lael-labs/linux

Documentation/devicetree/bindings/net/micrel-ksz90x1.txt+7−0

@@ -57,6 +57,13 @@ KSZ9031: · 56 unmodified lines
57	- txd2-skew-ps : Skew control of TX data 2 pad	57	- txd2-skew-ps : Skew control of TX data 2 pad
58	- txd3-skew-ps : Skew control of TX data 3 pad	58	- txd3-skew-ps : Skew control of TX data 3 pad
59		59
		60	- micrel,force-master:
		61	Boolean, force phy to master mode. Only set this option if the phy
		62	reference clock provided at CLK125_NDO pin is used as MAC reference
		63	clock because the clock jitter in slave mode is to high (errata#2).
		64	Attention: The link partner must be configurable as slave otherwise
		65	no link will be established.
		66
60	Examples:	67	Examples:
61		68
62	mdio {	69	mdio {

drivers/net/dsa/bcm_sf2_cfp.c+22−14

 	/* Locate the first rule available */
 	if (fs->location == RX_CLS_LOC_ANY)
 		rule_index = find_first_zero_bit(priv->cfp.used,
-						 bcm_sf2_cfp_rule_size(priv));
+						 priv->num_cfp_rules);
 	else
 		rule_index = fs->location;
+	if (rule_index > bcm_sf2_cfp_rule_size(priv))
+		return -ENOSPC;
 	layout = &udf_tcpip4_layout;
 	/* We only use one UDF slice for now */
 	slice_num = bcm_sf2_get_slice_number(layout, 0);
 	 * first half because the HW search is by incrementing addresses.
 	 */
 	if (fs->location == RX_CLS_LOC_ANY)
-		rule_index[0] = find_first_zero_bit(priv->cfp.used,
+		rule_index[1] = find_first_zero_bit(priv->cfp.used,
-						    bcm_sf2_cfp_rule_size(priv));
+						    priv->num_cfp_rules);
 	else
-		rule_index[0] = fs->location;
+		rule_index[1] = fs->location;
+	if (rule_index[1] > bcm_sf2_cfp_rule_size(priv))
+		return -ENOSPC;
 	/* Flag it as used (cleared on error path) such that we can immediately
 	 * obtain a second one to chain from.
 	 */
-	set_bit(rule_index[0], priv->cfp.used);
+	set_bit(rule_index[1], priv->cfp.used);
-	rule_index[1] = find_first_zero_bit(priv->cfp.used,
+	rule_index[0] = find_first_zero_bit(priv->cfp.used,
-					    bcm_sf2_cfp_rule_size(priv));
+					    priv->num_cfp_rules);
-	if (rule_index[1] > bcm_sf2_cfp_rule_size(priv)) {
+	if (rule_index[0] > bcm_sf2_cfp_rule_size(priv)) {
 		ret = -ENOSPC;
 		goto out_err;
 	}
 	/* Flag the second half rule as being used now, return it as the
 	 * location, and flag it as unique while dumping rules
 	 */
-	set_bit(rule_index[1], priv->cfp.used);
+	set_bit(rule_index[0], priv->cfp.used);
 	set_bit(rule_index[1], priv->cfp.unique);
 	fs->location = rule_index[1];
 	return ret;
 out_err:
-	clear_bit(rule_index[0], priv->cfp.used);
+	clear_bit(rule_index[1], priv->cfp.used);
 	return ret;
 }
 	int ret;
 	u32 reg;
-	/* Refuse deletion of unused rules, and the default reserved rule */
-	if (!test_bit(loc, priv->cfp.used) || loc == 0)
-		return -EINVAL;
 	/* Indicate which rule we want to read */
 	bcm_sf2_cfp_rule_addr_set(priv, loc);
 	u32 next_loc = 0;
 	int ret;
+	/* Refuse deleting unused rules, and those that are not unique since
+	 * that could leave IPv6 rules with one of the chained rule in the
+	 * table.
+	 */
+	if (!test_bit(loc, priv->cfp.unique) || loc == 0)
+		return -EINVAL;
 	ret = bcm_sf2_cfp_rule_del_one(priv, port, loc, &next_loc);
 	if (ret)
 		return ret;

drivers/net/ethernet/3com/3c59x.c+51−53

 	vp->mii.reg_num_mask = 0x1f;
 	/* Makes sure rings are at least 16 byte aligned. */
-	vp->rx_ring = pci_alloc_consistent(pdev, sizeof(struct boom_rx_desc) * RX_RING_SIZE
+	vp->rx_ring = dma_alloc_coherent(gendev, sizeof(struct boom_rx_desc) * RX_RING_SIZE
 					   + sizeof(struct boom_tx_desc) * TX_RING_SIZE,
-					   &vp->rx_ring_dma);
+					   &vp->rx_ring_dma, GFP_KERNEL);
 	retval = -ENOMEM;
 	if (!vp->rx_ring)
 		goto free_device;
 		return 0;
 free_ring:
-	pci_free_consistent(pdev,
+	dma_free_coherent(&pdev->dev,
-						sizeof(struct boom_rx_desc) * RX_RING_SIZE
+		sizeof(struct boom_rx_desc) * RX_RING_SIZE +
-							+ sizeof(struct boom_tx_desc) * TX_RING_SIZE,
+		sizeof(struct boom_tx_desc) * TX_RING_SIZE,
-						vp->rx_ring,
+		vp->rx_ring, vp->rx_ring_dma);
-						vp->rx_ring_dma);
 free_device:
 	free_netdev(dev);
 	pr_err(PFX "vortex_probe1 fails.  Returns %d\n", retval);
 				break;			/* Bad news!  */
 			skb_reserve(skb, NET_IP_ALIGN);	/* Align IP on 16 byte boundaries */
-			dma = pci_map_single(VORTEX_PCI(vp), skb->data,
+			dma = dma_map_single(vp->gendev, skb->data,
-					     PKT_BUF_SZ, PCI_DMA_FROMDEVICE);
+					     PKT_BUF_SZ, DMA_FROM_DEVICE);
-			if (dma_mapping_error(&VORTEX_PCI(vp)->dev, dma))
+			if (dma_mapping_error(vp->gendev, dma))
 				break;
 			vp->rx_ring[i].addr = cpu_to_le32(dma);
 		}
 	if (vp->bus_master) {
 		/* Set the bus-master controller to transfer the packet. */
 		int len = (skb->len + 3) & ~3;
-		vp->tx_skb_dma = pci_map_single(VORTEX_PCI(vp), skb->data, len,
+		vp->tx_skb_dma = dma_map_single(vp->gendev, skb->data, len,
-						PCI_DMA_TODEVICE);
+						DMA_TO_DEVICE);
-		if (dma_mapping_error(&VORTEX_PCI(vp)->dev, vp->tx_skb_dma)) {
+		if (dma_mapping_error(vp->gendev, vp->tx_skb_dma)) {
 			dev_kfree_skb_any(skb);
 			dev->stats.tx_dropped++;
 			return NETDEV_TX_OK;
 			vp->tx_ring[entry].status = cpu_to_le32(skb->len | TxIntrUploaded | AddTCPChksum | AddUDPChksum);
 	if (!skb_shinfo(skb)->nr_frags) {
-		dma_addr = pci_map_single(VORTEX_PCI(vp), skb->data, skb->len,
+		dma_addr = dma_map_single(vp->gendev, skb->data, skb->len,
-					  PCI_DMA_TODEVICE);
+					  DMA_TO_DEVICE);
-		if (dma_mapping_error(&VORTEX_PCI(vp)->dev, dma_addr))
+		if (dma_mapping_error(vp->gendev, dma_addr))
 			goto out_dma_err;
 		vp->tx_ring[entry].frag[0].addr = cpu_to_le32(dma_addr);
 	} else {
 		int i;
-		dma_addr = pci_map_single(VORTEX_PCI(vp), skb->data,
+		dma_addr = dma_map_single(vp->gendev, skb->data,
-					  skb_headlen(skb), PCI_DMA_TODEVICE);
+					  skb_headlen(skb), DMA_TO_DEVICE);
-		if (dma_mapping_error(&VORTEX_PCI(vp)->dev, dma_addr))
+		if (dma_mapping_error(vp->gendev, dma_addr))
 			goto out_dma_err;
 		vp->tx_ring[entry].frag[0].addr = cpu_to_le32(dma_addr);
 		for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
 			skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
-			dma_addr = skb_frag_dma_map(&VORTEX_PCI(vp)->dev, frag,
+			dma_addr = skb_frag_dma_map(vp->gendev, frag,
 						    0,
 						    frag->size,
 						    DMA_TO_DEVICE);
-			if (dma_mapping_error(&VORTEX_PCI(vp)->dev, dma_addr)) {
+			if (dma_mapping_error(vp->gendev, dma_addr)) {
 				for(i = i-1; i >= 0; i--)
-					dma_unmap_page(&VORTEX_PCI(vp)->dev,
+					dma_unmap_page(vp->gendev,
 						       le32_to_cpu(vp->tx_ring[entry].frag[i+1].addr),
 						       le32_to_cpu(vp->tx_ring[entry].frag[i+1].length),
 						       DMA_TO_DEVICE);
-				pci_unmap_single(VORTEX_PCI(vp),
+				dma_unmap_single(vp->gendev,
 						 le32_to_cpu(vp->tx_ring[entry].frag[0].addr),
 						 le32_to_cpu(vp->tx_ring[entry].frag[0].length),
-						 PCI_DMA_TODEVICE);
+						 DMA_TO_DEVICE);
 				goto out_dma_err;
 			}
 		}
 	}
 #else
-	dma_addr = pci_map_single(VORTEX_PCI(vp), skb->data, skb->len, PCI_DMA_TODEVICE);
+	dma_addr = dma_map_single(vp->gendev, skb->data, skb->len, DMA_TO_DEVICE);
-	if (dma_mapping_error(&VORTEX_PCI(vp)->dev, dma_addr))
+	if (dma_mapping_error(vp->gendev, dma_addr))
 		goto out_dma_err;
 	vp->tx_ring[entry].addr = cpu_to_le32(dma_addr);
 	vp->tx_ring[entry].length = cpu_to_le32(skb->len | LAST_FRAG);
 out:
 	return NETDEV_TX_OK;
 out_dma_err:
-	dev_err(&VORTEX_PCI(vp)->dev, "Error mapping dma buffer\n");
+	dev_err(vp->gendev, "Error mapping dma buffer\n");
 	goto out;
 }
 		if (status & DMADone) {
 			if (ioread16(ioaddr + Wn7_MasterStatus) & 0x1000) {
 				iowrite16(0x1000, ioaddr + Wn7_MasterStatus); /* Ack the event. */
-				pci_unmap_single(VORTEX_PCI(vp), vp->tx_skb_dma, (vp->tx_skb->len + 3) & ~3, PCI_DMA_TODEVICE);
+				dma_unmap_single(vp->gendev, vp->tx_skb_dma, (vp->tx_skb->len + 3) & ~3, DMA_TO_DEVICE);
 				pkts_compl++;
 				bytes_compl += vp->tx_skb->len;
 				dev_kfree_skb_irq(vp->tx_skb); /* Release the transferred buffer */
 					struct sk_buff *skb = vp->tx_skbuff[entry];
 #if DO_ZEROCOPY
 					int i;
-					pci_unmap_single(VORTEX_PCI(vp),
+					dma_unmap_single(vp->gendev,
 							le32_to_cpu(vp->tx_ring[entry].frag[0].addr),
 							le32_to_cpu(vp->tx_ring[entry].frag[0].length)&0xFFF,
-							PCI_DMA_TODEVICE);
+							DMA_TO_DEVICE);
 					for (i=1; i<=skb_shinfo(skb)->nr_frags; i++)
-							pci_unmap_page(VORTEX_PCI(vp),
+							dma_unmap_page(vp->gendev,
 											 le32_to_cpu(vp->tx_ring[entry].frag[i].addr),
 											 le32_to_cpu(vp->tx_ring[entry].frag[i].length)&0xFFF,
-											 PCI_DMA_TODEVICE);
+											 DMA_TO_DEVICE);
 #else
-					pci_unmap_single(VORTEX_PCI(vp),
+					dma_unmap_single(vp->gendev,
-						le32_to_cpu(vp->tx_ring[entry].addr), skb->len, PCI_DMA_TODEVICE);
+						le32_to_cpu(vp->tx_ring[entry].addr), skb->len, DMA_TO_DEVICE);
 #endif
 					pkts_compl++;
 					bytes_compl += skb->len;
 				/* 'skb_put()' points to the start of sk_buff data area. */
 				if (vp->bus_master &&
 					! (ioread16(ioaddr + Wn7_MasterStatus) & 0x8000)) {
-					dma_addr_t dma = pci_map_single(VORTEX_PCI(vp), skb_put(skb, pkt_len),
+					dma_addr_t dma = dma_map_single(vp->gendev, skb_put(skb, pkt_len),
-									   pkt_len, PCI_DMA_FROMDEVICE);
+									   pkt_len, DMA_FROM_DEVICE);
 					iowrite32(dma, ioaddr + Wn7_MasterAddr);
 					iowrite16((skb->len + 3) & ~3, ioaddr + Wn7_MasterLen);
 					iowrite16(StartDMAUp, ioaddr + EL3_CMD);
 					while (ioread16(ioaddr + Wn7_MasterStatus) & 0x8000)
 						;
-					pci_unmap_single(VORTEX_PCI(vp), dma, pkt_len, PCI_DMA_FROMDEVICE);
+					dma_unmap_single(vp->gendev, dma, pkt_len, DMA_FROM_DEVICE);
 				} else {
 					ioread32_rep(ioaddr + RX_FIFO,
 					             skb_put(skb, pkt_len),
 			if (pkt_len < rx_copybreak &&
 			    (skb = netdev_alloc_skb(dev, pkt_len + 2)) != NULL) {
 				skb_reserve(skb, 2);	/* Align IP on 16 byte boundaries */
-				pci_dma_sync_single_for_cpu(VORTEX_PCI(vp), dma, PKT_BUF_SZ, PCI_DMA_FROMDEVICE);
+				dma_sync_single_for_cpu(vp->gendev, dma, PKT_BUF_SZ, DMA_FROM_DEVICE);
 				/* 'skb_put()' points to the start of sk_buff data area. */
 				skb_put_data(skb, vp->rx_skbuff[entry]->data,
 					     pkt_len);
-				pci_dma_sync_single_for_device(VORTEX_PCI(vp), dma, PKT_BUF_SZ, PCI_DMA_FROMDEVICE);
+				dma_sync_single_for_device(vp->gendev, dma, PKT_BUF_SZ, DMA_FROM_DEVICE);
 				vp->rx_copy++;
 			} else {
 				/* Pre-allocate the replacement skb.  If it or its
 					dev->stats.rx_dropped++;
 					goto clear_complete;
 				}
-				newdma = pci_map_single(VORTEX_PCI(vp), newskb->data,
+				newdma = dma_map_single(vp->gendev, newskb->data,
-							PKT_BUF_SZ, PCI_DMA_FROMDEVICE);
+							PKT_BUF_SZ, DMA_FROM_DEVICE);
-				if (dma_mapping_error(&VORTEX_PCI(vp)->dev, newdma)) {
+				if (dma_mapping_error(vp->gendev, newdma)) {
 					dev->stats.rx_dropped++;
 					consume_skb(newskb);
 					goto clear_complete;
 				vp->rx_skbuff[entry] = newskb;
 				vp->rx_ring[entry].addr = cpu_to_le32(newdma);
 				skb_put(skb, pkt_len);
-				pci_unmap_single(VORTEX_PCI(vp), dma, PKT_BUF_SZ, PCI_DMA_FROMDEVICE);
+				dma_unmap_single(vp->gendev, dma, PKT_BUF_SZ, DMA_FROM_DEVICE);
 				vp->rx_nocopy++;
 			}
 			skb->protocol = eth_type_trans(skb, dev);
 	if (vp->full_bus_master_rx) { /* Free Boomerang bus master Rx buffers. */
 		for (i = 0; i < RX_RING_SIZE; i++)
 			if (vp->rx_skbuff[i]) {
-				pci_unmap_single(	VORTEX_PCI(vp), le32_to_cpu(vp->rx_ring[i].addr),
+				dma_unmap_single(vp->gendev, le32_to_cpu(vp->rx_ring[i].addr),
-									PKT_BUF_SZ, PCI_DMA_FROMDEVICE);
+									PKT_BUF_SZ, DMA_FROM_DEVICE);
 				dev_kfree_skb(vp->rx_skbuff[i]);
 				vp->rx_skbuff[i] = NULL;
 			}
 				int k;
 				for (k=0; k<=skb_shinfo(skb)->nr_frags; k++)
-						pci_unmap_single(VORTEX_PCI(vp),
+						dma_unmap_single(vp->gendev,
 										 le32_to_cpu(vp->tx_ring[i].frag[k].addr),
 										 le32_to_cpu(vp->tx_ring[i].frag[k].length)&0xFFF,
-										 PCI_DMA_TODEVICE);
+										 DMA_TO_DEVICE);
 #else
-				pci_unmap_single(VORTEX_PCI(vp), le32_to_cpu(vp->tx_ring[i].addr), skb->len, PCI_DMA_TODEVICE);
+				dma_unmap_single(vp->gendev, le32_to_cpu(vp->tx_ring[i].addr), skb->len, DMA_TO_DEVICE);
 #endif
 				dev_kfree_skb(skb);
 				vp->tx_skbuff[i] = NULL;
 	pci_iounmap(pdev, vp->ioaddr);
-	pci_free_consistent(pdev,
+	dma_free_coherent(&pdev->dev,
-						sizeof(struct boom_rx_desc) * RX_RING_SIZE
+			sizeof(struct boom_rx_desc) * RX_RING_SIZE +
-							+ sizeof(struct boom_tx_desc) * TX_RING_SIZE,
+			sizeof(struct boom_tx_desc) * TX_RING_SIZE,
-						vp->rx_ring,
+			vp->rx_ring, vp->rx_ring_dma);
-						vp->rx_ring_dma);
 	pci_release_regions(pdev);

drivers/net/ethernet/8390/ne.c+3−1

 #define NESM_START_PG	0x40	/* First page of TX buffer */
 #define NESM_STOP_PG	0x80	/* Last page +1 of RX ring */
-#if defined(CONFIG_ATARI)	/* 8-bit mode on Atari, normal on Q40 */
+#if defined(CONFIG_MACH_TX49XX)
+#  define DCR_VAL 0x48		/* 8-bit mode */
+#elif defined(CONFIG_ATARI)	/* 8-bit mode on Atari, normal on Q40 */
 #  define DCR_VAL (MACH_IS_ATARI ? 0x48 : 0x49)
 #else
 #  define DCR_VAL 0x49

drivers/net/ethernet/chelsio/cxgb4/cudbg_entity.h+9−19

 	{0x7b50, 0x7b54, 0x280, 0x20, 0}, /* up_cim_280_to_2fc */
 	{0x7b50, 0x7b54, 0x300, 0x20, 0}, /* up_cim_300_to_37c */
 	{0x7b50, 0x7b54, 0x380, 0x14, 0}, /* up_cim_380_to_3cc */
-	{0x7b50, 0x7b54, 0x2900, 0x4, 0x4}, /* up_cim_2900_to_3d40 */
+	{0x7b50, 0x7b54, 0x4900, 0x4, 0x4}, /* up_cim_4900_to_4c60 */
-	{0x7b50, 0x7b54, 0x2904, 0x4, 0x4}, /* up_cim_2904_to_3d44 */
+	{0x7b50, 0x7b54, 0x4904, 0x4, 0x4}, /* up_cim_4904_to_4c64 */
-	{0x7b50, 0x7b54, 0x2908, 0x4, 0x4}, /* up_cim_2908_to_3d48 */
+	{0x7b50, 0x7b54, 0x4908, 0x4, 0x4}, /* up_cim_4908_to_4c68 */
-	{0x7b50, 0x7b54, 0x2910, 0x4, 0x4}, /* up_cim_2910_to_3d4c */
+	{0x7b50, 0x7b54, 0x4910, 0x4, 0x4}, /* up_cim_4910_to_4c70 */
-	{0x7b50, 0x7b54, 0x2914, 0x4, 0x4}, /* up_cim_2914_to_3d50 */
+	{0x7b50, 0x7b54, 0x4914, 0x4, 0x4}, /* up_cim_4914_to_4c74 */
-	{0x7b50, 0x7b54, 0x2920, 0x10, 0x10}, /* up_cim_2920_to_2a10 */
+	{0x7b50, 0x7b54, 0x4920, 0x10, 0x10}, /* up_cim_4920_to_4a10 */
-	{0x7b50, 0x7b54, 0x2924, 0x10, 0x10}, /* up_cim_2924_to_2a14 */
+	{0x7b50, 0x7b54, 0x4924, 0x10, 0x10}, /* up_cim_4924_to_4a14 */
-	{0x7b50, 0x7b54, 0x2928, 0x10, 0x10}, /* up_cim_2928_to_2a18 */
+	{0x7b50, 0x7b54, 0x4928, 0x10, 0x10}, /* up_cim_4928_to_4a18 */
-	{0x7b50, 0x7b54, 0x292c, 0x10, 0x10}, /* up_cim_292c_to_2a1c */
+	{0x7b50, 0x7b54, 0x492c, 0x10, 0x10}, /* up_cim_492c_to_4a1c */
 };
 static const u32 t5_up_cim_reg_array[][IREG_NUM_ELEM + 1] = {
 	{0x7b50, 0x7b54, 0x280, 0x20, 0}, /* up_cim_280_to_2fc */
 	{0x7b50, 0x7b54, 0x300, 0x20, 0}, /* up_cim_300_to_37c */
 	{0x7b50, 0x7b54, 0x380, 0x14, 0}, /* up_cim_380_to_3cc */
-	{0x7b50, 0x7b54, 0x2900, 0x4, 0x4}, /* up_cim_2900_to_3d40 */
-	{0x7b50, 0x7b54, 0x2904, 0x4, 0x4}, /* up_cim_2904_to_3d44 */
-	{0x7b50, 0x7b54, 0x2908, 0x4, 0x4}, /* up_cim_2908_to_3d48 */
-	{0x7b50, 0x7b54, 0x2910, 0x4, 0x4}, /* up_cim_2910_to_3d4c */
-	{0x7b50, 0x7b54, 0x2914, 0x4, 0x4}, /* up_cim_2914_to_3d50 */
-	{0x7b50, 0x7b54, 0x2918, 0x4, 0x4}, /* up_cim_2918_to_3d54 */
-	{0x7b50, 0x7b54, 0x291c, 0x4, 0x4}, /* up_cim_291c_to_3d58 */
-	{0x7b50, 0x7b54, 0x2924, 0x10, 0x10}, /* up_cim_2924_to_2914 */
-	{0x7b50, 0x7b54, 0x2928, 0x10, 0x10}, /* up_cim_2928_to_2a18 */
-	{0x7b50, 0x7b54, 0x292c, 0x10, 0x10}, /* up_cim_292c_to_2a1c */
 };
 static const u32 t6_hma_ireg_array[][IREG_NUM_ELEM] = {

drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c+30−58

@@ -836,7 +836,7 @@ bool is_filter_exact_match(struct adapter *adap, · 835 unmodified lines
836	{	836	{
837	struct tp_params *tp = &adap->params.tp;	837	struct tp_params *tp = &adap->params.tp;
838	u64 hash_filter_mask = tp->hash_filter_mask;	838	u64 hash_filter_mask = tp->hash_filter_mask;
839	u32 mask;	839	u64 ntuple_mask = 0;
840		840
841	if (!is_hashfilter(adap))	841	if (!is_hashfilter(adap))
842	return false;	842	return false;
@@ -865,73 +865,45 @@ bool is_filter_exact_match(struct adapter *adap, · 22 unmodified lines
865	if (!fs->val.fport \|\| fs->mask.fport != 0xffff)	865	if (!fs->val.fport \|\| fs->mask.fport != 0xffff)
866	return false;	866	return false;
867		867
868	if (tp->fcoe_shift >= 0) {	868	/* calculate tuple mask and compare with mask configured in hw */
869	mask = (hash_filter_mask >> tp->fcoe_shift) & FT_FCOE_W;	869	if (tp->fcoe_shift >= 0)
870	if (mask && !fs->mask.fcoe)	870	ntuple_mask \|= (u64)fs->mask.fcoe << tp->fcoe_shift;
871	return false;
872	}
873		871
874	if (tp->port_shift >= 0) {	872	if (tp->port_shift >= 0)
875	mask = (hash_filter_mask >> tp->port_shift) & FT_PORT_W;	873	ntuple_mask \|= (u64)fs->mask.iport << tp->port_shift;
876	if (mask && !fs->mask.iport)
877	return false;
878	}
879		874
880	if (tp->vnic_shift >= 0) {	875	if (tp->vnic_shift >= 0) {
881	mask = (hash_filter_mask >> tp->vnic_shift) & FT_VNIC_ID_W;	876	if ((adap->params.tp.ingress_config & VNIC_F))
882		877	ntuple_mask \|= (u64)fs->mask.pfvf_vld << tp->vnic_shift;
883	if ((adap->params.tp.ingress_config & VNIC_F)) {	878	else
884	if (mask && !fs->mask.pfvf_vld)	879	ntuple_mask \|= (u64)fs->mask.ovlan_vld <<
885	return false;	880	tp->vnic_shift;
886	} else {
887	if (mask && !fs->mask.ovlan_vld)
888	return false;
889	}
890	}	881	}
891		882
892	if (tp->vlan_shift >= 0) {	883	if (tp->vlan_shift >= 0)
893	mask = (hash_filter_mask >> tp->vlan_shift) & FT_VLAN_W;	884	ntuple_mask \|= (u64)fs->mask.ivlan << tp->vlan_shift;
894	if (mask && !fs->mask.ivlan)
895	return false;
896	}
897		885
898	if (tp->tos_shift >= 0) {	886	if (tp->tos_shift >= 0)
899	mask = (hash_filter_mask >> tp->tos_shift) & FT_TOS_W;	887	ntuple_mask \|= (u64)fs->mask.tos << tp->tos_shift;
900	if (mask && !fs->mask.tos)
901	return false;
902	}
903		888
904	if (tp->protocol_shift >= 0) {	889	if (tp->protocol_shift >= 0)
905	mask = (hash_filter_mask >> tp->protocol_shift) & FT_PROTOCOL_W;	890	ntuple_mask \|= (u64)fs->mask.proto << tp->protocol_shift;
906	if (mask && !fs->mask.proto)
907	return false;
908	}
909		891
910	if (tp->ethertype_shift >= 0) {	892	if (tp->ethertype_shift >= 0)
911	mask = (hash_filter_mask >> tp->ethertype_shift) &	893	ntuple_mask \|= (u64)fs->mask.ethtype << tp->ethertype_shift;
912	FT_ETHERTYPE_W;
913	if (mask && !fs->mask.ethtype)
914	return false;
915	}
916		894
917	if (tp->macmatch_shift >= 0) {	895	if (tp->macmatch_shift >= 0)
918	mask = (hash_filter_mask >> tp->macmatch_shift) & FT_MACMATCH_W;	896	ntuple_mask \|= (u64)fs->mask.macidx << tp->macmatch_shift;
919	if (mask && !fs->mask.macidx)	897
920	return false;	898	if (tp->matchtype_shift >= 0)
921	}	899	ntuple_mask \|= (u64)fs->mask.matchtype << tp->matchtype_shift;
		900
		901	if (tp->frag_shift >= 0)
		902	ntuple_mask \|= (u64)fs->mask.frag << tp->frag_shift;
		903
		904	if (ntuple_mask != hash_filter_mask)
		905	return false;
922		906
923	if (tp->matchtype_shift >= 0) {
924	mask = (hash_filter_mask >> tp->matchtype_shift) &
925	FT_MPSHITTYPE_W;
926	if (mask && !fs->mask.matchtype)
927	return false;
928	}
929	if (tp->frag_shift >= 0) {
930	mask = (hash_filter_mask >> tp->frag_shift) &
931	FT_FRAGMENTATION_W;
932	if (mask && !fs->mask.frag)
933	return false;
934	}
935	return true;	907	return true;
936	}	908	}
937		909

drivers/net/ethernet/ibm/ibmvnic.c+17−11

 	if (adapter->fw_done_rc) {
 		dev_err(dev, "Couldn't map long term buffer,rc = %d\n",
 			adapter->fw_done_rc);
+		dma_free_coherent(dev, ltb->size, ltb->buff, ltb->addr);
 		return -1;
 	}
 	return 0;
 			if (rc)
 				return rc;
 		}
+		ibmvnic_disable_irqs(adapter);
 	}
-	ibmvnic_disable_irqs(adapter);
 	adapter->state = VNIC_CLOSED;
 	if (reset_state == VNIC_CLOSED)
 		release_crq_queue(adapter);
 	}
-	rc = init_stats_buffers(adapter);
-	if (rc)
-		return rc;
-	rc = init_stats_token(adapter);
-	if (rc)
-		return rc;
 	return rc;
 }
 			goto ibmvnic_init_fail;
 	} while (rc == EAGAIN);
+	rc = init_stats_buffers(adapter);
+	if (rc)
+		goto ibmvnic_init_fail;
+	rc = init_stats_token(adapter);
+	if (rc)
+		goto ibmvnic_stats_fail;
 	netdev->mtu = adapter->req_mtu - ETH_HLEN;
 	netdev->min_mtu = adapter->min_mtu - ETH_HLEN;
 	netdev->max_mtu = adapter->max_mtu - ETH_HLEN;
 	rc = device_create_file(&dev->dev, &dev_attr_failover);
 	if (rc)
-		goto ibmvnic_init_fail;
+		goto ibmvnic_dev_file_err;
 	netif_carrier_off(netdev);
 	rc = register_netdev(netdev);
 ibmvnic_register_fail:
 	device_remove_file(&dev->dev, &dev_attr_failover);
+ibmvnic_dev_file_err:
+	release_stats_token(adapter);
+ibmvnic_stats_fail:
+	release_stats_buffers(adapter);
 ibmvnic_init_fail:
 	release_sub_crqs(adapter, 1);
 	release_crq_queue(adapter);

drivers/net/ethernet/mellanox/mlx4/main.c+3−1

 		mlx4_err(dev, "Failed to create file for port %d\n", port);
 		devlink_port_unregister(&info->devlink_port);
 		info->port = -1;
+		return err;
 	}
 	sprintf(info->dev_mtu_name, "mlx4_port%d_mtu", port);
 				   &info->port_attr);
 		devlink_port_unregister(&info->devlink_port);
 		info->port = -1;
+		return err;
 	}
-	return err;
+	return 0;
 }
 static void mlx4_cleanup_port_info(struct mlx4_port_info *info)

drivers/net/ethernet/netronome/nfp/bpf/main.c+1−1

@@ -335,7 +335,7 @@ static int nfp_bpf_parse_capabilities(struct nfp_app *app) · 334 unmodified lines
335	return PTR_ERR(mem) == -ENOENT ? 0 : PTR_ERR(mem);	335	return PTR_ERR(mem) == -ENOENT ? 0 : PTR_ERR(mem);
336		336
337	start = mem;	337	start = mem;
338	while (mem - start + 8 < nfp_cpp_area_size(area)) {	338	while (mem - start + 8 <= nfp_cpp_area_size(area)) {
339	u8 __iomem *value;	339	u8 __iomem *value;
340	u32 type, length;	340	u32 type, length;
341		341

drivers/net/ethernet/qlogic/qed/qed_ll2.c+50−11

 	struct qed_ll2_tx_packet *p_pkt = NULL;
 	struct qed_ll2_info *p_ll2_conn;
 	struct qed_ll2_tx_queue *p_tx;
+	unsigned long flags = 0;
 	dma_addr_t tx_frag;
 	p_ll2_conn = qed_ll2_handle_sanity_inactive(p_hwfn, connection_handle);
 	p_tx = &p_ll2_conn->tx_queue;
+	spin_lock_irqsave(&p_tx->lock, flags);
 	while (!list_empty(&p_tx->active_descq)) {
 		p_pkt = list_first_entry(&p_tx->active_descq,
 					 struct qed_ll2_tx_packet, list_entry);
 		list_del(&p_pkt->list_entry);
 		b_last_packet = list_empty(&p_tx->active_descq);
 		list_add_tail(&p_pkt->list_entry, &p_tx->free_descq);
+		spin_unlock_irqrestore(&p_tx->lock, flags);
 		if (p_ll2_conn->input.conn_type == QED_LL2_TYPE_OOO) {
 			struct qed_ooo_buffer *p_buffer;
 						      b_last_frag,
 						      b_last_packet);
 		}
+		spin_lock_irqsave(&p_tx->lock, flags);
 	}
+	spin_unlock_irqrestore(&p_tx->lock, flags);
 }
 static int qed_ll2_txq_completion(struct qed_hwfn *p_hwfn, void *p_cookie)
 	struct qed_ll2_info *p_ll2_conn = NULL;
 	struct qed_ll2_rx_packet *p_pkt = NULL;
 	struct qed_ll2_rx_queue *p_rx;
+	unsigned long flags = 0;
 	p_ll2_conn = qed_ll2_handle_sanity_inactive(p_hwfn, connection_handle);
 	if (!p_ll2_conn)
 	p_rx = &p_ll2_conn->rx_queue;
+	spin_lock_irqsave(&p_rx->lock, flags);
 	while (!list_empty(&p_rx->active_descq)) {
 		p_pkt = list_first_entry(&p_rx->active_descq,
 					 struct qed_ll2_rx_packet, list_entry);
 		if (!p_pkt)
 			break;
 		list_move_tail(&p_pkt->list_entry, &p_rx->free_descq);
+		spin_unlock_irqrestore(&p_rx->lock, flags);
 		if (p_ll2_conn->input.conn_type == QED_LL2_TYPE_OOO) {
 			struct qed_ooo_buffer *p_buffer;
 						      cookie,
 						      rx_buf_addr, b_last);
 		}
+		spin_lock_irqsave(&p_rx->lock, flags);
 	}
+	spin_unlock_irqrestore(&p_rx->lock, flags);
+}
+static bool
+qed_ll2_lb_rxq_handler_slowpath(struct qed_hwfn *p_hwfn,
+				struct core_rx_slow_path_cqe *p_cqe)
+{
+	struct ooo_opaque *iscsi_ooo;
+	u32 cid;
+	if (p_cqe->ramrod_cmd_id != CORE_RAMROD_RX_QUEUE_FLUSH)
+		return false;
+	iscsi_ooo = (struct ooo_opaque *)&p_cqe->opaque_data;
+	if (iscsi_ooo->ooo_opcode != TCP_EVENT_DELETE_ISLES)
+		return false;
+	/* Need to make a flush */
+	cid = le32_to_cpu(iscsi_ooo->cid);
+	qed_ooo_release_connection_isles(p_hwfn, p_hwfn->p_ooo_info, cid);
+	return true;
 }
 static int qed_ll2_lb_rxq_handler(struct qed_hwfn *p_hwfn,
 		cq_old_idx = qed_chain_get_cons_idx(&p_rx->rcq_chain);
 		cqe_type = cqe->rx_cqe_sp.type;
+		if (cqe_type == CORE_RX_CQE_TYPE_SLOW_PATH)
+			if (qed_ll2_lb_rxq_handler_slowpath(p_hwfn,
+							    &cqe->rx_cqe_sp))
+				continue;
 		if (cqe_type != CORE_RX_CQE_TYPE_REGULAR) {
 			DP_NOTICE(p_hwfn,
 				  "Got a non-regular LB LL2 completion [type 0x%02x]\n",
 	struct qed_ll2_info *p_ll2_conn = (struct qed_ll2_info *)p_cookie;
 	int rc;
+	if (!QED_LL2_RX_REGISTERED(p_ll2_conn))
+		return 0;
 	rc = qed_ll2_lb_rxq_handler(p_hwfn, p_ll2_conn);
 	if (rc)
 		return rc;
 	u16 new_idx = 0, num_bds = 0;
 	int rc;
+	if (!QED_LL2_TX_REGISTERED(p_ll2_conn))
+		return 0;
 	new_idx = le16_to_cpu(*p_tx->p_fw_cons);
 	num_bds = ((s16)new_idx - (s16)p_tx->bds_idx);
 	/* Stop Tx & Rx of connection, if needed */
 	if (QED_LL2_TX_REGISTERED(p_ll2_conn)) {
+		p_ll2_conn->tx_queue.b_cb_registred = false;
+		smp_wmb(); /* Make sure this is seen by ll2_lb_rxq_completion */
 		rc = qed_sp_ll2_tx_queue_stop(p_hwfn, p_ll2_conn);
 		if (rc)
 			goto out;
 		qed_ll2_txq_flush(p_hwfn, connection_handle);
+		qed_int_unregister_cb(p_hwfn, p_ll2_conn->tx_queue.tx_sb_index);
 	}
 	if (QED_LL2_RX_REGISTERED(p_ll2_conn)) {
+		p_ll2_conn->rx_queue.b_cb_registred = false;
+		smp_wmb(); /* Make sure this is seen by ll2_lb_rxq_completion */
 		rc = qed_sp_ll2_rx_queue_stop(p_hwfn, p_ll2_conn);
 		if (rc)
 			goto out;
 		qed_ll2_rxq_flush(p_hwfn, connection_handle);
+		qed_int_unregister_cb(p_hwfn, p_ll2_conn->rx_queue.rx_sb_index);
 	}
 	if (p_ll2_conn->input.conn_type == QED_LL2_TYPE_OOO)
 	if (!p_ll2_conn)
 		return;
-	if (QED_LL2_RX_REGISTERED(p_ll2_conn)) {
-		p_ll2_conn->rx_queue.b_cb_registred = false;
-		qed_int_unregister_cb(p_hwfn, p_ll2_conn->rx_queue.rx_sb_index);
-	}
-	if (QED_LL2_TX_REGISTERED(p_ll2_conn)) {
-		p_ll2_conn->tx_queue.b_cb_registred = false;
-		qed_int_unregister_cb(p_hwfn, p_ll2_conn->tx_queue.tx_sb_index);
-	}
 	kfree(p_ll2_conn->tx_queue.descq_mem);
 	qed_chain_free(p_hwfn->cdev, &p_ll2_conn->tx_queue.txq_chain);

drivers/net/ethernet/qlogic/qede/qede_main.c+1−2

 	DP_INFO(edev, "Starting qede_remove\n");
+	qede_rdma_dev_remove(edev);
 	unregister_netdev(ndev);
 	cancel_delayed_work_sync(&edev->sp_task);
 	qede_ptp_disable(edev);
-	qede_rdma_dev_remove(edev);
 	edev->ops->common->set_power_state(cdev, PCI_D0);
 	pci_set_drvdata(pdev, NULL);

drivers/net/ethernet/renesas/sh_eth.h+1−1

@@ -163,7 +163,7 @@ enum { · 162 unmodified lines
163	};	163	};
164		164
165	/* Driver's parameters */	165	/* Driver's parameters */
166	#if defined(CONFIG_CPU_SH4) \|\| defined(CONFIG_ARCH_SHMOBILE)	166	#if defined(CONFIG_CPU_SH4) \|\| defined(CONFIG_ARCH_RENESAS)
167	#define SH_ETH_RX_ALIGN 32	167	#define SH_ETH_RX_ALIGN 32
168	#else	168	#else
169	#define SH_ETH_RX_ALIGN 2	169	#define SH_ETH_RX_ALIGN 2

drivers/net/ipvlan/ipvlan_main.c+3−1

 		break;
 	case NETDEV_CHANGEADDR:
-		list_for_each_entry(ipvlan, &port->ipvlans, pnode)
+		list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
 			ether_addr_copy(ipvlan->dev->dev_addr, dev->dev_addr);
+			call_netdevice_notifiers(NETDEV_CHANGEADDR, ipvlan->dev);
+		}
 		break;
 	case NETDEV_PRE_TYPE_CHANGE:

drivers/net/phy/micrel.c+31−0

@@ -573,9 +573,40 @@ static int ksz9031_config_init(struct phy_device *phydev) · 572 unmodified lines
573	ksz9031_of_load_skew_values(phydev, of_node,	573	ksz9031_of_load_skew_values(phydev, of_node,
574	MII_KSZ9031RN_TX_DATA_PAD_SKEW, 4,	574	MII_KSZ9031RN_TX_DATA_PAD_SKEW, 4,
575	tx_data_skews, 4);	575	tx_data_skews, 4);
		576
		577	/* Silicon Errata Sheet (DS80000691D or DS80000692D):
		578	* When the device links in the 1000BASE-T slave mode only,
		579	* the optional 125MHz reference output clock (CLK125_NDO)
		580	* has wide duty cycle variation.
		581	*
		582	* The optional CLK125_NDO clock does not meet the RGMII
		583	* 45/55 percent (min/max) duty cycle requirement and therefore
		584	* cannot be used directly by the MAC side for clocking
		585	* applications that have setup/hold time requirements on
		586	* rising and falling clock edges.
		587	*
		588	* Workaround:
		589	* Force the phy to be the master to receive a stable clock
		590	* which meets the duty cycle requirement.
		591	*/
		592	if (of_property_read_bool(of_node, "micrel,force-master")) {
		593	result = phy_read(phydev, MII_CTRL1000);
		594	if (result < 0)
		595	goto err_force_master;
		596
		597	/* enable master mode, config & prefer master */
		598	result \|= CTL1000_ENABLE_MASTER \| CTL1000_AS_MASTER;
		599	result = phy_write(phydev, MII_CTRL1000, result);
		600	if (result < 0)
		601	goto err_force_master;
		602	}
576	}	603	}
577		604
578	return ksz9031_center_flp_timing(phydev);	605	return ksz9031_center_flp_timing(phydev);
		606
		607	err_force_master:
		608	phydev_err(phydev, "failed to force the phy to master mode\n");
		609	return result;
579	}	610	}
580		611
581	#define KSZ8873MLL_GLOBAL_CONTROL_4 0x06	612	#define KSZ8873MLL_GLOBAL_CONTROL_4 0x06

drivers/net/tun.c+12−15

 	skb_queue_purge(&tfile->sk.sk_error_queue);
 }
-static void tun_cleanup_tx_ring(struct tun_file *tfile)
-{
-	if (tfile->tx_ring.queue) {
-		ptr_ring_cleanup(&tfile->tx_ring, tun_ptr_free);
-		xdp_rxq_info_unreg(&tfile->xdp_rxq);
-		memset(&tfile->tx_ring, 0, sizeof(tfile->tx_ring));
-	}
-}
 static void __tun_detach(struct tun_file *tfile, bool clean)
 {
 	struct tun_file *ntfile;
 			    tun->dev->reg_state == NETREG_REGISTERED)
 				unregister_netdevice(tun->dev);
 		}
-		tun_cleanup_tx_ring(tfile);
+		if (tun)
+			xdp_rxq_info_unreg(&tfile->xdp_rxq);
+		ptr_ring_cleanup(&tfile->tx_ring, tun_ptr_free);
 		sock_put(&tfile->sk);
 	}
 }
 		tun_napi_del(tun, tfile);
 		/* Drop read queue */
 		tun_queue_purge(tfile);
+		xdp_rxq_info_unreg(&tfile->xdp_rxq);
 		sock_put(&tfile->sk);
-		tun_cleanup_tx_ring(tfile);
 	}
 	list_for_each_entry_safe(tfile, tmp, &tun->disabled, next) {
 		tun_enable_queue(tfile);
 		tun_queue_purge(tfile);
+		xdp_rxq_info_unreg(&tfile->xdp_rxq);
 		sock_put(&tfile->sk);
-		tun_cleanup_tx_ring(tfile);
 	}
 	BUG_ON(tun->numdisabled != 0);
 	}
 	if (!tfile->detached &&
-	    ptr_ring_init(&tfile->tx_ring, dev->tx_queue_len, GFP_KERNEL)) {
+	    ptr_ring_resize(&tfile->tx_ring, dev->tx_queue_len,
+			    GFP_KERNEL, tun_ptr_free)) {
 		err = -ENOMEM;
 		goto out;
 	}
 					    &tun_proto, 0);
 	if (!tfile)
 		return -ENOMEM;
+	if (ptr_ring_init(&tfile->tx_ring, 0, GFP_KERNEL)) {
+		sk_free(&tfile->sk);
+		return -ENOMEM;
+	}
 	RCU_INIT_POINTER(tfile->tun, NULL);
 	tfile->flags = 0;
 	tfile->ifindex = 0;
 	sock_set_flag(&tfile->sk, SOCK_ZEROCOPY);
-	memset(&tfile->tx_ring, 0, sizeof(tfile->tx_ring));
 	return 0;
 }

drivers/net/vmxnet3/vmxnet3_drv.c+47−25

 	gdesc = tq->comp_ring.base + tq->comp_ring.next2proc;
 	while (VMXNET3_TCD_GET_GEN(&gdesc->tcd) == tq->comp_ring.gen) {
+		/* Prevent any &gdesc->tcd field from being (speculatively)
+		 * read before (&gdesc->tcd)->gen is read.
+		 */
+		dma_rmb();
 		completed += vmxnet3_unmap_pkt(VMXNET3_TCD_GET_TXIDX(
 					       &gdesc->tcd), tq, adapter->pdev,
 					       adapter);
 		gdesc->txd.tci = skb_vlan_tag_get(skb);
 	}
+	/* Ensure that the write to (&gdesc->txd)->gen will be observed after
+	 * all other writes to &gdesc->txd.
+	 */
+	dma_wmb();
 	/* finally flips the GEN bit of the SOP desc. */
 	gdesc->dword[2] = cpu_to_le32(le32_to_cpu(gdesc->dword[2]) ^
 						  VMXNET3_TXD_GEN);
 			 */
 			break;
 		}
+		/* Prevent any rcd field from being (speculatively) read before
+		 * rcd->gen is read.
+		 */
+		dma_rmb();
 		BUG_ON(rcd->rqID != rq->qid && rcd->rqID != rq->qid2 &&
 		       rcd->rqID != rq->dataRingQid);
 		idx = rcd->rxdIdx;
 		ring->next2comp = idx;
 		num_to_alloc = vmxnet3_cmd_ring_desc_avail(ring);
 		ring = rq->rx_ring + ring_idx;
+		/* Ensure that the writes to rxd->gen bits will be observed
+		 * after all other writes to rxd objects.
+		 */
+		dma_wmb();
 		while (num_to_alloc) {
 			vmxnet3_getRxDesc(rxd, &ring->base[ring->next2fill].rxd,
 					  &rxCmdDesc);
 /* ==================== initialization and cleanup routines ============ */
 static int
-vmxnet3_alloc_pci_resources(struct vmxnet3_adapter *adapter, bool *dma64)
+vmxnet3_alloc_pci_resources(struct vmxnet3_adapter *adapter)
 {
 	int err;
 	unsigned long mmio_start, mmio_len;
 		return err;
 	}
-	if (pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) == 0) {
-		if (pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)) != 0) {
-			dev_err(&pdev->dev,
-				"pci_set_consistent_dma_mask failed\n");
-			err = -EIO;
-			goto err_set_mask;
-		}
-		*dma64 = true;
-	} else {
-		if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32)) != 0) {
-			dev_err(&pdev->dev,
-				"pci_set_dma_mask failed\n");
-			err = -EIO;
-			goto err_set_mask;
-		}
-		*dma64 = false;
-	}
 	err = pci_request_selected_regions(pdev, (1 << 2) - 1,
 					   vmxnet3_driver_name);
 	if (err) {
 		dev_err(&pdev->dev,
 			"Failed to request region for adapter: error %d\n", err);
-		goto err_set_mask;
+		goto err_enable_device;
 	}
 	pci_set_master(pdev);
 	iounmap(adapter->hw_addr0);
 err_ioremap:
 	pci_release_selected_regions(pdev, (1 << 2) - 1);
-err_set_mask:
+err_enable_device:
 	pci_disable_device(pdev);
 	return err;
 }
 #endif
 	};
 	int err;
-	bool dma64 = false; /* stupid gcc */
+	bool dma64;
 	u32 ver;
 	struct net_device *netdev;
 	struct vmxnet3_adapter *adapter;
 	adapter->rx_ring_size = VMXNET3_DEF_RX_RING_SIZE;
 	adapter->rx_ring2_size = VMXNET3_DEF_RX_RING2_SIZE;
+	if (pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) == 0) {
+		if (pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)) != 0) {
+			dev_err(&pdev->dev,
+				"pci_set_consistent_dma_mask failed\n");
+			err = -EIO;
+			goto err_set_mask;
+		}
+		dma64 = true;
+	} else {
+		if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32)) != 0) {
+			dev_err(&pdev->dev,
+				"pci_set_dma_mask failed\n");
+			err = -EIO;
+			goto err_set_mask;
+		}
+		dma64 = false;
+	}
 	spin_lock_init(&adapter->cmd_lock);
 	adapter->adapter_pa = dma_map_single(&adapter->pdev->dev, adapter,
 					     sizeof(struct vmxnet3_adapter),
 	if (dma_mapping_error(&adapter->pdev->dev, adapter->adapter_pa)) {
 		dev_err(&pdev->dev, "Failed to map dma\n");
 		err = -EFAULT;
-		goto err_dma_map;
+		goto err_set_mask;
 	}
 	adapter->shared = dma_alloc_coherent(
 				&adapter->pdev->dev,
 	}
 #endif /* VMXNET3_RSS */
-	err = vmxnet3_alloc_pci_resources(adapter, &dma64);
+	err = vmxnet3_alloc_pci_resources(adapter);
 	if (err < 0)
 		goto err_alloc_pci;
 err_alloc_shared:
 	dma_unmap_single(&adapter->pdev->dev, adapter->adapter_pa,
 			 sizeof(struct vmxnet3_adapter), PCI_DMA_TODEVICE);
-err_dma_map:
+err_set_mask:
 	free_netdev(netdev);
 	return err;
 }

drivers/net/vmxnet3/vmxnet3_int.h+5−3

 /*
  * Version numbers
  */
-#define VMXNET3_DRIVER_VERSION_STRING   "1.4.14.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING   "1.4.16.0-k"
-/* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
+/* Each byte of this 32-bit integer encodes a version number in
-#define VMXNET3_DRIVER_VERSION_NUM      0x01040e00
+ * VMXNET3_DRIVER_VERSION_STRING.
+ */
+#define VMXNET3_DRIVER_VERSION_NUM      0x01041000
 #if defined(CONFIG_PCI_MSI)
 	/* RSS only makes sense if MSI-X is supported. */

include/linux/mlx5/driver.h+1−11

@@ -1286,17 +1286,7 @@ enum { · 1285 unmodified lines
1286	static inline const struct cpumask *	1286	static inline const struct cpumask *
1287	mlx5_get_vector_affinity_hint(struct mlx5_core_dev *dev, int vector)	1287	mlx5_get_vector_affinity_hint(struct mlx5_core_dev *dev, int vector)
1288	{	1288	{
1289	struct irq_desc *desc;	1289	return dev->priv.irq_info[vector].mask;
1290	unsigned int irq;
1291	int eqn;
1292	int err;
1293
1294	err = mlx5_vector2eqn(dev, vector, &eqn, &irq);
1295	if (err)
1296	return NULL;
1297
1298	desc = irq_to_desc(irq);
1299	return desc->affinity_hint;
1300	}	1290	}
1301		1291
1302	#endif /* MLX5_DRIVER_H */	1292	#endif /* MLX5_DRIVER_H */

include/net/netfilter/nf_tables.h+5−0

 int nft_data_init(const struct nft_ctx *ctx,
 		  struct nft_data *data, unsigned int size,
 		  struct nft_data_desc *desc, const struct nlattr *nla);
+void nft_data_hold(const struct nft_data *data, enum nft_data_types type);
 void nft_data_release(const struct nft_data *data, enum nft_data_types type);
 int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
 		  enum nft_data_types type, unsigned int len);
 	int				(*init)(const struct nft_ctx *ctx,
 						const struct nft_expr *expr,
 						const struct nlattr * const tb[]);
+	void				(*activate)(const struct nft_ctx *ctx,
+						    const struct nft_expr *expr);
+	void				(*deactivate)(const struct nft_ctx *ctx,
+						      const struct nft_expr *expr);
 	void				(*destroy)(const struct nft_ctx *ctx,
 						   const struct nft_expr *expr);
 	int				(*dump)(struct sk_buff *skb,

include/net/tls.h+3−0

@@ -97,6 +97,9 @@ struct tls_sw_context { · 96 unmodified lines
97	u8 control;	97	u8 control;
98	bool decrypted;	98	bool decrypted;
99		99
		100	char rx_aad_ciphertext[TLS_AAD_SPACE_SIZE];
		101	char rx_aad_plaintext[TLS_AAD_SPACE_SIZE];
		102
100	/* Sending context */	103	/* Sending context */
101	char aad_space[TLS_AAD_SPACE_SIZE];	104	char aad_space[TLS_AAD_SPACE_SIZE];
102		105

include/uapi/linux/netfilter/nf_conntrack_tcp.h+3−0

@@ -46,6 +46,9 @@ enum tcp_conntrack { · 45 unmodified lines
46	/* Marks possibility for expected RFC5961 challenge ACK */	46	/* Marks possibility for expected RFC5961 challenge ACK */
47	#define IP_CT_EXP_CHALLENGE_ACK 0x40	47	#define IP_CT_EXP_CHALLENGE_ACK 0x40
48		48
		49	/* Simultaneous open initialized */
		50	#define IP_CT_TCP_SIMULTANEOUS_OPEN 0x80
		51
49	struct nf_ct_tcp_flags {	52	struct nf_ct_tcp_flags {
50	__u8 flags;	53	__u8 flags;
51	__u8 mask;	54	__u8 mask;

kernel/bpf/core.c+75−25

@@ -218,47 +218,84 @@ int bpf_prog_calc_tag(struct bpf_prog *fp) · 217 unmodified lines
218	return 0;	218	return 0;
219	}	219	}
220		220
221	static void bpf_adj_branches(struct bpf_prog *prog, u32 pos, u32 delta)	221	static int bpf_adj_delta_to_imm(struct bpf_insn *insn, u32 pos, u32 delta,
		222	u32 curr, const bool probe_pass)
222	{	223	{
		224	const s64 imm_min = S32_MIN, imm_max = S32_MAX;
		225	s64 imm = insn->imm;
		226
		227	if (curr < pos && curr + imm + 1 > pos)
		228	imm += delta;
		229	else if (curr > pos + delta && curr + imm + 1 <= pos + delta)
		230	imm -= delta;
		231	if (imm < imm_min \|\| imm > imm_max)
		232	return -ERANGE;
		233	if (!probe_pass)
		234	insn->imm = imm;
		235	return 0;
		236	}
		237
		238	static int bpf_adj_delta_to_off(struct bpf_insn *insn, u32 pos, u32 delta,
		239	u32 curr, const bool probe_pass)
		240	{
		241	const s32 off_min = S16_MIN, off_max = S16_MAX;
		242	s32 off = insn->off;
		243
		244	if (curr < pos && curr + off + 1 > pos)
		245	off += delta;
		246	else if (curr > pos + delta && curr + off + 1 <= pos + delta)
		247	off -= delta;
		248	if (off < off_min \|\| off > off_max)
		249	return -ERANGE;
		250	if (!probe_pass)
		251	insn->off = off;
		252	return 0;
		253	}
		254
		255	static int bpf_adj_branches(struct bpf_prog *prog, u32 pos, u32 delta,
		256	const bool probe_pass)
		257	{
		258	u32 i, insn_cnt = prog->len + (probe_pass ? delta : 0);
223	struct bpf_insn *insn = prog->insnsi;	259	struct bpf_insn *insn = prog->insnsi;
224	u32 i, insn_cnt = prog->len;	260	int ret = 0;
225	bool pseudo_call;
226	u8 code;
227	int off;
228		261
229	for (i = 0; i < insn_cnt; i++, insn++) {	262	for (i = 0; i < insn_cnt; i++, insn++) {
		263	u8 code;
		264
		265	/* In the probing pass we still operate on the original,
		266	* unpatched image in order to check overflows before we
		267	* do any other adjustments. Therefore skip the patchlet.
		268	*/
		269	if (probe_pass && i == pos) {
		270	i += delta + 1;
		271	insn++;
		272	}
230	code = insn->code;	273	code = insn->code;
231	if (BPF_CLASS(code) != BPF_JMP)	274	if (BPF_CLASS(code) != BPF_JMP \|\|
232	continue;	275	BPF_OP(code) == BPF_EXIT)
233	if (BPF_OP(code) == BPF_EXIT)
234	continue;	276	continue;
		277	/* Adjust offset of jmps if we cross patch boundaries. */
235	if (BPF_OP(code) == BPF_CALL) {	278	if (BPF_OP(code) == BPF_CALL) {
236	if (insn->src_reg == BPF_PSEUDO_CALL)	279	if (insn->src_reg != BPF_PSEUDO_CALL)
237	pseudo_call = true;
238	else
239	continue;	280	continue;
		281	ret = bpf_adj_delta_to_imm(insn, pos, delta, i,
		282	probe_pass);
240	} else {	283	} else {
241	pseudo_call = false;	284	ret = bpf_adj_delta_to_off(insn, pos, delta, i,
		285	probe_pass);
242	}	286	}
243	off = pseudo_call ? insn->imm : insn->off;	287	if (ret)
244		288	break;
245	/* Adjust offset of jmps if we cross boundaries. */
246	if (i < pos && i + off + 1 > pos)
247	off += delta;
248	else if (i > pos + delta && i + off + 1 <= pos + delta)
249	off -= delta;
250
251	if (pseudo_call)
252	insn->imm = off;
253	else
254	insn->off = off;
255	}	289	}
		290
		291	return ret;
256	}	292	}
257		293
258	struct bpf_prog bpf_patch_insn_single(struct bpf_prog prog, u32 off,	294	struct bpf_prog bpf_patch_insn_single(struct bpf_prog prog, u32 off,
259	const struct bpf_insn *patch, u32 len)	295	const struct bpf_insn *patch, u32 len)
260	{	296	{
261	u32 insn_adj_cnt, insn_rest, insn_delta = len - 1;	297	u32 insn_adj_cnt, insn_rest, insn_delta = len - 1;
		298	const u32 cnt_max = S16_MAX;
262	struct bpf_prog *prog_adj;	299	struct bpf_prog *prog_adj;
263		300
264	/* Since our patchlet doesn't expand the image, we're done. */	301	/* Since our patchlet doesn't expand the image, we're done. */
@@ -269,6 +306,15 @@ struct bpf_prog bpf_patch_insn_single(struct bpf_prog prog, u32 off, · 4 unmodified lines
269		306
270	insn_adj_cnt = prog->len + insn_delta;	307	insn_adj_cnt = prog->len + insn_delta;
271		308
		309	/* Reject anything that would potentially let the insn->off
		310	* target overflow when we have excessive program expansions.
		311	* We need to probe here before we do any reallocation where
		312	* we afterwards may not fail anymore.
		313	*/
		314	if (insn_adj_cnt > cnt_max &&
		315	bpf_adj_branches(prog, off, insn_delta, true))
		316	return NULL;
		317
272	/* Several new instructions need to be inserted. Make room	318	/* Several new instructions need to be inserted. Make room
273	* for them. Likely, there's no need for a new allocation as	319	* for them. Likely, there's no need for a new allocation as
274	* last page could have large enough tailroom.	320	* last page could have large enough tailroom.
@@ -294,7 +340,11 @@ struct bpf_prog bpf_patch_insn_single(struct bpf_prog prog, u32 off, · 19 unmodified lines
294	sizeof(patch) insn_rest);	340	sizeof(patch) insn_rest);
295	memcpy(prog_adj->insnsi + off, patch, sizeof(patch) len);	341	memcpy(prog_adj->insnsi + off, patch, sizeof(patch) len);
296		342
297	bpf_adj_branches(prog_adj, off, insn_delta);	343	/* We are guaranteed to not fail at this point, otherwise
		344	* the ship has sailed to reverse to the original state. An
		345	* overflow cannot happen at this point.
		346	*/
		347	BUG_ON(bpf_adj_branches(prog_adj, off, insn_delta, false));
298		348
299	return prog_adj;	349	return prog_adj;
300	}	350	}

kernel/bpf/sockmap.c+9−9

 		 * we increment the refcnt. If this is the case abort with an
 		 * error.
 		 */
-		verdict = bpf_prog_inc_not_zero(stab->bpf_verdict);
+		verdict = bpf_prog_inc_not_zero(verdict);
 		if (IS_ERR(verdict))
 			return PTR_ERR(verdict);
-		parse = bpf_prog_inc_not_zero(stab->bpf_parse);
+		parse = bpf_prog_inc_not_zero(parse);
 		if (IS_ERR(parse)) {
 			bpf_prog_put(verdict);
 			return PTR_ERR(parse);
 	}
 	if (tx_msg) {
-		tx_msg = bpf_prog_inc_not_zero(stab->bpf_tx_msg);
+		tx_msg = bpf_prog_inc_not_zero(tx_msg);
 		if (IS_ERR(tx_msg)) {
-			if (verdict)
+			if (parse && verdict) {
-				bpf_prog_put(verdict);
-			if (parse)
 				bpf_prog_put(parse);
+				bpf_prog_put(verdict);
+			}
 			return PTR_ERR(tx_msg);
 		}
 	}
 out_free:
 	smap_release_sock(psock, sock);
 out_progs:
-	if (verdict)
+	if (parse && verdict) {
-		bpf_prog_put(verdict);
-	if (parse)
 		bpf_prog_put(parse);
+		bpf_prog_put(verdict);
+	}
 	if (tx_msg)
 		bpf_prog_put(tx_msg);
 	write_unlock_bh(&sock->sk_callback_lock);

net/bridge/netfilter/ebt_stp.c+2−2

@@ -161,8 +161,8 @@ static int ebt_stp_mt_check(const struct xt_mtchk_param *par) · 160 unmodified lines
161	/* Make sure the match only receives stp frames */	161	/* Make sure the match only receives stp frames */
162	if (!par->nft_compat &&	162	if (!par->nft_compat &&
163	(!ether_addr_equal(e->destmac, eth_stp_addr) \|\|	163	(!ether_addr_equal(e->destmac, eth_stp_addr) \|\|
164	!is_broadcast_ether_addr(e->destmsk) \|\|	164	!(e->bitmask & EBT_DESTMAC) \|\|
165	!(e->bitmask & EBT_DESTMAC)))	165	!is_broadcast_ether_addr(e->destmsk)))
166	return -EINVAL;	166	return -EINVAL;
167		167
168	return 0;	168	return 0;

net/core/dev.c+1−1

@@ -2124,7 +2124,7 @@ static bool remove_xps_queue_cpu(struct net_device *dev, · 2123 unmodified lines
2124	int i, j;	2124	int i, j;
2125		2125
2126	for (i = count, j = offset; i--; j++) {	2126	for (i = count, j = offset; i--; j++) {
2127	if (!remove_xps_queue(dev_maps, cpu, j))	2127	if (!remove_xps_queue(dev_maps, tci, j))
2128	break;	2128	break;
2129	}	2129	}
2130		2130

net/core/filter.c+9−2

 #define BPF_EMIT_JMP							\
 	do {								\
+		const s32 off_min = S16_MIN, off_max = S16_MAX;		\
+		s32 off;						\
+									\
 		if (target >= len || target < 0)			\
 			goto err;					\
-		insn->off = addrs ? addrs[target] - addrs[i] - 1 : 0;	\
+		off = addrs ? addrs[target] - addrs[i] - 1 : 0;		\
 		/* Adjust pc relative offset for 2nd or 3rd insn. */	\
-		insn->off -= insn - tmp_insns;				\
+		off -= insn - tmp_insns;				\
+		/* Reject anything not fitting into insn->off. */	\
+		if (off < off_min || off > off_max)			\
+			goto err;					\
+		insn->off = off;					\
 	} while (0)
 		case BPF_JMP | BPF_JA:

net/core/sock.c+1−1

@@ -1606,7 +1606,7 @@ static void __sk_free(struct sock *sk) · 1605 unmodified lines
1606	if (likely(sk->sk_net_refcnt))	1606	if (likely(sk->sk_net_refcnt))
1607	sock_inuse_add(sock_net(sk), -1);	1607	sock_inuse_add(sock_net(sk), -1);
1608		1608
1609	if (unlikely(sock_diag_has_destroy_listeners(sk) && sk->sk_net_refcnt))	1609	if (unlikely(sk->sk_net_refcnt && sock_diag_has_destroy_listeners(sk)))
1610	sock_diag_broadcast_destroy(sk);	1610	sock_diag_broadcast_destroy(sk);
1611	else	1611	else
1612	sk_destruct(sk);	1612	sk_destruct(sk);

net/dsa/dsa2.c+6−3

 static int dsa_port_setup(struct dsa_port *dp)
 {
 	struct dsa_switch *ds = dp->ds;
-	int err;
+	int err = 0;
 	memset(&dp->devlink_port, 0, sizeof(dp->devlink_port));
-	err = devlink_port_register(ds->devlink, &dp->devlink_port, dp->index);
+	if (dp->type != DSA_PORT_TYPE_UNUSED)
+		err = devlink_port_register(ds->devlink, &dp->devlink_port,
+					    dp->index);
 	if (err)
 		return err;
 static void dsa_port_teardown(struct dsa_port *dp)
 {
-	devlink_port_unregister(&dp->devlink_port);
+	if (dp->type != DSA_PORT_TYPE_UNUSED)
+		devlink_port_unregister(&dp->devlink_port);
 	switch (dp->type) {
 	case DSA_PORT_TYPE_UNUSED:

net/ipv4/fib_frontend.c+7−1

 				 u8 tos, int oif, struct net_device *dev,
 				 int rpf, struct in_device *idev, u32 *itag)
 {
+	struct net *net = dev_net(dev);
+	struct flow_keys flkeys;
 	int ret, no_addr;
 	struct fib_result res;
 	struct flowi4 fl4;
-	struct net *net = dev_net(dev);
 	bool dev_match;
 	fl4.flowi4_oif = 0;
 	no_addr = idev->ifa_list == NULL;
 	fl4.flowi4_mark = IN_DEV_SRC_VMARK(idev) ? skb->mark : 0;
+	if (!fib4_rules_early_flow_dissect(net, skb, &fl4, &flkeys)) {
+		fl4.flowi4_proto = 0;
+		fl4.fl4_sport = 0;
+		fl4.fl4_dport = 0;
+	}
 	trace_fib_validate_source(dev, &fl4);

net/ipv4/ip_gre.c+3−1

 		erspan_build_header(skb, ntohl(tunnel->parms.o_key),
 				    tunnel->index,
 				    truncate, true);
-	else
+	else if (tunnel->erspan_ver == 2)
 		erspan_build_header_v2(skb, ntohl(tunnel->parms.o_key),
 				       tunnel->dir, tunnel->hwid,
 				       truncate, true);
+	else
+		goto free_skb;
 	tunnel->parms.o_flags &= ~TUNNEL_KEY;
 	__gre_xmit(skb, dev, &tunnel->parms.iph, htons(ETH_P_ERSPAN));

net/ipv4/ip_output.c+2−1

@@ -1045,7 +1045,8 @@ alloc_new_skb: · 1044 unmodified lines
1045	if (copy > length)	1045	if (copy > length)
1046	copy = length;	1046	copy = length;
1047		1047
1048	if (!(rt->dst.dev->features&NETIF_F_SG)) {	1048	if (!(rt->dst.dev->features&NETIF_F_SG) &&
		1049	skb_tailroom(skb) >= copy) {
1049	unsigned int off;	1050	unsigned int off;
1050		1051
1051	off = skb->len;	1052	off = skb->len;

net/ipv4/netfilter/ip_tables.c+1−0

@@ -34,6 +34,7 @@ · 33 unmodified lines
34	MODULE_LICENSE("GPL");	34	MODULE_LICENSE("GPL");
35	MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");	35	MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
36	MODULE_DESCRIPTION("IPv4 packet filter");	36	MODULE_DESCRIPTION("IPv4 packet filter");
		37	MODULE_ALIAS("ipt_icmp");
37		38
38	void ipt_alloc_initial_table(const struct xt_table info)	39	void ipt_alloc_initial_table(const struct xt_table info)
39	{	40	{

net/ipv4/netfilter/ipt_rpfilter.c+1−1

 			return true ^ invert;
 	}
+	memset(&flow, 0, sizeof(flow));
 	flow.flowi4_iif = LOOPBACK_IFINDEX;
 	flow.daddr = iph->saddr;
 	flow.saddr = rpfilter_get_saddr(iph->daddr);
-	flow.flowi4_oif = 0;
 	flow.flowi4_mark = info->flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0;
 	flow.flowi4_tos = RT_TOS(iph->tos);
 	flow.flowi4_scope = RT_SCOPE_UNIVERSE;

net/ipv4/route.c+6−1

 	fl4.saddr = saddr;
 	fl4.flowi4_uid = sock_net_uid(net, NULL);
-	if (fib4_rules_early_flow_dissect(net, skb, &fl4, &_flkeys))
+	if (fib4_rules_early_flow_dissect(net, skb, &fl4, &_flkeys)) {
 		flkeys = &_flkeys;
+	} else {
+		fl4.flowi4_proto = 0;
+		fl4.fl4_sport = 0;
+		fl4.fl4_dport = 0;
+	}
 	err = fib_lookup(net, &fl4, res, 0);
 	if (err != 0) {

net/ipv4/tcp_output.c+5−2

 		return -EBUSY;
 	if (before(TCP_SKB_CB(skb)->seq, tp->snd_una)) {
-		if (before(TCP_SKB_CB(skb)->end_seq, tp->snd_una))
+		if (unlikely(before(TCP_SKB_CB(skb)->end_seq, tp->snd_una))) {
-			BUG();
+			WARN_ON_ONCE(1);
+			return -EINVAL;
+		}
 		if (tcp_trim_head(sk, skb, tp->snd_una - TCP_SKB_CB(skb)->seq))
 			return -ENOMEM;
 	}
 	sock_reset_flag(sk, SOCK_DONE);
 	tp->snd_wnd = 0;
 	tcp_init_wl(tp, 0);
+	tcp_write_queue_purge(sk);
 	tp->snd_una = tp->write_seq;
 	tp->snd_sml = tp->write_seq;
 	tp->snd_up = tp->write_seq;

net/ipv6/ip6_gre.c+226−60

@@ -71,6 +71,7 @@ struct ip6gre_net { · 70 unmodified lines
71	struct ip6_tnl __rcu *tunnels[4][IP6_GRE_HASH_SIZE];	71	struct ip6_tnl __rcu *tunnels[4][IP6_GRE_HASH_SIZE];
72		72
73	struct ip6_tnl __rcu *collect_md_tun;	73	struct ip6_tnl __rcu *collect_md_tun;
		74	struct ip6_tnl __rcu *collect_md_tun_erspan;
74	struct net_device *fb_tunnel_dev;	75	struct net_device *fb_tunnel_dev;
75	};	76	};
76		77
@@ -81,6 +82,7 @@ static int ip6gre_tunnel_init(struct net_device *dev); · 4 unmodified lines
81	static void ip6gre_tunnel_setup(struct net_device *dev);	82	static void ip6gre_tunnel_setup(struct net_device *dev);
82	static void ip6gre_tunnel_link(struct ip6gre_net ign, struct ip6_tnl t);	83	static void ip6gre_tunnel_link(struct ip6gre_net ign, struct ip6_tnl t);
83	static void ip6gre_tnl_link_config(struct ip6_tnl *t, int set_mtu);	84	static void ip6gre_tnl_link_config(struct ip6_tnl *t, int set_mtu);
		85	static void ip6erspan_tnl_link_config(struct ip6_tnl *t, int set_mtu);
84		86
85	/* Tunnel hash table */	87	/* Tunnel hash table */
86		88
@@ -232,7 +234,12 @@ static struct ip6_tnl ip6gre_tunnel_lookup(struct net_device dev, · 145 unmodified lines
232	if (cand)	234	if (cand)
233	return cand;	235	return cand;
234		236
235	t = rcu_dereference(ign->collect_md_tun);	237	if (gre_proto == htons(ETH_P_ERSPAN) \|\|
		238	gre_proto == htons(ETH_P_ERSPAN2))
		239	t = rcu_dereference(ign->collect_md_tun_erspan);
		240	else
		241	t = rcu_dereference(ign->collect_md_tun);
		242
236	if (t && t->dev->flags & IFF_UP)	243	if (t && t->dev->flags & IFF_UP)
237	return t;	244	return t;
238		245
@@ -261,6 +268,31 @@ static struct ip6_tnl __rcu *__ip6gre_bucket(struct ip6gre_net ign, · 22 unmodified lines
261	return &ign->tunnels[prio][h];	268	return &ign->tunnels[prio][h];
262	}	269	}
263		270
		271	static void ip6gre_tunnel_link_md(struct ip6gre_net ign, struct ip6_tnl t)
		272	{
		273	if (t->parms.collect_md)
		274	rcu_assign_pointer(ign->collect_md_tun, t);
		275	}
		276
		277	static void ip6erspan_tunnel_link_md(struct ip6gre_net ign, struct ip6_tnl t)
		278	{
		279	if (t->parms.collect_md)
		280	rcu_assign_pointer(ign->collect_md_tun_erspan, t);
		281	}
		282
		283	static void ip6gre_tunnel_unlink_md(struct ip6gre_net ign, struct ip6_tnl t)
		284	{
		285	if (t->parms.collect_md)
		286	rcu_assign_pointer(ign->collect_md_tun, NULL);
		287	}
		288
		289	static void ip6erspan_tunnel_unlink_md(struct ip6gre_net *ign,
		290	struct ip6_tnl *t)
		291	{
		292	if (t->parms.collect_md)
		293	rcu_assign_pointer(ign->collect_md_tun_erspan, NULL);
		294	}
		295
264	static inline struct ip6_tnl __rcu *ip6gre_bucket(struct ip6gre_net ign,	296	static inline struct ip6_tnl __rcu *ip6gre_bucket(struct ip6gre_net ign,
265	const struct ip6_tnl *t)	297	const struct ip6_tnl *t)
266	{	298	{
@@ -271,9 +303,6 @@ static void ip6gre_tunnel_link(struct ip6gre_net ign, struct ip6_tnl t) · 4 unmodified lines
271	{	303	{
272	struct ip6_tnl __rcu **tp = ip6gre_bucket(ign, t);	304	struct ip6_tnl __rcu **tp = ip6gre_bucket(ign, t);
273		305
274	if (t->parms.collect_md)
275	rcu_assign_pointer(ign->collect_md_tun, t);
276
277	rcu_assign_pointer(t->next, rtnl_dereference(*tp));	306	rcu_assign_pointer(t->next, rtnl_dereference(*tp));
278	rcu_assign_pointer(*tp, t);	307	rcu_assign_pointer(*tp, t);
279	}	308	}
@@ -283,9 +312,6 @@ static void ip6gre_tunnel_unlink(struct ip6gre_net ign, struct ip6_tnl t) · 3 unmodified lines
283	struct ip6_tnl __rcu **tp;	312	struct ip6_tnl __rcu **tp;
284	struct ip6_tnl *iter;	313	struct ip6_tnl *iter;
285		314
286	if (t->parms.collect_md)
287	rcu_assign_pointer(ign->collect_md_tun, NULL);
288
289	for (tp = ip6gre_bucket(ign, t);	315	for (tp = ip6gre_bucket(ign, t);
290	(iter = rtnl_dereference(*tp)) != NULL;	316	(iter = rtnl_dereference(*tp)) != NULL;
291	tp = &iter->next) {	317	tp = &iter->next) {
@@ -374,11 +400,23 @@ failed_free: · 82 unmodified lines
374	return NULL;	400	return NULL;
375	}	401	}
376		402
		403	static void ip6erspan_tunnel_uninit(struct net_device *dev)
		404	{
		405	struct ip6_tnl *t = netdev_priv(dev);
		406	struct ip6gre_net *ign = net_generic(t->net, ip6gre_net_id);
		407
		408	ip6erspan_tunnel_unlink_md(ign, t);
		409	ip6gre_tunnel_unlink(ign, t);
		410	dst_cache_reset(&t->dst_cache);
		411	dev_put(dev);
		412	}
		413
377	static void ip6gre_tunnel_uninit(struct net_device *dev)	414	static void ip6gre_tunnel_uninit(struct net_device *dev)
378	{	415	{
379	struct ip6_tnl *t = netdev_priv(dev);	416	struct ip6_tnl *t = netdev_priv(dev);
380	struct ip6gre_net *ign = net_generic(t->net, ip6gre_net_id);	417	struct ip6gre_net *ign = net_generic(t->net, ip6gre_net_id);
381		418
		419	ip6gre_tunnel_unlink_md(ign, t);
382	ip6gre_tunnel_unlink(ign, t);	420	ip6gre_tunnel_unlink(ign, t);
383	dst_cache_reset(&t->dst_cache);	421	dst_cache_reset(&t->dst_cache);
384	dev_put(dev);	422	dev_put(dev);
@@ -698,6 +736,9 @@ static netdev_tx_t __gre6_xmit(struct sk_buff *skb, · 313 unmodified lines
698	else	736	else
699	fl6->daddr = tunnel->parms.raddr;	737	fl6->daddr = tunnel->parms.raddr;
700		738
		739	if (skb_cow_head(skb, dev->needed_headroom ?: tunnel->hlen))
		740	return -ENOMEM;
		741
701	/* Push GRE header. */	742	/* Push GRE header. */
702	protocol = (dev->type == ARPHRD_ETHER) ? htons(ETH_P_TEB) : proto;	743	protocol = (dev->type == ARPHRD_ETHER) ? htons(ETH_P_TEB) : proto;
703		744
@@ -908,7 +949,7 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb, · 204 unmodified lines
908	truncate = true;	949	truncate = true;
909	}	950	}
910		951
911	if (skb_cow_head(skb, dev->needed_headroom))	952	if (skb_cow_head(skb, dev->needed_headroom ?: t->hlen))
912	goto tx_err;	953	goto tx_err;
913		954
914	t->parms.o_flags &= ~TUNNEL_KEY;	955	t->parms.o_flags &= ~TUNNEL_KEY;
@@ -979,11 +1020,14 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb, · 64 unmodified lines
979	erspan_build_header(skb, ntohl(t->parms.o_key),	1020	erspan_build_header(skb, ntohl(t->parms.o_key),
980	t->parms.index,	1021	t->parms.index,
981	truncate, false);	1022	truncate, false);
982	else	1023	else if (t->parms.erspan_ver == 2)
983	erspan_build_header_v2(skb, ntohl(t->parms.o_key),	1024	erspan_build_header_v2(skb, ntohl(t->parms.o_key),
984	t->parms.dir,	1025	t->parms.dir,
985	t->parms.hwid,	1026	t->parms.hwid,
986	truncate, false);	1027	truncate, false);
		1028	else
		1029	goto tx_err;
		1030
987	fl6.daddr = t->parms.raddr;	1031	fl6.daddr = t->parms.raddr;
988	}	1032	}
989		1033
@@ -1019,12 +1063,11 @@ tx_err: · 29 unmodified lines
1019	return NETDEV_TX_OK;	1063	return NETDEV_TX_OK;
1020	}	1064	}
1021		1065
1022	static void ip6gre_tnl_link_config(struct ip6_tnl *t, int set_mtu)	1066	static void ip6gre_tnl_link_config_common(struct ip6_tnl *t)
1023	{	1067	{
1024	struct net_device *dev = t->dev;	1068	struct net_device *dev = t->dev;
1025	struct __ip6_tnl_parm *p = &t->parms;	1069	struct __ip6_tnl_parm *p = &t->parms;
1026	struct flowi6 *fl6 = &t->fl.u.ip6;	1070	struct flowi6 *fl6 = &t->fl.u.ip6;
1027	int t_hlen;
1028		1071
1029	if (dev->type != ARPHRD_ETHER) {	1072	if (dev->type != ARPHRD_ETHER) {
1030	memcpy(dev->dev_addr, &p->laddr, sizeof(struct in6_addr));	1073	memcpy(dev->dev_addr, &p->laddr, sizeof(struct in6_addr));
@@ -1051,12 +1094,13 @@ static void ip6gre_tnl_link_config(struct ip6_tnl *t, int set_mtu) · 20 unmodified lines
1051	dev->flags \|= IFF_POINTOPOINT;	1094	dev->flags \|= IFF_POINTOPOINT;
1052	else	1095	else
1053	dev->flags &= ~IFF_POINTOPOINT;	1096	dev->flags &= ~IFF_POINTOPOINT;
		1097	}
1054		1098
1055	t->tun_hlen = gre_calc_hlen(t->parms.o_flags);	1099	static void ip6gre_tnl_link_config_route(struct ip6_tnl *t, int set_mtu,
1056		1100	int t_hlen)
1057	t->hlen = t->encap_hlen + t->tun_hlen;	1101	{
1058		1102	const struct __ip6_tnl_parm *p = &t->parms;
1059	t_hlen = t->hlen + sizeof(struct ipv6hdr);	1103	struct net_device *dev = t->dev;
1060		1104
1061	if (p->flags & IP6_TNL_F_CAP_XMIT) {	1105	if (p->flags & IP6_TNL_F_CAP_XMIT) {
1062	int strict = (ipv6_addr_type(&p->raddr) &	1106	int strict = (ipv6_addr_type(&p->raddr) &
@@ -1088,8 +1132,26 @@ static void ip6gre_tnl_link_config(struct ip6_tnl *t, int set_mtu) · 25 unmodified lines
1088	}	1132	}
1089	}	1133	}
1090		1134
1091	static int ip6gre_tnl_change(struct ip6_tnl *t,	1135	static int ip6gre_calc_hlen(struct ip6_tnl *tunnel)
1092	const struct __ip6_tnl_parm *p, int set_mtu)	1136	{
		1137	int t_hlen;
		1138
		1139	tunnel->tun_hlen = gre_calc_hlen(tunnel->parms.o_flags);
		1140	tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen;
		1141
		1142	t_hlen = tunnel->hlen + sizeof(struct ipv6hdr);
		1143	tunnel->dev->hard_header_len = LL_MAX_HEADER + t_hlen;
		1144	return t_hlen;
		1145	}
		1146
		1147	static void ip6gre_tnl_link_config(struct ip6_tnl *t, int set_mtu)
		1148	{
		1149	ip6gre_tnl_link_config_common(t);
		1150	ip6gre_tnl_link_config_route(t, set_mtu, ip6gre_calc_hlen(t));
		1151	}
		1152
		1153	static void ip6gre_tnl_copy_tnl_parm(struct ip6_tnl *t,
		1154	const struct __ip6_tnl_parm *p)
1093	{	1155	{
1094	t->parms.laddr = p->laddr;	1156	t->parms.laddr = p->laddr;
1095	t->parms.raddr = p->raddr;	1157	t->parms.raddr = p->raddr;
@@ -1105,6 +1167,12 @@ static int ip6gre_tnl_change(struct ip6_tnl *t, · 9 unmodified lines
1105	t->parms.o_flags = p->o_flags;	1167	t->parms.o_flags = p->o_flags;
1106	t->parms.fwmark = p->fwmark;	1168	t->parms.fwmark = p->fwmark;
1107	dst_cache_reset(&t->dst_cache);	1169	dst_cache_reset(&t->dst_cache);
		1170	}
		1171
		1172	static int ip6gre_tnl_change(struct ip6_tnl t, const struct __ip6_tnl_parm p,
		1173	int set_mtu)
		1174	{
		1175	ip6gre_tnl_copy_tnl_parm(t, p);
1108	ip6gre_tnl_link_config(t, set_mtu);	1176	ip6gre_tnl_link_config(t, set_mtu);
1109	return 0;	1177	return 0;
1110	}	1178	}
@@ -1381,11 +1449,7 @@ static int ip6gre_tunnel_init_common(struct net_device *dev) · 270 unmodified lines
1381	return ret;	1449	return ret;
1382	}	1450	}
1383		1451
1384	tunnel->tun_hlen = gre_calc_hlen(tunnel->parms.o_flags);	1452	t_hlen = ip6gre_calc_hlen(tunnel);
1385	tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen;
1386	t_hlen = tunnel->hlen + sizeof(struct ipv6hdr);
1387
1388	dev->hard_header_len = LL_MAX_HEADER + t_hlen;
1389	dev->mtu = ETH_DATA_LEN - t_hlen;	1453	dev->mtu = ETH_DATA_LEN - t_hlen;
1390	if (dev->type == ARPHRD_ETHER)	1454	if (dev->type == ARPHRD_ETHER)
1391	dev->mtu -= ETH_HLEN;	1455	dev->mtu -= ETH_HLEN;
@@ -1728,6 +1792,19 @@ static const struct net_device_ops ip6gre_tap_netdev_ops = { · 336 unmodified lines
1728	.ndo_get_iflink = ip6_tnl_get_iflink,	1792	.ndo_get_iflink = ip6_tnl_get_iflink,
1729	};	1793	};
1730		1794
		1795	static int ip6erspan_calc_hlen(struct ip6_tnl *tunnel)
		1796	{
		1797	int t_hlen;
		1798
		1799	tunnel->tun_hlen = 8;
		1800	tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen +
		1801	erspan_hdr_len(tunnel->parms.erspan_ver);
		1802
		1803	t_hlen = tunnel->hlen + sizeof(struct ipv6hdr);
		1804	tunnel->dev->hard_header_len = LL_MAX_HEADER + t_hlen;
		1805	return t_hlen;
		1806	}
		1807
1731	static int ip6erspan_tap_init(struct net_device *dev)	1808	static int ip6erspan_tap_init(struct net_device *dev)
1732	{	1809	{
1733	struct ip6_tnl *tunnel;	1810	struct ip6_tnl *tunnel;
@@ -1751,12 +1828,7 @@ static int ip6erspan_tap_init(struct net_device *dev) · 17 unmodified lines
1751	return ret;	1828	return ret;
1752	}	1829	}
1753		1830
1754	tunnel->tun_hlen = 8;	1831	t_hlen = ip6erspan_calc_hlen(tunnel);
1755	tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen +
1756	erspan_hdr_len(tunnel->parms.erspan_ver);
1757	t_hlen = tunnel->hlen + sizeof(struct ipv6hdr);
1758
1759	dev->hard_header_len = LL_MAX_HEADER + t_hlen;
1760	dev->mtu = ETH_DATA_LEN - t_hlen;	1832	dev->mtu = ETH_DATA_LEN - t_hlen;
1761	if (dev->type == ARPHRD_ETHER)	1833	if (dev->type == ARPHRD_ETHER)
1762	dev->mtu -= ETH_HLEN;	1834	dev->mtu -= ETH_HLEN;
@@ -1764,14 +1836,14 @@ static int ip6erspan_tap_init(struct net_device *dev) · 1 unmodified line
1764	dev->mtu -= 8;	1836	dev->mtu -= 8;
1765		1837
1766	dev->priv_flags \|= IFF_LIVE_ADDR_CHANGE;	1838	dev->priv_flags \|= IFF_LIVE_ADDR_CHANGE;
1767	ip6gre_tnl_link_config(tunnel, 1);	1839	ip6erspan_tnl_link_config(tunnel, 1);
1768		1840
1769	return 0;	1841	return 0;
1770	}	1842	}
1771		1843
1772	static const struct net_device_ops ip6erspan_netdev_ops = {	1844	static const struct net_device_ops ip6erspan_netdev_ops = {
1773	.ndo_init = ip6erspan_tap_init,	1845	.ndo_init = ip6erspan_tap_init,
1774	.ndo_uninit = ip6gre_tunnel_uninit,	1846	.ndo_uninit = ip6erspan_tunnel_uninit,
1775	.ndo_start_xmit = ip6erspan_tunnel_xmit,	1847	.ndo_start_xmit = ip6erspan_tunnel_xmit,
1776	.ndo_set_mac_address = eth_mac_addr,	1848	.ndo_set_mac_address = eth_mac_addr,
1777	.ndo_validate_addr = eth_validate_addr,	1849	.ndo_validate_addr = eth_validate_addr,
@@ -1835,13 +1907,11 @@ static bool ip6gre_netlink_encap_parms(struct nlattr *data[], · 57 unmodified lines
1835	return ret;	1907	return ret;
1836	}	1908	}
1837		1909
1838	static int ip6gre_newlink(struct net src_net, struct net_device dev,	1910	static int ip6gre_newlink_common(struct net src_net, struct net_device dev,
1839	struct nlattr tb[], struct nlattr data[],	1911	struct nlattr tb[], struct nlattr data[],
1840	struct netlink_ext_ack *extack)	1912	struct netlink_ext_ack *extack)
1841	{	1913	{
1842	struct ip6_tnl *nt;	1914	struct ip6_tnl *nt;
1843	struct net *net = dev_net(dev);
1844	struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
1845	struct ip_tunnel_encap ipencap;	1915	struct ip_tunnel_encap ipencap;
1846	int err;	1916	int err;
1847		1917
@@ -1854,16 +1924,6 @@ static int ip6gre_newlink(struct net src_net, struct net_device dev, · 6 unmodified lines
1854	return err;	1924	return err;
1855	}	1925	}
1856		1926
1857	ip6gre_netlink_parms(data, &nt->parms);
1858
1859	if (nt->parms.collect_md) {
1860	if (rtnl_dereference(ign->collect_md_tun))
1861	return -EEXIST;
1862	} else {
1863	if (ip6gre_tunnel_find(net, &nt->parms, dev->type))
1864	return -EEXIST;
1865	}
1866
1867	if (dev->type == ARPHRD_ETHER && !tb[IFLA_ADDRESS])	1927	if (dev->type == ARPHRD_ETHER && !tb[IFLA_ADDRESS])
1868	eth_hw_addr_random(dev);	1928	eth_hw_addr_random(dev);
1869		1929
@@ -1874,51 +1934,94 @@ static int ip6gre_newlink(struct net src_net, struct net_device dev, · 4 unmodified lines
1874	if (err)	1934	if (err)
1875	goto out;	1935	goto out;
1876		1936
1877	ip6gre_tnl_link_config(nt, !tb[IFLA_MTU]);
1878
1879	if (tb[IFLA_MTU])	1937	if (tb[IFLA_MTU])
1880	ip6_tnl_change_mtu(dev, nla_get_u32(tb[IFLA_MTU]));	1938	ip6_tnl_change_mtu(dev, nla_get_u32(tb[IFLA_MTU]));
1881		1939
1882	dev_hold(dev);	1940	dev_hold(dev);
1883	ip6gre_tunnel_link(ign, nt);
1884		1941
1885	out:	1942	out:
1886	return err;	1943	return err;
1887	}	1944	}
1888		1945
1889	static int ip6gre_changelink(struct net_device dev, struct nlattr tb[],	1946	static int ip6gre_newlink(struct net src_net, struct net_device dev,
1890	struct nlattr *data[],	1947	struct nlattr tb[], struct nlattr data[],
1891	struct netlink_ext_ack *extack)	1948	struct netlink_ext_ack *extack)
		1949	{
		1950	struct ip6_tnl *nt = netdev_priv(dev);
		1951	struct net *net = dev_net(dev);
		1952	struct ip6gre_net *ign;
		1953	int err;
		1954
		1955	ip6gre_netlink_parms(data, &nt->parms);
		1956	ign = net_generic(net, ip6gre_net_id);
		1957
		1958	if (nt->parms.collect_md) {
		1959	if (rtnl_dereference(ign->collect_md_tun))
		1960	return -EEXIST;
		1961	} else {
		1962	if (ip6gre_tunnel_find(net, &nt->parms, dev->type))
		1963	return -EEXIST;
		1964	}
		1965
		1966	err = ip6gre_newlink_common(src_net, dev, tb, data, extack);
		1967	if (!err) {
		1968	ip6gre_tnl_link_config(nt, !tb[IFLA_MTU]);
		1969	ip6gre_tunnel_link_md(ign, nt);
		1970	ip6gre_tunnel_link(net_generic(net, ip6gre_net_id), nt);
		1971	}
		1972	return err;
		1973	}
		1974
		1975	static struct ip6_tnl *
		1976	ip6gre_changelink_common(struct net_device dev, struct nlattr tb[],
		1977	struct nlattr data[], struct __ip6_tnl_parm p_p,
		1978	struct netlink_ext_ack *extack)
1892	{	1979	{
1893	struct ip6_tnl t, nt = netdev_priv(dev);	1980	struct ip6_tnl t, nt = netdev_priv(dev);
1894	struct net *net = nt->net;	1981	struct net *net = nt->net;
1895	struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);	1982	struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
1896	struct __ip6_tnl_parm p;
1897	struct ip_tunnel_encap ipencap;	1983	struct ip_tunnel_encap ipencap;
1898		1984
1899	if (dev == ign->fb_tunnel_dev)	1985	if (dev == ign->fb_tunnel_dev)
1900	return -EINVAL;	1986	return ERR_PTR(-EINVAL);
1901		1987
1902	if (ip6gre_netlink_encap_parms(data, &ipencap)) {	1988	if (ip6gre_netlink_encap_parms(data, &ipencap)) {
1903	int err = ip6_tnl_encap_setup(nt, &ipencap);	1989	int err = ip6_tnl_encap_setup(nt, &ipencap);
1904		1990
1905	if (err < 0)	1991	if (err < 0)
1906	return err;	1992	return ERR_PTR(err);
1907	}	1993	}
1908		1994
1909	ip6gre_netlink_parms(data, &p);	1995	ip6gre_netlink_parms(data, p_p);
1910		1996
1911	t = ip6gre_tunnel_locate(net, &p, 0);	1997	t = ip6gre_tunnel_locate(net, p_p, 0);
1912		1998
1913	if (t) {	1999	if (t) {
1914	if (t->dev != dev)	2000	if (t->dev != dev)
1915	return -EEXIST;	2001	return ERR_PTR(-EEXIST);
1916	} else {	2002	} else {
1917	t = nt;	2003	t = nt;
1918	}	2004	}
1919		2005
		2006	return t;
		2007	}
		2008
		2009	static int ip6gre_changelink(struct net_device dev, struct nlattr tb[],
		2010	struct nlattr *data[],
		2011	struct netlink_ext_ack *extack)
		2012	{
		2013	struct ip6gre_net *ign = net_generic(dev_net(dev), ip6gre_net_id);
		2014	struct __ip6_tnl_parm p;
		2015	struct ip6_tnl *t;
		2016
		2017	t = ip6gre_changelink_common(dev, tb, data, &p, extack);
		2018	if (IS_ERR(t))
		2019	return PTR_ERR(t);
		2020
		2021	ip6gre_tunnel_unlink_md(ign, t);
1920	ip6gre_tunnel_unlink(ign, t);	2022	ip6gre_tunnel_unlink(ign, t);
1921	ip6gre_tnl_change(t, &p, !tb[IFLA_MTU]);	2023	ip6gre_tnl_change(t, &p, !tb[IFLA_MTU]);
		2024	ip6gre_tunnel_link_md(ign, t);
1922	ip6gre_tunnel_link(ign, t);	2025	ip6gre_tunnel_link(ign, t);
1923	return 0;	2026	return 0;
1924	}	2027	}
@@ -2068,6 +2171,69 @@ static void ip6erspan_tap_setup(struct net_device *dev) · 143 unmodified lines
2068	netif_keep_dst(dev);	2171	netif_keep_dst(dev);
2069	}	2172	}
2070		2173
		2174	static int ip6erspan_newlink(struct net src_net, struct net_device dev,
		2175	struct nlattr tb[], struct nlattr data[],
		2176	struct netlink_ext_ack *extack)
		2177	{
		2178	struct ip6_tnl *nt = netdev_priv(dev);
		2179	struct net *net = dev_net(dev);
		2180	struct ip6gre_net *ign;
		2181	int err;
		2182
		2183	ip6gre_netlink_parms(data, &nt->parms);
		2184	ign = net_generic(net, ip6gre_net_id);
		2185
		2186	if (nt->parms.collect_md) {
		2187	if (rtnl_dereference(ign->collect_md_tun_erspan))
		2188	return -EEXIST;
		2189	} else {
		2190	if (ip6gre_tunnel_find(net, &nt->parms, dev->type))
		2191	return -EEXIST;
		2192	}
		2193
		2194	err = ip6gre_newlink_common(src_net, dev, tb, data, extack);
		2195	if (!err) {
		2196	ip6erspan_tnl_link_config(nt, !tb[IFLA_MTU]);
		2197	ip6erspan_tunnel_link_md(ign, nt);
		2198	ip6gre_tunnel_link(net_generic(net, ip6gre_net_id), nt);
		2199	}
		2200	return err;
		2201	}
		2202
		2203	static void ip6erspan_tnl_link_config(struct ip6_tnl *t, int set_mtu)
		2204	{
		2205	ip6gre_tnl_link_config_common(t);
		2206	ip6gre_tnl_link_config_route(t, set_mtu, ip6erspan_calc_hlen(t));
		2207	}
		2208
		2209	static int ip6erspan_tnl_change(struct ip6_tnl *t,
		2210	const struct __ip6_tnl_parm *p, int set_mtu)
		2211	{
		2212	ip6gre_tnl_copy_tnl_parm(t, p);
		2213	ip6erspan_tnl_link_config(t, set_mtu);
		2214	return 0;
		2215	}
		2216
		2217	static int ip6erspan_changelink(struct net_device dev, struct nlattr tb[],
		2218	struct nlattr *data[],
		2219	struct netlink_ext_ack *extack)
		2220	{
		2221	struct ip6gre_net *ign = net_generic(dev_net(dev), ip6gre_net_id);
		2222	struct __ip6_tnl_parm p;
		2223	struct ip6_tnl *t;
		2224
		2225	t = ip6gre_changelink_common(dev, tb, data, &p, extack);
		2226	if (IS_ERR(t))
		2227	return PTR_ERR(t);
		2228
		2229	ip6gre_tunnel_unlink_md(ign, t);
		2230	ip6gre_tunnel_unlink(ign, t);
		2231	ip6erspan_tnl_change(t, &p, !tb[IFLA_MTU]);
		2232	ip6erspan_tunnel_link_md(ign, t);
		2233	ip6gre_tunnel_link(ign, t);
		2234	return 0;
		2235	}
		2236
2071	static struct rtnl_link_ops ip6gre_link_ops __read_mostly = {	2237	static struct rtnl_link_ops ip6gre_link_ops __read_mostly = {
2072	.kind = "ip6gre",	2238	.kind = "ip6gre",
2073	.maxtype = IFLA_GRE_MAX,	2239	.maxtype = IFLA_GRE_MAX,
@@ -2104,8 +2270,8 @@ static struct rtnl_link_ops ip6erspan_tap_ops __read_mostly = { · 30 unmodified lines
2104	.priv_size = sizeof(struct ip6_tnl),	2270	.priv_size = sizeof(struct ip6_tnl),
2105	.setup = ip6erspan_tap_setup,	2271	.setup = ip6erspan_tap_setup,
2106	.validate = ip6erspan_tap_validate,	2272	.validate = ip6erspan_tap_validate,
2107	.newlink = ip6gre_newlink,	2273	.newlink = ip6erspan_newlink,
2108	.changelink = ip6gre_changelink,	2274	.changelink = ip6erspan_changelink,
2109	.get_size = ip6gre_get_size,	2275	.get_size = ip6gre_get_size,
2110	.fill_info = ip6gre_fill_info,	2276	.fill_info = ip6gre_fill_info,
2111	.get_link_net = ip6_tnl_get_link_net,	2277	.get_link_net = ip6_tnl_get_link_net,

net/ipv6/ip6_output.c+2−1

@@ -1503,7 +1503,8 @@ alloc_new_skb: · 1502 unmodified lines
1503	if (copy > length)	1503	if (copy > length)
1504	copy = length;	1504	copy = length;
1505		1505
1506	if (!(rt->dst.dev->features&NETIF_F_SG)) {	1506	if (!(rt->dst.dev->features&NETIF_F_SG) &&
		1507	skb_tailroom(skb) >= copy) {
1507	unsigned int off;	1508	unsigned int off;
1508		1509
1509	off = skb->len;	1510	off = skb->len;

net/ipv6/netfilter/ip6_tables.c+1−0

@@ -38,6 +38,7 @@ · 37 unmodified lines
38	MODULE_LICENSE("GPL");	38	MODULE_LICENSE("GPL");
39	MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");	39	MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
40	MODULE_DESCRIPTION("IPv6 packet filter");	40	MODULE_DESCRIPTION("IPv6 packet filter");
		41	MODULE_ALIAS("ip6t_icmp6");
41		42
42	void ip6t_alloc_initial_table(const struct xt_table info)	43	void ip6t_alloc_initial_table(const struct xt_table info)
43	{	44	{

net/netfilter/core.c+2−1

@@ -585,7 +585,8 @@ void (nf_nat_decode_session_hook)(struct sk_buff , struct flowi *); · 584 unmodified lines
585	EXPORT_SYMBOL(nf_nat_decode_session_hook);	585	EXPORT_SYMBOL(nf_nat_decode_session_hook);
586	#endif	586	#endif
587		587
588	static void __net_init __netfilter_net_init(struct nf_hook_entries **e, int max)	588	static void __net_init
		589	__netfilter_net_init(struct nf_hook_entries __rcu **e, int max)
589	{	590	{
590	int h;	591	int h;
591		592

net/netfilter/ipvs/ip_vs_conn.c+6−11

 static inline bool ip_vs_conn_unlink(struct ip_vs_conn *cp)
 {
 	unsigned int hash;
-	bool ret;
+	bool ret = false;
+	if (cp->flags & IP_VS_CONN_F_ONE_PACKET)
+		return refcount_dec_if_one(&cp->refcnt);
 	hash = ip_vs_conn_hashkey_conn(cp);
 	spin_lock(&cp->lock);
 	if (cp->flags & IP_VS_CONN_F_HASHED) {
-		ret = false;
 		/* Decrease refcnt and unlink conn only if we are last user */
 		if (refcount_dec_if_one(&cp->refcnt)) {
 			hlist_del_rcu(&cp->c_list);
 			cp->flags &= ~IP_VS_CONN_F_HASHED;
 			ret = true;
 		}
-	} else
+	}
-		ret = refcount_read(&cp->refcnt) ? false : true;
 	spin_unlock(&cp->lock);
 	ct_write_unlock_bh(hash);
 }
 EXPORT_SYMBOL_GPL(ip_vs_conn_out_get_proto);
-static void __ip_vs_conn_put_notimer(struct ip_vs_conn *cp)
-{
-	__ip_vs_conn_put(cp);
-	ip_vs_conn_expire(&cp->timer);
-}
 /*
  *      Put back the conn and restart its timer with its timeout
  */
 	    (refcount_read(&cp->refcnt) == 1) &&
 	    !timer_pending(&cp->timer))
 		/* expire connection immediately */
-		__ip_vs_conn_put_notimer(cp);
+		ip_vs_conn_expire(&cp->timer);
 	else
 		__ip_vs_conn_put_timer(cp);
 }

net/netfilter/ipvs/ip_vs_core.c+12−0

 		struct ip_vs_cpu_stats *s;
 		struct ip_vs_service *svc;
+		local_bh_disable();
 		s = this_cpu_ptr(dest->stats.cpustats);
 		u64_stats_update_begin(&s->syncp);
 		s->cnt.inpkts++;
 		s->cnt.inpkts++;
 		s->cnt.inbytes += skb->len;
 		u64_stats_update_end(&s->syncp);
+		local_bh_enable();
 	}
 }
 		struct ip_vs_cpu_stats *s;
 		struct ip_vs_service *svc;
+		local_bh_disable();
 		s = this_cpu_ptr(dest->stats.cpustats);
 		u64_stats_update_begin(&s->syncp);
 		s->cnt.outpkts++;
 		s->cnt.outpkts++;
 		s->cnt.outbytes += skb->len;
 		u64_stats_update_end(&s->syncp);
+		local_bh_enable();
 	}
 }
 	struct netns_ipvs *ipvs = svc->ipvs;
 	struct ip_vs_cpu_stats *s;
+	local_bh_disable();
 	s = this_cpu_ptr(cp->dest->stats.cpustats);
 	u64_stats_update_begin(&s->syncp);
 	s->cnt.conns++;
 	u64_stats_update_begin(&s->syncp);
 	s->cnt.conns++;
 	u64_stats_update_end(&s->syncp);
+	local_bh_enable();
 }

net/netfilter/nf_conntrack_proto_tcp.c+11−0

@@ -981,6 +981,17 @@ static int tcp_packet(struct nf_conn *ct, · 980 unmodified lines
981	return NF_ACCEPT; /* Don't change state */	981	return NF_ACCEPT; /* Don't change state */
982	}	982	}
983	break;	983	break;
		984	case TCP_CONNTRACK_SYN_SENT2:
		985	/* tcp_conntracks table is not smart enough to handle
		986	* simultaneous open.
		987	*/
		988	ct->proto.tcp.last_flags \|= IP_CT_TCP_SIMULTANEOUS_OPEN;
		989	break;
		990	case TCP_CONNTRACK_SYN_RECV:
		991	if (dir == IP_CT_DIR_REPLY && index == TCP_ACK_SET &&
		992	ct->proto.tcp.last_flags & IP_CT_TCP_SIMULTANEOUS_OPEN)
		993	new_state = TCP_CONNTRACK_ESTABLISHED;
		994	break;
984	case TCP_CONNTRACK_CLOSE:	995	case TCP_CONNTRACK_CLOSE:
985	if (index == TCP_RST_SET	996	if (index == TCP_RST_SET
986	&& (ct->proto.tcp.seen[!dir].flags & IP_CT_TCP_FLAG_MAXACK_SET)	997	&& (ct->proto.tcp.seen[!dir].flags & IP_CT_TCP_FLAG_MAXACK_SET)

net/netfilter/nf_tables_api.c+63−14

 	return err;
 }
+static void nft_rule_expr_activate(const struct nft_ctx *ctx,
+				   struct nft_rule *rule)
+{
+	struct nft_expr *expr;
+	expr = nft_expr_first(rule);
+	while (expr != nft_expr_last(rule) && expr->ops) {
+		if (expr->ops->activate)
+			expr->ops->activate(ctx, expr);
+		expr = nft_expr_next(expr);
+	}
+}
+static void nft_rule_expr_deactivate(const struct nft_ctx *ctx,
+				     struct nft_rule *rule)
+{
+	struct nft_expr *expr;
+	expr = nft_expr_first(rule);
+	while (expr != nft_expr_last(rule) && expr->ops) {
+		if (expr->ops->deactivate)
+			expr->ops->deactivate(ctx, expr);
+		expr = nft_expr_next(expr);
+	}
+}
 static int
 nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule)
 {
 		nft_trans_destroy(trans);
 		return err;
 	}
+	nft_rule_expr_deactivate(ctx, rule);
 	return 0;
 }
 	kfree(rule);
 }
+static void nf_tables_rule_release(const struct nft_ctx *ctx,
+				   struct nft_rule *rule)
+{
+	nft_rule_expr_deactivate(ctx, rule);
+	nf_tables_rule_destroy(ctx, rule);
+}
 #define NFT_RULE_MAXEXPRS	128
 static struct nft_expr_info *info;
 	return 0;
 err2:
-	nf_tables_rule_destroy(&ctx, rule);
+	nf_tables_rule_release(&ctx, rule);
 err1:
 	for (i = 0; i < n; i++) {
 		if (info[i].ops != NULL)
 			if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^
 			    nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) ||
 			    nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^
-			    nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF))
+			    nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF)) {
-				return -EBUSY;
+				err = -EBUSY;
+				goto err5;
+			}
 			if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
 			     nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) &&
 			     memcmp(nft_set_ext_data(ext),
  *	NFT_GOTO verdicts. This function must be called on active data objects
  *	from the second phase of the commit protocol.
  */
-static void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
+void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
 {
 	if (type == NFT_DATA_VERDICT) {
 		switch (data->verdict.code) {
 	}
 }
-static void nf_tables_commit_release(struct nft_trans *trans)
+static void nft_commit_release(struct nft_trans *trans)
 {
 	switch (trans->msg_type) {
 	case NFT_MSG_DELTABLE:
 	kfree(trans);
 }
+static void nf_tables_commit_release(struct net *net)
+{
+	struct nft_trans *trans, *next;
+	if (list_empty(&net->nft.commit_list))
+		return;
+	synchronize_rcu();
+	list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
+		list_del(&trans->list);
+		nft_commit_release(trans);
+	}
+}
 static int nf_tables_commit(struct net *net, struct sk_buff *skb)
 {
 	struct nft_trans *trans, *next;
 		}
 	}
-	synchronize_rcu();
+	nf_tables_commit_release(net);
-	list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
-		list_del(&trans->list);
-		nf_tables_commit_release(trans);
-	}
 	nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
 	return 0;
 		case NFT_MSG_NEWRULE:
 			trans->ctx.chain->use--;
 			list_del_rcu(&nft_trans_rule(trans)->list);
+			nft_rule_expr_deactivate(&trans->ctx, nft_trans_rule(trans));
 			break;
 		case NFT_MSG_DELRULE:
 			trans->ctx.chain->use++;
 			nft_clear(trans->ctx.net, nft_trans_rule(trans));
+			nft_rule_expr_activate(&trans->ctx, nft_trans_rule(trans));
 			nft_trans_destroy(trans);
 			break;
 		case NFT_MSG_NEWSET:
 	list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
 		list_del(&rule->list);
 		ctx->chain->use--;
-		nf_tables_rule_destroy(ctx, rule);
+		nf_tables_rule_release(ctx, rule);
 	}
 	list_del(&ctx->chain->list);
 	ctx->table->use--;
 			list_for_each_entry_safe(rule, nr, &chain->rules, list) {
 				list_del(&rule->list);
 				chain->use--;
-				nf_tables_rule_destroy(&ctx, rule);
+				nf_tables_rule_release(&ctx, rule);
 			}
 		}
 		list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {

net/netfilter/nf_tables_core.c+14−7

@@ -119,15 +119,22 @@ DEFINE_STATIC_KEY_FALSE(nft_counters_enabled); · 118 unmodified lines
119	static noinline void nft_update_chain_stats(const struct nft_chain *chain,	119	static noinline void nft_update_chain_stats(const struct nft_chain *chain,
120	const struct nft_pktinfo *pkt)	120	const struct nft_pktinfo *pkt)
121	{	121	{
		122	struct nft_base_chain *base_chain;
122	struct nft_stats *stats;	123	struct nft_stats *stats;
123		124
124	local_bh_disable();	125	base_chain = nft_base_chain(chain);
125	stats = this_cpu_ptr(rcu_dereference(nft_base_chain(chain)->stats));	126	if (!base_chain->stats)
126	u64_stats_update_begin(&stats->syncp);	127	return;
127	stats->pkts++;	128
128	stats->bytes += pkt->skb->len;	129	stats = this_cpu_ptr(rcu_dereference(base_chain->stats));
129	u64_stats_update_end(&stats->syncp);	130	if (stats) {
130	local_bh_enable();	131	local_bh_disable();
		132	u64_stats_update_begin(&stats->syncp);
		133	stats->pkts++;
		134	stats->bytes += pkt->skb->len;
		135	u64_stats_update_end(&stats->syncp);
		136	local_bh_enable();
		137	}
131	}	138	}
132		139
133	struct nft_jumpstack {	140	struct nft_jumpstack {

net/netfilter/nfnetlink_acct.c+1−1

@@ -115,7 +115,7 @@ static int nfnl_acct_new(struct net net, struct sock nfnl, · 114 unmodified lines
115	nfacct->flags = flags;	115	nfacct->flags = flags;
116	}	116	}
117		117
118	strncpy(nfacct->name, nla_data(tb[NFACCT_NAME]), NFACCT_NAME_MAX);	118	nla_strlcpy(nfacct->name, nla_data(tb[NFACCT_NAME]), NFACCT_NAME_MAX);
119		119
120	if (tb[NFACCT_BYTES]) {	120	if (tb[NFACCT_BYTES]) {
121	atomic64_set(&nfacct->bytes,	121	atomic64_set(&nfacct->bytes,

net/netfilter/nfnetlink_cthelper.c+4−3

 	    !tb[NFCTH_POLICY_EXPECT_TIMEOUT])
 		return -EINVAL;
-	strncpy(expect_policy->name,
+	nla_strlcpy(expect_policy->name,
-		nla_data(tb[NFCTH_POLICY_NAME]), NF_CT_HELPER_NAME_LEN);
+		    nla_data(tb[NFCTH_POLICY_NAME]), NF_CT_HELPER_NAME_LEN);
 	expect_policy->max_expected =
 		ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX]));
 	if (expect_policy->max_expected > NF_CT_EXPECT_MAX_CNT)
 	if (ret < 0)
 		goto err1;
-	strncpy(helper->name, nla_data(tb[NFCTH_NAME]), NF_CT_HELPER_NAME_LEN);
+	nla_strlcpy(helper->name,
+		    nla_data(tb[NFCTH_NAME]), NF_CT_HELPER_NAME_LEN);
 	size = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN]));
 	if (size > FIELD_SIZEOF(struct nf_conn_help, data)) {
 		ret = -ENOMEM;

net/netfilter/nft_compat.c+156−45

@@ -27,14 +27,31 @@ struct nft_xt { · 26 unmodified lines
27	struct list_head head;	27	struct list_head head;
28	struct nft_expr_ops ops;	28	struct nft_expr_ops ops;
29	unsigned int refcnt;	29	unsigned int refcnt;
		30
		31	/* Unlike other expressions, ops doesn't have static storage duration.
		32	* nft core assumes they do. We use kfree_rcu so that nft core can
		33	* can check expr->ops->size even after nft_compat->destroy() frees
		34	* the nft_xt struct that holds the ops structure.
		35	*/
		36	struct rcu_head rcu_head;
		37	};
		38
		39	/* Used for matches where info is larger than X byte /
		40	#define NFT_MATCH_LARGE_THRESH 192
		41
		42	struct nft_xt_match_priv {
		43	void *info;
30	};	44	};
31		45
32	static void nft_xt_put(struct nft_xt *xt)	46	static bool nft_xt_put(struct nft_xt *xt)
33	{	47	{
34	if (--xt->refcnt == 0) {	48	if (--xt->refcnt == 0) {
35	list_del(&xt->head);	49	list_del(&xt->head);
36	kfree(xt);	50	kfree_rcu(xt, rcu_head);
		51	return true;
37	}	52	}
		53
		54	return false;
38	}	55	}
39		56
40	static int nft_compat_chain_validate_dependency(const char *tablename,	57	static int nft_compat_chain_validate_dependency(const char *tablename,
@@ -226,6 +243,7 @@ nft_target_init(const struct nft_ctx ctx, const struct nft_expr expr, · 185 unmodified lines
226	struct xt_target *target = expr->ops->data;	243	struct xt_target *target = expr->ops->data;
227	struct xt_tgchk_param par;	244	struct xt_tgchk_param par;
228	size_t size = XT_ALIGN(nla_len(tb[NFTA_TARGET_INFO]));	245	size_t size = XT_ALIGN(nla_len(tb[NFTA_TARGET_INFO]));
		246	struct nft_xt *nft_xt;
229	u16 proto = 0;	247	u16 proto = 0;
230	bool inv = false;	248	bool inv = false;
231	union nft_entry e = {};	249	union nft_entry e = {};
@@ -236,25 +254,22 @@ nft_target_init(const struct nft_ctx ctx, const struct nft_expr expr, · 4 unmodified lines
236	if (ctx->nla[NFTA_RULE_COMPAT]) {	254	if (ctx->nla[NFTA_RULE_COMPAT]) {
237	ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv);	255	ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv);
238	if (ret < 0)	256	if (ret < 0)
239	goto err;	257	return ret;
240	}	258	}
241		259
242	nft_target_set_tgchk_param(&par, ctx, target, info, &e, proto, inv);	260	nft_target_set_tgchk_param(&par, ctx, target, info, &e, proto, inv);
243		261
244	ret = xt_check_target(&par, size, proto, inv);	262	ret = xt_check_target(&par, size, proto, inv);
245	if (ret < 0)	263	if (ret < 0)
246	goto err;	264	return ret;
247		265
248	/* The standard target cannot be used */	266	/* The standard target cannot be used */
249	if (target->target == NULL) {	267	if (!target->target)
250	ret = -EINVAL;	268	return -EINVAL;
251	goto err;
252	}
253		269
		270	nft_xt = container_of(expr->ops, struct nft_xt, ops);
		271	nft_xt->refcnt++;
254	return 0;	272	return 0;
255	err:
256	module_put(target->me);
257	return ret;
258	}	273	}
259		274
260	static void	275	static void
@@ -271,8 +286,8 @@ nft_target_destroy(const struct nft_ctx ctx, const struct nft_expr expr) · 10 unmodified lines
271	if (par.target->destroy != NULL)	286	if (par.target->destroy != NULL)
272	par.target->destroy(&par);	287	par.target->destroy(&par);
273		288
274	nft_xt_put(container_of(expr->ops, struct nft_xt, ops));	289	if (nft_xt_put(container_of(expr->ops, struct nft_xt, ops)))
275	module_put(target->me);	290	module_put(target->me);
276	}	291	}
277		292
278	static int nft_target_dump(struct sk_buff skb, const struct nft_expr expr)	293	static int nft_target_dump(struct sk_buff skb, const struct nft_expr expr)
@@ -316,11 +331,11 @@ static int nft_target_validate(const struct nft_ctx *ctx, · 37 unmodified lines
316	return 0;	331	return 0;
317	}	332	}
318		333
319	static void nft_match_eval(const struct nft_expr *expr,	334	static void __nft_match_eval(const struct nft_expr *expr,
320	struct nft_regs *regs,	335	struct nft_regs *regs,
321	const struct nft_pktinfo *pkt)	336	const struct nft_pktinfo *pkt,
		337	void *info)
322	{	338	{
323	void *info = nft_expr_priv(expr);
324	struct xt_match *match = expr->ops->data;	339	struct xt_match *match = expr->ops->data;
325	struct sk_buff *skb = pkt->skb;	340	struct sk_buff *skb = pkt->skb;
326	bool ret;	341	bool ret;
@@ -344,6 +359,22 @@ static void nft_match_eval(const struct nft_expr *expr, · 17 unmodified lines
344	}	359	}
345	}	360	}
346		361
		362	static void nft_match_large_eval(const struct nft_expr *expr,
		363	struct nft_regs *regs,
		364	const struct nft_pktinfo *pkt)
		365	{
		366	struct nft_xt_match_priv *priv = nft_expr_priv(expr);
		367
		368	__nft_match_eval(expr, regs, pkt, priv->info);
		369	}
		370
		371	static void nft_match_eval(const struct nft_expr *expr,
		372	struct nft_regs *regs,
		373	const struct nft_pktinfo *pkt)
		374	{
		375	__nft_match_eval(expr, regs, pkt, nft_expr_priv(expr));
		376	}
		377
347	static const struct nla_policy nft_match_policy[NFTA_MATCH_MAX + 1] = {	378	static const struct nla_policy nft_match_policy[NFTA_MATCH_MAX + 1] = {
348	[NFTA_MATCH_NAME] = { .type = NLA_NUL_STRING },	379	[NFTA_MATCH_NAME] = { .type = NLA_NUL_STRING },
349	[NFTA_MATCH_REV] = { .type = NLA_U32 },	380	[NFTA_MATCH_REV] = { .type = NLA_U32 },
@@ -404,13 +435,14 @@ static void match_compat_from_user(struct xt_match m, void in, void *out) · 54 unmodified lines
404	}	435	}
405		436
406	static int	437	static int
407	nft_match_init(const struct nft_ctx ctx, const struct nft_expr expr,	438	__nft_match_init(const struct nft_ctx ctx, const struct nft_expr expr,
408	const struct nlattr * const tb[])	439	const struct nlattr * const tb[],
		440	void *info)
409	{	441	{
410	void *info = nft_expr_priv(expr);
411	struct xt_match *match = expr->ops->data;	442	struct xt_match *match = expr->ops->data;
412	struct xt_mtchk_param par;	443	struct xt_mtchk_param par;
413	size_t size = XT_ALIGN(nla_len(tb[NFTA_MATCH_INFO]));	444	size_t size = XT_ALIGN(nla_len(tb[NFTA_MATCH_INFO]));
		445	struct nft_xt *nft_xt;
414	u16 proto = 0;	446	u16 proto = 0;
415	bool inv = false;	447	bool inv = false;
416	union nft_entry e = {};	448	union nft_entry e = {};
@@ -421,26 +453,50 @@ nft_match_init(const struct nft_ctx ctx, const struct nft_expr expr, · 4 unmodified lines
421	if (ctx->nla[NFTA_RULE_COMPAT]) {	453	if (ctx->nla[NFTA_RULE_COMPAT]) {
422	ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv);	454	ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv);
423	if (ret < 0)	455	if (ret < 0)
424	goto err;	456	return ret;
425	}	457	}
426		458
427	nft_match_set_mtchk_param(&par, ctx, match, info, &e, proto, inv);	459	nft_match_set_mtchk_param(&par, ctx, match, info, &e, proto, inv);
428		460
429	ret = xt_check_match(&par, size, proto, inv);	461	ret = xt_check_match(&par, size, proto, inv);
430	if (ret < 0)	462	if (ret < 0)
431	goto err;	463	return ret;
432		464
		465	nft_xt = container_of(expr->ops, struct nft_xt, ops);
		466	nft_xt->refcnt++;
433	return 0;	467	return 0;
434	err:	468	}
435	module_put(match->me);	469
		470	static int
		471	nft_match_init(const struct nft_ctx ctx, const struct nft_expr expr,
		472	const struct nlattr * const tb[])
		473	{
		474	return __nft_match_init(ctx, expr, tb, nft_expr_priv(expr));
		475	}
		476
		477	static int
		478	nft_match_large_init(const struct nft_ctx ctx, const struct nft_expr expr,
		479	const struct nlattr * const tb[])
		480	{
		481	struct nft_xt_match_priv *priv = nft_expr_priv(expr);
		482	struct xt_match *m = expr->ops->data;
		483	int ret;
		484
		485	priv->info = kmalloc(XT_ALIGN(m->matchsize), GFP_KERNEL);
		486	if (!priv->info)
		487	return -ENOMEM;
		488
		489	ret = __nft_match_init(ctx, expr, tb, priv->info);
		490	if (ret)
		491	kfree(priv->info);
436	return ret;	492	return ret;
437	}	493	}
438		494
439	static void	495	static void
440	nft_match_destroy(const struct nft_ctx ctx, const struct nft_expr expr)	496	__nft_match_destroy(const struct nft_ctx ctx, const struct nft_expr expr,
		497	void *info)
441	{	498	{
442	struct xt_match *match = expr->ops->data;	499	struct xt_match *match = expr->ops->data;
443	void *info = nft_expr_priv(expr);
444	struct xt_mtdtor_param par;	500	struct xt_mtdtor_param par;
445		501
446	par.net = ctx->net;	502	par.net = ctx->net;
@@ -450,13 +506,28 @@ nft_match_destroy(const struct nft_ctx ctx, const struct nft_expr expr) · 3 unmodified lines
450	if (par.match->destroy != NULL)	506	if (par.match->destroy != NULL)
451	par.match->destroy(&par);	507	par.match->destroy(&par);
452		508
453	nft_xt_put(container_of(expr->ops, struct nft_xt, ops));	509	if (nft_xt_put(container_of(expr->ops, struct nft_xt, ops)))
454	module_put(match->me);	510	module_put(match->me);
455	}	511	}
456		512
457	static int nft_match_dump(struct sk_buff skb, const struct nft_expr expr)	513	static void
		514	nft_match_destroy(const struct nft_ctx ctx, const struct nft_expr expr)
		515	{
		516	__nft_match_destroy(ctx, expr, nft_expr_priv(expr));
		517	}
		518
		519	static void
		520	nft_match_large_destroy(const struct nft_ctx ctx, const struct nft_expr expr)
		521	{
		522	struct nft_xt_match_priv *priv = nft_expr_priv(expr);
		523
		524	__nft_match_destroy(ctx, expr, priv->info);
		525	kfree(priv->info);
		526	}
		527
		528	static int __nft_match_dump(struct sk_buff skb, const struct nft_expr expr,
		529	void *info)
458	{	530	{
459	void *info = nft_expr_priv(expr);
460	struct xt_match *match = expr->ops->data;	531	struct xt_match *match = expr->ops->data;
461		532
462	if (nla_put_string(skb, NFTA_MATCH_NAME, match->name) \|\|	533	if (nla_put_string(skb, NFTA_MATCH_NAME, match->name) \|\|
@@ -470,6 +541,18 @@ nla_put_failure: · 7 unmodified lines
470	return -1;	541	return -1;
471	}	542	}
472		543
		544	static int nft_match_dump(struct sk_buff skb, const struct nft_expr expr)
		545	{
		546	return __nft_match_dump(skb, expr, nft_expr_priv(expr));
		547	}
		548
		549	static int nft_match_large_dump(struct sk_buff skb, const struct nft_expr e)
		550	{
		551	struct nft_xt_match_priv *priv = nft_expr_priv(e);
		552
		553	return __nft_match_dump(skb, e, priv->info);
		554	}
		555
473	static int nft_match_validate(const struct nft_ctx *ctx,	556	static int nft_match_validate(const struct nft_ctx *ctx,
474	const struct nft_expr *expr,	557	const struct nft_expr *expr,
475	const struct nft_data **data)	558	const struct nft_data **data)
@@ -637,6 +720,7 @@ nft_match_select_ops(const struct nft_ctx *ctx, · 161 unmodified lines
637	{	720	{
638	struct nft_xt *nft_match;	721	struct nft_xt *nft_match;
639	struct xt_match *match;	722	struct xt_match *match;
		723	unsigned int matchsize;
640	char *mt_name;	724	char *mt_name;
641	u32 rev, family;	725	u32 rev, family;
642	int err;	726	int err;
@@ -654,13 +738,8 @@ nft_match_select_ops(const struct nft_ctx *ctx, · 11 unmodified lines
654	list_for_each_entry(nft_match, &nft_match_list, head) {	738	list_for_each_entry(nft_match, &nft_match_list, head) {
655	struct xt_match *match = nft_match->ops.data;	739	struct xt_match *match = nft_match->ops.data;
656		740
657	if (nft_match_cmp(match, mt_name, rev, family)) {	741	if (nft_match_cmp(match, mt_name, rev, family))
658	if (!try_module_get(match->me))
659	return ERR_PTR(-ENOENT);
660
661	nft_match->refcnt++;
662	return &nft_match->ops;	742	return &nft_match->ops;
663	}
664	}	743	}
665		744
666	match = xt_request_find_match(family, mt_name, rev);	745	match = xt_request_find_match(family, mt_name, rev);
@@ -679,9 +758,8 @@ nft_match_select_ops(const struct nft_ctx *ctx, · 12 unmodified lines
679	goto err;	758	goto err;
680	}	759	}
681		760
682	nft_match->refcnt = 1;	761	nft_match->refcnt = 0;
683	nft_match->ops.type = &nft_match_type;	762	nft_match->ops.type = &nft_match_type;
684	nft_match->ops.size = NFT_EXPR_SIZE(XT_ALIGN(match->matchsize));
685	nft_match->ops.eval = nft_match_eval;	763	nft_match->ops.eval = nft_match_eval;
686	nft_match->ops.init = nft_match_init;	764	nft_match->ops.init = nft_match_init;
687	nft_match->ops.destroy = nft_match_destroy;	765	nft_match->ops.destroy = nft_match_destroy;
@@ -689,6 +767,18 @@ nft_match_select_ops(const struct nft_ctx *ctx, · 1 unmodified line
689	nft_match->ops.validate = nft_match_validate;	767	nft_match->ops.validate = nft_match_validate;
690	nft_match->ops.data = match;	768	nft_match->ops.data = match;
691		769
		770	matchsize = NFT_EXPR_SIZE(XT_ALIGN(match->matchsize));
		771	if (matchsize > NFT_MATCH_LARGE_THRESH) {
		772	matchsize = NFT_EXPR_SIZE(sizeof(struct nft_xt_match_priv));
		773
		774	nft_match->ops.eval = nft_match_large_eval;
		775	nft_match->ops.init = nft_match_large_init;
		776	nft_match->ops.destroy = nft_match_large_destroy;
		777	nft_match->ops.dump = nft_match_large_dump;
		778	}
		779
		780	nft_match->ops.size = matchsize;
		781
692	list_add(&nft_match->head, &nft_match_list);	782	list_add(&nft_match->head, &nft_match_list);
693		783
694	return &nft_match->ops;	784	return &nft_match->ops;
@@ -739,13 +829,8 @@ nft_target_select_ops(const struct nft_ctx *ctx, · 44 unmodified lines
739	list_for_each_entry(nft_target, &nft_target_list, head) {	829	list_for_each_entry(nft_target, &nft_target_list, head) {
740	struct xt_target *target = nft_target->ops.data;	830	struct xt_target *target = nft_target->ops.data;
741		831
742	if (nft_target_cmp(target, tg_name, rev, family)) {	832	if (nft_target_cmp(target, tg_name, rev, family))
743	if (!try_module_get(target->me))
744	return ERR_PTR(-ENOENT);
745
746	nft_target->refcnt++;
747	return &nft_target->ops;	833	return &nft_target->ops;
748	}
749	}	834	}
750		835
751	target = xt_request_find_target(family, tg_name, rev);	836	target = xt_request_find_target(family, tg_name, rev);
@@ -764,7 +849,7 @@ nft_target_select_ops(const struct nft_ctx *ctx, · 12 unmodified lines
764	goto err;	849	goto err;
765	}	850	}
766		851
767	nft_target->refcnt = 1;	852	nft_target->refcnt = 0;
768	nft_target->ops.type = &nft_target_type;	853	nft_target->ops.type = &nft_target_type;
769	nft_target->ops.size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize));	854	nft_target->ops.size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize));
770	nft_target->ops.init = nft_target_init;	855	nft_target->ops.init = nft_target_init;
@@ -823,6 +908,32 @@ err_match: · 52 unmodified lines
823		908
824	static void __exit nft_compat_module_exit(void)	909	static void __exit nft_compat_module_exit(void)
825	{	910	{
		911	struct nft_xt xt, next;
		912
		913	/* list should be empty here, it can be non-empty only in case there
		914	* was an error that caused nft_xt expr to not be initialized fully
		915	* and noone else requested the same expression later.
		916	*
		917	* In this case, the lists contain 0-refcount entries that still
		918	* hold module reference.
		919	*/
		920	list_for_each_entry_safe(xt, next, &nft_target_list, head) {
		921	struct xt_target *target = xt->ops.data;
		922
		923	if (WARN_ON_ONCE(xt->refcnt))
		924	continue;
		925	module_put(target->me);
		926	kfree(xt);
		927	}
		928
		929	list_for_each_entry_safe(xt, next, &nft_match_list, head) {
		930	struct xt_match *match = xt->ops.data;
		931
		932	if (WARN_ON_ONCE(xt->refcnt))
		933	continue;
		934	module_put(match->me);
		935	kfree(xt);
		936	}
826	nfnetlink_subsys_unregister(&nfnl_compat_subsys);	937	nfnetlink_subsys_unregister(&nfnl_compat_subsys);
827	nft_unregister_expr(&nft_target_type);	938	nft_unregister_expr(&nft_target_type);
828	nft_unregister_expr(&nft_match_type);	939	nft_unregister_expr(&nft_match_type);

net/netfilter/nft_immediate.c+12−3

 	return err;
 }
-static void nft_immediate_destroy(const struct nft_ctx *ctx,
+static void nft_immediate_activate(const struct nft_ctx *ctx,
-				  const struct nft_expr *expr)
+				   const struct nft_expr *expr)
+{
+	const struct nft_immediate_expr *priv = nft_expr_priv(expr);
+	return nft_data_hold(&priv->data, nft_dreg_to_type(priv->dreg));
+}
+static void nft_immediate_deactivate(const struct nft_ctx *ctx,
+				     const struct nft_expr *expr)
 {
 	const struct nft_immediate_expr *priv = nft_expr_priv(expr);
 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_immediate_expr)),
 	.eval		= nft_immediate_eval,
 	.init		= nft_immediate_init,
-	.destroy	= nft_immediate_destroy,
+	.activate	= nft_immediate_activate,
+	.deactivate	= nft_immediate_deactivate,
 	.dump		= nft_immediate_dump,
 	.validate	= nft_immediate_validate,
 };

net/netfilter/x_tables.c+6−0

 	struct xt_match *m;
 	int err = -ENOENT;
+	if (strnlen(name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN)
+		return ERR_PTR(-EINVAL);
 	mutex_lock(&xt[af].mutex);
 	list_for_each_entry(m, &xt[af].match, list) {
 		if (strcmp(m->name, name) == 0) {
 	struct xt_target *t;
 	int err = -ENOENT;
+	if (strnlen(name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN)
+		return ERR_PTR(-EINVAL);
 	mutex_lock(&xt[af].mutex);
 	list_for_each_entry(t, &xt[af].target, list) {
 		if (strcmp(t->name, name) == 0) {

net/packet/af_packet.c+3−1

 	if (skb == NULL)
 		goto out_unlock;
-	skb_set_network_header(skb, reserve);
+	skb_reset_network_header(skb);
 	err = -EINVAL;
 	if (sock->type == SOCK_DGRAM) {
 		offset = dev_hard_header(skb, dev, ntohs(proto), addr, NULL, len);
 		if (unlikely(offset < 0))
 			goto out_free;
+	} else if (reserve) {
+		skb_push(skb, reserve);
 	}
 	/* Returns -EFAULT on error */

net/sched/act_vlan.c+2−0

 			case htons(ETH_P_8021AD):
 				break;
 			default:
+				if (exists)
+					tcf_idr_release(*a, bind);
 				return -EPROTONOSUPPORT;
 			}
 		} else {

net/sched/sch_red.c+3−2

 					 extack);
 		if (IS_ERR(child))
 			return PTR_ERR(child);
-	}
-	if (child != &noop_qdisc)
+		/* child is fifo, no need to check for noop_qdisc */
 		qdisc_hash_add(child, true);
+	}
 	sch_tree_lock(sch);
 	q->flags = ctl->flags;
 	q->limit = ctl->limit;

net/sched/sch_tbf.c+3−2

 			err = PTR_ERR(child);
 			goto done;
 		}
+		/* child is fifo, no need to check for noop_qdisc */
+		qdisc_hash_add(child, true);
 	}
 	sch_tree_lock(sch);
 					  q->qdisc->qstats.backlog);
 		qdisc_destroy(q->qdisc);
 		q->qdisc = child;
-		if (child != &noop_qdisc)
-			qdisc_hash_add(child, true);
 	}
 	q->limit = qopt->limit;
 	if (tb[TCA_TBF_PBURST])

net/smc/smc_pnet.c+40−31

@@ -245,40 +245,45 @@ out: · 244 unmodified lines
245	static int smc_pnet_fill_entry(struct net net, struct smc_pnetentry pnetelem,	245	static int smc_pnet_fill_entry(struct net net, struct smc_pnetentry pnetelem,
246	struct nlattr *tb[])	246	struct nlattr *tb[])
247	{	247	{
248	char string, ibname = NULL;	248	char string, ibname;
249	int rc = 0;	249	int rc;
250		250
251	memset(pnetelem, 0, sizeof(*pnetelem));	251	memset(pnetelem, 0, sizeof(*pnetelem));
252	INIT_LIST_HEAD(&pnetelem->list);	252	INIT_LIST_HEAD(&pnetelem->list);
253	if (tb[SMC_PNETID_NAME]) {	253
254	string = (char *)nla_data(tb[SMC_PNETID_NAME]);	254	rc = -EINVAL;
255	if (!smc_pnetid_valid(string, pnetelem->pnet_name)) {	255	if (!tb[SMC_PNETID_NAME])
256	rc = -EINVAL;	256	goto error;
257	goto error;	257	string = (char *)nla_data(tb[SMC_PNETID_NAME]);
258	}	258	if (!smc_pnetid_valid(string, pnetelem->pnet_name))
259	}	259	goto error;
260	if (tb[SMC_PNETID_ETHNAME]) {	260
261	string = (char *)nla_data(tb[SMC_PNETID_ETHNAME]);	261	rc = -EINVAL;
262	pnetelem->ndev = dev_get_by_name(net, string);	262	if (!tb[SMC_PNETID_ETHNAME])
263	if (!pnetelem->ndev)	263	goto error;
264	return -ENOENT;	264	rc = -ENOENT;
265	}	265	string = (char *)nla_data(tb[SMC_PNETID_ETHNAME]);
266	if (tb[SMC_PNETID_IBNAME]) {	266	pnetelem->ndev = dev_get_by_name(net, string);
267	ibname = (char *)nla_data(tb[SMC_PNETID_IBNAME]);	267	if (!pnetelem->ndev)
268	ibname = strim(ibname);	268	goto error;
269	pnetelem->smcibdev = smc_pnet_find_ib(ibname);	269
270	if (!pnetelem->smcibdev) {	270	rc = -EINVAL;
271	rc = -ENOENT;	271	if (!tb[SMC_PNETID_IBNAME])
272	goto error;	272	goto error;
273	}	273	rc = -ENOENT;
274	}	274	ibname = (char *)nla_data(tb[SMC_PNETID_IBNAME]);
275	if (tb[SMC_PNETID_IBPORT]) {	275	ibname = strim(ibname);
276	pnetelem->ib_port = nla_get_u8(tb[SMC_PNETID_IBPORT]);	276	pnetelem->smcibdev = smc_pnet_find_ib(ibname);
277	if (pnetelem->ib_port > SMC_MAX_PORTS) {	277	if (!pnetelem->smcibdev)
278	rc = -EINVAL;	278	goto error;
279	goto error;	279
280	}	280	rc = -EINVAL;
281	}	281	if (!tb[SMC_PNETID_IBPORT])
		282	goto error;
		283	pnetelem->ib_port = nla_get_u8(tb[SMC_PNETID_IBPORT]);
		284	if (pnetelem->ib_port < 1 \|\| pnetelem->ib_port > SMC_MAX_PORTS)
		285	goto error;
		286
282	return 0;	287	return 0;
283		288
284	error:	289	error:
@@ -307,6 +312,8 @@ static int smc_pnet_get(struct sk_buff skb, struct genl_info info) · 22 unmodified lines
307	void *hdr;	312	void *hdr;
308	int rc;	313	int rc;
309		314
		315	if (!info->attrs[SMC_PNETID_NAME])
		316	return -EINVAL;
310	pnetelem = smc_pnet_find_pnetid(	317	pnetelem = smc_pnet_find_pnetid(
311	(char *)nla_data(info->attrs[SMC_PNETID_NAME]));	318	(char *)nla_data(info->attrs[SMC_PNETID_NAME]));
312	if (!pnetelem)	319	if (!pnetelem)
@@ -359,6 +366,8 @@ static int smc_pnet_add(struct sk_buff skb, struct genl_info info) · 46 unmodified lines
359		366
360	static int smc_pnet_del(struct sk_buff skb, struct genl_info info)	367	static int smc_pnet_del(struct sk_buff skb, struct genl_info info)
361	{	368	{
		369	if (!info->attrs[SMC_PNETID_NAME])
		370	return -EINVAL;
362	return smc_pnet_remove_by_pnetid(	371	return smc_pnet_remove_by_pnetid(
363	(char *)nla_data(info->attrs[SMC_PNETID_NAME]));	372	(char *)nla_data(info->attrs[SMC_PNETID_NAME]));
364	}	373	}

net/tls/tls_sw.c+4−5

 	struct scatterlist *sgin = &sgin_arr[0];
 	struct strp_msg *rxm = strp_msg(skb);
 	int ret, nsg = ARRAY_SIZE(sgin_arr);
-	char aad_recv[TLS_AAD_SPACE_SIZE];
 	struct sk_buff *unused;
 	ret = skb_copy_bits(skb, rxm->offset + TLS_HEADER_SIZE,
 	}
 	sg_init_table(sgin, nsg);
-	sg_set_buf(&sgin[0], aad_recv, sizeof(aad_recv));
+	sg_set_buf(&sgin[0], ctx->rx_aad_ciphertext, TLS_AAD_SPACE_SIZE);
 	nsg = skb_to_sgvec(skb, &sgin[1],
 			   rxm->offset + tls_ctx->rx.prepend_size,
 			   rxm->full_len - tls_ctx->rx.prepend_size);
-	tls_make_aad(aad_recv,
+	tls_make_aad(ctx->rx_aad_ciphertext,
 		     rxm->full_len - tls_ctx->rx.overhead_size,
 		     tls_ctx->rx.rec_seq,
 		     tls_ctx->rx.rec_seq_size,
 			if (to_copy <= len && page_count < MAX_SKB_FRAGS &&
 			    likely(!(flags & MSG_PEEK)))  {
 				struct scatterlist sgin[MAX_SKB_FRAGS + 1];
-				char unused[21];
 				int pages = 0;
 				zc = true;
 				sg_init_table(sgin, MAX_SKB_FRAGS + 1);
-				sg_set_buf(&sgin[0], unused, 13);
+				sg_set_buf(&sgin[0], ctx->rx_aad_plaintext,
+					   TLS_AAD_SPACE_SIZE);
 				err = zerocopy_from_iter(sk, &msg->msg_iter,
 							 to_copy, &pages,

tools/lib/bpf/libbpf.c+1−1

@@ -2035,7 +2035,7 @@ int bpf_prog_load_xattr(const struct bpf_prog_load_attr *attr, · 2034 unmodified lines
2035	return -EINVAL;	2035	return -EINVAL;
2036		2036
2037	obj = bpf_object__open(attr->file);	2037	obj = bpf_object__open(attr->file);
2038	if (IS_ERR(obj))	2038	if (IS_ERR_OR_NULL(obj))
2039	return -ENOENT;	2039	return -ENOENT;
2040		2040
2041	bpf_object__for_each_program(prog, obj) {	2041	bpf_object__for_each_program(prog, obj) {

tools/testing/selftests/bpf/test_verifier.c+5−0

 	FILE *fd;
 	fd = fopen("/proc/sys/"UNPRIV_SYSCTL, "r");
+	if (!fd) {
+		perror("fopen /proc/sys/"UNPRIV_SYSCTL);
+		unpriv_disabled = true;
+		return;
+	}
 	if (fgets(buf, 2, fd) == buf && atoi(buf))
 		unpriv_disabled = true;
 	fclose(fd);