Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller: 1) Fix refcounting bug for connections in on-packet scheduling mode of IPVS, from Julian Anastasov. 2) Set network header properly in AF_PACKET's packet_snd, from Willem de Bruijn. 3) Fix regressions in 3c59x by converting to generic DMA API. It was relying upon the hack that the PCI DMA interfaces would accept NULL for EISA devices. From Christoph Hellwig. 4) Remove RDMA devices before unregistering netdev in QEDE driver, from Michal Kalderon. 5) Use after free in TUN driver ptr_ring usage, from Jason Wang. 6) Properly check for missing netlink attributes in SMC_PNETID requests, from Eric Biggers. 7) Set DMA mask before performaing any DMA operations in vmxnet3 driver, from Regis Duchesne. 8) Fix mlx5 build with SMP=n, from Saeed Mahameed. 9) Classifier fixes in bcm_sf2 driver from Florian Fainelli. 10) Tuntap use after free during release, from Jason Wang. 11) Don't use stack memory in scatterlists in tls code, from Matt Mullins. 12) Not fully initialized flow key object in ipv4 routing code, from David Ahern. 13) Various packet headroom bug fixes in ip6_gre driver, from Petr Machata. 14) Remove queues from XPS maps using correct index, from Amritha Nambiar. 15) Fix use after free in sock_diag, from Eric Dumazet. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (64 commits) net: ip6_gre: fix tunnel metadata device sharing. cxgb4: fix offset in collecting TX rate limit info net: sched: red: avoid hashing NULL child sock_diag: fix use-after-free read in __sk_free sh_eth: Change platform check to CONFIG_ARCH_RENESAS net: dsa: Do not register devlink for unused ports net: Fix a bug in removing queues from XPS map bpf: fix truncated jump targets on heavy expansions bpf: parse and verdict prog attach may race with bpf map update bpf: sockmap update rollback on error can incorrectly dec prog refcnt net: test tailroom before appending to linear skb net: ip6_gre: Fix ip6erspan hlen calculation net: ip6_gre: Split up ip6gre_changelink() net: ip6_gre: Split up ip6gre_newlink() net: ip6_gre: Split up ip6gre_tnl_change() net: ip6_gre: Split up ip6gre_tnl_link_config() net: ip6_gre: Fix headroom request in ip6erspan_tunnel_xmit() net: ip6_gre: Request headroom in __gre6_xmit() selftests/bpf: check return value of fopen in test_verifier.c erspan: fix invalid erspan version. ...

Linus Torvalds committed 8 years ago

Commit 5aef2682 parents 771c577 b80d0b957 files · +1010 −465Browse files

Unified · Split

57 files

Documentation/devicetree/bindings/net/micrel-ksz90x1.txt +7 −0
drivers/net/dsa/bcm_sf2_cfp.c +22 −14
drivers/net/ethernet/3com/3c59x.c +51 −53
drivers/net/ethernet/8390/ne.c +3 −1
drivers/net/ethernet/chelsio/cxgb4/cudbg_entity.h +9 −19
drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c +30 −58
drivers/net/ethernet/ibm/ibmvnic.c +17 −11
drivers/net/ethernet/mellanox/mlx4/main.c +3 −1
drivers/net/ethernet/netronome/nfp/bpf/main.c +1 −1
drivers/net/ethernet/qlogic/qed/qed_ll2.c +50 −11
drivers/net/ethernet/qlogic/qede/qede_main.c +1 −2
drivers/net/ethernet/renesas/sh_eth.h +1 −1
drivers/net/ipvlan/ipvlan_main.c +3 −1
drivers/net/phy/micrel.c +31 −0
drivers/net/tun.c +12 −15
drivers/net/vmxnet3/vmxnet3_drv.c +47 −25
drivers/net/vmxnet3/vmxnet3_int.h +5 −3
include/linux/mlx5/driver.h +1 −11
include/net/netfilter/nf_tables.h +5 −0
include/net/tls.h +3 −0
include/uapi/linux/netfilter/nf_conntrack_tcp.h +3 −0
kernel/bpf/core.c +75 −25
kernel/bpf/sockmap.c +9 −9
net/bridge/netfilter/ebt_stp.c +2 −2
net/core/dev.c +1 −1
net/core/filter.c +9 −2
net/core/sock.c +1 −1
net/dsa/dsa2.c +6 −3
net/ipv4/fib_frontend.c +7 −1
net/ipv4/ip_gre.c +3 −1
net/ipv4/ip_output.c +2 −1
net/ipv4/netfilter/ip_tables.c +1 −0
net/ipv4/netfilter/ipt_rpfilter.c +1 −1
net/ipv4/route.c +6 −1
net/ipv4/tcp_output.c +5 −2
net/ipv6/ip6_gre.c +226 −60
net/ipv6/ip6_output.c +2 −1
net/ipv6/netfilter/ip6_tables.c +1 −0
net/netfilter/core.c +2 −1
net/netfilter/ipvs/ip_vs_conn.c +6 −11
net/netfilter/ipvs/ip_vs_core.c +12 −0
net/netfilter/nf_conntrack_proto_tcp.c +11 −0
net/netfilter/nf_tables_api.c +63 −14
net/netfilter/nf_tables_core.c +14 −7
net/netfilter/nfnetlink_acct.c +1 −1
net/netfilter/nfnetlink_cthelper.c +4 −3
net/netfilter/nft_compat.c +156 −45
net/netfilter/nft_immediate.c +12 −3
net/netfilter/x_tables.c +6 −0
net/packet/af_packet.c +3 −1
net/sched/act_vlan.c +2 −0
net/sched/sch_red.c +3 −2
net/sched/sch_tbf.c +3 −2
net/smc/smc_pnet.c +40 −31
net/tls/tls_sw.c +4 −5
tools/lib/bpf/libbpf.c +1 −1
tools/testing/selftests/bpf/test_verifier.c +5 −0

Documentation/devicetree/bindings/net/micrel-ksz90x1.txt+7−0

@@ -57,6 +57,13 @@ KSZ9031: · 56 unmodified lines
57	57	- txd2-skew-ps : Skew control of TX data 2 pad
58	58	- txd3-skew-ps : Skew control of TX data 3 pad
59	59
	60	+ - micrel,force-master:
	61	+ Boolean, force phy to master mode. Only set this option if the phy
	62	+ reference clock provided at CLK125_NDO pin is used as MAC reference
	63	+ clock because the clock jitter in slave mode is to high (errata#2).
	64	+ Attention: The link partner must be configurable as slave otherwise
	65	+ no link will be established.
	66	+
60	67	Examples:
61	68
62	69	mdio {

drivers/net/dsa/bcm_sf2_cfp.c+22−14

@@ -354,10 +354,13 @@ static int bcm_sf2_cfp_ipv4_rule_set(struct bcm_sf2_priv *priv, int port, · 353 unmodified lines
354	354	/* Locate the first rule available */
355	355	if (fs->location == RX_CLS_LOC_ANY)
356	356	rule_index = find_first_zero_bit(priv->cfp.used,
357		− bcm_sf2_cfp_rule_size(priv));
	357	+ priv->num_cfp_rules);
358	358	else
359	359	rule_index = fs->location;
360	360
	361	+ if (rule_index > bcm_sf2_cfp_rule_size(priv))
	362	+ return -ENOSPC;
	363	+
361	364	layout = &udf_tcpip4_layout;
362	365	/* We only use one UDF slice for now */
363	366	slice_num = bcm_sf2_get_slice_number(layout, 0);
@@ -562,19 +565,21 @@ static int bcm_sf2_cfp_ipv6_rule_set(struct bcm_sf2_priv *priv, int port, · 198 unmodified lines
562	565	* first half because the HW search is by incrementing addresses.
563	566	*/
564	567	if (fs->location == RX_CLS_LOC_ANY)
565		− rule_index[0] = find_first_zero_bit(priv->cfp.used,
566		− bcm_sf2_cfp_rule_size(priv));
	568	+ rule_index[1] = find_first_zero_bit(priv->cfp.used,
	569	+ priv->num_cfp_rules);
567	570	else
568		− rule_index[0] = fs->location;
	571	+ rule_index[1] = fs->location;
	572	+ if (rule_index[1] > bcm_sf2_cfp_rule_size(priv))
	573	+ return -ENOSPC;
569	574
570	575	/* Flag it as used (cleared on error path) such that we can immediately
571	576	* obtain a second one to chain from.
572	577	*/
573		− set_bit(rule_index[0], priv->cfp.used);
	578	+ set_bit(rule_index[1], priv->cfp.used);
574	579
575		− rule_index[1] = find_first_zero_bit(priv->cfp.used,
576		− bcm_sf2_cfp_rule_size(priv));
577		− if (rule_index[1] > bcm_sf2_cfp_rule_size(priv)) {
	580	+ rule_index[0] = find_first_zero_bit(priv->cfp.used,
	581	+ priv->num_cfp_rules);
	582	+ if (rule_index[0] > bcm_sf2_cfp_rule_size(priv)) {
578	583	ret = -ENOSPC;
579	584	goto out_err;
580	585	}
@@ -712,14 +717,14 @@ static int bcm_sf2_cfp_ipv6_rule_set(struct bcm_sf2_priv *priv, int port, · 131 unmodified lines
712	717	/* Flag the second half rule as being used now, return it as the
713	718	* location, and flag it as unique while dumping rules
714	719	*/
715		− set_bit(rule_index[1], priv->cfp.used);
	720	+ set_bit(rule_index[0], priv->cfp.used);
716	721	set_bit(rule_index[1], priv->cfp.unique);
717	722	fs->location = rule_index[1];
718	723
719	724	return ret;
720	725
721	726	out_err:
722		− clear_bit(rule_index[0], priv->cfp.used);
	727	+ clear_bit(rule_index[1], priv->cfp.used);
723	728	return ret;
724	729	}
725	730
@@ -785,10 +790,6 @@ static int bcm_sf2_cfp_rule_del_one(struct bcm_sf2_priv *priv, int port, · 59 unmodified lines
785	790	int ret;
786	791	u32 reg;
787	792
788		− /* Refuse deletion of unused rules, and the default reserved rule */
789		− if (!test_bit(loc, priv->cfp.used) \|\| loc == 0)
790		− return -EINVAL;
791		−
792	793	/* Indicate which rule we want to read */
793	794	bcm_sf2_cfp_rule_addr_set(priv, loc);
794	795
@@ -826,6 +827,13 @@ static int bcm_sf2_cfp_rule_del(struct bcm_sf2_priv *priv, int port, · 31 unmodified lines
826	827	u32 next_loc = 0;
827	828	int ret;
828	829
	830	+ /* Refuse deleting unused rules, and those that are not unique since
	831	+ * that could leave IPv6 rules with one of the chained rule in the
	832	+ * table.
	833	+ */
	834	+ if (!test_bit(loc, priv->cfp.unique) \|\| loc == 0)
	835	+ return -EINVAL;
	836	+
829	837	ret = bcm_sf2_cfp_rule_del_one(priv, port, loc, &next_loc);
830	838	if (ret)
831	839	return ret;

drivers/net/ethernet/3com/3c59x.c+51−53

@@ -1212,9 +1212,9 @@ static int vortex_probe1(struct device gendev, void __iomem ioaddr, int irq, · 1211 unmodified lines
1212	1212	vp->mii.reg_num_mask = 0x1f;
1213	1213
1214	1214	/* Makes sure rings are at least 16 byte aligned. */
1215		− vp->rx_ring = pci_alloc_consistent(pdev, sizeof(struct boom_rx_desc) * RX_RING_SIZE
	1215	+ vp->rx_ring = dma_alloc_coherent(gendev, sizeof(struct boom_rx_desc) * RX_RING_SIZE
1216	1216	+ sizeof(struct boom_tx_desc) * TX_RING_SIZE,
1217		− &vp->rx_ring_dma);
	1217	+ &vp->rx_ring_dma, GFP_KERNEL);
1218	1218	retval = -ENOMEM;
1219	1219	if (!vp->rx_ring)
1220	1220	goto free_device;
@@ -1476,11 +1476,10 @@ static int vortex_probe1(struct device gendev, void __iomem ioaddr, int irq, · 255 unmodified lines
1476	1476	return 0;
1477	1477
1478	1478	free_ring:
1479		− pci_free_consistent(pdev,
1480		− sizeof(struct boom_rx_desc) * RX_RING_SIZE
1481		− + sizeof(struct boom_tx_desc) * TX_RING_SIZE,
1482		− vp->rx_ring,
1483		− vp->rx_ring_dma);
	1479	+ dma_free_coherent(&pdev->dev,
	1480	+ sizeof(struct boom_rx_desc) * RX_RING_SIZE +
	1481	+ sizeof(struct boom_tx_desc) * TX_RING_SIZE,
	1482	+ vp->rx_ring, vp->rx_ring_dma);
1484	1483	free_device:
1485	1484	free_netdev(dev);
1486	1485	pr_err(PFX "vortex_probe1 fails. Returns %d\n", retval);
@@ -1751,9 +1750,9 @@ vortex_open(struct net_device *dev) · 264 unmodified lines
1751	1750	break; /* Bad news! */
1752	1751
1753	1752	skb_reserve(skb, NET_IP_ALIGN); /* Align IP on 16 byte boundaries */
1754		− dma = pci_map_single(VORTEX_PCI(vp), skb->data,
1755		− PKT_BUF_SZ, PCI_DMA_FROMDEVICE);
1756		− if (dma_mapping_error(&VORTEX_PCI(vp)->dev, dma))
	1753	+ dma = dma_map_single(vp->gendev, skb->data,
	1754	+ PKT_BUF_SZ, DMA_FROM_DEVICE);
	1755	+ if (dma_mapping_error(vp->gendev, dma))
1757	1756	break;
1758	1757	vp->rx_ring[i].addr = cpu_to_le32(dma);
1759	1758	}
@@ -2067,9 +2066,9 @@ vortex_start_xmit(struct sk_buff skb, struct net_device dev) · 307 unmodified lines
2067	2066	if (vp->bus_master) {
2068	2067	/* Set the bus-master controller to transfer the packet. */
2069	2068	int len = (skb->len + 3) & ~3;
2070		− vp->tx_skb_dma = pci_map_single(VORTEX_PCI(vp), skb->data, len,
2071		− PCI_DMA_TODEVICE);
2072		− if (dma_mapping_error(&VORTEX_PCI(vp)->dev, vp->tx_skb_dma)) {
	2069	+ vp->tx_skb_dma = dma_map_single(vp->gendev, skb->data, len,
	2070	+ DMA_TO_DEVICE);
	2071	+ if (dma_mapping_error(vp->gendev, vp->tx_skb_dma)) {
2073	2072	dev_kfree_skb_any(skb);
2074	2073	dev->stats.tx_dropped++;
2075	2074	return NETDEV_TX_OK;
@@ -2168,9 +2167,9 @@ boomerang_start_xmit(struct sk_buff skb, struct net_device dev) · 92 unmodified lines
2168	2167	vp->tx_ring[entry].status = cpu_to_le32(skb->len \| TxIntrUploaded \| AddTCPChksum \| AddUDPChksum);
2169	2168
2170	2169	if (!skb_shinfo(skb)->nr_frags) {
2171		− dma_addr = pci_map_single(VORTEX_PCI(vp), skb->data, skb->len,
2172		− PCI_DMA_TODEVICE);
2173		− if (dma_mapping_error(&VORTEX_PCI(vp)->dev, dma_addr))
	2170	+ dma_addr = dma_map_single(vp->gendev, skb->data, skb->len,
	2171	+ DMA_TO_DEVICE);
	2172	+ if (dma_mapping_error(vp->gendev, dma_addr))
2174	2173	goto out_dma_err;
2175	2174
2176	2175	vp->tx_ring[entry].frag[0].addr = cpu_to_le32(dma_addr);
@@ -2178,9 +2177,9 @@ boomerang_start_xmit(struct sk_buff skb, struct net_device dev) · 1 unmodified line
2178	2177	} else {
2179	2178	int i;
2180	2179
2181		− dma_addr = pci_map_single(VORTEX_PCI(vp), skb->data,
2182		− skb_headlen(skb), PCI_DMA_TODEVICE);
2183		− if (dma_mapping_error(&VORTEX_PCI(vp)->dev, dma_addr))
	2180	+ dma_addr = dma_map_single(vp->gendev, skb->data,
	2181	+ skb_headlen(skb), DMA_TO_DEVICE);
	2182	+ if (dma_mapping_error(vp->gendev, dma_addr))
2184	2183	goto out_dma_err;
2185	2184
2186	2185	vp->tx_ring[entry].frag[0].addr = cpu_to_le32(dma_addr);
@@ -2189,21 +2188,21 @@ boomerang_start_xmit(struct sk_buff skb, struct net_device dev) · 2 unmodified lines
2189	2188	for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
2190	2189	skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
2191	2190
2192		− dma_addr = skb_frag_dma_map(&VORTEX_PCI(vp)->dev, frag,
	2191	+ dma_addr = skb_frag_dma_map(vp->gendev, frag,
2193	2192	0,
2194	2193	frag->size,
2195	2194	DMA_TO_DEVICE);
2196		− if (dma_mapping_error(&VORTEX_PCI(vp)->dev, dma_addr)) {
	2195	+ if (dma_mapping_error(vp->gendev, dma_addr)) {
2197	2196	for(i = i-1; i >= 0; i--)
2198		− dma_unmap_page(&VORTEX_PCI(vp)->dev,
	2197	+ dma_unmap_page(vp->gendev,
2199	2198	le32_to_cpu(vp->tx_ring[entry].frag[i+1].addr),
2200	2199	le32_to_cpu(vp->tx_ring[entry].frag[i+1].length),
2201	2200	DMA_TO_DEVICE);
2202	2201
2203		− pci_unmap_single(VORTEX_PCI(vp),
	2202	+ dma_unmap_single(vp->gendev,
2204	2203	le32_to_cpu(vp->tx_ring[entry].frag[0].addr),
2205	2204	le32_to_cpu(vp->tx_ring[entry].frag[0].length),
2206		− PCI_DMA_TODEVICE);
	2205	+ DMA_TO_DEVICE);
2207	2206
2208	2207	goto out_dma_err;
2209	2208	}
@@ -2218,8 +2217,8 @@ boomerang_start_xmit(struct sk_buff skb, struct net_device dev) · 8 unmodified lines
2218	2217	}
2219	2218	}
2220	2219	#else
2221		− dma_addr = pci_map_single(VORTEX_PCI(vp), skb->data, skb->len, PCI_DMA_TODEVICE);
2222		− if (dma_mapping_error(&VORTEX_PCI(vp)->dev, dma_addr))
	2220	+ dma_addr = dma_map_single(vp->gendev, skb->data, skb->len, DMA_TO_DEVICE);
	2221	+ if (dma_mapping_error(vp->gendev, dma_addr))
2223	2222	goto out_dma_err;
2224	2223	vp->tx_ring[entry].addr = cpu_to_le32(dma_addr);
2225	2224	vp->tx_ring[entry].length = cpu_to_le32(skb->len \| LAST_FRAG);
@@ -2254,7 +2253,7 @@ boomerang_start_xmit(struct sk_buff skb, struct net_device dev) · 28 unmodified lines
2254	2253	out:
2255	2254	return NETDEV_TX_OK;
2256	2255	out_dma_err:
2257		− dev_err(&VORTEX_PCI(vp)->dev, "Error mapping dma buffer\n");
	2256	+ dev_err(vp->gendev, "Error mapping dma buffer\n");
2258	2257	goto out;
2259	2258	}
2260	2259
@@ -2322,7 +2321,7 @@ vortex_interrupt(int irq, void *dev_id) · 61 unmodified lines
2322	2321	if (status & DMADone) {
2323	2322	if (ioread16(ioaddr + Wn7_MasterStatus) & 0x1000) {
2324	2323	iowrite16(0x1000, ioaddr + Wn7_MasterStatus); /* Ack the event. */
2325		− pci_unmap_single(VORTEX_PCI(vp), vp->tx_skb_dma, (vp->tx_skb->len + 3) & ~3, PCI_DMA_TODEVICE);
	2324	+ dma_unmap_single(vp->gendev, vp->tx_skb_dma, (vp->tx_skb->len + 3) & ~3, DMA_TO_DEVICE);
2326	2325	pkts_compl++;
2327	2326	bytes_compl += vp->tx_skb->len;
2328	2327	dev_kfree_skb_irq(vp->tx_skb); /* Release the transferred buffer */
@@ -2459,19 +2458,19 @@ boomerang_interrupt(int irq, void *dev_id) · 130 unmodified lines
2459	2458	struct sk_buff *skb = vp->tx_skbuff[entry];
2460	2459	#if DO_ZEROCOPY
2461	2460	int i;
2462		− pci_unmap_single(VORTEX_PCI(vp),
	2461	+ dma_unmap_single(vp->gendev,
2463	2462	le32_to_cpu(vp->tx_ring[entry].frag[0].addr),
2464	2463	le32_to_cpu(vp->tx_ring[entry].frag[0].length)&0xFFF,
2465		− PCI_DMA_TODEVICE);
	2464	+ DMA_TO_DEVICE);
2466	2465
2467	2466	for (i=1; i<=skb_shinfo(skb)->nr_frags; i++)
2468		− pci_unmap_page(VORTEX_PCI(vp),
	2467	+ dma_unmap_page(vp->gendev,
2469	2468	le32_to_cpu(vp->tx_ring[entry].frag[i].addr),
2470	2469	le32_to_cpu(vp->tx_ring[entry].frag[i].length)&0xFFF,
2471		− PCI_DMA_TODEVICE);
	2470	+ DMA_TO_DEVICE);
2472	2471	#else
2473		− pci_unmap_single(VORTEX_PCI(vp),
2474		− le32_to_cpu(vp->tx_ring[entry].addr), skb->len, PCI_DMA_TODEVICE);
	2472	+ dma_unmap_single(vp->gendev,
	2473	+ le32_to_cpu(vp->tx_ring[entry].addr), skb->len, DMA_TO_DEVICE);
2475	2474	#endif
2476	2475	pkts_compl++;
2477	2476	bytes_compl += skb->len;
@@ -2561,14 +2560,14 @@ static int vortex_rx(struct net_device *dev) · 83 unmodified lines
2561	2560	/* 'skb_put()' points to the start of sk_buff data area. */
2562	2561	if (vp->bus_master &&
2563	2562	! (ioread16(ioaddr + Wn7_MasterStatus) & 0x8000)) {
2564		− dma_addr_t dma = pci_map_single(VORTEX_PCI(vp), skb_put(skb, pkt_len),
2565		− pkt_len, PCI_DMA_FROMDEVICE);
	2563	+ dma_addr_t dma = dma_map_single(vp->gendev, skb_put(skb, pkt_len),
	2564	+ pkt_len, DMA_FROM_DEVICE);
2566	2565	iowrite32(dma, ioaddr + Wn7_MasterAddr);
2567	2566	iowrite16((skb->len + 3) & ~3, ioaddr + Wn7_MasterLen);
2568	2567	iowrite16(StartDMAUp, ioaddr + EL3_CMD);
2569	2568	while (ioread16(ioaddr + Wn7_MasterStatus) & 0x8000)
2570	2569	;
2571		− pci_unmap_single(VORTEX_PCI(vp), dma, pkt_len, PCI_DMA_FROMDEVICE);
	2570	+ dma_unmap_single(vp->gendev, dma, pkt_len, DMA_FROM_DEVICE);
2572	2571	} else {
2573	2572	ioread32_rep(ioaddr + RX_FIFO,
2574	2573	skb_put(skb, pkt_len),
@@ -2635,11 +2634,11 @@ boomerang_rx(struct net_device *dev) · 60 unmodified lines
2635	2634	if (pkt_len < rx_copybreak &&
2636	2635	(skb = netdev_alloc_skb(dev, pkt_len + 2)) != NULL) {
2637	2636	skb_reserve(skb, 2); /* Align IP on 16 byte boundaries */
2638		− pci_dma_sync_single_for_cpu(VORTEX_PCI(vp), dma, PKT_BUF_SZ, PCI_DMA_FROMDEVICE);
	2637	+ dma_sync_single_for_cpu(vp->gendev, dma, PKT_BUF_SZ, DMA_FROM_DEVICE);
2639	2638	/* 'skb_put()' points to the start of sk_buff data area. */
2640	2639	skb_put_data(skb, vp->rx_skbuff[entry]->data,
2641	2640	pkt_len);
2642		− pci_dma_sync_single_for_device(VORTEX_PCI(vp), dma, PKT_BUF_SZ, PCI_DMA_FROMDEVICE);
	2641	+ dma_sync_single_for_device(vp->gendev, dma, PKT_BUF_SZ, DMA_FROM_DEVICE);
2643	2642	vp->rx_copy++;
2644	2643	} else {
2645	2644	/* Pre-allocate the replacement skb. If it or its
@@ -2651,9 +2650,9 @@ boomerang_rx(struct net_device *dev) · 5 unmodified lines
2651	2650	dev->stats.rx_dropped++;
2652	2651	goto clear_complete;
2653	2652	}
2654		− newdma = pci_map_single(VORTEX_PCI(vp), newskb->data,
2655		− PKT_BUF_SZ, PCI_DMA_FROMDEVICE);
2656		− if (dma_mapping_error(&VORTEX_PCI(vp)->dev, newdma)) {
	2653	+ newdma = dma_map_single(vp->gendev, newskb->data,
	2654	+ PKT_BUF_SZ, DMA_FROM_DEVICE);
	2655	+ if (dma_mapping_error(vp->gendev, newdma)) {
2657	2656	dev->stats.rx_dropped++;
2658	2657	consume_skb(newskb);
2659	2658	goto clear_complete;
@@ -2664,7 +2663,7 @@ boomerang_rx(struct net_device *dev) · 4 unmodified lines
2664	2663	vp->rx_skbuff[entry] = newskb;
2665	2664	vp->rx_ring[entry].addr = cpu_to_le32(newdma);
2666	2665	skb_put(skb, pkt_len);
2667		− pci_unmap_single(VORTEX_PCI(vp), dma, PKT_BUF_SZ, PCI_DMA_FROMDEVICE);
	2666	+ dma_unmap_single(vp->gendev, dma, PKT_BUF_SZ, DMA_FROM_DEVICE);
2668	2667	vp->rx_nocopy++;
2669	2668	}
2670	2669	skb->protocol = eth_type_trans(skb, dev);
@@ -2761,8 +2760,8 @@ vortex_close(struct net_device *dev) · 90 unmodified lines
2761	2760	if (vp->full_bus_master_rx) { /* Free Boomerang bus master Rx buffers. */
2762	2761	for (i = 0; i < RX_RING_SIZE; i++)
2763	2762	if (vp->rx_skbuff[i]) {
2764		− pci_unmap_single( VORTEX_PCI(vp), le32_to_cpu(vp->rx_ring[i].addr),
2765		− PKT_BUF_SZ, PCI_DMA_FROMDEVICE);
	2763	+ dma_unmap_single(vp->gendev, le32_to_cpu(vp->rx_ring[i].addr),
	2764	+ PKT_BUF_SZ, DMA_FROM_DEVICE);
2766	2765	dev_kfree_skb(vp->rx_skbuff[i]);
2767	2766	vp->rx_skbuff[i] = NULL;
2768	2767	}
@@ -2775,12 +2774,12 @@ vortex_close(struct net_device *dev) · 6 unmodified lines
2775	2774	int k;
2776	2775
2777	2776	for (k=0; k<=skb_shinfo(skb)->nr_frags; k++)
2778		− pci_unmap_single(VORTEX_PCI(vp),
	2777	+ dma_unmap_single(vp->gendev,
2779	2778	le32_to_cpu(vp->tx_ring[i].frag[k].addr),
2780	2779	le32_to_cpu(vp->tx_ring[i].frag[k].length)&0xFFF,
2781		− PCI_DMA_TODEVICE);
	2780	+ DMA_TO_DEVICE);
2782	2781	#else
2783		− pci_unmap_single(VORTEX_PCI(vp), le32_to_cpu(vp->tx_ring[i].addr), skb->len, PCI_DMA_TODEVICE);
	2782	+ dma_unmap_single(vp->gendev, le32_to_cpu(vp->tx_ring[i].addr), skb->len, DMA_TO_DEVICE);
2784	2783	#endif
2785	2784	dev_kfree_skb(skb);
2786	2785	vp->tx_skbuff[i] = NULL;
@@ -3288,11 +3287,10 @@ static void vortex_remove_one(struct pci_dev *pdev) · 501 unmodified lines
3288	3287
3289	3288	pci_iounmap(pdev, vp->ioaddr);
3290	3289
3291		− pci_free_consistent(pdev,
3292		− sizeof(struct boom_rx_desc) * RX_RING_SIZE
3293		− + sizeof(struct boom_tx_desc) * TX_RING_SIZE,
3294		− vp->rx_ring,
3295		− vp->rx_ring_dma);
	3290	+ dma_free_coherent(&pdev->dev,
	3291	+ sizeof(struct boom_rx_desc) * RX_RING_SIZE +
	3292	+ sizeof(struct boom_tx_desc) * TX_RING_SIZE,
	3293	+ vp->rx_ring, vp->rx_ring_dma);
3296	3294
3297	3295	pci_release_regions(pdev);
3298	3296

drivers/net/ethernet/8390/ne.c+3−1

@@ -164,7 +164,9 @@ bad_clone_list[] __initdata = { · 163 unmodified lines
164	164	#define NESM_START_PG 0x40 /* First page of TX buffer */
165	165	#define NESM_STOP_PG 0x80 /* Last page +1 of RX ring */
166	166
167		−#if defined(CONFIG_ATARI) /* 8-bit mode on Atari, normal on Q40 */
	167	+#if defined(CONFIG_MACH_TX49XX)
	168	+# define DCR_VAL 0x48 /* 8-bit mode */
	169	+#elif defined(CONFIG_ATARI) /* 8-bit mode on Atari, normal on Q40 */
168	170	# define DCR_VAL (MACH_IS_ATARI ? 0x48 : 0x49)
169	171	#else
170	172	# define DCR_VAL 0x49

drivers/net/ethernet/chelsio/cxgb4/cudbg_entity.h+9−19

@@ -419,15 +419,15 @@ static const u32 t6_up_cim_reg_array[][IREG_NUM_ELEM + 1] = { · 418 unmodified lines
419	419	{0x7b50, 0x7b54, 0x280, 0x20, 0}, /* up_cim_280_to_2fc */
420	420	{0x7b50, 0x7b54, 0x300, 0x20, 0}, /* up_cim_300_to_37c */
421	421	{0x7b50, 0x7b54, 0x380, 0x14, 0}, /* up_cim_380_to_3cc */
422		− {0x7b50, 0x7b54, 0x2900, 0x4, 0x4}, /* up_cim_2900_to_3d40 */
423		− {0x7b50, 0x7b54, 0x2904, 0x4, 0x4}, /* up_cim_2904_to_3d44 */
424		− {0x7b50, 0x7b54, 0x2908, 0x4, 0x4}, /* up_cim_2908_to_3d48 */
425		− {0x7b50, 0x7b54, 0x2910, 0x4, 0x4}, /* up_cim_2910_to_3d4c */
426		− {0x7b50, 0x7b54, 0x2914, 0x4, 0x4}, /* up_cim_2914_to_3d50 */
427		− {0x7b50, 0x7b54, 0x2920, 0x10, 0x10}, /* up_cim_2920_to_2a10 */
428		− {0x7b50, 0x7b54, 0x2924, 0x10, 0x10}, /* up_cim_2924_to_2a14 */
429		− {0x7b50, 0x7b54, 0x2928, 0x10, 0x10}, /* up_cim_2928_to_2a18 */
430		− {0x7b50, 0x7b54, 0x292c, 0x10, 0x10}, /* up_cim_292c_to_2a1c */
	422	+ {0x7b50, 0x7b54, 0x4900, 0x4, 0x4}, /* up_cim_4900_to_4c60 */
	423	+ {0x7b50, 0x7b54, 0x4904, 0x4, 0x4}, /* up_cim_4904_to_4c64 */
	424	+ {0x7b50, 0x7b54, 0x4908, 0x4, 0x4}, /* up_cim_4908_to_4c68 */
	425	+ {0x7b50, 0x7b54, 0x4910, 0x4, 0x4}, /* up_cim_4910_to_4c70 */
	426	+ {0x7b50, 0x7b54, 0x4914, 0x4, 0x4}, /* up_cim_4914_to_4c74 */
	427	+ {0x7b50, 0x7b54, 0x4920, 0x10, 0x10}, /* up_cim_4920_to_4a10 */
	428	+ {0x7b50, 0x7b54, 0x4924, 0x10, 0x10}, /* up_cim_4924_to_4a14 */
	429	+ {0x7b50, 0x7b54, 0x4928, 0x10, 0x10}, /* up_cim_4928_to_4a18 */
	430	+ {0x7b50, 0x7b54, 0x492c, 0x10, 0x10}, /* up_cim_492c_to_4a1c */
431	431	};
432	432
433	433	static const u32 t5_up_cim_reg_array[][IREG_NUM_ELEM + 1] = {
@@ -444,16 +444,6 @@ static const u32 t5_up_cim_reg_array[][IREG_NUM_ELEM + 1] = { · 10 unmodified lines
444	444	{0x7b50, 0x7b54, 0x280, 0x20, 0}, /* up_cim_280_to_2fc */
445	445	{0x7b50, 0x7b54, 0x300, 0x20, 0}, /* up_cim_300_to_37c */
446	446	{0x7b50, 0x7b54, 0x380, 0x14, 0}, /* up_cim_380_to_3cc */
447		− {0x7b50, 0x7b54, 0x2900, 0x4, 0x4}, /* up_cim_2900_to_3d40 */
448		− {0x7b50, 0x7b54, 0x2904, 0x4, 0x4}, /* up_cim_2904_to_3d44 */
449		− {0x7b50, 0x7b54, 0x2908, 0x4, 0x4}, /* up_cim_2908_to_3d48 */
450		− {0x7b50, 0x7b54, 0x2910, 0x4, 0x4}, /* up_cim_2910_to_3d4c */
451		− {0x7b50, 0x7b54, 0x2914, 0x4, 0x4}, /* up_cim_2914_to_3d50 */
452		− {0x7b50, 0x7b54, 0x2918, 0x4, 0x4}, /* up_cim_2918_to_3d54 */
453		− {0x7b50, 0x7b54, 0x291c, 0x4, 0x4}, /* up_cim_291c_to_3d58 */
454		− {0x7b50, 0x7b54, 0x2924, 0x10, 0x10}, /* up_cim_2924_to_2914 */
455		− {0x7b50, 0x7b54, 0x2928, 0x10, 0x10}, /* up_cim_2928_to_2a18 */
456		− {0x7b50, 0x7b54, 0x292c, 0x10, 0x10}, /* up_cim_292c_to_2a1c */
457	447	};
458	448
459	449	static const u32 t6_hma_ireg_array[][IREG_NUM_ELEM] = {

drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c+30−58

@@ -836,7 +836,7 @@ bool is_filter_exact_match(struct adapter *adap, · 835 unmodified lines
836	836	{
837	837	struct tp_params *tp = &adap->params.tp;
838	838	u64 hash_filter_mask = tp->hash_filter_mask;
839		− u32 mask;
	839	+ u64 ntuple_mask = 0;
840	840
841	841	if (!is_hashfilter(adap))
842	842	return false;
@@ -865,73 +865,45 @@ bool is_filter_exact_match(struct adapter *adap, · 22 unmodified lines
865	865	if (!fs->val.fport \|\| fs->mask.fport != 0xffff)
866	866	return false;
867	867
868		− if (tp->fcoe_shift >= 0) {
869		− mask = (hash_filter_mask >> tp->fcoe_shift) & FT_FCOE_W;
870		− if (mask && !fs->mask.fcoe)
871		− return false;
872		− }
	868	+ /* calculate tuple mask and compare with mask configured in hw */
	869	+ if (tp->fcoe_shift >= 0)
	870	+ ntuple_mask \|= (u64)fs->mask.fcoe << tp->fcoe_shift;
873	871
874		− if (tp->port_shift >= 0) {
875		− mask = (hash_filter_mask >> tp->port_shift) & FT_PORT_W;
876		− if (mask && !fs->mask.iport)
877		− return false;
878		− }
	872	+ if (tp->port_shift >= 0)
	873	+ ntuple_mask \|= (u64)fs->mask.iport << tp->port_shift;
879	874
880	875	if (tp->vnic_shift >= 0) {
881		− mask = (hash_filter_mask >> tp->vnic_shift) & FT_VNIC_ID_W;
882		−
883		− if ((adap->params.tp.ingress_config & VNIC_F)) {
884		− if (mask && !fs->mask.pfvf_vld)
885		− return false;
886		− } else {
887		− if (mask && !fs->mask.ovlan_vld)
888		− return false;
889		− }
	876	+ if ((adap->params.tp.ingress_config & VNIC_F))
	877	+ ntuple_mask \|= (u64)fs->mask.pfvf_vld << tp->vnic_shift;
	878	+ else
	879	+ ntuple_mask \|= (u64)fs->mask.ovlan_vld <<
	880	+ tp->vnic_shift;
890	881	}
891	882
892		− if (tp->vlan_shift >= 0) {
893		− mask = (hash_filter_mask >> tp->vlan_shift) & FT_VLAN_W;
894		− if (mask && !fs->mask.ivlan)
895		− return false;
896		− }
	883	+ if (tp->vlan_shift >= 0)
	884	+ ntuple_mask \|= (u64)fs->mask.ivlan << tp->vlan_shift;
897	885
898		− if (tp->tos_shift >= 0) {
899		− mask = (hash_filter_mask >> tp->tos_shift) & FT_TOS_W;
900		− if (mask && !fs->mask.tos)
901		− return false;
902		− }
	886	+ if (tp->tos_shift >= 0)
	887	+ ntuple_mask \|= (u64)fs->mask.tos << tp->tos_shift;
903	888
904		− if (tp->protocol_shift >= 0) {
905		− mask = (hash_filter_mask >> tp->protocol_shift) & FT_PROTOCOL_W;
906		− if (mask && !fs->mask.proto)
907		− return false;
908		− }
	889	+ if (tp->protocol_shift >= 0)
	890	+ ntuple_mask \|= (u64)fs->mask.proto << tp->protocol_shift;
909	891
910		− if (tp->ethertype_shift >= 0) {
911		− mask = (hash_filter_mask >> tp->ethertype_shift) &
912		− FT_ETHERTYPE_W;
913		− if (mask && !fs->mask.ethtype)
914		− return false;
915		− }
	892	+ if (tp->ethertype_shift >= 0)
	893	+ ntuple_mask \|= (u64)fs->mask.ethtype << tp->ethertype_shift;
916	894
917		− if (tp->macmatch_shift >= 0) {
918		− mask = (hash_filter_mask >> tp->macmatch_shift) & FT_MACMATCH_W;
919		− if (mask && !fs->mask.macidx)
920		− return false;
921		− }
	895	+ if (tp->macmatch_shift >= 0)
	896	+ ntuple_mask \|= (u64)fs->mask.macidx << tp->macmatch_shift;
	897	+
	898	+ if (tp->matchtype_shift >= 0)
	899	+ ntuple_mask \|= (u64)fs->mask.matchtype << tp->matchtype_shift;
	900	+
	901	+ if (tp->frag_shift >= 0)
	902	+ ntuple_mask \|= (u64)fs->mask.frag << tp->frag_shift;
	903	+
	904	+ if (ntuple_mask != hash_filter_mask)
	905	+ return false;
922	906
923		− if (tp->matchtype_shift >= 0) {
924		− mask = (hash_filter_mask >> tp->matchtype_shift) &
925		− FT_MPSHITTYPE_W;
926		− if (mask && !fs->mask.matchtype)
927		− return false;
928		− }
929		− if (tp->frag_shift >= 0) {
930		− mask = (hash_filter_mask >> tp->frag_shift) &
931		− FT_FRAGMENTATION_W;
932		− if (mask && !fs->mask.frag)
933		− return false;
934		− }
935	907	return true;
936	908	}
937	909

drivers/net/ethernet/ibm/ibmvnic.c+17−11

@@ -192,6 +192,7 @@ static int alloc_long_term_buff(struct ibmvnic_adapter *adapter, · 191 unmodified lines
192	192	if (adapter->fw_done_rc) {
193	193	dev_err(dev, "Couldn't map long term buffer,rc = %d\n",
194	194	adapter->fw_done_rc);
	195	+ dma_free_coherent(dev, ltb->size, ltb->buff, ltb->addr);
195	196	return -1;
196	197	}
197	198	return 0;
@@ -1821,9 +1822,8 @@ static int do_reset(struct ibmvnic_adapter *adapter, · 1623 unmodified lines
1821	1822	if (rc)
1822	1823	return rc;
1823	1824	}
	1825	+ ibmvnic_disable_irqs(adapter);
1824	1826	}
1825		−
1826		− ibmvnic_disable_irqs(adapter);
1827	1827	adapter->state = VNIC_CLOSED;
1828	1828
1829	1829	if (reset_state == VNIC_CLOSED)
@@ -4586,14 +4586,6 @@ static int ibmvnic_init(struct ibmvnic_adapter *adapter) · 2756 unmodified lines
4586	4586	release_crq_queue(adapter);
4587	4587	}
4588	4588
4589		− rc = init_stats_buffers(adapter);
4590		− if (rc)
4591		− return rc;
4592		−
4593		− rc = init_stats_token(adapter);
4594		− if (rc)
4595		− return rc;
4596		−
4597	4589	return rc;
4598	4590	}
4599	4591
@@ -4662,13 +4654,21 @@ static int ibmvnic_probe(struct vio_dev dev, const struct vio_device_id id) · 62 unmodified lines
4662	4654	goto ibmvnic_init_fail;
4663	4655	} while (rc == EAGAIN);
4664	4656
	4657	+ rc = init_stats_buffers(adapter);
	4658	+ if (rc)
	4659	+ goto ibmvnic_init_fail;
	4660	+
	4661	+ rc = init_stats_token(adapter);
	4662	+ if (rc)
	4663	+ goto ibmvnic_stats_fail;
	4664	+
4665	4665	netdev->mtu = adapter->req_mtu - ETH_HLEN;
4666	4666	netdev->min_mtu = adapter->min_mtu - ETH_HLEN;
4667	4667	netdev->max_mtu = adapter->max_mtu - ETH_HLEN;
4668	4668
4669	4669	rc = device_create_file(&dev->dev, &dev_attr_failover);
4670	4670	if (rc)
4671		− goto ibmvnic_init_fail;
	4671	+ goto ibmvnic_dev_file_err;
4672	4672
4673	4673	netif_carrier_off(netdev);
4674	4674	rc = register_netdev(netdev);
@@ -4687,6 +4687,12 @@ static int ibmvnic_probe(struct vio_dev dev, const struct vio_device_id id) · 12 unmodified lines
4687	4687	ibmvnic_register_fail:
4688	4688	device_remove_file(&dev->dev, &dev_attr_failover);
4689	4689
	4690	+ibmvnic_dev_file_err:
	4691	+ release_stats_token(adapter);
	4692	+
	4693	+ibmvnic_stats_fail:
	4694	+ release_stats_buffers(adapter);
	4695	+
4690	4696	ibmvnic_init_fail:
4691	4697	release_sub_crqs(adapter, 1);
4692	4698	release_crq_queue(adapter);

drivers/net/ethernet/mellanox/mlx4/main.c+3−1

@@ -2929,6 +2929,7 @@ static int mlx4_init_port_info(struct mlx4_dev *dev, int port) · 2928 unmodified lines
2929	2929	mlx4_err(dev, "Failed to create file for port %d\n", port);
2930	2930	devlink_port_unregister(&info->devlink_port);
2931	2931	info->port = -1;
	2932	+ return err;
2932	2933	}
2933	2934
2934	2935	sprintf(info->dev_mtu_name, "mlx4_port%d_mtu", port);
@@ -2950,9 +2951,10 @@ static int mlx4_init_port_info(struct mlx4_dev *dev, int port) · 15 unmodified lines
2950	2951	&info->port_attr);
2951	2952	devlink_port_unregister(&info->devlink_port);
2952	2953	info->port = -1;
	2954	+ return err;
2953	2955	}
2954	2956
2955		− return err;
	2957	+ return 0;
2956	2958	}
2957	2959
2958	2960	static void mlx4_cleanup_port_info(struct mlx4_port_info *info)

drivers/net/ethernet/netronome/nfp/bpf/main.c+1−1

@@ -335,7 +335,7 @@ static int nfp_bpf_parse_capabilities(struct nfp_app *app) · 334 unmodified lines
335	335	return PTR_ERR(mem) == -ENOENT ? 0 : PTR_ERR(mem);
336	336
337	337	start = mem;
338		− while (mem - start + 8 < nfp_cpp_area_size(area)) {
	338	+ while (mem - start + 8 <= nfp_cpp_area_size(area)) {
339	339	u8 __iomem *value;
340	340	u32 type, length;
341	341

drivers/net/ethernet/qlogic/qed/qed_ll2.c+50−11

@@ -292,6 +292,7 @@ static void qed_ll2_txq_flush(struct qed_hwfn *p_hwfn, u8 connection_handle) · 291 unmodified lines
292	292	struct qed_ll2_tx_packet *p_pkt = NULL;
293	293	struct qed_ll2_info *p_ll2_conn;
294	294	struct qed_ll2_tx_queue *p_tx;
	295	+ unsigned long flags = 0;
295	296	dma_addr_t tx_frag;
296	297
297	298	p_ll2_conn = qed_ll2_handle_sanity_inactive(p_hwfn, connection_handle);
@@ -300,6 +301,7 @@ static void qed_ll2_txq_flush(struct qed_hwfn *p_hwfn, u8 connection_handle) · 2 unmodified lines
300	301
301	302	p_tx = &p_ll2_conn->tx_queue;
302	303
	304	+ spin_lock_irqsave(&p_tx->lock, flags);
303	305	while (!list_empty(&p_tx->active_descq)) {
304	306	p_pkt = list_first_entry(&p_tx->active_descq,
305	307	struct qed_ll2_tx_packet, list_entry);
@@ -309,6 +311,7 @@ static void qed_ll2_txq_flush(struct qed_hwfn *p_hwfn, u8 connection_handle) · 3 unmodified lines
309	311	list_del(&p_pkt->list_entry);
310	312	b_last_packet = list_empty(&p_tx->active_descq);
311	313	list_add_tail(&p_pkt->list_entry, &p_tx->free_descq);
	314	+ spin_unlock_irqrestore(&p_tx->lock, flags);
312	315	if (p_ll2_conn->input.conn_type == QED_LL2_TYPE_OOO) {
313	316	struct qed_ooo_buffer *p_buffer;
314	317
@@ -328,7 +331,9 @@ static void qed_ll2_txq_flush(struct qed_hwfn *p_hwfn, u8 connection_handle) · 13 unmodified lines
328	331	b_last_frag,
329	332	b_last_packet);
330	333	}
	334	+ spin_lock_irqsave(&p_tx->lock, flags);
331	335	}
	336	+ spin_unlock_irqrestore(&p_tx->lock, flags);
332	337	}
333	338
334	339	static int qed_ll2_txq_completion(struct qed_hwfn p_hwfn, void p_cookie)
@@ -556,6 +561,7 @@ static void qed_ll2_rxq_flush(struct qed_hwfn *p_hwfn, u8 connection_handle) · 221 unmodified lines
556	561	struct qed_ll2_info *p_ll2_conn = NULL;
557	562	struct qed_ll2_rx_packet *p_pkt = NULL;
558	563	struct qed_ll2_rx_queue *p_rx;
	564	+ unsigned long flags = 0;
559	565
560	566	p_ll2_conn = qed_ll2_handle_sanity_inactive(p_hwfn, connection_handle);
561	567	if (!p_ll2_conn)
@@ -563,13 +569,14 @@ static void qed_ll2_rxq_flush(struct qed_hwfn *p_hwfn, u8 connection_handle) · 1 unmodified line
563	569
564	570	p_rx = &p_ll2_conn->rx_queue;
565	571
	572	+ spin_lock_irqsave(&p_rx->lock, flags);
566	573	while (!list_empty(&p_rx->active_descq)) {
567	574	p_pkt = list_first_entry(&p_rx->active_descq,
568	575	struct qed_ll2_rx_packet, list_entry);
569	576	if (!p_pkt)
570	577	break;
571		−
572	578	list_move_tail(&p_pkt->list_entry, &p_rx->free_descq);
	579	+ spin_unlock_irqrestore(&p_rx->lock, flags);
573	580
574	581	if (p_ll2_conn->input.conn_type == QED_LL2_TYPE_OOO) {
575	582	struct qed_ooo_buffer *p_buffer;
@@ -588,7 +595,30 @@ static void qed_ll2_rxq_flush(struct qed_hwfn *p_hwfn, u8 connection_handle) · 12 unmodified lines
588	595	cookie,
589	596	rx_buf_addr, b_last);
590	597	}
	598	+ spin_lock_irqsave(&p_rx->lock, flags);
591	599	}
	600	+ spin_unlock_irqrestore(&p_rx->lock, flags);
	601	+}
	602	+
	603	+static bool
	604	+qed_ll2_lb_rxq_handler_slowpath(struct qed_hwfn *p_hwfn,
	605	+ struct core_rx_slow_path_cqe *p_cqe)
	606	+{
	607	+ struct ooo_opaque *iscsi_ooo;
	608	+ u32 cid;
	609	+
	610	+ if (p_cqe->ramrod_cmd_id != CORE_RAMROD_RX_QUEUE_FLUSH)
	611	+ return false;
	612	+
	613	+ iscsi_ooo = (struct ooo_opaque *)&p_cqe->opaque_data;
	614	+ if (iscsi_ooo->ooo_opcode != TCP_EVENT_DELETE_ISLES)
	615	+ return false;
	616	+
	617	+ /* Need to make a flush */
	618	+ cid = le32_to_cpu(iscsi_ooo->cid);
	619	+ qed_ooo_release_connection_isles(p_hwfn, p_hwfn->p_ooo_info, cid);
	620	+
	621	+ return true;
592	622	}
593	623
594	624	static int qed_ll2_lb_rxq_handler(struct qed_hwfn *p_hwfn,
@@ -617,6 +647,11 @@ static int qed_ll2_lb_rxq_handler(struct qed_hwfn *p_hwfn, · 22 unmodified lines
617	647	cq_old_idx = qed_chain_get_cons_idx(&p_rx->rcq_chain);
618	648	cqe_type = cqe->rx_cqe_sp.type;
619	649
	650	+ if (cqe_type == CORE_RX_CQE_TYPE_SLOW_PATH)
	651	+ if (qed_ll2_lb_rxq_handler_slowpath(p_hwfn,
	652	+ &cqe->rx_cqe_sp))
	653	+ continue;
	654	+
620	655	if (cqe_type != CORE_RX_CQE_TYPE_REGULAR) {
621	656	DP_NOTICE(p_hwfn,
622	657	"Got a non-regular LB LL2 completion [type 0x%02x]\n",
@@ -794,6 +829,9 @@ static int qed_ll2_lb_rxq_completion(struct qed_hwfn p_hwfn, void p_cookie) · 171 unmodified lines
794	829	struct qed_ll2_info p_ll2_conn = (struct qed_ll2_info )p_cookie;
795	830	int rc;
796	831
	832	+ if (!QED_LL2_RX_REGISTERED(p_ll2_conn))
	833	+ return 0;
	834	+
797	835	rc = qed_ll2_lb_rxq_handler(p_hwfn, p_ll2_conn);
798	836	if (rc)
799	837	return rc;
@@ -814,6 +852,9 @@ static int qed_ll2_lb_txq_completion(struct qed_hwfn p_hwfn, void p_cookie) · 14 unmodified lines
814	852	u16 new_idx = 0, num_bds = 0;
815	853	int rc;
816	854
	855	+ if (!QED_LL2_TX_REGISTERED(p_ll2_conn))
	856	+ return 0;
	857	+
817	858	new_idx = le16_to_cpu(*p_tx->p_fw_cons);
818	859	num_bds = ((s16)new_idx - (s16)p_tx->bds_idx);
819	860
@@ -1867,17 +1908,25 @@ int qed_ll2_terminate_connection(void *cxt, u8 connection_handle) · 1047 unmodified lines
1867	1908
1868	1909	/* Stop Tx & Rx of connection, if needed */
1869	1910	if (QED_LL2_TX_REGISTERED(p_ll2_conn)) {
	1911	+ p_ll2_conn->tx_queue.b_cb_registred = false;
	1912	+ smp_wmb(); /* Make sure this is seen by ll2_lb_rxq_completion */
1870	1913	rc = qed_sp_ll2_tx_queue_stop(p_hwfn, p_ll2_conn);
1871	1914	if (rc)
1872	1915	goto out;
	1916	+
1873	1917	qed_ll2_txq_flush(p_hwfn, connection_handle);
	1918	+ qed_int_unregister_cb(p_hwfn, p_ll2_conn->tx_queue.tx_sb_index);
1874	1919	}
1875	1920
1876	1921	if (QED_LL2_RX_REGISTERED(p_ll2_conn)) {
	1922	+ p_ll2_conn->rx_queue.b_cb_registred = false;
	1923	+ smp_wmb(); /* Make sure this is seen by ll2_lb_rxq_completion */
1877	1924	rc = qed_sp_ll2_rx_queue_stop(p_hwfn, p_ll2_conn);
1878	1925	if (rc)
1879	1926	goto out;
	1927	+
1880	1928	qed_ll2_rxq_flush(p_hwfn, connection_handle);
	1929	+ qed_int_unregister_cb(p_hwfn, p_ll2_conn->rx_queue.rx_sb_index);
1881	1930	}
1882	1931
1883	1932	if (p_ll2_conn->input.conn_type == QED_LL2_TYPE_OOO)
@@ -1925,16 +1974,6 @@ void qed_ll2_release_connection(void *cxt, u8 connection_handle) · 41 unmodified lines
1925	1974	if (!p_ll2_conn)
1926	1975	return;
1927	1976
1928		− if (QED_LL2_RX_REGISTERED(p_ll2_conn)) {
1929		− p_ll2_conn->rx_queue.b_cb_registred = false;
1930		− qed_int_unregister_cb(p_hwfn, p_ll2_conn->rx_queue.rx_sb_index);
1931		− }
1932		−
1933		− if (QED_LL2_TX_REGISTERED(p_ll2_conn)) {
1934		− p_ll2_conn->tx_queue.b_cb_registred = false;
1935		− qed_int_unregister_cb(p_hwfn, p_ll2_conn->tx_queue.tx_sb_index);
1936		− }
1937		−
1938	1977	kfree(p_ll2_conn->tx_queue.descq_mem);
1939	1978	qed_chain_free(p_hwfn->cdev, &p_ll2_conn->tx_queue.txq_chain);
1940	1979

drivers/net/ethernet/qlogic/qede/qede_main.c+1−2

@@ -1066,13 +1066,12 @@ static void __qede_remove(struct pci_dev *pdev, enum qede_remove_mode mode) · 1065 unmodified lines
1066	1066
1067	1067	DP_INFO(edev, "Starting qede_remove\n");
1068	1068
	1069	+ qede_rdma_dev_remove(edev);
1069	1070	unregister_netdev(ndev);
1070	1071	cancel_delayed_work_sync(&edev->sp_task);
1071	1072
1072	1073	qede_ptp_disable(edev);
1073	1074
1074		− qede_rdma_dev_remove(edev);
1075		−
1076	1075	edev->ops->common->set_power_state(cdev, PCI_D0);
1077	1076
1078	1077	pci_set_drvdata(pdev, NULL);

drivers/net/ethernet/renesas/sh_eth.h+1−1

@@ -163,7 +163,7 @@ enum { · 162 unmodified lines
163	163	};
164	164
165	165	/* Driver's parameters */
166		−#if defined(CONFIG_CPU_SH4) \|\| defined(CONFIG_ARCH_SHMOBILE)
	166	+#if defined(CONFIG_CPU_SH4) \|\| defined(CONFIG_ARCH_RENESAS)
167	167	#define SH_ETH_RX_ALIGN 32
168	168	#else
169	169	#define SH_ETH_RX_ALIGN 2

drivers/net/ipvlan/ipvlan_main.c+3−1

@@ -792,8 +792,10 @@ static int ipvlan_device_event(struct notifier_block *unused, · 791 unmodified lines
792	792	break;
793	793
794	794	case NETDEV_CHANGEADDR:
795		− list_for_each_entry(ipvlan, &port->ipvlans, pnode)
	795	+ list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
796	796	ether_addr_copy(ipvlan->dev->dev_addr, dev->dev_addr);
	797	+ call_netdevice_notifiers(NETDEV_CHANGEADDR, ipvlan->dev);
	798	+ }
797	799	break;
798	800
799	801	case NETDEV_PRE_TYPE_CHANGE:

drivers/net/phy/micrel.c+31−0

@@ -573,9 +573,40 @@ static int ksz9031_config_init(struct phy_device *phydev) · 572 unmodified lines
573	573	ksz9031_of_load_skew_values(phydev, of_node,
574	574	MII_KSZ9031RN_TX_DATA_PAD_SKEW, 4,
575	575	tx_data_skews, 4);
	576	+
	577	+ /* Silicon Errata Sheet (DS80000691D or DS80000692D):
	578	+ * When the device links in the 1000BASE-T slave mode only,
	579	+ * the optional 125MHz reference output clock (CLK125_NDO)
	580	+ * has wide duty cycle variation.
	581	+ *
	582	+ * The optional CLK125_NDO clock does not meet the RGMII
	583	+ * 45/55 percent (min/max) duty cycle requirement and therefore
	584	+ * cannot be used directly by the MAC side for clocking
	585	+ * applications that have setup/hold time requirements on
	586	+ * rising and falling clock edges.
	587	+ *
	588	+ * Workaround:
	589	+ * Force the phy to be the master to receive a stable clock
	590	+ * which meets the duty cycle requirement.
	591	+ */
	592	+ if (of_property_read_bool(of_node, "micrel,force-master")) {
	593	+ result = phy_read(phydev, MII_CTRL1000);
	594	+ if (result < 0)
	595	+ goto err_force_master;
	596	+
	597	+ /* enable master mode, config & prefer master */
	598	+ result \|= CTL1000_ENABLE_MASTER \| CTL1000_AS_MASTER;
	599	+ result = phy_write(phydev, MII_CTRL1000, result);
	600	+ if (result < 0)
	601	+ goto err_force_master;
	602	+ }
576	603	}
577	604
578	605	return ksz9031_center_flp_timing(phydev);
	606	+
	607	+err_force_master:
	608	+ phydev_err(phydev, "failed to force the phy to master mode\n");
	609	+ return result;
579	610	}
580	611
581	612	#define KSZ8873MLL_GLOBAL_CONTROL_4 0x06

drivers/net/tun.c+12−15

@@ -681,15 +681,6 @@ static void tun_queue_purge(struct tun_file *tfile) · 680 unmodified lines
681	681	skb_queue_purge(&tfile->sk.sk_error_queue);
682	682	}
683	683
684		−static void tun_cleanup_tx_ring(struct tun_file *tfile)
685		−{
686		− if (tfile->tx_ring.queue) {
687		− ptr_ring_cleanup(&tfile->tx_ring, tun_ptr_free);
688		− xdp_rxq_info_unreg(&tfile->xdp_rxq);
689		− memset(&tfile->tx_ring, 0, sizeof(tfile->tx_ring));
690		− }
691		−}
692		−
693	684	static void __tun_detach(struct tun_file *tfile, bool clean)
694	685	{
695	686	struct tun_file *ntfile;
@@ -736,7 +727,9 @@ static void __tun_detach(struct tun_file *tfile, bool clean) · 40 unmodified lines
736	727	tun->dev->reg_state == NETREG_REGISTERED)
737	728	unregister_netdevice(tun->dev);
738	729	}
739		− tun_cleanup_tx_ring(tfile);
	730	+ if (tun)
	731	+ xdp_rxq_info_unreg(&tfile->xdp_rxq);
	732	+ ptr_ring_cleanup(&tfile->tx_ring, tun_ptr_free);
740	733	sock_put(&tfile->sk);
741	734	}
742	735	}
@@ -783,14 +776,14 @@ static void tun_detach_all(struct net_device *dev) · 40 unmodified lines
783	776	tun_napi_del(tun, tfile);
784	777	/* Drop read queue */
785	778	tun_queue_purge(tfile);
	779	+ xdp_rxq_info_unreg(&tfile->xdp_rxq);
786	780	sock_put(&tfile->sk);
787		− tun_cleanup_tx_ring(tfile);
788	781	}
789	782	list_for_each_entry_safe(tfile, tmp, &tun->disabled, next) {
790	783	tun_enable_queue(tfile);
791	784	tun_queue_purge(tfile);
	785	+ xdp_rxq_info_unreg(&tfile->xdp_rxq);
792	786	sock_put(&tfile->sk);
793		− tun_cleanup_tx_ring(tfile);
794	787	}
795	788	BUG_ON(tun->numdisabled != 0);
796	789
@@ -834,7 +827,8 @@ static int tun_attach(struct tun_struct tun, struct file file, · 37 unmodified lines
834	827	}
835	828
836	829	if (!tfile->detached &&
837		− ptr_ring_init(&tfile->tx_ring, dev->tx_queue_len, GFP_KERNEL)) {
	830	+ ptr_ring_resize(&tfile->tx_ring, dev->tx_queue_len,
	831	+ GFP_KERNEL, tun_ptr_free)) {
838	832	err = -ENOMEM;
839	833	goto out;
840	834	}
@@ -3219,6 +3213,11 @@ static int tun_chr_open(struct inode inode, struct file file) · 2378 unmodified lines
3219	3213	&tun_proto, 0);
3220	3214	if (!tfile)
3221	3215	return -ENOMEM;
	3216	+ if (ptr_ring_init(&tfile->tx_ring, 0, GFP_KERNEL)) {
	3217	+ sk_free(&tfile->sk);
	3218	+ return -ENOMEM;
	3219	+ }
	3220	+
3222	3221	RCU_INIT_POINTER(tfile->tun, NULL);
3223	3222	tfile->flags = 0;
3224	3223	tfile->ifindex = 0;
@@ -3239,8 +3238,6 @@ static int tun_chr_open(struct inode inode, struct file file) · 14 unmodified lines
3239	3238
3240	3239	sock_set_flag(&tfile->sk, SOCK_ZEROCOPY);
3241	3240
3242		− memset(&tfile->tx_ring, 0, sizeof(tfile->tx_ring));
3243		−
3244	3241	return 0;
3245	3242	}
3246	3243

drivers/net/vmxnet3/vmxnet3_drv.c+47−25

@@ -369,6 +369,11 @@ vmxnet3_tq_tx_complete(struct vmxnet3_tx_queue *tq, · 368 unmodified lines
369	369
370	370	gdesc = tq->comp_ring.base + tq->comp_ring.next2proc;
371	371	while (VMXNET3_TCD_GET_GEN(&gdesc->tcd) == tq->comp_ring.gen) {
	372	+ /* Prevent any &gdesc->tcd field from being (speculatively)
	373	+ * read before (&gdesc->tcd)->gen is read.
	374	+ */
	375	+ dma_rmb();
	376	+
372	377	completed += vmxnet3_unmap_pkt(VMXNET3_TCD_GET_TXIDX(
373	378	&gdesc->tcd), tq, adapter->pdev,
374	379	adapter);
@@ -1103,6 +1108,11 @@ vmxnet3_tq_xmit(struct sk_buff skb, struct vmxnet3_tx_queue tq, · 728 unmodified lines
1103	1108	gdesc->txd.tci = skb_vlan_tag_get(skb);
1104	1109	}
1105	1110
	1111	+ /* Ensure that the write to (&gdesc->txd)->gen will be observed after
	1112	+ * all other writes to &gdesc->txd.
	1113	+ */
	1114	+ dma_wmb();
	1115	+
1106	1116	/* finally flips the GEN bit of the SOP desc. */
1107	1117	gdesc->dword[2] = cpu_to_le32(le32_to_cpu(gdesc->dword[2]) ^
1108	1118	VMXNET3_TXD_GEN);
@@ -1298,6 +1308,12 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq, · 189 unmodified lines
1298	1308	*/
1299	1309	break;
1300	1310	}
	1311	+
	1312	+ /* Prevent any rcd field from being (speculatively) read before
	1313	+ * rcd->gen is read.
	1314	+ */
	1315	+ dma_rmb();
	1316	+
1301	1317	BUG_ON(rcd->rqID != rq->qid && rcd->rqID != rq->qid2 &&
1302	1318	rcd->rqID != rq->dataRingQid);
1303	1319	idx = rcd->rxdIdx;
@@ -1528,6 +1544,12 @@ rcd_done: · 224 unmodified lines
1528	1544	ring->next2comp = idx;
1529	1545	num_to_alloc = vmxnet3_cmd_ring_desc_avail(ring);
1530	1546	ring = rq->rx_ring + ring_idx;
	1547	+
	1548	+ /* Ensure that the writes to rxd->gen bits will be observed
	1549	+ * after all other writes to rxd objects.
	1550	+ */
	1551	+ dma_wmb();
	1552	+
1531	1553	while (num_to_alloc) {
1532	1554	vmxnet3_getRxDesc(rxd, &ring->base[ring->next2fill].rxd,
1533	1555	&rxCmdDesc);
@@ -2688,7 +2710,7 @@ vmxnet3_set_mac_addr(struct net_device netdev, void p) · 1154 unmodified lines
2688	2710	/* ==================== initialization and cleanup routines ============ */
2689	2711
2690	2712	static int
2691		−vmxnet3_alloc_pci_resources(struct vmxnet3_adapter adapter, bool dma64)
	2713	+vmxnet3_alloc_pci_resources(struct vmxnet3_adapter *adapter)
2692	2714	{
2693	2715	int err;
2694	2716	unsigned long mmio_start, mmio_len;
@@ -2700,30 +2722,12 @@ vmxnet3_alloc_pci_resources(struct vmxnet3_adapter adapter, bool dma64) · 5 unmodified lines
2700	2722	return err;
2701	2723	}
2702	2724
2703		− if (pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) == 0) {
2704		− if (pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)) != 0) {
2705		− dev_err(&pdev->dev,
2706		− "pci_set_consistent_dma_mask failed\n");
2707		− err = -EIO;
2708		− goto err_set_mask;
2709		− }
2710		− *dma64 = true;
2711		− } else {
2712		− if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32)) != 0) {
2713		− dev_err(&pdev->dev,
2714		− "pci_set_dma_mask failed\n");
2715		− err = -EIO;
2716		− goto err_set_mask;
2717		− }
2718		− *dma64 = false;
2719		− }
2720		−
2721	2725	err = pci_request_selected_regions(pdev, (1 << 2) - 1,
2722	2726	vmxnet3_driver_name);
2723	2727	if (err) {
2724	2728	dev_err(&pdev->dev,
2725	2729	"Failed to request region for adapter: error %d\n", err);
2726		− goto err_set_mask;
	2730	+ goto err_enable_device;
2727	2731	}
2728	2732
2729	2733	pci_set_master(pdev);
@@ -2751,7 +2755,7 @@ err_bar1: · 21 unmodified lines
2751	2755	iounmap(adapter->hw_addr0);
2752	2756	err_ioremap:
2753	2757	pci_release_selected_regions(pdev, (1 << 2) - 1);
2754		−err_set_mask:
	2758	+err_enable_device:
2755	2759	pci_disable_device(pdev);
2756	2760	return err;
2757	2761	}
@@ -3254,7 +3258,7 @@ vmxnet3_probe_device(struct pci_dev *pdev, · 496 unmodified lines
3254	3258	#endif
3255	3259	};
3256	3260	int err;
3257		− bool dma64 = false; /* stupid gcc */
	3261	+ bool dma64;
3258	3262	u32 ver;
3259	3263	struct net_device *netdev;
3260	3264	struct vmxnet3_adapter *adapter;
@@ -3300,6 +3304,24 @@ vmxnet3_probe_device(struct pci_dev *pdev, · 39 unmodified lines
3300	3304	adapter->rx_ring_size = VMXNET3_DEF_RX_RING_SIZE;
3301	3305	adapter->rx_ring2_size = VMXNET3_DEF_RX_RING2_SIZE;
3302	3306
	3307	+ if (pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) == 0) {
	3308	+ if (pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)) != 0) {
	3309	+ dev_err(&pdev->dev,
	3310	+ "pci_set_consistent_dma_mask failed\n");
	3311	+ err = -EIO;
	3312	+ goto err_set_mask;
	3313	+ }
	3314	+ dma64 = true;
	3315	+ } else {
	3316	+ if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32)) != 0) {
	3317	+ dev_err(&pdev->dev,
	3318	+ "pci_set_dma_mask failed\n");
	3319	+ err = -EIO;
	3320	+ goto err_set_mask;
	3321	+ }
	3322	+ dma64 = false;
	3323	+ }
	3324	+
3303	3325	spin_lock_init(&adapter->cmd_lock);
3304	3326	adapter->adapter_pa = dma_map_single(&adapter->pdev->dev, adapter,
3305	3327	sizeof(struct vmxnet3_adapter),
@@ -3307,7 +3329,7 @@ vmxnet3_probe_device(struct pci_dev *pdev, · 1 unmodified line
3307	3329	if (dma_mapping_error(&adapter->pdev->dev, adapter->adapter_pa)) {
3308	3330	dev_err(&pdev->dev, "Failed to map dma\n");
3309	3331	err = -EFAULT;
3310		− goto err_dma_map;
	3332	+ goto err_set_mask;
3311	3333	}
3312	3334	adapter->shared = dma_alloc_coherent(
3313	3335	&adapter->pdev->dev,
@@ -3358,7 +3380,7 @@ vmxnet3_probe_device(struct pci_dev *pdev, · 44 unmodified lines
3358	3380	}
3359	3381	#endif /* VMXNET3_RSS */
3360	3382
3361		− err = vmxnet3_alloc_pci_resources(adapter, &dma64);
	3383	+ err = vmxnet3_alloc_pci_resources(adapter);
3362	3384	if (err < 0)
3363	3385	goto err_alloc_pci;
3364	3386
@@ -3504,7 +3526,7 @@ err_alloc_queue_desc: · 139 unmodified lines
3504	3526	err_alloc_shared:
3505	3527	dma_unmap_single(&adapter->pdev->dev, adapter->adapter_pa,
3506	3528	sizeof(struct vmxnet3_adapter), PCI_DMA_TODEVICE);
3507		−err_dma_map:
	3529	+err_set_mask:
3508	3530	free_netdev(netdev);
3509	3531	return err;
3510	3532	}

drivers/net/vmxnet3/vmxnet3_int.h+5−3

@@ -69,10 +69,12 @@ · 68 unmodified lines
69	69	/*
70	70	* Version numbers
71	71	*/
72		−#define VMXNET3_DRIVER_VERSION_STRING "1.4.14.0-k"
	72	+#define VMXNET3_DRIVER_VERSION_STRING "1.4.16.0-k"
73	73
74		−/* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
75		−#define VMXNET3_DRIVER_VERSION_NUM 0x01040e00
	74	+/* Each byte of this 32-bit integer encodes a version number in
	75	+ * VMXNET3_DRIVER_VERSION_STRING.
	76	+ */
	77	+#define VMXNET3_DRIVER_VERSION_NUM 0x01041000
76	78
77	79	#if defined(CONFIG_PCI_MSI)
78	80	/* RSS only makes sense if MSI-X is supported. */

include/linux/mlx5/driver.h+1−11

@@ -1286,17 +1286,7 @@ enum { · 1285 unmodified lines
1286	1286	static inline const struct cpumask *
1287	1287	mlx5_get_vector_affinity_hint(struct mlx5_core_dev *dev, int vector)
1288	1288	{
1289		− struct irq_desc *desc;
1290		− unsigned int irq;
1291		− int eqn;
1292		− int err;
1293		−
1294		− err = mlx5_vector2eqn(dev, vector, &eqn, &irq);
1295		− if (err)
1296		− return NULL;
1297		−
1298		− desc = irq_to_desc(irq);
1299		− return desc->affinity_hint;
	1289	+ return dev->priv.irq_info[vector].mask;
1300	1290	}
1301	1291
1302	1292	#endif /* MLX5_DRIVER_H */

include/net/netfilter/nf_tables.h+5−0

@@ -170,6 +170,7 @@ struct nft_data_desc { · 169 unmodified lines
170	170	int nft_data_init(const struct nft_ctx *ctx,
171	171	struct nft_data *data, unsigned int size,
172	172	struct nft_data_desc desc, const struct nlattr nla);
	173	+void nft_data_hold(const struct nft_data *data, enum nft_data_types type);
173	174	void nft_data_release(const struct nft_data *data, enum nft_data_types type);
174	175	int nft_data_dump(struct sk_buff skb, int attr, const struct nft_data data,
175	176	enum nft_data_types type, unsigned int len);
@@ -736,6 +737,10 @@ struct nft_expr_ops { · 560 unmodified lines
736	737	int (init)(const struct nft_ctx ctx,
737	738	const struct nft_expr *expr,
738	739	const struct nlattr * const tb[]);
	740	+ void (activate)(const struct nft_ctx ctx,
	741	+ const struct nft_expr *expr);
	742	+ void (deactivate)(const struct nft_ctx ctx,
	743	+ const struct nft_expr *expr);
739	744	void (destroy)(const struct nft_ctx ctx,
740	745	const struct nft_expr *expr);
741	746	int (dump)(struct sk_buff skb,

include/net/tls.h+3−0

@@ -97,6 +97,9 @@ struct tls_sw_context { · 96 unmodified lines
97	97	u8 control;
98	98	bool decrypted;
99	99
	100	+ char rx_aad_ciphertext[TLS_AAD_SPACE_SIZE];
	101	+ char rx_aad_plaintext[TLS_AAD_SPACE_SIZE];
	102	+
100	103	/* Sending context */
101	104	char aad_space[TLS_AAD_SPACE_SIZE];
102	105

include/uapi/linux/netfilter/nf_conntrack_tcp.h+3−0

@@ -46,6 +46,9 @@ enum tcp_conntrack { · 45 unmodified lines
46	46	/* Marks possibility for expected RFC5961 challenge ACK */
47	47	#define IP_CT_EXP_CHALLENGE_ACK 0x40
48	48
	49	+/* Simultaneous open initialized */
	50	+#define IP_CT_TCP_SIMULTANEOUS_OPEN 0x80
	51	+
49	52	struct nf_ct_tcp_flags {
50	53	__u8 flags;
51	54	__u8 mask;

kernel/bpf/core.c+75−25

@@ -218,47 +218,84 @@ int bpf_prog_calc_tag(struct bpf_prog *fp) · 217 unmodified lines
218	218	return 0;
219	219	}
220	220
221		−static void bpf_adj_branches(struct bpf_prog *prog, u32 pos, u32 delta)
	221	+static int bpf_adj_delta_to_imm(struct bpf_insn *insn, u32 pos, u32 delta,
	222	+ u32 curr, const bool probe_pass)
222	223	{
	224	+ const s64 imm_min = S32_MIN, imm_max = S32_MAX;
	225	+ s64 imm = insn->imm;
	226	+
	227	+ if (curr < pos && curr + imm + 1 > pos)
	228	+ imm += delta;
	229	+ else if (curr > pos + delta && curr + imm + 1 <= pos + delta)
	230	+ imm -= delta;
	231	+ if (imm < imm_min \|\| imm > imm_max)
	232	+ return -ERANGE;
	233	+ if (!probe_pass)
	234	+ insn->imm = imm;
	235	+ return 0;
	236	+}
	237	+
	238	+static int bpf_adj_delta_to_off(struct bpf_insn *insn, u32 pos, u32 delta,
	239	+ u32 curr, const bool probe_pass)
	240	+{
	241	+ const s32 off_min = S16_MIN, off_max = S16_MAX;
	242	+ s32 off = insn->off;
	243	+
	244	+ if (curr < pos && curr + off + 1 > pos)
	245	+ off += delta;
	246	+ else if (curr > pos + delta && curr + off + 1 <= pos + delta)
	247	+ off -= delta;
	248	+ if (off < off_min \|\| off > off_max)
	249	+ return -ERANGE;
	250	+ if (!probe_pass)
	251	+ insn->off = off;
	252	+ return 0;
	253	+}
	254	+
	255	+static int bpf_adj_branches(struct bpf_prog *prog, u32 pos, u32 delta,
	256	+ const bool probe_pass)
	257	+{
	258	+ u32 i, insn_cnt = prog->len + (probe_pass ? delta : 0);
223	259	struct bpf_insn *insn = prog->insnsi;
224		− u32 i, insn_cnt = prog->len;
225		− bool pseudo_call;
226		− u8 code;
227		− int off;
	260	+ int ret = 0;
228	261
229	262	for (i = 0; i < insn_cnt; i++, insn++) {
	263	+ u8 code;
	264	+
	265	+ /* In the probing pass we still operate on the original,
	266	+ * unpatched image in order to check overflows before we
	267	+ * do any other adjustments. Therefore skip the patchlet.
	268	+ */
	269	+ if (probe_pass && i == pos) {
	270	+ i += delta + 1;
	271	+ insn++;
	272	+ }
230	273	code = insn->code;
231		− if (BPF_CLASS(code) != BPF_JMP)
232		− continue;
233		− if (BPF_OP(code) == BPF_EXIT)
	274	+ if (BPF_CLASS(code) != BPF_JMP \|\|
	275	+ BPF_OP(code) == BPF_EXIT)
234	276	continue;
	277	+ /* Adjust offset of jmps if we cross patch boundaries. */
235	278	if (BPF_OP(code) == BPF_CALL) {
236		− if (insn->src_reg == BPF_PSEUDO_CALL)
237		− pseudo_call = true;
238		− else
	279	+ if (insn->src_reg != BPF_PSEUDO_CALL)
239	280	continue;
	281	+ ret = bpf_adj_delta_to_imm(insn, pos, delta, i,
	282	+ probe_pass);
240	283	} else {
241		− pseudo_call = false;
	284	+ ret = bpf_adj_delta_to_off(insn, pos, delta, i,
	285	+ probe_pass);
242	286	}
243		− off = pseudo_call ? insn->imm : insn->off;
244		−
245		− /* Adjust offset of jmps if we cross boundaries. */
246		− if (i < pos && i + off + 1 > pos)
247		− off += delta;
248		− else if (i > pos + delta && i + off + 1 <= pos + delta)
249		− off -= delta;
250		−
251		− if (pseudo_call)
252		− insn->imm = off;
253		− else
254		− insn->off = off;
	287	+ if (ret)
	288	+ break;
255	289	}
	290	+
	291	+ return ret;
256	292	}
257	293
258	294	struct bpf_prog bpf_patch_insn_single(struct bpf_prog prog, u32 off,
259	295	const struct bpf_insn *patch, u32 len)
260	296	{
261	297	u32 insn_adj_cnt, insn_rest, insn_delta = len - 1;
	298	+ const u32 cnt_max = S16_MAX;
262	299	struct bpf_prog *prog_adj;
263	300
264	301	/* Since our patchlet doesn't expand the image, we're done. */
@@ -269,6 +306,15 @@ struct bpf_prog bpf_patch_insn_single(struct bpf_prog prog, u32 off, · 4 unmodified lines
269	306
270	307	insn_adj_cnt = prog->len + insn_delta;
271	308
	309	+ /* Reject anything that would potentially let the insn->off
	310	+ * target overflow when we have excessive program expansions.
	311	+ * We need to probe here before we do any reallocation where
	312	+ * we afterwards may not fail anymore.
	313	+ */
	314	+ if (insn_adj_cnt > cnt_max &&
	315	+ bpf_adj_branches(prog, off, insn_delta, true))
	316	+ return NULL;
	317	+
272	318	/* Several new instructions need to be inserted. Make room
273	319	* for them. Likely, there's no need for a new allocation as
274	320	* last page could have large enough tailroom.
@@ -294,7 +340,11 @@ struct bpf_prog bpf_patch_insn_single(struct bpf_prog prog, u32 off, · 19 unmodified lines
294	340	sizeof(patch) insn_rest);
295	341	memcpy(prog_adj->insnsi + off, patch, sizeof(patch) len);
296	342
297		− bpf_adj_branches(prog_adj, off, insn_delta);
	343	+ /* We are guaranteed to not fail at this point, otherwise
	344	+ * the ship has sailed to reverse to the original state. An
	345	+ * overflow cannot happen at this point.
	346	+ */
	347	+ BUG_ON(bpf_adj_branches(prog_adj, off, insn_delta, false));
298	348
299	349	return prog_adj;
300	350	}

kernel/bpf/sockmap.c+9−9

@@ -1703,11 +1703,11 @@ static int sock_map_ctx_update_elem(struct bpf_sock_ops_kern *skops, · 1702 unmodified lines
1703	1703	* we increment the refcnt. If this is the case abort with an
1704	1704	* error.
1705	1705	*/
1706		− verdict = bpf_prog_inc_not_zero(stab->bpf_verdict);
	1706	+ verdict = bpf_prog_inc_not_zero(verdict);
1707	1707	if (IS_ERR(verdict))
1708	1708	return PTR_ERR(verdict);
1709	1709
1710		− parse = bpf_prog_inc_not_zero(stab->bpf_parse);
	1710	+ parse = bpf_prog_inc_not_zero(parse);
1711	1711	if (IS_ERR(parse)) {
1712	1712	bpf_prog_put(verdict);
1713	1713	return PTR_ERR(parse);
@@ -1715,12 +1715,12 @@ static int sock_map_ctx_update_elem(struct bpf_sock_ops_kern *skops, · 1 unmodified line
1715	1715	}
1716	1716
1717	1717	if (tx_msg) {
1718		− tx_msg = bpf_prog_inc_not_zero(stab->bpf_tx_msg);
	1718	+ tx_msg = bpf_prog_inc_not_zero(tx_msg);
1719	1719	if (IS_ERR(tx_msg)) {
1720		− if (verdict)
1721		− bpf_prog_put(verdict);
1722		− if (parse)
	1720	+ if (parse && verdict) {
1723	1721	bpf_prog_put(parse);
	1722	+ bpf_prog_put(verdict);
	1723	+ }
1724	1724	return PTR_ERR(tx_msg);
1725	1725	}
1726	1726	}
@@ -1805,10 +1805,10 @@ static int sock_map_ctx_update_elem(struct bpf_sock_ops_kern *skops, · 78 unmodified lines
1805	1805	out_free:
1806	1806	smap_release_sock(psock, sock);
1807	1807	out_progs:
1808		− if (verdict)
1809		− bpf_prog_put(verdict);
1810		− if (parse)
	1808	+ if (parse && verdict) {
1811	1809	bpf_prog_put(parse);
	1810	+ bpf_prog_put(verdict);
	1811	+ }
1812	1812	if (tx_msg)
1813	1813	bpf_prog_put(tx_msg);
1814	1814	write_unlock_bh(&sock->sk_callback_lock);

net/bridge/netfilter/ebt_stp.c+2−2

@@ -161,8 +161,8 @@ static int ebt_stp_mt_check(const struct xt_mtchk_param *par) · 160 unmodified lines
161	161	/* Make sure the match only receives stp frames */
162	162	if (!par->nft_compat &&
163	163	(!ether_addr_equal(e->destmac, eth_stp_addr) \|\|
164		− !is_broadcast_ether_addr(e->destmsk) \|\|
165		− !(e->bitmask & EBT_DESTMAC)))
	164	+ !(e->bitmask & EBT_DESTMAC) \|\|
	165	+ !is_broadcast_ether_addr(e->destmsk)))
166	166	return -EINVAL;
167	167
168	168	return 0;

net/core/dev.c+1−1

@@ -2124,7 +2124,7 @@ static bool remove_xps_queue_cpu(struct net_device *dev, · 2123 unmodified lines
2124	2124	int i, j;
2125	2125
2126	2126	for (i = count, j = offset; i--; j++) {
2127		− if (!remove_xps_queue(dev_maps, cpu, j))
	2127	+ if (!remove_xps_queue(dev_maps, tci, j))
2128	2128	break;
2129	2129	}
2130	2130

net/core/filter.c+9−2

@@ -481,11 +481,18 @@ do_pass: · 480 unmodified lines
481	481
482	482	#define BPF_EMIT_JMP \
483	483	do { \
	484	+ const s32 off_min = S16_MIN, off_max = S16_MAX; \
	485	+ s32 off; \
	486	+ \
484	487	if (target >= len \|\| target < 0) \
485	488	goto err; \
486		− insn->off = addrs ? addrs[target] - addrs[i] - 1 : 0; \
	489	+ off = addrs ? addrs[target] - addrs[i] - 1 : 0; \
487	490	/* Adjust pc relative offset for 2nd or 3rd insn. */ \
488		− insn->off -= insn - tmp_insns; \
	491	+ off -= insn - tmp_insns; \
	492	+ /* Reject anything not fitting into insn->off. */ \
	493	+ if (off < off_min \|\| off > off_max) \
	494	+ goto err; \
	495	+ insn->off = off; \
489	496	} while (0)
490	497
491	498	case BPF_JMP \| BPF_JA:

net/core/sock.c+1−1

@@ -1606,7 +1606,7 @@ static void __sk_free(struct sock *sk) · 1605 unmodified lines
1606	1606	if (likely(sk->sk_net_refcnt))
1607	1607	sock_inuse_add(sock_net(sk), -1);
1608	1608
1609		− if (unlikely(sock_diag_has_destroy_listeners(sk) && sk->sk_net_refcnt))
	1609	+ if (unlikely(sk->sk_net_refcnt && sock_diag_has_destroy_listeners(sk)))
1610	1610	sock_diag_broadcast_destroy(sk);
1611	1611	else
1612	1612	sk_destruct(sk);

net/dsa/dsa2.c+6−3

@@ -258,11 +258,13 @@ static void dsa_tree_teardown_default_cpu(struct dsa_switch_tree *dst) · 257 unmodified lines
258	258	static int dsa_port_setup(struct dsa_port *dp)
259	259	{
260	260	struct dsa_switch *ds = dp->ds;
261		− int err;
	261	+ int err = 0;
262	262
263	263	memset(&dp->devlink_port, 0, sizeof(dp->devlink_port));
264	264
265		− err = devlink_port_register(ds->devlink, &dp->devlink_port, dp->index);
	265	+ if (dp->type != DSA_PORT_TYPE_UNUSED)
	266	+ err = devlink_port_register(ds->devlink, &dp->devlink_port,
	267	+ dp->index);
266	268	if (err)
267	269	return err;
268	270
@@ -293,7 +295,8 @@ static int dsa_port_setup(struct dsa_port *dp) · 24 unmodified lines
293	295
294	296	static void dsa_port_teardown(struct dsa_port *dp)
295	297	{
296		− devlink_port_unregister(&dp->devlink_port);
	298	+ if (dp->type != DSA_PORT_TYPE_UNUSED)
	299	+ devlink_port_unregister(&dp->devlink_port);
297	300
298	301	switch (dp->type) {
299	302	case DSA_PORT_TYPE_UNUSED:

net/ipv4/fib_frontend.c+7−1

@@ -326,10 +326,11 @@ static int __fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst, · 325 unmodified lines
326	326	u8 tos, int oif, struct net_device *dev,
327	327	int rpf, struct in_device idev, u32 itag)
328	328	{
	329	+ struct net *net = dev_net(dev);
	330	+ struct flow_keys flkeys;
329	331	int ret, no_addr;
330	332	struct fib_result res;
331	333	struct flowi4 fl4;
332		− struct net *net = dev_net(dev);
333	334	bool dev_match;
334	335
335	336	fl4.flowi4_oif = 0;
@@ -347,6 +348,11 @@ static int __fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst, · 11 unmodified lines
347	348	no_addr = idev->ifa_list == NULL;
348	349
349	350	fl4.flowi4_mark = IN_DEV_SRC_VMARK(idev) ? skb->mark : 0;
	351	+ if (!fib4_rules_early_flow_dissect(net, skb, &fl4, &flkeys)) {
	352	+ fl4.flowi4_proto = 0;
	353	+ fl4.fl4_sport = 0;
	354	+ fl4.fl4_dport = 0;
	355	+ }
350	356
351	357	trace_fib_validate_source(dev, &fl4);
352	358

net/ipv4/ip_gre.c+3−1

@@ -722,10 +722,12 @@ static netdev_tx_t erspan_xmit(struct sk_buff *skb, · 721 unmodified lines
722	722	erspan_build_header(skb, ntohl(tunnel->parms.o_key),
723	723	tunnel->index,
724	724	truncate, true);
725		− else
	725	+ else if (tunnel->erspan_ver == 2)
726	726	erspan_build_header_v2(skb, ntohl(tunnel->parms.o_key),
727	727	tunnel->dir, tunnel->hwid,
728	728	truncate, true);
	729	+ else
	730	+ goto free_skb;
729	731
730	732	tunnel->parms.o_flags &= ~TUNNEL_KEY;
731	733	__gre_xmit(skb, dev, &tunnel->parms.iph, htons(ETH_P_ERSPAN));

net/ipv4/ip_output.c+2−1

@@ -1045,7 +1045,8 @@ alloc_new_skb: · 1044 unmodified lines
1045	1045	if (copy > length)
1046	1046	copy = length;
1047	1047
1048		− if (!(rt->dst.dev->features&NETIF_F_SG)) {
	1048	+ if (!(rt->dst.dev->features&NETIF_F_SG) &&
	1049	+ skb_tailroom(skb) >= copy) {
1049	1050	unsigned int off;
1050	1051
1051	1052	off = skb->len;

net/ipv4/netfilter/ip_tables.c+1−0

@@ -34,6 +34,7 @@ · 33 unmodified lines
34	34	MODULE_LICENSE("GPL");
35	35	MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
36	36	MODULE_DESCRIPTION("IPv4 packet filter");
	37	+MODULE_ALIAS("ipt_icmp");
37	38
38	39	void ipt_alloc_initial_table(const struct xt_table info)
39	40	{

net/ipv4/netfilter/ipt_rpfilter.c+1−1

@@ -89,10 +89,10 @@ static bool rpfilter_mt(const struct sk_buff skb, struct xt_action_param par) · 88 unmodified lines
89	89	return true ^ invert;
90	90	}
91	91
	92	+ memset(&flow, 0, sizeof(flow));
92	93	flow.flowi4_iif = LOOPBACK_IFINDEX;
93	94	flow.daddr = iph->saddr;
94	95	flow.saddr = rpfilter_get_saddr(iph->daddr);
95		− flow.flowi4_oif = 0;
96	96	flow.flowi4_mark = info->flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0;
97	97	flow.flowi4_tos = RT_TOS(iph->tos);
98	98	flow.flowi4_scope = RT_SCOPE_UNIVERSE;

net/ipv4/route.c+6−1

@@ -1961,8 +1961,13 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr, · 1960 unmodified lines
1961	1961	fl4.saddr = saddr;
1962	1962	fl4.flowi4_uid = sock_net_uid(net, NULL);
1963	1963
1964		− if (fib4_rules_early_flow_dissect(net, skb, &fl4, &_flkeys))
	1964	+ if (fib4_rules_early_flow_dissect(net, skb, &fl4, &_flkeys)) {
1965	1965	flkeys = &_flkeys;
	1966	+ } else {
	1967	+ fl4.flowi4_proto = 0;
	1968	+ fl4.fl4_sport = 0;
	1969	+ fl4.fl4_dport = 0;
	1970	+ }
1966	1971
1967	1972	err = fib_lookup(net, &fl4, res, 0);
1968	1973	if (err != 0) {

net/ipv4/tcp_output.c+5−2

@@ -2833,8 +2833,10 @@ int __tcp_retransmit_skb(struct sock sk, struct sk_buff skb, int segs) · 2832 unmodified lines
2833	2833	return -EBUSY;
2834	2834
2835	2835	if (before(TCP_SKB_CB(skb)->seq, tp->snd_una)) {
2836		− if (before(TCP_SKB_CB(skb)->end_seq, tp->snd_una))
2837		− BUG();
	2836	+ if (unlikely(before(TCP_SKB_CB(skb)->end_seq, tp->snd_una))) {
	2837	+ WARN_ON_ONCE(1);
	2838	+ return -EINVAL;
	2839	+ }
2838	2840	if (tcp_trim_head(sk, skb, tp->snd_una - TCP_SKB_CB(skb)->seq))
2839	2841	return -ENOMEM;
2840	2842	}
@@ -3342,6 +3344,7 @@ static void tcp_connect_init(struct sock *sk) · 501 unmodified lines
3342	3344	sock_reset_flag(sk, SOCK_DONE);
3343	3345	tp->snd_wnd = 0;
3344	3346	tcp_init_wl(tp, 0);
	3347	+ tcp_write_queue_purge(sk);
3345	3348	tp->snd_una = tp->write_seq;
3346	3349	tp->snd_sml = tp->write_seq;
3347	3350	tp->snd_up = tp->write_seq;

net/ipv6/ip6_gre.c+226−60

@@ -71,6 +71,7 @@ struct ip6gre_net { · 70 unmodified lines
71	71	struct ip6_tnl __rcu *tunnels[4][IP6_GRE_HASH_SIZE];
72	72
73	73	struct ip6_tnl __rcu *collect_md_tun;
	74	+ struct ip6_tnl __rcu *collect_md_tun_erspan;
74	75	struct net_device *fb_tunnel_dev;
75	76	};
76	77
@@ -81,6 +82,7 @@ static int ip6gre_tunnel_init(struct net_device *dev); · 4 unmodified lines
81	82	static void ip6gre_tunnel_setup(struct net_device *dev);
82	83	static void ip6gre_tunnel_link(struct ip6gre_net ign, struct ip6_tnl t);
83	84	static void ip6gre_tnl_link_config(struct ip6_tnl *t, int set_mtu);
	85	+static void ip6erspan_tnl_link_config(struct ip6_tnl *t, int set_mtu);
84	86
85	87	/* Tunnel hash table */
86	88
@@ -232,7 +234,12 @@ static struct ip6_tnl ip6gre_tunnel_lookup(struct net_device dev, · 145 unmodified lines
232	234	if (cand)
233	235	return cand;
234	236
235		− t = rcu_dereference(ign->collect_md_tun);
	237	+ if (gre_proto == htons(ETH_P_ERSPAN) \|\|
	238	+ gre_proto == htons(ETH_P_ERSPAN2))
	239	+ t = rcu_dereference(ign->collect_md_tun_erspan);
	240	+ else
	241	+ t = rcu_dereference(ign->collect_md_tun);
	242	+
236	243	if (t && t->dev->flags & IFF_UP)
237	244	return t;
238	245
@@ -261,6 +268,31 @@ static struct ip6_tnl __rcu *__ip6gre_bucket(struct ip6gre_net ign, · 22 unmodified lines
261	268	return &ign->tunnels[prio][h];
262	269	}
263	270
	271	+static void ip6gre_tunnel_link_md(struct ip6gre_net ign, struct ip6_tnl t)
	272	+{
	273	+ if (t->parms.collect_md)
	274	+ rcu_assign_pointer(ign->collect_md_tun, t);
	275	+}
	276	+
	277	+static void ip6erspan_tunnel_link_md(struct ip6gre_net ign, struct ip6_tnl t)
	278	+{
	279	+ if (t->parms.collect_md)
	280	+ rcu_assign_pointer(ign->collect_md_tun_erspan, t);
	281	+}
	282	+
	283	+static void ip6gre_tunnel_unlink_md(struct ip6gre_net ign, struct ip6_tnl t)
	284	+{
	285	+ if (t->parms.collect_md)
	286	+ rcu_assign_pointer(ign->collect_md_tun, NULL);
	287	+}
	288	+
	289	+static void ip6erspan_tunnel_unlink_md(struct ip6gre_net *ign,
	290	+ struct ip6_tnl *t)
	291	+{
	292	+ if (t->parms.collect_md)
	293	+ rcu_assign_pointer(ign->collect_md_tun_erspan, NULL);
	294	+}
	295	+
264	296	static inline struct ip6_tnl __rcu *ip6gre_bucket(struct ip6gre_net ign,
265	297	const struct ip6_tnl *t)
266	298	{
@@ -271,9 +303,6 @@ static void ip6gre_tunnel_link(struct ip6gre_net ign, struct ip6_tnl t) · 4 unmodified lines
271	303	{
272	304	struct ip6_tnl __rcu **tp = ip6gre_bucket(ign, t);
273	305
274		− if (t->parms.collect_md)
275		− rcu_assign_pointer(ign->collect_md_tun, t);
276		−
277	306	rcu_assign_pointer(t->next, rtnl_dereference(*tp));
278	307	rcu_assign_pointer(*tp, t);
279	308	}
@@ -283,9 +312,6 @@ static void ip6gre_tunnel_unlink(struct ip6gre_net ign, struct ip6_tnl t) · 3 unmodified lines
283	312	struct ip6_tnl __rcu **tp;
284	313	struct ip6_tnl *iter;
285	314
286		− if (t->parms.collect_md)
287		− rcu_assign_pointer(ign->collect_md_tun, NULL);
288		−
289	315	for (tp = ip6gre_bucket(ign, t);
290	316	(iter = rtnl_dereference(*tp)) != NULL;
291	317	tp = &iter->next) {
@@ -374,11 +400,23 @@ failed_free: · 82 unmodified lines
374	400	return NULL;
375	401	}
376	402
	403	+static void ip6erspan_tunnel_uninit(struct net_device *dev)
	404	+{
	405	+ struct ip6_tnl *t = netdev_priv(dev);
	406	+ struct ip6gre_net *ign = net_generic(t->net, ip6gre_net_id);
	407	+
	408	+ ip6erspan_tunnel_unlink_md(ign, t);
	409	+ ip6gre_tunnel_unlink(ign, t);
	410	+ dst_cache_reset(&t->dst_cache);
	411	+ dev_put(dev);
	412	+}
	413	+
377	414	static void ip6gre_tunnel_uninit(struct net_device *dev)
378	415	{
379	416	struct ip6_tnl *t = netdev_priv(dev);
380	417	struct ip6gre_net *ign = net_generic(t->net, ip6gre_net_id);
381	418
	419	+ ip6gre_tunnel_unlink_md(ign, t);
382	420	ip6gre_tunnel_unlink(ign, t);
383	421	dst_cache_reset(&t->dst_cache);
384	422	dev_put(dev);
@@ -698,6 +736,9 @@ static netdev_tx_t __gre6_xmit(struct sk_buff *skb, · 313 unmodified lines
698	736	else
699	737	fl6->daddr = tunnel->parms.raddr;
700	738
	739	+ if (skb_cow_head(skb, dev->needed_headroom ?: tunnel->hlen))
	740	+ return -ENOMEM;
	741	+
701	742	/* Push GRE header. */
702	743	protocol = (dev->type == ARPHRD_ETHER) ? htons(ETH_P_TEB) : proto;
703	744
@@ -908,7 +949,7 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb, · 204 unmodified lines
908	949	truncate = true;
909	950	}
910	951
911		− if (skb_cow_head(skb, dev->needed_headroom))
	952	+ if (skb_cow_head(skb, dev->needed_headroom ?: t->hlen))
912	953	goto tx_err;
913	954
914	955	t->parms.o_flags &= ~TUNNEL_KEY;
@@ -979,11 +1020,14 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb, · 64 unmodified lines
979	1020	erspan_build_header(skb, ntohl(t->parms.o_key),
980	1021	t->parms.index,
981	1022	truncate, false);
982		− else
	1023	+ else if (t->parms.erspan_ver == 2)
983	1024	erspan_build_header_v2(skb, ntohl(t->parms.o_key),
984	1025	t->parms.dir,
985	1026	t->parms.hwid,
986	1027	truncate, false);
	1028	+ else
	1029	+ goto tx_err;
	1030	+
987	1031	fl6.daddr = t->parms.raddr;
988	1032	}
989	1033
@@ -1019,12 +1063,11 @@ tx_err: · 29 unmodified lines
1019	1063	return NETDEV_TX_OK;
1020	1064	}
1021	1065
1022		−static void ip6gre_tnl_link_config(struct ip6_tnl *t, int set_mtu)
	1066	+static void ip6gre_tnl_link_config_common(struct ip6_tnl *t)
1023	1067	{
1024	1068	struct net_device *dev = t->dev;
1025	1069	struct __ip6_tnl_parm *p = &t->parms;
1026	1070	struct flowi6 *fl6 = &t->fl.u.ip6;
1027		− int t_hlen;
1028	1071
1029	1072	if (dev->type != ARPHRD_ETHER) {
1030	1073	memcpy(dev->dev_addr, &p->laddr, sizeof(struct in6_addr));
@@ -1051,12 +1094,13 @@ static void ip6gre_tnl_link_config(struct ip6_tnl *t, int set_mtu) · 20 unmodified lines
1051	1094	dev->flags \|= IFF_POINTOPOINT;
1052	1095	else
1053	1096	dev->flags &= ~IFF_POINTOPOINT;
	1097	+}
1054	1098
1055		− t->tun_hlen = gre_calc_hlen(t->parms.o_flags);
1056		−
1057		− t->hlen = t->encap_hlen + t->tun_hlen;
1058		−
1059		− t_hlen = t->hlen + sizeof(struct ipv6hdr);
	1099	+static void ip6gre_tnl_link_config_route(struct ip6_tnl *t, int set_mtu,
	1100	+ int t_hlen)
	1101	+{
	1102	+ const struct __ip6_tnl_parm *p = &t->parms;
	1103	+ struct net_device *dev = t->dev;
1060	1104
1061	1105	if (p->flags & IP6_TNL_F_CAP_XMIT) {
1062	1106	int strict = (ipv6_addr_type(&p->raddr) &
@@ -1088,8 +1132,26 @@ static void ip6gre_tnl_link_config(struct ip6_tnl *t, int set_mtu) · 25 unmodified lines
1088	1132	}
1089	1133	}
1090	1134
1091		−static int ip6gre_tnl_change(struct ip6_tnl *t,
1092		− const struct __ip6_tnl_parm *p, int set_mtu)
	1135	+static int ip6gre_calc_hlen(struct ip6_tnl *tunnel)
	1136	+{
	1137	+ int t_hlen;
	1138	+
	1139	+ tunnel->tun_hlen = gre_calc_hlen(tunnel->parms.o_flags);
	1140	+ tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen;
	1141	+
	1142	+ t_hlen = tunnel->hlen + sizeof(struct ipv6hdr);
	1143	+ tunnel->dev->hard_header_len = LL_MAX_HEADER + t_hlen;
	1144	+ return t_hlen;
	1145	+}
	1146	+
	1147	+static void ip6gre_tnl_link_config(struct ip6_tnl *t, int set_mtu)
	1148	+{
	1149	+ ip6gre_tnl_link_config_common(t);
	1150	+ ip6gre_tnl_link_config_route(t, set_mtu, ip6gre_calc_hlen(t));
	1151	+}
	1152	+
	1153	+static void ip6gre_tnl_copy_tnl_parm(struct ip6_tnl *t,
	1154	+ const struct __ip6_tnl_parm *p)
1093	1155	{
1094	1156	t->parms.laddr = p->laddr;
1095	1157	t->parms.raddr = p->raddr;
@@ -1105,6 +1167,12 @@ static int ip6gre_tnl_change(struct ip6_tnl *t, · 9 unmodified lines
1105	1167	t->parms.o_flags = p->o_flags;
1106	1168	t->parms.fwmark = p->fwmark;
1107	1169	dst_cache_reset(&t->dst_cache);
	1170	+}
	1171	+
	1172	+static int ip6gre_tnl_change(struct ip6_tnl t, const struct __ip6_tnl_parm p,
	1173	+ int set_mtu)
	1174	+{
	1175	+ ip6gre_tnl_copy_tnl_parm(t, p);
1108	1176	ip6gre_tnl_link_config(t, set_mtu);
1109	1177	return 0;
1110	1178	}
@@ -1381,11 +1449,7 @@ static int ip6gre_tunnel_init_common(struct net_device *dev) · 270 unmodified lines
1381	1449	return ret;
1382	1450	}
1383	1451
1384		− tunnel->tun_hlen = gre_calc_hlen(tunnel->parms.o_flags);
1385		− tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen;
1386		− t_hlen = tunnel->hlen + sizeof(struct ipv6hdr);
1387		−
1388		− dev->hard_header_len = LL_MAX_HEADER + t_hlen;
	1452	+ t_hlen = ip6gre_calc_hlen(tunnel);
1389	1453	dev->mtu = ETH_DATA_LEN - t_hlen;
1390	1454	if (dev->type == ARPHRD_ETHER)
1391	1455	dev->mtu -= ETH_HLEN;
@@ -1728,6 +1792,19 @@ static const struct net_device_ops ip6gre_tap_netdev_ops = { · 336 unmodified lines
1728	1792	.ndo_get_iflink = ip6_tnl_get_iflink,
1729	1793	};
1730	1794
	1795	+static int ip6erspan_calc_hlen(struct ip6_tnl *tunnel)
	1796	+{
	1797	+ int t_hlen;
	1798	+
	1799	+ tunnel->tun_hlen = 8;
	1800	+ tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen +
	1801	+ erspan_hdr_len(tunnel->parms.erspan_ver);
	1802	+
	1803	+ t_hlen = tunnel->hlen + sizeof(struct ipv6hdr);
	1804	+ tunnel->dev->hard_header_len = LL_MAX_HEADER + t_hlen;
	1805	+ return t_hlen;
	1806	+}
	1807	+
1731	1808	static int ip6erspan_tap_init(struct net_device *dev)
1732	1809	{
1733	1810	struct ip6_tnl *tunnel;
@@ -1751,12 +1828,7 @@ static int ip6erspan_tap_init(struct net_device *dev) · 17 unmodified lines
1751	1828	return ret;
1752	1829	}
1753	1830
1754		− tunnel->tun_hlen = 8;
1755		− tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen +
1756		− erspan_hdr_len(tunnel->parms.erspan_ver);
1757		− t_hlen = tunnel->hlen + sizeof(struct ipv6hdr);
1758		−
1759		− dev->hard_header_len = LL_MAX_HEADER + t_hlen;
	1831	+ t_hlen = ip6erspan_calc_hlen(tunnel);
1760	1832	dev->mtu = ETH_DATA_LEN - t_hlen;
1761	1833	if (dev->type == ARPHRD_ETHER)
1762	1834	dev->mtu -= ETH_HLEN;
@@ -1764,14 +1836,14 @@ static int ip6erspan_tap_init(struct net_device *dev) · 1 unmodified line
1764	1836	dev->mtu -= 8;
1765	1837
1766	1838	dev->priv_flags \|= IFF_LIVE_ADDR_CHANGE;
1767		− ip6gre_tnl_link_config(tunnel, 1);
	1839	+ ip6erspan_tnl_link_config(tunnel, 1);
1768	1840
1769	1841	return 0;
1770	1842	}
1771	1843
1772	1844	static const struct net_device_ops ip6erspan_netdev_ops = {
1773	1845	.ndo_init = ip6erspan_tap_init,
1774		− .ndo_uninit = ip6gre_tunnel_uninit,
	1846	+ .ndo_uninit = ip6erspan_tunnel_uninit,
1775	1847	.ndo_start_xmit = ip6erspan_tunnel_xmit,
1776	1848	.ndo_set_mac_address = eth_mac_addr,
1777	1849	.ndo_validate_addr = eth_validate_addr,
@@ -1835,13 +1907,11 @@ static bool ip6gre_netlink_encap_parms(struct nlattr *data[], · 57 unmodified lines
1835	1907	return ret;
1836	1908	}
1837	1909
1838		−static int ip6gre_newlink(struct net src_net, struct net_device dev,
1839		− struct nlattr tb[], struct nlattr data[],
1840		− struct netlink_ext_ack *extack)
	1910	+static int ip6gre_newlink_common(struct net src_net, struct net_device dev,
	1911	+ struct nlattr tb[], struct nlattr data[],
	1912	+ struct netlink_ext_ack *extack)
1841	1913	{
1842	1914	struct ip6_tnl *nt;
1843		− struct net *net = dev_net(dev);
1844		− struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
1845	1915	struct ip_tunnel_encap ipencap;
1846	1916	int err;
1847	1917
@@ -1854,16 +1924,6 @@ static int ip6gre_newlink(struct net src_net, struct net_device dev, · 6 unmodified lines
1854	1924	return err;
1855	1925	}
1856	1926
1857		− ip6gre_netlink_parms(data, &nt->parms);
1858		−
1859		− if (nt->parms.collect_md) {
1860		− if (rtnl_dereference(ign->collect_md_tun))
1861		− return -EEXIST;
1862		− } else {
1863		− if (ip6gre_tunnel_find(net, &nt->parms, dev->type))
1864		− return -EEXIST;
1865		− }
1866		−
1867	1927	if (dev->type == ARPHRD_ETHER && !tb[IFLA_ADDRESS])
1868	1928	eth_hw_addr_random(dev);
1869	1929
@@ -1874,51 +1934,94 @@ static int ip6gre_newlink(struct net src_net, struct net_device dev, · 4 unmodified lines
1874	1934	if (err)
1875	1935	goto out;
1876	1936
1877		− ip6gre_tnl_link_config(nt, !tb[IFLA_MTU]);
1878		−
1879	1937	if (tb[IFLA_MTU])
1880	1938	ip6_tnl_change_mtu(dev, nla_get_u32(tb[IFLA_MTU]));
1881	1939
1882	1940	dev_hold(dev);
1883		− ip6gre_tunnel_link(ign, nt);
1884	1941
1885	1942	out:
1886	1943	return err;
1887	1944	}
1888	1945
1889		−static int ip6gre_changelink(struct net_device dev, struct nlattr tb[],
1890		− struct nlattr *data[],
1891		− struct netlink_ext_ack *extack)
	1946	+static int ip6gre_newlink(struct net src_net, struct net_device dev,
	1947	+ struct nlattr tb[], struct nlattr data[],
	1948	+ struct netlink_ext_ack *extack)
	1949	+{
	1950	+ struct ip6_tnl *nt = netdev_priv(dev);
	1951	+ struct net *net = dev_net(dev);
	1952	+ struct ip6gre_net *ign;
	1953	+ int err;
	1954	+
	1955	+ ip6gre_netlink_parms(data, &nt->parms);
	1956	+ ign = net_generic(net, ip6gre_net_id);
	1957	+
	1958	+ if (nt->parms.collect_md) {
	1959	+ if (rtnl_dereference(ign->collect_md_tun))
	1960	+ return -EEXIST;
	1961	+ } else {
	1962	+ if (ip6gre_tunnel_find(net, &nt->parms, dev->type))
	1963	+ return -EEXIST;
	1964	+ }
	1965	+
	1966	+ err = ip6gre_newlink_common(src_net, dev, tb, data, extack);
	1967	+ if (!err) {
	1968	+ ip6gre_tnl_link_config(nt, !tb[IFLA_MTU]);
	1969	+ ip6gre_tunnel_link_md(ign, nt);
	1970	+ ip6gre_tunnel_link(net_generic(net, ip6gre_net_id), nt);
	1971	+ }
	1972	+ return err;
	1973	+}
	1974	+
	1975	+static struct ip6_tnl *
	1976	+ip6gre_changelink_common(struct net_device dev, struct nlattr tb[],
	1977	+ struct nlattr data[], struct __ip6_tnl_parm p_p,
	1978	+ struct netlink_ext_ack *extack)
1892	1979	{
1893	1980	struct ip6_tnl t, nt = netdev_priv(dev);
1894	1981	struct net *net = nt->net;
1895	1982	struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
1896		− struct __ip6_tnl_parm p;
1897	1983	struct ip_tunnel_encap ipencap;
1898	1984
1899	1985	if (dev == ign->fb_tunnel_dev)
1900		− return -EINVAL;
	1986	+ return ERR_PTR(-EINVAL);
1901	1987
1902	1988	if (ip6gre_netlink_encap_parms(data, &ipencap)) {
1903	1989	int err = ip6_tnl_encap_setup(nt, &ipencap);
1904	1990
1905	1991	if (err < 0)
1906		− return err;
	1992	+ return ERR_PTR(err);
1907	1993	}
1908	1994
1909		− ip6gre_netlink_parms(data, &p);
	1995	+ ip6gre_netlink_parms(data, p_p);
1910	1996
1911		− t = ip6gre_tunnel_locate(net, &p, 0);
	1997	+ t = ip6gre_tunnel_locate(net, p_p, 0);
1912	1998
1913	1999	if (t) {
1914	2000	if (t->dev != dev)
1915		− return -EEXIST;
	2001	+ return ERR_PTR(-EEXIST);
1916	2002	} else {
1917	2003	t = nt;
1918	2004	}
1919	2005
	2006	+ return t;
	2007	+}
	2008	+
	2009	+static int ip6gre_changelink(struct net_device dev, struct nlattr tb[],
	2010	+ struct nlattr *data[],
	2011	+ struct netlink_ext_ack *extack)
	2012	+{
	2013	+ struct ip6gre_net *ign = net_generic(dev_net(dev), ip6gre_net_id);
	2014	+ struct __ip6_tnl_parm p;
	2015	+ struct ip6_tnl *t;
	2016	+
	2017	+ t = ip6gre_changelink_common(dev, tb, data, &p, extack);
	2018	+ if (IS_ERR(t))
	2019	+ return PTR_ERR(t);
	2020	+
	2021	+ ip6gre_tunnel_unlink_md(ign, t);
1920	2022	ip6gre_tunnel_unlink(ign, t);
1921	2023	ip6gre_tnl_change(t, &p, !tb[IFLA_MTU]);
	2024	+ ip6gre_tunnel_link_md(ign, t);
1922	2025	ip6gre_tunnel_link(ign, t);
1923	2026	return 0;
1924	2027	}
@@ -2068,6 +2171,69 @@ static void ip6erspan_tap_setup(struct net_device *dev) · 143 unmodified lines
2068	2171	netif_keep_dst(dev);
2069	2172	}
2070	2173
	2174	+static int ip6erspan_newlink(struct net src_net, struct net_device dev,
	2175	+ struct nlattr tb[], struct nlattr data[],
	2176	+ struct netlink_ext_ack *extack)
	2177	+{
	2178	+ struct ip6_tnl *nt = netdev_priv(dev);
	2179	+ struct net *net = dev_net(dev);
	2180	+ struct ip6gre_net *ign;
	2181	+ int err;
	2182	+
	2183	+ ip6gre_netlink_parms(data, &nt->parms);
	2184	+ ign = net_generic(net, ip6gre_net_id);
	2185	+
	2186	+ if (nt->parms.collect_md) {
	2187	+ if (rtnl_dereference(ign->collect_md_tun_erspan))
	2188	+ return -EEXIST;
	2189	+ } else {
	2190	+ if (ip6gre_tunnel_find(net, &nt->parms, dev->type))
	2191	+ return -EEXIST;
	2192	+ }
	2193	+
	2194	+ err = ip6gre_newlink_common(src_net, dev, tb, data, extack);
	2195	+ if (!err) {
	2196	+ ip6erspan_tnl_link_config(nt, !tb[IFLA_MTU]);
	2197	+ ip6erspan_tunnel_link_md(ign, nt);
	2198	+ ip6gre_tunnel_link(net_generic(net, ip6gre_net_id), nt);
	2199	+ }
	2200	+ return err;
	2201	+}
	2202	+
	2203	+static void ip6erspan_tnl_link_config(struct ip6_tnl *t, int set_mtu)
	2204	+{
	2205	+ ip6gre_tnl_link_config_common(t);
	2206	+ ip6gre_tnl_link_config_route(t, set_mtu, ip6erspan_calc_hlen(t));
	2207	+}
	2208	+
	2209	+static int ip6erspan_tnl_change(struct ip6_tnl *t,
	2210	+ const struct __ip6_tnl_parm *p, int set_mtu)
	2211	+{
	2212	+ ip6gre_tnl_copy_tnl_parm(t, p);
	2213	+ ip6erspan_tnl_link_config(t, set_mtu);
	2214	+ return 0;
	2215	+}
	2216	+
	2217	+static int ip6erspan_changelink(struct net_device dev, struct nlattr tb[],
	2218	+ struct nlattr *data[],
	2219	+ struct netlink_ext_ack *extack)
	2220	+{
	2221	+ struct ip6gre_net *ign = net_generic(dev_net(dev), ip6gre_net_id);
	2222	+ struct __ip6_tnl_parm p;
	2223	+ struct ip6_tnl *t;
	2224	+
	2225	+ t = ip6gre_changelink_common(dev, tb, data, &p, extack);
	2226	+ if (IS_ERR(t))
	2227	+ return PTR_ERR(t);
	2228	+
	2229	+ ip6gre_tunnel_unlink_md(ign, t);
	2230	+ ip6gre_tunnel_unlink(ign, t);
	2231	+ ip6erspan_tnl_change(t, &p, !tb[IFLA_MTU]);
	2232	+ ip6erspan_tunnel_link_md(ign, t);
	2233	+ ip6gre_tunnel_link(ign, t);
	2234	+ return 0;
	2235	+}
	2236	+
2071	2237	static struct rtnl_link_ops ip6gre_link_ops __read_mostly = {
2072	2238	.kind = "ip6gre",
2073	2239	.maxtype = IFLA_GRE_MAX,
@@ -2104,8 +2270,8 @@ static struct rtnl_link_ops ip6erspan_tap_ops __read_mostly = { · 30 unmodified lines
2104	2270	.priv_size = sizeof(struct ip6_tnl),
2105	2271	.setup = ip6erspan_tap_setup,
2106	2272	.validate = ip6erspan_tap_validate,
2107		− .newlink = ip6gre_newlink,
2108		− .changelink = ip6gre_changelink,
	2273	+ .newlink = ip6erspan_newlink,
	2274	+ .changelink = ip6erspan_changelink,
2109	2275	.get_size = ip6gre_get_size,
2110	2276	.fill_info = ip6gre_fill_info,
2111	2277	.get_link_net = ip6_tnl_get_link_net,

net/ipv6/ip6_output.c+2−1

@@ -1503,7 +1503,8 @@ alloc_new_skb: · 1502 unmodified lines
1503	1503	if (copy > length)
1504	1504	copy = length;
1505	1505
1506		− if (!(rt->dst.dev->features&NETIF_F_SG)) {
	1506	+ if (!(rt->dst.dev->features&NETIF_F_SG) &&
	1507	+ skb_tailroom(skb) >= copy) {
1507	1508	unsigned int off;
1508	1509
1509	1510	off = skb->len;

net/ipv6/netfilter/ip6_tables.c+1−0

@@ -38,6 +38,7 @@ · 37 unmodified lines
38	38	MODULE_LICENSE("GPL");
39	39	MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
40	40	MODULE_DESCRIPTION("IPv6 packet filter");
	41	+MODULE_ALIAS("ip6t_icmp6");
41	42
42	43	void ip6t_alloc_initial_table(const struct xt_table info)
43	44	{

net/netfilter/core.c+2−1

@@ -585,7 +585,8 @@ void (nf_nat_decode_session_hook)(struct sk_buff , struct flowi *); · 584 unmodified lines
585	585	EXPORT_SYMBOL(nf_nat_decode_session_hook);
586	586	#endif
587	587
588		−static void __net_init __netfilter_net_init(struct nf_hook_entries **e, int max)
	588	+static void __net_init
	589	+__netfilter_net_init(struct nf_hook_entries __rcu **e, int max)
589	590	{
590	591	int h;
591	592

net/netfilter/ipvs/ip_vs_conn.c+6−11

@@ -232,7 +232,10 @@ static inline int ip_vs_conn_unhash(struct ip_vs_conn *cp) · 231 unmodified lines
232	232	static inline bool ip_vs_conn_unlink(struct ip_vs_conn *cp)
233	233	{
234	234	unsigned int hash;
235		− bool ret;
	235	+ bool ret = false;
	236	+
	237	+ if (cp->flags & IP_VS_CONN_F_ONE_PACKET)
	238	+ return refcount_dec_if_one(&cp->refcnt);
236	239
237	240	hash = ip_vs_conn_hashkey_conn(cp);
238	241
@@ -240,15 +243,13 @@ static inline bool ip_vs_conn_unlink(struct ip_vs_conn *cp) · 1 unmodified line
240	243	spin_lock(&cp->lock);
241	244
242	245	if (cp->flags & IP_VS_CONN_F_HASHED) {
243		− ret = false;
244	246	/* Decrease refcnt and unlink conn only if we are last user */
245	247	if (refcount_dec_if_one(&cp->refcnt)) {
246	248	hlist_del_rcu(&cp->c_list);
247	249	cp->flags &= ~IP_VS_CONN_F_HASHED;
248	250	ret = true;
249	251	}
250		− } else
251		− ret = refcount_read(&cp->refcnt) ? false : true;
	252	+ }
252	253
253	254	spin_unlock(&cp->lock);
254	255	ct_write_unlock_bh(hash);
@@ -454,12 +455,6 @@ ip_vs_conn_out_get_proto(struct netns_ipvs *ipvs, int af, · 199 unmodified lines
454	455	}
455	456	EXPORT_SYMBOL_GPL(ip_vs_conn_out_get_proto);
456	457
457		−static void __ip_vs_conn_put_notimer(struct ip_vs_conn *cp)
458		−{
459		− __ip_vs_conn_put(cp);
460		− ip_vs_conn_expire(&cp->timer);
461		−}
462		−
463	458	/*
464	459	* Put back the conn and restart its timer with its timeout
465	460	*/
@@ -478,7 +473,7 @@ void ip_vs_conn_put(struct ip_vs_conn *cp) · 12 unmodified lines
478	473	(refcount_read(&cp->refcnt) == 1) &&
479	474	!timer_pending(&cp->timer))
480	475	/* expire connection immediately */
481		− __ip_vs_conn_put_notimer(cp);
	476	+ ip_vs_conn_expire(&cp->timer);
482	477	else
483	478	__ip_vs_conn_put_timer(cp);
484	479	}

net/netfilter/ipvs/ip_vs_core.c+12−0

@@ -119,6 +119,8 @@ ip_vs_in_stats(struct ip_vs_conn cp, struct sk_buff skb) · 118 unmodified lines
119	119	struct ip_vs_cpu_stats *s;
120	120	struct ip_vs_service *svc;
121	121
	122	+ local_bh_disable();
	123	+
122	124	s = this_cpu_ptr(dest->stats.cpustats);
123	125	u64_stats_update_begin(&s->syncp);
124	126	s->cnt.inpkts++;
@@ -137,6 +139,8 @@ ip_vs_in_stats(struct ip_vs_conn cp, struct sk_buff skb) · 12 unmodified lines
137	139	s->cnt.inpkts++;
138	140	s->cnt.inbytes += skb->len;
139	141	u64_stats_update_end(&s->syncp);
	142	+
	143	+ local_bh_enable();
140	144	}
141	145	}
142	146
@@ -151,6 +155,8 @@ ip_vs_out_stats(struct ip_vs_conn cp, struct sk_buff skb) · 8 unmodified lines
151	155	struct ip_vs_cpu_stats *s;
152	156	struct ip_vs_service *svc;
153	157
	158	+ local_bh_disable();
	159	+
154	160	s = this_cpu_ptr(dest->stats.cpustats);
155	161	u64_stats_update_begin(&s->syncp);
156	162	s->cnt.outpkts++;
@@ -169,6 +175,8 @@ ip_vs_out_stats(struct ip_vs_conn cp, struct sk_buff skb) · 12 unmodified lines
169	175	s->cnt.outpkts++;
170	176	s->cnt.outbytes += skb->len;
171	177	u64_stats_update_end(&s->syncp);
	178	+
	179	+ local_bh_enable();
172	180	}
173	181	}
174	182
@@ -179,6 +187,8 @@ ip_vs_conn_stats(struct ip_vs_conn cp, struct ip_vs_service svc) · 4 unmodified lines
179	187	struct netns_ipvs *ipvs = svc->ipvs;
180	188	struct ip_vs_cpu_stats *s;
181	189
	190	+ local_bh_disable();
	191	+
182	192	s = this_cpu_ptr(cp->dest->stats.cpustats);
183	193	u64_stats_update_begin(&s->syncp);
184	194	s->cnt.conns++;
@@ -193,6 +203,8 @@ ip_vs_conn_stats(struct ip_vs_conn cp, struct ip_vs_service svc) · 8 unmodified lines
193	203	u64_stats_update_begin(&s->syncp);
194	204	s->cnt.conns++;
195	205	u64_stats_update_end(&s->syncp);
	206	+
	207	+ local_bh_enable();
196	208	}
197	209
198	210

net/netfilter/nf_conntrack_proto_tcp.c+11−0

@@ -981,6 +981,17 @@ static int tcp_packet(struct nf_conn *ct, · 980 unmodified lines
981	981	return NF_ACCEPT; /* Don't change state */
982	982	}
983	983	break;
	984	+ case TCP_CONNTRACK_SYN_SENT2:
	985	+ /* tcp_conntracks table is not smart enough to handle
	986	+ * simultaneous open.
	987	+ */
	988	+ ct->proto.tcp.last_flags \|= IP_CT_TCP_SIMULTANEOUS_OPEN;
	989	+ break;
	990	+ case TCP_CONNTRACK_SYN_RECV:
	991	+ if (dir == IP_CT_DIR_REPLY && index == TCP_ACK_SET &&
	992	+ ct->proto.tcp.last_flags & IP_CT_TCP_SIMULTANEOUS_OPEN)
	993	+ new_state = TCP_CONNTRACK_ESTABLISHED;
	994	+ break;
984	995	case TCP_CONNTRACK_CLOSE:
985	996	if (index == TCP_RST_SET
986	997	&& (ct->proto.tcp.seen[!dir].flags & IP_CT_TCP_FLAG_MAXACK_SET)

net/netfilter/nf_tables_api.c+63−14

@@ -214,6 +214,34 @@ static int nft_delchain(struct nft_ctx *ctx) · 213 unmodified lines
214	214	return err;
215	215	}
216	216
	217	+static void nft_rule_expr_activate(const struct nft_ctx *ctx,
	218	+ struct nft_rule *rule)
	219	+{
	220	+ struct nft_expr *expr;
	221	+
	222	+ expr = nft_expr_first(rule);
	223	+ while (expr != nft_expr_last(rule) && expr->ops) {
	224	+ if (expr->ops->activate)
	225	+ expr->ops->activate(ctx, expr);
	226	+
	227	+ expr = nft_expr_next(expr);
	228	+ }
	229	+}
	230	+
	231	+static void nft_rule_expr_deactivate(const struct nft_ctx *ctx,
	232	+ struct nft_rule *rule)
	233	+{
	234	+ struct nft_expr *expr;
	235	+
	236	+ expr = nft_expr_first(rule);
	237	+ while (expr != nft_expr_last(rule) && expr->ops) {
	238	+ if (expr->ops->deactivate)
	239	+ expr->ops->deactivate(ctx, expr);
	240	+
	241	+ expr = nft_expr_next(expr);
	242	+ }
	243	+}
	244	+
217	245	static int
218	246	nf_tables_delrule_deactivate(struct nft_ctx ctx, struct nft_rule rule)
219	247	{
@@ -259,6 +287,7 @@ static int nft_delrule(struct nft_ctx ctx, struct nft_rule rule) · 39 unmodified lines
259	287	nft_trans_destroy(trans);
260	288	return err;
261	289	}
	290	+ nft_rule_expr_deactivate(ctx, rule);
262	291
263	292	return 0;
264	293	}
@@ -2238,6 +2267,13 @@ static void nf_tables_rule_destroy(const struct nft_ctx *ctx, · 1973 unmodified lines
2238	2267	kfree(rule);
2239	2268	}
2240	2269
	2270	+static void nf_tables_rule_release(const struct nft_ctx *ctx,
	2271	+ struct nft_rule *rule)
	2272	+{
	2273	+ nft_rule_expr_deactivate(ctx, rule);
	2274	+ nf_tables_rule_destroy(ctx, rule);
	2275	+}
	2276	+
2241	2277	#define NFT_RULE_MAXEXPRS 128
2242	2278
2243	2279	static struct nft_expr_info *info;
@@ -2402,7 +2438,7 @@ static int nf_tables_newrule(struct net net, struct sock nlsk, · 158 unmodified lines
2402	2438	return 0;
2403	2439
2404	2440	err2:
2405		− nf_tables_rule_destroy(&ctx, rule);
	2441	+ nf_tables_rule_release(&ctx, rule);
2406	2442	err1:
2407	2443	for (i = 0; i < n; i++) {
2408	2444	if (info[i].ops != NULL)
@@ -4044,8 +4080,10 @@ static int nft_add_set_elem(struct nft_ctx ctx, struct nft_set set, · 1635 unmodified lines
4044	4080	if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^
4045	4081	nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) \|\|
4046	4082	nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^
4047		− nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF))
4048		− return -EBUSY;
	4083	+ nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF)) {
	4084	+ err = -EBUSY;
	4085	+ goto err5;
	4086	+ }
4049	4087	if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
4050	4088	nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) &&
4051	4089	memcmp(nft_set_ext_data(ext),
@@ -4130,7 +4168,7 @@ static int nf_tables_newsetelem(struct net net, struct sock nlsk, · 78 unmodified lines
4130	4168	* NFT_GOTO verdicts. This function must be called on active data objects
4131	4169	* from the second phase of the commit protocol.
4132	4170	*/
4133		−static void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
	4171	+void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
4134	4172	{
4135	4173	if (type == NFT_DATA_VERDICT) {
4136	4174	switch (data->verdict.code) {
@@ -5761,7 +5799,7 @@ static void nft_chain_commit_update(struct nft_trans *trans) · 1624 unmodified lines
5761	5799	}
5762	5800	}
5763	5801
5764		−static void nf_tables_commit_release(struct nft_trans *trans)
	5802	+static void nft_commit_release(struct nft_trans *trans)
5765	5803	{
5766	5804	switch (trans->msg_type) {
5767	5805	case NFT_MSG_DELTABLE:
@@ -5790,6 +5828,21 @@ static void nf_tables_commit_release(struct nft_trans *trans) · 22 unmodified lines
5790	5828	kfree(trans);
5791	5829	}
5792	5830
	5831	+static void nf_tables_commit_release(struct net *net)
	5832	+{
	5833	+ struct nft_trans trans, next;
	5834	+
	5835	+ if (list_empty(&net->nft.commit_list))
	5836	+ return;
	5837	+
	5838	+ synchronize_rcu();
	5839	+
	5840	+ list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
	5841	+ list_del(&trans->list);
	5842	+ nft_commit_release(trans);
	5843	+ }
	5844	+}
	5845	+
5793	5846	static int nf_tables_commit(struct net net, struct sk_buff skb)
5794	5847	{
5795	5848	struct nft_trans trans, next;
@@ -5920,13 +5973,7 @@ static int nf_tables_commit(struct net net, struct sk_buff skb) · 124 unmodified lines
5920	5973	}
5921	5974	}
5922	5975
5923		− synchronize_rcu();
5924		−
5925		− list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
5926		− list_del(&trans->list);
5927		− nf_tables_commit_release(trans);
5928		− }
5929		−
	5976	+ nf_tables_commit_release(net);
5930	5977	nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
5931	5978
5932	5979	return 0;
@@ -6006,10 +6053,12 @@ static int nf_tables_abort(struct net net, struct sk_buff skb) · 73 unmodified lines
6006	6053	case NFT_MSG_NEWRULE:
6007	6054	trans->ctx.chain->use--;
6008	6055	list_del_rcu(&nft_trans_rule(trans)->list);
	6056	+ nft_rule_expr_deactivate(&trans->ctx, nft_trans_rule(trans));
6009	6057	break;
6010	6058	case NFT_MSG_DELRULE:
6011	6059	trans->ctx.chain->use++;
6012	6060	nft_clear(trans->ctx.net, nft_trans_rule(trans));
	6061	+ nft_rule_expr_activate(&trans->ctx, nft_trans_rule(trans));
6013	6062	nft_trans_destroy(trans);
6014	6063	break;
6015	6064	case NFT_MSG_NEWSET:
@@ -6585,7 +6634,7 @@ int __nft_release_basechain(struct nft_ctx *ctx) · 569 unmodified lines
6585	6634	list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
6586	6635	list_del(&rule->list);
6587	6636	ctx->chain->use--;
6588		− nf_tables_rule_destroy(ctx, rule);
	6637	+ nf_tables_rule_release(ctx, rule);
6589	6638	}
6590	6639	list_del(&ctx->chain->list);
6591	6640	ctx->table->use--;
@@ -6623,7 +6672,7 @@ static void __nft_release_tables(struct net *net) · 31 unmodified lines
6623	6672	list_for_each_entry_safe(rule, nr, &chain->rules, list) {
6624	6673	list_del(&rule->list);
6625	6674	chain->use--;
6626		− nf_tables_rule_destroy(&ctx, rule);
	6675	+ nf_tables_rule_release(&ctx, rule);
6627	6676	}
6628	6677	}
6629	6678	list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {

net/netfilter/nf_tables_core.c+14−7

@@ -119,15 +119,22 @@ DEFINE_STATIC_KEY_FALSE(nft_counters_enabled); · 118 unmodified lines
119	119	static noinline void nft_update_chain_stats(const struct nft_chain *chain,
120	120	const struct nft_pktinfo *pkt)
121	121	{
	122	+ struct nft_base_chain *base_chain;
122	123	struct nft_stats *stats;
123	124
124		− local_bh_disable();
125		− stats = this_cpu_ptr(rcu_dereference(nft_base_chain(chain)->stats));
126		− u64_stats_update_begin(&stats->syncp);
127		− stats->pkts++;
128		− stats->bytes += pkt->skb->len;
129		− u64_stats_update_end(&stats->syncp);
130		− local_bh_enable();
	125	+ base_chain = nft_base_chain(chain);
	126	+ if (!base_chain->stats)
	127	+ return;
	128	+
	129	+ stats = this_cpu_ptr(rcu_dereference(base_chain->stats));
	130	+ if (stats) {
	131	+ local_bh_disable();
	132	+ u64_stats_update_begin(&stats->syncp);
	133	+ stats->pkts++;
	134	+ stats->bytes += pkt->skb->len;
	135	+ u64_stats_update_end(&stats->syncp);
	136	+ local_bh_enable();
	137	+ }
131	138	}
132	139
133	140	struct nft_jumpstack {

net/netfilter/nfnetlink_acct.c+1−1

@@ -115,7 +115,7 @@ static int nfnl_acct_new(struct net net, struct sock nfnl, · 114 unmodified lines
115	115	nfacct->flags = flags;
116	116	}
117	117
118		− strncpy(nfacct->name, nla_data(tb[NFACCT_NAME]), NFACCT_NAME_MAX);
	118	+ nla_strlcpy(nfacct->name, nla_data(tb[NFACCT_NAME]), NFACCT_NAME_MAX);
119	119
120	120	if (tb[NFACCT_BYTES]) {
121	121	atomic64_set(&nfacct->bytes,

net/netfilter/nfnetlink_cthelper.c+4−3

@@ -149,8 +149,8 @@ nfnl_cthelper_expect_policy(struct nf_conntrack_expect_policy *expect_policy, · 148 unmodified lines
149	149	!tb[NFCTH_POLICY_EXPECT_TIMEOUT])
150	150	return -EINVAL;
151	151
152		− strncpy(expect_policy->name,
153		− nla_data(tb[NFCTH_POLICY_NAME]), NF_CT_HELPER_NAME_LEN);
	152	+ nla_strlcpy(expect_policy->name,
	153	+ nla_data(tb[NFCTH_POLICY_NAME]), NF_CT_HELPER_NAME_LEN);
154	154	expect_policy->max_expected =
155	155	ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX]));
156	156	if (expect_policy->max_expected > NF_CT_EXPECT_MAX_CNT)
@@ -234,7 +234,8 @@ nfnl_cthelper_create(const struct nlattr * const tb[], · 77 unmodified lines
234	234	if (ret < 0)
235	235	goto err1;
236	236
237		− strncpy(helper->name, nla_data(tb[NFCTH_NAME]), NF_CT_HELPER_NAME_LEN);
	237	+ nla_strlcpy(helper->name,
	238	+ nla_data(tb[NFCTH_NAME]), NF_CT_HELPER_NAME_LEN);
238	239	size = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN]));
239	240	if (size > FIELD_SIZEOF(struct nf_conn_help, data)) {
240	241	ret = -ENOMEM;

net/netfilter/nft_compat.c+156−45

@@ -27,14 +27,31 @@ struct nft_xt { · 26 unmodified lines
27	27	struct list_head head;
28	28	struct nft_expr_ops ops;
29	29	unsigned int refcnt;
	30	+
	31	+ /* Unlike other expressions, ops doesn't have static storage duration.
	32	+ * nft core assumes they do. We use kfree_rcu so that nft core can
	33	+ * can check expr->ops->size even after nft_compat->destroy() frees
	34	+ * the nft_xt struct that holds the ops structure.
	35	+ */
	36	+ struct rcu_head rcu_head;
	37	+};
	38	+
	39	+/* Used for matches where info is larger than X byte /
	40	+#define NFT_MATCH_LARGE_THRESH 192
	41	+
	42	+struct nft_xt_match_priv {
	43	+ void *info;
30	44	};
31	45
32		−static void nft_xt_put(struct nft_xt *xt)
	46	+static bool nft_xt_put(struct nft_xt *xt)
33	47	{
34	48	if (--xt->refcnt == 0) {
35	49	list_del(&xt->head);
36		− kfree(xt);
	50	+ kfree_rcu(xt, rcu_head);
	51	+ return true;
37	52	}
	53	+
	54	+ return false;
38	55	}
39	56
40	57	static int nft_compat_chain_validate_dependency(const char *tablename,
@@ -226,6 +243,7 @@ nft_target_init(const struct nft_ctx ctx, const struct nft_expr expr, · 185 unmodified lines
226	243	struct xt_target *target = expr->ops->data;
227	244	struct xt_tgchk_param par;
228	245	size_t size = XT_ALIGN(nla_len(tb[NFTA_TARGET_INFO]));
	246	+ struct nft_xt *nft_xt;
229	247	u16 proto = 0;
230	248	bool inv = false;
231	249	union nft_entry e = {};
@@ -236,25 +254,22 @@ nft_target_init(const struct nft_ctx ctx, const struct nft_expr expr, · 4 unmodified lines
236	254	if (ctx->nla[NFTA_RULE_COMPAT]) {
237	255	ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv);
238	256	if (ret < 0)
239		− goto err;
	257	+ return ret;
240	258	}
241	259
242	260	nft_target_set_tgchk_param(&par, ctx, target, info, &e, proto, inv);
243	261
244	262	ret = xt_check_target(&par, size, proto, inv);
245	263	if (ret < 0)
246		− goto err;
	264	+ return ret;
247	265
248	266	/* The standard target cannot be used */
249		− if (target->target == NULL) {
250		− ret = -EINVAL;
251		− goto err;
252		− }
	267	+ if (!target->target)
	268	+ return -EINVAL;
253	269
	270	+ nft_xt = container_of(expr->ops, struct nft_xt, ops);
	271	+ nft_xt->refcnt++;
254	272	return 0;
255		−err:
256		− module_put(target->me);
257		− return ret;
258	273	}
259	274
260	275	static void
@@ -271,8 +286,8 @@ nft_target_destroy(const struct nft_ctx ctx, const struct nft_expr expr) · 10 unmodified lines
271	286	if (par.target->destroy != NULL)
272	287	par.target->destroy(&par);
273	288
274		− nft_xt_put(container_of(expr->ops, struct nft_xt, ops));
275		− module_put(target->me);
	289	+ if (nft_xt_put(container_of(expr->ops, struct nft_xt, ops)))
	290	+ module_put(target->me);
276	291	}
277	292
278	293	static int nft_target_dump(struct sk_buff skb, const struct nft_expr expr)
@@ -316,11 +331,11 @@ static int nft_target_validate(const struct nft_ctx *ctx, · 37 unmodified lines
316	331	return 0;
317	332	}
318	333
319		−static void nft_match_eval(const struct nft_expr *expr,
320		− struct nft_regs *regs,
321		− const struct nft_pktinfo *pkt)
	334	+static void __nft_match_eval(const struct nft_expr *expr,
	335	+ struct nft_regs *regs,
	336	+ const struct nft_pktinfo *pkt,
	337	+ void *info)
322	338	{
323		− void *info = nft_expr_priv(expr);
324	339	struct xt_match *match = expr->ops->data;
325	340	struct sk_buff *skb = pkt->skb;
326	341	bool ret;
@@ -344,6 +359,22 @@ static void nft_match_eval(const struct nft_expr *expr, · 17 unmodified lines
344	359	}
345	360	}
346	361
	362	+static void nft_match_large_eval(const struct nft_expr *expr,
	363	+ struct nft_regs *regs,
	364	+ const struct nft_pktinfo *pkt)
	365	+{
	366	+ struct nft_xt_match_priv *priv = nft_expr_priv(expr);
	367	+
	368	+ __nft_match_eval(expr, regs, pkt, priv->info);
	369	+}
	370	+
	371	+static void nft_match_eval(const struct nft_expr *expr,
	372	+ struct nft_regs *regs,
	373	+ const struct nft_pktinfo *pkt)
	374	+{
	375	+ __nft_match_eval(expr, regs, pkt, nft_expr_priv(expr));
	376	+}
	377	+
347	378	static const struct nla_policy nft_match_policy[NFTA_MATCH_MAX + 1] = {
348	379	[NFTA_MATCH_NAME] = { .type = NLA_NUL_STRING },
349	380	[NFTA_MATCH_REV] = { .type = NLA_U32 },
@@ -404,13 +435,14 @@ static void match_compat_from_user(struct xt_match m, void in, void *out) · 54 unmodified lines
404	435	}
405	436
406	437	static int
407		−nft_match_init(const struct nft_ctx ctx, const struct nft_expr expr,
408		− const struct nlattr * const tb[])
	438	+__nft_match_init(const struct nft_ctx ctx, const struct nft_expr expr,
	439	+ const struct nlattr * const tb[],
	440	+ void *info)
409	441	{
410		− void *info = nft_expr_priv(expr);
411	442	struct xt_match *match = expr->ops->data;
412	443	struct xt_mtchk_param par;
413	444	size_t size = XT_ALIGN(nla_len(tb[NFTA_MATCH_INFO]));
	445	+ struct nft_xt *nft_xt;
414	446	u16 proto = 0;
415	447	bool inv = false;
416	448	union nft_entry e = {};
@@ -421,26 +453,50 @@ nft_match_init(const struct nft_ctx ctx, const struct nft_expr expr, · 4 unmodified lines
421	453	if (ctx->nla[NFTA_RULE_COMPAT]) {
422	454	ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv);
423	455	if (ret < 0)
424		− goto err;
	456	+ return ret;
425	457	}
426	458
427	459	nft_match_set_mtchk_param(&par, ctx, match, info, &e, proto, inv);
428	460
429	461	ret = xt_check_match(&par, size, proto, inv);
430	462	if (ret < 0)
431		− goto err;
	463	+ return ret;
432	464
	465	+ nft_xt = container_of(expr->ops, struct nft_xt, ops);
	466	+ nft_xt->refcnt++;
433	467	return 0;
434		−err:
435		− module_put(match->me);
	468	+}
	469	+
	470	+static int
	471	+nft_match_init(const struct nft_ctx ctx, const struct nft_expr expr,
	472	+ const struct nlattr * const tb[])
	473	+{
	474	+ return __nft_match_init(ctx, expr, tb, nft_expr_priv(expr));
	475	+}
	476	+
	477	+static int
	478	+nft_match_large_init(const struct nft_ctx ctx, const struct nft_expr expr,
	479	+ const struct nlattr * const tb[])
	480	+{
	481	+ struct nft_xt_match_priv *priv = nft_expr_priv(expr);
	482	+ struct xt_match *m = expr->ops->data;
	483	+ int ret;
	484	+
	485	+ priv->info = kmalloc(XT_ALIGN(m->matchsize), GFP_KERNEL);
	486	+ if (!priv->info)
	487	+ return -ENOMEM;
	488	+
	489	+ ret = __nft_match_init(ctx, expr, tb, priv->info);
	490	+ if (ret)
	491	+ kfree(priv->info);
436	492	return ret;
437	493	}
438	494
439	495	static void
440		−nft_match_destroy(const struct nft_ctx ctx, const struct nft_expr expr)
	496	+__nft_match_destroy(const struct nft_ctx ctx, const struct nft_expr expr,
	497	+ void *info)
441	498	{
442	499	struct xt_match *match = expr->ops->data;
443		− void *info = nft_expr_priv(expr);
444	500	struct xt_mtdtor_param par;
445	501
446	502	par.net = ctx->net;
@@ -450,13 +506,28 @@ nft_match_destroy(const struct nft_ctx ctx, const struct nft_expr expr) · 3 unmodified lines
450	506	if (par.match->destroy != NULL)
451	507	par.match->destroy(&par);
452	508
453		− nft_xt_put(container_of(expr->ops, struct nft_xt, ops));
454		− module_put(match->me);
	509	+ if (nft_xt_put(container_of(expr->ops, struct nft_xt, ops)))
	510	+ module_put(match->me);
455	511	}
456	512
457		−static int nft_match_dump(struct sk_buff skb, const struct nft_expr expr)
	513	+static void
	514	+nft_match_destroy(const struct nft_ctx ctx, const struct nft_expr expr)
	515	+{
	516	+ __nft_match_destroy(ctx, expr, nft_expr_priv(expr));
	517	+}
	518	+
	519	+static void
	520	+nft_match_large_destroy(const struct nft_ctx ctx, const struct nft_expr expr)
	521	+{
	522	+ struct nft_xt_match_priv *priv = nft_expr_priv(expr);
	523	+
	524	+ __nft_match_destroy(ctx, expr, priv->info);
	525	+ kfree(priv->info);
	526	+}
	527	+
	528	+static int __nft_match_dump(struct sk_buff skb, const struct nft_expr expr,
	529	+ void *info)
458	530	{
459		− void *info = nft_expr_priv(expr);
460	531	struct xt_match *match = expr->ops->data;
461	532
462	533	if (nla_put_string(skb, NFTA_MATCH_NAME, match->name) \|\|
@@ -470,6 +541,18 @@ nla_put_failure: · 7 unmodified lines
470	541	return -1;
471	542	}
472	543
	544	+static int nft_match_dump(struct sk_buff skb, const struct nft_expr expr)
	545	+{
	546	+ return __nft_match_dump(skb, expr, nft_expr_priv(expr));
	547	+}
	548	+
	549	+static int nft_match_large_dump(struct sk_buff skb, const struct nft_expr e)
	550	+{
	551	+ struct nft_xt_match_priv *priv = nft_expr_priv(e);
	552	+
	553	+ return __nft_match_dump(skb, e, priv->info);
	554	+}
	555	+
473	556	static int nft_match_validate(const struct nft_ctx *ctx,
474	557	const struct nft_expr *expr,
475	558	const struct nft_data **data)
@@ -637,6 +720,7 @@ nft_match_select_ops(const struct nft_ctx *ctx, · 161 unmodified lines
637	720	{
638	721	struct nft_xt *nft_match;
639	722	struct xt_match *match;
	723	+ unsigned int matchsize;
640	724	char *mt_name;
641	725	u32 rev, family;
642	726	int err;
@@ -654,13 +738,8 @@ nft_match_select_ops(const struct nft_ctx *ctx, · 11 unmodified lines
654	738	list_for_each_entry(nft_match, &nft_match_list, head) {
655	739	struct xt_match *match = nft_match->ops.data;
656	740
657		− if (nft_match_cmp(match, mt_name, rev, family)) {
658		− if (!try_module_get(match->me))
659		− return ERR_PTR(-ENOENT);
660		−
661		− nft_match->refcnt++;
	741	+ if (nft_match_cmp(match, mt_name, rev, family))
662	742	return &nft_match->ops;
663		− }
664	743	}
665	744
666	745	match = xt_request_find_match(family, mt_name, rev);
@@ -679,9 +758,8 @@ nft_match_select_ops(const struct nft_ctx *ctx, · 12 unmodified lines
679	758	goto err;
680	759	}
681	760
682		− nft_match->refcnt = 1;
	761	+ nft_match->refcnt = 0;
683	762	nft_match->ops.type = &nft_match_type;
684		− nft_match->ops.size = NFT_EXPR_SIZE(XT_ALIGN(match->matchsize));
685	763	nft_match->ops.eval = nft_match_eval;
686	764	nft_match->ops.init = nft_match_init;
687	765	nft_match->ops.destroy = nft_match_destroy;
@@ -689,6 +767,18 @@ nft_match_select_ops(const struct nft_ctx *ctx, · 1 unmodified line
689	767	nft_match->ops.validate = nft_match_validate;
690	768	nft_match->ops.data = match;
691	769
	770	+ matchsize = NFT_EXPR_SIZE(XT_ALIGN(match->matchsize));
	771	+ if (matchsize > NFT_MATCH_LARGE_THRESH) {
	772	+ matchsize = NFT_EXPR_SIZE(sizeof(struct nft_xt_match_priv));
	773	+
	774	+ nft_match->ops.eval = nft_match_large_eval;
	775	+ nft_match->ops.init = nft_match_large_init;
	776	+ nft_match->ops.destroy = nft_match_large_destroy;
	777	+ nft_match->ops.dump = nft_match_large_dump;
	778	+ }
	779	+
	780	+ nft_match->ops.size = matchsize;
	781	+
692	782	list_add(&nft_match->head, &nft_match_list);
693	783
694	784	return &nft_match->ops;
@@ -739,13 +829,8 @@ nft_target_select_ops(const struct nft_ctx *ctx, · 44 unmodified lines
739	829	list_for_each_entry(nft_target, &nft_target_list, head) {
740	830	struct xt_target *target = nft_target->ops.data;
741	831
742		− if (nft_target_cmp(target, tg_name, rev, family)) {
743		− if (!try_module_get(target->me))
744		− return ERR_PTR(-ENOENT);
745		−
746		− nft_target->refcnt++;
	832	+ if (nft_target_cmp(target, tg_name, rev, family))
747	833	return &nft_target->ops;
748		− }
749	834	}
750	835
751	836	target = xt_request_find_target(family, tg_name, rev);
@@ -764,7 +849,7 @@ nft_target_select_ops(const struct nft_ctx *ctx, · 12 unmodified lines
764	849	goto err;
765	850	}
766	851
767		− nft_target->refcnt = 1;
	852	+ nft_target->refcnt = 0;
768	853	nft_target->ops.type = &nft_target_type;
769	854	nft_target->ops.size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize));
770	855	nft_target->ops.init = nft_target_init;
@@ -823,6 +908,32 @@ err_match: · 52 unmodified lines
823	908
824	909	static void __exit nft_compat_module_exit(void)
825	910	{
	911	+ struct nft_xt xt, next;
	912	+
	913	+ /* list should be empty here, it can be non-empty only in case there
	914	+ * was an error that caused nft_xt expr to not be initialized fully
	915	+ * and noone else requested the same expression later.
	916	+ *
	917	+ * In this case, the lists contain 0-refcount entries that still
	918	+ * hold module reference.
	919	+ */
	920	+ list_for_each_entry_safe(xt, next, &nft_target_list, head) {
	921	+ struct xt_target *target = xt->ops.data;
	922	+
	923	+ if (WARN_ON_ONCE(xt->refcnt))
	924	+ continue;
	925	+ module_put(target->me);
	926	+ kfree(xt);
	927	+ }
	928	+
	929	+ list_for_each_entry_safe(xt, next, &nft_match_list, head) {
	930	+ struct xt_match *match = xt->ops.data;
	931	+
	932	+ if (WARN_ON_ONCE(xt->refcnt))
	933	+ continue;
	934	+ module_put(match->me);
	935	+ kfree(xt);
	936	+ }
826	937	nfnetlink_subsys_unregister(&nfnl_compat_subsys);
827	938	nft_unregister_expr(&nft_target_type);
828	939	nft_unregister_expr(&nft_match_type);

net/netfilter/nft_immediate.c+12−3

@@ -69,8 +69,16 @@ err1: · 68 unmodified lines
69	69	return err;
70	70	}
71	71
72		−static void nft_immediate_destroy(const struct nft_ctx *ctx,
73		− const struct nft_expr *expr)
	72	+static void nft_immediate_activate(const struct nft_ctx *ctx,
	73	+ const struct nft_expr *expr)
	74	+{
	75	+ const struct nft_immediate_expr *priv = nft_expr_priv(expr);
	76	+
	77	+ return nft_data_hold(&priv->data, nft_dreg_to_type(priv->dreg));
	78	+}
	79	+
	80	+static void nft_immediate_deactivate(const struct nft_ctx *ctx,
	81	+ const struct nft_expr *expr)
74	82	{
75	83	const struct nft_immediate_expr *priv = nft_expr_priv(expr);
76	84
@@ -108,7 +116,8 @@ static const struct nft_expr_ops nft_imm_ops = { · 31 unmodified lines
108	116	.size = NFT_EXPR_SIZE(sizeof(struct nft_immediate_expr)),
109	117	.eval = nft_immediate_eval,
110	118	.init = nft_immediate_init,
111		− .destroy = nft_immediate_destroy,
	119	+ .activate = nft_immediate_activate,
	120	+ .deactivate = nft_immediate_deactivate,
112	121	.dump = nft_immediate_dump,
113	122	.validate = nft_immediate_validate,
114	123	};

net/netfilter/x_tables.c+6−0

@@ -183,6 +183,9 @@ struct xt_match xt_find_match(u8 af, const char name, u8 revision) · 182 unmodified lines
183	183	struct xt_match *m;
184	184	int err = -ENOENT;
185	185
	186	+ if (strnlen(name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN)
	187	+ return ERR_PTR(-EINVAL);
	188	+
186	189	mutex_lock(&xt[af].mutex);
187	190	list_for_each_entry(m, &xt[af].match, list) {
188	191	if (strcmp(m->name, name) == 0) {
@@ -229,6 +232,9 @@ struct xt_target xt_find_target(u8 af, const char name, u8 revision) · 40 unmodified lines
229	232	struct xt_target *t;
230	233	int err = -ENOENT;
231	234
	235	+ if (strnlen(name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN)
	236	+ return ERR_PTR(-EINVAL);
	237	+
232	238	mutex_lock(&xt[af].mutex);
233	239	list_for_each_entry(t, &xt[af].target, list) {
234	240	if (strcmp(t->name, name) == 0) {

net/packet/af_packet.c+3−1

@@ -2903,13 +2903,15 @@ static int packet_snd(struct socket sock, struct msghdr msg, size_t len) · 2902 unmodified lines
2903	2903	if (skb == NULL)
2904	2904	goto out_unlock;
2905	2905
2906		− skb_set_network_header(skb, reserve);
	2906	+ skb_reset_network_header(skb);
2907	2907
2908	2908	err = -EINVAL;
2909	2909	if (sock->type == SOCK_DGRAM) {
2910	2910	offset = dev_hard_header(skb, dev, ntohs(proto), addr, NULL, len);
2911	2911	if (unlikely(offset < 0))
2912	2912	goto out_free;
	2913	+ } else if (reserve) {
	2914	+ skb_push(skb, reserve);
2913	2915	}
2914	2916
2915	2917	/* Returns -EFAULT on error */

net/sched/act_vlan.c+2−0

@@ -161,6 +161,8 @@ static int tcf_vlan_init(struct net net, struct nlattr nla, · 160 unmodified lines
161	161	case htons(ETH_P_8021AD):
162	162	break;
163	163	default:
	164	+ if (exists)
	165	+ tcf_idr_release(*a, bind);
164	166	return -EPROTONOSUPPORT;
165	167	}
166	168	} else {

net/sched/sch_red.c+3−2

@@ -222,10 +222,11 @@ static int red_change(struct Qdisc sch, struct nlattr opt, · 221 unmodified lines
222	222	extack);
223	223	if (IS_ERR(child))
224	224	return PTR_ERR(child);
225		− }
226	225
227		− if (child != &noop_qdisc)
	226	+ /* child is fifo, no need to check for noop_qdisc */
228	227	qdisc_hash_add(child, true);
	228	+ }
	229	+
229	230	sch_tree_lock(sch);
230	231	q->flags = ctl->flags;
231	232	q->limit = ctl->limit;

net/sched/sch_tbf.c+3−2

@@ -383,6 +383,9 @@ static int tbf_change(struct Qdisc sch, struct nlattr opt, · 382 unmodified lines
383	383	err = PTR_ERR(child);
384	384	goto done;
385	385	}
	386	+
	387	+ /* child is fifo, no need to check for noop_qdisc */
	388	+ qdisc_hash_add(child, true);
386	389	}
387	390
388	391	sch_tree_lock(sch);
@@ -391,8 +394,6 @@ static int tbf_change(struct Qdisc sch, struct nlattr opt, · 2 unmodified lines
391	394	q->qdisc->qstats.backlog);
392	395	qdisc_destroy(q->qdisc);
393	396	q->qdisc = child;
394		− if (child != &noop_qdisc)
395		− qdisc_hash_add(child, true);
396	397	}
397	398	q->limit = qopt->limit;
398	399	if (tb[TCA_TBF_PBURST])

net/smc/smc_pnet.c+40−31

@@ -245,40 +245,45 @@ out: · 244 unmodified lines
245	245	static int smc_pnet_fill_entry(struct net net, struct smc_pnetentry pnetelem,
246	246	struct nlattr *tb[])
247	247	{
248		− char string, ibname = NULL;
249		− int rc = 0;
	248	+ char string, ibname;
	249	+ int rc;
250	250
251	251	memset(pnetelem, 0, sizeof(*pnetelem));
252	252	INIT_LIST_HEAD(&pnetelem->list);
253		− if (tb[SMC_PNETID_NAME]) {
254		− string = (char *)nla_data(tb[SMC_PNETID_NAME]);
255		− if (!smc_pnetid_valid(string, pnetelem->pnet_name)) {
256		− rc = -EINVAL;
257		− goto error;
258		− }
259		− }
260		− if (tb[SMC_PNETID_ETHNAME]) {
261		− string = (char *)nla_data(tb[SMC_PNETID_ETHNAME]);
262		− pnetelem->ndev = dev_get_by_name(net, string);
263		− if (!pnetelem->ndev)
264		− return -ENOENT;
265		− }
266		− if (tb[SMC_PNETID_IBNAME]) {
267		− ibname = (char *)nla_data(tb[SMC_PNETID_IBNAME]);
268		− ibname = strim(ibname);
269		− pnetelem->smcibdev = smc_pnet_find_ib(ibname);
270		− if (!pnetelem->smcibdev) {
271		− rc = -ENOENT;
272		− goto error;
273		− }
274		− }
275		− if (tb[SMC_PNETID_IBPORT]) {
276		− pnetelem->ib_port = nla_get_u8(tb[SMC_PNETID_IBPORT]);
277		− if (pnetelem->ib_port > SMC_MAX_PORTS) {
278		− rc = -EINVAL;
279		− goto error;
280		− }
281		− }
	253	+
	254	+ rc = -EINVAL;
	255	+ if (!tb[SMC_PNETID_NAME])
	256	+ goto error;
	257	+ string = (char *)nla_data(tb[SMC_PNETID_NAME]);
	258	+ if (!smc_pnetid_valid(string, pnetelem->pnet_name))
	259	+ goto error;
	260	+
	261	+ rc = -EINVAL;
	262	+ if (!tb[SMC_PNETID_ETHNAME])
	263	+ goto error;
	264	+ rc = -ENOENT;
	265	+ string = (char *)nla_data(tb[SMC_PNETID_ETHNAME]);
	266	+ pnetelem->ndev = dev_get_by_name(net, string);
	267	+ if (!pnetelem->ndev)
	268	+ goto error;
	269	+
	270	+ rc = -EINVAL;
	271	+ if (!tb[SMC_PNETID_IBNAME])
	272	+ goto error;
	273	+ rc = -ENOENT;
	274	+ ibname = (char *)nla_data(tb[SMC_PNETID_IBNAME]);
	275	+ ibname = strim(ibname);
	276	+ pnetelem->smcibdev = smc_pnet_find_ib(ibname);
	277	+ if (!pnetelem->smcibdev)
	278	+ goto error;
	279	+
	280	+ rc = -EINVAL;
	281	+ if (!tb[SMC_PNETID_IBPORT])
	282	+ goto error;
	283	+ pnetelem->ib_port = nla_get_u8(tb[SMC_PNETID_IBPORT]);
	284	+ if (pnetelem->ib_port < 1 \|\| pnetelem->ib_port > SMC_MAX_PORTS)
	285	+ goto error;
	286	+
282	287	return 0;
283	288
284	289	error:
@@ -307,6 +312,8 @@ static int smc_pnet_get(struct sk_buff skb, struct genl_info info) · 22 unmodified lines
307	312	void *hdr;
308	313	int rc;
309	314
	315	+ if (!info->attrs[SMC_PNETID_NAME])
	316	+ return -EINVAL;
310	317	pnetelem = smc_pnet_find_pnetid(
311	318	(char *)nla_data(info->attrs[SMC_PNETID_NAME]));
312	319	if (!pnetelem)
@@ -359,6 +366,8 @@ static int smc_pnet_add(struct sk_buff skb, struct genl_info info) · 46 unmodified lines
359	366
360	367	static int smc_pnet_del(struct sk_buff skb, struct genl_info info)
361	368	{
	369	+ if (!info->attrs[SMC_PNETID_NAME])
	370	+ return -EINVAL;
362	371	return smc_pnet_remove_by_pnetid(
363	372	(char *)nla_data(info->attrs[SMC_PNETID_NAME]));
364	373	}

net/tls/tls_sw.c+4−5

@@ -680,7 +680,6 @@ static int decrypt_skb(struct sock sk, struct sk_buff skb, · 679 unmodified lines
680	680	struct scatterlist *sgin = &sgin_arr[0];
681	681	struct strp_msg *rxm = strp_msg(skb);
682	682	int ret, nsg = ARRAY_SIZE(sgin_arr);
683		− char aad_recv[TLS_AAD_SPACE_SIZE];
684	683	struct sk_buff *unused;
685	684
686	685	ret = skb_copy_bits(skb, rxm->offset + TLS_HEADER_SIZE,
@@ -698,13 +697,13 @@ static int decrypt_skb(struct sock sk, struct sk_buff skb, · 11 unmodified lines
698	697	}
699	698
700	699	sg_init_table(sgin, nsg);
701		− sg_set_buf(&sgin[0], aad_recv, sizeof(aad_recv));
	700	+ sg_set_buf(&sgin[0], ctx->rx_aad_ciphertext, TLS_AAD_SPACE_SIZE);
702	701
703	702	nsg = skb_to_sgvec(skb, &sgin[1],
704	703	rxm->offset + tls_ctx->rx.prepend_size,
705	704	rxm->full_len - tls_ctx->rx.prepend_size);
706	705
707		− tls_make_aad(aad_recv,
	706	+ tls_make_aad(ctx->rx_aad_ciphertext,
708	707	rxm->full_len - tls_ctx->rx.overhead_size,
709	708	tls_ctx->rx.rec_seq,
710	709	tls_ctx->rx.rec_seq_size,
@@ -803,12 +802,12 @@ int tls_sw_recvmsg(struct sock *sk, · 92 unmodified lines
803	802	if (to_copy <= len && page_count < MAX_SKB_FRAGS &&
804	803	likely(!(flags & MSG_PEEK))) {
805	804	struct scatterlist sgin[MAX_SKB_FRAGS + 1];
806		− char unused[21];
807	805	int pages = 0;
808	806
809	807	zc = true;
810	808	sg_init_table(sgin, MAX_SKB_FRAGS + 1);
811		− sg_set_buf(&sgin[0], unused, 13);
	809	+ sg_set_buf(&sgin[0], ctx->rx_aad_plaintext,
	810	+ TLS_AAD_SPACE_SIZE);
812	811
813	812	err = zerocopy_from_iter(sk, &msg->msg_iter,
814	813	to_copy, &pages,

tools/lib/bpf/libbpf.c+1−1

@@ -2035,7 +2035,7 @@ int bpf_prog_load_xattr(const struct bpf_prog_load_attr *attr, · 2034 unmodified lines
2035	2035	return -EINVAL;
2036	2036
2037	2037	obj = bpf_object__open(attr->file);
2038		− if (IS_ERR(obj))
	2038	+ if (IS_ERR_OR_NULL(obj))
2039	2039	return -ENOENT;
2040	2040
2041	2041	bpf_object__for_each_program(prog, obj) {

tools/testing/selftests/bpf/test_verifier.c+5−0

@@ -11713,6 +11713,11 @@ static void get_unpriv_disabled() · 11712 unmodified lines
11713	11713	FILE *fd;
11714	11714
11715	11715	fd = fopen("/proc/sys/"UNPRIV_SYSCTL, "r");
	11716	+ if (!fd) {
	11717	+ perror("fopen /proc/sys/"UNPRIV_SYSCTL);
	11718	+ unpriv_disabled = true;
	11719	+ return;
	11720	+ }
11716	11721	if (fgets(buf, 2, fd) == buf && atoi(buf))
11717	11722	unpriv_disabled = true;
11718	11723	fclose(fd);