void nft_pipapo_remove(const struct net net, const struct nft_set set, · 1928 unmodified lines
1929	int i, start, rules_fx;	1929	int i, start, rules_fx;
1930		1930
1931	match_start = data;	1931	match_start = data;
1932	match_end = (const u8 *)nft_set_ext_key_end(&e->ext)->data;	1932
		1933	if (nft_set_ext_exists(&e->ext, NFT_SET_EXT_KEY_END))
		1934	match_end = (const u8 *)nft_set_ext_key_end(&e->ext)->data;
		1935	else
		1936	match_end = data;
1933		1937
1934	start = first_rule;	1938	start = first_rule;
1935	rules_fx = rules_f0;	1939	rules_fx = rules_f0;

net/sched/cls_bpf.c+47−52

 	return 0;
 }
-static int cls_bpf_set_parms(struct net *net, struct tcf_proto *tp,
-			     struct cls_bpf_prog *prog, unsigned long base,
-			     struct nlattr **tb, struct nlattr *est, u32 flags,
-			     struct netlink_ext_ack *extack)
-{
-	bool is_bpf, is_ebpf, have_exts = false;
-	u32 gen_flags = 0;
-	int ret;
-	is_bpf = tb[TCA_BPF_OPS_LEN] && tb[TCA_BPF_OPS];
-	is_ebpf = tb[TCA_BPF_FD];
-	if ((!is_bpf && !is_ebpf) || (is_bpf && is_ebpf))
-		return -EINVAL;
-	ret = tcf_exts_validate(net, tp, tb, est, &prog->exts, flags,
-				extack);
-	if (ret < 0)
-		return ret;
-	if (tb[TCA_BPF_FLAGS]) {
-		u32 bpf_flags = nla_get_u32(tb[TCA_BPF_FLAGS]);
-		if (bpf_flags & ~TCA_BPF_FLAG_ACT_DIRECT)
-			return -EINVAL;
-		have_exts = bpf_flags & TCA_BPF_FLAG_ACT_DIRECT;
-	}
-	if (tb[TCA_BPF_FLAGS_GEN]) {
-		gen_flags = nla_get_u32(tb[TCA_BPF_FLAGS_GEN]);
-		if (gen_flags & ~CLS_BPF_SUPPORTED_GEN_FLAGS ||
-		    !tc_flags_valid(gen_flags))
-			return -EINVAL;
-	}
-	prog->exts_integrated = have_exts;
-	prog->gen_flags = gen_flags;
-	ret = is_bpf ? cls_bpf_prog_from_ops(tb, prog) :
-		       cls_bpf_prog_from_efd(tb, prog, gen_flags, tp);
-	if (ret < 0)
-		return ret;
-	if (tb[TCA_BPF_CLASSID]) {
-		prog->res.classid = nla_get_u32(tb[TCA_BPF_CLASSID]);
-		tcf_bind_filter(tp, &prog->res, base);
-	}
-	return 0;
-}
 static int cls_bpf_change(struct net *net, struct sk_buff *in_skb,
 			  struct tcf_proto *tp, unsigned long base,
 			  u32 handle, struct nlattr **tca,
 			  struct netlink_ext_ack *extack)
 {
 	struct cls_bpf_head *head = rtnl_dereference(tp->root);
+	bool is_bpf, is_ebpf, have_exts = false;
 	struct cls_bpf_prog *oldprog = *arg;
 	struct nlattr *tb[TCA_BPF_MAX + 1];
+	bool bound_to_filter = false;
 	struct cls_bpf_prog *prog;
+	u32 gen_flags = 0;
 	int ret;
 	if (tca[TCA_OPTIONS] == NULL)
 		goto errout;
 	prog->handle = handle;
-	ret = cls_bpf_set_parms(net, tp, prog, base, tb, tca[TCA_RATE], flags,
+	is_bpf = tb[TCA_BPF_OPS_LEN] && tb[TCA_BPF_OPS];
-				extack);
+	is_ebpf = tb[TCA_BPF_FD];
+	if ((!is_bpf && !is_ebpf) || (is_bpf && is_ebpf)) {
+		ret = -EINVAL;
+		goto errout_idr;
+	}
+	ret = tcf_exts_validate(net, tp, tb, tca[TCA_RATE], &prog->exts,
+				flags, extack);
+	if (ret < 0)
+		goto errout_idr;
+	if (tb[TCA_BPF_FLAGS]) {
+		u32 bpf_flags = nla_get_u32(tb[TCA_BPF_FLAGS]);
+		if (bpf_flags & ~TCA_BPF_FLAG_ACT_DIRECT) {
+			ret = -EINVAL;
+			goto errout_idr;
+		}
+		have_exts = bpf_flags & TCA_BPF_FLAG_ACT_DIRECT;
+	}
+	if (tb[TCA_BPF_FLAGS_GEN]) {
+		gen_flags = nla_get_u32(tb[TCA_BPF_FLAGS_GEN]);
+		if (gen_flags & ~CLS_BPF_SUPPORTED_GEN_FLAGS ||
+		    !tc_flags_valid(gen_flags)) {
+			ret = -EINVAL;
+			goto errout_idr;
+		}
+	}
+	prog->exts_integrated = have_exts;
+	prog->gen_flags = gen_flags;
+	ret = is_bpf ? cls_bpf_prog_from_ops(tb, prog) :
+		cls_bpf_prog_from_efd(tb, prog, gen_flags, tp);
 	if (ret < 0)
 		goto errout_idr;
+	if (tb[TCA_BPF_CLASSID]) {
+		prog->res.classid = nla_get_u32(tb[TCA_BPF_CLASSID]);
+		tcf_bind_filter(tp, &prog->res, base);
+		bound_to_filter = true;
+	}
 	ret = cls_bpf_offload(tp, prog, oldprog, extack);
 	if (ret)
 		goto errout_parms;
 	return 0;
 errout_parms:
+	if (bound_to_filter)
+		tcf_unbind_filter(tp, &prog->res);
 	cls_bpf_free_parms(prog);
 errout_idr:
 	if (!oldprog)

net/sched/cls_flower.c+47−52

 	return mask->meta.l2_miss;
 }
-static int fl_set_parms(struct net *net, struct tcf_proto *tp,
-			struct cls_fl_filter *f, struct fl_flow_mask *mask,
-			unsigned long base, struct nlattr **tb,
-			struct nlattr *est,
-			struct fl_flow_tmplt *tmplt,
-			u32 flags, u32 fl_flags,
-			struct netlink_ext_ack *extack)
-{
-	int err;
-	err = tcf_exts_validate_ex(net, tp, tb, est, &f->exts, flags,
-				   fl_flags, extack);
-	if (err < 0)
-		return err;
-	if (tb[TCA_FLOWER_CLASSID]) {
-		f->res.classid = nla_get_u32(tb[TCA_FLOWER_CLASSID]);
-		if (flags & TCA_ACT_FLAGS_NO_RTNL)
-			rtnl_lock();
-		tcf_bind_filter(tp, &f->res, base);
-		if (flags & TCA_ACT_FLAGS_NO_RTNL)
-			rtnl_unlock();
-	}
-	err = fl_set_key(net, tb, &f->key, &mask->key, extack);
-	if (err)
-		return err;
-	fl_mask_update_range(mask);
-	fl_set_masked_key(&f->mkey, &f->key, mask);
-	if (!fl_mask_fits_tmplt(tmplt, mask)) {
-		NL_SET_ERR_MSG_MOD(extack, "Mask does not fit the template");
-		return -EINVAL;
-	}
-	/* Enable tc skb extension if filter matches on data extracted from
-	 * this extension.
-	 */
-	if (fl_needs_tc_skb_ext(&mask->key)) {
-		f->needs_tc_skb_ext = 1;
-		tc_skb_ext_tc_enable();
-	}
-	return 0;
-}
 static int fl_ht_insert_unique(struct cls_fl_filter *fnew,
 			       struct cls_fl_filter *fold,
 			       bool *in_ht)
 	struct cls_fl_head *head = fl_head_dereference(tp);
 	bool rtnl_held = !(flags & TCA_ACT_FLAGS_NO_RTNL);
 	struct cls_fl_filter *fold = *arg;
+	bool bound_to_filter = false;
 	struct cls_fl_filter *fnew;
 	struct fl_flow_mask *mask;
 	struct nlattr **tb;
 	if (err < 0)
 		goto errout_idr;
-	err = fl_set_parms(net, tp, fnew, mask, base, tb, tca[TCA_RATE],
+	err = tcf_exts_validate_ex(net, tp, tb, tca[TCA_RATE],
-			   tp->chain->tmplt_priv, flags, fnew->flags,
+				   &fnew->exts, flags, fnew->flags,
-			   extack);
+				   extack);
-	if (err)
+	if (err < 0)
 		goto errout_idr;
+	if (tb[TCA_FLOWER_CLASSID]) {
+		fnew->res.classid = nla_get_u32(tb[TCA_FLOWER_CLASSID]);
+		if (flags & TCA_ACT_FLAGS_NO_RTNL)
+			rtnl_lock();
+		tcf_bind_filter(tp, &fnew->res, base);
+		if (flags & TCA_ACT_FLAGS_NO_RTNL)
+			rtnl_unlock();
+		bound_to_filter = true;
+	}
+	err = fl_set_key(net, tb, &fnew->key, &mask->key, extack);
+	if (err)
+		goto unbind_filter;
+	fl_mask_update_range(mask);
+	fl_set_masked_key(&fnew->mkey, &fnew->key, mask);
+	if (!fl_mask_fits_tmplt(tp->chain->tmplt_priv, mask)) {
+		NL_SET_ERR_MSG_MOD(extack, "Mask does not fit the template");
+		err = -EINVAL;
+		goto unbind_filter;
+	}
+	/* Enable tc skb extension if filter matches on data extracted from
+	 * this extension.
+	 */
+	if (fl_needs_tc_skb_ext(&mask->key)) {
+		fnew->needs_tc_skb_ext = 1;
+		tc_skb_ext_tc_enable();
+	}
 	err = fl_check_assign_mask(head, fnew, fold, mask);
 	if (err)
-		goto errout_idr;
+		goto unbind_filter;
 	err = fl_ht_insert_unique(fnew, fold, &in_ht);
 	if (err)
 				       fnew->mask->filter_ht_params);
 errout_mask:
 	fl_mask_put(head, fnew->mask);
+unbind_filter:
+	if (bound_to_filter) {
+		if (flags & TCA_ACT_FLAGS_NO_RTNL)
+			rtnl_lock();
+		tcf_unbind_filter(tp, &fnew->res);
+		if (flags & TCA_ACT_FLAGS_NO_RTNL)
+			rtnl_unlock();
+	}
 errout_idr:
 	if (!fold)
 		idr_remove(&head->handle_idr, fnew->handle);

net/sched/cls_matchall.c+12−23

 	[TCA_MATCHALL_FLAGS]		= { .type = NLA_U32 },
 };
-static int mall_set_parms(struct net *net, struct tcf_proto *tp,
-			  struct cls_mall_head *head,
-			  unsigned long base, struct nlattr **tb,
-			  struct nlattr *est, u32 flags, u32 fl_flags,
-			  struct netlink_ext_ack *extack)
-{
-	int err;
-	err = tcf_exts_validate_ex(net, tp, tb, est, &head->exts, flags,
-				   fl_flags, extack);
-	if (err < 0)
-		return err;
-	if (tb[TCA_MATCHALL_CLASSID]) {
-		head->res.classid = nla_get_u32(tb[TCA_MATCHALL_CLASSID]);
-		tcf_bind_filter(tp, &head->res, base);
-	}
-	return 0;
-}
 static int mall_change(struct net *net, struct sk_buff *in_skb,
 		       struct tcf_proto *tp, unsigned long base,
 		       u32 handle, struct nlattr **tca,
 {
 	struct cls_mall_head *head = rtnl_dereference(tp->root);
 	struct nlattr *tb[TCA_MATCHALL_MAX + 1];
+	bool bound_to_filter = false;
 	struct cls_mall_head *new;
 	u32 userflags = 0;
 	int err;
 		goto err_alloc_percpu;
 	}
-	err = mall_set_parms(net, tp, new, base, tb, tca[TCA_RATE],
+	err = tcf_exts_validate_ex(net, tp, tb, tca[TCA_RATE],
-			     flags, new->flags, extack);
+				   &new->exts, flags, new->flags, extack);
-	if (err)
+	if (err < 0)
 		goto err_set_parms;
+	if (tb[TCA_MATCHALL_CLASSID]) {
+		new->res.classid = nla_get_u32(tb[TCA_MATCHALL_CLASSID]);
+		tcf_bind_filter(tp, &new->res, base);
+		bound_to_filter = true;
+	}
 	if (!tc_skip_hw(new->flags)) {
 		err = mall_replace_hw_filter(tp, new, (unsigned long)new,
 					     extack);
 	return 0;
 err_replace_hw_filter:
+	if (bound_to_filter)
+		tcf_unbind_filter(tp, &new->res);
 err_set_parms:
 	free_percpu(new->pf);
 err_alloc_percpu:

net/sched/cls_u32.c+37−11

 	[TCA_U32_FLAGS]		= { .type = NLA_U32 },
 };
+static void u32_unbind_filter(struct tcf_proto *tp, struct tc_u_knode *n,
+			      struct nlattr **tb)
+{
+	if (tb[TCA_U32_CLASSID])
+		tcf_unbind_filter(tp, &n->res);
+}
+static void u32_bind_filter(struct tcf_proto *tp, struct tc_u_knode *n,
+			    unsigned long base, struct nlattr **tb)
+{
+	if (tb[TCA_U32_CLASSID]) {
+		n->res.classid = nla_get_u32(tb[TCA_U32_CLASSID]);
+		tcf_bind_filter(tp, &n->res, base);
+	}
+}
 static int u32_set_parms(struct net *net, struct tcf_proto *tp,
-			 unsigned long base,
 			 struct tc_u_knode *n, struct nlattr **tb,
 			 struct nlattr *est, u32 flags, u32 fl_flags,
 			 struct netlink_ext_ack *extack)
 		if (ht_old)
 			ht_old->refcnt--;
 	}
-	if (tb[TCA_U32_CLASSID]) {
-		n->res.classid = nla_get_u32(tb[TCA_U32_CLASSID]);
-		tcf_bind_filter(tp, &n->res, base);
-	}
 	if (ifindex >= 0)
 		n->ifindex = ifindex;
 		if (!new)
 			return -ENOMEM;
-		err = u32_set_parms(net, tp, base, new, tb,
+		err = u32_set_parms(net, tp, new, tb, tca[TCA_RATE],
-				    tca[TCA_RATE], flags, new->flags,
+				    flags, new->flags, extack);
-				    extack);
 		if (err) {
 			__u32_destroy_key(new);
 			return err;
 		}
+		u32_bind_filter(tp, new, base, tb);
 		err = u32_replace_hw_knode(tp, new, flags, extack);
 		if (err) {
+			u32_unbind_filter(tp, new, tb);
+			if (tb[TCA_U32_LINK]) {
+				struct tc_u_hnode *ht_old;
+				ht_old = rtnl_dereference(n->ht_down);
+				if (ht_old)
+					ht_old->refcnt++;
+			}
 			__u32_destroy_key(new);
 			return err;
 		}
 	}
 #endif
-	err = u32_set_parms(net, tp, base, n, tb, tca[TCA_RATE],
+	err = u32_set_parms(net, tp, n, tb, tca[TCA_RATE],
 			    flags, n->flags, extack);
+	u32_bind_filter(tp, n, base, tb);
 	if (err == 0) {
 		struct tc_u_knode __rcu **ins;
 		struct tc_u_knode *pins;
 		err = u32_replace_hw_knode(tp, n, flags, extack);
 		if (err)
-			goto errhw;
+			goto errunbind;
 		if (!tc_in_hw(n->flags))
 			n->flags |= TCA_CLS_FLAGS_NOT_IN_HW;
 		return 0;
 	}
-errhw:
+errunbind:
+	u32_unbind_filter(tp, n, tb);
 #ifdef CONFIG_CLS_U32_MARK
 	free_percpu(n->pcpu_success);
 #endif

tools/testing/selftests/bpf/progs/async_stack_depth.c+23−2

@@ -22,9 +22,16 @@ static int timer_cb(void map, int key, struct bpf_timer *timer) · 21 unmodified lines
22	return buf[69];	22	return buf[69];
23	}	23	}
24		24
		25	__attribute__((noinline))
		26	static int bad_timer_cb(void map, int key, struct bpf_timer *timer)
		27	{
		28	volatile char buf[300] = {};
		29	return buf[255] + timer_cb(NULL, NULL, NULL);
		30	}
		31
25	SEC("tc")	32	SEC("tc")
26	__failure __msg("combined stack size of 2 calls")	33	__failure __msg("combined stack size of 2 calls is 576. Too large")
27	int prog(struct __sk_buff *ctx)	34	int pseudo_call_check(struct __sk_buff *ctx)
28	{	35	{
29	struct hmap_elem *elem;	36	struct hmap_elem *elem;
30	volatile char buf[256] = {};	37	volatile char buf[256] = {};
@@ -37,4 +44,18 @@ int prog(struct __sk_buff *ctx) · 6 unmodified lines
37	return bpf_timer_set_callback(&elem->timer, timer_cb) + buf[0];	44	return bpf_timer_set_callback(&elem->timer, timer_cb) + buf[0];
38	}	45	}
39		46
		47	SEC("tc")
		48	__failure __msg("combined stack size of 2 calls is 608. Too large")
		49	int async_call_root_check(struct __sk_buff *ctx)
		50	{
		51	struct hmap_elem *elem;
		52	volatile char buf[256] = {};
		53
		54	elem = bpf_map_lookup_elem(&hmap, &(int){0});
		55	if (!elem)
		56	return 0;
		57
		58	return bpf_timer_set_callback(&elem->timer, bad_timer_cb) + buf[0];
		59	}
		60
40	char _license[] SEC("license") = "GPL";	61	char _license[] SEC("license") = "GPL";

tools/testing/selftests/tc-testing/config+2−0

@@ -5,6 +5,8 @@ CONFIG_NF_CONNTRACK=m · 4 unmodified lines
5	CONFIG_NF_CONNTRACK_MARK=y	5	CONFIG_NF_CONNTRACK_MARK=y
6	CONFIG_NF_CONNTRACK_ZONES=y	6	CONFIG_NF_CONNTRACK_ZONES=y
7	CONFIG_NF_CONNTRACK_LABELS=y	7	CONFIG_NF_CONNTRACK_LABELS=y
		8	CONFIG_NF_CONNTRACK_PROCFS=y
		9	CONFIG_NF_FLOW_TABLE=m
8	CONFIG_NF_NAT=m	10	CONFIG_NF_NAT=m
9	CONFIG_NETFILTER_XT_TARGET_LOG=m	11	CONFIG_NETFILTER_XT_TARGET_LOG=m
10		12

tools/testing/selftests/tc-testing/settings+1−0

@@ -0,0 +1 @@
		1	timeout=900

Merge tag 'net-6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code