lael-labs/linux

.mailmap+2−1

 Luca Weiss <luca@lucaweiss.eu> <luca@z3ntu.xyz>
 Lucas De Marchi <demarchi@kernel.org> <lucas.demarchi@intel.com>
 Lukasz Luba <lukasz.luba@arm.com> <l.luba@partner.samsung.com>
-Luo Jie <quic_luoj@quicinc.com> <luoj@codeaurora.org>
+Luo Jie <jie.luo@oss.qualcomm.com> <luoj@codeaurora.org>
+Luo Jie <jie.luo@oss.qualcomm.com> <quic_luoj@quicinc.com>
 Lance Yang <lance.yang@linux.dev> <ioworker0@gmail.com>
 Lance Yang <lance.yang@linux.dev> <mingzhe.yang@ly.com>
 Maciej W. Rozycki <macro@mips.com> <macro@imgtec.com>

Documentation/devicetree/bindings/clock/qcom,ipq9574-cmn-pll.yaml+1−1

@@ -8,7 +8,7 @@ title: Qualcomm CMN PLL Clock Controller on IPQ SoC · 7 unmodified lines
8		8
9	maintainers:	9	maintainers:
10	- Bjorn Andersson <andersson@kernel.org>	10	- Bjorn Andersson <andersson@kernel.org>
11	- Luo Jie <quic_luoj@quicinc.com>	11	- Luo Jie <jie.luo@oss.qualcomm.com>
12		12
13	description:	13	description:
14	The CMN (or common) PLL clock controller expects a reference	14	The CMN (or common) PLL clock controller expects a reference

Documentation/devicetree/bindings/clock/qcom,qca8k-nsscc.yaml+1−1

@@ -8,7 +8,7 @@ title: Qualcomm NSS Clock & Reset Controller on QCA8386/QCA8084 · 7 unmodified lines
8		8
9	maintainers:	9	maintainers:
10	- Bjorn Andersson <andersson@kernel.org>	10	- Bjorn Andersson <andersson@kernel.org>
11	- Luo Jie <quic_luoj@quicinc.com>	11	- Luo Jie <jie.luo@oss.qualcomm.com>
12		12
13	description: \|	13	description: \|
14	Qualcomm NSS clock control module provides the clocks and resets	14	Qualcomm NSS clock control module provides the clocks and resets

Documentation/devicetree/bindings/net/qcom,ipq9574-ppe.yaml+1−1

@@ -7,7 +7,7 @@ $schema: http://devicetree.org/meta-schemas/core.yaml# · 6 unmodified lines
7	title: Qualcomm IPQ packet process engine (PPE)	7	title: Qualcomm IPQ packet process engine (PPE)
8		8
9	maintainers:	9	maintainers:
10	- Luo Jie <quic_luoj@quicinc.com>	10	- Luo Jie <jie.luo@oss.qualcomm.com>
11	- Lei Wei <quic_leiwei@quicinc.com>	11	- Lei Wei <quic_leiwei@quicinc.com>
12	- Suruchi Agarwal <quic_suruchia@quicinc.com>	12	- Suruchi Agarwal <quic_suruchia@quicinc.com>
13	- Pavithra R <quic_pavir@quicinc.com>	13	- Pavithra R <quic_pavir@quicinc.com>

Documentation/devicetree/bindings/net/renesas,ether.yaml+1−2

@@ -121,8 +121,7 @@ examples: · 120 unmodified lines
121	#size-cells = <0>;	121	#size-cells = <0>;
122		122
123	phy1: ethernet-phy@1 {	123	phy1: ethernet-phy@1 {
124	compatible = "ethernet-phy-id0022.1537",	124	compatible = "ethernet-phy-id0022.1537";
125	"ethernet-phy-ieee802.3-c22";
126	reg = <1>;	125	reg = <1>;
127	interrupt-parent = <&irqc0>;	126	interrupt-parent = <&irqc0>;
128	interrupts = <0 IRQ_TYPE_LEVEL_LOW>;	127	interrupts = <0 IRQ_TYPE_LEVEL_LOW>;

Documentation/networking/netdevices.rst+2−0

@@ -433,6 +433,8 @@ exceptions) notifiers run under the instance lock. Please extend this · 432 unmodified lines
433	documentation whenever you make explicit assumption about lock being held	433	documentation whenever you make explicit assumption about lock being held
434	from a notifier.	434	from a notifier.
435		435
		436	Drivers must not generate nested notifications of the ops-locked types.
		437
436	NETDEV_INTERNAL symbol namespace	438	NETDEV_INTERNAL symbol namespace
437	================================	439	================================
438		440

MAINTAINERS+3−4

@@ -22323,9 +22323,9 @@ F: Documentation/devicetree/bindings/power/supply/qcom,pmi8998-charger.yaml · 22322 unmodified lines
22323	F: drivers/power/supply/qcom_smbx.c	22323	F: drivers/power/supply/qcom_smbx.c
22324		22324
22325	QUALCOMM PPE DRIVER	22325	QUALCOMM PPE DRIVER
22326	M: Luo Jie <quic_luoj@quicinc.com>	22326	M: Luo Jie <jie.luo@oss.qualcomm.com>
22327	L: netdev@vger.kernel.org	22327	L: netdev@vger.kernel.org
22328	S: Supported	22328	S: Maintained
22329	F: Documentation/devicetree/bindings/net/qcom,ipq9574-ppe.yaml	22329	F: Documentation/devicetree/bindings/net/qcom,ipq9574-ppe.yaml
22330	F: Documentation/networking/device_drivers/ethernet/qualcomm/ppe/ppe.rst	22330	F: Documentation/networking/device_drivers/ethernet/qualcomm/ppe/ppe.rst
22331	F: drivers/net/ethernet/qualcomm/ppe/	22331	F: drivers/net/ethernet/qualcomm/ppe/
@@ -26001,9 +26001,8 @@ S: Maintained · 3669 unmodified lines
26001	F: drivers/net/ethernet/dlink/sundance.c	26001	F: drivers/net/ethernet/dlink/sundance.c
26002		26002
26003	SUNPLUS ETHERNET DRIVER	26003	SUNPLUS ETHERNET DRIVER
26004	M: Wells Lu <wellslutw@gmail.com>
26005	L: netdev@vger.kernel.org	26004	L: netdev@vger.kernel.org
26006	S: Maintained	26005	S: Orphan
26007	W: https://sunplus.atlassian.net/wiki/spaces/doc/overview	26006	W: https://sunplus.atlassian.net/wiki/spaces/doc/overview
26008	F: Documentation/devicetree/bindings/net/sunplus,sp7021-emac.yaml	26007	F: Documentation/devicetree/bindings/net/sunplus,sp7021-emac.yaml
26009	F: drivers/net/ethernet/sunplus/	26008	F: drivers/net/ethernet/sunplus/

drivers/net/dsa/mxl862xx/mxl862xx-host.c+10−8

 #include <linux/crc16.h>
 #include <linux/iopoll.h>
 #include <linux/limits.h>
+#include <linux/unaligned.h>
 #include <net/dsa.h>
 #include "mxl862xx.h"
 #include "mxl862xx-host.h"
 						  crc_err_work);
 	struct dsa_port *dp;
-	dev_warn(&priv->mdiodev->dev,
-		 "MDIO CRC error detected, shutting down all ports\n");
 	rtnl_lock();
-	dsa_switch_for_each_cpu_port(dp, priv->ds)
+	if (!test_bit(MXL862XX_FLAG_WORK_STOPPED, &priv->flags)) {
-		dev_close(dp->conduit);
+		dev_warn(&priv->mdiodev->dev,
+			 "MDIO CRC error detected, shutting down all ports\n");
+		dsa_switch_for_each_cpu_port(dp, priv->ds)
+			dev_close(dp->conduit);
+	}
 	rtnl_unlock();
 	clear_bit(MXL862XX_FLAG_CRC_ERR, &priv->flags);
 	 * zero words individually.
 	 */
 	for (i = 0, zeros = 0; i < size / 2 && zeros < RST_DATA_THRESHOLD; i++)
-		if (!data[i])
+		if (!get_unaligned_le16(&data[i]))
 			zeros++;
 	if (zeros < RST_DATA_THRESHOLD && (size & 1) && !*(u8 *)&data[i])
 			 */
 			val = *(u8 *)&data[i] | ((crc & 0xff) << 8);
 		} else {
-			val = le16_to_cpu(data[i]);
+			val = get_unaligned_le16(&data[i]);
 		}
 		/* After RST_DATA, skip zero data words as the registers
 			*(uint8_t *)&data[i] = ret & 0xff;
 			crc = (ret >> 8) & 0xff;
 		} else {
-			data[i] = cpu_to_le16((u16)ret);
+			put_unaligned_le16((u16)ret, &data[i]);
 		}
 	}

drivers/net/dsa/realtek/rtl8366rb-leds.c+4−4

 	struct led_init_data init_data = { };
 	enum led_default_state state;
 	struct rtl8366rb_led *led;
+	char name[64];
 	u32 led_group;
 	int ret;
 	init_data.fwnode = led_fwnode;
 	init_data.devname_mandatory = true;
-	init_data.devicename = kasprintf(GFP_KERNEL, "Realtek-%d:0%d:%d",
+	snprintf(name, sizeof(name), "Realtek-%d:0%d:%d",
-					 dp->ds->index, dp->index, led_group);
+		 dp->ds->index, dp->index, led_group);
-	if (!init_data.devicename)
+	init_data.devicename = name;
-		return -ENOMEM;
 	ret = devm_led_classdev_register_ext(priv->dev, &led->cdev, &init_data);
 	if (ret) {

drivers/net/dsa/sja1105/sja1105_ptp.c+1−1

@@ -755,7 +755,7 @@ static int sja1105_per_out_enable(struct sja1105_private *priv, · 754 unmodified lines
755	* 2 edges on PTP_CLK. So check for truncation which happens	755	* 2 edges on PTP_CLK. So check for truncation which happens
756	* at periods larger than around 68.7 seconds.	756	* at periods larger than around 68.7 seconds.
757	*/	757	*/
758	pin_duration = ns_to_sja1105_ticks(pin_duration / 2);	758	pin_duration = max_t(u64, ns_to_sja1105_ticks(pin_duration / 2), 1);
759	if (pin_duration > U32_MAX) {	759	if (pin_duration > U32_MAX) {
760	rc = -ERANGE;	760	rc = -ERANGE;
761	goto out;	761	goto out;

drivers/net/ethernet/airoha/airoha_eth.c+111−86

@@ -1004,6 +1004,7 @@ static int airoha_qdma_tx_napi_poll(struct napi_struct *napi, int budget) · 1003 unmodified lines
1004		1004
1005	e = &q->entry[index];	1005	e = &q->entry[index];
1006	skb = e->skb;	1006	skb = e->skb;
		1007	e->skb = NULL;
1007		1008
1008	dma_unmap_single(eth->dev, e->dma_addr, e->dma_len,	1009	dma_unmap_single(eth->dev, e->dma_addr, e->dma_len,
1009	DMA_TO_DEVICE);	1010	DMA_TO_DEVICE);
@@ -1147,55 +1148,76 @@ static int airoha_qdma_init_tx(struct airoha_qdma *qdma) · 137 unmodified lines
1147	return 0;	1148	return 0;
1148	}	1149	}
1149		1150
1150	static void airoha_qdma_cleanup_tx_queue(struct airoha_queue *q)	1151	static void airoha_qdma_tx_cleanup(struct airoha_qdma *qdma)
1151	{	1152	{
1152	struct airoha_qdma *qdma = q->qdma;	1153	u32 status;
1153	struct airoha_eth *eth = qdma->eth;	1154	int i;
1154	int i, qid = q - &qdma->q_tx[0];
1155	u16 index = 0;
1156		1155
1157	spin_lock_bh(&q->lock);	1156	airoha_qdma_clear(qdma, REG_QDMA_GLOBAL_CFG,
1158	for (i = 0; i < q->ndesc; i++) {	1157	GLOBAL_CFG_TX_DMA_EN_MASK);
1159	struct airoha_queue_entry *e = &q->entry[i];	1158	if (read_poll_timeout(airoha_qdma_rr, status,
1160	struct airoha_qdma_desc *desc = &q->desc[i];	1159	!(status & GLOBAL_CFG_TX_DMA_BUSY_MASK),
		1160	USEC_PER_MSEC, 50 * USEC_PER_MSEC, true,
		1161	qdma, REG_QDMA_GLOBAL_CFG))
		1162	dev_warn(qdma->eth->dev, "QDMA TX DMA busy timeout\n");
1161		1163
1162	if (!e->dma_addr)	1164	for (i = 0; i < ARRAY_SIZE(qdma->q_tx); i++) {
		1165	struct airoha_queue *q = &qdma->q_tx[i];
		1166	u16 index = 0;
		1167	int j;
		1168
		1169	if (!q->ndesc)
1163	continue;	1170	continue;
1164		1171
1165	dma_unmap_single(eth->dev, e->dma_addr, e->dma_len,	1172	spin_lock_bh(&q->lock);
1166	DMA_TO_DEVICE);
1167	dev_kfree_skb_any(e->skb);
1168	e->dma_addr = 0;
1169	e->skb = NULL;
1170	list_add_tail(&e->list, &q->tx_list);
1171		1173
1172	/* Reset DMA descriptor */	1174	q->flushing = true;
1173	WRITE_ONCE(desc->ctrl, 0);	1175	for (j = 0; j < q->ndesc; j++) {
1174	WRITE_ONCE(desc->addr, 0);	1176	struct airoha_queue_entry *e = &q->entry[j];
1175	WRITE_ONCE(desc->data, 0);	1177	struct airoha_qdma_desc *desc = &q->desc[j];
1176	WRITE_ONCE(desc->msg0, 0);	1178	struct sk_buff *skb = e->skb;
1177	WRITE_ONCE(desc->msg1, 0);
1178	WRITE_ONCE(desc->msg2, 0);
1179		1179
1180	q->queued--;	1180	if (!e->dma_addr)
1181	}	1181	continue;
1182		1182
1183	if (!list_empty(&q->tx_list)) {	1183	dma_unmap_single(qdma->eth->dev, e->dma_addr,
1184	struct airoha_queue_entry *e;	1184	e->dma_len, DMA_TO_DEVICE);
		1185	e->dma_addr = 0;
		1186	list_add_tail(&e->list, &q->tx_list);
		1187
		1188	WRITE_ONCE(desc->ctrl, 0);
		1189	WRITE_ONCE(desc->addr, 0);
		1190	WRITE_ONCE(desc->data, 0);
		1191	WRITE_ONCE(desc->msg0, 0);
		1192	WRITE_ONCE(desc->msg1, 0);
		1193	WRITE_ONCE(desc->msg2, 0);
		1194
		1195	if (skb) {
		1196	struct netdev_queue *txq;
		1197
		1198	txq = skb_get_tx_queue(skb->dev, skb);
		1199	netdev_tx_completed_queue(txq, 1, skb->len);
		1200	dev_kfree_skb_any(skb);
		1201	e->skb = NULL;
		1202	}
1185		1203
1186	e = list_first_entry(&q->tx_list, struct airoha_queue_entry,	1204	q->queued--;
1187	list);	1205	}
1188	index = e - q->entry;
1189	}
1190	/* Set TX_DMA_IDX to TX_CPU_IDX to notify the hw the QDMA TX ring is
1191	* empty.
1192	*/
1193	airoha_qdma_rmw(qdma, REG_TX_CPU_IDX(qid), TX_RING_CPU_IDX_MASK,
1194	FIELD_PREP(TX_RING_CPU_IDX_MASK, index));
1195	airoha_qdma_rmw(qdma, REG_TX_DMA_IDX(qid), TX_RING_DMA_IDX_MASK,
1196	FIELD_PREP(TX_RING_DMA_IDX_MASK, index));
1197		1206
1198	spin_unlock_bh(&q->lock);	1207	if (!list_empty(&q->tx_list)) {
		1208	struct airoha_queue_entry *e;
		1209
		1210	e = list_first_entry(&q->tx_list,
		1211	struct airoha_queue_entry, list);
		1212	index = e - q->entry;
		1213	}
		1214	airoha_qdma_rmw(qdma, REG_TX_CPU_IDX(i), TX_RING_CPU_IDX_MASK,
		1215	FIELD_PREP(TX_RING_CPU_IDX_MASK, index));
		1216	airoha_qdma_rmw(qdma, REG_TX_DMA_IDX(i), TX_RING_DMA_IDX_MASK,
		1217	FIELD_PREP(TX_RING_DMA_IDX_MASK, index));
		1218
		1219	spin_unlock_bh(&q->lock);
		1220	}
1199	}	1221	}
1200		1222
1201	static int airoha_qdma_init_hfwd_queues(struct airoha_qdma *qdma)	1223	static int airoha_qdma_init_hfwd_queues(struct airoha_qdma *qdma)
@@ -1523,10 +1545,23 @@ static int airoha_qdma_init(struct platform_device *pdev, · 321 unmodified lines
1523	return airoha_qdma_hw_init(qdma);	1545	return airoha_qdma_hw_init(qdma);
1524	}	1546	}
1525		1547
1526	static void airoha_qdma_cleanup(struct airoha_qdma *qdma)	1548	static void airoha_qdma_cleanup(struct airoha_eth *eth,
		1549	struct airoha_qdma *qdma)
1527	{	1550	{
1528	int i;	1551	int i;
1529		1552
		1553	if (test_bit(DEV_STATE_INITIALIZED, &eth->state)) {
		1554	u32 status;
		1555
		1556	airoha_qdma_clear(qdma, REG_QDMA_GLOBAL_CFG,
		1557	GLOBAL_CFG_RX_DMA_EN_MASK);
		1558	if (read_poll_timeout(airoha_qdma_rr, status,
		1559	!(status & GLOBAL_CFG_RX_DMA_BUSY_MASK),
		1560	USEC_PER_MSEC, 50 * USEC_PER_MSEC, true,
		1561	qdma, REG_QDMA_GLOBAL_CFG))
		1562	dev_warn(eth->dev, "QDMA RX DMA busy timeout\n");
		1563	}
		1564
1530	for (i = 0; i < ARRAY_SIZE(qdma->q_rx); i++) {	1565	for (i = 0; i < ARRAY_SIZE(qdma->q_rx); i++) {
1531	if (!qdma->q_rx[i].ndesc)	1566	if (!qdma->q_rx[i].ndesc)
1532	continue;	1567	continue;
@@ -1546,12 +1581,6 @@ static void airoha_qdma_cleanup(struct airoha_qdma *qdma) · 13 unmodified lines
1546	netif_napi_del(&qdma->q_tx_irq[i].napi);	1581	netif_napi_del(&qdma->q_tx_irq[i].napi);
1547	}	1582	}
1548		1583
1549	for (i = 0; i < ARRAY_SIZE(qdma->q_tx); i++) {
1550	if (!qdma->q_tx[i].ndesc)
1551	continue;
1552
1553	airoha_qdma_cleanup_tx_queue(&qdma->q_tx[i]);
1554	}
1555	}	1584	}
1556		1585
1557	static int airoha_hw_init(struct platform_device *pdev,	1586	static int airoha_hw_init(struct platform_device *pdev,
@@ -1593,7 +1622,7 @@ static int airoha_hw_init(struct platform_device *pdev, · 35 unmodified lines
1593	return 0;	1622	return 0;
1594	error:	1623	error:
1595	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++)	1624	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++)
1596	airoha_qdma_cleanup(&eth->qdma[i]);	1625	airoha_qdma_cleanup(eth, &eth->qdma[i]);
1597		1626
1598	return err;	1627	return err;
1599	}	1628	}
@@ -1603,7 +1632,7 @@ static void airoha_hw_cleanup(struct airoha_eth *eth) · 3 unmodified lines
1603	int i;	1632	int i;
1604		1633
1605	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++)	1634	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++)
1606	airoha_qdma_cleanup(&eth->qdma[i]);	1635	airoha_qdma_cleanup(eth, &eth->qdma[i]);
1607	airoha_ppe_deinit(eth);	1636	airoha_ppe_deinit(eth);
1608	}	1637	}
1609		1638
@@ -1837,11 +1866,6 @@ static int airoha_dev_open(struct net_device *netdev) · 227 unmodified lines
1837	}	1866	}
1838	port->users++;	1867	port->users++;
1839		1868
1840	airoha_qdma_set(qdma, REG_QDMA_GLOBAL_CFG,
1841	GLOBAL_CFG_TX_DMA_EN_MASK \|
1842	GLOBAL_CFG_RX_DMA_EN_MASK);
1843	qdma->users++;
1844
1845	if (!airoha_is_lan_gdm_dev(dev) &&	1869	if (!airoha_is_lan_gdm_dev(dev) &&
1846	airoha_ppe_is_enabled(qdma->eth, 1))	1870	airoha_ppe_is_enabled(qdma->eth, 1))
1847	pse_port = FE_PSE_PORT_PPE2;	1871	pse_port = FE_PSE_PORT_PPE2;
@@ -1880,12 +1904,9 @@ static int airoha_dev_stop(struct net_device *netdev) · 32 unmodified lines
1880	struct airoha_gdm_dev *dev = netdev_priv(netdev);	1904	struct airoha_gdm_dev *dev = netdev_priv(netdev);
1881	struct airoha_gdm_port *port = dev->port;	1905	struct airoha_gdm_port *port = dev->port;
1882	struct airoha_qdma *qdma = dev->qdma;	1906	struct airoha_qdma *qdma = dev->qdma;
1883	int i;
1884		1907
1885	netif_tx_disable(netdev);	1908	netif_tx_disable(netdev);
1886	airoha_set_vip_for_gdm_port(dev, false);	1909	airoha_set_vip_for_gdm_port(dev, false);
1887	for (i = 0; i < netdev->num_tx_queues; i++)
1888	netdev_tx_reset_subqueue(netdev, i);
1889		1910
1890	if (--port->users)	1911	if (--port->users)
1891	airoha_set_port_mtu(dev->eth, port);	1912	airoha_set_port_mtu(dev->eth, port);
@@ -1893,20 +1914,6 @@ static int airoha_dev_stop(struct net_device *netdev) · 1 unmodified line
1893	airoha_set_gdm_port_fwd_cfg(qdma->eth,	1914	airoha_set_gdm_port_fwd_cfg(qdma->eth,
1894	REG_GDM_FWD_CFG(port->id),	1915	REG_GDM_FWD_CFG(port->id),
1895	FE_PSE_PORT_DROP);	1916	FE_PSE_PORT_DROP);
1896
1897	if (!--qdma->users) {
1898	airoha_qdma_clear(qdma, REG_QDMA_GLOBAL_CFG,
1899	GLOBAL_CFG_TX_DMA_EN_MASK \|
1900	GLOBAL_CFG_RX_DMA_EN_MASK);
1901
1902	for (i = 0; i < ARRAY_SIZE(qdma->q_tx); i++) {
1903	if (!qdma->q_tx[i].ndesc)
1904	continue;
1905
1906	airoha_qdma_cleanup_tx_queue(&qdma->q_tx[i]);
1907	}
1908	}
1909
1910	return 0;	1917	return 0;
1911	}	1918	}
1912		1919
@@ -2110,7 +2117,7 @@ static u16 airoha_dev_select_queue(struct net_device *netdev, · 197 unmodified lines
2110	*/	2117	*/
2111	channel = netdev_uses_dsa(netdev) ? skb_get_queue_mapping(skb) : port->id;	2118	channel = netdev_uses_dsa(netdev) ? skb_get_queue_mapping(skb) : port->id;
2112	channel = channel % AIROHA_NUM_QOS_CHANNELS;	2119	channel = channel % AIROHA_NUM_QOS_CHANNELS;
2113	queue = (skb->priority - 1) % AIROHA_NUM_QOS_QUEUES; /* QoS queue */	2120	queue = skb->priority % AIROHA_NUM_QOS_QUEUES;
2114	queue = channel * AIROHA_NUM_QOS_QUEUES + queue;	2121	queue = channel * AIROHA_NUM_QOS_QUEUES + queue;
2115		2122
2116	return queue < netdev->num_tx_queues ? queue : 0;	2123	return queue < netdev->num_tx_queues ? queue : 0;
@@ -2229,6 +2236,9 @@ static netdev_tx_t airoha_dev_xmit(struct sk_buff *skb, · 112 unmodified lines
2229		2236
2230	spin_lock_bh(&q->lock);	2237	spin_lock_bh(&q->lock);
2231		2238
		2239	if (q->flushing)
		2240	goto error_unlock;
		2241
2232	txq = skb_get_tx_queue(netdev, skb);	2242	txq = skb_get_tx_queue(netdev, skb);
2233	nr_frags = 1 + skb_shinfo(skb)->nr_frags;	2243	nr_frags = 1 + skb_shinfo(skb)->nr_frags;
2234		2244
@@ -2309,7 +2319,7 @@ error_unmap: · 74 unmodified lines
2309	e->dma_addr = 0;	2319	e->dma_addr = 0;
2310	}	2320	}
2311	list_splice(&tx_list, &q->tx_list);	2321	list_splice(&tx_list, &q->tx_list);
2312		2322	error_unlock:
2313	spin_unlock_bh(&q->lock);	2323	spin_unlock_bh(&q->lock);
2314	error:	2324	error:
2315	dev_kfree_skb_any(skb);	2325	dev_kfree_skb_any(skb);
@@ -2395,7 +2405,7 @@ static int airoha_qdma_set_chan_tx_sched(struct net_device *netdev, · 79 unmodified lines
2395	struct airoha_gdm_dev *dev = netdev_priv(netdev);	2405	struct airoha_gdm_dev *dev = netdev_priv(netdev);
2396	int i;	2406	int i;
2397		2407
2398	for (i = 0; i < AIROHA_NUM_TX_RING; i++)	2408	for (i = 0; i < AIROHA_NUM_QOS_QUEUES; i++)
2399	airoha_qdma_clear(dev->qdma, REG_QUEUE_CLOSE_CFG(channel),	2409	airoha_qdma_clear(dev->qdma, REG_QUEUE_CLOSE_CFG(channel),
2400	TXQ_DISABLE_CHAN_QUEUE_MASK(channel, i));	2410	TXQ_DISABLE_CHAN_QUEUE_MASK(channel, i));
2401		2411
@@ -2789,7 +2799,7 @@ static int airoha_tc_htb_alloc_leaf_queue(struct net_device *netdev, · 387 unmodified lines
2789	struct tc_htb_qopt_offload *opt)	2799	struct tc_htb_qopt_offload *opt)
2790	{	2800	{
2791	u32 channel = TC_H_MIN(opt->classid) % AIROHA_NUM_QOS_CHANNELS;	2801	u32 channel = TC_H_MIN(opt->classid) % AIROHA_NUM_QOS_CHANNELS;
2792	int err, num_tx_queues = netdev->real_num_tx_queues;	2802	int err, num_tx_queues = AIROHA_NUM_TX_RING + channel + 1;
2793	struct airoha_gdm_dev *dev = netdev_priv(netdev);	2803	struct airoha_gdm_dev *dev = netdev_priv(netdev);
2794	struct airoha_qdma *qdma = dev->qdma;	2804	struct airoha_qdma *qdma = dev->qdma;
2795		2805
@@ -2806,13 +2816,15 @@ static int airoha_tc_htb_alloc_leaf_queue(struct net_device *netdev, · 10 unmodified lines
2806	if (err)	2816	if (err)
2807	goto error;	2817	goto error;
2808		2818
2809	err = netif_set_real_num_tx_queues(netdev, num_tx_queues + 1);	2819	if (num_tx_queues > netdev->real_num_tx_queues) {
2810	if (err) {	2820	err = netif_set_real_num_tx_queues(netdev, num_tx_queues);
2811	airoha_qdma_set_tx_rate_limit(netdev, channel, 0,	2821	if (err) {
2812	opt->quantum);	2822	airoha_qdma_set_tx_rate_limit(netdev, channel, 0,
2813	NL_SET_ERR_MSG_MOD(opt->extack,	2823	opt->quantum);
2814	"failed setting real_num_tx_queues");	2824	NL_SET_ERR_MSG_MOD(opt->extack,
2815	goto error;	2825	"failed setting real_num_tx_queues");
		2826	goto error;
		2827	}
2816	}	2828	}
2817		2829
2818	set_bit(channel, dev->qos_sq_bmap);	2830	set_bit(channel, dev->qos_sq_bmap);
@@ -3003,13 +3015,18 @@ static int airoha_dev_setup_tc_block(struct net_device *dev, · 184 unmodified lines
3003	static void airoha_tc_remove_htb_queue(struct net_device *netdev, int queue)	3015	static void airoha_tc_remove_htb_queue(struct net_device *netdev, int queue)
3004	{	3016	{
3005	struct airoha_gdm_dev *dev = netdev_priv(netdev);	3017	struct airoha_gdm_dev *dev = netdev_priv(netdev);
		3018	int num_tx_queues = AIROHA_NUM_TX_RING;
3006	struct airoha_qdma *qdma = dev->qdma;	3019	struct airoha_qdma *qdma = dev->qdma;
3007		3020
3008	netif_set_real_num_tx_queues(netdev, netdev->real_num_tx_queues - 1);	3021	airoha_qdma_set_tx_rate_limit(netdev, queue, 0, 0);
3009	airoha_qdma_set_tx_rate_limit(netdev, queue + 1, 0, 0);
3010		3022
3011	clear_bit(queue, qdma->qos_channel_map);	3023	clear_bit(queue, qdma->qos_channel_map);
3012	clear_bit(queue, dev->qos_sq_bmap);	3024	clear_bit(queue, dev->qos_sq_bmap);
		3025
		3026	if (!bitmap_empty(dev->qos_sq_bmap, AIROHA_NUM_QOS_CHANNELS))
		3027	num_tx_queues += find_last_bit(dev->qos_sq_bmap,
		3028	AIROHA_NUM_QOS_CHANNELS) + 1;
		3029	netif_set_real_num_tx_queues(netdev, num_tx_queues);
3013	}	3030	}
3014		3031
3015	static int airoha_tc_htb_delete_leaf_queue(struct net_device *netdev,	3032	static int airoha_tc_htb_delete_leaf_queue(struct net_device *netdev,
@@ -3413,8 +3430,12 @@ static int airoha_probe(struct platform_device *pdev) · 397 unmodified lines
3413	if (err)	3430	if (err)
3414	goto error_netdev_free;	3431	goto error_netdev_free;
3415		3432
3416	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++)	3433	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++) {
3417	airoha_qdma_start_napi(&eth->qdma[i]);	3434	airoha_qdma_start_napi(&eth->qdma[i]);
		3435	airoha_qdma_set(&eth->qdma[i], REG_QDMA_GLOBAL_CFG,
		3436	GLOBAL_CFG_TX_DMA_EN_MASK \|
		3437	GLOBAL_CFG_RX_DMA_EN_MASK);
		3438	}
3418		3439
3419	for_each_child_of_node(pdev->dev.of_node, np) {	3440	for_each_child_of_node(pdev->dev.of_node, np) {
3420	if (!of_device_is_compatible(np, "airoha,eth-mac"))	3441	if (!of_device_is_compatible(np, "airoha,eth-mac"))
@@ -3437,8 +3458,10 @@ static int airoha_probe(struct platform_device *pdev) · 16 unmodified lines
3437	return 0;	3458	return 0;
3438		3459
3439	error_napi_stop:	3460	error_napi_stop:
3440	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++)	3461	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++) {
3441	airoha_qdma_stop_napi(&eth->qdma[i]);	3462	airoha_qdma_stop_napi(&eth->qdma[i]);
		3463	airoha_qdma_tx_cleanup(&eth->qdma[i]);
		3464	}
3442		3465
3443	for (i = 0; i < ARRAY_SIZE(eth->ports); i++) {	3466	for (i = 0; i < ARRAY_SIZE(eth->ports); i++) {
3444	struct airoha_gdm_port *port = eth->ports[i];	3467	struct airoha_gdm_port *port = eth->ports[i];
@@ -3474,8 +3497,10 @@ static void airoha_remove(struct platform_device *pdev) · 29 unmodified lines
3474	struct airoha_eth *eth = platform_get_drvdata(pdev);	3497	struct airoha_eth *eth = platform_get_drvdata(pdev);
3475	int i;	3498	int i;
3476		3499
3477	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++)	3500	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++) {
3478	airoha_qdma_stop_napi(&eth->qdma[i]);	3501	airoha_qdma_stop_napi(&eth->qdma[i]);
		3502	airoha_qdma_tx_cleanup(&eth->qdma[i]);
		3503	}
3479		3504
3480	for (i = 0; i < ARRAY_SIZE(eth->ports); i++) {	3505	for (i = 0; i < ARRAY_SIZE(eth->ports); i++) {
3481	struct airoha_gdm_port *port = eth->ports[i];	3506	struct airoha_gdm_port *port = eth->ports[i];

drivers/net/ethernet/airoha/airoha_eth.h+1−2

 	int free_thr;
 	int buf_size;
 	bool txq_stopped;
+	bool flushing;
 	struct napi_struct napi;
 	struct page_pool *page_pool;
 	struct airoha_eth *eth;
 	void __iomem *regs;
-	int users;
 	struct airoha_irq_bank irq_banks[AIROHA_MAX_NUM_IRQ_BANKS];
 	struct airoha_tx_irq_queue q_tx_irq[AIROHA_NUM_TX_IRQ];

drivers/net/ethernet/airoha/airoha_ppe.c+2−1

@@ -1601,7 +1601,8 @@ int airoha_ppe_init(struct airoha_eth *eth) · 1600 unmodified lines
1601	return -ENOMEM;	1601	return -ENOMEM;
1602	}	1602	}
1603		1603
1604	ppe->foe_check_time = devm_kzalloc(eth->dev, ppe_num_entries,	1604	ppe->foe_check_time = devm_kzalloc(eth->dev,
		1605	ppe_num_entries * sizeof(*ppe->foe_check_time),
1605	GFP_KERNEL);	1606	GFP_KERNEL);
1606	if (!ppe->foe_check_time)	1607	if (!ppe->foe_check_time)
1607	return -ENOMEM;	1608	return -ENOMEM;

drivers/net/ethernet/amazon/ena/ena_netdev.c+21−2

 	}
 }
+static void ena_destroy_xdp_tx_queues(struct ena_adapter *adapter)
+{
+	u16 ena_qid;
+	int i;
+	for (i = adapter->xdp_first_ring;
+	     i < adapter->xdp_first_ring + adapter->xdp_num_queues; i++) {
+		ena_qid = ENA_IO_TXQ_IDX(i);
+		ena_com_destroy_io_queue(adapter->ena_dev, ena_qid);
+	}
+}
 static void ena_destroy_all_rx_queues(struct ena_adapter *adapter)
 {
 	u16 ena_qid;
 		rc = ena_setup_tx_resources_in_range(adapter,
 						     0,
 						     adapter->num_io_queues);
-		if (rc)
+		if (rc) {
+			ena_destroy_xdp_tx_queues(adapter);
+			ena_free_all_io_tx_resources_in_range(adapter,
+							      adapter->xdp_first_ring,
+							      adapter->xdp_num_queues);
 			goto err_setup_tx;
+		}
 		rc = ena_create_io_tx_queues_in_range(adapter,
 						      0,
 						      adapter->num_io_queues);
-		if (rc)
+		if (rc) {
+			ena_destroy_xdp_tx_queues(adapter);
 			goto err_create_tx_queues;
+		}
 		rc = ena_setup_all_rx_resources(adapter);
 		if (rc)

drivers/net/ethernet/amd/au1000_eth.c+2−1

 	/* stop the device */
 	netif_stop_queue(dev);
+	spin_unlock_irqrestore(&aup->lock, flags);
 	/* disable the interrupt */
 	free_irq(dev->irq, dev);
-	spin_unlock_irqrestore(&aup->lock, flags);
 	return 0;
 }

drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c+1−2

 	fp = kzalloc_objs(*fp, bp->fp_array_size);
 	if (!fp)
 		goto alloc_err;
+	bp->fp = fp;
 	for (i = 0; i < bp->fp_array_size; i++) {
 		fp[i].tpa_info =
 			kzalloc_objs(struct bnx2x_agg_info,
 			goto alloc_err;
 	}
-	bp->fp = fp;
 	/* allocate sp objs */
 	bp->sp_objs = kzalloc_objs(struct bnx2x_sp_objs, bp->fp_array_size);
 	if (!bp->sp_objs)

drivers/net/ethernet/broadcom/bnxt/bnxt.c+47−1

 				stats->hw_masks, stats->len / 8, false);
 }
-static void bnxt_accumulate_all_stats(struct bnxt *bp)
+static void bnxt_accumulate_ring_stats(struct bnxt *bp)
 {
 	struct bnxt_stats_mem *ring0_stats;
 	bool ignore_zero = false;
 					ring0_stats->hw_masks,
 					ring0_stats->len / 8, ignore_zero);
 	}
+}
+static void bnxt_accumulate_port_stats(struct bnxt *bp)
+{
 	if (bp->flags & BNXT_FLAG_PORT_STATS) {
 		struct bnxt_stats_mem *stats = &bp->port_stats;
 		__le64 *hw_stats = stats->hw_stats;
 	}
 }
+static void bnxt_accumulate_all_stats(struct bnxt *bp)
+{
+	bnxt_accumulate_ring_stats(bp);
+	bnxt_accumulate_port_stats(bp);
+}
+/* Re-accumulate ring stats from DMA buffers if stale.
+ * uAPIs for reading sw_stats should call this first.
+ *
+ * We promise user space update frequency of bp->stats_coal_ticks but
+ * the update is a two step process - first device updates the DMA buffer,
+ * then we have to update from that buffer to driver stats in the service work.
+ * Worst case we would be 2x off from the desired frequency.
+ * Sync the stats sooner, if stale. The 20% threshold was chosen arbitrarily.
+ *
+ * Ideally we would split the user-configured time into two portions,
+ * i.e. also lower the DMA period by the 20%. But the DMA timer seems to have
+ * too coarse granularity to play such tricks.
+ */
+void bnxt_sync_ring_stats(struct bnxt *bp)
+{
+	unsigned long stale;
+	if (!netif_running(bp->dev) || !bp->stats_coal_ticks)
+		return;
+	spin_lock(&bp->stats_lock);
+	stale = usecs_to_jiffies(bp->stats_coal_ticks / 5);
+	if (time_after_eq(jiffies, bp->stats_updated_jiffies + stale)) {
+		bnxt_accumulate_ring_stats(bp);
+		bp->stats_updated_jiffies = jiffies;
+	}
+	spin_unlock(&bp->stats_lock);
+}
 static int bnxt_hwrm_port_qstats(struct bnxt *bp, u8 flags)
 {
 	struct hwrm_port_qstats_input *req;
 		return;
 	}
+	bnxt_sync_ring_stats(bp);
 	bnxt_get_ring_stats(bp, stats);
 	bnxt_add_prev_stats(bp, stats);
 	if (test_and_clear_bit(BNXT_PERIODIC_STATS_SP_EVENT, &bp->sp_event)) {
 		bnxt_hwrm_port_qstats(bp, 0);
 		bnxt_hwrm_port_qstats_ext(bp, 0);
+		spin_lock(&bp->stats_lock);
 		bnxt_accumulate_all_stats(bp);
+		bp->stats_updated_jiffies = jiffies;
+		spin_unlock(&bp->stats_lock);
 	}
 	if (test_and_clear_bit(BNXT_LINK_CHNG_SP_EVENT, &bp->sp_event)) {
 	INIT_DELAYED_WORK(&bp->fw_reset_task, bnxt_fw_reset_task);
 	spin_lock_init(&bp->ntp_fltr_lock);
+	spin_lock_init(&bp->stats_lock);
 #if BITS_PER_LONG == 32
 	spin_lock_init(&bp->db_lock);
 #endif
 	if (!bp->bnapi)
 		return;
+	bnxt_sync_ring_stats(bp);
 	cpr = &bp->bnapi[i]->cp_ring;
 	sw = cpr->stats.sw_stats;
 	if (!bp->tx_ring)
 		return;
+	bnxt_sync_ring_stats(bp);
 	bnapi = bp->tx_ring[bp->tx_ring_map[i]].bnapi;
 	sw = bnapi->cp_ring.stats.sw_stats;

drivers/net/ethernet/broadcom/bnxt/bnxt.h+5−0

 #define BNXT_MIN_STATS_COAL_TICKS	  250000
 #define BNXT_MAX_STATS_COAL_TICKS	 1000000
+	/* Protects stats_updated_jiffies and writes to sw_stats */
+	spinlock_t		stats_lock;
+	unsigned long		stats_updated_jiffies;
 	struct work_struct	sp_task;
 	unsigned long		sp_event;
 #define BNXT_RX_NTP_FLTR_SP_EVENT	1
 void bnxt_close_nic(struct bnxt *, bool, bool);
 void bnxt_get_ring_drv_stats(struct bnxt *bp,
 			     struct bnxt_total_ring_drv_stats *stats);
+void bnxt_sync_ring_stats(struct bnxt *bp);
 bool bnxt_rfs_capable(struct bnxt *bp, bool new_rss_ctx);
 int bnxt_dbg_hwrm_rd_reg(struct bnxt *bp, u32 reg_off, u16 num_words,
 			 u32 *reg_buf);

drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c+1−0

@@ -606,6 +606,7 @@ static void bnxt_get_ethtool_stats(struct net_device *dev, · 605 unmodified lines
606	goto skip_ring_stats;	606	goto skip_ring_stats;
607	}	607	}
608		608
		609	bnxt_sync_ring_stats(bp);
609	tpa_stats = bnxt_get_num_tpa_ring_stats(bp);	610	tpa_stats = bnxt_get_num_tpa_ring_stats(bp);
610	for (i = 0; i < bp->cp_nr_rings; i++) {	611	for (i = 0; i < bp->cp_nr_rings; i++) {
611	struct bnxt_napi *bnapi = bp->bnapi[i];	612	struct bnxt_napi *bnapi = bp->bnapi[i];

drivers/net/ethernet/cadence/macb_main.c+8−0

 	}
 }
+static void macb_tx_timeout(struct net_device *dev, unsigned int q)
+{
+	struct macb *bp = netdev_priv(dev);
+	macb_tx_restart(&bp->queues[q]);
+}
 static const struct net_device_ops macb_netdev_ops = {
 	.ndo_open		= macb_open,
 	.ndo_stop		= macb_close,
 	.ndo_hwtstamp_set	= macb_hwtstamp_set,
 	.ndo_hwtstamp_get	= macb_hwtstamp_get,
 	.ndo_setup_tc		= macb_setup_tc,
+	.ndo_tx_timeout		= macb_tx_timeout,
 };
 /* Configure peripheral capabilities according to device tree

drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c+9−1

 	if (err) {
 		NL_SET_ERR_MSG_MOD(extack,
 				   "Cannot join a bridge while VLAN uppers are present");
-		return 0;
+		return err;
 	}
 	netdev_for_each_lower_dev(upper_dev, other_dev, iter) {
 static int dpaa2_switch_port_prechangeupper(struct net_device *netdev,
 					    struct netdev_notifier_changeupper_info *info)
 {
+	struct ethsw_port_priv *port_priv;
 	struct netlink_ext_ack *extack;
 	struct net_device *upper_dev;
 	int err;
 		if (!info->linking)
 			dpaa2_switch_port_pre_bridge_leave(netdev);
+	} else if (is_vlan_dev(upper_dev)) {
+		port_priv = netdev_priv(netdev);
+		if (port_priv->fdb->bridge_dev) {
+			NL_SET_ERR_MSG_MOD(extack,
+					   "Cannot accept VLAN uppers while bridged");
+			return -EOPNOTSUPP;
+		}
 	}
 	return 0;

drivers/net/ethernet/freescale/enetc/enetc4_pf.c+3−0

@@ -322,6 +322,9 @@ static void enetc4_default_rings_allocation(struct enetc_pf *pf) · 321 unmodified lines
322	val = enetc4_psicfgr0_val_construct(false, num_tx_bdr, num_rx_bdr);	322	val = enetc4_psicfgr0_val_construct(false, num_tx_bdr, num_rx_bdr);
323	enetc_port_wr(hw, ENETC4_PSICFGR0(0), val);	323	enetc_port_wr(hw, ENETC4_PSICFGR0(0), val);
324		324
		325	if (!pf->caps.num_vsi)
		326	return;
		327
325	num_rx_bdr = pf->caps.num_rx_bdr - num_rx_bdr;	328	num_rx_bdr = pf->caps.num_rx_bdr - num_rx_bdr;
326	rx_rem = num_rx_bdr % pf->caps.num_vsi;	329	rx_rem = num_rx_bdr % pf->caps.num_vsi;
327	num_rx_bdr = num_rx_bdr / pf->caps.num_vsi;	330	num_rx_bdr = num_rx_bdr / pf->caps.num_vsi;

drivers/net/ethernet/google/gve/gve_ethtool.c+2−1

 	.supported_ring_params = ETHTOOL_RING_USE_TCP_DATA_SPLIT |
 				 ETHTOOL_RING_USE_RX_BUF_LEN,
 	.op_needs_rtnl = ETHTOOL_OP_NEEDS_RTNL_SCHANNELS |
-			 ETHTOOL_OP_NEEDS_RTNL_SRINGPARAM,
+			 ETHTOOL_OP_NEEDS_RTNL_SRINGPARAM |
+			 ETHTOOL_OP_NEEDS_RTNL_GLINK,
 	.get_drvinfo = gve_get_drvinfo,
 	.get_strings = gve_get_strings,
 	.get_sset_count = gve_get_sset_count,

drivers/net/ethernet/google/gve/gve_rx_dqo.c+18−10

@@ -21,11 +21,13 @@ · 20 unmodified lines
21	static void gve_rx_free_hdr_bufs(struct gve_priv priv, struct gve_rx_ring rx)	21	static void gve_rx_free_hdr_bufs(struct gve_priv priv, struct gve_rx_ring rx)
22	{	22	{
23	struct device *hdev = &priv->pdev->dev;	23	struct device *hdev = &priv->pdev->dev;
24	int buf_count = rx->dqo.bufq.mask + 1;
25		24
26	if (rx->dqo.hdr_bufs.data) {	25	if (rx->dqo.hdr_bufs.data) {
27	dma_free_coherent(hdev, priv->header_buf_size * buf_count,	26	size_t size =
28	rx->dqo.hdr_bufs.data, rx->dqo.hdr_bufs.addr);	27	(size_t)priv->header_buf_size * rx->dqo.num_buf_states;
		28
		29	dma_free_coherent(hdev, size, rx->dqo.hdr_bufs.data,
		30	rx->dqo.hdr_bufs.addr);
29	rx->dqo.hdr_bufs.data = NULL;	31	rx->dqo.hdr_bufs.data = NULL;
30	}	32	}
31	}	33	}
@@ -254,7 +256,7 @@ int gve_rx_alloc_ring_dqo(struct gve_priv *priv, · 222 unmodified lines
254		256
255	/* Allocate header buffers for header-split */	257	/* Allocate header buffers for header-split */
256	if (cfg->enable_header_split)	258	if (cfg->enable_header_split)
257	if (gve_rx_alloc_hdr_bufs(priv, rx, buffer_queue_slots))	259	if (gve_rx_alloc_hdr_bufs(priv, rx, rx->dqo.num_buf_states))
258	goto err;	260	goto err;
259		261
260	/* Allocate RX completion queue */	262	/* Allocate RX completion queue */
@@ -381,10 +383,13 @@ void gve_rx_post_buffers_dqo(struct gve_rx_ring *rx) · 120 unmodified lines
381	break;	383	break;
382	}	384	}
383		385
384	if (rx->dqo.hdr_bufs.data)	386	if (rx->dqo.hdr_bufs.data) {
		387	u16 buf_id = le16_to_cpu(desc->buf_id);
		388
385	desc->header_buf_addr =	389	desc->header_buf_addr =
386	cpu_to_le64(rx->dqo.hdr_bufs.addr +	390	cpu_to_le64(rx->dqo.hdr_bufs.addr +
387	priv->header_buf_size * bufq->tail);	391	(size_t)priv->header_buf_size * buf_id);
		392	}
388		393
389	bufq->tail = (bufq->tail + 1) & bufq->mask;	394	bufq->tail = (bufq->tail + 1) & bufq->mask;
390	complq->num_free_slots--;	395	complq->num_free_slots--;
@@ -826,10 +831,13 @@ static int gve_rx_dqo(struct napi_struct napi, struct gve_rx_ring rx, · 435 unmodified lines
826	int unsplit = 0;	831	int unsplit = 0;
827		832
828	if (hdr_len && !hbo) {	833	if (hdr_len && !hbo) {
829	rx->ctx.skb_head = gve_rx_copy_data(priv->dev, napi,	834	size_t offset =
830	rx->dqo.hdr_bufs.data +	835	(size_t)buffer_id * priv->header_buf_size;
831	desc_idx * priv->header_buf_size,	836
832	hdr_len);	837	rx->ctx.skb_head =
		838	gve_rx_copy_data(priv->dev, napi,
		839	rx->dqo.hdr_bufs.data + offset,
		840	hdr_len);
833	if (unlikely(!rx->ctx.skb_head))	841	if (unlikely(!rx->ctx.skb_head))
834	goto error;	842	goto error;
835	rx->ctx.skb_tail = rx->ctx.skb_head;	843	rx->ctx.skb_tail = rx->ctx.skb_head;

drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c+15−16

 }
 static int hns3_check_ksettings_param(const struct net_device *netdev,
-				      const struct ethtool_link_ksettings *cmd)
+				      const struct ethtool_link_ksettings *cmd,
+				      u8 media_type)
 {
 	struct hnae3_handle *handle = hns3_get_handle(netdev);
 	const struct hnae3_ae_ops *ops = hns3_get_ops(handle);
-	u8 module_type = HNAE3_MODULE_TYPE_UNKNOWN;
-	u8 media_type = HNAE3_MEDIA_TYPE_UNKNOWN;
 	u32 lane_num;
 	u8 autoneg;
 	u32 speed;
 			return 0;
 	}
-	if (ops->get_media_type)
-		ops->get_media_type(handle, &media_type, &module_type);
 	if (cmd->base.duplex == DUPLEX_HALF &&
 	    media_type != HNAE3_MEDIA_TYPE_COPPER) {
 		netdev_err(netdev,
 	struct hnae3_handle *handle = hns3_get_handle(netdev);
 	struct hnae3_ae_dev *ae_dev = hns3_get_ae_dev(handle);
 	const struct hnae3_ae_ops *ops = hns3_get_ops(handle);
+	u8 module_type = HNAE3_MODULE_TYPE_UNKNOWN;
+	u8 media_type = HNAE3_MEDIA_TYPE_UNKNOWN;
 	int ret;
 	/* Chip don't support this mode. */
 		  cmd->base.autoneg, cmd->base.speed, cmd->base.duplex,
 		  cmd->lanes);
-	/* Only support ksettings_set for netdev with phy attached for now */
+	if (!ops->get_media_type)
-	if (netdev->phydev) {
+		return -EOPNOTSUPP;
-		if (cmd->base.speed == SPEED_1000 &&
+	ops->get_media_type(handle, &media_type, &module_type);
-		    cmd->base.autoneg == AUTONEG_DISABLE)
-			return -EINVAL;
-		return phy_ethtool_ksettings_set(netdev->phydev, cmd);
+	if (media_type == HNAE3_MEDIA_TYPE_COPPER) {
-	} else if (test_bit(HNAE3_DEV_SUPPORT_PHY_IMP_B, ae_dev->caps) &&
+		if (!ops->set_phy_link_ksettings)
-		   ops->set_phy_link_ksettings) {
+			return -EOPNOTSUPP;
-		return ops->set_phy_link_ksettings(handle, cmd);
+		ret = ops->set_phy_link_ksettings(handle, cmd);
+		if (ret != -ENODEV)
+			return ret;
+		/* PHY_INEXISTENT, use MAC-level configuration */
 	}
 	if (ae_dev->dev_version < HNAE3_DEVICE_VERSION_V2)
 		return -EOPNOTSUPP;
-	ret = hns3_check_ksettings_param(netdev, cmd);
+	ret = hns3_check_ksettings_param(netdev, cmd, media_type);
 	if (ret)
 		return ret;

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c+86−22

 	hdev->hw.mac.req_autoneg = AUTONEG_ENABLE;
 	hdev->hw.mac.req_duplex = DUPLEX_FULL;
+	/* When lane_num is 0, the firmware will automatically
+	 * select the appropriate lane_num based on the speed.
+	 */
+	hdev->hw.mac.req_lane_num = 0;
 	hclge_parse_link_mode(hdev, cfg.speed_ability);
 	hdev->hw.mac.max_speed = hclge_get_max_speed(cfg.speed_ability);
 	if (ret)
 		return ret;
-	hdev->hw.mac.req_speed = (u32)speed;
+	hdev->hw.mac.req_lane_num = lane_num;
-	hdev->hw.mac.req_duplex = duplex;
+	if (speed != SPEED_UNKNOWN)
+		hdev->hw.mac.req_speed = (u32)speed;
+	if (duplex != DUPLEX_UNKNOWN)
+		hdev->hw.mac.req_duplex = duplex;
 	return 0;
 }
 {
 	struct hclge_vport *vport = hclge_get_vport(handle);
 	struct hclge_dev *hdev = vport->back;
+	int ret;
 	if (!hdev->hw.mac.support_autoneg) {
 		if (enable) {
 		}
 	}
-	return hclge_set_autoneg_en(hdev, enable);
+	ret = hclge_set_autoneg_en(hdev, enable);
+	if (!ret)
+		hdev->hw.mac.req_autoneg = enable;
+	return ret;
 }
 static int hclge_get_autoneg(struct hnae3_handle *handle)
 	if (!test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state))
 		hdev->hw.mac.duplex = HCLGE_MAC_FULL;
-	if (hdev->hw.mac.support_autoneg) {
-		ret = hclge_set_autoneg_en(hdev, hdev->hw.mac.autoneg);
-		if (ret)
-			return ret;
-	}
-	if (!hdev->hw.mac.autoneg) {
-		ret = hclge_cfg_mac_speed_dup_hw(hdev, hdev->hw.mac.req_speed,
-						 hdev->hw.mac.req_duplex,
-						 hdev->hw.mac.lane_num);
-		if (ret)
-			return ret;
-	}
 	mac->link = 0;
 	if (mac->user_fec_mode & BIT(HNAE3_FEC_USER_DEF)) {
 }
 static int
-hclge_set_phy_link_ksettings(struct hnae3_handle *handle,
+hclge_ethtool_ksettings_set(struct hnae3_handle *handle,
-			     const struct ethtool_link_ksettings *cmd)
+			    const struct ethtool_link_ksettings *cmd)
 {
 	struct hclge_desc desc[HCLGE_PHY_LINK_SETTING_BD_NUM];
 	struct hclge_vport *vport = hclge_get_vport(handle);
 		return ret;
 	}
-	hdev->hw.mac.req_autoneg = cmd->base.autoneg;
-	hdev->hw.mac.req_speed = cmd->base.speed;
-	hdev->hw.mac.req_duplex = cmd->base.duplex;
 	linkmode_copy(hdev->hw.mac.advertising, cmd->link_modes.advertising);
+	return 0;
+}
+static int
+hclge_set_phy_link_ksettings(struct hnae3_handle *handle,
+			     const struct ethtool_link_ksettings *cmd)
+{
+	struct hclge_vport *vport = hclge_get_vport(handle);
+	struct hclge_dev *hdev = vport->back;
+	int ret = -ENODEV;
+	if (hnae3_dev_phy_imp_supported(hdev)) {
+		ret = hclge_ethtool_ksettings_set(handle, cmd);
+	} else if (handle->netdev->phydev) {
+		if (cmd->base.speed == SPEED_1000 &&
+		    cmd->base.autoneg == AUTONEG_DISABLE)
+			return -EINVAL;
+		ret = phy_ethtool_ksettings_set(handle->netdev->phydev, cmd);
+	}
+	if (ret)
+		return ret;
+	hdev->hw.mac.req_autoneg = cmd->base.autoneg;
+	if (cmd->base.speed != SPEED_UNKNOWN)
+		hdev->hw.mac.req_speed = cmd->base.speed;
+	if (cmd->base.duplex != DUPLEX_UNKNOWN)
+		hdev->hw.mac.req_duplex = cmd->base.duplex;
 	return 0;
 }
 	return ret;
 }
+static int hclge_set_autoneg_speed_dup(struct hclge_dev *hdev)
+{
+	int ret;
+	if (hdev->hw.mac.support_autoneg) {
+		ret = hclge_set_autoneg_en(hdev, hdev->hw.mac.req_autoneg);
+		if (ret)
+			return ret;
+	}
+	if (!hdev->hw.mac.req_autoneg) {
+		ret = hclge_cfg_mac_speed_dup_hw(hdev, hdev->hw.mac.req_speed,
+						 hdev->hw.mac.req_duplex,
+						 hdev->hw.mac.req_lane_num);
+		if (ret)
+			return ret;
+	}
+	return 0;
+}
 static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)
 {
 	struct pci_dev *pdev = ae_dev->pdev;
 	if (ret)
 		goto err_ptp_uninit;
+	if (hdev->hw.mac.media_type != HNAE3_MEDIA_TYPE_COPPER) {
+		hdev->hw.mac.req_autoneg = hdev->hw.mac.autoneg;
+		if (hdev->hw.mac.autoneg == AUTONEG_DISABLE &&
+		    hdev->hw.mac.speed != SPEED_UNKNOWN)
+			hdev->hw.mac.req_speed = hdev->hw.mac.speed;
+	}
+	ret = hclge_set_autoneg_speed_dup(hdev);
+	if (ret) {
+		dev_err(&pdev->dev,
+			"failed to set autoneg speed duplex, ret = %d\n", ret);
+		goto err_ptp_uninit;
+	}
 	INIT_KFIFO(hdev->mac_tnl_log);
 	hclge_dcb_ops_set(hdev);
 		return ret;
 	}
+	ret = hclge_set_autoneg_speed_dup(hdev);
+	if (ret) {
+		dev_err(&pdev->dev,
+			"failed to set autoneg speed duplex, ret = %d\n", ret);
+		return ret;
+	}
 	ret = hclge_tp_port_init(hdev);
 	if (ret) {
 		dev_err(&pdev->dev, "failed to init tp port, ret = %d\n",

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h+1−0

@@ -287,6 +287,7 @@ struct hclge_mac { · 286 unmodified lines
287	u8 support_autoneg;	287	u8 support_autoneg;
288	u8 speed_type; /* 0: sfp speed, 1: active speed */	288	u8 speed_type; /* 0: sfp speed, 1: active speed */
289	u8 lane_num;	289	u8 lane_num;
		290	u8 req_lane_num;
290	u32 speed;	291	u32 speed;
291	u32 req_speed;	292	u32 req_speed;
292	u32 max_speed;	293	u32 max_speed;

drivers/net/ethernet/ibm/ehea/ehea_main.c+2−0

@@ -3216,6 +3216,8 @@ static int ehea_create_device_sysfs(struct platform_device *dev) · 3215 unmodified lines
3216	goto out;	3216	goto out;
3217		3217
3218	ret = device_create_file(&dev->dev, &dev_attr_remove_port);	3218	ret = device_create_file(&dev->dev, &dev_attr_remove_port);
		3219	if (ret)
		3220	device_remove_file(&dev->dev, &dev_attr_probe_port);
3219	out:	3221	out:
3220	return ret;	3222	return ret;
3221	}	3223	}

drivers/net/ethernet/ibm/emac/core.c+6−7

 	if (err)
 		goto err_gone;
+	dev->emacp = devm_platform_ioremap_resource(ofdev, 0);
+	if (IS_ERR(dev->emacp)) {
+		err = PTR_ERR(dev->emacp);
+		goto err_gone;
+	}
 	/* Setup error IRQ handler */
 	dev->emac_irq = platform_get_irq(ofdev, 0);
 	if (dev->emac_irq < 0) {
 	ndev->irq = dev->emac_irq;
-	dev->emacp = devm_platform_ioremap_resource(ofdev, 0);
-	if (IS_ERR(dev->emacp)) {
-		dev_err(&ofdev->dev, "can't map device registers");
-		err = PTR_ERR(dev->emacp);
-		goto err_gone;
-	}
 	/* Wait for dependent devices */
 	err = emac_wait_deps(dev);
 	if (err)

drivers/net/ethernet/intel/e1000e/ich8lan.c+3−0

 			phy_reg &= ~I217_PLL_CLOCK_GATE_MASK;
 			if (speed == SPEED_100 || speed == SPEED_10)
 				phy_reg |= 0x3E8;
+			else if (hw->mac.type == e1000_pch_mtp ||
+				 hw->mac.type == e1000_pch_ptp)
+				phy_reg |= 0x1D5;
 			else
 				phy_reg |= 0xFA;
 			e1e_wphy_locked(hw, I217_PLL_CLOCK_GATE_REG, phy_reg);

drivers/net/ethernet/intel/e1000e/netdev.c+14−1

 #include <linux/pm_runtime.h>
 #include <linux/prefetch.h>
 #include <linux/suspend.h>
+#include <linux/dmi.h>
 #include "e1000.h"
 #define CREATE_TRACE_POINTS
 	[board_pch_ptp]		= &e1000_pch_ptp_info,
 };
+static const struct dmi_system_id disable_k1_list[] = {
+	{
+		.ident = "Dell Pro 16 Plus PB16250",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Dell Pro 16 Plus PB16250"),
+		},
+	},
+	{}
+};
 struct e1000_reg_info {
 	u32 ofs;
 	char *name;
 	/* init PTP hardware clock */
 	e1000e_ptp_init(adapter);
-	if (hw->mac.type >= e1000_pch_mtp)
+	/* disable K1 by default on known problematic systems */
+	if (hw->mac.type >= e1000_pch_mtp && dmi_check_system(disable_k1_list))
 		adapter->flags2 |= FLAG2_DISABLE_K1;
 	/* reset the hardware with the new settings */

drivers/net/ethernet/intel/i40e/i40e_debug.h+1−1

@@ -42,7 +42,7 @@ struct device i40e_hw_to_dev(struct i40e_hw hw); · 41 unmodified lines
42	#define i40e_debug(h, m, s, ...) \	42	#define i40e_debug(h, m, s, ...) \
43	do { \	43	do { \
44	if (((m) & (h)->debug_mask)) \	44	if (((m) & (h)->debug_mask)) \
45	dev_info(i40e_hw_to_dev(hw), s, ##__VA_ARGS__); \	45	dev_info(i40e_hw_to_dev(h), s, ##__VA_ARGS__); \
46	} while (0)	46	} while (0)
47		47
48	#endif /* _I40E_DEBUG_H_ */	48	#endif /* _I40E_DEBUG_H_ */

drivers/net/ethernet/intel/iavf/iavf_ethtool.c+1−0

@@ -1855,6 +1855,7 @@ static const struct ethtool_ops iavf_ethtool_ops = { · 1854 unmodified lines
1855	.supported_coalesce_params = ETHTOOL_COALESCE_USECS \|	1855	.supported_coalesce_params = ETHTOOL_COALESCE_USECS \|
1856	ETHTOOL_COALESCE_USE_ADAPTIVE,	1856	ETHTOOL_COALESCE_USE_ADAPTIVE,
1857	.supported_input_xfrm = RXH_XFRM_SYM_XOR,	1857	.supported_input_xfrm = RXH_XFRM_SYM_XOR,
		1858	.op_needs_rtnl = ETHTOOL_OP_NEEDS_RTNL_GLINK,
1858	.get_drvinfo = iavf_get_drvinfo,	1859	.get_drvinfo = iavf_get_drvinfo,
1859	.get_link = ethtool_op_get_link,	1860	.get_link = ethtool_op_get_link,
1860	.get_ringparam = iavf_get_ringparam,	1861	.get_ringparam = iavf_get_ringparam,

drivers/net/ethernet/intel/ice/ice_common.c+0−1

@@ -3882,7 +3882,6 @@ ice_set_fc(struct ice_port_info pi, u8 aq_failures, bool ena_auto_link_update) · 3881 unmodified lines
3882	if (!pi \|\| !aq_failures)	3882	if (!pi \|\| !aq_failures)
3883	return -EINVAL;	3883	return -EINVAL;
3884		3884
3885	*aq_failures = 0;
3886	hw = pi->hw;	3885	hw = pi->hw;
3887		3886
3888	pcaps = kzalloc_obj(*pcaps);	3887	pcaps = kzalloc_obj(*pcaps);

drivers/net/ethernet/intel/ice/ice_dpll.c+14−6

 static void ice_dpll_deinit_info(struct ice_pf *pf)
 {
 	kfree(pf->dplls.inputs);
+	pf->dplls.inputs = NULL;
 	kfree(pf->dplls.outputs);
+	pf->dplls.outputs = NULL;
 	kfree(pf->dplls.eec.input_prio);
+	pf->dplls.eec.input_prio = NULL;
 	kfree(pf->dplls.pps.input_prio);
+	pf->dplls.pps.input_prio = NULL;
 }
 /**
 	alloc_size = sizeof(*de->input_prio) * d->num_inputs;
 	de->input_prio = kzalloc(alloc_size, GFP_KERNEL);
-	if (!de->input_prio)
+	if (!de->input_prio) {
-		return -ENOMEM;
+		ret = -ENOMEM;
+		goto deinit_info;
+	}
 	dp->input_prio = kzalloc(alloc_size, GFP_KERNEL);
-	if (!dp->input_prio)
+	if (!dp->input_prio) {
-		return -ENOMEM;
+		ret = -ENOMEM;
+		goto deinit_info;
+	}
 	ret = ice_dpll_init_pins_info(pf, ICE_DPLL_PIN_TYPE_INPUT);
 	if (ret)
 	ret = ice_get_cgu_rclk_pin_info(&pf->hw, &d->base_rclk_idx,
 					&pf->dplls.rclk.num_parents);
 	if (ret)
-		return ret;
+		goto deinit_info;
 	for (i = 0; i < pf->dplls.rclk.num_parents; i++)
 		pf->dplls.rclk.parent_idx[i] = d->base_rclk_idx + i;
 	ret = ice_dpll_init_pins_info(pf, ICE_DPLL_PIN_TYPE_RCLK_INPUT);
 	if (ret)
-		return ret;
+		goto deinit_info;
 	de->mode = DPLL_MODE_AUTOMATIC;
 	dp->mode = DPLL_MODE_AUTOMATIC;

drivers/net/ethernet/intel/ice/ice_eswitch.c+2−2

 	if (!repr->dst)
 		return -ENOMEM;
-	netif_keep_dst(uplink_vsi->netdev);
 	dst = repr->dst;
 	dst->u.port_info.port_id = vsi->vsi_num;
 	dst->u.port_info.lower_dev = uplink_vsi->netdev;
 	if (ice_eswitch_br_offloads_init(pf))
 		goto err_br_offloads;
+	netif_keep_dst(uplink_vsi->netdev);
 	pf->eswitch.is_running = true;
 	return 0;

drivers/net/ethernet/intel/ice/ice_ethtool.c+8−4

 	struct ice_vsi *vsi = np->vsi;
 	struct ice_hw *hw = &pf->hw;
 	struct ice_port_info *pi;
-	u8 aq_failures;
+	u8 aq_failures = 0;
 	bool link_up;
 	u32 is_an;
 	int err;
 	/* Set the FC mode and only restart AN if link is up */
 	err = ice_set_fc(pi, &aq_failures, link_up);
-	if (aq_failures & ICE_SET_FC_AQ_FAIL_GET) {
+	switch (aq_failures) {
+	case ICE_SET_FC_AQ_FAIL_GET:
 		netdev_info(netdev, "Set fc failed on the get_phy_capabilities call with err %d aq_err %s\n",
 			    err, libie_aq_str(hw->adminq.sq_last_status));
 		err = -EAGAIN;
-	} else if (aq_failures & ICE_SET_FC_AQ_FAIL_SET) {
+		break;
+	case ICE_SET_FC_AQ_FAIL_SET:
 		netdev_info(netdev, "Set fc failed on the set_phy_config call with err %d aq_err %s\n",
 			    err, libie_aq_str(hw->adminq.sq_last_status));
 		err = -EAGAIN;
-	} else if (aq_failures & ICE_SET_FC_AQ_FAIL_UPDATE) {
+		break;
+	case ICE_SET_FC_AQ_FAIL_UPDATE:
 		netdev_info(netdev, "Set fc failed on the get_link_info call with err %d aq_err %s\n",
 			    err, libie_aq_str(hw->adminq.sq_last_status));
 		err = -EAGAIN;
+		break;
 	}
 	return err;

drivers/net/ethernet/intel/ice/ice_main.c+5−11

 	device_set_wakeup_enable(ice_pf_to_dev(pf), false);
 }
-static int ice_init_link(struct ice_pf *pf)
+static void ice_init_link(struct ice_pf *pf)
 {
 	struct device *dev = ice_pf_to_dev(pf);
 	int err;
 	err = ice_init_link_events(pf->hw.port_info);
-	if (err) {
+	if (err)
 		dev_err(dev, "ice_init_link_events failed: %d\n", err);
-		return err;
-	}
 	/* not a fatal error if this fails */
 	err = ice_init_nvm_phy_type(pf->hw.port_info);
 	} else {
 		set_bit(ICE_FLAG_NO_MEDIA, pf->flags);
 	}
-	return err;
 }
 static int ice_init_pf_sw(struct ice_pf *pf)
 	ice_init_wakeup(pf);
-	err = ice_init_link(pf);
+	ice_init_link(pf);
-	if (err)
-		goto err_init_link;
 	err = ice_send_version(pf);
 	if (err)
-		goto err_init_link;
+		goto err_deinit_pf_sw;
 	ice_verify_cacheline_size(pf);
 	return 0;
-err_init_link:
+err_deinit_pf_sw:
 	ice_deinit_pf_sw(pf);
 err_init_pf_sw:
 	ice_dealloc_vsis(pf);

drivers/net/ethernet/intel/ice/ice_vf_lib.c+1−1

@@ -801,7 +801,7 @@ void ice_reset_all_vfs(struct ice_pf *pf) · 800 unmodified lines
801	* setup only when VF creates its first FDIR rule.	801	* setup only when VF creates its first FDIR rule.
802	*/	802	*/
803	if (vf->ctrl_vsi_idx != ICE_NO_VSI)	803	if (vf->ctrl_vsi_idx != ICE_NO_VSI)
804	ice_vf_ctrl_invalidate_vsi(vf);	804	ice_vf_ctrl_vsi_release(vf);
805		805
806	ice_vf_pre_vsi_rebuild(vf);	806	ice_vf_pre_vsi_rebuild(vf);
807	if (ice_vf_rebuild_vsi(vf)) {	807	if (ice_vf_rebuild_vsi(vf)) {

drivers/net/ethernet/marvell/mvneta.c+3−0

@@ -5900,6 +5900,9 @@ static int mvneta_resume(struct device *device) · 5899 unmodified lines
5900	rtnl_unlock();	5900	rtnl_unlock();
5901	mvneta_set_rx_mode(dev);	5901	mvneta_set_rx_mode(dev);
5902		5902
		5903	if (!pp->neta_armada3700)
		5904	on_each_cpu(mvneta_percpu_enable, pp, true);
		5905
5903	return 0;	5906	return 0;
5904	}	5907	}
5905	#endif	5908	#endif

drivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c+45−15

 	return 0;
 }
+static int npc_subbanks_srch_order_init(struct rvu *rvu)
+{
+	struct npc_subbank *sb;
+	int sb_idx;
+	int i, j;
+	int rc;
+	for (i = 0; i < npc_priv->num_subbanks; i++) {
+		sb_idx = subbank_srch_order[i];
+		sb = &npc_priv->sb[sb_idx];
+		sb->arr_idx = i;
+		dev_dbg(rvu->dev, "%s: sb->idx=%u sb->arr_idx=%u\n",
+			__func__, sb->idx, sb->arr_idx);
+		rc = xa_err(xa_store(&npc_priv->xa_sb_free, sb->arr_idx,
+				     xa_mk_value(sb->idx), GFP_KERNEL));
+		if (rc) {
+			dev_err(rvu->dev,
+				"%s: xa_store(xa_sb_free) failed at slot %d (sb=%d): %d\n",
+				__func__, i, sb_idx, rc);
+			for (j = 0; j < i; j++)
+				xa_erase(&npc_priv->xa_sb_free, j);
+			return rc;
+		}
+	}
+	return 0;
+}
 static void npc_subbank_init(struct rvu *rvu, struct npc_subbank *sb, int idx)
 {
 	mutex_init(&sb->lock);
 	sb->flags = NPC_SUBBANK_FLAG_FREE;
 	sb->idx = idx;
-	sb->arr_idx = subbank_srch_order[idx];
-	dev_dbg(rvu->dev, "%s: sb->idx=%u sb->arr_idx=%u\n",
-		__func__, sb->idx, sb->arr_idx);
-	/* Keep first and last subbank at end of free array; so that
-	 * it will be used at last
-	 */
-	xa_store(&npc_priv->xa_sb_free, sb->arr_idx,
-		 xa_mk_value(sb->idx), GFP_KERNEL);
 }
 static int npc_pcifunc_map_create(struct rvu *rvu)
 	alloc_cnt2 = 0;
 	rc = __npc_subbank_alloc(rvu, sb,
-				 NPC_MCAM_KEY_X2, sb->b0b,
+				 f->key_type, sb->b0b,
 				 sb->b0t,
 				 NPC_MCAM_LOWER_PRIO,
 				 false, cnt, save, cnt, true,
 				 &alloc_cnt1);
-	if (alloc_cnt1 < cnt) {
+	/* X4 entries only occupy bank 0 (b0b..b0t); see npc_subbank_idx_2_mcam_idx().
+	 * X2 uses both halves of the subbank, so spill into bank 1 if needed.
+	 */
+	if (alloc_cnt1 < cnt && f->key_type == NPC_MCAM_KEY_X2) {
 		rc = __npc_subbank_alloc(rvu, sb,
-					 NPC_MCAM_KEY_X2, sb->b1b,
+					 f->key_type, sb->b1b,
 					 sb->b1t,
 					 NPC_MCAM_LOWER_PRIO,
 					 false, cnt - alloc_cnt1,
 	int num_subbanks, subbank_depth;
 	u64 npc_const1, npc_const2 = 0;
 	struct npc_subbank *sb;
+	int ret = -ENOMEM;
 	u64 cfg;
 	int i;
 	for (i = 0, sb = npc_priv->sb; i < num_subbanks; i++, sb++)
 		npc_subbank_init(rvu, sb, i);
+	ret = npc_subbanks_srch_order_init(rvu);
+	if (ret)
+		goto fail3;
 	/* Get number of pcifuncs in the system */
 	npc_priv->pf_cnt = npc_pcifunc_map_create(rvu);
 	npc_priv->xa_pf2idx_map = kcalloc(npc_priv->pf_cnt,
 					  sizeof(struct xarray),
 					  GFP_KERNEL);
-	if (!npc_priv->xa_pf2idx_map)
+	if (!npc_priv->xa_pf2idx_map) {
+		ret = -ENOMEM;
 		goto fail3;
+	}
 	for (i = 0; i < npc_priv->pf_cnt; i++)
 		xa_init_flags(&npc_priv->xa_pf2idx_map[i], XA_FLAGS_ALLOC);
 fail1:
 	kfree(npc_priv);
 	npc_priv = NULL;
-	return -ENOMEM;
+	return ret;
 }
 void npc_cn20k_deinit(struct rvu *rvu)

drivers/net/ethernet/marvell/octeontx2/af/mcs.c+3−3

 	reg = MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYUNTAGGEDX(id);
 	stats->pkt_untaged_cnt = mcs_reg_read(mcs, reg);
-	reg = MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYCTLX(id);
-	stats->pkt_ctl_cnt = mcs_reg_read(mcs, reg);
 	if (mcs->hw->mcs_blks > 1) {
 		reg = MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYNOTAGX(id);
 		stats->pkt_notag_cnt = mcs_reg_read(mcs, reg);
+		return;
 	}
+	reg = MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYCTLX(id);
+	stats->pkt_ctl_cnt = mcs_reg_read(mcs, reg);
 }
 void mcs_get_flowid_stats(struct mcs *mcs, struct mcs_flowid_stats *stats,

drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c+9−0

@@ -178,6 +178,15 @@ int rvu_mbox_handler_lmtst_tbl_setup(struct rvu *rvu, · 177 unmodified lines
178	* pcifunc (will be the one who is calling this mailbox).	178	* pcifunc (will be the one who is calling this mailbox).
179	*/	179	*/
180	if (req->base_pcifunc) {	180	if (req->base_pcifunc) {
		181	/* A VF is untrusted and must not redirect its LMTLINE to
		182	* another PF's region, so confine VF callers to their own PF.
		183	*/
		184	if (is_vf(req->hdr.pcifunc) &&
		185	(!is_pf_func_valid(rvu, req->base_pcifunc) \|\|
		186	rvu_get_pf(rvu->pdev, req->hdr.pcifunc) !=
		187	rvu_get_pf(rvu->pdev, req->base_pcifunc)))
		188	return -EPERM;
		189
181	/* Calculating the LMT table index equivalent to primary	190	/* Calculating the LMT table index equivalent to primary
182	* pcifunc.	191	* pcifunc.
183	*/	192	*/

drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c+32−27

 		seq_printf(filp, "secy%d: Tagged ctrl pkts: %lld\n", secy_id,
 			   stats.pkt_tagged_ctl_cnt);
 		seq_printf(filp, "secy%d: Untaged pkts: %lld\n", secy_id, stats.pkt_untaged_cnt);
-		seq_printf(filp, "secy%d: Ctrl pkts: %lld\n", secy_id, stats.pkt_ctl_cnt);
 		if (mcs->hw->mcs_blks > 1)
 			seq_printf(filp, "secy%d: pkts notag: %lld\n", secy_id,
 				   stats.pkt_notag_cnt);
+		else
+			seq_printf(filp, "secy%d: Ctrl pkts: %lld\n", secy_id, stats.pkt_ctl_cnt);
 	}
 	mutex_unlock(&mcs->stats_lock);
 	return 0;
 			    &rvu_dbg_npa_ndc_hits_miss_fops);
 }
+/* Per-lmac CGX debugfs files need both RVU and CGX handle; inode->i_private
+ * points here so seq_file ops avoid pci_get_device(PCI_DEVID_OCTEONTX2_RVU_AF).
+ */
+struct rvu_cgx_lmac_dbgfs_ctx {
+	struct rvu	*rvu;
+	void		*cgxd;
+};
 #define PRINT_CGX_CUML_NIXRX_STATUS(idx, name)				\
 	({								\
 		u64 cnt;						\
 static int cgx_print_stats(struct seq_file *s, int lmac_id)
 {
+	struct rvu_cgx_lmac_dbgfs_ctx *dctx = s->private;
 	struct cgx_link_user_info linfo;
+	struct rvu *rvu = dctx->rvu;
 	struct mac_ops *mac_ops;
-	void *cgxd = s->private;
+	void *cgxd = dctx->cgxd;
 	u64 ucast, mcast, bcast;
 	int stat = 0, err = 0;
 	u64 tx_stat, rx_stat;
-	struct rvu *rvu;
-	rvu = pci_get_drvdata(pci_get_device(PCI_VENDOR_ID_CAVIUM,
-					     PCI_DEVID_OCTEONTX2_RVU_AF, NULL));
-	if (!rvu)
-		return -ENODEV;
 	mac_ops = get_mac_ops(cgxd);
 	/* There can be no CGX devices at all */
 static int cgx_print_dmac_flt(struct seq_file *s, int lmac_id)
 {
+	struct rvu_cgx_lmac_dbgfs_ctx *dctx = s->private;
+	struct rvu *rvu = dctx->rvu;
 	struct pci_dev *pdev = NULL;
-	void *cgxd = s->private;
+	void *cgxd = dctx->cgxd;
 	char *bcast, *mcast;
 	u16 index, domain;
 	u8 dmac[ETH_ALEN];
-	struct rvu *rvu;
 	u64 cfg, mac;
 	int pf;
-	rvu = pci_get_drvdata(pci_get_device(PCI_VENDOR_ID_CAVIUM,
-					     PCI_DEVID_OCTEONTX2_RVU_AF, NULL));
-	if (!rvu)
-		return -ENODEV;
 	pf = cgxlmac_to_pf(rvu, cgx_get_cgxid(cgxd), lmac_id);
 	domain = 2;
 static int cgx_print_fwdata(struct seq_file *s, int lmac_id)
 {
+	struct rvu_cgx_lmac_dbgfs_ctx *dctx = s->private;
 	struct cgx_lmac_fwdata_s *fwdata;
-	void *cgxd = s->private;
+	struct rvu *rvu = dctx->rvu;
+	void *cgxd = dctx->cgxd;
 	struct phy_s *phy;
-	struct rvu *rvu;
 	int cgx_id, i;
-	rvu = pci_get_drvdata(pci_get_device(PCI_VENDOR_ID_CAVIUM,
-					     PCI_DEVID_OCTEONTX2_RVU_AF, NULL));
-	if (!rvu)
-		return -ENODEV;
 	if (!rvu->fwdata)
 		return -EAGAIN;
 static void rvu_dbg_cgx_init(struct rvu *rvu)
 {
+	struct rvu_cgx_lmac_dbgfs_ctx *ctx;
 	struct mac_ops *mac_ops;
 	unsigned long lmac_bmap;
 	int i, lmac_id;
 		rvu->rvu_dbg.cgx = debugfs_create_dir(dname,
 						      rvu->rvu_dbg.cgx_root);
+		ctx = devm_kzalloc(rvu->dev, sizeof(*ctx), GFP_KERNEL);
+		if (!ctx)
+			continue;
+		ctx->rvu = rvu;
+		ctx->cgxd = cgx;
 		for_each_set_bit(lmac_id, &lmac_bmap, rvu->hw->lmac_per_cgx) {
 			/* lmac debugfs dir */
 			sprintf(dname, "lmac%d", lmac_id);
 				debugfs_create_dir(dname, rvu->rvu_dbg.cgx);
 			debugfs_create_file_aux_num("stats", 0600, rvu->rvu_dbg.lmac,
-					    cgx, lmac_id, &rvu_dbg_cgx_stat_fops);
+						    ctx, lmac_id, &rvu_dbg_cgx_stat_fops);
 			debugfs_create_file_aux_num("mac_filter", 0600,
-					    rvu->rvu_dbg.lmac, cgx, lmac_id,
+					    rvu->rvu_dbg.lmac, ctx, lmac_id,
 					    &rvu_dbg_cgx_dmac_flt_fops);
-			debugfs_create_file("fwdata", 0600,
+			debugfs_create_file_aux_num("fwdata", 0600,
-					    rvu->rvu_dbg.lmac, cgx,
+						    rvu->rvu_dbg.lmac, ctx,
-					    &rvu_dbg_cgx_fwdata_fops);
+						    lmac_id, &rvu_dbg_cgx_fwdata_fops);
 		}
 	}
 }

drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c+19−8

@@ -1511,7 +1511,9 @@ static int rvu_af_dl_nix_maxlf_validate(struct devlink *devlink, u32 id, · 1510 unmodified lines
1511	struct rvu_devlink *rvu_dl = devlink_priv(devlink);	1511	struct rvu_devlink *rvu_dl = devlink_priv(devlink);
1512	struct rvu *rvu = rvu_dl->rvu;	1512	struct rvu *rvu = rvu_dl->rvu;
1513	u16 max_nix0_lf, max_nix1_lf;	1513	u16 max_nix0_lf, max_nix1_lf;
1514	struct npc_mcam *mcam;	1514	struct rvu_block *block;
		1515	int blkaddr = 0;
		1516	int free_lfs;
1515	u64 cfg;	1517	u64 cfg;
1516		1518
1517	cfg = rvu_read64(rvu, BLKADDR_NIX0, NIX_AF_CONST2);	1519	cfg = rvu_read64(rvu, BLKADDR_NIX0, NIX_AF_CONST2);
@@ -1519,14 +1521,23 @@ static int rvu_af_dl_nix_maxlf_validate(struct devlink *devlink, u32 id, · 1 unmodified line
1519	cfg = rvu_read64(rvu, BLKADDR_NIX1, NIX_AF_CONST2);	1521	cfg = rvu_read64(rvu, BLKADDR_NIX1, NIX_AF_CONST2);
1520	max_nix1_lf = cfg & 0xFFF;	1522	max_nix1_lf = cfg & 0xFFF;
1521		1523
1522	/* Do not allow user to modify maximum NIX LFs while mcam entries	1524	/* Do not allow user to modify maximum NIX LFs while NIX LFs
1523	* have already been assigned.	1525	* have already been assigned. Note that modifying NIX LFs count
		1526	* can be done only before any LF attach requests from PFs and VFs
		1527	* and not later or concurrently.
1524	*/	1528	*/
1525	mcam = &rvu->hw->mcam;	1529	blkaddr = rvu_get_next_nix_blkaddr(rvu, blkaddr);
1526	if (mcam->bmap_fcnt < mcam->bmap_entries) {	1530	while (blkaddr) {
1527	NL_SET_ERR_MSG_MOD(extack,	1531	block = &rvu->hw->block[blkaddr];
1528	"mcam entries have already been assigned, can't resize");	1532
1529	return -EPERM;	1533	free_lfs = rvu_rsrc_free_count(&block->lf);
		1534	if (free_lfs != block->lf.max) {
		1535	NL_SET_ERR_MSG_MOD(extack,
		1536	"NIX LFs already assigned, can't resize");
		1537	return -EPERM;
		1538	}
		1539
		1540	blkaddr = rvu_get_next_nix_blkaddr(rvu, blkaddr);
1530	}	1541	}
1531		1542
1532	if (max_nix0_lf && val->vu16 > max_nix0_lf) {	1543	if (max_nix0_lf && val->vu16 > max_nix0_lf) {

drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c+8−3

 	bp->fn_map = devm_kcalloc(rvu->dev, bp->bpids.max,
 				  sizeof(u16), GFP_KERNEL);
 	if (!bp->fn_map)
-		return -ENOMEM;
+		goto free_bpids;
 	bp->intf_map = devm_kcalloc(rvu->dev, bp->bpids.max,
 				    sizeof(u8), GFP_KERNEL);
 	if (!bp->intf_map)
-		return -ENOMEM;
+		goto free_bpids;
 	bp->ref_cnt = devm_kcalloc(rvu->dev, bp->bpids.max,
 				   sizeof(u8), GFP_KERNEL);
 	if (!bp->ref_cnt)
-		return -ENOMEM;
+		goto free_bpids;
 	return 0;
+free_bpids:
+	rvu_free_bitmap(&bp->bpids);
+	bp->bpids.bmap = NULL;
+	return -ENOMEM;
 }
 void rvu_nix_flr_free_bpids(struct rvu *rvu, u16 pcifunc)

drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c+1−1

@@ -2225,7 +2225,7 @@ int npc_install_mcam_drop_rule(struct rvu rvu, int mcam_idx, u16 counter_idx, · 2224 unmodified lines
2225	return err;	2225	return err;
2226	}	2226	}
2227		2227
2228	dev_err(rvu->dev,	2228	dev_dbg(rvu->dev,
2229	"%s: Installed single drop on non hit rule at %d, cntr=%d\n",	2229	"%s: Installed single drop on non hit rule at %d, cntr=%d\n",
2230	__func__, mcam_idx, req.cntr);	2230	__func__, mcam_idx, req.cntr);
2231		2231

drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c+8−2

 	clear_req->id = hw_rsrc_id;
 	clear_req->type = type;
 	clear_req->dir = dir;
+	clear_req->all = all;
 	req = otx2_mbox_alloc_msg_mcs_free_resources(mbox);
 	if (!req)
 void cn10k_mcs_free(struct otx2_nic *pfvf)
 {
+	struct cn10k_mcs_cfg *cfg = pfvf->macsec_cfg;
 	if (!test_bit(CN10K_HW_MACSEC, &pfvf->hw.cap_flag))
 		return;
-	cn10k_mcs_free_rsrc(pfvf, MCS_TX, MCS_RSRC_TYPE_SECY, 0, true);
+	if (!list_empty(&cfg->txsc_list)) {
-	cn10k_mcs_free_rsrc(pfvf, MCS_RX, MCS_RSRC_TYPE_SECY, 0, true);
+		cn10k_mcs_free_rsrc(pfvf, MCS_TX, MCS_RSRC_TYPE_SECY, 0, true);
+		cn10k_mcs_free_rsrc(pfvf, MCS_RX, MCS_RSRC_TYPE_SECY, 0, true);
+	}
 	kfree(pfvf->macsec_cfg);
 	pfvf->macsec_cfg = NULL;
 }

drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c+1−0

@@ -1575,6 +1575,7 @@ static void otx2_free_sq_res(struct otx2_nic *pf) · 1574 unmodified lines
1575	qmem_free(pf->dev, sq->sqe_ring);	1575	qmem_free(pf->dev, sq->sqe_ring);
1576	qmem_free(pf->dev, sq->cpt_resp);	1576	qmem_free(pf->dev, sq->cpt_resp);
1577	qmem_free(pf->dev, sq->tso_hdrs);	1577	qmem_free(pf->dev, sq->tso_hdrs);
		1578	qmem_free(pf->dev, sq->timestamps);
1578	kfree(sq->sg);	1579	kfree(sq->sg);
1579	kfree(sq->sqb_ptrs);	1580	kfree(sq->sqb_ptrs);
1580	}	1581	}

drivers/net/ethernet/marvell/prestera/prestera_main.c+1−1

@@ -373,7 +373,7 @@ static int prestera_port_sfp_bind(struct prestera_port *port) · 372 unmodified lines
373	struct device_node ports, node;	373	struct device_node ports, node;
374	struct fwnode_handle *fwnode;	374	struct fwnode_handle *fwnode;
375	struct phylink *phy_link;	375	struct phylink *phy_link;
376	int err;	376	int err = 0;
377		377
378	if (!sw->np)	378	if (!sw->np)
379	return 0;	379	return 0;

drivers/net/ethernet/mediatek/mtk_eth_soc.c+5−5

 	if (MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628))
 		mac_ops = &rt5350_phylink_ops;
+	if (MTK_HAS_CAPS(mac->hw->soc->caps, MTK_2P5GPHY) &&
+	    id == MTK_GMAC2_ID)
+		__set_bit(PHY_INTERFACE_MODE_INTERNAL,
+			  mac->phylink_config.supported_interfaces);
 	phylink = phylink_create(&mac->phylink_config,
 				 of_fwnode_handle(mac->of_node),
 				 phy_mode, mac_ops);
 	mac->phylink = phylink;
-	if (MTK_HAS_CAPS(mac->hw->soc->caps, MTK_2P5GPHY) &&
-	    id == MTK_GMAC2_ID)
-		__set_bit(PHY_INTERFACE_MODE_INTERNAL,
-			  mac->phylink_config.supported_interfaces);
 	SET_NETDEV_DEV(eth->netdev[id], eth->dev);
 	eth->netdev[id]->watchdog_timeo = 5 * HZ;
 	eth->netdev[id]->netdev_ops = &mtk_netdev_ops;

drivers/net/ethernet/mediatek/mtk_ppe.c+2−2

@@ -918,7 +918,7 @@ struct mtk_ppe mtk_ppe_init(struct mtk_eth eth, void __iomem *base, int index) · 917 unmodified lines
918	mib = dmam_alloc_coherent(ppe->dev, MTK_PPE_ENTRIES * sizeof(*mib),	918	mib = dmam_alloc_coherent(ppe->dev, MTK_PPE_ENTRIES * sizeof(*mib),
919	&ppe->mib_phys, GFP_KERNEL);	919	&ppe->mib_phys, GFP_KERNEL);
920	if (!mib)	920	if (!mib)
921	return NULL;	921	goto err_free_l2_flows;
922		922
923	ppe->mib_table = mib;	923	ppe->mib_table = mib;
924		924
@@ -926,7 +926,7 @@ struct mtk_ppe mtk_ppe_init(struct mtk_eth eth, void __iomem *base, int index) · 1 unmodified line
926	GFP_KERNEL);	926	GFP_KERNEL);
927		927
928	if (!acct)	928	if (!acct)
929	return NULL;	929	goto err_free_l2_flows;
930		930
931	ppe->acct_table = acct;	931	ppe->acct_table = acct;
932	}	932	}

drivers/net/ethernet/mellanox/mlx5/core/Kconfig+1−1

@@ -143,7 +143,7 @@ config MLX5_CORE_IPOIB · 142 unmodified lines
143	config MLX5_MACSEC	143	config MLX5_MACSEC
144	bool "Connect-X support for MACSec offload"	144	bool "Connect-X support for MACSec offload"
145	depends on MLX5_CORE_EN	145	depends on MLX5_CORE_EN
146	depends on MACSEC	146	depends on MACSEC=y \|\| MACSEC=MLX5_CORE
147	default n	147	default n
148	help	148	help
149	Build support for MACsec cryptography-offload acceleration in the NIC.	149	Build support for MACsec cryptography-offload acceleration in the NIC.

drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c+2−1

 	.rxfh_max_num_contexts	= MLX5E_MAX_NUM_RSS,
 	.op_needs_rtnl		= ETHTOOL_OP_NEEDS_RTNL_SCHANNELS |
 				  ETHTOOL_OP_NEEDS_RTNL_SRINGPARAM |
-				  ETHTOOL_OP_NEEDS_RTNL_SPFLAGS,
+				  ETHTOOL_OP_NEEDS_RTNL_SPFLAGS |
+				  ETHTOOL_OP_NEEDS_RTNL_GLINK,
 	.supported_coalesce_params = ETHTOOL_COALESCE_USECS |
 				     ETHTOOL_COALESCE_MAX_FRAMES |
 				     ETHTOOL_COALESCE_USE_ADAPTIVE |

drivers/net/ethernet/mellanox/mlx5/core/en_rep.c+2−1

 				     ETHTOOL_COALESCE_MAX_FRAMES |
 				     ETHTOOL_COALESCE_USE_ADAPTIVE,
 	.op_needs_rtnl	   = ETHTOOL_OP_NEEDS_RTNL_SCHANNELS |
-			     ETHTOOL_OP_NEEDS_RTNL_SRINGPARAM,
+			     ETHTOOL_OP_NEEDS_RTNL_SRINGPARAM |
+			     ETHTOOL_OP_NEEDS_RTNL_GLINK,
 	.get_drvinfo	   = mlx5e_rep_get_drvinfo,
 	.get_link	   = ethtool_op_get_link,
 	.get_strings       = mlx5e_rep_get_strings,

drivers/net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c+3−1

 				     ETHTOOL_COALESCE_MAX_FRAMES |
 				     ETHTOOL_COALESCE_USE_ADAPTIVE,
 	.op_needs_rtnl	    = ETHTOOL_OP_NEEDS_RTNL_SCHANNELS |
-			      ETHTOOL_OP_NEEDS_RTNL_SRINGPARAM,
+			      ETHTOOL_OP_NEEDS_RTNL_SRINGPARAM |
+			      ETHTOOL_OP_NEEDS_RTNL_GLINK,
 	.get_drvinfo        = mlx5i_get_drvinfo,
 	.get_strings        = mlx5i_get_strings,
 	.get_sset_count     = mlx5i_get_sset_count,
 };
 const struct ethtool_ops mlx5i_pkey_ethtool_ops = {
+	.op_needs_rtnl	    = ETHTOOL_OP_NEEDS_RTNL_GLINK,
 	.get_drvinfo        = mlx5i_get_drvinfo,
 	.get_link           = ethtool_op_get_link,
 	.get_ts_info        = mlx5i_get_ts_info,

drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h+0−1

@@ -297,7 +297,6 @@ void mlx5_core_reps_aux_devs_remove(struct mlx5_core_dev *dev); · 296 unmodified lines
297	void mlx5_fw_reporters_create(struct mlx5_core_dev *dev);	297	void mlx5_fw_reporters_create(struct mlx5_core_dev *dev);
298	int mlx5_query_mtpps(struct mlx5_core_dev dev, u32 mtpps, u32 mtpps_size);	298	int mlx5_query_mtpps(struct mlx5_core_dev dev, u32 mtpps, u32 mtpps_size);
299	int mlx5_set_mtpps(struct mlx5_core_dev mdev, u32 mtpps, u32 mtpps_size);	299	int mlx5_set_mtpps(struct mlx5_core_dev mdev, u32 mtpps, u32 mtpps_size);
300	int mlx5_query_mtppse(struct mlx5_core_dev mdev, u8 pin, u8 arm, u8 *mode);
301	int mlx5_set_mtppse(struct mlx5_core_dev *mdev, u8 pin, u8 arm, u8 mode);	300	int mlx5_set_mtppse(struct mlx5_core_dev *mdev, u8 pin, u8 arm, u8 mode);
302		301
303	struct mlx5_dm mlx5_dm_create(struct mlx5_core_dev dev);	302	struct mlx5_dm mlx5_dm_create(struct mlx5_core_dev dev);

drivers/net/ethernet/mellanox/mlx5/core/port.c+0−19

@@ -908,25 +908,6 @@ int mlx5_set_mtpps(struct mlx5_core_dev mdev, u32 mtpps, u32 mtpps_size) · 907 unmodified lines
908	sizeof(out), MLX5_REG_MTPPS, 0, 1);	908	sizeof(out), MLX5_REG_MTPPS, 0, 1);
909	}	909	}
910		910
911	int mlx5_query_mtppse(struct mlx5_core_dev mdev, u8 pin, u8 arm, u8 *mode)
912	{
913	u32 out[MLX5_ST_SZ_DW(mtppse_reg)] = {0};
914	u32 in[MLX5_ST_SZ_DW(mtppse_reg)] = {0};
915	int err = 0;
916
917	MLX5_SET(mtppse_reg, in, pin, pin);
918
919	err = mlx5_core_access_reg(mdev, in, sizeof(in), out,
920	sizeof(out), MLX5_REG_MTPPSE, 0, 0);
921	if (err)
922	return err;
923
924	*arm = MLX5_GET(mtppse_reg, in, event_arm);
925	*mode = MLX5_GET(mtppse_reg, in, event_generation_mode);
926
927	return err;
928	}
929
930	int mlx5_set_mtppse(struct mlx5_core_dev *mdev, u8 pin, u8 arm, u8 mode)	911	int mlx5_set_mtppse(struct mlx5_core_dev *mdev, u8 pin, u8 arm, u8 mode)
931	{	912	{
932	u32 out[MLX5_ST_SZ_DW(mtppse_reg)] = {0};	913	u32 out[MLX5_ST_SZ_DW(mtppse_reg)] = {0};

drivers/net/ethernet/meta/fbnic/fbnic_ethtool.c+2−1

 					  ETHTOOL_OP_NEEDS_RTNL_GPAUSEPARAM |
 					  ETHTOOL_OP_NEEDS_RTNL_SPAUSEPARAM |
 					  ETHTOOL_OP_NEEDS_RTNL_SCHANNELS |
-					  ETHTOOL_OP_NEEDS_RTNL_SRINGPARAM,
+					  ETHTOOL_OP_NEEDS_RTNL_SRINGPARAM |
+					  ETHTOOL_OP_NEEDS_RTNL_GLINK,
 	.get_drvinfo			= fbnic_get_drvinfo,
 	.get_regs_len			= fbnic_get_regs_len,
 	.get_regs			= fbnic_get_regs,

drivers/net/ethernet/meta/fbnic/fbnic_fw.c+4−5

 			goto free_message;
 	}
-	err = fbnic_mbx_map_tlv_msg(fbd, msg);
-	if (err)
-		goto free_message;
 	/* Initialize heartbeat, set last response to 1 second in the past
 	 * so that we will trigger a timeout if the firmware doesn't respond
 	 */
 	fbd->last_heartbeat_response = req_time - HZ;
 	fbd->last_heartbeat_request = req_time;
 	/* Set prev_firmware_time to 0 to avoid triggering firmware crash
 	 */
 	fbd->prev_firmware_time = 0;
+	err = fbnic_mbx_map_tlv_msg(fbd, msg);
+	if (err)
+		goto free_message;
 	/* Set heartbeat detection based on if we are taking ownership */
 	fbd->fw_heartbeat_enabled = take_ownership;

drivers/net/ethernet/meta/fbnic/fbnic_netdev.c+6−1

 	eth_hw_addr_set(netdev, addr->sa_data);
-	if (netif_running(netdev))
+	if (netif_running(netdev)) {
+		netif_addr_lock_bh(netdev);
 		__fbnic_set_rx_mode(fbn->fbd, &netdev->uc, &netdev->mc);
+		netif_addr_unlock_bh(netdev);
+	}
 	return 0;
 }
 	/* Write updates to hardware */
 	fbnic_write_macda(fbd);
+	netif_addr_lock_bh(netdev);
 	__dev_uc_unsync(netdev, NULL);
 	__dev_mc_unsync(netdev, NULL);
+	netif_addr_unlock_bh(netdev);
 }
 static int fbnic_hwtstamp_get(struct net_device *netdev,

drivers/net/ethernet/meta/fbnic/fbnic_pci.c+4−0

 	fbnic_rss_reinit_hw(fbn->fbd, fbn);
+	netif_addr_lock_bh(fbn->netdev);
 	__fbnic_set_rx_mode(fbn->fbd, &fbn->netdev->uc, &fbn->netdev->mc);
+	netif_addr_unlock_bh(fbn->netdev);
 	/* Enable Tx/Rx processing */
 	fbnic_napi_enable(fbn);
 	}
 	fbnic_rpc_reset_valid_entries(fbd);
+	netif_addr_lock_bh(fbd->netdev);
 	__fbnic_set_rx_mode(fbd, &fbd->netdev->uc, &fbd->netdev->mc);
+	netif_addr_unlock_bh(fbd->netdev);
 	return 0;
 }

drivers/net/ethernet/meta/fbnic/fbnic_rpc.c+2−0

@@ -244,7 +244,9 @@ void fbnic_bmc_rpc_check(struct fbnic_dev *fbd) · 243 unmodified lines
244		244
245	if (fbd->fw_cap.need_bmc_tcam_reinit) {	245	if (fbd->fw_cap.need_bmc_tcam_reinit) {
246	fbnic_bmc_rpc_init(fbd);	246	fbnic_bmc_rpc_init(fbd);
		247	netif_addr_lock_bh(fbd->netdev);
247	__fbnic_set_rx_mode(fbd, &fbd->netdev->uc, &fbd->netdev->mc);	248	__fbnic_set_rx_mode(fbd, &fbd->netdev->uc, &fbd->netdev->mc);
		249	netif_addr_unlock_bh(fbd->netdev);
248	fbd->fw_cap.need_bmc_tcam_reinit = false;	250	fbd->fw_cap.need_bmc_tcam_reinit = false;
249	}	251	}
250		252

drivers/net/ethernet/microchip/sparx5/sparx5_switchdev.c+3−1

 	sparx5_owq = alloc_ordered_workqueue("sparx5_order", 0);
 	if (!sparx5_owq) {
 		err = -ENOMEM;
-		goto err_switchdev_blocking_nb;
+		goto err_alloc_workqueue;
 	}
 	return 0;
+err_alloc_workqueue:
+	unregister_switchdev_blocking_notifier(&s5->switchdev_blocking_nb);
 err_switchdev_blocking_nb:
 	unregister_switchdev_notifier(&s5->switchdev_nb);
 err_switchdev_nb:

drivers/net/ethernet/microsoft/mana/gdma_main.c+64−14

@@ -210,6 +210,8 @@ static int mana_gd_query_max_resources(struct pci_dev *pdev) · 209 unmodified lines
210	} else {	210	} else {
211	/* If dynamic allocation is enabled we have already allocated	211	/* If dynamic allocation is enabled we have already allocated
212	* hwc msi	212	* hwc msi
		213	* Also, we make sure in this case the following is always true
		214	* (num_msix_usable - 1 HWC) <= num_online_cpus()
213	*/	215	*/
214	gc->num_msix_usable = min(resp.max_msix, num_online_cpus() + 1);	216	gc->num_msix_usable = min(resp.max_msix, num_online_cpus() + 1);
215	}	217	}
@@ -1909,8 +1911,8 @@ void mana_gd_free_res_map(struct gdma_resource *r) · 1693 unmodified lines
1909	* do the same thing.	1911	* do the same thing.
1910	*/	1912	*/
1911		1913
1912	static int irq_setup(unsigned int *irqs, unsigned int len, int node,	1914	static int mana_irq_setup_numa_aware(unsigned int *irqs, unsigned int len,
1913	bool skip_first_cpu)	1915	int node, bool skip_first_cpu)
1914	{	1916	{
1915	const struct cpumask next, prev = cpu_none_mask;	1917	const struct cpumask next, prev = cpu_none_mask;
1916	cpumask_var_t cpus __free(free_cpumask_var);	1918	cpumask_var_t cpus __free(free_cpumask_var);
@@ -1946,11 +1948,24 @@ done: · 29 unmodified lines
1946	return 0;	1948	return 0;
1947	}	1949	}
1948		1950
		1951	/* must be called with cpus_read_lock() held */
		1952	static void mana_irq_setup_linear(unsigned int *irqs, unsigned int len)
		1953	{
		1954	int cpu;
		1955
		1956	for_each_online_cpu(cpu) {
		1957	if (len == 0)
		1958	break;
		1959
		1960	irq_set_affinity_and_hint(*irqs++, cpumask_of(cpu));
		1961	len--;
		1962	}
		1963	}
		1964
1949	static int mana_gd_setup_dyn_irqs(struct pci_dev *pdev, int nvec)	1965	static int mana_gd_setup_dyn_irqs(struct pci_dev *pdev, int nvec)
1950	{	1966	{
1951	struct gdma_context *gc = pci_get_drvdata(pdev);	1967	struct gdma_context *gc = pci_get_drvdata(pdev);
1952	struct gdma_irq_context *gic;	1968	struct gdma_irq_context *gic;
1953	bool skip_first_cpu = false;
1954	int *irqs, err, i, msi;	1969	int *irqs, err, i, msi;
1955		1970
1956	irqs = kmalloc_objs(int, nvec);	1971	irqs = kmalloc_objs(int, nvec);
@@ -1958,10 +1973,12 @@ static int mana_gd_setup_dyn_irqs(struct pci_dev *pdev, int nvec) · 1 unmodified line
1958	return -ENOMEM;	1973	return -ENOMEM;
1959		1974
1960	/*	1975	/*
		1976	* In this function, num_msix_usable = HWC IRQ + Queue IRQ.
		1977	* nvec is only Queue IRQ (HWC already setup).
1961	* While processing the next pci irq vector, we start with index 1,	1978	* While processing the next pci irq vector, we start with index 1,
1962	* as IRQ vector at index 0 is already processed for HWC.	1979	* as IRQ vector at index 0 is already processed for HWC.
1963	* However, the population of irqs array starts with index 0, to be	1980	* However, the population of irqs array starts with index 0, to be
1964	* further used in irq_setup()	1981	* further used in mana_irq_setup_numa_aware()
1965	*/	1982	*/
1966	for (i = 1; i <= nvec; i++) {	1983	for (i = 1; i <= nvec; i++) {
1967	msi = i;	1984	msi = i;
@@ -1975,18 +1992,51 @@ static int mana_gd_setup_dyn_irqs(struct pci_dev *pdev, int nvec) · 7 unmodified lines
1975	}	1992	}
1976		1993
1977	/*	1994	/*
1978	* When calling irq_setup() for dynamically added IRQs, if number of	1995	* When calling mana_irq_setup_numa_aware() for dynamically added IRQs,
1979	* CPUs is more than or equal to allocated MSI-X, we need to skip the	1996	* if number of CPUs is more than or equal to allocated MSI-X, we need to
1980	* first CPU sibling group since they are already affinitized to HWC IRQ	1997	* skip the first CPU sibling group since they are already affinitized to
		1998	* HWC IRQ
1981	*/	1999	*/
1982	cpus_read_lock();	2000	cpus_read_lock();
1983	if (gc->num_msix_usable <= num_online_cpus())	2001	if (gc->num_msix_usable <= num_online_cpus()) {
1984	skip_first_cpu = true;	2002	err = mana_irq_setup_numa_aware(irqs, nvec, gc->numa_node,
		2003	true);
		2004	if (err) {
		2005	cpus_read_unlock();
		2006	goto free_irq;
		2007	}
		2008	} else {
		2009	/*
		2010	* When num_msix_usable are more than num_online_cpus, our
		2011	* queue IRQs should be equal to num of online vCPUs.
		2012	* We try to make sure queue IRQs spread across all vCPUs.
		2013	* In such a case NUMA or CPU core affinity does not matter.
		2014	* Note: in this case the total mana IRQ should always be
		2015	* num_online_cpus + 1. The first HWC IRQ is already handled
		2016	* in HWC setup calls
		2017	* However, if CPUs went offline since num_msix_usable was
		2018	* computed, queue IRQs will be more than num_online_cpus().
		2019	* In such cases remaining extra IRQs will retain their default
		2020	* affinity.
		2021	*/
		2022	int first_unassigned = num_online_cpus();
1985		2023
1986	err = irq_setup(irqs, nvec, gc->numa_node, skip_first_cpu);	2024	if (nvec > first_unassigned) {
1987	if (err) {	2025	char buf[32];
1988	cpus_read_unlock();	2026
1989	goto free_irq;	2027	if (first_unassigned == nvec - 1)
		2028	snprintf(buf, sizeof(buf), "%d",
		2029	first_unassigned);
		2030	else
		2031	snprintf(buf, sizeof(buf), "%d-%d",
		2032	first_unassigned, nvec - 1);
		2033
		2034	dev_dbg(&pdev->dev,
		2035	"MANA IRQ indices #%s will retain the default CPU affinity\n",
		2036	buf);
		2037	}
		2038
		2039	mana_irq_setup_linear(irqs, nvec);
1990	}	2040	}
1991		2041
1992	cpus_read_unlock();	2042	cpus_read_unlock();
@@ -2041,7 +2091,7 @@ static int mana_gd_setup_irqs(struct pci_dev *pdev, int nvec) · 48 unmodified lines
2041	nvec -= 1;	2091	nvec -= 1;
2042	}	2092	}
2043		2093
2044	err = irq_setup(irqs, nvec, gc->numa_node, false);	2094	err = mana_irq_setup_numa_aware(irqs, nvec, gc->numa_node, false);
2045	if (err) {	2095	if (err) {
2046	cpus_read_unlock();	2096	cpus_read_unlock();
2047	goto free_irq;	2097	goto free_irq;

drivers/net/ethernet/microsoft/mana/mana_bpf.c+2−1

@@ -237,7 +237,8 @@ static int mana_xdp_set(struct net_device ndev, struct bpf_prog prog, · 236 unmodified lines
237	bpf_prog_put(old_prog);	237	bpf_prog_put(old_prog);
238		238
239	if (prog)	239	if (prog)
240	ndev->max_mtu = MANA_XDP_MTU_MAX;	240	ndev->max_mtu = min_t(unsigned int, MANA_XDP_MTU_MAX,
		241	gc->adapter_mtu - ETH_HLEN);
241	else	242	else
242	ndev->max_mtu = gc->adapter_mtu - ETH_HLEN;	243	ndev->max_mtu = gc->adapter_mtu - ETH_HLEN;
243		244

drivers/net/ethernet/microsoft/mana/mana_en.c+14−2

@@ -1233,12 +1233,24 @@ int mana_gd_query_device_cfg(struct gdma_context *gc, u32 proto_major_ver, · 1232 unmodified lines
1233	*max_num_vports = resp.max_num_vports;	1233	*max_num_vports = resp.max_num_vports;
1234		1234
1235	if (resp.hdr.response.msg_version >= GDMA_MESSAGE_V2) {	1235	if (resp.hdr.response.msg_version >= GDMA_MESSAGE_V2) {
1236	if (resp.adapter_mtu < ETH_MIN_MTU + ETH_HLEN) {	1236	if (resp.adapter_mtu == 0) {
		1237	/*
		1238	* Some older PF firmware versions report an
		1239	* adapter_mtu of 0. MANA hardware always supports the
		1240	* standard Ethernet MTU, so fall back to ETH_FRAME_LEN.
		1241	* Jumbo frames will not be available in this case.
		1242	*/
		1243	dev_info(dev,
		1244	"PF reported adapter_mtu of 0, falling back to %u (jumbo frames disabled)\n",
		1245	ETH_FRAME_LEN);
		1246	gc->adapter_mtu = ETH_FRAME_LEN;
		1247	} else if (resp.adapter_mtu < ETH_MIN_MTU + ETH_HLEN) {
1237	dev_err(dev, "Adapter MTU too small: %u\n",	1248	dev_err(dev, "Adapter MTU too small: %u\n",
1238	resp.adapter_mtu);	1249	resp.adapter_mtu);
1239	return -EPROTO;	1250	return -EPROTO;
		1251	} else {
		1252	gc->adapter_mtu = resp.adapter_mtu;
1240	}	1253	}
1241	gc->adapter_mtu = resp.adapter_mtu;
1242	} else {	1254	} else {
1243	gc->adapter_mtu = ETH_FRAME_LEN;	1255	gc->adapter_mtu = ETH_FRAME_LEN;
1244	}	1256	}

drivers/net/ethernet/microsoft/mana/mana_ethtool.c+2−1

 const struct ethtool_ops mana_ethtool_ops = {
 	.supported_coalesce_params = ETHTOOL_COALESCE_RX_CQE_FRAMES,
 	.op_needs_rtnl		= ETHTOOL_OP_NEEDS_RTNL_SCHANNELS |
-				  ETHTOOL_OP_NEEDS_RTNL_SRINGPARAM,
+				  ETHTOOL_OP_NEEDS_RTNL_SRINGPARAM |
+				  ETHTOOL_OP_NEEDS_RTNL_GLINK,
 	.get_ethtool_stats	= mana_get_ethtool_stats,
 	.get_sset_count		= mana_get_sset_count,
 	.get_strings		= mana_get_strings,

drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c+29−9

@@ -1420,13 +1420,25 @@ pch_gbe_alloc_rx_buffers_pool(struct pch_gbe_adapter *adapter, · 1419 unmodified lines
1420	return 0;	1420	return 0;
1421	}	1421	}
1422		1422
		1423	static void pch_gbe_free_rx_buffers_pool(struct pch_gbe_adapter *adapter,
		1424	struct pch_gbe_rx_ring *rx_ring)
		1425	{
		1426	dma_free_coherent(&adapter->pdev->dev, rx_ring->rx_buff_pool_size,
		1427	rx_ring->rx_buff_pool, rx_ring->rx_buff_pool_logic);
		1428	rx_ring->rx_buff_pool_logic = 0;
		1429	rx_ring->rx_buff_pool_size = 0;
		1430	rx_ring->rx_buff_pool = NULL;
		1431	}
		1432
1423	/**	1433	/**
1424	* pch_gbe_alloc_tx_buffers - Allocate transmit buffers	1434	* pch_gbe_alloc_tx_buffers - Allocate transmit buffers
1425	* @adapter: Board private structure	1435	* @adapter: Board private structure
1426	* @tx_ring: Tx descriptor ring	1436	* @tx_ring: Tx descriptor ring
		1437	*
		1438	* Return: 0 on success, -ENOMEM if a TX skb allocation fails.
1427	*/	1439	*/
1428	static void pch_gbe_alloc_tx_buffers(struct pch_gbe_adapter *adapter,	1440	static int pch_gbe_alloc_tx_buffers(struct pch_gbe_adapter *adapter,
1429	struct pch_gbe_tx_ring *tx_ring)	1441	struct pch_gbe_tx_ring *tx_ring)
1430	{	1442	{
1431	struct pch_gbe_buffer *buffer_info;	1443	struct pch_gbe_buffer *buffer_info;
1432	struct sk_buff *skb;	1444	struct sk_buff *skb;
@@ -1440,12 +1452,17 @@ static void pch_gbe_alloc_tx_buffers(struct pch_gbe_adapter *adapter, · 7 unmodified lines
1440	for (i = 0; i < tx_ring->count; i++) {	1452	for (i = 0; i < tx_ring->count; i++) {
1441	buffer_info = &tx_ring->buffer_info[i];	1453	buffer_info = &tx_ring->buffer_info[i];
1442	skb = netdev_alloc_skb(adapter->netdev, bufsz);	1454	skb = netdev_alloc_skb(adapter->netdev, bufsz);
		1455	if (!skb) {
		1456	pch_gbe_clean_tx_ring(adapter, tx_ring);
		1457	return -ENOMEM;
		1458	}
1443	skb_reserve(skb, PCH_GBE_DMA_ALIGN);	1459	skb_reserve(skb, PCH_GBE_DMA_ALIGN);
1444	buffer_info->skb = skb;	1460	buffer_info->skb = skb;
1445	tx_desc = PCH_GBE_TX_DESC(*tx_ring, i);	1461	tx_desc = PCH_GBE_TX_DESC(*tx_ring, i);
1446	tx_desc->gbec_status = (DSC_INIT16);	1462	tx_desc->gbec_status = (DSC_INIT16);
1447	}	1463	}
1448	return;	1464
		1465	return 0;
1449	}	1466	}
1450		1467
1451	/**	1468	/**
@@ -1887,7 +1904,12 @@ int pch_gbe_up(struct pch_gbe_adapter *adapter) · 435 unmodified lines
1887	"Error: can't bring device up - alloc rx buffers pool failed\n");	1904	"Error: can't bring device up - alloc rx buffers pool failed\n");
1888	goto freeirq;	1905	goto freeirq;
1889	}	1906	}
1890	pch_gbe_alloc_tx_buffers(adapter, tx_ring);	1907	err = pch_gbe_alloc_tx_buffers(adapter, tx_ring);
		1908	if (err) {
		1909	netdev_err(netdev,
		1910	"Error: can't bring device up - alloc tx buffers failed\n");
		1911	goto freebuf;
		1912	}
1891	pch_gbe_alloc_rx_buffers(adapter, rx_ring, rx_ring->count);	1913	pch_gbe_alloc_rx_buffers(adapter, rx_ring, rx_ring->count);
1892	adapter->tx_queue_len = netdev->tx_queue_len;	1914	adapter->tx_queue_len = netdev->tx_queue_len;
1893	pch_gbe_enable_dma_rx(&adapter->hw);	1915	pch_gbe_enable_dma_rx(&adapter->hw);
@@ -1901,6 +1923,8 @@ int pch_gbe_up(struct pch_gbe_adapter *adapter) · 7 unmodified lines
1901		1923
1902	return 0;	1924	return 0;
1903		1925
		1926	freebuf:
		1927	pch_gbe_free_rx_buffers_pool(adapter, rx_ring);
1904	freeirq:	1928	freeirq:
1905	pch_gbe_free_irq(adapter);	1929	pch_gbe_free_irq(adapter);
1906	out:	1930	out:
@@ -1936,11 +1960,7 @@ void pch_gbe_down(struct pch_gbe_adapter *adapter) · 29 unmodified lines
1936	pch_gbe_clean_tx_ring(adapter, adapter->tx_ring);	1960	pch_gbe_clean_tx_ring(adapter, adapter->tx_ring);
1937	pch_gbe_clean_rx_ring(adapter, adapter->rx_ring);	1961	pch_gbe_clean_rx_ring(adapter, adapter->rx_ring);
1938		1962
1939	dma_free_coherent(&adapter->pdev->dev, rx_ring->rx_buff_pool_size,	1963	pch_gbe_free_rx_buffers_pool(adapter, rx_ring);
1940	rx_ring->rx_buff_pool, rx_ring->rx_buff_pool_logic);
1941	rx_ring->rx_buff_pool_logic = 0;
1942	rx_ring->rx_buff_pool_size = 0;
1943	rx_ring->rx_buff_pool = NULL;
1944	}	1964	}
1945		1965
1946	/**	1966	/**

drivers/net/ethernet/rocker/rocker_ofdpa.c+3−0

@@ -1924,6 +1924,9 @@ static int ofdpa_port_fdb(struct ofdpa_port *ofdpa_port, · 1923 unmodified lines
1924	flags \|= OFDPA_OP_FLAG_REFRESH;	1924	flags \|= OFDPA_OP_FLAG_REFRESH;
1925	}	1925	}
1926		1926
		1927	if (found && removing)
		1928	kfree(found);
		1929
1927	return ofdpa_port_fdb_learn(ofdpa_port, flags, addr, vlan_id);	1930	return ofdpa_port_fdb_learn(ofdpa_port, flags, addr, vlan_id);
1928	}	1931	}
1929		1932

drivers/net/ethernet/stmicro/stmmac/dwmac-spacemit.c+8−5

 #include "stmmac_platform.h"
 /* ctrl register bits */
-#define CTRL_PHY_INTF_RGMII		BIT(3)
+#define CTRL_PHY_INTF_MODE		GENMASK(4, 3)
-#define CTRL_PHY_INTF_MII		BIT(4)
+#define CTRL_PHY_INTF_RMII		FIELD_PREP(CTRL_PHY_INTF_MODE, 0)
-#define CTRL_WAKE_IRQ_EN		BIT(9)
+#define CTRL_PHY_INTF_RGMII		FIELD_PREP(CTRL_PHY_INTF_MODE, 1)
-#define CTRL_PHY_IRQ_EN			BIT(12)
+#define CTRL_PHY_INTF_MII		FIELD_PREP(CTRL_PHY_INTF_MODE, 3)
+#define CTRL_LPI_IRQ_EN			BIT(9)
+#define CTRL_WAKE_IRQ_EN		BIT(12)
 /* dline register bits */
 #define RGMII_RX_DLINE_EN		BIT(0)
 static int spacemit_set_phy_intf_sel(void *bsp_priv, u8 phy_intf_sel)
 {
-	unsigned int mask = CTRL_PHY_INTF_MII | CTRL_PHY_INTF_RGMII;
+	unsigned int mask = CTRL_PHY_INTF_MODE;
 	struct spacmit_dwmac *dwmac = bsp_priv;
 	unsigned int val = 0;
 		break;
 	case PHY_INTF_SEL_RMII:
+		val = CTRL_PHY_INTF_RMII;
 		break;
 	case PHY_INTF_SEL_RGMII:

drivers/net/ethernet/sun/sungem.c+9−4

 	dev->max_mtu = GEM_MAX_MTU;
 	/* Register with kernel */
-	if (register_netdev(dev)) {
+	err = register_netdev(dev);
+	if (err) {
 		pr_err("Cannot register net device, aborting\n");
-		err = -ENOMEM;
+		goto err_out_clear_drvdata;
-		goto err_out_free_consistent;
 	}
 	/* Undo the get_cell with appropriate locking (we could use
 		    dev->dev_addr);
 	return 0;
+err_out_clear_drvdata:
+	pci_set_drvdata(pdev, NULL);
+	netif_napi_del(&gp->napi);
 err_out_free_consistent:
-	gem_remove_one(pdev);
+	dma_free_coherent(&pdev->dev, sizeof(struct gem_init_block),
+			  gp->init_block, gp->gblock_dvma);
 err_out_iounmap:
 	gem_put_cell(gp);
 	iounmap(gp->regs);

drivers/net/ethernet/sunplus/spl2sw_phy.c+4−2

 void spl2sw_phy_remove(struct spl2sw_common *comm)
 {
 	struct net_device *ndev;
+	struct spl2sw_mac *mac;
 	int i;
 	for (i = 0; i < MAX_NETDEV_NUM; i++)
 		if (comm->ndev[i]) {
 			ndev = comm->ndev[i];
-			if (ndev)
+			mac = netdev_priv(ndev);
-				phy_disconnect(ndev->phydev);
+			phy_disconnect(ndev->phydev);
+			of_node_put(mac->phy_node);
 		}
 }

drivers/net/ethernet/ti/icssg/icssg_common.c+39−33

@@ -93,8 +93,8 @@ void prueth_ndev_del_tx_napi(struct prueth_emac *emac, int num) · 92 unmodified lines
93	}	93	}
94	EXPORT_SYMBOL_GPL(prueth_ndev_del_tx_napi);	94	EXPORT_SYMBOL_GPL(prueth_ndev_del_tx_napi);
95		95
96	static int emac_xsk_xmit_zc(struct prueth_emac *emac,	96	static void emac_xsk_xmit_zc(struct prueth_emac *emac,
97	unsigned int q_idx)	97	unsigned int q_idx)
98	{	98	{
99	struct prueth_tx_chn *tx_chn = &emac->tx_chns[q_idx];	99	struct prueth_tx_chn *tx_chn = &emac->tx_chns[q_idx];
100	struct xsk_buff_pool *pool = tx_chn->xsk_pool;	100	struct xsk_buff_pool *pool = tx_chn->xsk_pool;
@@ -115,7 +115,7 @@ static int emac_xsk_xmit_zc(struct prueth_emac *emac, · 14 unmodified lines
115	* necessary	115	* necessary
116	*/	116	*/
117	if (descs_avail <= MAX_SKB_FRAGS)	117	if (descs_avail <= MAX_SKB_FRAGS)
118	return 0;	118	return;
119		119
120	descs_avail -= MAX_SKB_FRAGS;	120	descs_avail -= MAX_SKB_FRAGS;
121		121
@@ -170,8 +170,8 @@ static int emac_xsk_xmit_zc(struct prueth_emac *emac, · 48 unmodified lines
170	num_tx++;	170	num_tx++;
171	}	171	}
172		172
173	xsk_tx_release(tx_chn->xsk_pool);	173	if (num_tx)
174	return num_tx;	174	xsk_tx_release(tx_chn->xsk_pool);
175	}	175	}
176		176
177	void prueth_xmit_free(struct prueth_tx_chn *tx_chn,	177	void prueth_xmit_free(struct prueth_tx_chn *tx_chn,
@@ -279,9 +279,6 @@ int emac_tx_complete_packets(struct prueth_emac *emac, int chn, · 101 unmodified lines
279	num_tx++;	279	num_tx++;
280	}	280	}
281		281
282	if (!num_tx)
283	return 0;
284
285	netif_txq = netdev_get_tx_queue(ndev, chn);	282	netif_txq = netdev_get_tx_queue(ndev, chn);
286	netdev_tx_completed_queue(netif_txq, num_tx, total_bytes);	283	netdev_tx_completed_queue(netif_txq, num_tx, total_bytes);
287		284
@@ -297,16 +294,18 @@ int emac_tx_complete_packets(struct prueth_emac *emac, int chn, · 9 unmodified lines
297	__netif_tx_unlock(netif_txq);	294	__netif_tx_unlock(netif_txq);
298	}	295	}
299		296
300	if (tx_chn->xsk_pool) {	297	if (budget && tx_chn->xsk_pool) {
301	if (xsk_frames_done)	298	if (xsk_frames_done) {
302	xsk_tx_completed(tx_chn->xsk_pool, xsk_frames_done);	299	xsk_tx_completed(tx_chn->xsk_pool, xsk_frames_done);
		300	txq_trans_cond_update(netif_txq);
		301	}
303		302
304	if (xsk_uses_need_wakeup(tx_chn->xsk_pool))	303	if (xsk_uses_need_wakeup(tx_chn->xsk_pool))
305	xsk_set_tx_need_wakeup(tx_chn->xsk_pool);	304	xsk_set_tx_need_wakeup(tx_chn->xsk_pool);
306		305
307	netif_txq = netdev_get_tx_queue(ndev, chn);	306	__netif_tx_lock(netif_txq, smp_processor_id());
308	txq_trans_cond_update(netif_txq);
309	emac_xsk_xmit_zc(emac, chn);	307	emac_xsk_xmit_zc(emac, chn);
		308	__netif_tx_unlock(netif_txq);
310	}	309	}
311		310
312	return num_tx;	311	return num_tx;
@@ -1652,28 +1651,35 @@ void icssg_ndo_get_stats64(struct net_device *ndev, · 1339 unmodified lines
1652	stats->rx_over_errors = emac_get_stat_by_name(emac, "rx_over_errors");	1651	stats->rx_over_errors = emac_get_stat_by_name(emac, "rx_over_errors");
1653	stats->multicast = emac_get_stat_by_name(emac, "rx_multicast_frames");	1652	stats->multicast = emac_get_stat_by_name(emac, "rx_multicast_frames");
1654		1653
1655	stats->rx_errors = ndev->stats.rx_errors +	1654	stats->rx_errors = ndev->stats.rx_errors;
1656	emac_get_stat_by_name(emac, "FW_RX_ERROR") +	1655	stats->rx_dropped = ndev->stats.rx_dropped;
1657	emac_get_stat_by_name(emac, "FW_RX_EOF_SHORT_FRMERR") +
1658	emac_get_stat_by_name(emac, "FW_RX_B0_DROP_EARLY_EOF") +
1659	emac_get_stat_by_name(emac, "FW_RX_EXP_FRAG_Q_DROP") +
1660	emac_get_stat_by_name(emac, "FW_RX_FIFO_OVERRUN");
1661	stats->rx_dropped = ndev->stats.rx_dropped +
1662	emac_get_stat_by_name(emac, "FW_DROPPED_PKT") +
1663	emac_get_stat_by_name(emac, "FW_INF_PORT_DISABLED") +
1664	emac_get_stat_by_name(emac, "FW_INF_SAV") +
1665	emac_get_stat_by_name(emac, "FW_INF_SA_DL") +
1666	emac_get_stat_by_name(emac, "FW_INF_PORT_BLOCKED") +
1667	emac_get_stat_by_name(emac, "FW_INF_DROP_TAGGED") +
1668	emac_get_stat_by_name(emac, "FW_INF_DROP_PRIOTAGGED") +
1669	emac_get_stat_by_name(emac, "FW_INF_DROP_NOTAG") +
1670	emac_get_stat_by_name(emac, "FW_INF_DROP_NOTMEMBER");
1671	stats->tx_errors = ndev->stats.tx_errors;	1656	stats->tx_errors = ndev->stats.tx_errors;
1672	stats->tx_dropped = ndev->stats.tx_dropped +	1657	stats->tx_dropped = ndev->stats.tx_dropped;
1673	emac_get_stat_by_name(emac, "FW_RTU_PKT_DROP") +	1658
1674	emac_get_stat_by_name(emac, "FW_TX_DROPPED_PACKET") +	1659	if (!emac->prueth->pa_stats)
1675	emac_get_stat_by_name(emac, "FW_TX_TS_DROPPED_PACKET") +	1660	return;
1676	emac_get_stat_by_name(emac, "FW_TX_JUMBO_FRM_CUTOFF");	1661
		1662	stats->rx_errors +=
		1663	emac_get_stat_by_name(emac, "FW_RX_ERROR") +
		1664	emac_get_stat_by_name(emac, "FW_RX_EOF_SHORT_FRMERR") +
		1665	emac_get_stat_by_name(emac, "FW_RX_B0_DROP_EARLY_EOF") +
		1666	emac_get_stat_by_name(emac, "FW_RX_EXP_FRAG_Q_DROP") +
		1667	emac_get_stat_by_name(emac, "FW_RX_FIFO_OVERRUN");
		1668	stats->rx_dropped +=
		1669	emac_get_stat_by_name(emac, "FW_DROPPED_PKT") +
		1670	emac_get_stat_by_name(emac, "FW_INF_PORT_DISABLED") +
		1671	emac_get_stat_by_name(emac, "FW_INF_SAV") +
		1672	emac_get_stat_by_name(emac, "FW_INF_SA_DL") +
		1673	emac_get_stat_by_name(emac, "FW_INF_PORT_BLOCKED") +
		1674	emac_get_stat_by_name(emac, "FW_INF_DROP_TAGGED") +
		1675	emac_get_stat_by_name(emac, "FW_INF_DROP_PRIOTAGGED") +
		1676	emac_get_stat_by_name(emac, "FW_INF_DROP_NOTAG") +
		1677	emac_get_stat_by_name(emac, "FW_INF_DROP_NOTMEMBER");
		1678	stats->tx_dropped +=
		1679	emac_get_stat_by_name(emac, "FW_RTU_PKT_DROP") +
		1680	emac_get_stat_by_name(emac, "FW_TX_DROPPED_PACKET") +
		1681	emac_get_stat_by_name(emac, "FW_TX_TS_DROPPED_PACKET") +
		1682	emac_get_stat_by_name(emac, "FW_TX_JUMBO_FRM_CUTOFF");
1677	}	1683	}
1678	EXPORT_SYMBOL_GPL(icssg_ndo_get_stats64);	1684	EXPORT_SYMBOL_GPL(icssg_ndo_get_stats64);
1679		1685

drivers/net/ethernet/wangxun/ngbe/ngbe_main.c+0−1

@@ -715,7 +715,6 @@ static int ngbe_probe(struct pci_dev *pdev, · 714 unmodified lines
715	netdev->features \|= NETIF_F_GRO;	715	netdev->features \|= NETIF_F_GRO;
716		716
717	netdev->priv_flags \|= IFF_UNICAST_FLT;	717	netdev->priv_flags \|= IFF_UNICAST_FLT;
718	netdev->priv_flags \|= IFF_SUPP_NOFCS;
719	netdev->priv_flags \|= IFF_LIVE_ADDR_CHANGE;	718	netdev->priv_flags \|= IFF_LIVE_ADDR_CHANGE;
720		719
721	netdev->min_mtu = ETH_MIN_MTU;	720	netdev->min_mtu = ETH_MIN_MTU;

drivers/net/ethernet/wangxun/txgbe/txgbe_main.c+0−1

@@ -796,7 +796,6 @@ static int txgbe_probe(struct pci_dev *pdev, · 795 unmodified lines
796	netdev->features \|= NETIF_F_RX_UDP_TUNNEL_PORT;	796	netdev->features \|= NETIF_F_RX_UDP_TUNNEL_PORT;
797		797
798	netdev->priv_flags \|= IFF_UNICAST_FLT;	798	netdev->priv_flags \|= IFF_UNICAST_FLT;
799	netdev->priv_flags \|= IFF_SUPP_NOFCS;
800	netdev->priv_flags \|= IFF_LIVE_ADDR_CHANGE;	799	netdev->priv_flags \|= IFF_LIVE_ADDR_CHANGE;
801		800
802	netdev->min_mtu = ETH_MIN_MTU;	801	netdev->min_mtu = ETH_MIN_MTU;

drivers/net/geneve.c+16−2

@@ -954,13 +954,27 @@ static int geneve_gro_complete(struct sock sk, struct sk_buff skb, · 953 unmodified lines
954	struct genevehdr *gh;	954	struct genevehdr *gh;
955	struct packet_offload *ptype;	955	struct packet_offload *ptype;
956	__be16 type;	956	__be16 type;
957	int gh_len;	957	unsigned int gh_len;
958	int err = -ENOSYS;	958	int err = -ENOSYS;
959		959
960	gh = (struct genevehdr *)(skb->data + nhoff);	960	gh = (struct genevehdr *)(skb->data + nhoff);
961	gh_len = geneve_hlen(gh);	961	gh_len = geneve_hlen(gh);
962	type = gh->proto_type;	962	type = gh->proto_type;
963	geneve_opt_gro_hint_off(gh, &type, &gh_len);	963	geneve_sk_gro_hint_off(sk, gh, &type, &gh_len);
		964
		965	/* Bail out if we are about to dispatch past the inner network header
		966	* gro_receive() validated. An inner VLAN tag only pushes
		967	* inner_network_offset out, so use a lower bound.
		968	*/
		969	if (skb->encapsulation) {
		970	unsigned int inner_nh = nhoff + gh_len;
		971
		972	if (type == htons(ETH_P_TEB))
		973	inner_nh += ETH_HLEN;
		974
		975	if (unlikely(inner_nh > NAPI_GRO_CB(skb)->inner_network_offset))
		976	return -EINVAL;
		977	}
964		978
965	/* since skb->encapsulation is set, eth_gro_complete() sets the inner mac header */	979	/* since skb->encapsulation is set, eth_gro_complete() sets the inner mac header */
966	if (likely(type == htons(ETH_P_TEB)))	980	if (likely(type == htons(ETH_P_TEB)))

drivers/net/ieee802154/ca8210.c+6−3

 	fifo_buffer = kmemdup(buf, len, GFP_KERNEL);
 	if (!fifo_buffer)
 		return -ENOMEM;
-	kfifo_in(&test->up_fifo, &fifo_buffer, 4);
+	kfifo_in(&test->up_fifo, &fifo_buffer, sizeof(fifo_buffer));
 	wake_up_interruptible(&priv->test.readq);
 	return 0;
 	if (status < 0) {
 		dev_crit(
 			&spi->dev,
-			"status %d from spi_sync in write\n",
+			"status %d from spi_async in write\n",
 			status
 		);
+		kfree(cas_ctl);
 	}
 	return status;
 	struct ca8210_priv *priv = filp->private_data;
 	unsigned char *fifo_buffer;
 	unsigned long bytes_not_copied;
+	unsigned int copied;
 	if (filp->f_flags & O_NONBLOCK) {
 		/* Non-blocking mode */
 		);
 	}
-	if (kfifo_out(&priv->test.up_fifo, &fifo_buffer, 4) != 4) {
+	copied = kfifo_out(&priv->test.up_fifo, &fifo_buffer, sizeof(fifo_buffer));
+	if (copied != sizeof(fifo_buffer)) {
 		dev_err(
 			&priv->spi->dev,
 			"test_interface: Wrong number of elements popped from upstream fifo\n"

drivers/net/netconsole.c+7−5

 	bool			extended;
 	bool			release;
 	struct netpoll		np;
-	/* protected by target_list_lock */
+	/* protected by target_list_lock; +1 gives scnprintf() room for its
-	char			buf[MAX_PRINT_CHUNK];
+	 * NUL terminator so a full MAX_PRINT_CHUNK payload is not truncated
+	 */
+	char			buf[MAX_PRINT_CHUNK + 1];
 	struct work_struct	resume_wq;
 };
 	if (release_len) {
 		release = init_utsname()->release;
-		scnprintf(nt->buf, MAX_PRINT_CHUNK, "%s,%.*s", release,
+		scnprintf(nt->buf, sizeof(nt->buf), "%s,%.*s", release,
 			  msg_len, msg);
 		msg_len += release_len;
 	} else {
 	if (userdata)
 		msg_len += scnprintf(&nt->buf[msg_len],
-				     MAX_PRINT_CHUNK - msg_len, "%s",
+				     sizeof(nt->buf) - msg_len, "%s",
 				     userdata);
 	if (sysdata)
 		msg_len += scnprintf(&nt->buf[msg_len],
-				     MAX_PRINT_CHUNK - msg_len, "%s",
+				     sizeof(nt->buf) - msg_len, "%s",
 				     sysdata);
 	send_udp(nt, nt->buf, msg_len);

drivers/net/phy/realtek/realtek_main.c+2−1

 		ret = phy_modify_mmd_changed(phydev, MDIO_MMD_VEND2,
 					     RTL_MDIO_AN_10GBT_CTRL,
 					     MDIO_AN_10GBT_CTRL_ADV2_5G |
-					     MDIO_AN_10GBT_CTRL_ADV5G, adv);
+					     MDIO_AN_10GBT_CTRL_ADV5G |
+					     MDIO_AN_10GBT_CTRL_ADV10G, adv);
 		if (ret < 0)
 			return ret;
 	}

drivers/net/pse-pd/pd692x0.c+1−1

@@ -200,7 +200,7 @@ static const struct pd692x0_msg pd692x0_msg_template_list[PD692X0_MSG_CNT] = { · 199 unmodified lines
200	},	200	},
201	[PD692X0_MSG_SET_USER_BYTE] = {	201	[PD692X0_MSG_SET_USER_BYTE] = {
202	.key = PD692X0_KEY_PRG,	202	.key = PD692X0_KEY_PRG,
203	.sub = {0x41, PD692X0_USER_BYTE},	203	.sub = {0x41, PD692X0_USER_BYTE, 0x4e},
204	.data = {0x4e, 0x4e, 0x4e, 0x4e,	204	.data = {0x4e, 0x4e, 0x4e, 0x4e,
205	0x4e, 0x4e, 0x4e, 0x4e},	205	0x4e, 0x4e, 0x4e, 0x4e},
206	},	206	},

drivers/net/thunderbolt/main.c+6−2

 		return true;
 	}
-	/* Start of packet, validate the frame header */
+	/* Start of packet, validate the frame header. tbnet_poll() puts the
-	if (frame_count == 0 || frame_count > TBNET_RING_SIZE / 4) {
+	 * first frame in the skb linear area and every further frame in a page
+	 * fragment, so a packet may not span more than MAX_SKB_FRAGS + 1 frames
+	 * without overflowing skb_shinfo()->frags[].
+	 */
+	if (frame_count == 0 || frame_count > MAX_SKB_FRAGS + 1) {
 		net->stats.rx_length_errors++;
 		return false;
 	}

drivers/net/usb/kalmia.c+8−0

@@ -276,6 +276,14 @@ kalmia_rx_fixup(struct usbnet dev, struct sk_buff skb) · 275 unmodified lines
276	"Received header: %6phC. Package length: %i\n",	276	"Received header: %6phC. Package length: %i\n",
277	header_start, skb->len - KALMIA_HEADER_LENGTH);	277	header_start, skb->len - KALMIA_HEADER_LENGTH);
278		278
		279	/* both framing headers must be present before we subtract
		280	* them, otherwise usb_packet_length underflows and the
		281	* device-supplied ether_packet_length drives an out of bounds
		282	* access below
		283	*/
		284	if (skb->len < 2 * KALMIA_HEADER_LENGTH)
		285	return 0;
		286
279	/* subtract start header and end header */	287	/* subtract start header and end header */
280	usb_packet_length = skb->len - (2 * KALMIA_HEADER_LENGTH);	288	usb_packet_length = skb->len - (2 * KALMIA_HEADER_LENGTH);
281	ether_packet_length = get_unaligned_le16(&header_start[2]);	289	ether_packet_length = get_unaligned_le16(&header_start[2]);

drivers/net/usb/lan78xx.c+31−6

 	return (ether_crc(ETH_ALEN, addr) >> 23) & 0x1ff;
 }
+static int lan78xx_write_mchash_table(struct lan78xx_net *dev)
+{
+	struct lan78xx_priv *pdata = (struct lan78xx_priv *)(dev->data[0]);
+	return lan78xx_dataport_write(dev, DP_SEL_RSEL_VLAN_DA_,
+				      DP_SEL_VHF_VLAN_LEN,
+				      DP_SEL_VHF_HASH_LEN, pdata->mchash_table);
+}
 static void lan78xx_deferred_multicast_write(struct work_struct *param)
 {
 	struct lan78xx_priv *pdata =
 	netif_dbg(dev, drv, dev->net, "deferred multicast write 0x%08x\n",
 		  pdata->rfe_ctl);
-	ret = lan78xx_dataport_write(dev, DP_SEL_RSEL_VLAN_DA_,
+	ret = lan78xx_write_mchash_table(dev);
-				     DP_SEL_VHF_VLAN_LEN,
-				     DP_SEL_VHF_HASH_LEN, pdata->mchash_table);
 	if (ret < 0)
 		goto multicast_write_done;
 }
 static void lan78xx_rx_urb_submit_all(struct lan78xx_net *dev);
+static int lan78xx_write_vlan_table(struct lan78xx_net *dev);
 static int lan78xx_mac_reset(struct lan78xx_net *dev)
 {
 	if (ret < 0)
 		goto link_up_fail;
+	/* The RFE clears the VLAN/DA hash filter (VHF) on a link down/up
+	 * cycle, so reprogram both tables from their shadow copies.
+	 */
+	ret = lan78xx_write_vlan_table(dev);
+	if (ret < 0)
+		goto link_up_fail;
+	ret = lan78xx_write_mchash_table(dev);
+	if (ret < 0)
+		goto link_up_fail;
 	netif_start_queue(net);
 	return;
 	return lan78xx_write_reg(dev, RFE_CTL, pdata->rfe_ctl);
 }
+static int lan78xx_write_vlan_table(struct lan78xx_net *dev)
+{
+	struct lan78xx_priv *pdata = (struct lan78xx_priv *)(dev->data[0]);
+	return lan78xx_dataport_write(dev, DP_SEL_RSEL_VLAN_DA_, 0,
+				      DP_SEL_VHF_VLAN_LEN, pdata->vlan_table);
+}
 static void lan78xx_deferred_vlan_write(struct work_struct *param)
 {
 	struct lan78xx_priv *pdata =
 			container_of(param, struct lan78xx_priv, set_vlan);
-	struct lan78xx_net *dev = pdata->dev;
-	lan78xx_dataport_write(dev, DP_SEL_RSEL_VLAN_DA_, 0,
+	lan78xx_write_vlan_table(pdata->dev);
-			       DP_SEL_VHF_VLAN_LEN, pdata->vlan_table);
 }
 static int lan78xx_vlan_rx_add_vid(struct net_device *netdev,

drivers/net/veth.c+2−0

@@ -1137,6 +1137,8 @@ static int veth_enable_xdp_range(struct net_device *dev, int start, int end, · 1136 unmodified lines
1137	err_reg_mem:	1137	err_reg_mem:
1138	xdp_rxq_info_unreg(&priv->rq[i].xdp_rxq);	1138	xdp_rxq_info_unreg(&priv->rq[i].xdp_rxq);
1139	err_rxq_reg:	1139	err_rxq_reg:
		1140	if (!napi_already_on)
		1141	netif_napi_del(&priv->rq[i].xdp_napi);
1140	for (i--; i >= start; i--) {	1142	for (i--; i >= start; i--) {
1141	struct veth_rq *rq = &priv->rq[i];	1143	struct veth_rq *rq = &priv->rq[i];
1142		1144

drivers/net/virtio_net.c+6−3

 				   struct virtnet_rq_stats *stats)
 {
 	struct page *page = buf;
+	unsigned long max_len;
 	struct sk_buff *skb;
+	max_len = (vi->big_packets_num_skbfrags + 1) * PAGE_SIZE -
+		  sizeof(struct padded_vnet_hdr) + vi->hdr_len;
 	/* Make sure that len does not exceed the size allocated in
 	 * add_recvbuf_big.
 	 */
-	if (unlikely(len > (vi->big_packets_num_skbfrags + 1) * PAGE_SIZE)) {
+	if (unlikely(len > max_len)) {
 		pr_debug("%s: rx error: len %u exceeds allocated size %lu\n",
-			 dev->name, len,
+			 dev->name, len, max_len);
-			 (vi->big_packets_num_skbfrags + 1) * PAGE_SIZE);
 		goto err;
 	}

drivers/net/wan/hdlc_ppp.c+13−2

 		struct proto *proto = &ppp->protos[i];
 		proto->dev = dev;
-		timer_setup(&proto->timer, ppp_timer, 0);
 		proto->state = CLOSED;
 	}
 	ppp->protos[IDX_LCP].pid = PID_LCP;
 	ppp_tx_flush();
 }
+static void ppp_timer_release(struct net_device *dev)
+{
+	struct ppp *ppp = get_ppp(dev);
+	int i;
+	for (i = 0; i < IDX_COUNT; i++)
+		timer_shutdown_sync(&ppp->protos[i].timer);
+}
 static struct hdlc_proto proto = {
 	.start		= ppp_start,
 	.stop		= ppp_stop,
 	.ioctl		= ppp_ioctl,
 	.netif_rx	= ppp_rx,
 	.module		= THIS_MODULE,
+	.detach		= ppp_timer_release,
 };
 static const struct header_ops ppp_header_ops = {
 {
 	hdlc_device *hdlc = dev_to_hdlc(dev);
 	struct ppp *ppp;
-	int result;
+	int i, result;
 	switch (ifs->type) {
 	case IF_GET_PROTO:
 			return result;
 		ppp = get_ppp(dev);
+		for (i = 0; i < IDX_COUNT; i++)
+			timer_setup(&ppp->protos[i].timer, ppp_timer, 0);
 		spin_lock_init(&ppp->lock);
 		ppp->req_timeout = 2;
 		ppp->cr_retries = 10;

drivers/net/wan/ixp4xx_hss.c+2−2

 				     "unable to get CLK internal GPIO\n");
 	ndev = alloc_hdlcdev(port);
-	port->netdev = alloc_hdlcdev(port);
+	if (!ndev) {
-	if (!port->netdev) {
 		err = -ENOMEM;
 		goto err_plat;
 	}
+	port->netdev = ndev;
 	SET_NETDEV_DEV(ndev, &pdev->dev);
 	hdlc = dev_to_hdlc(ndev);

drivers/net/wwan/t7xx/t7xx_hif_cldma.c+3−0

@@ -1063,6 +1063,9 @@ err_free_tx_ring: · 1062 unmodified lines
1063	while (i--)	1063	while (i--)
1064	t7xx_cldma_ring_free(md_ctrl, &md_ctrl->tx_ring[i], DMA_TO_DEVICE);	1064	t7xx_cldma_ring_free(md_ctrl, &md_ctrl->tx_ring[i], DMA_TO_DEVICE);
1065		1065
		1066	dma_pool_destroy(md_ctrl->gpd_dmapool);
		1067	md_ctrl->gpd_dmapool = NULL;
		1068
1066	return ret;	1069	return ret;
1067	}	1070	}
1068		1071

fs/afs/cm_security.c+2−1

@@ -101,7 +101,8 @@ void afs_process_oob_queue(struct work_struct *work) · 100 unmodified lines
101	struct sk_buff *oob;	101	struct sk_buff *oob;
102	enum rxrpc_oob_type type;	102	enum rxrpc_oob_type type;
103		103
104	while ((oob = rxrpc_kernel_dequeue_oob(net->socket, &type))) {	104	while (READ_ONCE(net->live) &&
		105	(oob = rxrpc_kernel_dequeue_oob(net->socket, &type))) {
105	switch (type) {	106	switch (type) {
106	case RXRPC_OOB_CHALLENGE:	107	case RXRPC_OOB_CHALLENGE:
107	afs_respond_to_challenge(oob);	108	afs_respond_to_challenge(oob);

fs/afs/rxrpc.c+9−1

 	_enter("");
 	cancel_work_sync(&net->charge_preallocation_work);
+	cancel_work_sync(&net->rx_oob_work);
+	/* Future work items should now see ->live is false. */
 	kernel_listen(net->socket, 0);
+	/* Make sure work items are no longer running. */
 	flush_workqueue(afs_async_calls);
+	cancel_work_sync(&net->charge_preallocation_work);
 	if (net->spare_incoming_call) {
 		afs_put_call(net->spare_incoming_call);
 	kernel_sock_shutdown(net->socket, SHUT_RDWR);
 	flush_workqueue(afs_async_calls);
+	cancel_work_sync(&net->rx_oob_work);
 	net->socket->sk->sk_user_data = NULL;
 	sock_release(net->socket);
 	key_put(net->fs_cm_token_key);
 {
 	struct afs_net *net = sk->sk_user_data;
-	schedule_work(&net->rx_oob_work);
+	if (READ_ONCE(net->live))
+		queue_work(afs_wq, &net->rx_oob_work);
 }

include/linux/ethtool.h+2−0

 #define ETHTOOL_OP_NEEDS_RTNL_GPAUSEPARAM	BIT(5)
 #define ETHTOOL_OP_NEEDS_RTNL_SPAUSEPARAM	BIT(6)
 #define ETHTOOL_OP_NEEDS_RTNL_RSS		BIT(7)
+#define ETHTOOL_OP_NEEDS_RTNL_GLINK		BIT(8)
 /**
  * struct ethtool_ops - optional netdev operations
  *	 - phylink helpers (note that phydev is currently unsupported!)
  *	 - netdev_update_features()
  *	 - netif_set_real_num_tx_queues()
+ *	 - ethtool_op_get_link() (syncs link watch under rtnl_lock)
  *
  * @get_drvinfo: Report driver/device information. Modern drivers no
  *	longer have to implement this callback. Most fields are

include/linux/netdevice.h+17−4

  *	netdev_hw_addr_list_for_each(ha, uc). Return 0 on success or a
  *	negative errno to request a retry via the core backoff.
  *
+ * void (*ndo_work)(struct net_device *dev, unsigned long events);
+ *	Run deferred work scheduled with netdev_work_sched(@events).
+ *
  * int (*ndo_set_mac_address)(struct net_device *dev, void *addr);
  *	This function  is called when the Media Access Control address
  *	needs to be changed. If this interface is not defined, the
 					struct net_device *dev,
 					struct netdev_hw_addr_list *uc,
 					struct netdev_hw_addr_list *mc);
+	void			(*ndo_work)(struct net_device *dev,
+					    unsigned long events);
 	int			(*ndo_set_mac_address)(struct net_device *dev,
 						       void *addr);
 	int			(*ndo_validate_addr)(struct net_device *dev);
  *				has been enabled due to the need to listen to
  *				additional unicast addresses in a device that
  *				does not implement ndo_set_rx_mode()
- *	@rx_mode_node:		List entry for rx_mode work processing
+ *	@work_node:		List entry for async netdev_work processing
- *	@rx_mode_tracker:	Refcount tracker for rx_mode work
+ *	@work_tracker:		Refcount tracker for async netdev_work
+ *	@work_pending:		Driver-defined pending netdev_work, passed to
+ *				ndo_work() (see netdev_work_sched())
+ *	@work_core_pending:	Core-defined pending netdev_work (NETDEV_WORK_*)
  *	@rx_mode_addr_cache:	Recycled snapshot entries for rx_mode work
  *	@rx_mode_retry_timer:	Timer that re-queues rx_mode work after failure
  *	@rx_mode_retry_count:	Number of consecutive retries already scheduled
 	unsigned int		promiscuity;
 	unsigned int		allmulti;
 	bool			uc_promisc;
-	struct list_head	rx_mode_node;
+	struct list_head	work_node;
-	netdevice_tracker	rx_mode_tracker;
+	netdevice_tracker	work_tracker;
+	unsigned long		work_pending;
+	unsigned long		work_core_pending;
 	struct netdev_hw_addr_list	rx_mode_addr_cache;
 	struct timer_list	rx_mode_retry_timer;
 	unsigned int		rx_mode_retry_count;
 			   const struct pcpu_sw_netstats __percpu *netstats);
 void dev_get_tstats64(struct net_device *dev, struct rtnl_link_stats64 *s);
+void netdev_work_sched(struct net_device *dev, unsigned long events);
+unsigned long netdev_work_cancel(struct net_device *dev, unsigned long mask);
 enum {
 	NESTED_SYNC_IMM_BIT,
 	NESTED_SYNC_TODO_BIT,

include/linux/netfilter/x_tables.h+21−8

  * @match:	the match extension
  * @target:	the target extension
  * @matchinfo:	per-match data
- * @targetinfo:	per-target data
+ * @targinfo:	per-target data
  * @state:	pointer to hook state this packet came from
  * @fragoff:	packet is a fragment, this is the data offset
  * @thoff:	position of transport header relative to skb->data
  * @match:	struct xt_match through which this function was invoked
  * @matchinfo:	per-match data
  * @hook_mask:	via which hooks the new rule is reachable
- * Other fields as above.
+ * @family:	actual NFPROTO_* through which the function is invoked
+ *		(helpful when match->family == NFPROTO_UNSPEC)
+ * @nft_compat:	running from the nft compat layer if true
  */
 struct xt_mtchk_param {
 	struct net *net;
 };
 /**
- * struct xt_mdtor_param - match destructor parameters
+ * struct xt_mtdtor_param - match destructor parameters
- * Fields as above.
+ *
+ * @net:	network namespace through which the check was invoked
+ * @match:	struct xt_match through which this function was invoked
+ * @matchinfo:	per-match data
+ * @family:	actual NFPROTO_* through which the function is invoked
+ *		(helpful when match->family == NFPROTO_UNSPEC)
  */
 struct xt_mtdtor_param {
 	struct net *net;
  * struct xt_tgchk_param - parameters for target extensions'
  * checkentry functions
  *
+ * @net:	network namespace through which the check was invoked
+ * @table:	table the rule is tried to be inserted into
  * @entryinfo:	the family-specific rule data
  * 		(struct ipt_entry, ip6t_entry, arpt_entry, ebt_entry)
- *
+ * @target:	the target extension
- * Other fields see above.
+ * @targinfo:	per-target data
+ * @hook_mask:	via which hooks the new rule is reachable
+ * @family:	actual NFPROTO_* through which the function is invoked
+ *		(helpful when match->family == NFPROTO_UNSPEC)
+ * @nft_compat:	running from the nft compat layer if true
  */
 struct xt_tgchk_param {
 	struct net *net;
 void xt_free_table_info(struct xt_table_info *info);
 /**
- * xt_recseq - recursive seqcount for netfilter use
+ * var xt_recseq - recursive seqcount for netfilter use
  *
- * Packet processing changes the seqcount only if no recursion happened
+ * Packet processing changes the seqcount only if no recursion happened.
  * get_counters() can use read_seqcount_begin()/read_seqcount_retry(),
  * because we use the normal seqcount convention :
  * Low order bit set to 1 if a writer is active.

include/net/dst_metadata.h+5−2

 	if (!new_md)
 		return ERR_PTR(-ENOMEM);
-	memcpy(&new_md->u.tun_info, &md_dst->u.tun_info,
+	/* Copy in two stages to keep the __counted_by happy. */
-	       sizeof(struct ip_tunnel_info) + md_size);
+	new_md->u.tun_info = md_dst->u.tun_info;
+	memcpy(ip_tunnel_info_opts(&new_md->u.tun_info),
+	       ip_tunnel_info_opts(&md_dst->u.tun_info), md_size);
 #ifdef CONFIG_DST_CACHE
 	/* Unclone the dst cache if there is one */
 	if (new_md->u.tun_info.dst_cache.cache) {

include/net/ip_fib.h+3−4

@@ -374,7 +374,7 @@ static inline int fib_lookup(struct net net, struct flowi4 flp, · 373 unmodified lines
374	struct fib_result *res, unsigned int flags)	374	struct fib_result *res, unsigned int flags)
375	{	375	{
376	struct fib_table *tb;	376	struct fib_table *tb;
377	int err = -ENETUNREACH;	377	int err = -EAGAIN;
378		378
379	flags \|= FIB_LOOKUP_NOREF;	379	flags \|= FIB_LOOKUP_NOREF;
380	if (net->ipv4.fib_has_custom_rules)	380	if (net->ipv4.fib_has_custom_rules)
@@ -388,17 +388,16 @@ static inline int fib_lookup(struct net net, struct flowi4 flp, · 7 unmodified lines
388	if (tb)	388	if (tb)
389	err = fib_table_lookup(tb, flp, res, flags);	389	err = fib_table_lookup(tb, flp, res, flags);
390		390
391	if (!err)	391	if (err != -EAGAIN)
392	goto out;	392	goto out;
393		393
394	tb = rcu_dereference_rtnl(net->ipv4.fib_default);	394	tb = rcu_dereference_rtnl(net->ipv4.fib_default);
395	if (tb)	395	if (tb)
396	err = fib_table_lookup(tb, flp, res, flags);	396	err = fib_table_lookup(tb, flp, res, flags);
397		397
398	out:
399	if (err == -EAGAIN)	398	if (err == -EAGAIN)
400	err = -ENETUNREACH;	399	err = -ENETUNREACH;
401		400	out:
402	rcu_read_unlock();	401	rcu_read_unlock();
403		402
404	return err;	403	return err;

include/net/netfilter/nf_conntrack_expect.h+14−3

 	possible_net_t net;
 	/* We expect this tuple, with the following mask */
+	struct nf_conntrack_tuple master_tuple;
 	struct nf_conntrack_tuple tuple;
 	struct nf_conntrack_tuple_mask mask;
 	/* The conntrack of the master connection */
 	struct nf_conn *master;
-	/* Timer function; deletes the expectation. */
+	/* jiffies32 when this expectation expires */
-	struct timer_list timeout;
+	u32 timeout;
 #if IS_ENABLED(CONFIG_NF_NAT)
 	union nf_inet_addr saved_addr;
 	struct rcu_head rcu;
 };
+static inline bool nf_ct_exp_is_expired(const struct nf_conntrack_expect *exp)
+{
+	if (READ_ONCE(exp->flags) & NF_CT_EXPECT_DEAD)
+		return true;
+	return (__s32)(READ_ONCE(exp->timeout) - nfct_time_stamp) <= 0;
+}
 static inline struct net *nf_ct_exp_net(struct nf_conntrack_expect *exp)
 {
 	return read_pnet(&exp->net);
 void nf_ct_remove_expectations(struct nf_conn *ct);
 void nf_ct_unexpect_related(struct nf_conntrack_expect *exp);
-bool nf_ct_remove_expect(struct nf_conntrack_expect *exp);
 void nf_ct_expect_iterate_destroy(bool (*iter)(struct nf_conntrack_expect *e, void *data), void *data);
 void nf_ct_expect_iterate_net(struct net *net,
 	return nf_ct_expect_related_report(expect, 0, 0, flags);
 }
+struct nf_conn_help;
+void nf_ct_expectation_gc(struct nf_conn_help *master_help);
 #endif /*_NF_CONNTRACK_EXPECT_H*/

include/net/netfilter/nf_conntrack_helper.h+4−0

@@ -114,6 +114,10 @@ int nf_conntrack_helpers_register(struct nf_conntrack_helper *, unsigned int, · 113 unmodified lines
114	void nf_conntrack_helpers_unregister(struct nf_conntrack_helper **,	114	void nf_conntrack_helpers_unregister(struct nf_conntrack_helper **,
115	unsigned int);	115	unsigned int);
116		116
		117	#define nf_conntrack_helper_deprecated(name) \
		118	pr_warn("The %s conntrack helper is scheduled for removal.\n" \
		119	"Please contact the netfilter-devel mailing list if you still need this.\n", name)
		120
117	struct nf_conn_help nf_ct_helper_ext_add(struct nf_conn ct, gfp_t gfp);	121	struct nf_conn_help nf_ct_helper_ext_add(struct nf_conn ct, gfp_t gfp);
118		122
119	int __nf_ct_try_assign_helper(struct nf_conn ct, struct nf_conn tmpl,	123	int __nf_ct_try_assign_helper(struct nf_conn ct, struct nf_conn tmpl,

include/net/netfilter/nf_queue.h+1−0

@@ -18,6 +18,7 @@ struct nf_queue_entry { · 17 unmodified lines
18	unsigned int id;	18	unsigned int id;
19	unsigned int hook_index; /* index in hook_entries->hook[] */	19	unsigned int hook_index; /* index in hook_entries->hook[] */
20	#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)	20	#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
		21	struct net_device *bridge_dev;
21	struct net_device *physin;	22	struct net_device *physin;
22	struct net_device *physout;	23	struct net_device *physout;
23	#endif	24	#endif

include/net/netfilter/nft_meta.h+2−0

@@ -40,6 +40,8 @@ void nft_meta_set_eval(const struct nft_expr *expr, · 39 unmodified lines
40	void nft_meta_set_destroy(const struct nft_ctx *ctx,	40	void nft_meta_set_destroy(const struct nft_ctx *ctx,
41	const struct nft_expr *expr);	41	const struct nft_expr *expr);
42		42
		43	int nft_meta_get_validate(const struct nft_ctx *ctx,
		44	const struct nft_expr *expr);
43	int nft_meta_set_validate(const struct nft_ctx *ctx,	45	int nft_meta_set_validate(const struct nft_ctx *ctx,
44	const struct nft_expr *expr);	46	const struct nft_expr *expr);
45		47

include/net/rtnetlink.h+2−0

@@ -256,6 +256,8 @@ int rtnl_configure_link(struct net_device dev, const struct ifinfomsg ifm, · 255 unmodified lines
256	int rtnl_nla_parse_ifinfomsg(struct nlattr *tb, const struct nlattr nla_peer,	256	int rtnl_nla_parse_ifinfomsg(struct nlattr *tb, const struct nlattr nla_peer,
257	struct netlink_ext_ack *exterr);	257	struct netlink_ext_ack *exterr);
258	struct net rtnl_get_net_ns_capable(struct sock sk, int netnsid);	258	struct net rtnl_get_net_ns_capable(struct sock sk, int netnsid);
		259	bool rtnl_dev_link_net_capable(const struct net_device *dev,
		260	const struct net *link_net);
259		261
260	#define MODULE_ALIAS_RTNL_LINK(kind) MODULE_ALIAS("rtnl-link-" kind)	262	#define MODULE_ALIAS_RTNL_LINK(kind) MODULE_ALIAS("rtnl-link-" kind)
261		263

include/net/sctp/sctp.h+2−1

@@ -111,7 +111,8 @@ int sctp_transport_lookup_process(sctp_callback_t cb, struct net *net, · 110 unmodified lines
111	const union sctp_addr paddr, void p, int dif);	111	const union sctp_addr paddr, void p, int dif);
112	int sctp_transport_traverse_process(sctp_callback_t cb, sctp_callback_t cb_done,	112	int sctp_transport_traverse_process(sctp_callback_t cb, sctp_callback_t cb_done,
113	struct net net, int pos, void *p);	113	struct net net, int pos, void *p);
114	int sctp_for_each_endpoint(int (cb)(struct sctp_endpoint , void ), void p);	114	int sctp_for_each_endpoint(int (cb)(struct sctp_endpoint , void *),
		115	struct net net, int pos, void *p);
115	int sctp_get_sctp_info(struct sock sk, struct sctp_association asoc,	116	int sctp_get_sctp_info(struct sock sk, struct sctp_association asoc,
116	struct sctp_info *info);	117	struct sctp_info *info);
117		118

include/net/xfrm.h+11−4

 	unsigned int pdw;
 	unsigned int pbi;
+	if (prefixlen > 128)
+		return false;
 	pdw = prefixlen >> 5;	  /* num of whole u32 in prefix */
 	pbi = prefixlen &  0x1f;  /* num of bits in incomplete u32 in prefix */
 	/* C99 6.5.7 (3): u32 << 32 is undefined behaviour */
 	if (sizeof(long) == 4 && prefixlen == 0)
 		return true;
+	if (prefixlen > 32)
+		return false;
 	return !((a1 ^ a2) & htonl(~0UL << (32 - prefixlen)));
 }
 static inline bool __xfrm_check_nopolicy(struct net *net, struct sk_buff *skb,
 					 int dir)
 {
-	if (!net->xfrm.policy_count[dir] && !secpath_exists(skb))
+	if (!READ_ONCE(net->xfrm.policy_count[dir]) && !secpath_exists(skb))
-		return net->xfrm.policy_default[dir] == XFRM_USERPOLICY_ACCEPT;
+		return READ_ONCE(net->xfrm.policy_default[dir]) == XFRM_USERPOLICY_ACCEPT;
 	return false;
 }
 {
 	struct net *net = dev_net(skb->dev);
-	if (!net->xfrm.policy_count[XFRM_POLICY_OUT] &&
+	if (!READ_ONCE(net->xfrm.policy_count[XFRM_POLICY_OUT]) &&
-	    net->xfrm.policy_default[XFRM_POLICY_OUT] == XFRM_USERPOLICY_ACCEPT)
+	    READ_ONCE(net->xfrm.policy_default[XFRM_POLICY_OUT]) == XFRM_USERPOLICY_ACCEPT)
 		return true;
 	return (skb_dst(skb)->flags & DST_NOXFRM) ||

include/uapi/linux/netfilter/nf_conntrack_common.h+1−0

@@ -160,6 +160,7 @@ enum ip_conntrack_expect_events { · 159 unmodified lines
160	#define NF_CT_EXPECT_USERSPACE 0x4	160	#define NF_CT_EXPECT_USERSPACE 0x4
161		161
162	#ifdef __KERNEL__	162	#ifdef __KERNEL__
		163	#define NF_CT_EXPECT_DEAD 0x8
163	#define NF_CT_EXPECT_MASK (NF_CT_EXPECT_PERMANENT \| NF_CT_EXPECT_INACTIVE \| \	164	#define NF_CT_EXPECT_MASK (NF_CT_EXPECT_PERMANENT \| NF_CT_EXPECT_INACTIVE \| \
164	NF_CT_EXPECT_USERSPACE)	165	NF_CT_EXPECT_USERSPACE)
165	#endif	166	#endif

net/8021q/vlan.c+8−68

@@ -77,9 +77,9 @@ static int vlan_group_prealloc_vid(struct vlan_group *vg, · 76 unmodified lines
77	return 0;	77	return 0;
78	}	78	}
79		79
80	static void vlan_stacked_transfer_operstate(const struct net_device *rootdev,	80	void vlan_stacked_transfer_operstate(const struct net_device *rootdev,
81	struct net_device *dev,	81	struct net_device *dev,
82	struct vlan_dev_priv *vlan)	82	struct vlan_dev_priv *vlan)
83	{	83	{
84	if (!(vlan->flags & VLAN_FLAG_BRIDGE_BINDING))	84	if (!(vlan->flags & VLAN_FLAG_BRIDGE_BINDING))
85	netif_stacked_transfer_operstate(rootdev, dev);	85	netif_stacked_transfer_operstate(rootdev, dev);
@@ -316,29 +316,6 @@ out: · 230 unmodified lines
316	ether_addr_copy(vlan->real_dev_addr, dev->dev_addr);	316	ether_addr_copy(vlan->real_dev_addr, dev->dev_addr);
317	}	317	}
318		318
319	static void vlan_transfer_features(struct net_device *dev,
320	struct net_device *vlandev)
321	{
322	struct vlan_dev_priv *vlan = vlan_dev_priv(vlandev);
323
324	netif_inherit_tso_max(vlandev, dev);
325
326	if (vlan_hw_offload_capable(dev->features, vlan->vlan_proto))
327	vlandev->hard_header_len = dev->hard_header_len;
328	else
329	vlandev->hard_header_len = dev->hard_header_len + VLAN_HLEN;
330
331	#if IS_ENABLED(CONFIG_FCOE)
332	vlandev->fcoe_ddp_xid = dev->fcoe_ddp_xid;
333	#endif
334
335	vlandev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
336	vlandev->priv_flags \|= (vlan->real_dev->priv_flags & IFF_XMIT_DST_RELEASE);
337	vlandev->hw_enc_features = vlan_tnl_features(vlan->real_dev);
338
339	netdev_update_features(vlandev);
340	}
341
342	static int __vlan_device_event(struct net_device *dev, unsigned long event)	319	static int __vlan_device_event(struct net_device *dev, unsigned long event)
343	{	320	{
344	int err = 0;	321	int err = 0;
@@ -391,13 +368,11 @@ static void vlan_vid0_del(struct net_device *dev) · 46 unmodified lines
391	static int vlan_device_event(struct notifier_block *unused, unsigned long event,	368	static int vlan_device_event(struct notifier_block *unused, unsigned long event,
392	void *ptr)	369	void *ptr)
393	{	370	{
394	struct netlink_ext_ack *extack = netdev_notifier_info_to_extack(ptr);
395	struct net_device *dev = netdev_notifier_info_to_dev(ptr);	371	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
396	struct vlan_group *grp;	372	struct vlan_group *grp;
397	struct vlan_info *vlan_info;	373	struct vlan_info *vlan_info;
398	int i, flgs;	374	int i, flgs;
399	struct net_device *vlandev;	375	struct net_device *vlandev;
400	struct vlan_dev_priv *vlan;
401	bool last = false;	376	bool last = false;
402	LIST_HEAD(list);	377	LIST_HEAD(list);
403	int err;	378	int err;
@@ -447,54 +422,19 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event, · 43 unmodified lines
447	if (vlandev->mtu <= dev->mtu)	422	if (vlandev->mtu <= dev->mtu)
448	continue;	423	continue;
449		424
450	dev_set_mtu(vlandev, dev->mtu);	425	netdev_work_sched(vlandev, VLAN_WORK_MTU);
451	}	426	}
452	break;	427	break;
453		428
454	case NETDEV_FEAT_CHANGE:	429	case NETDEV_FEAT_CHANGE:
455	/* Propagate device features to underlying device */
456	vlan_group_for_each_dev(grp, i, vlandev)	430	vlan_group_for_each_dev(grp, i, vlandev)
457	vlan_transfer_features(dev, vlandev);	431	netdev_work_sched(vlandev, VLAN_WORK_FEATURES);
458	break;	432	break;
459		433
460	case NETDEV_DOWN: {	434	case NETDEV_DOWN:
461	struct net_device *tmp;
462	LIST_HEAD(close_list);
463
464	/* Put all VLANs for this dev in the down state too. */
465	vlan_group_for_each_dev(grp, i, vlandev) {
466	flgs = vlandev->flags;
467	if (!(flgs & IFF_UP))
468	continue;
469
470	vlan = vlan_dev_priv(vlandev);
471	if (!(vlan->flags & VLAN_FLAG_LOOSE_BINDING))
472	list_add(&vlandev->close_list, &close_list);
473	}
474
475	netif_close_many(&close_list, false);
476
477	list_for_each_entry_safe(vlandev, tmp, &close_list, close_list) {
478	vlan_stacked_transfer_operstate(dev, vlandev,
479	vlan_dev_priv(vlandev));
480	list_del_init(&vlandev->close_list);
481	}
482	list_del(&close_list);
483	break;
484	}
485	case NETDEV_UP:	435	case NETDEV_UP:
486	/* Put all VLANs for this dev in the up state too. */	436	vlan_group_for_each_dev(grp, i, vlandev)
487	vlan_group_for_each_dev(grp, i, vlandev) {	437	netdev_work_sched(vlandev, VLAN_WORK_LINK_STATE);
488	flgs = netif_get_flags(vlandev);
489	if (flgs & IFF_UP)
490	continue;
491
492	vlan = vlan_dev_priv(vlandev);
493	if (!(vlan->flags & VLAN_FLAG_LOOSE_BINDING))
494	dev_change_flags(vlandev, flgs \| IFF_UP,
495	extack);
496	vlan_stacked_transfer_operstate(dev, vlandev, vlan);
497	}
498	break;	438	break;
499		439
500	case NETDEV_UNREGISTER:	440	case NETDEV_UNREGISTER:

net/8021q/vlan.h+11−0

@@ -125,6 +125,17 @@ static inline netdev_features_t vlan_tnl_features(struct net_device *real_dev) · 124 unmodified lines
125	int vlan_filter_push_vids(struct vlan_info *vlan_info, __be16 proto);	125	int vlan_filter_push_vids(struct vlan_info *vlan_info, __be16 proto);
126	void vlan_filter_drop_vids(struct vlan_info *vlan_info, __be16 proto);	126	void vlan_filter_drop_vids(struct vlan_info *vlan_info, __be16 proto);
127		127
		128	/* netdev_work events propagated from the real device, see vlan_dev_work(). */
		129	enum {
		130	VLAN_WORK_LINK_STATE = BIT(0), /* sync up/down with real_dev */
		131	VLAN_WORK_MTU = BIT(1), /* clamp mtu to real_dev's */
		132	VLAN_WORK_FEATURES = BIT(2), /* re-inherit real_dev features */
		133	};
		134
		135	void vlan_stacked_transfer_operstate(const struct net_device *rootdev,
		136	struct net_device *dev,
		137	struct vlan_dev_priv *vlan);
		138
128	/* found in vlan_dev.c */	139	/* found in vlan_dev.c */
129	void vlan_dev_set_ingress_priority(const struct net_device *dev,	140	void vlan_dev_set_ingress_priority(const struct net_device *dev,
130	u32 skb_prio, u16 vlan_prio);	141	u32 skb_prio, u16 vlan_prio);

net/8021q/vlan_dev.c+60−0

@@ -270,6 +270,9 @@ static int vlan_dev_open(struct net_device *dev) · 269 unmodified lines
270	!(vlan->flags & VLAN_FLAG_LOOSE_BINDING))	270	!(vlan->flags & VLAN_FLAG_LOOSE_BINDING))
271	return -ENETDOWN;	271	return -ENETDOWN;
272		272
		273	/* The explicit open supersedes any deferred link-state sync */
		274	netdev_work_cancel(dev, VLAN_WORK_LINK_STATE);
		275
273	if (!ether_addr_equal(dev->dev_addr, real_dev->dev_addr) &&	276	if (!ether_addr_equal(dev->dev_addr, real_dev->dev_addr) &&
274	!vlan_dev_inherit_address(dev, real_dev)) {	277	!vlan_dev_inherit_address(dev, real_dev)) {
275	err = dev_uc_add(real_dev, dev->dev_addr);	278	err = dev_uc_add(real_dev, dev->dev_addr);
@@ -300,6 +303,9 @@ static int vlan_dev_stop(struct net_device *dev) · 24 unmodified lines
300	struct vlan_dev_priv *vlan = vlan_dev_priv(dev);	303	struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
301	struct net_device *real_dev = vlan->real_dev;	304	struct net_device *real_dev = vlan->real_dev;
302		305
		306	/* The explicit close supersedes any deferred link-state sync */
		307	netdev_work_cancel(dev, VLAN_WORK_LINK_STATE);
		308
303	dev_mc_unsync(real_dev, dev);	309	dev_mc_unsync(real_dev, dev);
304	dev_uc_unsync(real_dev, dev);	310	dev_uc_unsync(real_dev, dev);
305		311
@@ -1016,6 +1022,59 @@ static const struct ethtool_ops vlan_ethtool_ops = { · 710 unmodified lines
1016	.get_ts_info = vlan_ethtool_get_ts_info,	1022	.get_ts_info = vlan_ethtool_get_ts_info,
1017	};	1023	};
1018		1024
		1025	static void vlan_transfer_features(struct net_device *dev,
		1026	struct net_device *vlandev)
		1027	{
		1028	struct vlan_dev_priv *vlan = vlan_dev_priv(vlandev);
		1029
		1030	netif_inherit_tso_max(vlandev, dev);
		1031
		1032	if (vlan_hw_offload_capable(dev->features, vlan->vlan_proto))
		1033	vlandev->hard_header_len = dev->hard_header_len;
		1034	else
		1035	vlandev->hard_header_len = dev->hard_header_len + VLAN_HLEN;
		1036
		1037	#if IS_ENABLED(CONFIG_FCOE)
		1038	vlandev->fcoe_ddp_xid = dev->fcoe_ddp_xid;
		1039	#endif
		1040
		1041	vlandev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
		1042	vlandev->priv_flags \|= (vlan->real_dev->priv_flags & IFF_XMIT_DST_RELEASE);
		1043	vlandev->hw_enc_features = vlan_tnl_features(vlan->real_dev);
		1044
		1045	netdev_update_features(vlandev);
		1046	}
		1047
		1048	static void vlan_dev_work(struct net_device *vlandev, unsigned long events)
		1049	{
		1050	struct vlan_dev_priv *vlan = vlan_dev_priv(vlandev);
		1051	struct net_device *real_dev = vlan->real_dev;
		1052	bool loose = vlan->flags & VLAN_FLAG_LOOSE_BINDING;
		1053	unsigned int flgs;
		1054
		1055	if (events & VLAN_WORK_LINK_STATE) {
		1056	flgs = netif_get_flags(vlandev);
		1057	if (real_dev->flags & IFF_UP) {
		1058	if (!(flgs & IFF_UP)) {
		1059	if (!loose)
		1060	netif_change_flags(vlandev,
		1061	flgs \| IFF_UP, NULL);
		1062	vlan_stacked_transfer_operstate(real_dev,
		1063	vlandev, vlan);
		1064	}
		1065	} else if ((flgs & IFF_UP) && !loose) {
		1066	netif_change_flags(vlandev, flgs & ~IFF_UP, NULL);
		1067	vlan_stacked_transfer_operstate(real_dev, vlandev, vlan);
		1068	}
		1069	}
		1070
		1071	if ((events & VLAN_WORK_MTU) && vlandev->mtu > real_dev->mtu)
		1072	netif_set_mtu(vlandev, real_dev->mtu);
		1073
		1074	if (events & VLAN_WORK_FEATURES)
		1075	vlan_transfer_features(real_dev, vlandev);
		1076	}
		1077
1019	static const struct net_device_ops vlan_netdev_ops = {	1078	static const struct net_device_ops vlan_netdev_ops = {
1020	.ndo_change_mtu = vlan_dev_change_mtu,	1079	.ndo_change_mtu = vlan_dev_change_mtu,
1021	.ndo_init = vlan_dev_init,	1080	.ndo_init = vlan_dev_init,
@@ -1027,6 +1086,7 @@ static const struct net_device_ops vlan_netdev_ops = { · 5 unmodified lines
1027	.ndo_set_mac_address = vlan_dev_set_mac_address,	1086	.ndo_set_mac_address = vlan_dev_set_mac_address,
1028	.ndo_set_rx_mode = vlan_dev_set_rx_mode,	1087	.ndo_set_rx_mode = vlan_dev_set_rx_mode,
1029	.ndo_change_rx_flags = vlan_dev_change_rx_flags,	1088	.ndo_change_rx_flags = vlan_dev_change_rx_flags,
		1089	.ndo_work = vlan_dev_work,
1030	.ndo_eth_ioctl = vlan_dev_ioctl,	1090	.ndo_eth_ioctl = vlan_dev_ioctl,
1031	.ndo_neigh_setup = vlan_dev_neigh_setup,	1091	.ndo_neigh_setup = vlan_dev_neigh_setup,
1032	.ndo_get_stats64 = vlan_dev_get_stats64,	1092	.ndo_get_stats64 = vlan_dev_get_stats64,

net/batman-adv/bat_iv_ogm.c+10−1

 			  const struct batadv_ogm_packet *ogm_packet)
 {
 	int next_buff_pos = 0;
+	u16 tvlv_len;
 	/* check if there is enough space for the header */
 	next_buff_pos += buff_pos + sizeof(*ogm_packet);
 	if (next_buff_pos > packet_len)
 		return false;
+	tvlv_len = ntohs(ogm_packet->tvlv_len);
+	/* the fields of an aggregated OGM are accessed assuming (at least)
+	 * 2-byte alignment, so a following OGM must start at an even offset.
+	 */
+	if (tvlv_len & 1)
+		return false;
 	/* check if there is enough space for the optional TVLV */
-	next_buff_pos += ntohs(ogm_packet->tvlv_len);
+	next_buff_pos += tvlv_len;
 	return next_buff_pos <= packet_len;
 }

net/batman-adv/bat_v.c+1−0

@@ -817,6 +817,7 @@ void batadv_v_hardif_init(struct batadv_hard_iface *hard_iface) · 816 unmodified lines
817		817
818	hard_iface->bat_v.aggr_len = 0;	818	hard_iface->bat_v.aggr_len = 0;
819	skb_queue_head_init(&hard_iface->bat_v.aggr_list);	819	skb_queue_head_init(&hard_iface->bat_v.aggr_list);
		820	hard_iface->bat_v.aggr_list_enabled = false;
820	INIT_DELAYED_WORK(&hard_iface->bat_v.aggr_wq,	821	INIT_DELAYED_WORK(&hard_iface->bat_v.aggr_wq,
821	batadv_v_ogm_aggr_work);	822	batadv_v_ogm_aggr_work);
822	/* make sure it doesn't run until interface gets enabled */	823	/* make sure it doesn't run until interface gets enabled */

net/batman-adv/bat_v_ogm.c+22−1

 	}
 	spin_lock_bh(&hard_iface->bat_v.aggr_list.lock);
+	if (!hard_iface->bat_v.aggr_list_enabled) {
+		kfree_skb(skb);
+		goto unlock;
+	}
 	if (!batadv_v_ogm_queue_left(skb, hard_iface))
 		batadv_v_ogm_aggr_send(bat_priv, hard_iface);
 	hard_iface->bat_v.aggr_len += batadv_v_ogm_len(skb);
 	__skb_queue_tail(&hard_iface->bat_v.aggr_list, skb);
+unlock:
 	spin_unlock_bh(&hard_iface->bat_v.aggr_list.lock);
 }
 {
 	struct batadv_priv *bat_priv = netdev_priv(hard_iface->mesh_iface);
+	spin_lock_bh(&hard_iface->bat_v.aggr_list.lock);
+	hard_iface->bat_v.aggr_list_enabled = true;
+	spin_unlock_bh(&hard_iface->bat_v.aggr_list.lock);
 	enable_delayed_work(&hard_iface->bat_v.aggr_wq);
 	batadv_v_ogm_start_queue_timer(hard_iface);
 	disable_delayed_work_sync(&hard_iface->bat_v.aggr_wq);
 	spin_lock_bh(&hard_iface->bat_v.aggr_list.lock);
+	hard_iface->bat_v.aggr_list_enabled = false;
 	batadv_v_ogm_aggr_list_free(hard_iface);
 	spin_unlock_bh(&hard_iface->bat_v.aggr_list.lock);
 }
 			 const struct batadv_ogm2_packet *ogm2_packet)
 {
 	int next_buff_pos = 0;
+	u16 tvlv_len;
 	/* check if there is enough space for the header */
 	next_buff_pos += buff_pos + sizeof(*ogm2_packet);
 	if (next_buff_pos > packet_len)
 		return false;
+	tvlv_len = ntohs(ogm2_packet->tvlv_len);
+	/* the fields of an aggregated OGMv2 are accessed assuming (at least)
+	 * 2-byte alignment, so a following OGMv2 must start at an even offset.
+	 */
+	if (tvlv_len & 1)
+		return false;
 	/* check if there is enough space for the optional TVLV */
-	next_buff_pos += ntohs(ogm2_packet->tvlv_len);
+	next_buff_pos += tvlv_len;
 	return next_buff_pos <= packet_len;
 }

net/batman-adv/distributed-arp-table.c+9−3

  */
 static bool batadv_compare_dat(const struct hlist_node *node, const void *data2)
 {
-	const void *data1 = container_of(node, struct batadv_dat_entry,
+	const struct batadv_dat_entry *entry1;
-					 hash_entry);
+	const struct batadv_dat_entry *entry2;
-	return memcmp(data1, data2, sizeof(__be32)) == 0;
+	entry1 = container_of(node, struct batadv_dat_entry, hash_entry);
+	entry2 = data2;
+	return entry1->ip == entry2->ip && entry1->vid == entry2->vid;
 }
 /**
 		if (dat_entry->ip != ip)
 			continue;
+		if (dat_entry->vid != vid)
+			continue;
 		if (!kref_get_unless_zero(&dat_entry->refcount))
 			continue;

net/batman-adv/fragmentation.c+21−1

  * @skb: skb to forward
  * @recv_if: interface that the skb is received on
  * @orig_node_src: originator that the skb is received from
+ * @rx_result: set to NET_RX_SUCCESS when the fragment was forwarded and
+ *  NET_RX_DROP when it was dropped; only valid when true is returned
  *
  * Look up the next-hop of the fragments payload and check if the merged packet
  * will exceed the MTU towards the next-hop. If so, the fragment is forwarded
  */
 bool batadv_frag_skb_fwd(struct sk_buff *skb,
 			 struct batadv_hard_iface *recv_if,
-			 struct batadv_orig_node *orig_node_src)
+			 struct batadv_orig_node *orig_node_src,
+			 int *rx_result)
 {
 	struct batadv_priv *bat_priv = netdev_priv(recv_if->mesh_iface);
 	struct batadv_neigh_node *neigh_node = NULL;
 	 */
 	total_size = ntohs(packet->total_size);
 	if (total_size > neigh_node->if_incoming->net_dev->mtu) {
+		if (packet->ttl < 2) {
+			kfree_skb(skb);
+			*rx_result = NET_RX_DROP;
+			ret = true;
+			goto out;
+		}
+		if (skb_cow(skb, ETH_HLEN) < 0) {
+			kfree_skb(skb);
+			*rx_result = NET_RX_DROP;
+			ret = true;
+			goto out;
+		}
+		packet = (struct batadv_frag_packet *)skb->data;
 		batadv_inc_counter(bat_priv, BATADV_CNT_FRAG_FWD);
 		batadv_add_counter(bat_priv, BATADV_CNT_FRAG_FWD_BYTES,
 				   skb->len + ETH_HLEN);
 		packet->ttl--;
 		batadv_send_unicast_skb(skb, neigh_node);
+		*rx_result = NET_RX_SUCCESS;
 		ret = true;
 	}

net/batman-adv/fragmentation.h+2−1

 			    bool (*check_cb)(struct batadv_frag_table_entry *));
 bool batadv_frag_skb_fwd(struct sk_buff *skb,
 			 struct batadv_hard_iface *recv_if,
-			 struct batadv_orig_node *orig_node_src);
+			 struct batadv_orig_node *orig_node_src,
+			 int *rx_result);
 bool batadv_frag_skb_buffer(struct sk_buff **skb,
 			    struct batadv_orig_node *orig_node);
 int batadv_frag_send_packet(struct sk_buff *skb,

net/batman-adv/hard-interface.c+2−26

@@ -814,30 +814,6 @@ err_dev: · 813 unmodified lines
814	return ret;	814	return ret;
815	}	815	}
816		816
817	/**
818	* batadv_hardif_cnt() - get number of interfaces enslaved to mesh interface
819	* @mesh_iface: mesh interface to check
820	*
821	* This function is only using RCU for locking - the result can therefore be
822	* off when another function is modifying the list at the same time. The
823	* caller can use the rtnl_lock to make sure that the count is accurate.
824	*
825	* Return: number of connected/enslaved hard interfaces
826	*/
827	static size_t batadv_hardif_cnt(struct net_device *mesh_iface)
828	{
829	struct batadv_hard_iface *hard_iface;
830	struct list_head *iter;
831	size_t count = 0;
832
833	rcu_read_lock();
834	netdev_for_each_lower_private_rcu(mesh_iface, hard_iface, iter)
835	count++;
836	rcu_read_unlock();
837
838	return count;
839	}
840
841	/**	817	/**
842	* batadv_hardif_disable_interface() - Remove hard interface from mesh interface	818	* batadv_hardif_disable_interface() - Remove hard interface from mesh interface
843	* @hard_iface: hard interface to be removed	819	* @hard_iface: hard interface to be removed
@@ -878,8 +854,8 @@ void batadv_hardif_disable_interface(struct batadv_hard_iface *hard_iface) · 34 unmodified lines
878	netdev_upper_dev_unlink(hard_iface->net_dev, hard_iface->mesh_iface);	854	netdev_upper_dev_unlink(hard_iface->net_dev, hard_iface->mesh_iface);
879	batadv_hardif_recalc_extra_skbroom(hard_iface->mesh_iface);	855	batadv_hardif_recalc_extra_skbroom(hard_iface->mesh_iface);
880		856
881	/* nobody uses this interface anymore */	857	/* nobody uses this mesh interface anymore */
882	if (batadv_hardif_cnt(hard_iface->mesh_iface) <= 1)	858	if (list_empty(&hard_iface->mesh_iface->adj_list.lower))
883	batadv_gw_check_client_stop(bat_priv);	859	batadv_gw_check_client_stop(bat_priv);
884		860
885	hard_iface->mesh_iface = NULL;	861	hard_iface->mesh_iface = NULL;

net/batman-adv/routing.c+69−4

@@ -8,6 +8,7 @@ · 7 unmodified lines
8	#include "main.h"	8	#include "main.h"
9		9
10	#include <linux/atomic.h>	10	#include <linux/atomic.h>
		11	#include <linux/build_bug.h>
11	#include <linux/byteorder/generic.h>	12	#include <linux/byteorder/generic.h>
12	#include <linux/compiler.h>	13	#include <linux/compiler.h>
13	#include <linux/errno.h>	14	#include <linux/errno.h>
@@ -204,6 +205,59 @@ bool batadv_check_management_packet(struct sk_buff *skb, · 190 unmodified lines
204	return true;	205	return true;
205	}	206	}
206		207
		208	/**
		209	* batadv_skb_decrement_ttl() - decrement ttl in a batman-adv header, csum-safe
		210	* @skb: the received packet with @skb->data pointing to the batman-adv header
		211	*
		212	* Supports the following packet types, all of which carry the TTL at offset 2:
		213	*
		214	* - batadv_ogm_packet
		215	* - batadv_ogm2_packet
		216	* - batadv_icmp_header
		217	* - batadv_icmp_packet
		218	* - batadv_icmp_tp_packet
		219	* - batadv_icmp_packet_rr
		220	* - batadv_unicast_packet
		221	* - batadv_frag_packet
		222	* - batadv_bcast_packet
		223	* - batadv_mcast_packet
		224	* - batadv_coded_packet
		225	* - batadv_unicast_tvlv_packet
		226	*
		227	* Return: true if the packet may be forwarded (ttl decremented),
		228	* false if it must be dropped (ttl would expire)
		229	*/
		230	static bool batadv_skb_decrement_ttl(struct sk_buff *skb)
		231	{
		232	static const size_t ttl_offset = 2;
		233	u8 *ttl_pos;
		234
		235	BUILD_BUG_ON(offsetof(struct batadv_ogm_packet, ttl) != ttl_offset);
		236	BUILD_BUG_ON(offsetof(struct batadv_ogm2_packet, ttl) != ttl_offset);
		237	BUILD_BUG_ON(offsetof(struct batadv_icmp_header, ttl) != ttl_offset);
		238	BUILD_BUG_ON(offsetof(struct batadv_icmp_packet, ttl) != ttl_offset);
		239	BUILD_BUG_ON(offsetof(struct batadv_icmp_tp_packet, ttl) != ttl_offset);
		240	BUILD_BUG_ON(offsetof(struct batadv_icmp_packet_rr, ttl) != ttl_offset);
		241	BUILD_BUG_ON(offsetof(struct batadv_unicast_packet, ttl) != ttl_offset);
		242	BUILD_BUG_ON(offsetof(struct batadv_frag_packet, ttl) != ttl_offset);
		243	BUILD_BUG_ON(offsetof(struct batadv_bcast_packet, ttl) != ttl_offset);
		244	BUILD_BUG_ON(offsetof(struct batadv_mcast_packet, ttl) != ttl_offset);
		245	BUILD_BUG_ON(offsetof(struct batadv_coded_packet, ttl) != ttl_offset);
		246	BUILD_BUG_ON(offsetof(struct batadv_unicast_tvlv_packet, ttl) != ttl_offset);
		247
		248	ttl_pos = skb->data + ttl_offset;
		249
		250	/* would expire on this hop -> drop, leave header + csum untouched */
		251	if (*ttl_pos < 2)
		252	return false;
		253
		254	skb_postpull_rcsum(skb, ttl_pos, 1);
		255	(*ttl_pos)--;
		256	skb_postpush_rcsum(skb, ttl_pos, 1);
		257
		258	return true;
		259	}
		260
207	/**	261	/**
208	* batadv_recv_my_icmp_packet() - receive an icmp packet locally	262	* batadv_recv_my_icmp_packet() - receive an icmp packet locally
209	* @bat_priv: the bat priv with all the mesh interface information	263	* @bat_priv: the bat priv with all the mesh interface information
@@ -1114,10 +1168,9 @@ int batadv_recv_frag_packet(struct sk_buff *skb, · 904 unmodified lines
1114		1168
1115	/* Route the fragment if it is not for us and too big to be merged. */	1169	/* Route the fragment if it is not for us and too big to be merged. */
1116	if (!batadv_is_my_mac(bat_priv, frag_packet->dest) &&	1170	if (!batadv_is_my_mac(bat_priv, frag_packet->dest) &&
1117	batadv_frag_skb_fwd(skb, recv_if, orig_node_src)) {	1171	batadv_frag_skb_fwd(skb, recv_if, orig_node_src, &ret)) {
1118	/* skb was consumed */	1172	/* skb was consumed */
1119	skb = NULL;	1173	skb = NULL;
1120	ret = NET_RX_SUCCESS;
1121	goto put_orig_node;	1174	goto put_orig_node;
1122	}	1175	}
1123		1176
@@ -1191,7 +1244,13 @@ int batadv_recv_bcast_packet(struct sk_buff *skb, · 67 unmodified lines
1191	if (batadv_is_my_mac(bat_priv, bcast_packet->orig))	1244	if (batadv_is_my_mac(bat_priv, bcast_packet->orig))
1192	goto free_skb;	1245	goto free_skb;
1193		1246
1194	if (bcast_packet->ttl-- < 2)	1247	/* create a copy of the skb, if needed, to modify it. */
		1248	if (skb_cow(skb, ETH_HLEN) < 0)
		1249	goto free_skb;
		1250
		1251	bcast_packet = (struct batadv_bcast_packet *)skb->data;
		1252
		1253	if (!batadv_skb_decrement_ttl(skb))
1195	goto free_skb;	1254	goto free_skb;
1196		1255
1197	orig_node = batadv_orig_hash_find(bat_priv, bcast_packet->orig);	1256	orig_node = batadv_orig_hash_find(bat_priv, bcast_packet->orig);
@@ -1298,7 +1357,7 @@ int batadv_recv_mcast_packet(struct sk_buff *skb, · 100 unmodified lines
1298	goto free_skb;	1357	goto free_skb;
1299		1358
1300	mcast_packet = (struct batadv_mcast_packet *)skb->data;	1359	mcast_packet = (struct batadv_mcast_packet *)skb->data;
1301	if (mcast_packet->ttl-- < 2)	1360	if (!batadv_skb_decrement_ttl(skb))
1302	goto free_skb;	1361	goto free_skb;
1303		1362
1304	tvlv_buff = (unsigned char *)(skb->data + hdr_size);	1363	tvlv_buff = (unsigned char *)(skb->data + hdr_size);
@@ -1307,6 +1366,12 @@ int batadv_recv_mcast_packet(struct sk_buff *skb, · 2 unmodified lines
1307	if (tvlv_buff_len > skb->len - hdr_size)	1366	if (tvlv_buff_len > skb->len - hdr_size)
1308	goto free_skb;	1367	goto free_skb;
1309		1368
		1369	/* the fields of an multicast payload are accessed assuming (at least)
		1370	* 2-byte alignment, so a following packet must start at an even offset.
		1371	*/
		1372	if (tvlv_buff_len & 1)
		1373	goto free_skb;
		1374
1310	ret = batadv_tvlv_containers_process(bat_priv, BATADV_MCAST, NULL, skb,	1375	ret = batadv_tvlv_containers_process(bat_priv, BATADV_MCAST, NULL, skb,
1311	tvlv_buff, tvlv_buff_len);	1376	tvlv_buff, tvlv_buff_len);
1312	if (ret >= 0) {	1377	if (ret >= 0) {

net/batman-adv/tp_meter.c+48−26

 #define BATADV_TP_PLEN (BATADV_TP_PACKET_LEN - ETH_HLEN - \
 			sizeof(struct batadv_unicast_packet))
+/**
+ * BATADV_TP_MAX_UNACKED - maximum number of packets a receiver didn't yet ack
+ */
+#define BATADV_TP_MAX_UNACKED 100
 static u8 batadv_tp_prerandom[4096] __read_mostly;
 /**
 	bat_priv = tp_vars->common.bat_priv;
 	/* if there is recent activity rearm the timer */
-	if (!batadv_has_timed_out(tp_vars->last_recv_time,
+	if (!batadv_has_timed_out(READ_ONCE(tp_vars->last_recv_time),
 				  BATADV_TP_RECV_TIMEOUT)) {
 		/* reset the receiver shutdown timer */
 		batadv_tp_reset_receiver_timer(tp_vars);
 	list_for_each_entry_safe(un, safe, &tp_vars->common.unacked_list, list) {
 		list_del(&un->list);
 		kfree(un);
+		tp_vars->common.unacked_count--;
 	}
 	spin_unlock_bh(&tp_vars->common.unacked_lock);
 /**
  * batadv_tp_handle_out_of_order() - store an out of order packet
  * @tp_vars: the private data of the current TP meter session
- * @skb: the buffer containing the received packet
+ * @seqno: sequence number of new received packet
+ * @payload_len: length of the received packet
  *
  * Store the out of order packet in the unacked list for late processing. This
  * packets are kept in this list so that they can be ACKed at once as soon as
  * Return: true if the packed has been successfully processed, false otherwise
  */
 static bool batadv_tp_handle_out_of_order(struct batadv_tp_receiver *tp_vars,
-					  const struct sk_buff *skb)
+					  u32 seqno, u32 payload_len)
+	__must_hold(&tp_vars->common.unacked_lock)
 {
-	const struct batadv_icmp_tp_packet *icmp;
 	struct batadv_tp_unacked *un, *new;
-	u32 payload_len;
 	bool added = false;
 	new = kmalloc_obj(*new, GFP_ATOMIC);
 	if (unlikely(!new))
 		return false;
-	icmp = (struct batadv_icmp_tp_packet *)skb->data;
+	new->seqno = seqno;
-	new->seqno = ntohl(icmp->seqno);
-	payload_len = skb->len - sizeof(struct batadv_unicast_packet);
 	new->len = payload_len;
-	spin_lock_bh(&tp_vars->common.unacked_lock);
 	/* if the list is empty immediately attach this new object */
 	if (list_empty(&tp_vars->common.unacked_list)) {
 		list_add(&new->list, &tp_vars->common.unacked_list);
-		goto out;
+		tp_vars->common.unacked_count++;
+		return true;
 	}
 	/* otherwise loop over the list and either drop the packet because this
 		 */
 		list_add(&new->list, &un->list);
 		added = true;
+		tp_vars->common.unacked_count++;
 		break;
 	}
 	/* received packet with smallest seqno out of order; add it to front */
-	if (!added)
+	if (!added) {
 		list_add(&new->list, &tp_vars->common.unacked_list);
+		tp_vars->common.unacked_count++;
+	}
-out:
+	/* remove the last (biggest) unacked seqno when list is too large */
-	spin_unlock_bh(&tp_vars->common.unacked_lock);
+	if (tp_vars->common.unacked_count > BATADV_TP_MAX_UNACKED) {
+		un = list_last_entry(&tp_vars->common.unacked_list,
+				     struct batadv_tp_unacked, list);
+		list_del(&un->list);
+		kfree(un);
+		tp_vars->common.unacked_count--;
+	}
 	return true;
 }
  * @tp_vars: the private data of the current TP meter session
  */
 static void batadv_tp_ack_unordered(struct batadv_tp_receiver *tp_vars)
+	__must_hold(&tp_vars->common.unacked_lock)
 {
 	struct batadv_tp_unacked *un, *safe;
 	u32 to_ack;
 	/* go through the unacked packet list and possibly ACK them as
 	 * well
 	 */
-	spin_lock_bh(&tp_vars->common.unacked_lock);
 	list_for_each_entry_safe(un, safe, &tp_vars->common.unacked_list, list) {
 		/* the list is ordered, therefore it is possible to stop as soon
 		 * there is a gap between the last acked seqno and the seqno of
 		list_del(&un->list);
 		kfree(un);
+		tp_vars->common.unacked_count--;
 	}
-	spin_unlock_bh(&tp_vars->common.unacked_lock);
 }
 /**
 	tp_vars = batadv_tp_list_find_receiver_session(bat_priv, icmp->orig,
 						       icmp->session);
 	if (tp_vars) {
-		tp_vars->last_recv_time = jiffies;
+		WRITE_ONCE(tp_vars->last_recv_time, jiffies);
 		goto out_unlock;
 	}
 	spin_lock_init(&tp_vars->common.unacked_lock);
 	INIT_LIST_HEAD(&tp_vars->common.unacked_list);
+	tp_vars->common.unacked_count = 0;
 	kref_get(&tp_vars->common.refcount);
 	timer_setup(&tp_vars->common.timer, batadv_tp_receiver_shutdown, 0);
-	tp_vars->last_recv_time = jiffies;
+	WRITE_ONCE(tp_vars->last_recv_time, jiffies);
 	kref_get(&tp_vars->common.refcount);
 	hlist_add_head_rcu(&tp_vars->common.list, &bat_priv->tp_receiver_list);
 {
 	const struct batadv_icmp_tp_packet *icmp;
 	struct batadv_tp_receiver *tp_vars;
-	size_t packet_size;
+	u32 payload_len;
+	u32 to_ack;
 	u32 seqno;
 	icmp = (struct batadv_icmp_tp_packet *)skb->data;
 			goto out;
 		}
-		tp_vars->last_recv_time = jiffies;
+		WRITE_ONCE(tp_vars->last_recv_time, jiffies);
 	}
+	spin_lock_bh(&tp_vars->common.unacked_lock);
 	/* if the packet is a duplicate, it may be the case that an ACK has been
 	 * lost. Resend the ACK
 	 */
-	if (batadv_seq_before(seqno, tp_vars->last_recv))
+	payload_len = skb->len - sizeof(struct batadv_unicast_packet);
+	to_ack = seqno + payload_len;
+	if (batadv_seq_before(to_ack, tp_vars->last_recv))
 		goto send_ack;
 	/* if the packet is out of order enqueue it */
-	if (ntohl(icmp->seqno) != tp_vars->last_recv) {
+	if (batadv_seq_before(tp_vars->last_recv, seqno)) {
 		/* exit immediately (and do not send any ACK) if the packet has
 		 * not been enqueued correctly
 		 */
-		if (!batadv_tp_handle_out_of_order(tp_vars, skb))
+		if (!batadv_tp_handle_out_of_order(tp_vars, seqno, payload_len)) {
+			spin_unlock_bh(&tp_vars->common.unacked_lock);
 			goto out;
+		}
 		/* send a duplicate ACK */
 		goto send_ack;
 	}
 	/* if everything was fine count the ACKed bytes */
-	packet_size = skb->len - sizeof(struct batadv_unicast_packet);
+	tp_vars->last_recv = to_ack;
-	tp_vars->last_recv += packet_size;
 	/* check if this ordered message filled a gap.... */
 	batadv_tp_ack_unordered(tp_vars);
 send_ack:
+	to_ack = tp_vars->last_recv;
+	spin_unlock_bh(&tp_vars->common.unacked_lock);
 	/* send the ACK. If the received packet was out of order, the ACK that
 	 * is going to be sent is a duplicate (the sender will count them and
 	 * possibly enter Fast Retransmit as soon as it has reached 3)
 	 */
-	batadv_tp_send_ack(bat_priv, icmp->orig, tp_vars->last_recv,
+	batadv_tp_send_ack(bat_priv, icmp->orig, to_ack,
 			   icmp->timestamp, icmp->session, icmp->uid);
 out:
 	batadv_tp_receiver_put(tp_vars);

net/batman-adv/translation-table.c+10−2

 		if (!batadv_compare_eth(entry->change.addr, common->addr))
 			continue;
+		if (entry->change.vid != tt_change_node->change.vid)
+			continue;
 		del_op_entry = entry->change.flags & BATADV_TT_CLIENT_DEL;
 		if (del_op_requested != del_op_entry) {
 			/* DEL+ADD in the same orig interval have no effect and
  * batadv_tt_check_roam_count() - check if a client has roamed too frequently
  * @bat_priv: the bat priv with all the mesh interface information
  * @client: mac address of the roaming client
+ * @vid: VLAN identifier
  *
  * This function checks whether the client already reached the
  * maximum number of possible roaming phases. In this case the ROAMING_ADV
  *
  * Return: true if the ROAMING_ADV can be sent, false otherwise
  */
-static bool batadv_tt_check_roam_count(struct batadv_priv *bat_priv, u8 *client)
+static bool batadv_tt_check_roam_count(struct batadv_priv *bat_priv, u8 *client, u16 vid)
 {
 	struct batadv_tt_roam_node *tt_roam_node;
 	bool ret = false;
 		if (!batadv_compare_eth(tt_roam_node->addr, client))
 			continue;
+		if (tt_roam_node->vid != vid)
+			continue;
 		if (batadv_has_timed_out(tt_roam_node->first_time,
 					 BATADV_ROAMING_MAX_TIME))
 			continue;
 		atomic_set(&tt_roam_node->counter,
 			   BATADV_ROAMING_MAX_COUNT - 1);
 		ether_addr_copy(tt_roam_node->addr, client);
+		tt_roam_node->vid = vid;
 		list_add(&tt_roam_node->list, &bat_priv->tt.roam_list);
 		ret = true;
 	/* before going on we have to check whether the client has
 	 * already roamed to us too many times
 	 */
-	if (!batadv_tt_check_roam_count(bat_priv, client))
+	if (!batadv_tt_check_roam_count(bat_priv, client, vid))
 		goto out;
 	batadv_dbg(BATADV_DBG_TT, bat_priv,

net/batman-adv/tvlv.c+63−6

@@ -411,7 +411,6 @@ static int batadv_tvlv_call_handler(struct batadv_priv *bat_priv, · 410 unmodified lines
411	tvlv_handler->ogm_handler(bat_priv, orig_node,	411	tvlv_handler->ogm_handler(bat_priv, orig_node,
412	BATADV_NO_FLAGS,	412	BATADV_NO_FLAGS,
413	tvlv_value, tvlv_value_len);	413	tvlv_value, tvlv_value_len);
414	tvlv_handler->flags \|= BATADV_TVLV_HANDLER_OGM_CALLED;
415	break;	414	break;
416	case BATADV_UNICAST_TVLV:	415	case BATADV_UNICAST_TVLV:
417	if (!skb)	416	if (!skb)
@@ -443,6 +442,48 @@ static int batadv_tvlv_call_handler(struct batadv_priv *bat_priv, · 25 unmodified lines
443	return NET_RX_SUCCESS;	442	return NET_RX_SUCCESS;
444	}	443	}
445		444
		445	/**
		446	* batadv_tvlv_containers_contain() - check if a tvlv buffer holds a container
		447	* @tvlv_value: tvlv content
		448	* @tvlv_value_len: tvlv content length
		449	* @type: tvlv container type to look for
		450	* @version: tvlv container version to look for
		451	*
		452	* Return: true if a container of the given type and version is present in the
		453	* tvlv buffer, false otherwise.
		454	*/
		455	static bool batadv_tvlv_containers_contain(void *tvlv_value,
		456	u16 tvlv_value_len, u8 type,
		457	u8 version)
		458	{
		459	struct batadv_tvlv_hdr *tvlv_hdr;
		460	u16 tvlv_value_cont_len;
		461
		462	while (tvlv_value_len >= sizeof(*tvlv_hdr)) {
		463	tvlv_hdr = tvlv_value;
		464	tvlv_value_cont_len = ntohs(tvlv_hdr->len);
		465	tvlv_value = tvlv_hdr + 1;
		466	tvlv_value_len -= sizeof(*tvlv_hdr);
		467
		468	if (tvlv_value_cont_len > tvlv_value_len)
		469	break;
		470
		471	/* the next tvlv header is accessed assuming (at least) 2-byte
		472	* alignment, so it must start at an even offset.
		473	*/
		474	if (tvlv_value_cont_len & 1)
		475	break;
		476
		477	if (tvlv_hdr->type == type && tvlv_hdr->version == version)
		478	return true;
		479
		480	tvlv_value = (u8 *)tvlv_value + tvlv_value_cont_len;
		481	tvlv_value_len -= tvlv_value_cont_len;
		482	}
		483
		484	return false;
		485	}
		486
446	/**	487	/**
447	* batadv_tvlv_containers_process() - parse the given tvlv buffer to call the	488	* batadv_tvlv_containers_process() - parse the given tvlv buffer to call the
448	* appropriate handlers	489	* appropriate handlers
@@ -462,7 +503,9 @@ int batadv_tvlv_containers_process(struct batadv_priv *bat_priv, · 13 unmodified lines
462	struct sk_buff skb, void tvlv_value,	503	struct sk_buff skb, void tvlv_value,
463	u16 tvlv_value_len)	504	u16 tvlv_value_len)
464	{	505	{
		506	u16 tvlv_value_start_len = tvlv_value_len;
465	struct batadv_tvlv_handler *tvlv_handler;	507	struct batadv_tvlv_handler *tvlv_handler;
		508	void *tvlv_value_start = tvlv_value;
466	struct batadv_tvlv_hdr *tvlv_hdr;	509	struct batadv_tvlv_hdr *tvlv_hdr;
467	u16 tvlv_value_cont_len;	510	u16 tvlv_value_cont_len;
468	u8 cifnotfound = BATADV_TVLV_HANDLER_OGM_CIFNOTFND;	511	u8 cifnotfound = BATADV_TVLV_HANDLER_OGM_CIFNOTFND;
@@ -477,6 +520,12 @@ int batadv_tvlv_containers_process(struct batadv_priv *bat_priv, · 8 unmodified lines
477	if (tvlv_value_cont_len > tvlv_value_len)	520	if (tvlv_value_cont_len > tvlv_value_len)
478	break;	521	break;
479		522
		523	/* the next tvlv header is accessed assuming (at least) 2-byte
		524	* alignment, so it must start at an even offset.
		525	*/
		526	if (tvlv_value_cont_len & 1)
		527	break;
		528
480	tvlv_handler = batadv_tvlv_handler_get(bat_priv,	529	tvlv_handler = batadv_tvlv_handler_get(bat_priv,
481	tvlv_hdr->type,	530	tvlv_hdr->type,
482	tvlv_hdr->version);	531	tvlv_hdr->version);
@@ -500,12 +549,20 @@ int batadv_tvlv_containers_process(struct batadv_priv *bat_priv, · 17 unmodified lines
500	if (!tvlv_handler->ogm_handler)	549	if (!tvlv_handler->ogm_handler)
501	continue;	550	continue;
502		551
503	if ((tvlv_handler->flags & BATADV_TVLV_HANDLER_OGM_CIFNOTFND) &&	552	if (!(tvlv_handler->flags & BATADV_TVLV_HANDLER_OGM_CIFNOTFND))
504	!(tvlv_handler->flags & BATADV_TVLV_HANDLER_OGM_CALLED))	553	continue;
505	tvlv_handler->ogm_handler(bat_priv, orig_node,	554
506	cifnotfound, NULL, 0);	555	/* if the corresponding container was present then the handler
		556	* was already called from the loop above
		557	*/
		558	if (batadv_tvlv_containers_contain(tvlv_value_start,
		559	tvlv_value_start_len,
		560	tvlv_handler->type,
		561	tvlv_handler->version))
		562	continue;
507		563
508	tvlv_handler->flags &= ~BATADV_TVLV_HANDLER_OGM_CALLED;	564	tvlv_handler->ogm_handler(bat_priv, orig_node,
		565	cifnotfound, NULL, 0);
509	}	566	}
510	rcu_read_unlock();	567	rcu_read_unlock();
511		568

net/batman-adv/types.h+13−8

 	/** @aggr_list: queue for to be aggregated OGM packets */
 	struct sk_buff_head aggr_list;
+	/**
+	 * @aggr_list_enabled: aggr_list is active and new skbs can be
+	 * enqueued. Protected by aggr_list.lock after initialization
+	 */
+	bool aggr_list_enabled:1;
 	/** @aggr_len: size of the OGM aggregate (excluding ethernet header) */
 	unsigned int aggr_len;
 	/** @unacked_list: list of unacked packets (meta-info only) */
 	struct list_head unacked_list;
-	/** @unacked_lock: protect unacked_list */
+	/** @unacked_lock: protect unacked_list + &batadv_tp_receiver.last_recv */
 	spinlock_t unacked_lock;
+	/** @unacked_count: number of unacked entries */
+	size_t unacked_count;
 	/** @refcount: number of context where the object is used */
 	struct kref refcount;
 	/** @addr: mac address of the client in the roaming phase */
 	u8 addr[ETH_ALEN];
+	/** @vid: VLAN identifier */
+	u16 vid;
 	/**
 	 * @counter: number of allowed roaming events per client within a single
 	 * OGM interval (changes are committed with each OGM)
 	 *  will call this handler even if its type was not found (with no data)
 	 */
 	BATADV_TVLV_HANDLER_OGM_CIFNOTFND = BIT(1),
-	/**
-	 * @BATADV_TVLV_HANDLER_OGM_CALLED: interval tvlv handling flag - the
-	 *  API marks a handler as being called, so it won't be called if the
-	 *  BATADV_TVLV_HANDLER_OGM_CIFNOTFND flag was set
-	 */
-	BATADV_TVLV_HANDLER_OGM_CALLED = BIT(2),
 };
 #endif /* _NET_BATMAN_ADV_TYPES_H_ */

net/bridge/netfilter/nft_meta_bridge.c+21−2

 		if (!br_dev || !br_vlan_enabled(br_dev))
 			goto err;
-		br_vlan_get_pvid_rcu(in, &p_pvid);
+		if (br_vlan_get_pvid_rcu(in, &p_pvid))
+			goto err;
 		nft_reg_store16(dest, p_pvid);
 		return;
 	}
 					NULL, NFT_DATA_VALUE, len);
 }
+static int nft_meta_bridge_get_validate(const struct nft_ctx *ctx,
+					const struct nft_expr *expr)
+{
+	struct nft_meta *priv = nft_expr_priv(expr);
+	unsigned int hooks;
+	switch (priv->key) {
+	case NFT_META_BRI_IIFHWADDR:
+		hooks = 1 << NF_BR_PRE_ROUTING;
+		break;
+	default:
+		return nft_meta_get_validate(ctx, expr);
+	}
+	return nft_chain_validate_hooks(ctx->chain, hooks);
+}
 static struct nft_expr_type nft_meta_bridge_type;
 static const struct nft_expr_ops nft_meta_bridge_get_ops = {
 	.type		= &nft_meta_bridge_type,
 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_meta)),
 	.eval		= nft_meta_bridge_get_eval,
 	.init		= nft_meta_bridge_get_init,
+	.validate	= nft_meta_bridge_get_validate,
 	.dump		= nft_meta_get_dump,
 };
 	switch (priv->key) {
 	case NFT_META_BRI_BROUTE:
-	case NFT_META_BRI_IIFHWADDR:
 		hooks = 1 << NF_BR_PRE_ROUTING;
 		break;
 	default:

net/core/Makefile+1−1

@@ -13,7 +13,7 @@ obj-y += dev.o dev_api.o dev_addr_lists.o dst.o netevent.o \ · 12 unmodified lines
13	neighbour.o rtnetlink.o utils.o link_watch.o filter.o \	13	neighbour.o rtnetlink.o utils.o link_watch.o filter.o \
14	sock_diag.o dev_ioctl.o tso.o sock_reuseport.o \	14	sock_diag.o dev_ioctl.o tso.o sock_reuseport.o \
15	fib_notifier.o xdp.o flow_offload.o gro.o \	15	fib_notifier.o xdp.o flow_offload.o gro.o \
16	netdev-genl.o netdev-genl-gen.o gso.o	16	netdev-genl.o netdev-genl-gen.o netdev_work.o gso.o
17		17
18	obj-$(CONFIG_NETDEV_ADDR_LIST_TEST) += dev_addr_lists_test.o	18	obj-$(CONFIG_NETDEV_ADDR_LIST_TEST) += dev_addr_lists_test.o
19		19

net/core/dev.c+2−0

 	__dev_notify_flags(dev, old_flags, changes, 0, NULL);
 	return ret;
 }
+EXPORT_SYMBOL(netif_change_flags);
 int __netif_set_mtu(struct net_device *dev, int new_mtu)
 {
 	INIT_LIST_HEAD(&dev->ptype_all);
 	INIT_LIST_HEAD(&dev->ptype_specific);
 	INIT_LIST_HEAD(&dev->net_notifier_list);
+	INIT_LIST_HEAD(&dev->work_node);
 #ifdef CONFIG_NET_SCHED
 	hash_init(dev->qdisc_hash);
 #endif

net/core/dev.h+10−1

 void __dev_set_rx_mode(struct net_device *dev);
 int __dev_set_promiscuity(struct net_device *dev, int inc, bool notify);
 void netif_rx_mode_init(struct net_device *dev);
-bool netif_rx_mode_clean(struct net_device *dev);
+void netif_rx_mode_run(struct net_device *dev);
 void netif_rx_mode_sync(struct net_device *dev);
 void netif_rx_mode_cancel_retry(struct net_device *dev);
+/* Events for the async netdev work, tracked in netdev->work_core_pending. */
+enum netdev_work_core {
+	NETDEV_WORK_RX_MODE	= BIT(0),	/* run the rx_mode update */
+};
+void __netdev_work_core_sched(struct net_device *dev, unsigned long event);
+unsigned long
+__netdev_work_core_cancel(struct net_device *dev, unsigned long mask);
 void __dev_notify_flags(struct net_device *dev, unsigned int old_flags,
 			unsigned int gchanges, u32 portid,
 			const struct nlmsghdr *nlh);

net/core/dev_addr_lists.c+3−74

@@ -12,17 +12,10 @@ · 11 unmodified lines
12	#include <linux/export.h>	12	#include <linux/export.h>
13	#include <linux/list.h>	13	#include <linux/list.h>
14	#include <linux/spinlock.h>	14	#include <linux/spinlock.h>
15	#include <linux/workqueue.h>
16	#include <kunit/visibility.h>	15	#include <kunit/visibility.h>
17		16
18	#include "dev.h"	17	#include "dev.h"
19		18
20	static void netdev_rx_mode_work(struct work_struct *work);
21
22	static LIST_HEAD(rx_mode_list);
23	static DEFINE_SPINLOCK(rx_mode_lock);
24	static DECLARE_WORK(rx_mode_work, netdev_rx_mode_work);
25
26	/*	19	/*
27	* General list handling functions	20	* General list handling functions
28	*/	21	*/
@@ -1281,7 +1274,7 @@ void netif_rx_mode_cancel_retry(struct net_device *dev) · 1252 unmodified lines
1281	dev->rx_mode_retry_count = 0;	1274	dev->rx_mode_retry_count = 0;
1282	}	1275	}
1283		1276
1284	static void netif_rx_mode_run(struct net_device *dev)	1277	void netif_rx_mode_run(struct net_device *dev)
1285	{	1278	{
1286	struct netdev_hw_addr_list uc_snap, mc_snap, uc_ref, mc_ref;	1279	struct netdev_hw_addr_list uc_snap, mc_snap, uc_ref, mc_ref;
1287	const struct net_device_ops *ops = dev->netdev_ops;	1280	const struct net_device_ops *ops = dev->netdev_ops;
@@ -1339,49 +1332,9 @@ static void netif_rx_mode_run(struct net_device *dev) · 51 unmodified lines
1339	}	1332	}
1340	}	1333	}
1341		1334
1342	static void netdev_rx_mode_work(struct work_struct *work)
1343	{
1344	struct net_device *dev;
1345
1346	rtnl_lock();
1347
1348	while (true) {
1349	spin_lock_bh(&rx_mode_lock);
1350	if (list_empty(&rx_mode_list)) {
1351	spin_unlock_bh(&rx_mode_lock);
1352	break;
1353	}
1354	dev = list_first_entry(&rx_mode_list, struct net_device,
1355	rx_mode_node);
1356	list_del_init(&dev->rx_mode_node);
1357	/* We must free netdev tracker under
1358	* the spinlock protection.
1359	*/
1360	netdev_tracker_free(dev, &dev->rx_mode_tracker);
1361	spin_unlock_bh(&rx_mode_lock);
1362
1363	netdev_lock_ops(dev);
1364	netif_rx_mode_run(dev);
1365	netdev_unlock_ops(dev);
1366	/* Use __dev_put() because netdev_tracker_free() was already
1367	* called above. Must be after netdev_unlock_ops() to prevent
1368	* netdev_run_todo() from freeing the device while still in use.
1369	*/
1370	__dev_put(dev);
1371	}
1372
1373	rtnl_unlock();
1374	}
1375
1376	static void netif_rx_mode_queue(struct net_device *dev)	1335	static void netif_rx_mode_queue(struct net_device *dev)
1377	{	1336	{
1378	spin_lock_bh(&rx_mode_lock);	1337	__netdev_work_core_sched(dev, NETDEV_WORK_RX_MODE);
1379	if (list_empty(&dev->rx_mode_node)) {
1380	list_add_tail(&dev->rx_mode_node, &rx_mode_list);
1381	netdev_hold(dev, &dev->rx_mode_tracker, GFP_ATOMIC);
1382	}
1383	spin_unlock_bh(&rx_mode_lock);
1384	schedule_work(&rx_mode_work);
1385	}	1338	}
1386		1339
1387	static void netif_rx_mode_retry(struct timer_list *t)	1340	static void netif_rx_mode_retry(struct timer_list *t)
@@ -1394,7 +1347,6 @@ static void netif_rx_mode_retry(struct timer_list *t) · 6 unmodified lines
1394		1347
1395	void netif_rx_mode_init(struct net_device *dev)	1348	void netif_rx_mode_init(struct net_device *dev)
1396	{	1349	{
1397	INIT_LIST_HEAD(&dev->rx_mode_node);
1398	__hw_addr_init(&dev->rx_mode_addr_cache);	1350	__hw_addr_init(&dev->rx_mode_addr_cache);
1399	timer_setup(&dev->rx_mode_retry_timer, netif_rx_mode_retry, 0);	1351	timer_setup(&dev->rx_mode_retry_timer, netif_rx_mode_retry, 0);
1400	}	1352	}
@@ -1442,24 +1394,6 @@ void dev_set_rx_mode(struct net_device *dev) · 41 unmodified lines
1442	netif_addr_unlock_bh(dev);	1394	netif_addr_unlock_bh(dev);
1443	}	1395	}
1444		1396
1445	bool netif_rx_mode_clean(struct net_device *dev)
1446	{
1447	bool clean = false;
1448
1449	spin_lock_bh(&rx_mode_lock);
1450	if (!list_empty(&dev->rx_mode_node)) {
1451	list_del_init(&dev->rx_mode_node);
1452	clean = true;
1453	/* We must release netdev tracker under
1454	* the spinlock protection.
1455	*/
1456	netdev_tracker_free(dev, &dev->rx_mode_tracker);
1457	}
1458	spin_unlock_bh(&rx_mode_lock);
1459
1460	return clean;
1461	}
1462
1463	/**	1397	/**
1464	* netif_rx_mode_sync() - sync rx mode inline	1398	* netif_rx_mode_sync() - sync rx mode inline
1465	* @dev: network device	1399	* @dev: network device
@@ -1473,11 +1407,6 @@ bool netif_rx_mode_clean(struct net_device *dev) · 7 unmodified lines
1473	*/	1407	*/
1474	void netif_rx_mode_sync(struct net_device *dev)	1408	void netif_rx_mode_sync(struct net_device *dev)
1475	{	1409	{
1476	if (netif_rx_mode_clean(dev)) {	1410	if (__netdev_work_core_cancel(dev, NETDEV_WORK_RX_MODE))
1477	netif_rx_mode_run(dev);	1411	netif_rx_mode_run(dev);
1478	/* Use __dev_put() because netdev_tracker_free() was already
1479	* called inside netif_rx_mode_clean().
1480	*/
1481	__dev_put(dev);
1482	}
1483	}	1412	}

net/core/filter.c+1−1

@@ -4472,7 +4472,7 @@ u32 xdp_master_redirect(struct xdp_buff *xdp) · 4471 unmodified lines
4472	struct net_device master, slave;	4472	struct net_device master, slave;
4473		4473
4474	master = netdev_master_upper_dev_get_rcu(xdp->rxq->dev);	4474	master = netdev_master_upper_dev_get_rcu(xdp->rxq->dev);
4475	if (unlikely(!(master->flags & IFF_UP)))	4475	if (unlikely(!master \|\| !(master->flags & IFF_UP)))
4476	return XDP_ABORTED;	4476	return XDP_ABORTED;
4477	slave = master->netdev_ops->ndo_xdp_get_xmit_slave(master, xdp);	4477	slave = master->netdev_ops->ndo_xdp_get_xmit_slave(master, xdp);
4478	if (slave && slave != xdp->rxq->dev) {	4478	if (slave && slave != xdp->rxq->dev) {

net/core/flow_dissector.c+10−2

 	if (dissector_uses_key(flow_dissector,
 			       FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
-		struct ethhdr *eth = eth_hdr(skb);
 		struct flow_dissector_key_eth_addrs *key_eth_addrs;
 		key_eth_addrs = skb_flow_dissector_target(flow_dissector,
 							  FLOW_DISSECTOR_KEY_ETH_ADDRS,
 							  target_container);
-		memcpy(key_eth_addrs, eth, sizeof(*key_eth_addrs));
+		/* TC filter blocks can be shared across devices with
+		 * different link types, so we cannot validate this
+		 * when the filter is installed -- check at dissect time.
+		 */
+		if (skb && skb->dev &&
+		    skb->dev->type == ARPHRD_ETHER &&
+		    skb_mac_header_was_set(skb))
+			memcpy(key_eth_addrs, eth_hdr(skb), sizeof(*key_eth_addrs));
+		else
+			memset(key_eth_addrs, 0, sizeof(*key_eth_addrs));
 	}
 	if (dissector_uses_key(flow_dissector,

net/core/lwtunnel.c+6−0

 	rcu_read_lock();
 	ops = rcu_dereference(lwtun_encaps[lwtstate->type]);
 	if (likely(ops && ops->output)) {
+		/* Encap pushes outer headers over the metadata; drop it. */
+		skb_metadata_clear(skb);
 		dev_xmit_recursion_inc();
 		ret = ops->output(net, sk, skb);
 		dev_xmit_recursion_dec();
 	rcu_read_lock();
 	ops = rcu_dereference(lwtun_encaps[lwtstate->type]);
 	if (likely(ops && ops->xmit)) {
+		/* Encap pushes outer headers over the metadata; drop it. */
+		skb_metadata_clear(skb);
 		dev_xmit_recursion_inc();
 		ret = ops->xmit(skb);
 		dev_xmit_recursion_dec();
 	rcu_read_lock();
 	ops = rcu_dereference(lwtun_encaps[lwtstate->type]);
 	if (likely(ops && ops->input)) {
+		/* Encap pushes outer headers over the metadata; drop it. */
+		skb_metadata_clear(skb);
 		dev_xmit_recursion_inc();
 		ret = ops->input(skb);
 		dev_xmit_recursion_dec();

net/core/netdev-genl.c+3−1

 #include <linux/netdevice.h>
 #include <linux/notifier.h>
+#include <linux/pid_namespace.h>
 #include <linux/rtnetlink.h>
 #include <net/busy_poll.h>
 #include <net/net_namespace.h>
 		goto nla_put_failure;
 	if (napi->thread) {
-		pid = task_pid_nr(napi->thread);
+		pid = task_pid_nr_ns(napi->thread,
+				     task_active_pid_ns(current));
 		if (nla_put_u32(rsp, NETDEV_A_NAPI_PID, pid))
 			goto nla_put_failure;
 	}

net/core/netdev_work.c+162−0

@@ -0,0 +1,162 @@
	1	// SPDX-License-Identifier: GPL-2.0-or-later
	2
	3	#include <linux/export.h>
	4	#include <linux/list.h>
	5	#include <linux/netdevice.h>
	6	#include <linux/rtnetlink.h>
	7	#include <linux/spinlock.h>
	8	#include <linux/workqueue.h>
	9	#include <net/netdev_lock.h>
	10
	11	#include "dev.h"
	12
	13	static void netdev_work_proc(struct work_struct *work);
	14
	15	/* @netdev_work_lock protects:
	16	* - @netdev_work_list
	17	* - within the list entries (struct net_device fields):
	18	* - work_node
	19	* - work_tracker
	20	* - work_pending
	21	* - work_core_pending
	22	*/
	23	static LIST_HEAD(netdev_work_list);
	24	static DEFINE_SPINLOCK(netdev_work_lock);
	25	static DECLARE_WORK(netdev_work, netdev_work_proc);
	26
	27	static void netdev_work_enqueue(struct net_device *dev, unsigned long events,
	28	unsigned long core)
	29	{
	30	if (!events && !core)
	31	return;
	32
	33	spin_lock_bh(&netdev_work_lock);
	34	if (list_empty(&dev->work_node)) {
	35	list_add_tail(&dev->work_node, &netdev_work_list);
	36	netdev_hold(dev, &dev->work_tracker, GFP_ATOMIC);
	37	}
	38	dev->work_pending \|= events;
	39	dev->work_core_pending \|= core;
	40	spin_unlock_bh(&netdev_work_lock);
	41
	42	schedule_work(&netdev_work);
	43	}
	44
	45	static unsigned long
	46	netdev_work_dequeue(struct net_device dev, unsigned long pending,
	47	unsigned long mask)
	48	{
	49	unsigned long events;
	50
	51	spin_lock_bh(&netdev_work_lock);
	52	events = *pending & mask;
	53	*pending &= ~events;
	54	if (!list_empty(&dev->work_node) &&
	55	!dev->work_pending && !dev->work_core_pending) {
	56	list_del_init(&dev->work_node);
	57	netdev_put(dev, &dev->work_tracker);
	58	}
	59	spin_unlock_bh(&netdev_work_lock);
	60
	61	return events;
	62	}
	63
	64	void netdev_work_sched(struct net_device *dev, unsigned long events)
	65	{
	66	netdev_work_enqueue(dev, events, 0);
	67	}
	68	EXPORT_SYMBOL(netdev_work_sched);
	69
	70	/**
	71	* netdev_work_cancel() - cancel selected work for a netdev
	72	* @dev: net_device
	73	* @mask: events to cancel
	74	*
	75	* Clear @mask from the device's work pending mask. If no work is left pending
	76	* the device is dequeued and its ndo_work won't be called.
	77	*
	78	* No expectations on locking, but also no guarantees provided. If the caller
	79	* wants to touch @dev afterwards (e.g. call the work that got canceled)
	80	* they have to ensure @dev does not get freed.
	81	*
	82	* Returns: the subset of @mask that was actually pending, so the caller can run
	83	* those events inline.
	84	*/
	85	unsigned long netdev_work_cancel(struct net_device *dev, unsigned long mask)
	86	{
	87	return netdev_work_dequeue(dev, &dev->work_pending, mask);
	88	}
	89	EXPORT_SYMBOL(netdev_work_cancel);
	90
	91	void __netdev_work_core_sched(struct net_device *dev, unsigned long events)
	92	{
	93	netdev_work_enqueue(dev, 0, events);
	94	}
	95
	96	unsigned long
	97	__netdev_work_core_cancel(struct net_device *dev, unsigned long mask)
	98	{
	99	return netdev_work_dequeue(dev, &dev->work_core_pending, mask);
	100	}
	101
	102	static void netdev_work_run(struct net_device *dev, unsigned long events,
	103	unsigned long core)
	104	{
	105	if (!netif_device_present(dev))
	106	return;
	107
	108	if (core & NETDEV_WORK_RX_MODE)
	109	netif_rx_mode_run(dev);
	110	if (events && dev->netdev_ops->ndo_work)
	111	dev->netdev_ops->ndo_work(dev, events);
	112	}
	113
	114	static void netdev_work_proc(struct work_struct *work)
	115	{
	116	rtnl_lock();
	117
	118	while (true) {
	119	unsigned long events = 0, core = 0;
	120	netdevice_tracker tracker;
	121	struct net_device *dev;
	122
	123	spin_lock_bh(&netdev_work_lock);
	124	if (list_empty(&netdev_work_list)) {
	125	spin_unlock_bh(&netdev_work_lock);
	126	break;
	127	}
	128	dev = list_first_entry(&netdev_work_list, struct net_device,
	129	work_node);
	130	/* Take a temporary reference so @dev can't be freed while we
	131	* drop the lock to grab its ops lock; the work reference is
	132	* only released once we claim the work below.
	133	* The re-locking dance is to ensure that ops lock is enough
	134	* to ensure canceling work is not racy with dequeue.
	135	*/
	136	netdev_hold(dev, &tracker, GFP_ATOMIC);
	137	spin_unlock_bh(&netdev_work_lock);
	138
	139	netdev_lock_ops(dev);
	140	spin_lock_bh(&netdev_work_lock);
	141	if (!list_empty(&dev->work_node)) {
	142	list_del_init(&dev->work_node);
	143	core = dev->work_core_pending;
	144	dev->work_core_pending = 0;
	145	events = dev->work_pending;
	146	dev->work_pending = 0;
	147	/* We took another ref above */
	148	netdev_put(dev, &dev->work_tracker);
	149
	150	if (!dev_isalive(dev))
	151	core = events = 0;
	152	}
	153	spin_unlock_bh(&netdev_work_lock);
	154
	155	netdev_work_run(dev, events, core);
	156	netdev_unlock_ops(dev);
	157
	158	netdev_put(dev, &tracker);
	159	}
	160
	161	rtnl_unlock();
	162	}

net/core/rtnetlink.c+8−0

@@ -2438,6 +2438,14 @@ struct net rtnl_get_net_ns_capable(struct sock sk, int netnsid) · 2437 unmodified lines
2438	}	2438	}
2439	EXPORT_SYMBOL_GPL(rtnl_get_net_ns_capable);	2439	EXPORT_SYMBOL_GPL(rtnl_get_net_ns_capable);
2440		2440
		2441	bool rtnl_dev_link_net_capable(const struct net_device *dev,
		2442	const struct net *link_net)
		2443	{
		2444	return net_eq(link_net, dev_net(dev)) \|\|
		2445	ns_capable(link_net->user_ns, CAP_NET_ADMIN);
		2446	}
		2447	EXPORT_SYMBOL_GPL(rtnl_dev_link_net_capable);
		2448
2441	static int rtnl_valid_dump_ifinfo_req(const struct nlmsghdr *nlh,	2449	static int rtnl_valid_dump_ifinfo_req(const struct nlmsghdr *nlh,
2442	bool strict_check, struct nlattr **tb,	2450	bool strict_check, struct nlattr **tb,
2443	struct netlink_ext_ack *extack)	2451	struct netlink_ext_ack *extack)

net/devlink/rate.c+14−11

 		devlink_rate->tx_weight = weight;
 	}
-	nla_parent = attrs[DEVLINK_ATTR_RATE_PARENT_NODE_NAME];
+	if (attrs[DEVLINK_ATTR_RATE_TC_BWS]) {
-	if (nla_parent) {
+		err = devlink_nl_rate_tc_bw_set(devlink_rate, info);
-		err = devlink_nl_rate_parent_node_set(devlink_rate, info,
-						      nla_parent);
 		if (err)
 			return err;
 	}
-	if (attrs[DEVLINK_ATTR_RATE_TC_BWS]) {
+	/* Keep parent setting last because it takes a reference. This function
-		err = devlink_nl_rate_tc_bw_set(devlink_rate, info);
+	 * has no rollback, so failing after taking the ref would leak it.
+	 */
+	nla_parent = attrs[DEVLINK_ATTR_RATE_PARENT_NODE_NAME];
+	if (nla_parent) {
+		err = devlink_nl_rate_parent_node_set(devlink_rate, info,
+						      nla_parent);
 		if (err)
 			return err;
 	}
 	if (!rate_node)
 		return ERR_PTR(-ENOMEM);
-	if (parent) {
-		rate_node->parent = parent;
-		refcount_inc(&rate_node->parent->refcnt);
-	}
 	rate_node->type = DEVLINK_RATE_TYPE_NODE;
 	rate_node->devlink = devlink;
 	rate_node->priv = priv;
 		return ERR_PTR(-ENOMEM);
 	}
+	if (parent) {
+		rate_node->parent = parent;
+		refcount_inc(&rate_node->parent->refcnt);
+	}
 	refcount_set(&rate_node->refcnt, 1);
 	list_add(&rate_node->list, &devlink->rate_list);
 	devlink_rate_notify(rate_node, DEVLINK_CMD_RATE_NEW);

net/ethtool/common.h+4−0

 		return ops->op_needs_rtnl & ETHTOOL_OP_NEEDS_RTNL_SPAUSEPARAM;
 	case ETHTOOL_MSG_RSS_SET:
 		return ops->op_needs_rtnl & ETHTOOL_OP_NEEDS_RTNL_RSS;
+	case ETHTOOL_MSG_LINKSTATE_GET:
+		return ops->op_needs_rtnl & ETHTOOL_OP_NEEDS_RTNL_GLINK;
 	case ETHTOOL_MSG_TSCONFIG_GET:
 	case ETHTOOL_MSG_TSCONFIG_SET:
 		/* tsconfig calls ndos (ndo_hwtstamp_set/get), not ethtool ops.
 	case ETHTOOL_SRXFH:
 	case ETHTOOL_SRXFHINDIR:
 		return ops->op_needs_rtnl & ETHTOOL_OP_NEEDS_RTNL_RSS;
+	case ETHTOOL_GLINK:
+		return ops->op_needs_rtnl & ETHTOOL_OP_NEEDS_RTNL_GLINK;
 	}
 	return false;
 }

net/ieee802154/core.c+29−22

 			continue;
 		wpan_dev->netdev->netns_immutable = false;
 		err = dev_change_net_namespace(wpan_dev->netdev, net, "wpan%d");
-		if (err)
+		if (err) {
+			WARN_ON(err && err != -ENOMEM);
 			break;
+		}
 		wpan_dev->netdev->netns_immutable = true;
 	}
-	if (err) {
+	if (err)
-		/* failed -- clean up to old netns */
+		goto errout;
-		net = wpan_phy_net(&rdev->wpan_phy);
-		list_for_each_entry_continue_reverse(wpan_dev,
-						     &rdev->wpan_dev_list,
-						     list) {
-			if (!wpan_dev->netdev)
-				continue;
-			wpan_dev->netdev->netns_immutable = false;
-			err = dev_change_net_namespace(wpan_dev->netdev, net,
-						       "wpan%d");
-			WARN_ON(err);
-			wpan_dev->netdev->netns_immutable = true;
-		}
-		return err;
+	err = device_rename(&rdev->wpan_phy.dev, dev_name(&rdev->wpan_phy.dev));
-	}
+	WARN_ON(err && err != -ENOMEM);
-	wpan_phy_net_set(&rdev->wpan_phy, net);
+	if (err)
+		goto errout;
-	err = device_rename(&rdev->wpan_phy.dev, dev_name(&rdev->wpan_phy.dev));
+	wpan_phy_net_set(&rdev->wpan_phy, net);
-	WARN_ON(err);
 	return 0;
+errout:
+	/* failed -- clean up to old netns */
+	net = wpan_phy_net(&rdev->wpan_phy);
+	list_for_each_entry_continue_reverse(wpan_dev,
+					     &rdev->wpan_dev_list,
+					     list) {
+		if (!wpan_dev->netdev)
+			continue;
+		wpan_dev->netdev->netns_immutable = false;
+		err = dev_change_net_namespace(wpan_dev->netdev, net,
+					       "wpan%d");
+		WARN_ON(err && err != -ENOMEM);
+		wpan_dev->netdev->netns_immutable = true;
+	}
+	return err;
 }
 void cfg802154_dev_free(struct cfg802154_registered_device *rdev)
 	rtnl_lock();
 	list_for_each_entry(rdev, &cfg802154_rdev_list, list) {
 		if (net_eq(wpan_phy_net(&rdev->wpan_phy), net))
-			WARN_ON(cfg802154_switch_netns(rdev, &init_net));
+			cfg802154_switch_netns(rdev, &init_net);
 	}
 	rtnl_unlock();
 }

net/ieee802154/header_ops.c+6−3

@@ -173,10 +173,13 @@ ieee802154_hdr_get_addr(const u8 *buf, int mode, bool omit_pan, · 172 unmodified lines
173	{	173	{
174	int pos = 0;	174	int pos = 0;
175		175
176	addr->mode = mode;	176	if (mode == IEEE802154_ADDR_NONE) {
177		177	memset(addr, 0, sizeof(*addr));
178	if (mode == IEEE802154_ADDR_NONE)	178	addr->mode = IEEE802154_ADDR_NONE;
179	return 0;	179	return 0;
		180	}
		181
		182	addr->mode = mode;
180		183
181	if (!omit_pan) {	184	if (!omit_pan) {
182	memcpy(&addr->pan_id, buf + pos, 2);	185	memcpy(&addr->pan_id, buf + pos, 2);

net/ieee802154/ieee802154.h+17−0

@@ -16,6 +16,15 @@ void ieee802154_nl_exit(void); · 15 unmodified lines
16	.flags = GENL_ADMIN_PERM, \	16	.flags = GENL_ADMIN_PERM, \
17	}	17	}
18		18
		19	#define IEEE802154_OP_RELAXED(_cmd, _func) \
		20	{ \
		21	.cmd = _cmd, \
		22	.doit = _func, \
		23	.dumpit = NULL, \
		24	.flags = GENL_ADMIN_PERM, \
		25	.validate = GENL_DONT_VALIDATE_STRICT,\
		26	}
		27
19	#define IEEE802154_DUMP(_cmd, _func, _dump) \	28	#define IEEE802154_DUMP(_cmd, _func, _dump) \
20	{ \	29	{ \
21	.cmd = _cmd, \	30	.cmd = _cmd, \
@@ -23,6 +32,14 @@ void ieee802154_nl_exit(void); · 1 unmodified line
23	.dumpit = _dump, \	32	.dumpit = _dump, \
24	}	33	}
25		34
		35	#define IEEE802154_DUMP_PRIV(_cmd, _func, _dump) \
		36	{ \
		37	.cmd = _cmd, \
		38	.doit = _func, \
		39	.dumpit = _dump, \
		40	.flags = GENL_ADMIN_PERM, \
		41	}
		42
26	struct genl_info;	43	struct genl_info;
27		44
28	struct sk_buff *ieee802154_nl_create(int flags, u8 req);	45	struct sk_buff *ieee802154_nl_create(int flags, u8 req);

net/ieee802154/netlink.c+18−18

net/ipv4/ip_gre.c+6−0

 	__u32 fwmark = t->fwmark;
 	int err;
+	if (!rtnl_dev_link_net_capable(dev, t->net))
+		return -EPERM;
 	err = ipgre_newlink_encap_setup(dev, data);
 	if (err)
 		return err;
 	__u32 fwmark = t->fwmark;
 	int err;
+	if (!rtnl_dev_link_net_capable(dev, t->net))
+		return -EPERM;
 	err = ipgre_newlink_encap_setup(dev, data);
 	if (err)
 		return err;

net/ipv4/ip_output.c+2−5

 				  !(rt->dst.dev->features & NETIF_F_SG)))
 				alloclen = fraglen;
 			else {
-				alloclen = fragheaderlen + transhdrlen;
+				alloclen = fragheaderlen + transhdrlen + fraggap;
-				pagedlen = datalen - transhdrlen;
+				pagedlen = datalen - transhdrlen - fraggap;
 			}
 			alloclen += alloc_extra;
 			}
 			copy = datalen - transhdrlen - fraggap - pagedlen;
-			/* [!] NOTE: copy will be negative if pagedlen>0
-			 * because then the equation reduces to -fraggap.
-			 */
 			if (copy > 0 &&
 			    INDIRECT_CALL_1(getfrag, ip_generic_getfrag,
 					    from, data + transhdrlen, offset,

net/ipv4/ip_vti.c+3−0

@@ -596,6 +596,9 @@ static int vti_changelink(struct net_device dev, struct nlattr tb[], · 595 unmodified lines
596	struct ip_tunnel_parm_kern p;	596	struct ip_tunnel_parm_kern p;
597	__u32 fwmark = t->fwmark;	597	__u32 fwmark = t->fwmark;
598		598
		599	if (!rtnl_dev_link_net_capable(dev, t->net))
		600	return -EPERM;
		601
599	vti_netlink_parms(data, &p, &fwmark);	602	vti_netlink_parms(data, &p, &fwmark);
600	return ip_tunnel_changelink(dev, tb, &p, fwmark);	603	return ip_tunnel_changelink(dev, tb, &p, fwmark);
601	}	604	}

net/ipv4/ipip.c+3−0

@@ -494,6 +494,9 @@ static int ipip_changelink(struct net_device dev, struct nlattr tb[], · 493 unmodified lines
494	bool collect_md;	494	bool collect_md;
495	__u32 fwmark = t->fwmark;	495	__u32 fwmark = t->fwmark;
496		496
		497	if (!rtnl_dev_link_net_capable(dev, t->net))
		498	return -EPERM;
		499
497	if (ip_tunnel_netlink_encap_parms(data, &ipencap)) {	500	if (ip_tunnel_netlink_encap_parms(data, &ipencap)) {
498	int err = ip_tunnel_encap_setup(t, &ipencap);	501	int err = ip_tunnel_encap_setup(t, &ipencap);
499		502

net/ipv4/netfilter/nf_reject_ipv4.c+1−1

@@ -89,7 +89,7 @@ static bool nf_skb_is_icmp_unreach(const struct sk_buff *skb) · 88 unmodified lines
89	if (iph->protocol != IPPROTO_ICMP)	89	if (iph->protocol != IPPROTO_ICMP)
90	return false;	90	return false;
91		91
92	thoff = skb_network_offset(skb) + sizeof(*iph);	92	thoff = skb_network_offset(skb) + ip_hdrlen(skb);
93		93
94	tp = skb_header_pointer(skb,	94	tp = skb_header_pointer(skb,
95	thoff + offsetof(struct icmphdr, type),	95	thoff + offsetof(struct icmphdr, type),

net/ipv4/sysctl_net_ipv4.c+8−2

 		.data		= &init_net.ipv4.sysctl_tcp_reordering,
 		.maxlen		= sizeof(int),
 		.mode		= 0644,
-		.proc_handler	= proc_dointvec
+		.proc_handler	= proc_dointvec_minmax,
+		.extra1		= SYSCTL_ONE,
+		.extra2		= &init_net.ipv4.sysctl_tcp_max_reordering,
 	},
 	{
 		.procname	= "tcp_retries1",
 		.data		= &init_net.ipv4.sysctl_tcp_max_reordering,
 		.maxlen		= sizeof(int),
 		.mode		= 0644,
-		.proc_handler	= proc_dointvec
+		.proc_handler	= proc_dointvec_minmax,
+		.extra1		= SYSCTL_ONE,
 	},
 	{
 		.procname	= "tcp_dsack",
 				 */
 				table[i].mode &= ~0222;
 			}
+			if (table[i].extra2 >= (void *)&init_net.ipv4 &&
+			    table[i].extra2 < (void *)(&init_net.ipv4 + 1))
+				table[i].extra2 += (void *)net - (void *)&init_net;
 		}
 	}

net/ipv4/tcp_ao.c+4−0

 	 * them and we can just free all resources in RCU fashion.
 	 */
 	if (del_async) {
+		if (ao_info->current_key == key)
+			WRITE_ONCE(ao_info->current_key, NULL);
+		if (ao_info->rnext_key == key)
+			WRITE_ONCE(ao_info->rnext_key, NULL);
 		atomic_sub(tcp_ao_sizeof_key(key), &sk->sk_omem_alloc);
 		call_rcu(&key->rcu, tcp_ao_key_free_rcu);
 		return 0;

net/ipv4/tcp_output.c+2−2

@@ -2688,7 +2688,7 @@ static int tcp_mtu_probe(struct sock *sk) · 2687 unmodified lines
2688	struct sk_buff skb, nskb, *next;	2688	struct sk_buff skb, nskb, *next;
2689	struct net *net = sock_net(sk);	2689	struct net *net = sock_net(sk);
2690	int probe_size;	2690	int probe_size;
2691	int size_needed;	2691	u64 size_needed;
2692	int copy, len;	2692	int copy, len;
2693	int mss_now;	2693	int mss_now;
2694	int interval;	2694	int interval;
@@ -2712,7 +2712,7 @@ static int tcp_mtu_probe(struct sock *sk) · 17 unmodified lines
2712	mss_now = tcp_current_mss(sk);	2712	mss_now = tcp_current_mss(sk);
2713	probe_size = tcp_mtu_to_mss(sk, (icsk->icsk_mtup.search_high +	2713	probe_size = tcp_mtu_to_mss(sk, (icsk->icsk_mtup.search_high +
2714	icsk->icsk_mtup.search_low) >> 1);	2714	icsk->icsk_mtup.search_low) >> 1);
2715	size_needed = probe_size + (tp->reordering + 1) * tp->mss_cache;	2715	size_needed = probe_size + (tp->reordering + 1) * (u64)tp->mss_cache;
2716	interval = icsk->icsk_mtup.search_high - icsk->icsk_mtup.search_low;	2716	interval = icsk->icsk_mtup.search_high - icsk->icsk_mtup.search_low;
2717	/* When misfortune happens, we are reprobing actively,	2717	/* When misfortune happens, we are reprobing actively,
2718	* and then reprobe timer has expired. We stick with current	2718	* and then reprobe timer has expired. We stick with current

net/ipv4/udp_tunnel_nic.c+1−1

@@ -301,7 +301,7 @@ __udp_tunnel_nic_device_sync(struct net_device dev, struct udp_tunnel_nic utn) · 300 unmodified lines
301	static void	301	static void
302	udp_tunnel_nic_device_sync(struct net_device dev, struct udp_tunnel_nic utn)	302	udp_tunnel_nic_device_sync(struct net_device dev, struct udp_tunnel_nic utn)
303	{	303	{
304	if (!utn->need_sync)	304	if (!utn->need_sync \|\| utn->work_pending)
305	return;	305	return;
306		306
307	queue_work(udp_tunnel_nic_workqueue, &utn->work);	307	queue_work(udp_tunnel_nic_workqueue, &utn->work);

net/ipv4/xfrm4_input.c+0−2

@@ -76,8 +76,6 @@ int xfrm4_transport_finish(struct sk_buff *skb, int async) · 75 unmodified lines
76	NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING,	76	NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING,
77	dev_net(dev), NULL, skb, dev, NULL,	77	dev_net(dev), NULL, skb, dev, NULL,
78	xfrm4_rcv_encap_finish);	78	xfrm4_rcv_encap_finish);
79	if (async)
80	dev_put(dev);
81	return 0;	79	return 0;
82	}	80	}
83		81

net/ipv6/addrconf.c+28−14

 	if (newf)
 		rt6_purge_dflt_routers(net);
-	return 1;
+	return 0;
 }
 static void addrconf_linkdown_change(struct net *net, __s32 newf)
 						     NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN,
 						     NETCONFA_IFINDEX_DEFAULT,
 						     net->ipv6.devconf_dflt);
-		rtnl_net_unlock(net);
+	} else if (p == &net->ipv6.devconf_all->ignore_routes_with_linkdown) {
-		return 0;
-	}
-	if (p == &net->ipv6.devconf_all->ignore_routes_with_linkdown) {
 		WRITE_ONCE(net->ipv6.devconf_dflt->ignore_routes_with_linkdown, newf);
 		addrconf_linkdown_change(net, newf);
 		if ((!newf) ^ (!old))
 						     NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN,
 						     NETCONFA_IFINDEX_ALL,
 						     net->ipv6.devconf_all);
+	} else {
+		if (!newf ^ !old) {
+			struct inet6_dev *idev = table->extra1;
+			inet6_netconf_notify_devconf(net,
+						     RTM_NEWNETCONF,
+						     NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN,
+						     idev->dev->ifindex,
+						     &idev->cnf);
+		}
 	}
 	rtnl_net_unlock(net);
-	return 1;
+	return 0;
 }
 #endif
 	lctl.data = &val;
 	ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
+	if (ret)
+		return ret;
 	if (write)
 		ret = addrconf_fixup_forwarding(ctl, valp, val);
 	lctl.data = &val;
 	ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
+	if (ret)
+		return ret;
 	if (write)
 		ret = addrconf_disable_ipv6(ctl, valp, val);
 static int addrconf_sysctl_proxy_ndp(const struct ctl_table *ctl, int write,
 		void *buffer, size_t *lenp, loff_t *ppos)
 {
+	struct net *net = ctl->extra2;
 	int *valp = ctl->data;
-	int ret;
 	int old, new;
+	int ret;
+	if (write && !rtnl_net_trylock(net))
+		return restart_syscall();
 	old = *valp;
 	ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
 	new = *valp;
 	if (write && old != new) {
-		struct net *net = ctl->extra2;
-		if (!rtnl_net_trylock(net))
-			return restart_syscall();
 		if (valp == &net->ipv6.devconf_dflt->proxy_ndp) {
 			inet6_netconf_notify_devconf(net, RTM_NEWNETCONF,
 						     NETCONFA_PROXY_NEIGH,
 						     idev->dev->ifindex,
 						     &idev->cnf);
 		}
-		rtnl_net_unlock(net);
 	}
+	if (write)
+		rtnl_net_unlock(net);
 	return ret;
 }
 	lctl.data = &val;
 	ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
+	if (ret)
+		return ret;
 	if (write)
 		ret = addrconf_fixup_linkdown(ctl, valp, val);
 	lctl = *ctl;
 	lctl.data = &val;
 	ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
+	if (ret)
+		return ret;
 	if (write && (*valp != val))
 		ret = addrconf_disable_policy(ctl, valp, val);

net/ipv6/ioam6_iptunnel.c+4−4

@@ -35,7 +35,7 @@ struct ioam6_lwt_freq { · 34 unmodified lines
35	};	35	};
36		36
37	struct ioam6_lwt {	37	struct ioam6_lwt {
38	struct dst_entry null_dst;	38	struct rt6_info null_rt;
39	struct dst_cache cache;	39	struct dst_cache cache;
40	struct ioam6_lwt_freq freq;	40	struct ioam6_lwt_freq freq;
41	atomic_t pkt_cnt;	41	atomic_t pkt_cnt;
@@ -176,7 +176,7 @@ static int ioam6_build_state(struct net net, struct nlattr nla, · 134 unmodified lines
176	* it is stored in the cache. Then, +1/-1 each time we read the cache	176	* it is stored in the cache. Then, +1/-1 each time we read the cache
177	* and release it. Long story short, we're fine.	177	* and release it. Long story short, we're fine.
178	*/	178	*/
179	dst_init(&ilwt->null_dst, NULL, NULL, DST_OBSOLETE_NONE, DST_NOCOUNT);	179	dst_init(&ilwt->null_rt.dst, NULL, NULL, DST_OBSOLETE_NONE, DST_NOCOUNT);
180		180
181	atomic_set(&ilwt->pkt_cnt, 0);	181	atomic_set(&ilwt->pkt_cnt, 0);
182	ilwt->freq.k = freq_k;	182	ilwt->freq.k = freq_k;
@@ -360,7 +360,7 @@ static int ioam6_output(struct net net, struct sock sk, struct sk_buff *skb) · 177 unmodified lines
360	/* This is how we notify that the destination does not change after	360	/* This is how we notify that the destination does not change after
361	* transformation and that we need to use orig_dst instead of the cache	361	* transformation and that we need to use orig_dst instead of the cache
362	*/	362	*/
363	if (dst == &ilwt->null_dst) {	363	if (dst == &ilwt->null_rt.dst) {
364	dst_release(dst);	364	dst_release(dst);
365		365
366	dst = orig_dst;	366	dst = orig_dst;
@@ -429,7 +429,7 @@ do_encap: · 62 unmodified lines
429	local_bh_disable();	429	local_bh_disable();
430	if (orig_dst->lwtstate == dst->lwtstate)	430	if (orig_dst->lwtstate == dst->lwtstate)
431	dst_cache_set_ip6(&ilwt->cache,	431	dst_cache_set_ip6(&ilwt->cache,
432	&ilwt->null_dst, &fl6.saddr);	432	&ilwt->null_rt.dst, &fl6.saddr);
433	else	433	else
434	dst_cache_set_ip6(&ilwt->cache, dst, &fl6.saddr);	434	dst_cache_set_ip6(&ilwt->cache, dst, &fl6.saddr);
435	local_bh_enable();	435	local_bh_enable();

net/ipv6/ip6_gre.c+6−0

 	struct ip6gre_net *ign = net_generic(t->net, ip6gre_net_id);
 	struct __ip6_tnl_parm p;
+	if (!rtnl_dev_link_net_capable(dev, t->net))
+		return -EPERM;
 	t = ip6gre_changelink_common(dev, tb, data, &p, extack);
 	if (IS_ERR(t))
 		return PTR_ERR(t);
 	struct __ip6_tnl_parm p;
 	struct ip6gre_net *ign;
+	if (!rtnl_dev_link_net_capable(dev, t->net))
+		return -EPERM;
 	ign = net_generic(t->net, ip6gre_net_id);
 	t = ip6gre_changelink_common(dev, tb, data, &p, extack);
 	if (IS_ERR(t))

net/ipv6/ip6_output.c+3−6

 				  !(rt->dst.dev->features & NETIF_F_SG)))
 				alloclen = fraglen;
 			else {
-				alloclen = fragheaderlen + transhdrlen;
+				alloclen = fragheaderlen + transhdrlen + fraggap;
-				pagedlen = datalen - transhdrlen;
+				pagedlen = datalen - transhdrlen - fraggap;
 			}
 			alloclen += alloc_extra;
 			fraglen = datalen + fragheaderlen;
 			copy = datalen - transhdrlen - fraggap - pagedlen;
-			/* [!] NOTE: copy may be negative if pagedlen>0
+			if (copy < 0) {
-			 * because then the equation may reduces to -fraggap.
-			 */
-			if (copy < 0 && !(flags & MSG_SPLICE_PAGES)) {
 				err = -EINVAL;
 				goto error;
 			}

net/ipv6/ip6_tunnel.c+10−0

 	struct dst_entry *dst;
 	int err;
+	if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT)) {
+		/* encaplimit option is currently not supported is
+		 * sw-acceleration path.
+		 */
+		return -EOPNOTSUPP;
+	}
 	dst = ip6_route_output(dev_net(ctx->dev), NULL, &fl6);
 	if (!dst->error) {
 		path->type = DEV_PATH_TUN;
 	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 	struct ip_tunnel_encap ipencap;
+	if (!rtnl_dev_link_net_capable(dev, net))
+		return -EPERM;
 	if (dev == ip6n->fb_tnl_dev) {
 		if (ip_tunnel_netlink_encap_parms(data, &ipencap)) {
 			/* iproute2 always sets TUNNEL_ENCAP_FLAG_CSUM6, so

net/ipv6/ip6_vti.c+3−0

@@ -1046,6 +1046,9 @@ static int vti6_changelink(struct net_device dev, struct nlattr tb[], · 1045 unmodified lines
1046	struct __ip6_tnl_parm p;	1046	struct __ip6_tnl_parm p;
1047	struct vti6_net *ip6n;	1047	struct vti6_net *ip6n;
1048		1048
		1049	if (!rtnl_dev_link_net_capable(dev, net))
		1050	return -EPERM;
		1051
1049	ip6n = net_generic(net, vti6_net_id);	1052	ip6n = net_generic(net, vti6_net_id);
1050	if (dev == ip6n->fb_tnl_dev)	1053	if (dev == ip6n->fb_tnl_dev)
1051	return -EINVAL;	1054	return -EINVAL;

net/ipv6/ndisc.c+3−5

 	return reason;
 }
-static int accept_untracked_na(struct net_device *dev, struct in6_addr *saddr)
+static int accept_untracked_na(struct inet6_dev *idev, struct in6_addr *saddr)
 {
-	struct inet6_dev *idev = __in6_dev_get(dev);
 	switch (READ_ONCE(idev->cnf.accept_untracked_na)) {
 	case 0: /* Don't accept untracked na (absent in neighbor cache) */
 		return 0;
 		 * same subnet as an address configured on the interface that
 		 * received the na
 		 */
-		return !!ipv6_chk_prefix(saddr, dev);
+		return !!ipv6_chk_prefix(saddr, idev->dev);
 	default:
 		return 0;
 	}
 	 */
 	new_state = msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE;
 	if (!neigh && lladdr && idev && READ_ONCE(idev->cnf.forwarding)) {
-		if (accept_untracked_na(dev, saddr)) {
+		if (accept_untracked_na(idev, saddr)) {
 			neigh = neigh_create(&nd_tbl, &msg->target, dev);
 			new_state = NUD_STALE;
 		}

net/ipv6/route.c+3−0

@@ -5055,6 +5055,9 @@ static int fib6_nh_mtu_change(struct fib6_nh nh, void _arg) · 5054 unmodified lines
5055	struct inet6_dev *idev = __in6_dev_get(arg->dev);	5055	struct inet6_dev *idev = __in6_dev_get(arg->dev);
5056	u32 mtu = f6i->fib6_pmtu;	5056	u32 mtu = f6i->fib6_pmtu;
5057		5057
		5058	if (!idev)
		5059	return 0;
		5060
5058	if (mtu >= arg->mtu \|\|	5061	if (mtu >= arg->mtu \|\|
5059	(mtu < arg->mtu && mtu == idev->cnf.mtu6))	5062	(mtu < arg->mtu && mtu == idev->cnf.mtu6))
5060	fib6_metric_set(f6i, RTAX_MTU, arg->mtu);	5063	fib6_metric_set(f6i, RTAX_MTU, arg->mtu);

net/ipv6/sit.c+3−0

@@ -1613,6 +1613,9 @@ static int ipip6_changelink(struct net_device dev, struct nlattr tb[], · 1612 unmodified lines
1613	__u32 fwmark = t->fwmark;	1613	__u32 fwmark = t->fwmark;
1614	int err;	1614	int err;
1615		1615
		1616	if (!rtnl_dev_link_net_capable(dev, net))
		1617	return -EPERM;
		1618
1616	if (dev == sitn->fb_tunnel_dev)	1619	if (dev == sitn->fb_tunnel_dev)
1617	return -EINVAL;	1620	return -EINVAL;
1618		1621

net/ipv6/xfrm6_input.c+0−2

@@ -71,8 +71,6 @@ int xfrm6_transport_finish(struct sk_buff *skb, int async) · 70 unmodified lines
71	NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING,	71	NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING,
72	dev_net(dev), NULL, skb, dev, NULL,	72	dev_net(dev), NULL, skb, dev, NULL,
73	xfrm6_transport_finish2);	73	xfrm6_transport_finish2);
74	if (async)
75	dev_put(dev);
76	return 0;	74	return 0;
77	}	75	}
78		76

net/key/af_key.c+1−0

@@ -1218,6 +1218,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net, · 1217 unmodified lines
1218	goto out;	1218	goto out;
1219	}	1219	}
1220	strcpy(x->calg->alg_name, a->name);	1220	strcpy(x->calg->alg_name, a->name);
		1221	x->calg->alg_key_len = 0;
1221	x->props.calgo = sa->sadb_sa_encrypt;	1222	x->props.calgo = sa->sadb_sa_encrypt;
1222	} else {	1223	} else {
1223	int keysize = 0;	1224	int keysize = 0;

net/llc/sysctl_net_llc.c+1−1

@@ -47,7 +47,7 @@ static struct ctl_table_header *llc_station_header; · 46 unmodified lines
47		47
48	int __init llc_sysctl_init(void)	48	int __init llc_sysctl_init(void)
49	{	49	{
50	struct ctl_table empty[1] = {};	50	static struct ctl_table empty[1] = {};
51	llc2_timeout_header = register_net_sysctl(&init_net, "net/llc/llc2/timeout", llc2_timeout_table);	51	llc2_timeout_header = register_net_sysctl(&init_net, "net/llc/llc2/timeout", llc2_timeout_table);
52	llc_station_header = register_net_sysctl_sz(&init_net, "net/llc/station", empty, 0);	52	llc_station_header = register_net_sysctl_sz(&init_net, "net/llc/station", empty, 0);
53		53

net/mac802154/llsec.c+14−0

 {
 	struct ieee802154_hdr hdr;
 	int rc, authlen, hlen;
+	struct sk_buff *trailer;
 	struct mac802154_llsec_key *key;
 	u32 frame_ctr;
 	skb->mac_len = ieee802154_hdr_push(skb, &hdr);
 	skb_reset_mac_header(skb);
+	rc = skb_cow_data(skb, 0, &trailer);
+	if (rc < 0) {
+		llsec_key_put(key);
+		return rc;
+	}
 	rc = llsec_do_encrypt(skb, sec, &hdr, key);
 	llsec_key_put(key);
 		 const struct ieee802154_hdr *hdr,
 		 struct mac802154_llsec_key *key, __le64 dev_addr)
 {
+	struct sk_buff *trailer;
+	int err;
+	err = skb_cow_data(skb, 0, &trailer);
+	if (err < 0)
+		return err;
 	if (hdr->sec.level == IEEE802154_SCF_SECLEVEL_ENC)
 		return llsec_do_decrypt_unauth(skb, sec, hdr, key, dev_addr);
 	else

net/mac802154/scan.c+1−0

@@ -594,6 +594,7 @@ int mac802154_perform_association(struct ieee802154_sub_if_data *sdata, · 593 unmodified lines
594	"Negative ASSOC RESP received from %8phC: %s\n", &ceaddr,	594	"Negative ASSOC RESP received from %8phC: %s\n", &ceaddr,
595	local->assoc_status == IEEE802154_PAN_AT_CAPACITY ?	595	local->assoc_status == IEEE802154_PAN_AT_CAPACITY ?
596	"PAN at capacity" : "access denied");	596	"PAN at capacity" : "access denied");
		597	goto clear_assoc;
597	}	598	}
598		599
599	ret = 0;	600	ret = 0;

net/netfilter/Kconfig+6−5

 	  To compile it as a module, choose M here.  If unsure, say N.
 config NF_CONNTRACK_IRC
-	tristate "IRC protocol support"
+	tristate "IRC DCC protocol support (obsolete)"
-	default m if NETFILTER_ADVANCED=n
 	help
 	  There is a commonly-used extension to IRC called
 	  Direct Client-to-Client Protocol (DCC).  This enables users to send
 	  using NAT, this extension will enable you to send files and initiate
 	  chats.  Note that you do NOT need this extension to get files or
 	  have others initiate chats, or everything else in IRC.
+	  DCC tracking behind NAT requires plaintext (unencrypted) IRC, so
+	  this helper is of limited use these days.
 	  To compile it as a module, choose M here.  If unsure, say N.
 	  To compile it as a module, choose M here.  If unsure, say N.
 config NF_CONNTRACK_PPTP
-	tristate "PPtP protocol support"
+	tristate "PPtP protocol support (deprecated)"
 	depends on NETFILTER_ADVANCED
 	select NF_CT_PROTO_GRE
 	help
 	  This module adds support for PPTP (Point to Point Tunnelling
 	  Protocol, RFC2637) connection tracking and NAT.
-	  If you are running PPTP sessions over a stateful firewall or NAT
+	  If you are still running PPTP sessions over a stateful firewall or NAT
 	  box, you may want to enable this feature.
-	  Please note that not all PPTP modes of operation are supported yet.
+	  Please note that not all PPTP modes of operation are supported.
 	  Specifically these limitations exist:
 	    - Blindly assumes that control connections are always established
 	      in PNS->PAC direction. This is a violation of RFC2637.

net/netfilter/ipset/ip_set_bitmap_gen.h+3−1

 		ip_set_init_skbinfo(ext_skbinfo(x, set), ext);
 	/* Activate element */
+	smp_mb__before_atomic();
 	set_bit(e->id, map->members);
 	set->elements++;
 		cond_resched_rcu();
 		id = cb->args[IPSET_CB_ARG0];
 		x = get_ext(set, map, id);
-		if (!test_bit(id, map->members) ||
+		if (!test_bit_acquire(id, map->members) ||
 		    (SET_WITH_TIMEOUT(set) &&
 #ifdef IP_SET_BITMAP_STORED_TIMEOUT
 		     mtype_is_filled(x) &&
 			x = get_ext(set, map, id);
 			if (ip_set_timeout_expired(ext_timeout(x, set))) {
 				clear_bit(id, map->members);
+				smp_mb__after_atomic();
 				ip_set_ext_destroy(set, x);
 				set->elements--;
 			}

net/netfilter/ipset/ip_set_bitmap_ip.c+1−1

@@ -67,7 +67,7 @@ static int · 66 unmodified lines
67	bitmap_ip_do_test(const struct bitmap_ip_adt_elem *e,	67	bitmap_ip_do_test(const struct bitmap_ip_adt_elem *e,
68	struct bitmap_ip *map, size_t dsize)	68	struct bitmap_ip *map, size_t dsize)
69	{	69	{
70	return !!test_bit(e->id, map->members);	70	return !!test_bit_acquire(e->id, map->members);
71	}	71	}
72		72
73	static int	73	static int

net/netfilter/ipset/ip_set_bitmap_ipmac.c+1−1

@@ -86,7 +86,7 @@ bitmap_ipmac_do_test(const struct bitmap_ipmac_adt_elem *e, · 85 unmodified lines
86	{	86	{
87	const struct bitmap_ipmac_elem *elem;	87	const struct bitmap_ipmac_elem *elem;
88		88
89	if (!test_bit(e->id, map->members))	89	if (!test_bit_acquire(e->id, map->members))
90	return 0;	90	return 0;
91	elem = get_const_elem(map->extensions, e->id, dsize);	91	elem = get_const_elem(map->extensions, e->id, dsize);
92	if (e->add_mac && elem->filled == MAC_FILLED)	92	if (e->add_mac && elem->filled == MAC_FILLED)

net/netfilter/ipset/ip_set_bitmap_port.c+1−1

@@ -58,7 +58,7 @@ static int · 57 unmodified lines
58	bitmap_port_do_test(const struct bitmap_port_adt_elem *e,	58	bitmap_port_do_test(const struct bitmap_port_adt_elem *e,
59	const struct bitmap_port *map, size_t dsize)	59	const struct bitmap_port *map, size_t dsize)
60	{	60	{
61	return !!test_bit(e->id, map->members);	61	return !!test_bit_acquire(e->id, map->members);
62	}	62	}
63		63
64	static int	64	static int

net/netfilter/ipset/ip_set_core.c+2−2

 	if (unlikely(c)) {
 		set->ext_size -= sizeof(*c) + strlen(c->str) + 1;
-		kfree_rcu(c, rcu);
 		rcu_assign_pointer(comment->c, NULL);
+		kfree_rcu(c, rcu);
 	}
 	if (!len)
 		return;
 	if (unlikely(!c))
 		return;
 	set->ext_size -= sizeof(*c) + strlen(c->str) + 1;
-	kfree_rcu(c, rcu);
 	rcu_assign_pointer(comment->c, NULL);
+	kfree_rcu(c, rcu);
 }
 typedef void (*destroyer)(struct ip_set *, void *);

net/netfilter/ipset/ip_set_hash_gen.h+6−6

@@ -606,7 +606,7 @@ mtype_cancel_gc(struct ip_set *set) · 605 unmodified lines
606	struct htype *h = set->data;	606	struct htype *h = set->data;
607		607
608	if (SET_WITH_TIMEOUT(set))	608	if (SET_WITH_TIMEOUT(set))
609	cancel_delayed_work_sync(&h->gc.dwork);	609	disable_delayed_work_sync(&h->gc.dwork);
610	}	610	}
611		611
612	static int	612	static int
@@ -689,7 +689,7 @@ retry: · 76 unmodified lines
689	continue;	689	continue;
690	pos = smp_load_acquire(&n->pos);	690	pos = smp_load_acquire(&n->pos);
691	for (j = 0; j < pos; j++) {	691	for (j = 0; j < pos; j++) {
692	if (!test_bit(j, n->used))	692	if (!test_bit_acquire(j, n->used))
693	continue;	693	continue;
694	data = ahash_data(n, j, dsize);	694	data = ahash_data(n, j, dsize);
695	if (SET_ELEM_EXPIRED(set, data))	695	if (SET_ELEM_EXPIRED(set, data))
@@ -826,7 +826,7 @@ mtype_ext_size(struct ip_set set, u32 elements, size_t *ext_size) · 130 unmodified lines
826	continue;	826	continue;
827	pos = smp_load_acquire(&n->pos);	827	pos = smp_load_acquire(&n->pos);
828	for (j = 0; j < pos; j++) {	828	for (j = 0; j < pos; j++) {
829	if (!test_bit(j, n->used))	829	if (!test_bit_acquire(j, n->used))
830	continue;	830	continue;
831	data = ahash_data(n, j, set->dsize);	831	data = ahash_data(n, j, set->dsize);
832	if (!SET_ELEM_EXPIRED(set, data))	832	if (!SET_ELEM_EXPIRED(set, data))
@@ -1201,7 +1201,7 @@ mtype_test_cidrs(struct ip_set set, struct mtype_elem d, · 368 unmodified lines
1201	continue;	1201	continue;
1202	pos = smp_load_acquire(&n->pos);	1202	pos = smp_load_acquire(&n->pos);
1203	for (i = 0; i < pos; i++) {	1203	for (i = 0; i < pos; i++) {
1204	if (!test_bit(i, n->used))	1204	if (!test_bit_acquire(i, n->used))
1205	continue;	1205	continue;
1206	data = ahash_data(n, i, set->dsize);	1206	data = ahash_data(n, i, set->dsize);
1207	if (!mtype_data_equal(data, d, &multi))	1207	if (!mtype_data_equal(data, d, &multi))
@@ -1259,7 +1259,7 @@ mtype_test(struct ip_set set, void value, const struct ip_set_ext *ext, · 51 unmodified lines
1259	}	1259	}
1260	pos = smp_load_acquire(&n->pos);	1260	pos = smp_load_acquire(&n->pos);
1261	for (i = 0; i < pos; i++) {	1261	for (i = 0; i < pos; i++) {
1262	if (!test_bit(i, n->used))	1262	if (!test_bit_acquire(i, n->used))
1263	continue;	1263	continue;
1264	data = ahash_data(n, i, set->dsize);	1264	data = ahash_data(n, i, set->dsize);
1265	if (!mtype_data_equal(data, d, &multi))	1265	if (!mtype_data_equal(data, d, &multi))
@@ -1396,7 +1396,7 @@ mtype_list(const struct ip_set *set, · 130 unmodified lines
1396	continue;	1396	continue;
1397	pos = smp_load_acquire(&n->pos);	1397	pos = smp_load_acquire(&n->pos);
1398	for (i = 0; i < pos; i++) {	1398	for (i = 0; i < pos; i++) {
1399	if (!test_bit(i, n->used))	1399	if (!test_bit_acquire(i, n->used))
1400	continue;	1400	continue;
1401	e = ahash_data(n, i, set->dsize);	1401	e = ahash_data(n, i, set->dsize);
1402	if (SET_ELEM_EXPIRED(set, e))	1402	if (SET_ELEM_EXPIRED(set, e))

net/netfilter/nf_conncount.c+5−6

 		return -ENOENT;
 	if (ct && nf_ct_is_confirmed(ct)) {
-		/* local connections are confirmed in postrouting so confirmation
+		/* Connection is confirmed but might still be in the setup phase.
-		 * might have happened before hitting connlimit
+		 * Only skip the tracking if it is fully assured. This guarantees
+		 * that setup packets or retransmissions are properly counted and
+		 * deduplicated.
 		 */
-		if (skb->skb_iif != LOOPBACK_IFINDEX) {
+		if (test_bit(IPS_ASSURED_BIT, &ct->status)) {
 			err = -EEXIST;
 			goto out_put;
 		}
-		/* this is likely a local connection, skip optimization to avoid
-		 * adding duplicates from a 'packet train'
-		 */
 		goto check_connections;
 	}

net/netfilter/nf_conntrack_broadcast.c+1−0

@@ -62,6 +62,7 @@ int nf_conntrack_broadcast_help(struct sk_buff *skb, · 61 unmodified lines
62	if (exp == NULL)	62	if (exp == NULL)
63	goto out;	63	goto out;
64		64
		65	exp->master_tuple = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
65	exp->tuple = ct->tuplehash[IP_CT_DIR_REPLY].tuple;	66	exp->tuple = ct->tuplehash[IP_CT_DIR_REPLY].tuple;
66		67
67	helper = rcu_dereference(help->helper);	68	helper = rcu_dereference(help->helper);

net/netfilter/nf_conntrack_core.c+32−1

@@ -1471,6 +1471,31 @@ static bool gc_worker_can_early_drop(const struct nf_conn *ct) · 1470 unmodified lines
1471	return false;	1471	return false;
1472	}	1472	}
1473		1473
		1474	static void nf_ct_help_gc(struct nf_conn *ct)
		1475	{
		1476	struct nf_conn_help *help;
		1477
		1478	if (!refcount_inc_not_zero(&ct->ct_general.use))
		1479	return;
		1480
		1481	/* load ->status after refcount increase */
		1482	smp_acquire__after_ctrl_dep();
		1483
		1484	if (!nf_ct_is_confirmed(ct) \|\| nf_ct_is_dying(ct)) {
		1485	nf_ct_put(ct);
		1486	return;
		1487	}
		1488
		1489	/* re-check helper due to SLAB_TYPESAFE_BY_RCU */
		1490	if (test_bit(IPS_HELPER_BIT, &ct->status)) {
		1491	help = nfct_help(ct);
		1492	if (help)
		1493	nf_ct_expectation_gc(help);
		1494	}
		1495
		1496	nf_ct_put(ct);
		1497	}
		1498
1474	static void gc_worker(struct work_struct *work)	1499	static void gc_worker(struct work_struct *work)
1475	{	1500	{
1476	unsigned int i, hashsz, nf_conntrack_max95 = 0;	1501	unsigned int i, hashsz, nf_conntrack_max95 = 0;
@@ -1543,7 +1568,13 @@ static void gc_worker(struct work_struct *work) · 66 unmodified lines
1543	expires = (expires - (long)next_run) / ++count;	1568	expires = (expires - (long)next_run) / ++count;
1544	next_run += expires;	1569	next_run += expires;
1545		1570
1546	if (nf_conntrack_max95 == 0 \|\| gc_worker_skip_ct(tmp))	1571	if (gc_worker_skip_ct(tmp))
		1572	continue;
		1573
		1574	if (test_bit(IPS_HELPER_BIT, &tmp->status))
		1575	nf_ct_help_gc(tmp);
		1576
		1577	if (nf_conntrack_max95 == 0)
1547	continue;	1578	continue;
1548		1579
1549	net = nf_ct_net(tmp);	1580	net = nf_ct_net(tmp);

net/netfilter/nf_conntrack_expect.c+81−74

@@ -43,6 +43,24 @@ unsigned int nf_ct_expect_max __read_mostly; · 42 unmodified lines
43	static struct kmem_cache *nf_ct_expect_cachep __read_mostly;	43	static struct kmem_cache *nf_ct_expect_cachep __read_mostly;
44	static siphash_aligned_key_t nf_ct_expect_hashrnd;	44	static siphash_aligned_key_t nf_ct_expect_hashrnd;
45		45
		46	void nf_ct_expectation_gc(struct nf_conn_help *master_help)
		47	{
		48	struct nf_conntrack_expect *exp;
		49	struct hlist_node *next;
		50
		51	if (hlist_empty(&master_help->expectations))
		52	return;
		53
		54	spin_lock_bh(&nf_conntrack_expect_lock);
		55	hlist_for_each_entry_safe(exp, next, &master_help->expectations, lnode) {
		56	if (!nf_ct_exp_is_expired(exp))
		57	continue;
		58
		59	nf_ct_unlink_expect(exp);
		60	}
		61	spin_unlock_bh(&nf_conntrack_expect_lock);
		62	}
		63
46	/* nf_conntrack_expect helper functions */	64	/* nf_conntrack_expect helper functions */
47	void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp,	65	void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp,
48	u32 portid, int report)	66	u32 portid, int report)
@@ -52,7 +70,6 @@ void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp, · 3 unmodified lines
52	struct nf_conntrack_net *cnet;	70	struct nf_conntrack_net *cnet;
53		71
54	lockdep_nfct_expect_lock_held();	72	lockdep_nfct_expect_lock_held();
55	WARN_ON_ONCE(timer_pending(&exp->timeout));
56		73
57	hlist_del_rcu(&exp->hnode);	74	hlist_del_rcu(&exp->hnode);
58		75
@@ -70,16 +87,6 @@ void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp, · 11 unmodified lines
70	}	87	}
71	EXPORT_SYMBOL_GPL(nf_ct_unlink_expect_report);	88	EXPORT_SYMBOL_GPL(nf_ct_unlink_expect_report);
72		89
73	static void nf_ct_expectation_timed_out(struct timer_list *t)
74	{
75	struct nf_conntrack_expect *exp = timer_container_of(exp, t, timeout);
76
77	spin_lock_bh(&nf_conntrack_expect_lock);
78	nf_ct_unlink_expect(exp);
79	spin_unlock_bh(&nf_conntrack_expect_lock);
80	nf_ct_expect_put(exp);
81	}
82
83	static unsigned int nf_ct_expect_dst_hash(const struct net n, const struct nf_conntrack_tuple tuple)	90	static unsigned int nf_ct_expect_dst_hash(const struct net n, const struct nf_conntrack_tuple tuple)
84	{	91	{
85	struct {	92	struct {
@@ -117,19 +124,6 @@ nf_ct_exp_equal(const struct nf_conntrack_tuple *tuple, · 31 unmodified lines
117	nf_ct_exp_zone_equal_any(i, zone);	124	nf_ct_exp_zone_equal_any(i, zone);
118	}	125	}
119		126
120	bool nf_ct_remove_expect(struct nf_conntrack_expect *exp)
121	{
122	lockdep_nfct_expect_lock_held();
123
124	if (timer_delete(&exp->timeout)) {
125	nf_ct_unlink_expect(exp);
126	nf_ct_expect_put(exp);
127	return true;
128	}
129	return false;
130	}
131	EXPORT_SYMBOL_GPL(nf_ct_remove_expect);
132
133	struct nf_conntrack_expect *	127	struct nf_conntrack_expect *
134	__nf_ct_expect_find(struct net *net,	128	__nf_ct_expect_find(struct net *net,
135	const struct nf_conntrack_zone *zone,	129	const struct nf_conntrack_zone *zone,
@@ -144,6 +138,8 @@ __nf_ct_expect_find(struct net *net, · 8 unmodified lines
144		138
145	h = nf_ct_expect_dst_hash(net, tuple);	139	h = nf_ct_expect_dst_hash(net, tuple);
146	hlist_for_each_entry_rcu(i, &nf_ct_expect_hash[h], hnode) {	140	hlist_for_each_entry_rcu(i, &nf_ct_expect_hash[h], hnode) {
		141	if (nf_ct_exp_is_expired(i))
		142	continue;
147	if (nf_ct_exp_equal(tuple, i, zone, net))	143	if (nf_ct_exp_equal(tuple, i, zone, net))
148	return i;	144	return i;
149	}	145	}
@@ -178,6 +174,7 @@ nf_ct_find_expectation(struct net *net, · 28 unmodified lines
178	{	174	{
179	struct nf_conntrack_net *cnet = nf_ct_pernet(net);	175	struct nf_conntrack_net *cnet = nf_ct_pernet(net);
180	struct nf_conntrack_expect i, exp = NULL;	176	struct nf_conntrack_expect i, exp = NULL;
		177	struct hlist_node *next;
181	unsigned int h;	178	unsigned int h;
182		179
183	lockdep_nfct_expect_lock_held();	180	lockdep_nfct_expect_lock_held();
@@ -186,7 +183,11 @@ nf_ct_find_expectation(struct net *net, · 2 unmodified lines
186	return NULL;	183	return NULL;
187		184
188	h = nf_ct_expect_dst_hash(net, tuple);	185	h = nf_ct_expect_dst_hash(net, tuple);
189	hlist_for_each_entry(i, &nf_ct_expect_hash[h], hnode) {	186	hlist_for_each_entry_safe(i, next, &nf_ct_expect_hash[h], hnode) {
		187	if (nf_ct_exp_is_expired(i)) {
		188	nf_ct_unlink_expect(i);
		189	continue;
		190	}
190	if (!(i->flags & NF_CT_EXPECT_INACTIVE) &&	191	if (!(i->flags & NF_CT_EXPECT_INACTIVE) &&
191	nf_ct_exp_equal(tuple, i, zone, net)) {	192	nf_ct_exp_equal(tuple, i, zone, net)) {
192	exp = i;	193	exp = i;
@@ -196,13 +197,16 @@ nf_ct_find_expectation(struct net *net, · 3 unmodified lines
196	if (!exp)	197	if (!exp)
197	return NULL;	198	return NULL;
198		199
		200	if (!refcount_inc_not_zero(&exp->use))
		201	return NULL;
		202
199	/* If master is not in hash table yet (ie. packet hasn't left	203	/* If master is not in hash table yet (ie. packet hasn't left
200	this machine yet), how can other end know about expected?	204	this machine yet), how can other end know about expected?
201	Hence these are not the droids you are looking for (if	205	Hence these are not the droids you are looking for (if
202	master ct never got confirmed, we'd hold a reference to it	206	master ct never got confirmed, we'd hold a reference to it
203	and weird things would happen to future packets). */	207	and weird things would happen to future packets). */
204	if (!nf_ct_is_confirmed(exp->master))	208	if (!nf_ct_is_confirmed(exp->master))
205	return NULL;	209	goto err_release_exp;
206		210
207	/* Avoid race with other CPUs, that for exp->master ct, is	211	/* Avoid race with other CPUs, that for exp->master ct, is
208	* about to invoke ->destroy(), or nf_ct_delete() via timeout	212	* about to invoke ->destroy(), or nf_ct_delete() via timeout
@@ -214,18 +218,17 @@ nf_ct_find_expectation(struct net *net, · 5 unmodified lines
214	*/	218	*/
215	if (unlikely(nf_ct_is_dying(exp->master) \|\|	219	if (unlikely(nf_ct_is_dying(exp->master) \|\|
216	!refcount_inc_not_zero(&exp->master->ct_general.use)))	220	!refcount_inc_not_zero(&exp->master->ct_general.use)))
217	return NULL;	221	goto err_release_exp;
218		222
219	if (exp->flags & NF_CT_EXPECT_PERMANENT \|\| !unlink) {	223	if (exp->flags & NF_CT_EXPECT_PERMANENT \|\| !unlink)
220	refcount_inc(&exp->use);
221	return exp;	224	return exp;
222	} else if (timer_delete(&exp->timeout)) {
223	nf_ct_unlink_expect(exp);
224	return exp;
225	}
226	/* Undo exp->master refcnt increase, if timer_delete() failed */
227	nf_ct_put(exp->master);
228		225
		226	nf_ct_unlink_expect(exp);
		227
		228	return exp;
		229
		230	err_release_exp:
		231	nf_ct_expect_put(exp);
229	return NULL;	232	return NULL;
230	}	233	}
231		234
@@ -241,9 +244,8 @@ void nf_ct_remove_expectations(struct nf_conn *ct) · 9 unmodified lines
241	return;	244	return;
242		245
243	spin_lock_bh(&nf_conntrack_expect_lock);	246	spin_lock_bh(&nf_conntrack_expect_lock);
244	hlist_for_each_entry_safe(exp, next, &help->expectations, lnode) {	247	hlist_for_each_entry_safe(exp, next, &help->expectations, lnode)
245	nf_ct_remove_expect(exp);	248	nf_ct_unlink_expect(exp);
246	}
247	spin_unlock_bh(&nf_conntrack_expect_lock);	249	spin_unlock_bh(&nf_conntrack_expect_lock);
248	}	250	}
249	EXPORT_SYMBOL_GPL(nf_ct_remove_expectations);	251	EXPORT_SYMBOL_GPL(nf_ct_remove_expectations);
@@ -292,7 +294,7 @@ static bool master_matches(const struct nf_conntrack_expect *a, · 42 unmodified lines
292	void nf_ct_unexpect_related(struct nf_conntrack_expect *exp)	294	void nf_ct_unexpect_related(struct nf_conntrack_expect *exp)
293	{	295	{
294	spin_lock_bh(&nf_conntrack_expect_lock);	296	spin_lock_bh(&nf_conntrack_expect_lock);
295	nf_ct_remove_expect(exp);	297	WRITE_ONCE(exp->flags, exp->flags \| NF_CT_EXPECT_DEAD);
296	spin_unlock_bh(&nf_conntrack_expect_lock);	298	spin_unlock_bh(&nf_conntrack_expect_lock);
297	}	299	}
298	EXPORT_SYMBOL_GPL(nf_ct_unexpect_related);	300	EXPORT_SYMBOL_GPL(nf_ct_unexpect_related);
@@ -308,6 +310,7 @@ struct nf_conntrack_expect nf_ct_expect_alloc(struct nf_conn me) · 9 unmodified lines
308	if (!new)	310	if (!new)
309	return NULL;	311	return NULL;
310		312
		313	new->timeout = nfct_time_stamp;
311	new->master = me;	314	new->master = me;
312	refcount_set(&new->use, 1);	315	refcount_set(&new->use, 1);
313	return new;	316	return new;
@@ -352,6 +355,8 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class, · 38 unmodified lines
352	exp->tuple.src.l3num = family;	355	exp->tuple.src.l3num = family;
353	exp->tuple.dst.protonum = proto;	356	exp->tuple.dst.protonum = proto;
354		357
		358	exp->master_tuple = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
		359
355	if (saddr) {	360	if (saddr) {
356	memcpy(&exp->tuple.src.u3, saddr, len);	361	memcpy(&exp->tuple.src.u3, saddr, len);
357	if (sizeof(exp->tuple.src.u3) > len)	362	if (sizeof(exp->tuple.src.u3) > len)
@@ -413,17 +418,12 @@ static void nf_ct_expect_insert(struct nf_conntrack_expect *exp, · 55 unmodified lines
413	struct net *net = nf_ct_exp_net(exp);	418	struct net *net = nf_ct_exp_net(exp);
414	unsigned int h = nf_ct_expect_dst_hash(net, &exp->tuple);	419	unsigned int h = nf_ct_expect_dst_hash(net, &exp->tuple);
415		420
416	/* two references : one for hash insert, one for the timer */	421	refcount_inc(&exp->use);
417	refcount_add(2, &exp->use);
418		422
419	timer_setup(&exp->timeout, nf_ct_expectation_timed_out, 0);
420	helper = rcu_dereference_protected(master_help->helper,	423	helper = rcu_dereference_protected(master_help->helper,
421	lockdep_is_held(&nf_conntrack_expect_lock));	424	lockdep_is_held(&nf_conntrack_expect_lock));
422	if (helper) {	425	if (helper)
423	exp->timeout.expires = jiffies +	426	exp->timeout += helper->expect_policy[exp->class].timeout * HZ;
424	helper->expect_policy[exp->class].timeout * HZ;
425	}
426	add_timer(&exp->timeout);
427		427
428	hlist_add_head_rcu(&exp->lnode, &master_help->expectations);	428	hlist_add_head_rcu(&exp->lnode, &master_help->expectations);
429	master_help->expecting[exp->class]++;	429	master_help->expecting[exp->class]++;
@@ -435,19 +435,26 @@ static void nf_ct_expect_insert(struct nf_conntrack_expect *exp, · 5 unmodified lines
435	NF_CT_STAT_INC(net, expect_create);	435	NF_CT_STAT_INC(net, expect_create);
436	}	436	}
437		437
438	/* Race with expectations being used means we could have none to find; OK. */
439	static void evict_oldest_expect(struct nf_conn_help *master_help,	438	static void evict_oldest_expect(struct nf_conn_help *master_help,
440	struct nf_conntrack_expect *new)	439	struct nf_conntrack_expect *new,
		440	const struct nf_conntrack_expect_policy *p)
441	{	441	{
442	struct nf_conntrack_expect exp, last = NULL;	442	struct nf_conntrack_expect exp, last = NULL;
		443	struct hlist_node *next;
443		444
444	hlist_for_each_entry(exp, &master_help->expectations, lnode) {	445	hlist_for_each_entry_safe(exp, next, &master_help->expectations, lnode) {
		446	if (nf_ct_exp_is_expired(exp)) {
		447	nf_ct_unlink_expect(exp);
		448	continue;
		449	}
445	if (exp->class == new->class)	450	if (exp->class == new->class)
446	last = exp;	451	last = exp;
447	}	452	}
448		453
449	if (last)	454	/* Still worth to evict oldest expectation after garbage collection? */
450	nf_ct_remove_expect(last);	455	if (last &&
		456	master_help->expecting[last->class] >= p->max_expected)
		457	nf_ct_unlink_expect(last);
451	}	458	}
452		459
453	static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect,	460	static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect,
@@ -467,14 +474,18 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect, · 13 unmodified lines
467		474
468	h = nf_ct_expect_dst_hash(net, &expect->tuple);	475	h = nf_ct_expect_dst_hash(net, &expect->tuple);
469	hlist_for_each_entry_safe(i, next, &nf_ct_expect_hash[h], hnode) {	476	hlist_for_each_entry_safe(i, next, &nf_ct_expect_hash[h], hnode) {
		477	if (nf_ct_exp_is_expired(i)) {
		478	nf_ct_unlink_expect(i);
		479	continue;
		480	}
470	if (master_matches(i, expect, flags) &&	481	if (master_matches(i, expect, flags) &&
471	expect_matches(i, expect)) {	482	expect_matches(i, expect)) {
472	if (i->class != expect->class \|\|	483	if (i->class != expect->class \|\|
473	i->master != expect->master)	484	i->master != expect->master)
474	return -EALREADY;	485	return -EALREADY;
475		486
476	if (nf_ct_remove_expect(i))	487	nf_ct_unlink_expect(i);
477	break;	488	break;
478	} else if (expect_clash(i, expect)) {	489	} else if (expect_clash(i, expect)) {
479	ret = -EBUSY;	490	ret = -EBUSY;
480	goto out;	491	goto out;
@@ -485,15 +496,15 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect, · 4 unmodified lines
485	lockdep_is_held(&nf_conntrack_expect_lock));	496	lockdep_is_held(&nf_conntrack_expect_lock));
486	if (helper) {	497	if (helper) {
487	p = &helper->expect_policy[expect->class];	498	p = &helper->expect_policy[expect->class];
488	if (p->max_expected &&	499	if (master_help->expecting[expect->class] >= p->max_expected)
489	master_help->expecting[expect->class] >= p->max_expected) {	500	evict_oldest_expect(master_help, expect, p);
490	evict_oldest_expect(master_help, expect);	501	} else {
491	if (master_help->expecting[expect->class]	502	const struct nf_conntrack_expect_policy default_exp_policy = {
492	>= p->max_expected) {	503	.max_expected = NF_CT_EXPECT_MAX_CNT,
493	ret = -EMFILE;	504	};
494	goto out;	505
495	}	506	if (master_help->expecting[expect->class] >= default_exp_policy.max_expected)
496	}	507	evict_oldest_expect(master_help, expect, &default_exp_policy);
497	}	508	}
498		509
499	cnet = nf_ct_pernet(net);	510	cnet = nf_ct_pernet(net);
@@ -547,10 +558,8 @@ void nf_ct_expect_iterate_destroy(bool (iter)(struct nf_conntrack_expect e, vo · 47 unmodified lines
547	hlist_for_each_entry_safe(exp, next,	558	hlist_for_each_entry_safe(exp, next,
548	&nf_ct_expect_hash[i],	559	&nf_ct_expect_hash[i],
549	hnode) {	560	hnode) {
550	if (iter(exp, data) && timer_delete(&exp->timeout)) {	561	if (iter(exp, data))
551	nf_ct_unlink_expect(exp);	562	nf_ct_unlink_expect(exp);
552	nf_ct_expect_put(exp);
553	}
554	}	563	}
555	}	564	}
556		565
@@ -577,10 +586,8 @@ void nf_ct_expect_iterate_net(struct net *net, · 20 unmodified lines
577	if (!net_eq(nf_ct_exp_net(exp), net))	586	if (!net_eq(nf_ct_exp_net(exp), net))
578	continue;	587	continue;
579		588
580	if (iter(exp, data) && timer_delete(&exp->timeout)) {	589	if (iter(exp, data))
581	nf_ct_unlink_expect_report(exp, portid, report);	590	nf_ct_unlink_expect_report(exp, portid, report);
582	nf_ct_expect_put(exp);
583	}
584	}	591	}
585	}	592	}
586		593
@@ -657,17 +664,17 @@ static int exp_seq_show(struct seq_file s, void v) · 70 unmodified lines
657	struct net *net = seq_file_net(s);	664	struct net *net = seq_file_net(s);
658	struct hlist_node *n = v;	665	struct hlist_node *n = v;
659	char *delim = "";	666	char *delim = "";
		667	__s32 timeout;
660		668
661	expect = hlist_entry(n, struct nf_conntrack_expect, hnode);	669	expect = hlist_entry(n, struct nf_conntrack_expect, hnode);
662		670
663	if (!net_eq(nf_ct_exp_net(expect), net))	671	if (!net_eq(nf_ct_exp_net(expect), net))
664	return 0;	672	return 0;
		673	if (nf_ct_exp_is_expired(expect))
		674	return 0;
665		675
666	if (expect->timeout.function)	676	timeout = (__s32)(READ_ONCE(expect->timeout) - nfct_time_stamp) / HZ;
667	seq_printf(s, "%ld ", timer_pending(&expect->timeout)	677	seq_printf(s, "%d ", timeout > 0 ? timeout : 0);
668	? (long)(expect->timeout.expires - jiffies)/HZ : 0);
669	else
670	seq_puts(s, "- ");
671	seq_printf(s, "l3proto = %u proto=%u ",	678	seq_printf(s, "l3proto = %u proto=%u ",
672	expect->tuple.src.l3num,	679	expect->tuple.src.l3num,
673	expect->tuple.dst.protonum);	680	expect->tuple.dst.protonum);

net/netfilter/nf_conntrack_h323_main.c+2−2

@@ -1388,8 +1388,8 @@ static int process_rcf(struct sk_buff skb, struct nf_conn ct, · 1387 unmodified lines
1388	"timeout to %u seconds for",	1388	"timeout to %u seconds for",
1389	info->timeout);	1389	info->timeout);
1390	nf_ct_dump_tuple(&exp->tuple);	1390	nf_ct_dump_tuple(&exp->tuple);
1391	mod_timer_pending(&exp->timeout,	1391	WRITE_ONCE(exp->timeout,
1392	jiffies + info->timeout * HZ);	1392	nfct_time_stamp + (info->timeout * HZ));
1393	}	1393	}
1394	spin_unlock_bh(&nf_conntrack_expect_lock);	1394	spin_unlock_bh(&nf_conntrack_expect_lock);
1395	}	1395	}

net/netfilter/nf_conntrack_helper.c+11−8

 	struct nf_conn_help *help;
 	help = nf_ct_ext_add(ct, NF_CT_EXT_HELPER, gfp);
-	if (help)
+	if (help) {
+		__set_bit(IPS_HELPER_BIT, &ct->status);
 		INIT_HLIST_HEAD(&help->expectations);
-	else
+	}
-		pr_debug("failed to add helper extension area");
 	return help;
 }
 EXPORT_SYMBOL_GPL(nf_ct_helper_ext_add);
 		return 0;
 	help = nfct_help(tmpl);
-	if (help != NULL) {
+	if (help)
 		helper = rcu_dereference(help->helper);
-		set_bit(IPS_HELPER_BIT, &ct->status);
-	}
 	help = nfct_help(ct);
 	if (!nf_ct_helper_hash)
 		return -ENOENT;
-	if (me->expect_policy->max_expected > NF_CT_EXPECT_MAX_CNT)
+	for (i = 0; i <= me->expect_class_max; i++) {
-		return -EINVAL;
+		if (!me->expect_policy[i].max_expected)
+			me->expect_policy[i].max_expected = NF_CT_EXPECT_MAX_CNT;
+		if (me->expect_policy[i].max_expected > NF_CT_EXPECT_MAX_CNT)
+			return -EINVAL;
+	}
 	mutex_lock(&nf_ct_helper_mutex);
 	for (i = 0; i < nf_ct_helper_hsize; i++) {

net/netfilter/nf_conntrack_irc.c+2−0

@@ -262,6 +262,8 @@ static int __init nf_conntrack_irc_init(void) · 261 unmodified lines
262	{	262	{
263	int i, ret;	263	int i, ret;
264		264
		265	nf_conntrack_helper_deprecated(HELPER_NAME);
		266
265	if (max_dcc_channels < 1) {	267	if (max_dcc_channels < 1) {
266	pr_err("max_dcc_channels must not be zero\n");	268	pr_err("max_dcc_channels must not be zero\n");
267	return -EINVAL;	269	return -EINVAL;

net/netfilter/nf_conntrack_netlink.c+13−32

 		return err;
 	}
-	if (!strcmp(helpname, "") && help) {
-		helper = rcu_dereference(help->helper);
-		if (helper) {
-			/* we had a helper before ... */
-			nf_ct_remove_expectations(ct);
-			RCU_INIT_POINTER(help->helper, NULL);
-			if (refcount_dec_and_test(&helper->ct_refcnt))
-				kfree_rcu(helper, rcu);
-		}
-		rcu_read_unlock();
-		return 0;
-	}
 	helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),
 					    nf_ct_protonum(ct));
 	if (helper == NULL) {
 ctnetlink_exp_dump_expect(struct sk_buff *skb,
 			  const struct nf_conntrack_expect *exp)
 {
-	struct nf_conn *master = exp->master;
+	__s32 timeout = (__s32)(READ_ONCE(exp->timeout) - nfct_time_stamp) / HZ;
-	long timeout = ((long)exp->timeout.expires - (long)jiffies) / HZ;
 	struct nf_conntrack_helper *helper;
 #if IS_ENABLED(CONFIG_NF_NAT)
 	struct nlattr *nest_parms;
 		goto nla_put_failure;
 	if (ctnetlink_exp_dump_mask(skb, &exp->tuple, &exp->mask) < 0)
 		goto nla_put_failure;
-	if (ctnetlink_exp_dump_tuple(skb,
+	if (ctnetlink_exp_dump_tuple(skb, &exp->master_tuple, CTA_EXPECT_MASTER) < 0)
-				 &master->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
-				 CTA_EXPECT_MASTER) < 0)
 		goto nla_put_failure;
 #if IS_ENABLED(CONFIG_NF_NAT)
 		if (nla_put_be32(skb, CTA_EXPECT_NAT_DIR, htonl(exp->dir)))
 			goto nla_put_failure;
-		nat_tuple.src.l3num = nf_ct_l3num(master);
+		nat_tuple.src.l3num = exp->master_tuple.src.l3num;
 		nat_tuple.src.u3 = exp->saved_addr;
-		nat_tuple.dst.protonum = nf_ct_protonum(master);
+		nat_tuple.dst.protonum = exp->master_tuple.dst.protonum;
 		nat_tuple.src.u = exp->saved_proto;
 		if (ctnetlink_exp_dump_tuple(skb, &nat_tuple,
 restart:
 		hlist_for_each_entry_rcu(exp, &nf_ct_expect_hash[cb->args[0]],
 					 hnode) {
+			if (nf_ct_exp_is_expired(exp))
+				continue;
 			if (l3proto && exp->tuple.src.l3num != l3proto)
 				continue;
 		}
 		/* after list removal, usage count == 1 */
-		if (timer_delete(&exp->timeout)) {
+		nf_ct_unlink_expect_report(exp, NETLINK_CB(skb).portid,
-			nf_ct_unlink_expect_report(exp, NETLINK_CB(skb).portid,
+					   nlmsg_report(info->nlh));
-						   nlmsg_report(info->nlh));
-			nf_ct_expect_put(exp);
-		}
 		spin_unlock_bh(&nf_conntrack_expect_lock);
 		/* have to put what we 'get' above.
 		 * after this line usage count == 0 */
 ctnetlink_change_expect(struct nf_conntrack_expect *x,
 			const struct nlattr * const cda[])
 {
-	if (cda[CTA_EXPECT_TIMEOUT]) {
+	if (cda[CTA_EXPECT_TIMEOUT])
-		if (!timer_delete(&x->timeout))
+		WRITE_ONCE(x->timeout, nfct_time_stamp +
-			return -ETIME;
+			   ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ);
-		x->timeout.expires = jiffies +
-			ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ;
-		add_timer(&x->timeout);
-	}
 	return 0;
 }
 #endif
 	rcu_assign_pointer(exp->helper, helper);
 	rcu_assign_pointer(exp->assign_helper, assign_helper);
+	exp->master_tuple = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
 	exp->tuple = *tuple;
 	exp->mask.src.u3 = mask->src.u3;
 	exp->mask.src.u.all = mask->src.u.all;

net/netfilter/nf_conntrack_pptp.c+2−0

@@ -545,6 +545,8 @@ static int __init nf_conntrack_pptp_init(void) · 544 unmodified lines
545		545
546	pptp.destroy = gre_pptp_destroy_siblings;	546	pptp.destroy = gre_pptp_destroy_siblings;
547		547
		548	nf_conntrack_helper_deprecated(pptp.name);
		549
548	return nf_conntrack_helper_register(&pptp, &pptp_ptr);	550	return nf_conntrack_helper_register(&pptp, &pptp_ptr);
549	}	551	}
550		552

net/netfilter/nf_conntrack_sip.c+5−8

 		    exp->tuple.dst.protonum != proto ||
 		    exp->tuple.dst.u.udp.port != port)
 			continue;
-		if (mod_timer_pending(&exp->timeout, jiffies + expires * HZ)) {
+		WRITE_ONCE(exp->timeout, nfct_time_stamp + (expires * HZ));
-			exp->flags &= ~NF_CT_EXPECT_INACTIVE;
+		WRITE_ONCE(exp->flags, exp->flags & ~NF_CT_EXPECT_INACTIVE);
-			found = 1;
+		found = 1;
-			break;
+		break;
-		}
 	}
 	spin_unlock_bh(&nf_conntrack_expect_lock);
 	return found;
 	hlist_for_each_entry_safe(exp, next, &help->expectations, lnode) {
 		if ((exp->class != SIP_EXPECT_SIGNALLING) ^ media)
 			continue;
-		if (!nf_ct_remove_expect(exp))
+		nf_ct_unlink_expect(exp);
-			continue;
 		if (!media)
 			break;
 	}
 	nf_ct_expect_init(exp, SIP_EXPECT_SIGNALLING, nf_ct_l3num(ct),
 			  saddr, &daddr, proto, NULL, &port);
-	exp->timeout.expires = sip_timeout * HZ;
 	rcu_assign_pointer(exp->assign_helper, helper);
 	exp->flags = NF_CT_EXPECT_PERMANENT | NF_CT_EXPECT_INACTIVE;

net/netfilter/nf_flow_table_core.c+9−4

  */
 static void nf_flow_table_extend_ct_timeout(struct nf_conn *ct)
 {
-	static const u32 min_timeout = 5 * 60 * HZ;
+	static const s32 min_timeout = 5 * 60 * HZ;
-	u32 expires = nf_ct_expires(ct);
+	u32 ct_timeout = READ_ONCE(ct->timeout);
+	s32 expires;
+	expires = ct_timeout - nfct_time_stamp;
+	if (expires <= 0) /* already expired */
+		return;
 	/* normal case: large enough timeout, nothing to do. */
 	if (likely(expires >= min_timeout))
 	if (nf_ct_is_confirmed(ct) &&
 	    test_bit(IPS_OFFLOAD_BIT, &ct->status)) {
 		u8 l4proto = nf_ct_protonum(ct);
-		u32 new_timeout = true;
+		u32 new_timeout = 1;
 		switch (l4proto) {
 		case IPPROTO_UDP:
 		 */
 		if (new_timeout) {
 			new_timeout += nfct_time_stamp;
-			cmpxchg(&ct->timeout, expires, new_timeout);
+			cmpxchg(&ct->timeout, ct_timeout, new_timeout);
 		}
 	}

net/netfilter/nf_flow_table_ip.c+24−64

 		return false;
 	iph = (struct iphdr *)(skb_network_header(skb) + ctx->offset);
-	size = iph->ihl << 2;
+	if (iph->ihl < 5)
+		return false;
+	size = iph->ihl << 2;
 	if (ip_is_fragment(iph) || unlikely(ip_has_options(size)))
 		return false;
 		return false;
 	if (iph->protocol == IPPROTO_IPIP) {
-		ctx->tun.proto = IPPROTO_IPIP;
+		ctx->tun.proto = iph->protocol;
 		ctx->tun.hdr_size = size;
-		ctx->offset += size;
+		ctx->offset += ctx->tun.hdr_size;
 	}
 	return true;
 				     struct sk_buff *skb)
 {
 #if IS_ENABLED(CONFIG_IPV6)
-	struct ipv6hdr *ip6h, _ip6h;
+	struct ipv6hdr *ip6h;
-	__be16 frag_off;
-	u8 nexthdr;
-	int hdrlen;
-	ip6h = skb_header_pointer(skb, ctx->offset, sizeof(*ip6h), &_ip6h);
+	if (!pskb_may_pull(skb, sizeof(*ip6h) + ctx->offset))
-	if (!ip6h)
 		return false;
+	ip6h = (struct ipv6hdr *)(skb_network_header(skb) + ctx->offset);
 	if (ip6h->hop_limit <= 1)
 		return false;
-	nexthdr = ip6h->nexthdr;
+	if (ipv6_ext_hdr(ip6h->nexthdr))
-	hdrlen = ipv6_skip_exthdr(skb, sizeof(*ip6h) + ctx->offset, &nexthdr,
-				  &frag_off);
-	if (hdrlen < 0)
 		return false;
-	if (nexthdr == IPPROTO_IPV6) {
+	if (ip6h->nexthdr == IPPROTO_IPV6) {
-		ctx->tun.hdr_size = hdrlen;
+		ctx->tun.proto = ip6h->nexthdr;
-		ctx->tun.proto = IPPROTO_IPV6;
+		ctx->tun.hdr_size = sizeof(*ip6h);
+		ctx->offset += ctx->tun.hdr_size;
 	}
-	ctx->offset += ctx->tun.hdr_size;
 	return true;
 #else
 	return 0;
 }
-struct ipv6_tel_txoption {
-	struct ipv6_txoptions ops;
-	__u8 dst_opt[8];
-};
 static int nf_flow_tunnel_ip6ip6_push(struct net *net, struct sk_buff *skb,
 				      struct flow_offload_tuple *tuple,
-				      struct in6_addr **ip6_daddr,
+				      struct in6_addr **ip6_daddr)
-				      int encap_limit)
 {
 	struct ipv6hdr *ip6h = (struct ipv6hdr *)skb_network_header(skb);
-	u8 hop_limit = ip6h->hop_limit, proto = IPPROTO_IPV6;
 	struct rtable *rt = dst_rtable(tuple->dst_cache);
 	__u8 dsfield = ipv6_get_dsfield(ip6h);
 	struct flowi6 fl6 = {
 		.daddr = tuple->tun.src_v6,
 		.saddr = tuple->tun.dst_v6,
-		.flowi6_proto = proto,
+		.flowi6_proto = IPPROTO_IPV6,
 	};
+	u8 hop_limit = ip6h->hop_limit;
 	int err, mtu;
 	u32 headroom;
 	if (err)
 		return err;
-	skb_set_inner_ipproto(skb, proto);
+	skb_set_inner_ipproto(skb, IPPROTO_IPV6);
 	headroom = sizeof(*ip6h) + LL_RESERVED_SPACE(rt->dst.dev) +
 		   rt->dst.header_len;
-	if (encap_limit)
-		headroom += 8;
 	err = skb_cow_head(skb, headroom);
 	if (err)
 		return err;
 	skb_scrub_packet(skb, true);
 	mtu = dst_mtu(&rt->dst) - sizeof(*ip6h);
-	if (encap_limit)
-		mtu -= 8;
 	mtu = max(mtu, IPV6_MIN_MTU);
 	skb_dst_update_pmtu_no_confirm(skb, mtu);
-	if (encap_limit > 0) {
-		struct ipv6_tel_txoption opt = {
-			.dst_opt[2] = IPV6_TLV_TNL_ENCAP_LIMIT,
-			.dst_opt[3] = 1,
-			.dst_opt[4] = encap_limit,
-			.dst_opt[5] = IPV6_TLV_PADN,
-			.dst_opt[6] = 1,
-		};
-		struct ipv6_opt_hdr *hopt;
-		opt.ops.dst1opt = (struct ipv6_opt_hdr *)opt.dst_opt;
-		opt.ops.opt_nflen = 8;
-		hopt = skb_push(skb, ipv6_optlen(opt.ops.dst1opt));
-		memcpy(hopt, opt.ops.dst1opt, ipv6_optlen(opt.ops.dst1opt));
-		hopt->nexthdr = IPPROTO_IPV6;
-		proto = NEXTHDR_DEST;
-	}
 	skb_push(skb, sizeof(*ip6h));
 	skb_reset_network_header(skb);
 	ip6_flow_hdr(ip6h, dsfield,
 		     ip6_make_flowlabel(net, skb, fl6.flowlabel, true, &fl6));
 	ip6h->hop_limit = hop_limit;
-	ip6h->nexthdr = proto;
+	ip6h->nexthdr = IPPROTO_IPV6;
 	ip6h->daddr = tuple->tun.src_v6;
 	ip6h->saddr = tuple->tun.dst_v6;
 	ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(*ip6h));
 static int nf_flow_tunnel_v6_push(struct net *net, struct sk_buff *skb,
 				  struct flow_offload_tuple *tuple,
-				  struct in6_addr **ip6_daddr,
+				  struct in6_addr **ip6_daddr)
-				  int encap_limit)
 {
 	if (tuple->tun_num)
-		return nf_flow_tunnel_ip6ip6_push(net, skb, tuple, ip6_daddr,
+		return nf_flow_tunnel_ip6ip6_push(net, skb, tuple, ip6_daddr);
-						  encap_limit);
 	return 0;
 }
 static int nf_flow_offload_ipv6_forward(struct nf_flowtable_ctx *ctx,
 					struct nf_flowtable *flow_table,
 					struct flow_offload_tuple_rhash *tuplehash,
-					struct sk_buff *skb, int encap_limit)
+					struct sk_buff *skb)
 {
 	enum flow_offload_tuple_dir dir;
 	struct flow_offload *flow;
 	flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
 	mtu = flow->tuplehash[dir].tuple.mtu + ctx->offset;
-	if (flow->tuplehash[!dir].tuple.tun_num) {
+	if (flow->tuplehash[!dir].tuple.tun_num)
 		mtu -= sizeof(*ip6h);
-		if (encap_limit > 0)
-			mtu -= 8; /* encap limit option */
-	}
 	if (unlikely(nf_flow_exceeds_mtu(skb, mtu)))
 		return 0;
 nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
 			  const struct nf_hook_state *state)
 {
-	int encap_limit = IPV6_DEFAULT_TNL_ENCAP_LIMIT;
 	struct flow_offload_tuple_rhash *tuplehash;
 	struct nf_flowtable *flow_table = priv;
 	struct flow_offload_tuple *other_tuple;
 	if (tuplehash == NULL)
 		return NF_ACCEPT;
-	ret = nf_flow_offload_ipv6_forward(&ctx, flow_table, tuplehash, skb,
+	ret = nf_flow_offload_ipv6_forward(&ctx, flow_table, tuplehash, skb);
-					   encap_limit);
 	if (ret < 0)
 		return NF_DROP;
 	else if (ret == 0)
 	ip6_daddr = &other_tuple->src_v6;
 	if (nf_flow_tunnel_v6_push(state->net, skb, other_tuple,
-				   &ip6_daddr, encap_limit) < 0)
+				   &ip6_daddr) < 0)
 		return NF_DROP;
 	switch (tuplehash->tuple.xmit_type) {

net/netfilter/nf_flow_table_path.c+3−1

 	struct neighbour *n;
 	u8 nud_state;
-	if (!nft_is_valid_ether_device(dev))
+	if (!nft_is_valid_ether_device(dev)) {
+		eth_zero_addr(ha);
 		goto out;
+	}
 	n = dst_neigh_lookup(dst_cache, daddr);
 	if (!n)

net/netfilter/nf_nat_core.c+10−0

@@ -1181,6 +1181,16 @@ int nf_nat_register_fn(struct net net, u8 pf, const struct nf_hook_ops ops, · 1180 unmodified lines
1181	struct nf_hook_ops *nat_ops;	1181	struct nf_hook_ops *nat_ops;
1182	int i, ret;	1182	int i, ret;
1183		1183
		1184	#ifndef MODULE
		1185	/* If nf_nat_core is built-in and nf_nat_init() fails, dependent
		1186	* modules like nft_chain_nat.ko may still call this function.
		1187	* However, nat_net would be invalid, likely pointing to some other
		1188	* per-net structure.
		1189	*/
		1190	if (WARN_ON_ONCE(!nf_nat_hook))
		1191	return -EOPNOTSUPP;
		1192	#endif
		1193
1184	if (WARN_ON_ONCE(pf >= ARRAY_SIZE(nat_net->nat_proto_net)))	1194	if (WARN_ON_ONCE(pf >= ARRAY_SIZE(nat_net->nat_proto_net)))
1185	return -EINVAL;	1195	return -EINVAL;
1186		1196

net/netfilter/nf_queue.c+14−0

 		nf_queue_sock_put(state->sk);
 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
+	dev_put(entry->bridge_dev);
 	dev_put(entry->physin);
 	dev_put(entry->physout);
 #endif
 {
 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
 	const struct sk_buff *skb = entry->skb;
+	struct dst_entry *dst = skb_dst(skb);
+	struct net_device *dev = NULL;
 	if (nf_bridge_info_exists(skb)) {
 		entry->physin = nf_bridge_get_physindev(skb, entry->state.net);
 		entry->physin = NULL;
 		entry->physout = NULL;
 	}
+	if (entry->state.pf == NFPROTO_BRIDGE &&
+	    dst && (dst->flags & DST_FAKE_RTABLE))
+		dev = dst_dev_rcu(dst);
+	/* Must hold a reference on the bridge device: dst_hold() protects
+	 * the dst itself, but the fake rtable is embedded in bridge-private
+	 * storage that netdevice teardown can free independently.
+	 */
+	entry->bridge_dev = dev;
 #endif
 }
 	dev_hold(state->out);
 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
+	dev_hold(entry->bridge_dev);
 	dev_hold(entry->physin);
 	dev_hold(entry->physout);
 #endif

net/netfilter/nfnetlink_queue.c+3−0

@@ -1262,6 +1262,9 @@ dev_cmp(struct nf_queue_entry *entry, unsigned long ifindex) · 1261 unmodified lines
1262		1262
1263	if (physinif == ifindex \|\| physoutif == ifindex)	1263	if (physinif == ifindex \|\| physoutif == ifindex)
1264	return 1;	1264	return 1;
		1265
		1266	if (entry->bridge_dev && entry->bridge_dev->ifindex == ifindex)
		1267	return 1;
1265	#endif	1268	#endif
1266	if (entry->skb_dev && entry->skb_dev->ifindex == ifindex)	1269	if (entry->skb_dev && entry->skb_dev->ifindex == ifindex)
1267	return 1;	1270	return 1;

net/netfilter/nft_compat.c+21−3

 	return 0;
 }
+static int nft_target_bridge_validate(const struct nft_ctx *ctx,
+				      const struct nft_expr *expr)
+{
+	struct xt_target *target = expr->ops->data;
+	/* Do not allow UNSPEC to stand-in for NFPROTO_BRIDGE
+	 * targets: they are incompatible.  ebtables targets return
+	 * EBT_ACCEPT, DROP and so on which are not compatible with
+	 * NF_ACCEPT, NF_DROP and so on.
+	 */
+	if (target->family != NFPROTO_BRIDGE)
+		return -ENOENT;
+	return nft_target_validate(ctx, expr);
+}
 static void __nft_match_eval(const struct nft_expr *expr,
 			     struct nft_regs *regs,
 			     const struct nft_pktinfo *pkt,
 	ops->init = nft_target_init;
 	ops->destroy = nft_target_destroy;
 	ops->dump = nft_target_dump;
-	ops->validate = nft_target_validate;
 	ops->data = target;
-	if (family == NFPROTO_BRIDGE)
+	if (family == NFPROTO_BRIDGE) {
 		ops->eval = nft_target_eval_bridge;
-	else
+		ops->validate = nft_target_bridge_validate;
+	} else {
 		ops->eval = nft_target_eval_xt;
+		ops->validate = nft_target_validate;
+	}
 	return ops;
 err:

net/netfilter/nft_ct.c+18−4

 	help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
 	if (help && refcount_inc_not_zero(&to_assign->ct_refcnt)) {
 		rcu_assign_pointer(help->helper, to_assign);
-		set_bit(IPS_HELPER_BIT, &ct->status);
 		if ((ct->status & IPS_NAT_MASK) && !nfct_seqadj(ct))
 			if (!nfct_seqadj_ext_add(ct))
 	u32		timeout;
 };
+static int nft_ct_expect_timeout_get(const struct nlattr *attr, u32 *val)
+{
+	unsigned long jiffies_val = msecs_to_jiffies(nla_get_u32(attr));
+	if (jiffies_val > UINT_MAX)
+		return -ERANGE;
+	*val = jiffies_val;
+	return 0;
+}
 static int nft_ct_expect_obj_init(const struct nft_ctx *ctx,
 				  const struct nlattr * const tb[],
 				  struct nft_object *obj)
 {
 	struct nft_ct_expect_obj *priv = nft_obj_data(obj);
+	int err;
 	if (!tb[NFTA_CT_EXPECT_L4PROTO] ||
 	    !tb[NFTA_CT_EXPECT_DPORT] ||
 		return -EOPNOTSUPP;
 	}
+	err = nft_ct_expect_timeout_get(tb[NFTA_CT_EXPECT_TIMEOUT], &priv->timeout);
+	if (err)
+		return err;
 	priv->dport = nla_get_be16(tb[NFTA_CT_EXPECT_DPORT]);
-	priv->timeout = nla_get_u32(tb[NFTA_CT_EXPECT_TIMEOUT]);
 	priv->size = nla_get_u8(tb[NFTA_CT_EXPECT_SIZE]);
 	return nf_ct_netns_get(ctx->net, ctx->family);
 	if (nla_put_be16(skb, NFTA_CT_EXPECT_L3PROTO, htons(priv->l3num)) ||
 	    nla_put_u8(skb, NFTA_CT_EXPECT_L4PROTO, priv->l4proto) ||
 	    nla_put_be16(skb, NFTA_CT_EXPECT_DPORT, priv->dport) ||
-	    nla_put_u32(skb, NFTA_CT_EXPECT_TIMEOUT, priv->timeout) ||
+	    nla_put_u32(skb, NFTA_CT_EXPECT_TIMEOUT, jiffies_to_msecs(priv->timeout)) ||
 	    nla_put_u8(skb, NFTA_CT_EXPECT_SIZE, priv->size))
 		return -1;
 		          &ct->tuplehash[!dir].tuple.src.u3,
 		          &ct->tuplehash[!dir].tuple.dst.u3,
 		          priv->l4proto, NULL, &priv->dport);
-	exp->timeout.expires = jiffies + priv->timeout * HZ;
+	exp->timeout += priv->timeout;
 	if (nf_ct_expect_related(exp, 0) != 0)
 		regs->verdict.code = NF_DROP;

net/netfilter/nft_meta.c+3−2

 #endif
 }
-static int nft_meta_get_validate(const struct nft_ctx *ctx,
+int nft_meta_get_validate(const struct nft_ctx *ctx,
-				 const struct nft_expr *expr)
+			  const struct nft_expr *expr)
 {
 	const struct nft_meta *priv = nft_expr_priv(expr);
 	return 0;
 }
+EXPORT_SYMBOL_GPL(nft_meta_get_validate);
 int nft_meta_set_validate(const struct nft_ctx *ctx,
 			  const struct nft_expr *expr)

net/netfilter/nft_payload.c+13−3

 			    const struct nlattr * const tb[])
 {
 	struct nft_payload *priv = nft_expr_priv(expr);
+	u32 offset;
+	int err;
 	priv->base   = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_BASE]));
-	priv->offset = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_OFFSET]));
 	priv->len    = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_LEN]));
+	err = nft_parse_u32_check(tb[NFTA_PAYLOAD_OFFSET], U16_MAX, &offset);
+	if (err < 0)
+		return err;
+	priv->offset = offset;
 	return nft_parse_register_store(ctx, tb[NFTA_PAYLOAD_DREG],
 					&priv->dreg, NULL, NFT_DATA_VALUE,
 					priv->len);
 				  const struct nlattr * const tb[])
 {
 	struct nft_payload *priv = nft_expr_priv(expr);
-	u32 base;
+	u32 base, offset;
+	int err;
 	if (!tb[NFTA_PAYLOAD_BASE] || !tb[NFTA_PAYLOAD_OFFSET] ||
 	    !tb[NFTA_PAYLOAD_LEN] || !tb[NFTA_PAYLOAD_DREG])
 	}
 	priv->base   = base;
-	priv->offset = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_OFFSET]));
 	priv->len    = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_LEN]));
+	err = nft_parse_u32_check(tb[NFTA_PAYLOAD_OFFSET], U16_MAX, &offset);
+	if (err < 0)
+		return err;
+	priv->offset = offset;
 	return nft_parse_register_store(ctx, tb[NFTA_PAYLOAD_DREG],
 					&priv->dreg, NULL, NFT_DATA_VALUE,

net/netfilter/nft_synproxy.c+4−5

 static void nft_synproxy_tcp_options(struct synproxy_options *opts,
 				     const struct tcphdr *tcp,
 				     struct synproxy_net *snet,
-				     struct nf_synproxy_info *info,
+				     struct nf_synproxy_info *info)
-				     const struct nft_synproxy *priv)
 {
 	this_cpu_inc(snet->stats->syn_received);
 	if (tcp->ece && tcp->cwr)
 		opts->options |= NF_SYNPROXY_OPT_ECN;
-	opts->options &= priv->info.options;
+	opts->options &= info->options;
 	opts->mss_encode = opts->mss_option;
 	opts->mss_option = info->mss;
 	if (opts->options & NF_SYNPROXY_OPT_TIMESTAMP)
 	if (tcp->syn) {
 		/* Initial SYN from client */
-		nft_synproxy_tcp_options(opts, tcp, snet, &info, priv);
+		nft_synproxy_tcp_options(opts, tcp, snet, &info);
 		synproxy_send_client_synack(net, skb, tcp, opts);
 		consume_skb(skb);
 		regs->verdict.code = NF_STOLEN;
 	if (tcp->syn) {
 		/* Initial SYN from client */
-		nft_synproxy_tcp_options(opts, tcp, snet, &info, priv);
+		nft_synproxy_tcp_options(opts, tcp, snet, &info);
 		synproxy_send_client_synack_ipv6(net, skb, tcp, opts);
 		consume_skb(skb);
 		regs->verdict.code = NF_STOLEN;

net/netfilter/xt_cluster.c+1−1

@@ -107,7 +107,7 @@ xt_cluster_mt(const struct sk_buff skb, struct xt_action_param par) · 106 unmodified lines
107	}	107	}
108		108
109	ct = nf_ct_get(skb, &ctinfo);	109	ct = nf_ct_get(skb, &ctinfo);
110	if (ct == NULL)	110	if (!ct \|\| nf_ct_is_template(ct))
111	return false;	111	return false;
112		112
113	if (ct->master)	113	if (ct->master)

net/openvswitch/conntrack.c+2−1

@@ -883,7 +883,8 @@ static void ct_limit_set(const struct ovs_ct_limit_info *info, · 882 unmodified lines
883	struct hlist_head *head;	883	struct hlist_head *head;
884		884
885	head = ct_limit_hash_bucket(info, new_ct_limit->zone);	885	head = ct_limit_hash_bucket(info, new_ct_limit->zone);
886	hlist_for_each_entry_rcu(ct_limit, head, hlist_node) {	886	hlist_for_each_entry_rcu(ct_limit, head, hlist_node,
		887	lockdep_ovsl_is_held()) {
887	if (ct_limit->zone == new_ct_limit->zone) {	888	if (ct_limit->zone == new_ct_limit->zone) {
888	hlist_replace_rcu(&ct_limit->hlist_node,	889	hlist_replace_rcu(&ct_limit->hlist_node,
889	&new_ct_limit->hlist_node);	890	&new_ct_limit->hlist_node);

net/psample/psample.c+4−2

 		goto error;
 	if (data_len) {
-		int nla_len = nla_total_size(data_len);
+		int nla_len = nla_attr_size(data_len);
 		struct nlattr *nla;
 		nla = skb_put(nl_skb, nla_len);
 		nla->nla_type = PSAMPLE_ATTR_DATA;
-		nla->nla_len = nla_attr_size(data_len);
+		nla->nla_len = nla_len;
 		if (skb_copy_bits(skb, 0, nla_data(nla), data_len))
 			goto error;
+		skb_put_zero(nl_skb, nla_padlen(data_len));
 	}
 #ifdef CONFIG_INET

net/rds/send.c+2−0

@@ -967,6 +967,8 @@ static int rds_rm_size(struct msghdr *msg, int num_sgs, · 966 unmodified lines
967		967
968	switch (cmsg->cmsg_type) {	968	switch (cmsg->cmsg_type) {
969	case RDS_CMSG_RDMA_ARGS:	969	case RDS_CMSG_RDMA_ARGS:
		970	if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct rds_rdma_args)))
		971	return -EINVAL;
970	if (vct->indx >= vct->len) {	972	if (vct->indx >= vct->len) {
971	vct->len += vct->incr;	973	vct->len += vct->incr;
972	tmp_iov =	974	tmp_iov =

net/rxrpc/ar-internal.h+4−2

 enum rxrpc_call_state {
 	RXRPC_CALL_UNINITIALISED,
 	RXRPC_CALL_CLIENT_AWAIT_CONN,	/* - client waiting for connection to become available */
+	RXRPC_CALL_CLIENT_PRE_SEND,	/* - client is connected, but hasn't sent anything yet */
 	RXRPC_CALL_CLIENT_SEND_REQUEST,	/* - client sending request phase */
+	RXRPC_CALL_CLIENT_AWAIT_ACK,	/* - client awaiting ACKs of request */
 	RXRPC_CALL_CLIENT_AWAIT_REPLY,	/* - client awaiting reply */
 	RXRPC_CALL_CLIENT_RECV_REPLY,	/* - client receiving reply phase */
 	RXRPC_CALL_SERVER_PREALLOC,	/* - service preallocation */
 }
 /*
- * out_of_band.c
+ * oob.c
  */
-void rxrpc_notify_socket_oob(struct rxrpc_call *call, struct sk_buff *skb);
+bool rxrpc_notify_socket_oob(struct rxrpc_call *call, struct sk_buff *skb);
 void rxrpc_add_pending_oob(struct rxrpc_sock *rx, struct sk_buff *skb);
 int rxrpc_sendmsg_oob(struct rxrpc_sock *rx, struct msghdr *msg, size_t len);

net/rxrpc/call_event.c+4−1

 	switch (__rxrpc_call_state(call)) {
 	case RXRPC_CALL_CLIENT_SEND_REQUEST:
-		rxrpc_set_call_state(call, RXRPC_CALL_CLIENT_AWAIT_REPLY);
+		rxrpc_set_call_state(call, RXRPC_CALL_CLIENT_AWAIT_ACK);
 		break;
 	case RXRPC_CALL_SERVER_SEND_REPLY:
 		rxrpc_set_call_state(call, RXRPC_CALL_SERVER_AWAIT_ACK);
 				break;
 		} while (req.n < limit && before(seq, send_top));
+		if (__rxrpc_call_state(call) == RXRPC_CALL_CLIENT_PRE_SEND)
+			rxrpc_set_call_state(call, RXRPC_CALL_CLIENT_SEND_REQUEST);
 		if (txb->flags & RXRPC_LAST_PACKET) {
 			rxrpc_close_tx_phase(call);
 			tq = NULL;
 		fallthrough;
 	case RXRPC_CALL_SERVER_SEND_REPLY:
+	case RXRPC_CALL_CLIENT_PRE_SEND:
 	case RXRPC_CALL_CLIENT_SEND_REQUEST:
 		if (!rxrpc_tx_window_space(call))
 			return;

net/rxrpc/call_object.c+2−0

 const char *const rxrpc_call_states[NR__RXRPC_CALL_STATES] = {
 	[RXRPC_CALL_UNINITIALISED]		= "Uninit  ",
 	[RXRPC_CALL_CLIENT_AWAIT_CONN]		= "ClWtConn",
+	[RXRPC_CALL_CLIENT_PRE_SEND]		= "ClPreSnd",
 	[RXRPC_CALL_CLIENT_SEND_REQUEST]	= "ClSndReq",
+	[RXRPC_CALL_CLIENT_AWAIT_ACK]		= "ClAwtAck",
 	[RXRPC_CALL_CLIENT_AWAIT_REPLY]		= "ClAwtRpl",
 	[RXRPC_CALL_CLIENT_RECV_REPLY]		= "ClRcvRpl",
 	[RXRPC_CALL_SERVER_PREALLOC]		= "SvPrealc",

net/rxrpc/conn_client.c+1−1

@@ -449,7 +449,7 @@ static void rxrpc_activate_one_channel(struct rxrpc_connection *conn, · 448 unmodified lines
449	trace_rxrpc_connect_call(call);	449	trace_rxrpc_connect_call(call);
450	call->tx_last_sent = ktime_get_real();	450	call->tx_last_sent = ktime_get_real();
451	rxrpc_start_call_timer(call);	451	rxrpc_start_call_timer(call);
452	rxrpc_set_call_state(call, RXRPC_CALL_CLIENT_SEND_REQUEST);	452	rxrpc_set_call_state(call, RXRPC_CALL_CLIENT_PRE_SEND);
453	wake_up(&call->waitq);	453	wake_up(&call->waitq);
454	}	454	}
455		455

net/rxrpc/conn_event.c+7−2

 	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
 	struct rxrpc_call *call = NULL;
 	struct rxrpc_sock *rx;
-	bool respond = false;
+	bool respond = false, queued = false;
 	sp->chall.conn =
 		rxrpc_get_connection(conn, rxrpc_conn_get_challenge_input);
 	}
 	if (call)
-		rxrpc_notify_socket_oob(call, skb);
+		queued = rxrpc_notify_socket_oob(call, skb);
 	rcu_read_unlock();
+	if (call && !queued) {
+		rxrpc_put_connection(conn, rxrpc_conn_put_challenge_input);
+		sp->chall.conn = NULL;
+		return false;
+	}
 	if (!call)
 		rxrpc_post_packet_to_conn(conn, skb);

net/rxrpc/input.c+32−7

@@ -181,7 +181,8 @@ void rxrpc_congestion_degrade(struct rxrpc_call *call) · 180 unmodified lines
181	if (call->cong_ca_state != RXRPC_CA_SLOW_START &&	181	if (call->cong_ca_state != RXRPC_CA_SLOW_START &&
182	call->cong_ca_state != RXRPC_CA_CONGEST_AVOIDANCE)	182	call->cong_ca_state != RXRPC_CA_CONGEST_AVOIDANCE)
183	return;	183	return;
184	if (__rxrpc_call_state(call) == RXRPC_CALL_CLIENT_AWAIT_REPLY)	184	if (__rxrpc_call_state(call) == RXRPC_CALL_CLIENT_AWAIT_ACK \|\|
		185	__rxrpc_call_state(call) == RXRPC_CALL_CLIENT_AWAIT_REPLY)
185	return;	186	return;
186		187
187	rtt = ns_to_ktime(call->srtt_us * (NSEC_PER_USEC / 8));	188	rtt = ns_to_ktime(call->srtt_us * (NSEC_PER_USEC / 8));
@@ -236,6 +237,9 @@ static bool rxrpc_rotate_tx_window(struct rxrpc_call *call, rxrpc_seq_t to, · 48 unmodified lines
236	call->acks_lowest_nak = to;	237	call->acks_lowest_nak = to;
237	}	238	}
238		239
		240	if (after(seq, to))
		241	return false;
		242
239	/* We may have a left over fully-consumed buffer at the front that we	243	/* We may have a left over fully-consumed buffer at the front that we
240	* couldn't drop before (rotate_and_keep below).	244	* couldn't drop before (rotate_and_keep below).
241	*/	245	*/
@@ -247,7 +251,7 @@ static bool rxrpc_rotate_tx_window(struct rxrpc_call *call, rxrpc_seq_t to, · 5 unmodified lines
247	tq = call->tx_queue;	251	tq = call->tx_queue;
248	}	252	}
249		253
250	do {	254	while (before_eq(seq, to)) {
251	unsigned int ix = seq - call->tx_qbase;	255	unsigned int ix = seq - call->tx_qbase;
252		256
253	_debug("tq=%x seq=%x i=%d f=%x", tq->qbase, seq, ix, tq->bufs[ix]->flags);	257	_debug("tq=%x seq=%x i=%d f=%x", tq->qbase, seq, ix, tq->bufs[ix]->flags);
@@ -317,8 +321,7 @@ static bool rxrpc_rotate_tx_window(struct rxrpc_call *call, rxrpc_seq_t to, · 63 unmodified lines
317	break;	321	break;
318	}	322	}
319	}	323	}
320		324	}
321	} while (before_eq(seq, to));
322		325
323	if (trace)	326	if (trace)
324	trace_rxrpc_rack_update(call, summary);	327	trace_rxrpc_rack_update(call, summary);
@@ -356,6 +359,7 @@ static void rxrpc_end_tx_phase(struct rxrpc_call *call, bool reply_begun, · 31 unmodified lines
356		359
357	switch (__rxrpc_call_state(call)) {	360	switch (__rxrpc_call_state(call)) {
358	case RXRPC_CALL_CLIENT_SEND_REQUEST:	361	case RXRPC_CALL_CLIENT_SEND_REQUEST:
		362	case RXRPC_CALL_CLIENT_AWAIT_ACK:
359	case RXRPC_CALL_CLIENT_AWAIT_REPLY:	363	case RXRPC_CALL_CLIENT_AWAIT_REPLY:
360	if (reply_begun) {	364	if (reply_begun) {
361	rxrpc_set_call_state(call, RXRPC_CALL_CLIENT_RECV_REPLY);	365	rxrpc_set_call_state(call, RXRPC_CALL_CLIENT_RECV_REPLY);
@@ -392,6 +396,14 @@ static bool rxrpc_receiving_reply(struct rxrpc_call *call) · 30 unmodified lines
392	trace_rxrpc_timer_can(call, rxrpc_timer_trace_delayed_ack);	396	trace_rxrpc_timer_can(call, rxrpc_timer_trace_delayed_ack);
393	}	397	}
394		398
		399	/* Deal with an apparent reply coming in before we've got the request
		400	* queued or transmitted.
		401	*/
		402	if (!test_bit(RXRPC_CALL_EXPOSED, &call->flags)) {
		403	rxrpc_proto_abort(call, top, rxrpc_eproto_early_reply);
		404	return false;
		405	}
		406
395	if (!test_bit(RXRPC_CALL_TX_LAST, &call->flags)) {	407	if (!test_bit(RXRPC_CALL_TX_LAST, &call->flags)) {
396	if (!rxrpc_rotate_tx_window(call, top, &summary)) {	408	if (!rxrpc_rotate_tx_window(call, top, &summary)) {
397	rxrpc_proto_abort(call, top, rxrpc_eproto_early_reply);	409	rxrpc_proto_abort(call, top, rxrpc_eproto_early_reply);
@@ -694,6 +706,7 @@ static void rxrpc_input_data(struct rxrpc_call call, struct sk_buff skb) · 296 unmodified lines
694		706
695	switch (__rxrpc_call_state(call)) {	707	switch (__rxrpc_call_state(call)) {
696	case RXRPC_CALL_CLIENT_SEND_REQUEST:	708	case RXRPC_CALL_CLIENT_SEND_REQUEST:
		709	case RXRPC_CALL_CLIENT_AWAIT_ACK:
697	case RXRPC_CALL_CLIENT_AWAIT_REPLY:	710	case RXRPC_CALL_CLIENT_AWAIT_REPLY:
698	/* Received data implicitly ACKs all of the request	711	/* Received data implicitly ACKs all of the request
699	* packets we sent when we're acting as a client.	712	* packets we sent when we're acting as a client.
@@ -1154,10 +1167,12 @@ static void rxrpc_input_ack(struct rxrpc_call call, struct sk_buff skb) · 454 unmodified lines
1154	if (hard_ack + 1 == 0)	1167	if (hard_ack + 1 == 0)
1155	return rxrpc_proto_abort(call, 0, rxrpc_eproto_ackr_zero);	1168	return rxrpc_proto_abort(call, 0, rxrpc_eproto_ackr_zero);
1156		1169
1157	/* Ignore ACKs unless we are or have just been transmitting. */	1170	/* Ignore ACKs unless we are transmitting or are waiting for
		1171	* acknowledgement of the packets we've just been transmitting.
		1172	*/
1158	switch (__rxrpc_call_state(call)) {	1173	switch (__rxrpc_call_state(call)) {
1159	case RXRPC_CALL_CLIENT_SEND_REQUEST:	1174	case RXRPC_CALL_CLIENT_SEND_REQUEST:
1160	case RXRPC_CALL_CLIENT_AWAIT_REPLY:	1175	case RXRPC_CALL_CLIENT_AWAIT_ACK:
1161	case RXRPC_CALL_SERVER_SEND_REPLY:	1176	case RXRPC_CALL_SERVER_SEND_REPLY:
1162	case RXRPC_CALL_SERVER_AWAIT_ACK:	1177	case RXRPC_CALL_SERVER_AWAIT_ACK:
1163	break;	1178	break;
@@ -1215,7 +1230,17 @@ static void rxrpc_input_ackall(struct rxrpc_call call, struct sk_buff skb) · 51 unmodified lines
1215	{	1230	{
1216	struct rxrpc_ack_summary summary = { 0 };	1231	struct rxrpc_ack_summary summary = { 0 };
1217		1232
1218	if (rxrpc_rotate_tx_window(call, call->tx_top, &summary))	1233	switch (__rxrpc_call_state(call)) {
		1234	case RXRPC_CALL_CLIENT_SEND_REQUEST:
		1235	case RXRPC_CALL_CLIENT_AWAIT_ACK:
		1236	case RXRPC_CALL_SERVER_SEND_REPLY:
		1237	case RXRPC_CALL_SERVER_AWAIT_ACK:
		1238	break;
		1239	default:
		1240	return;
		1241	}
		1242
		1243	if (rxrpc_rotate_tx_window(call, call->tx_transmitted, &summary))
1219	rxrpc_end_tx_phase(call, false, rxrpc_eproto_unexpected_ackall);	1244	rxrpc_end_tx_phase(call, false, rxrpc_eproto_unexpected_ackall);
1220	}	1245	}
1221		1246

net/rxrpc/oob.c+10−2

  * Post an out-of-band message for attention by the socket or kernel service
  * associated with a reference call.
  */
-void rxrpc_notify_socket_oob(struct rxrpc_call *call, struct sk_buff *skb)
+bool rxrpc_notify_socket_oob(struct rxrpc_call *call, struct sk_buff *skb)
 {
 	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
 	struct rxrpc_sock *rx;
 	struct sock *sk;
+	bool queued = false;
 	rcu_read_lock();
 			skb->skb_mstamp_ns = rx->oob_id_counter++;
 			rxrpc_get_skb(skb, rxrpc_skb_get_post_oob);
 			skb_queue_tail(&rx->recvmsg_oobq, skb);
+			queued = true;
 			trace_rxrpc_notify_socket(call->debug_id, sp->hdr.serial);
 			if (rx->app_ops)
 		}
 		spin_unlock_irq(&rx->recvmsg_lock);
-		if (!rx->app_ops && !sock_flag(sk, SOCK_DEAD))
+		if (queued && !rx->app_ops && !sock_flag(sk, SOCK_DEAD))
 			sk->sk_data_ready(sk);
 	}
 	rcu_read_unlock();
+	return queued;
 }
 /*
 		break;
 	}
+	switch (skb->mark) {
+	case RXRPC_OOB_CHALLENGE:
+		rxrpc_put_connection(sp->chall.conn, rxrpc_conn_put_oob);
+		break;
+	}
 	rxrpc_free_skb(skb, rxrpc_skb_put_oob);
 	return ret;
 }

net/rxrpc/recvmsg.c+4−6

 	_enter("%d", call->debug_id);
-	if (!list_empty(&call->recvmsg_link))
-		return;
 	if (test_bit(RXRPC_CALL_RELEASED, &call->flags)) {
 		rxrpc_see_call(call, rxrpc_call_see_notify_released);
 		return;
 		return -EAGAIN;
 	}
-	if (list_empty(&rx->recvmsg_q)) {
+	if (list_empty(&rx->recvmsg_q) &&
+	    skb_queue_empty_lockless(&rx->recvmsg_oobq)) {
 		ret = -EWOULDBLOCK;
 		if (timeo == 0) {
 			call = NULL;
 		release_sock(&rx->sk);
 		if (ret == -EAGAIN)
 			goto try_again;
-		goto error_no_call;
+		goto error_trace;
 	}
 	/* Find the next call and dequeue it if we're not just peeking.  If we
 	if (test_bit(RXRPC_CALL_RELEASED, &call->flags)) {
 		rxrpc_see_call(call, rxrpc_call_see_already_released);
 		mutex_unlock(&call->user_mutex);
-		if (!(flags & MSG_PEEK))
+		rxrpc_put_call(call, rxrpc_call_put_recvmsg);
-			rxrpc_put_call(call, rxrpc_call_put_recvmsg);
 		goto try_again;
 	}

net/rxrpc/sendmsg.c+2−1

 	if (state >= RXRPC_CALL_COMPLETE)
 		goto maybe_error;
 	ret = -EPROTO;
-	if (state != RXRPC_CALL_CLIENT_SEND_REQUEST &&
+	if (state != RXRPC_CALL_CLIENT_PRE_SEND &&
+	    state != RXRPC_CALL_CLIENT_SEND_REQUEST &&
 	    state != RXRPC_CALL_SERVER_ACK_REQUEST &&
 	    state != RXRPC_CALL_SERVER_SEND_REPLY) {
 		/* Request phase complete for this client call */

net/sched/act_ct.c+8−5

 				   u8 family, u16 zone, bool *defrag)
 {
 	enum ip_conntrack_info ctinfo;
+	struct tc_skb_cb cb;
 	struct nf_conn *ct;
 	int err = 0;
 	bool frag;
 	u8 proto;
-	u16 mru;
 	/* Previously seen (loopback)? Ignore. */
 	ct = nf_ct_get(skb, &ctinfo);
 	if (err || !frag)
 		return err;
-	err = nf_ct_handle_fragments(net, skb, zone, family, &proto, &mru);
+	cb = *tc_skb_cb(skb);
+	err = nf_ct_handle_fragments(net, skb, zone, family, &proto, &cb.mru);
 	if (err)
 		return err;
 	*defrag = true;
-	tc_skb_cb(skb)->mru = mru;
+	*tc_skb_cb(skb) = cb;
 	return 0;
 }
 	if (tb[TCA_CT_ZONE]) {
 		if (!IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES)) {
 			NL_SET_ERR_MSG_MOD(extack, "Conntrack zones isn't enabled.");
-			return -EOPNOTSUPP;
+			err = -EOPNOTSUPP;
+			goto err;
 		}
 		tcf_ct_set_key_val(tb,
 	tmpl = nf_ct_tmpl_alloc(net, &zone, GFP_KERNEL);
 	if (!tmpl) {
 		NL_SET_ERR_MSG_MOD(extack, "Failed to allocate conntrack template");
-		return -ENOMEM;
+		err = -ENOMEM;
+		goto err;
 	}
 	p->tmpl = tmpl;
 	if (tb[TCA_CT_HELPER_NAME]) {

net/sched/cls_api.c+3−0

 		skb_do_redirect(skb);
 		*ret = __NET_XMIT_STOLEN;
 		return NULL;
+	case TC_ACT_CONSUMED:
+		*ret = __NET_XMIT_STOLEN;
+		return NULL;
 	}
 	return skb;

net/sched/sch_dualpi2.c+5−6

 		if (IS_ERR_OR_NULL(nskb))
 			return qdisc_drop(skb, sch, to_free);
-		cnt = 1;
+		cnt = 0;
 		byte_len = 0;
 		orig_len = qdisc_pkt_len(skb);
 		skb_list_walk_safe(nskb, nskb, next) {
 				byte_len += nskb->len;
 			}
 		}
-		if (cnt > 1) {
+		if (cnt > 0) {
 			/* The caller will add the original skb stats to its
 			 * backlog, compensate this if any nskb is enqueued.
 			 */
-			--cnt;
+			qdisc_tree_reduce_backlog(sch, 1 - cnt,
-			byte_len -= orig_len;
+						  orig_len - byte_len);
 		}
-		qdisc_tree_reduce_backlog(sch, -cnt, -byte_len);
 		consume_skb(skb);
-		return err;
+		return cnt > 0 ? NET_XMIT_SUCCESS : err;
 	}
 	return dualpi2_enqueue_skb(skb, sch, to_free);
 }

net/sched/sch_generic.c+2−5

 		return;
 	if (dev->watchdog_timeo <= 0)
 		dev->watchdog_timeo = 5*HZ;
-	spin_lock_bh(&dev->tx_global_lock);
-	spin_lock(&dev->watchdog_lock);
+	spin_lock_bh(&dev->watchdog_lock);
 	if (!mod_timer(&dev->watchdog_timer,
 		       round_jiffies(jiffies + dev->watchdog_timeo))) {
 		if (!dev->watchdog_ref_held) {
 			dev->watchdog_ref_held = true;
 		}
 	}
-	spin_unlock(&dev->watchdog_lock);
+	spin_unlock_bh(&dev->watchdog_lock);
-	spin_unlock_bh(&dev->tx_global_lock);
 }
 EXPORT_SYMBOL_GPL(netdev_watchdog_up);

net/sctp/diag.c+32−35

@@ -92,6 +92,7 @@ static int inet_diag_msg_sctpladdrs_fill(struct sk_buff *skb, · 91 unmodified lines
92	if (!--addrcnt)	92	if (!--addrcnt)
93	break;	93	break;
94	}	94	}
		95	WARN_ON_ONCE(addrcnt);
95	rcu_read_unlock();	96	rcu_read_unlock();
96		97
97	return 0;	98	return 0;
@@ -373,42 +374,39 @@ static int sctp_ep_dump(struct sctp_endpoint ep, void p) · 275 unmodified lines
373	struct sk_buff *skb = commp->skb;	374	struct sk_buff *skb = commp->skb;
374	struct netlink_callback *cb = commp->cb;	375	struct netlink_callback *cb = commp->cb;
375	const struct inet_diag_req_v2 *r = commp->r;	376	const struct inet_diag_req_v2 *r = commp->r;
376	struct net *net = sock_net(skb->sk);
377	struct inet_sock *inet = inet_sk(sk);	377	struct inet_sock *inet = inet_sk(sk);
378	int err = 0;	378	int err = 0;
379		379
380	if (!net_eq(sock_net(sk), net))	380	lock_sock(sk);
		381	if (ep->base.dead)
381	goto out;	382	goto out;
382		383
383	if (cb->args[4] < cb->args[1])	384	/* Skip eps with assocs if non-LISTEN states were requested, since
384	goto next;	385	* they'll be dumped by sctp_sock_dump() during assoc traversal.
385		386	*/
386	if (!(r->idiag_states & TCPF_LISTEN) && !list_empty(&ep->asocs))	387	if ((r->idiag_states & ~(TCPF_LISTEN \| TCPF_CLOSE)) &&
387	goto next;	388	!list_empty(&ep->asocs))
		389	goto out;
388		390
389	if (r->sdiag_family != AF_UNSPEC &&	391	if (r->sdiag_family != AF_UNSPEC &&
390	sk->sk_family != r->sdiag_family)	392	sk->sk_family != r->sdiag_family)
391	goto next;	393	goto out;
392		394
393	if (r->id.idiag_sport != inet->inet_sport &&	395	if (r->id.idiag_sport != inet->inet_sport &&
394	r->id.idiag_sport)	396	r->id.idiag_sport)
395	goto next;	397	goto out;
396		398
397	if (r->id.idiag_dport != inet->inet_dport &&	399	if (r->id.idiag_dport != inet->inet_dport &&
398	r->id.idiag_dport)	400	r->id.idiag_dport)
399	goto next;
400
401	if (inet_sctp_diag_fill(sk, NULL, skb, r,
402	sk_user_ns(NETLINK_CB(cb->skb).sk),
403	NETLINK_CB(cb->skb).portid,
404	cb->nlh->nlmsg_seq, NLM_F_MULTI,
405	cb->nlh, commp->net_admin) < 0) {
406	err = 2;
407	goto out;	401	goto out;
408	}	402
409	next:	403	err = inet_sctp_diag_fill(sk, NULL, skb, r,
410	cb->args[4]++;	404	sk_user_ns(NETLINK_CB(cb->skb).sk),
		405	NETLINK_CB(cb->skb).portid,
		406	cb->nlh->nlmsg_seq, NLM_F_MULTI,
		407	cb->nlh, commp->net_admin);
411	out:	408	out:
		409	release_sock(sk);
412	return err;	410	return err;
413	}	411	}
414		412
@@ -479,41 +477,40 @@ static void sctp_diag_dump(struct sk_buff skb, struct netlink_callback cb, · 64 unmodified lines
479	.r = r,	477	.r = r,
480	.net_admin = netlink_net_capable(cb->skb, CAP_NET_ADMIN),	478	.net_admin = netlink_net_capable(cb->skb, CAP_NET_ADMIN),
481	};	479	};
482	int pos = cb->args[2];	480	int pos;
483		481
484	/* eps hashtable dumps	482	/* eps hashtable dumps
485	* args:	483	* args:
486	* 0 : if it will traversal listen sock	484	* 0 : if it will traversal listen sock
487	* 1 : to record the sock pos of this time's traversal	485	* 1 : to record the sock pos of this time's traversal
488	* 4 : to work as a temporary variable to traversal list
489	*/	486	*/
490	if (cb->args[0] == 0) {	487	if (cb->args[0] == 0) {
491	if (!(idiag_states & TCPF_LISTEN))	488	if (idiag_states & TCPF_LISTEN) {
492	goto skip;	489	pos = cb->args[1];
493	if (sctp_for_each_endpoint(sctp_ep_dump, &commp))	490	if (sctp_for_each_endpoint(sctp_ep_dump, net, &pos,
494	goto done;	491	&commp)) {
495	skip:	492	cb->args[1] = pos;
		493	return;
		494	}
		495	}
496	cb->args[0] = 1;	496	cb->args[0] = 1;
497	cb->args[1] = 0;	497	cb->args[1] = 0;
498	cb->args[4] = 0;
499	}	498	}
500		499
		500	if (!(idiag_states & ~(TCPF_LISTEN \| TCPF_CLOSE)))
		501	return;
		502
501	/* asocs by transport hashtable dump	503	/* asocs by transport hashtable dump
502	* args:	504	* args:
503	* 1 : to record the assoc pos of this time's traversal	505	* 1 : to record the assoc pos of this time's traversal
504	* 2 : to record the transport pos of this time's traversal	506	* 2 : to record the transport pos of this time's traversal
505	* 3 : to mark if we have dumped the ep info of the current asoc	507	* 3 : to mark if we have dumped the ep info of the current asoc
506	* 4 : to work as a temporary variable to traversal list	508	* 4 : to track position within ep->asocs list in sctp_sock_dump()
507	* 5 : to save the sk we get from travelsing the tsp list.
508	*/	509	*/
509	if (!(idiag_states & ~(TCPF_LISTEN \| TCPF_CLOSE)))	510	pos = cb->args[2];
510	goto done;
511
512	sctp_transport_traverse_process(sctp_sock_filter, sctp_sock_dump,	511	sctp_transport_traverse_process(sctp_sock_filter, sctp_sock_dump,
513	net, &pos, &commp);	512	net, &pos, &commp);
514	cb->args[2] = pos;	513	cb->args[2] = pos;
515
516	done:
517	cb->args[1] = cb->args[4];	514	cb->args[1] = cb->args[4];
518	cb->args[4] = 0;	515	cb->args[4] = 0;
519	}	516	}

net/sctp/sm_statefuns.c+5−0

 	/* Update socket peer label if first association. */
 	if (security_sctp_assoc_request(new_asoc, chunk->skb)) {
 		sctp_association_free(new_asoc);
+		if (err_chunk)
+			sctp_chunk_free(err_chunk);
 		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 	}
 	/* Update socket peer label if first association. */
 	if (security_sctp_assoc_request(new_asoc, chunk->skb)) {
 		sctp_association_free(new_asoc);
+		if (err_chunk)
+			sctp_chunk_free(err_chunk);
 		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 	}
 		 * parameter type.
 		 */
 		sctp_addto_chunk(repl, len, unk_param);
+		sctp_chunk_free(err_chunk);
 	}
 	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));

net/sctp/socket.c+22−7

 }
 int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *),
-			   void *p) {
+			   struct net *net, int *pos, void *p) {
-	int err = 0;
+	int err, hash = 0, idx = 0, start;
-	int hash = 0;
-	struct sctp_endpoint *ep;
 	struct sctp_hashbucket *head;
+	struct sctp_endpoint *ep;
 	for (head = sctp_ep_hashtable; hash < sctp_ep_hashsize;
 	     hash++, head++) {
+		start = idx;
+again:
 		read_lock_bh(&head->lock);
 		sctp_for_each_hentry(ep, &head->chain) {
-			err = cb(ep, p);
+			if (sock_net(ep->base.sk) != net)
-			if (err)
+				continue;
+			if (idx++ >= *pos) {
+				sctp_endpoint_hold(ep);
 				break;
+			}
 		}
 		read_unlock_bh(&head->lock);
+		if (ep) {
+			err = cb(ep, p);
+			sctp_endpoint_put(ep);
+			if (err)
+				return err;
+			(*pos)++;
+			idx = start;
+			goto again;
+		}
 	}
-	return err;
+	return 0;
 }
 EXPORT_SYMBOL_GPL(sctp_for_each_endpoint);

net/tipc/core.c+7−2

 #include "crypto.h"
 #include <linux/module.h>
+#include <linux/wait_bit.h>
 /* configurable TIPC parameters */
 unsigned int tipc_net_id __read_mostly;
 #ifdef CONFIG_TIPC_CRYPTO
 	tipc_crypto_stop(&tipc_net(net)->crypto_tx);
 #endif
-	while (atomic_read(&tn->wq_count))
+	wait_var_event(&tn->wq_count, atomic_read(&tn->wq_count) == 0);
-		cond_resched();
 }
 static void __net_exit tipc_pernet_pre_exit(struct net *net)
 	unregister_pernet_device(&tipc_net_ops);
 	tipc_unregister_sysctl();
+	/* TODO: Wait for all timers that called call_rcu() to finish before
+	 * calling rcu_barrier().
+	 */
+	rcu_barrier();
 	pr_info("Deactivated\n");
 }

net/tipc/crypto.c+9−0

 		goto exit;
 	}
+	/* Get net to avoid freed tipc_crypto when delete namespace */
+	if (!maybe_get_net(net)) {
+		tipc_bearer_put(b);
+		rc = -ENODEV;
+		goto exit;
+	}
 	/* Now, do decrypt */
 	rc = crypto_aead_decrypt(req);
 	if (rc == -EINPROGRESS || rc == -EBUSY)
 		return rc;
 	tipc_bearer_put(b);
+	put_net(net);
 exit:
 	kfree(ctx);
 	}
 	tipc_bearer_put(b);
+	put_net(net);
 }
 static inline int tipc_ehdr_size(struct tipc_ehdr *ehdr)

net/tipc/discover.c+12−2

  * @skb: request message to be (repeatedly) sent
  * @timer: timer governing period between requests
  * @timer_intv: current interval between requests (in ms)
+ * @rcu: RCU head for deferred freeing
  */
 struct tipc_discoverer {
 	u32 bearer_id;
 	struct sk_buff *skb;
 	struct timer_list timer;
 	unsigned long timer_intv;
+	struct rcu_head rcu;
 };
 /**
 	return 0;
 }
+static void tipc_disc_free_rcu(struct rcu_head *rp)
+{
+	struct tipc_discoverer *d = container_of(rp, struct tipc_discoverer,
+						 rcu);
+	kfree_skb(d->skb);
+	kfree(d);
+}
 /**
  * tipc_disc_delete - destroy object sending periodic link setup requests
  * @d: ptr to link dest structure
 void tipc_disc_delete(struct tipc_discoverer *d)
 {
 	timer_shutdown_sync(&d->timer);
-	kfree_skb(d->skb);
+	call_rcu(&d->rcu, tipc_disc_free_rcu);
-	kfree(d);
 }
 /**

net/tipc/udp_media.c+14−5

@@ -40,6 +40,7 @@ · 39 unmodified lines
40	#include <linux/igmp.h>	40	#include <linux/igmp.h>
41	#include <linux/kernel.h>	41	#include <linux/kernel.h>
42	#include <linux/workqueue.h>	42	#include <linux/workqueue.h>
		43	#include <linux/wait_bit.h>
43	#include <linux/list.h>	44	#include <linux/list.h>
44	#include <net/sock.h>	45	#include <net/sock.h>
45	#include <net/ip.h>	46	#include <net/ip.h>
@@ -803,6 +804,14 @@ err: · 757 unmodified lines
803	return err;	804	return err;
804	}	805	}
805		806
		807	static void rcast_free_rcu(struct rcu_head *rcu)
		808	{
		809	struct udp_replicast *rcast = container_of(rcu, struct udp_replicast, rcu);
		810
		811	dst_cache_destroy(&rcast->dst_cache);
		812	kfree(rcast);
		813	}
		814
806	/* cleanup_bearer - break the socket/bearer association */	815	/* cleanup_bearer - break the socket/bearer association */
807	static void cleanup_bearer(struct work_struct *work)	816	static void cleanup_bearer(struct work_struct *work)
808	{	817	{
@@ -811,19 +820,19 @@ static void cleanup_bearer(struct work_struct *work) · 2 unmodified lines
811	struct tipc_net *tn;	820	struct tipc_net *tn;
812		821
813	list_for_each_entry_safe(rcast, tmp, &ub->rcast.list, list) {	822	list_for_each_entry_safe(rcast, tmp, &ub->rcast.list, list) {
814	dst_cache_destroy(&rcast->dst_cache);
815	list_del_rcu(&rcast->list);	823	list_del_rcu(&rcast->list);
816	kfree_rcu(rcast, rcu);	824	call_rcu_hurry(&rcast->rcu, rcast_free_rcu);
817	}	825	}
818		826
819	tn = tipc_net(sock_net(ub->sk));	827	tn = tipc_net(sock_net(ub->sk));
820		828
821	dst_cache_destroy(&ub->rcast.dst_cache);
822	udp_tunnel_sock_release(ub->sk);	829	udp_tunnel_sock_release(ub->sk);
823		830
824	/* Note: could use a call_rcu() to avoid another synchronize_net() */
825	synchronize_net();	831	synchronize_net();
826	atomic_dec(&tn->wq_count);	832
		833	dst_cache_destroy(&ub->rcast.dst_cache);
		834	if (atomic_dec_and_test(&tn->wq_count))
		835	wake_up_var(&tn->wq_count);
827	kfree(ub);	836	kfree(ub);
828	}	837	}
829		838

net/xfrm/espintcp.c+7−27

 	struct sk_msg *skmsg = &emsg->skmsg;
 	bool more = flags & MSG_MORE;
 	struct scatterlist *sg;
-	int done = 0;
 	int ret;
-	sg = &skmsg->sg.data[skmsg->sg.start];
 	do {
 		struct bio_vec bvec;
-		size_t size = sg->length - emsg->offset;
-		int offset = sg->offset + emsg->offset;
-		struct page *p;
-		emsg->offset = 0;
+		sg = &skmsg->sg.data[skmsg->sg.start];
 		if (sg_is_last(sg) && !more)
 			msghdr.msg_flags &= ~MSG_MORE;
-		p = sg_page(sg);
+		bvec_set_page(&bvec, sg_page(sg), sg->length, sg->offset);
-retry:
+		iov_iter_bvec(&msghdr.msg_iter, ITER_SOURCE, &bvec, 1, sg->length);
-		bvec_set_page(&bvec, p, size, offset);
+		ret = tcp_sendmsg_locked(sk, &msghdr, sg->length);
-		iov_iter_bvec(&msghdr.msg_iter, ITER_SOURCE, &bvec, 1, size);
+		if (ret < 0)
-		ret = tcp_sendmsg_locked(sk, &msghdr, size);
-		if (ret < 0) {
-			emsg->offset = offset - sg->offset;
-			skmsg->sg.start += done;
 			return ret;
-		}
-		if (ret != size) {
-			offset += ret;
-			size -= ret;
-			goto retry;
-		}
-		done++;
+		sk_msg_free_partial(sk, skmsg, ret);
-		put_page(p);
+	} while (skmsg->sg.size);
-		sk_mem_uncharge(sk, sg->length);
-		sg = sg_next(sg);
-	} while (sg);
 	memset(emsg, 0, sizeof(*emsg));

net/xfrm/xfrm_input.c+16−13

 {
 	const struct xfrm_state_afinfo *afinfo;
 	struct net *net = dev_net(skb->dev);
+	struct net_device *dev = skb->dev;
 	int err;
 	__be32 seq;
 	__be32 seq_hi;
 					       LINUX_MIB_XFRMINSTATEINVALID);
 			if (encap_type == -1)
-				dev_put(skb->dev);
+				dev_put(dev);
 			goto drop;
 		}
 		if (!crypto_done) {
 			spin_unlock(&x->lock);
-			dev_hold(skb->dev);
+			dev_hold(dev);
 			nexthdr = x->type->input(x, skb);
 			if (nexthdr == -EINPROGRESS) {
 				if (async)
-					dev_put(skb->dev);
+					dev_put(dev);
 				return 0;
 			}
-			dev_put(skb->dev);
+			dev_put(dev);
 			spin_lock(&x->lock);
 		}
 resume:
 		err = xfrm_inner_mode_input(x, skb);
 		if (err == -EINPROGRESS) {
 			if (async)
-				dev_put(skb->dev);
+				dev_put(dev);
 			return 0;
 		} else if (err) {
 			XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEMODEERROR);
 		crypto_done = false;
 	} while (!err);
+	rcu_read_lock();
 	err = xfrm_rcv_cb(skb, family, x->type->proto, 0);
-	if (err)
+	if (err) {
+		rcu_read_unlock();
 		goto drop;
+	}
 	nf_reset_ct(skb);
 		if (skb_valid_dst(skb))
 			skb_dst_drop(skb);
 		if (async)
-			dev_put(skb->dev);
+			dev_put(dev);
 		gro_cells_receive(&gro_cells, skb);
+		rcu_read_unlock();
 		return 0;
 	} else {
 		xo = xfrm_offload(skb);
 			xfrm_gro = xo->flags & XFRM_GRO;
 		err = -EAFNOSUPPORT;
-		rcu_read_lock();
 		afinfo = xfrm_state_afinfo_get_rcu(x->props.family);
 		if (likely(afinfo))
 			err = afinfo->transport_finish(skb, xfrm_gro || async);
-		rcu_read_unlock();
 		if (xfrm_gro) {
 			sp = skb_sec_path(skb);
 			if (sp)
 				sp->olen = 0;
 			if (skb_valid_dst(skb))
 				skb_dst_drop(skb);
-			if (async)
-				dev_put(skb->dev);
 			gro_cells_receive(&gro_cells, skb);
-			return err;
 		}
+		if (async)
+			dev_put(dev);
+		rcu_read_unlock();
 		return err;
 	}
 	spin_unlock(&x->lock);
 drop:
 	if (async)
-		dev_put(skb->dev);
+		dev_put(dev);
 	xfrm_rcv_cb(skb, family, x && x->type ? x->type->proto : nexthdr, -1);
 	kfree_skb(skb);
 	return 0;

net/xfrm/xfrm_interface_core.c+3−0

@@ -869,6 +869,9 @@ static int xfrmi_changelink(struct net_device dev, struct nlattr tb[], · 868 unmodified lines
869	struct net *net = xi->net;	869	struct net *net = xi->net;
870	struct xfrm_if_parms p = {};	870	struct xfrm_if_parms p = {};
871		871
		872	if (!rtnl_dev_link_net_capable(dev, net))
		873	return -EPERM;
		874
872	xfrmi_netlink_parms(data, &p);	875	xfrmi_netlink_parms(data, &p);
873	if (!p.if_id) {	876	if (!p.if_id) {
874	NL_SET_ERR_MSG(extack, "if_id must be non zero");	877	NL_SET_ERR_MSG(extack, "if_id must be non zero");

net/xfrm/xfrm_policy.c+15−12

 bool xfrm_selector_match(const struct xfrm_selector *sel, const struct flowi *fl,
 			 unsigned short family)
 {
+	if (family != sel->family && sel->family != AF_UNSPEC)
+		return false;
 	switch (family) {
 	case AF_INET:
 		return __xfrm4_selector_match(sel, fl);
 static inline int xfrm_bydst_should_resize(struct net *net, int dir, int *total)
 {
-	unsigned int cnt = net->xfrm.policy_count[dir];
+	unsigned int cnt = READ_ONCE(net->xfrm.policy_count[dir]);
 	unsigned int hmask = net->xfrm.policy_bydst[dir].hmask;
 	if (total)
 void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si)
 {
-	si->incnt = net->xfrm.policy_count[XFRM_POLICY_IN];
+	si->incnt = READ_ONCE(net->xfrm.policy_count[XFRM_POLICY_IN]);
-	si->outcnt = net->xfrm.policy_count[XFRM_POLICY_OUT];
+	si->outcnt = READ_ONCE(net->xfrm.policy_count[XFRM_POLICY_OUT]);
-	si->fwdcnt = net->xfrm.policy_count[XFRM_POLICY_FWD];
+	si->fwdcnt = READ_ONCE(net->xfrm.policy_count[XFRM_POLICY_FWD]);
-	si->inscnt = net->xfrm.policy_count[XFRM_POLICY_IN+XFRM_POLICY_MAX];
+	si->inscnt = READ_ONCE(net->xfrm.policy_count[XFRM_POLICY_IN+XFRM_POLICY_MAX]);
-	si->outscnt = net->xfrm.policy_count[XFRM_POLICY_OUT+XFRM_POLICY_MAX];
+	si->outscnt = READ_ONCE(net->xfrm.policy_count[XFRM_POLICY_OUT+XFRM_POLICY_MAX]);
-	si->fwdscnt = net->xfrm.policy_count[XFRM_POLICY_FWD+XFRM_POLICY_MAX];
+	si->fwdscnt = READ_ONCE(net->xfrm.policy_count[XFRM_POLICY_FWD+XFRM_POLICY_MAX]);
 	si->spdhcnt = net->xfrm.policy_idx_hmask;
 	si->spdhmcnt = xfrm_policy_hashmax;
 }
 	}
 	list_add(&pol->walk.all, &net->xfrm.policy_all);
-	net->xfrm.policy_count[dir]++;
+	WRITE_ONCE(net->xfrm.policy_count[dir], net->xfrm.policy_count[dir] + 1);
 	xfrm_pol_hold(pol);
 }
 	}
 	list_del_init(&pol->walk.all);
-	net->xfrm.policy_count[dir]--;
+	WRITE_ONCE(net->xfrm.policy_count[dir], net->xfrm.policy_count[dir] - 1);
 	return pol;
 }
 		/* To accelerate a bit...  */
 		if (!if_id && ((dst_orig->flags & DST_NOXFRM) ||
-			       !net->xfrm.policy_count[XFRM_POLICY_OUT]))
+			       !READ_ONCE(net->xfrm.policy_count[XFRM_POLICY_OUT])))
 			goto nopol;
 		xdst = xfrm_bundle_lookup(net, fl, family, dir, &xflo, if_id);
 nopol:
 	if ((!dst_orig->dev || !(dst_orig->dev->flags & IFF_LOOPBACK)) &&
-	    net->xfrm.policy_default[dir] == XFRM_USERPOLICY_BLOCK) {
+	    READ_ONCE(net->xfrm.policy_default[dir]) == XFRM_USERPOLICY_BLOCK) {
 		err = -EPERM;
 		goto error;
 	}
 		const bool is_crypto_offload = sp &&
 			(xfrm_input_state(skb)->xso.type == XFRM_DEV_OFFLOAD_CRYPTO);
-		if (net->xfrm.policy_default[dir] == XFRM_USERPOLICY_BLOCK) {
+		if (READ_ONCE(net->xfrm.policy_default[dir]) == XFRM_USERPOLICY_BLOCK) {
 			XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOPOLS);
 			return 0;
 		}

net/xfrm/xfrm_state.c+15−8

@@ -1207,9 +1207,11 @@ struct xfrm_state xfrm_input_state_lookup(struct net net, u32 mark, · 1206 unmodified lines
1207	struct hlist_head *state_cache_input;	1207	struct hlist_head *state_cache_input;
1208	struct xfrm_state *x = NULL;	1208	struct xfrm_state *x = NULL;
1209		1209
		1210	/* BH is always disabled on the input path. */
		1211	lockdep_assert_in_softirq();
		1212
1210	state_cache_input = raw_cpu_ptr(net->xfrm.state_cache_input);	1213	state_cache_input = raw_cpu_ptr(net->xfrm.state_cache_input);
1211		1214
1212	rcu_read_lock();
1213	hlist_for_each_entry_rcu(x, state_cache_input, state_cache_input) {	1215	hlist_for_each_entry_rcu(x, state_cache_input, state_cache_input) {
1214	if (x->props.family != family \|\|	1216	if (x->props.family != family \|\|
1215	x->id.spi != spi \|\|	1217	x->id.spi != spi \|\|
@@ -1227,20 +1229,25 @@ struct xfrm_state xfrm_input_state_lookup(struct net net, u32 mark, · 11 unmodified lines
1227	xfrm_hash_ptrs_get(net, &state_ptrs);	1229	xfrm_hash_ptrs_get(net, &state_ptrs);
1228		1230
1229	x = __xfrm_state_lookup(&state_ptrs, mark, daddr, spi, proto, family);	1231	x = __xfrm_state_lookup(&state_ptrs, mark, daddr, spi, proto, family);
1230		1232	if (x) {
1231	if (x && x->km.state == XFRM_STATE_VALID) {	1233	spin_lock(&net->xfrm.xfrm_state_lock);
1232	spin_lock_bh(&net->xfrm.xfrm_state_lock);	1234	if (x->km.state != XFRM_STATE_VALID) {
1233	if (hlist_unhashed(&x->state_cache_input)) {	1235	/*
		1236	* The state is about to be destroyed.
		1237	*
		1238	* Don't add it to the cache but still
		1239	* return it to the caller.
		1240	*/
		1241	} else if (hlist_unhashed(&x->state_cache_input)) {
1234	hlist_add_head_rcu(&x->state_cache_input, state_cache_input);	1242	hlist_add_head_rcu(&x->state_cache_input, state_cache_input);
1235	} else {	1243	} else {
1236	hlist_del_rcu(&x->state_cache_input);	1244	hlist_del_rcu(&x->state_cache_input);
1237	hlist_add_head_rcu(&x->state_cache_input, state_cache_input);	1245	hlist_add_head_rcu(&x->state_cache_input, state_cache_input);
1238	}	1246	}
1239	spin_unlock_bh(&net->xfrm.xfrm_state_lock);	1247	spin_unlock(&net->xfrm.xfrm_state_lock);
1240	}	1248	}
1241		1249
1242	out:	1250	out:
1243	rcu_read_unlock();
1244	return x;	1251	return x;
1245	}	1252	}
1246	EXPORT_SYMBOL(xfrm_input_state_lookup);	1253	EXPORT_SYMBOL(xfrm_input_state_lookup);
@@ -3014,7 +3021,7 @@ int xfrm_user_policy(struct sock *sk, int optname, sockptr_t optval, int optlen) · 1767 unmodified lines
3014	if (IS_ERR(data))	3021	if (IS_ERR(data))
3015	return PTR_ERR(data);	3022	return PTR_ERR(data);
3016		3023
3017	if (in_compat_syscall()) {	3024	if (IS_ENABLED(CONFIG_COMPAT_FOR_U64_ALIGNMENT) && in_compat_syscall()) {
3018	struct xfrm_translator *xtr = xfrm_get_translator();	3025	struct xfrm_translator *xtr = xfrm_get_translator();
3019		3026
3020	if (!xtr) {	3027	if (!xtr) {

net/xfrm/xfrm_user.c+10−10

@@ -2511,9 +2511,9 @@ static int xfrm_notify_userpolicy(struct net *net) · 2510 unmodified lines
2511	}	2511	}
2512		2512
2513	up = nlmsg_data(nlh);	2513	up = nlmsg_data(nlh);
2514	up->in = net->xfrm.policy_default[XFRM_POLICY_IN];	2514	up->in = READ_ONCE(net->xfrm.policy_default[XFRM_POLICY_IN]);
2515	up->fwd = net->xfrm.policy_default[XFRM_POLICY_FWD];	2515	up->fwd = READ_ONCE(net->xfrm.policy_default[XFRM_POLICY_FWD]);
2516	up->out = net->xfrm.policy_default[XFRM_POLICY_OUT];	2516	up->out = READ_ONCE(net->xfrm.policy_default[XFRM_POLICY_OUT]);
2517		2517
2518	nlmsg_end(skb, nlh);	2518	nlmsg_end(skb, nlh);
2519		2519
@@ -2537,13 +2537,13 @@ static int xfrm_set_default(struct sk_buff skb, struct nlmsghdr nlh, · 17 unmodified lines
2537	struct xfrm_userpolicy_default *up = nlmsg_data(nlh);	2537	struct xfrm_userpolicy_default *up = nlmsg_data(nlh);
2538		2538
2539	if (xfrm_userpolicy_is_valid(up->in))	2539	if (xfrm_userpolicy_is_valid(up->in))
2540	net->xfrm.policy_default[XFRM_POLICY_IN] = up->in;	2540	WRITE_ONCE(net->xfrm.policy_default[XFRM_POLICY_IN], up->in);
2541		2541
2542	if (xfrm_userpolicy_is_valid(up->fwd))	2542	if (xfrm_userpolicy_is_valid(up->fwd))
2543	net->xfrm.policy_default[XFRM_POLICY_FWD] = up->fwd;	2543	WRITE_ONCE(net->xfrm.policy_default[XFRM_POLICY_FWD], up->fwd);
2544		2544
2545	if (xfrm_userpolicy_is_valid(up->out))	2545	if (xfrm_userpolicy_is_valid(up->out))
2546	net->xfrm.policy_default[XFRM_POLICY_OUT] = up->out;	2546	WRITE_ONCE(net->xfrm.policy_default[XFRM_POLICY_OUT], up->out);
2547		2547
2548	rt_genid_bump_all(net);	2548	rt_genid_bump_all(net);
2549		2549
@@ -2573,9 +2573,9 @@ static int xfrm_get_default(struct sk_buff skb, struct nlmsghdr nlh, · 23 unmodified lines
2573	}	2573	}
2574		2574
2575	r_up = nlmsg_data(r_nlh);	2575	r_up = nlmsg_data(r_nlh);
2576	r_up->in = net->xfrm.policy_default[XFRM_POLICY_IN];	2576	r_up->in = READ_ONCE(net->xfrm.policy_default[XFRM_POLICY_IN]);
2577	r_up->fwd = net->xfrm.policy_default[XFRM_POLICY_FWD];	2577	r_up->fwd = READ_ONCE(net->xfrm.policy_default[XFRM_POLICY_FWD]);
2578	r_up->out = net->xfrm.policy_default[XFRM_POLICY_OUT];	2578	r_up->out = READ_ONCE(net->xfrm.policy_default[XFRM_POLICY_OUT]);
2579	nlmsg_end(r_skb, r_nlh);	2579	nlmsg_end(r_skb, r_nlh);
2580		2580
2581	return nlmsg_unicast(xfrm_net_nlsk(net, skb), r_skb, portid);	2581	return nlmsg_unicast(xfrm_net_nlsk(net, skb), r_skb, portid);
@@ -3835,7 +3835,7 @@ static int xfrm_user_rcv_msg(struct sk_buff skb, struct nlmsghdr nlh, · 1253 unmodified lines
3835	if (!netlink_net_capable(skb, CAP_NET_ADMIN))	3835	if (!netlink_net_capable(skb, CAP_NET_ADMIN))
3836	return -EPERM;	3836	return -EPERM;
3837		3837
3838	if (in_compat_syscall()) {	3838	if (IS_ENABLED(CONFIG_COMPAT_FOR_U64_ALIGNMENT) && in_compat_syscall()) {
3839	struct xfrm_translator *xtr = xfrm_get_translator();	3839	struct xfrm_translator *xtr = xfrm_get_translator();
3840		3840
3841	if (!xtr)	3841	if (!xtr)

tools/net/ynl/Makefile+1−1

@@ -22,7 +22,7 @@ tests: \| lib generated libynl.a · 21 unmodified lines
22	ynltool: \| lib generated libynl.a	22	ynltool: \| lib generated libynl.a
23	libynl.a: \| lib generated	23	libynl.a: \| lib generated
24	@echo -e "\tAR $@"	24	@echo -e "\tAR $@"
25	@ar rcs $@ lib/ynl.o generated/*-user.o	25	@$(AR) rcs $@ lib/ynl.o generated/*-user.o
26		26
27	$(SUBDIRS):	27	$(SUBDIRS):
28	@if [ -f "$@/Makefile" ] ; then \	28	@if [ -f "$@/Makefile" ] ; then \

tools/net/ynl/Makefile.deps+2−0

 get_hdr_inc=-D$(1) -include $(UAPI_PATH)/linux/$(2)
 get_hdr_inc2=-D$(1) -D$(2) -include $(UAPI_PATH)/linux/$(3)
+get_hdr_inc_drm=-D$(1) -include $(UAPI_PATH)/drm/$(2)
 CFLAGS_dev-energymodel:=$(call get_hdr_inc,_LINUX_DEV_ENERGYMODEL_H,dev_energymodel.h)
 CFLAGS_devlink:=$(call get_hdr_inc,_LINUX_DEVLINK_H_,devlink.h)
 CFLAGS_dpll:=$(call get_hdr_inc,_LINUX_DPLL_H,dpll.h)
+CFLAGS_drm_ras:=$(call get_hdr_inc_drm,_LINUX_DRM_RAS_H,drm_ras.h)
 CFLAGS_ethtool:=$(call get_hdr_inc,_LINUX_TYPELIMITS_H,typelimits.h) \
 	$(call get_hdr_inc,_LINUX_ETHTOOL_H,ethtool.h) \
 	$(call get_hdr_inc,_LINUX_ETHTOOL_NETLINK_H_,ethtool_netlink.h) \

tools/net/ynl/generated/Makefile+1−1

@@ -37,7 +37,7 @@ all: protos.a $(HDRS) $(SRCS) $(KHDRS) $(KSRCS) $(UAPI) $(RSTS) · 36 unmodified lines
37		37
38	protos.a: $(OBJS)	38	protos.a: $(OBJS)
39	@echo -e "\tAR $@"	39	@echo -e "\tAR $@"
40	@ar rcs $@ $(OBJS)	40	@$(AR) rcs $@ $(OBJS)
41		41
42	%-user.h: $(SPECS_DIR)/%.yaml $(TOOL)	42	%-user.h: $(SPECS_DIR)/%.yaml $(TOOL)
43	@echo -e "\tGEN $@"	43	@echo -e "\tGEN $@"

tools/net/ynl/lib/Makefile+1−1

@@ -15,7 +15,7 @@ all: ynl.a · 14 unmodified lines
15		15
16	ynl.a: $(OBJS)	16	ynl.a: $(OBJS)
17	@echo -e "\tAR $@"	17	@echo -e "\tAR $@"
18	@ar rcs $@ $(OBJS)	18	@$(AR) rcs $@ $(OBJS)
19		19
20	clean:	20	clean:
21	rm -f .o .d *~	21	rm -f .o .d *~

tools/testing/selftests/bpf/config+3−0

 CONFIG_IPV6_FOU=y
 CONFIG_IPV6_FOU_TUNNEL=y
 CONFIG_IPV6_GRE=y
+CONFIG_IPV6_IOAM6_LWTUNNEL=y
 CONFIG_IPV6_SEG6_BPF=y
+CONFIG_IPV6_SEG6_LWTUNNEL=y
 CONFIG_IPV6_SIT=y
 CONFIG_IPV6_TUNNEL=y
 CONFIG_KEYS=y
 CONFIG_LIRC=y
 CONFIG_LIVEPATCH=y
 CONFIG_LWTUNNEL=y
+CONFIG_LWTUNNEL_BPF=y
 CONFIG_MODULE_SIG=y
 CONFIG_MODULE_SRCVERSION_ALL=y
 CONFIG_MODULE_UNLOAD=y

tools/testing/selftests/bpf/prog_tests/test_xsk.c+54−42

 #include <linux/netdev.h>
 #include <poll.h>
 #include <pthread.h>
-#include <signal.h>
 #include <string.h>
 #include <sys/mman.h>
 #include <sys/socket.h>
 	eth_hdr->h_proto = htons(ETH_P_LOOPBACK);
 }
-static bool is_umem_valid(struct xsk_socket_info *xsk)
-{
-	return !!xsk->umem->umem;
-}
 static u32 mode_to_xdp_flags(enum test_mode mode)
 {
 	return (mode == TEST_MODE_SKB) ? XDP_FLAGS_SKB_MODE : XDP_FLAGS_DRV_MODE;
 			return TEST_FAILURE;
 		if (!ret) {
-			if (!is_umem_valid(test->ifobj_tx->xsk))
+			if (test->poll_tmout)
 				return TEST_PASS;
 			ksft_print_msg("ERROR: [%s] Poll timed out\n", __func__);
 			break;
 		res = __receive_pkts(test, xsk);
-		if (!(res == TEST_PASS || res == TEST_CONTINUE))
+		if (res != TEST_CONTINUE)
 			return res;
 		ret = gettimeofday(&tv_now, NULL);
 	return TEST_PASS;
 }
-static int __send_pkts(struct ifobject *ifobject, struct xsk_socket_info *xsk, bool timeout)
+static int __send_pkts(struct ifobject *ifobject, struct xsk_socket_info *xsk,
+		       bool test_timeout)
 {
 	u32 i, idx = 0, valid_pkts = 0, valid_frags = 0, buffer_len;
 	struct pkt_stream *pkt_stream = xsk->pkt_stream;
 	buffer_len = pkt_get_buffer_len(umem, pkt_stream->max_pkt_len);
 	/* pkts_in_flight might be negative if many invalid packets are sent */
 	if (pkts_in_flight >= (int)((umem_size(umem) - xsk->batch_size * buffer_len) /
-	    buffer_len)) {
+	    buffer_len) && !test_timeout) {
 		ret = kick_tx(xsk);
 		if (ret)
 			return TEST_FAILURE;
 	while (xsk_ring_prod__reserve(&xsk->tx, xsk->batch_size, &idx) < xsk->batch_size) {
 		if (use_poll) {
 			ret = poll(&fds, 1, POLL_TMOUT);
-			if (timeout) {
+			if (test_timeout) {
 				if (ret < 0) {
 					ksft_print_msg("ERROR: [%s] Poll error %d\n",
 						       __func__, errno);
 	if (use_poll) {
 		ret = poll(&fds, 1, POLL_TMOUT);
 		if (ret <= 0) {
-			if (ret == 0 && timeout)
+			if (ret == 0 && test_timeout)
 				return TEST_PASS;
 			ksft_print_msg("ERROR: [%s] Poll error %d\n", __func__, ret);
 		}
 	}
-	if (!timeout) {
+	if (!test_timeout) {
 		if (complete_pkts(xsk, i))
 			return TEST_FAILURE;
 		usleep(10);
-		return TEST_PASS;
 	}
+	/* Loop completion is driven by send_pkts() stream progress checks. */
 	return TEST_CONTINUE;
 }
 static int send_pkts(struct test_spec *test, struct ifobject *ifobject)
 {
-	bool timeout = !is_umem_valid(test->ifobj_rx->xsk);
 	DECLARE_BITMAP(bitmap, test->nb_sockets);
 	u32 i, ret;
 				__set_bit(i, bitmap);
 				continue;
 			}
-			ret = __send_pkts(ifobject, &ifobject->xsk_arr[i], timeout);
+			ret = __send_pkts(ifobject, &ifobject->xsk_arr[i], test->poll_tmout);
-			if (ret == TEST_CONTINUE && !test->fail)
+			if (ret != TEST_CONTINUE)
-				continue;
-			if ((ret || test->fail) && !timeout)
-				return TEST_FAILURE;
-			if (ret == TEST_PASS && timeout)
 				return ret;
-			ret = wait_for_tx_completion(&ifobject->xsk_arr[i]);
+			if (test->fail)
-			if (ret)
 				return TEST_FAILURE;
+			if (!test->poll_tmout) {
+				ret = wait_for_tx_completion(&ifobject->xsk_arr[i]);
+				if (ret)
+					return TEST_FAILURE;
+			}
 		}
 	}
 				       strerror(-err));
 	}
-	pthread_barrier_wait(&barr);
+	if (test->use_barrier)
+		pthread_barrier_wait(&barr);
 	/* We leave only now in case of error to avoid getting stuck in the barrier */
 	if (err) {
 	munmap(umem->buffer, umem->mmap_size);
 }
-static void handler(int signum)
-{
-	pthread_exit(NULL);
-}
 static bool xdp_prog_changed_rx(struct test_spec *test)
 {
 	struct ifobject *ifobj = test->ifobj_rx;
 		return TEST_FAILURE;
 	}
-	if (ifobj2) {
+	err = xsk_attach_xdp_progs(test, ifobj1, ifobj2);
+	if (err) {
+		ksft_print_msg("Error: failed to attach XDP programs: %d (%s)\n",
+			       err, strerror(-err));
+		return TEST_FAILURE;
+	}
+	test->use_barrier = !!ifobj2;
+	if (test->use_barrier) {
 		if (pthread_barrier_init(&barr, NULL, 2))
 			return TEST_FAILURE;
 		pkt_stream_reset(ifobj2->xsk->pkt_stream);
 	}
 	pkt_stream_reset(ifobj1->xsk->pkt_stream);
 	pkts_in_flight = 0;
-	signal(SIGUSR1, handler);
 	/*Spawn RX thread */
 	pthread_create(&t0, NULL, ifobj1->func_ptr, test);
-	if (ifobj2) {
+	if (test->use_barrier) {
 		pthread_barrier_wait(&barr);
 		if (pthread_barrier_destroy(&barr)) {
-			pthread_kill(t0, SIGUSR1);
+			test->use_barrier = false;
+			pthread_join(t0, NULL);
 			clean_sockets(test, ifobj1);
 			clean_umem(test, ifobj1, NULL);
 			return TEST_FAILURE;
 		}
+	}
+	if (ifobj2) {
 		/*Spawn TX thread */
 		pthread_create(&t1, NULL, ifobj2->func_ptr, test);
 		pthread_join(t1, NULL);
 	}
-	if (!ifobj2)
-		pthread_kill(t0, SIGUSR1);
 	pthread_join(t0, NULL);
 	if (test->total_steps == test->current_step || test->fail) {
 		}
 	}
-	if (xsk_attach_xdp_progs(test, ifobj_rx, ifobj_tx))
-		return TEST_FAILURE;
 	return __testapp_validate_traffic(test, ifobj_rx, ifobj_tx);
 }
 int testapp_poll_txq_tmout(struct test_spec *test)
 {
+	bool shared_umem = test->ifobj_tx->shared_umem;
+	int ret;
+	test->poll_tmout = true;
+	/*
+	 * POLL_TXQ_FULL exercises TX timeout setup in isolation.
+	 * Keep TX out of shared-UMEM mode here so TX setup does not require
+	 * RX UMEM to be initialized first.
+	 */
+	test->ifobj_tx->shared_umem = false;
 	test->ifobj_tx->use_poll = true;
 	/* create invalid frame by set umem frame_size and pkt length equal to 2048 */
 	test->ifobj_tx->xsk->umem->frame_size = 2048;
-	if (pkt_stream_replace(test, 2 * DEFAULT_PKT_CNT, 2048))
+	if (pkt_stream_replace(test, 2 * DEFAULT_PKT_CNT, 2048)) {
+		test->ifobj_tx->shared_umem = shared_umem;
 		return TEST_FAILURE;
-	return testapp_validate_traffic_single_thread(test, test->ifobj_tx);
+	}
+	ret = testapp_validate_traffic_single_thread(test, test->ifobj_tx);
+	test->ifobj_tx->shared_umem = shared_umem;
+	return ret;
 }
 int testapp_poll_rxq_tmout(struct test_spec *test)
 {
+	test->poll_tmout = true;
 	test->ifobj_rx->use_poll = true;
 	return testapp_validate_traffic_single_thread(test, test->ifobj_rx);
 }

tools/testing/selftests/bpf/prog_tests/test_xsk.h+2−0

 	bool set_ring;
 	bool adjust_tail;
 	bool adjust_tail_support;
+	bool poll_tmout;
+	bool use_barrier;
 	enum test_mode mode;
 	char name[MAX_TEST_NAME_SIZE];
 };

tools/testing/selftests/bpf/prog_tests/xdp_context_test_run.c+175−0

@@ -1,6 +1,8 @@
1	// SPDX-License-Identifier: GPL-2.0	1	// SPDX-License-Identifier: GPL-2.0
2	#include <test_progs.h>	2	#include <test_progs.h>
3	#include <network_helpers.h>	3	#include <network_helpers.h>
		4	#include <linux/ipv6.h>
		5	#include <arpa/inet.h>
4	#include "test_xdp_context_test_run.skel.h"	6	#include "test_xdp_context_test_run.skel.h"
5	#include "test_xdp_meta.skel.h"	7	#include "test_xdp_meta.skel.h"
6		8
@@ -8,9 +10,12 @@ · 1 unmodified line
8	#define TX_NAME "veth1"	10	#define TX_NAME "veth1"
9	#define TX_NETNS "xdp_context_tx"	11	#define TX_NETNS "xdp_context_tx"
10	#define RX_NETNS "xdp_context_rx"	12	#define RX_NETNS "xdp_context_rx"
		13	#define RX_MAC "02:00:00:00:00:01"
		14	#define TX_MAC "02:00:00:00:00:02"
11	#define TAP_NAME "tap0"	15	#define TAP_NAME "tap0"
12	#define DUMMY_NAME "dum0"	16	#define DUMMY_NAME "dum0"
13	#define TAP_NETNS "xdp_context_tuntap"	17	#define TAP_NETNS "xdp_context_tuntap"
		18	#define LWT_NETNS "xdp_context_lwt"
14		19
15	#define TEST_PAYLOAD_LEN 32	20	#define TEST_PAYLOAD_LEN 32
16	static const __u8 test_payload[TEST_PAYLOAD_LEN] = {	21	static const __u8 test_payload[TEST_PAYLOAD_LEN] = {
@@ -187,6 +192,42 @@ static int write_test_packet(int tap_fd) · 170 unmodified lines
187	return 0;	192	return 0;
188	}	193	}
189		194
		195	/* Inject Ethernet+IPv6+UDP frame into TAP */
		196	static int write_test_packet_udp(int tap_fd)
		197	{
		198	__u8 pkt[sizeof(struct ethhdr) + sizeof(struct ipv6hdr) +
		199	sizeof(struct udphdr) + TEST_PAYLOAD_LEN] = {};
		200	struct ethhdr eth = (void )pkt;
		201	struct ipv6hdr ip6 = (void )(eth + 1);
		202	struct udphdr udp = (void )(ip6 + 1);
		203	__u8 payload = (void )(udp + 1);
		204	const __u8 tap_mac[ETH_ALEN] = { 0x02, 0, 0, 0, 0, 0x01 };
		205	int n;
		206
		207	memcpy(eth->h_dest, tap_mac, ETH_ALEN);
		208	eth->h_proto = htons(ETH_P_IPV6);
		209
		210	ip6->version = 6;
		211	ip6->hop_limit = 64;
		212	ip6->nexthdr = IPPROTO_UDP;
		213	ip6->payload_len = htons(sizeof(*udp) + TEST_PAYLOAD_LEN);
		214	inet_pton(AF_INET6, "fd00::2", &ip6->saddr);
		215	inet_pton(AF_INET6, "fd00:1::1", &ip6->daddr);
		216
		217	udp->source = htons(42);
		218	udp->dest = htons(42);
		219	udp->len = htons(sizeof(*udp) + TEST_PAYLOAD_LEN);
		220	/* UDP checksum is not validated on the forwarding path. */
		221
		222	memcpy(payload, test_payload, TEST_PAYLOAD_LEN);
		223
		224	n = write(tap_fd, pkt, sizeof(pkt));
		225	if (!ASSERT_EQ(n, sizeof(pkt), "write frame"))
		226	return -1;
		227
		228	return 0;
		229	}
		230
190	static void dump_err_stream(const struct bpf_program *prog)	231	static void dump_err_stream(const struct bpf_program *prog)
191	{	232	{
192	char buf[512];	233	char buf[512];
@@ -518,3 +559,137 @@ void test_xdp_context_tuntap(void) · 325 unmodified lines
518		559
519	test_xdp_meta__destroy(skel);	560	test_xdp_meta__destroy(skel);
520	}	561	}
		562
		563	/*
		564	* Test topology:
		565	*
		566	* tap0 fd00::1
		567	* RX: injected IPv6 UDP frame, XDP ingress sets metadata
		568	* fwd: encap route prepends outer header(s)
		569	* TX: TC egress validates metadata
		570	*
		571	* A routable IPv6 UDP frame is written into the tap fd, so it enters the RX
		572	* path where XDP stores metadata. Routing then forwards it back out the same
		573	* tap through an encapsulating route that prepends outer header(s). The TC
		574	* egress program checks that the pushed header did not silently corrupt
		575	* metadata.
		576	*/
		577	#define LWT_PIN_PATH "/sys/fs/bpf/xdp_context_lwt_xmit"
		578
		579	enum lwt_encap_type {
		580	LWT_ENCAP_BPF,
		581	LWT_ENCAP_MPLS,
		582	LWT_ENCAP_SEG6,
		583	LWT_ENCAP_IOAM6,
		584	};
		585
		586	static void test_lwt_encap(struct test_xdp_meta *skel,
		587	enum lwt_encap_type type)
		588	{
		589	LIBBPF_OPTS(bpf_tc_hook, tc_hook, .attach_point = BPF_TC_EGRESS);
		590	LIBBPF_OPTS(bpf_tc_opts, tc_opts, .handle = 1, .priority = 1);
		591	struct bpf_program *lwt_prog = NULL;
		592	struct netns_obj *ns = NULL;
		593	const char *encap;
		594	bool pinned = false;
		595	int tap_ifindex;
		596	int tap_fd = -1;
		597	int ret;
		598
		599	skel->bss->test_pass = false;
		600
		601	switch (type) {
		602	case LWT_ENCAP_BPF:
		603	encap = "encap bpf xmit pinned " LWT_PIN_PATH " via fd00::2";
		604	lwt_prog = skel->progs.dummy_lwt_xmit;
		605	break;
		606	case LWT_ENCAP_MPLS:
		607	encap = "encap mpls 100 via inet6 fd00::2";
		608	break;
		609	case LWT_ENCAP_SEG6:
		610	encap = "encap seg6 mode encap segs fd00::2";
		611	break;
		612	case LWT_ENCAP_IOAM6:
		613	encap = "encap ioam6 mode encap tundst fd00::2 "
		614	"trace prealloc type 0x800000 ns 0 size 4 via fd00::2";
		615	break;
		616	default:
		617	return;
		618	}
		619
		620	if (lwt_prog) {
		621	unlink(LWT_PIN_PATH);
		622	ret = bpf_program__pin(lwt_prog, LWT_PIN_PATH);
		623	if (!ASSERT_OK(ret, "pin lwt prog"))
		624	return;
		625	pinned = true;
		626	}
		627
		628	ns = netns_new(LWT_NETNS, true);
		629	if (!ASSERT_OK_PTR(ns, "netns_new"))
		630	goto close;
		631
		632	tap_fd = open_tuntap(TAP_NAME, true);
		633	if (!ASSERT_GE(tap_fd, 0, "open_tuntap"))
		634	goto close;
		635
		636	SYS(close, "ip link set dev " TAP_NAME " address " RX_MAC);
		637	SYS(close, "sysctl -wq net.ipv6.conf.all.forwarding=1");
		638	SYS(close, "ip addr add fd00::1/64 dev " TAP_NAME " nodad");
		639	SYS(close, "ip link set dev " TAP_NAME " up");
		640	SYS(close, "ip neigh add fd00::2 lladdr " TX_MAC " nud permanent dev " TAP_NAME);
		641	SYS(close, "ip -6 route add fd00:1::/64 %s dev %s", encap, TAP_NAME);
		642
		643	tap_ifindex = if_nametoindex(TAP_NAME);
		644	if (!ASSERT_GE(tap_ifindex, 0, "if_nametoindex"))
		645	goto close;
		646
		647	ret = bpf_xdp_attach(tap_ifindex, bpf_program__fd(skel->progs.ing_xdp),
		648	0, NULL);
		649	if (!ASSERT_GE(ret, 0, "bpf_xdp_attach"))
		650	goto close;
		651
		652	tc_hook.ifindex = tap_ifindex;
		653	ret = bpf_tc_hook_create(&tc_hook);
		654	if (!ASSERT_OK(ret, "bpf_tc_hook_create"))
		655	goto close;
		656
		657	tc_opts.prog_fd = bpf_program__fd(skel->progs.tc_is_meta_empty);
		658	ret = bpf_tc_attach(&tc_hook, &tc_opts);
		659	if (!ASSERT_OK(ret, "bpf_tc_attach"))
		660	goto close;
		661
		662	ret = write_test_packet_udp(tap_fd);
		663	if (!ASSERT_OK(ret, "write_test_packet_udp"))
		664	goto close;
		665
		666	if (!ASSERT_TRUE(skel->bss->test_pass, "test_pass"))
		667	dump_err_stream(skel->progs.tc_is_meta_empty);
		668
		669	close:
		670	if (tap_fd >= 0)
		671	close(tap_fd);
		672	netns_free(ns);
		673	if (pinned)
		674	unlink(LWT_PIN_PATH);
		675	}
		676
		677	void test_xdp_context_lwt_encap(void)
		678	{
		679	struct test_xdp_meta *skel;
		680
		681	skel = test_xdp_meta__open_and_load();
		682	if (!ASSERT_OK_PTR(skel, "open and load skeleton"))
		683	return;
		684
		685	if (test__start_subtest("bpf_encap"))
		686	test_lwt_encap(skel, LWT_ENCAP_BPF);
		687	if (test__start_subtest("mpls_encap"))
		688	test_lwt_encap(skel, LWT_ENCAP_MPLS);
		689	if (test__start_subtest("seg6_encap"))
		690	test_lwt_encap(skel, LWT_ENCAP_SEG6);
		691	if (test__start_subtest("ioam6_encap"))
		692	test_lwt_encap(skel, LWT_ENCAP_IOAM6);
		693
		694	test_xdp_meta__destroy(skel);
		695	}

tools/testing/selftests/bpf/progs/test_xdp_meta.c+71−52

 bool test_pass;
-static const __u8 smac_want[ETH_ALEN] = {
-	0x12, 0x34, 0xDE, 0xAD, 0xBE, 0xEF,
-};
 static const __u8 meta_want[META_SIZE] = {
 	0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
 	0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18,
 	0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38,
 };
-static bool check_smac(const struct ethhdr *eth)
-{
-	return !__builtin_memcmp(eth->h_source, smac_want, ETH_ALEN);
-}
 static bool check_metadata(const char *file, int line, __u8 *meta_have)
 {
 	if (!__builtin_memcmp(meta_have, meta_want, META_SIZE))
 	return TC_ACT_SHOT;
 }
+/* Test packets carry test metadata pattern as payload. */
+static bool is_test_packet_xdp(struct xdp_md *ctx)
+{
+	__u8 meta_have[META_SIZE];
+	__u32 len;
+	len = bpf_xdp_get_buff_len(ctx);
+	if (len < META_SIZE)
+		return false;
+	if (bpf_xdp_load_bytes(ctx, len - META_SIZE, meta_have, META_SIZE))
+		return false;
+	if (__builtin_memcmp(meta_have, meta_want, META_SIZE))
+		return false;
+	return true;
+}
+/* Test packets carry test metadata pattern as payload. */
+static bool is_test_packet_tc(struct __sk_buff *ctx)
+{
+	__u8 meta_have[META_SIZE];
+	if (ctx->len < META_SIZE)
+		return false;
+	if (bpf_skb_load_bytes(ctx, ctx->len - META_SIZE, meta_have, META_SIZE))
+		return false;
+	if (__builtin_memcmp(meta_have, meta_want, META_SIZE))
+		return false;
+	return true;
+}
 /* Reserve and clear space for metadata but don't populate it */
 SEC("xdp")
 int ing_xdp_zalloc_meta(struct xdp_md *ctx)
 {
-	struct ethhdr *eth = ctx_ptr(ctx, data);
 	__u8 *meta;
 	int ret;
 	/* Drop any non-test packets */
-	if (eth + 1 > ctx_ptr(ctx, data_end))
+	if (!is_test_packet_xdp(ctx))
-		return XDP_DROP;
-	if (!check_smac(eth))
 		return XDP_DROP;
 	ret = bpf_xdp_adjust_meta(ctx, -META_SIZE);
 SEC("xdp")
 int ing_xdp(struct xdp_md *ctx)
 {
-	__u8 *data, *data_meta, *data_end, *payload;
+	__u8 *data, *data_meta;
-	struct ethhdr *eth;
 	int ret;
+	/* Drop any non-test packets */
+	if (!is_test_packet_xdp(ctx))
+		return XDP_DROP;
 	ret = bpf_xdp_adjust_meta(ctx, -META_SIZE);
 	if (ret < 0)
 		return XDP_DROP;
 	data_meta = ctx_ptr(ctx, data_meta);
-	data_end  = ctx_ptr(ctx, data_end);
 	data      = ctx_ptr(ctx, data);
-	eth = (struct ethhdr *)data;
+	if (data_meta + META_SIZE > data)
-	payload = data + sizeof(struct ethhdr);
-	if (payload + META_SIZE > data_end ||
-	    data_meta + META_SIZE > data)
 		return XDP_DROP;
-	/* The Linux networking stack may send other packets on the test
+	__builtin_memcpy(data_meta, meta_want, META_SIZE);
-	 * interface that interfere with the test. Just drop them.
-	 * The test packets can be recognized by their source MAC address.
-	 */
-	if (!check_smac(eth))
-		return XDP_DROP;
-	__builtin_memcpy(data_meta, payload, META_SIZE);
 	return XDP_PASS;
 }
 	if (eth + 1 > ctx_ptr(ctx, data_end))
 		goto out;
 	/* Ignore non-test packets */
-	if (!check_smac(eth))
+	if (!is_test_packet_tc(ctx))
 		goto out;
 	if (meta_have + META_SIZE > eth)
 	if (eth + 1 > ctx_ptr(ctx, data_end))
 		goto out;
 	/* Ignore non-test packets */
-	if (!check_smac(eth))
+	if (!is_test_packet_tc(ctx))
 		goto out;
 	if (meta_have + META_SIZE > eth)
 	if (!eth)
 		goto out;
 	/* Ignore non-test packets */
-	if (!check_smac(eth))
+	if (!is_test_packet_tc(ctx))
 		goto out;
 	bpf_dynptr_from_skb_meta(ctx, 0, &meta);
 SEC("tc")
 int clone_meta_dynptr_survives_meta_slice_write(struct __sk_buff *ctx)
 {
-	struct bpf_dynptr data, meta;
+	struct bpf_dynptr meta;
-	const struct ethhdr *eth;
 	__u8 *meta_have;
-	bpf_dynptr_from_skb(ctx, 0, &data);
-	eth = bpf_dynptr_slice(&data, 0, NULL, sizeof(*eth));
-	if (!eth)
-		goto out;
 	/* Ignore non-test packets */
-	if (!check_smac(eth))
+	if (!is_test_packet_tc(ctx))
 		goto out;
 	bpf_dynptr_from_skb_meta(ctx, 0, &meta);
 {
 	struct bpf_dynptr data, meta;
 	__u8 meta_have[META_SIZE];
-	const struct ethhdr *eth;
 	int err;
-	bpf_dynptr_from_skb(ctx, 0, &data);
-	eth = bpf_dynptr_slice(&data, 0, NULL, sizeof(*eth));
-	if (!eth)
-		goto out;
 	/* Ignore non-test packets */
-	if (!check_smac(eth))
+	if (!is_test_packet_tc(ctx))
 		goto out;
 	/* Expect read-write metadata before unclone */
 		goto out;
 	/* Helper write to payload will unclone the packet */
+	bpf_dynptr_from_skb(ctx, 0, &data);
 	bpf_dynptr_write(&data, offsetof(struct ethhdr, h_proto), "x", 1, 0);
 	err = bpf_dynptr_read(meta_have, META_SIZE, &meta, 0, 0);
 SEC("tc")
 int clone_meta_dynptr_rw_before_meta_dynptr_write(struct __sk_buff *ctx)
 {
-	struct bpf_dynptr data, meta;
+	struct bpf_dynptr meta;
 	__u8 meta_have[META_SIZE];
-	const struct ethhdr *eth;
 	int err;
-	bpf_dynptr_from_skb(ctx, 0, &data);
-	eth = bpf_dynptr_slice(&data, 0, NULL, sizeof(*eth));
-	if (!eth)
-		goto out;
 	/* Ignore non-test packets */
-	if (!check_smac(eth))
+	if (!is_test_packet_tc(ctx))
 		goto out;
 	/* Expect read-write metadata before unclone */
 	return TC_ACT_SHOT;
 }
+SEC("lwt_xmit")
+int dummy_lwt_xmit(struct __sk_buff *ctx)
+{
+	if (bpf_skb_change_head(ctx, sizeof(struct ipv6hdr), 0))
+		return BPF_DROP;
+	return BPF_OK;
+}
+SEC("tc")
+int tc_is_meta_empty(struct __sk_buff *ctx)
+{
+	if (!is_test_packet_tc(ctx))
+		return TC_ACT_OK;
+	if (ctx->data_meta != ctx->data)
+		return TC_ACT_OK;
+	test_pass = true;
+	return TC_ACT_OK;
+}
 SEC("tc")
 int helper_skb_vlan_push_pop(struct __sk_buff *ctx)
 {

tools/testing/selftests/drivers/net/bonding/Makefile+1−0

@@ -13,6 +13,7 @@ TEST_PROGS := \ · 12 unmodified lines
13	bond_options.sh \	13	bond_options.sh \
14	bond_passive_lacp.sh \	14	bond_passive_lacp.sh \
15	bond_stacked_header_parse.sh \	15	bond_stacked_header_parse.sh \
		16	bond_vlan_real_dev.sh \
16	dev_addr_lists.sh \	17	dev_addr_lists.sh \
17	mode-1-recovery-updelay.sh \	18	mode-1-recovery-updelay.sh \
18	mode-2-recovery-updelay.sh \	19	mode-2-recovery-updelay.sh \

tools/testing/selftests/drivers/net/bonding/bond_vlan_real_dev.sh+180−0

@@ -0,0 +1,180 @@
	1	#!/bin/bash
	2	# SPDX-License-Identifier: GPL-2.0
	3	#
	4	# Test propagation of a real device's state to the VLANs stacked on top of it
	5	# when the real device is (or becomes) a bond member.
	6	#
	7	# The kernel mirrors a real device's UP/DOWN, MTU and feature changes onto its
	8	# VLANs. This is done asynchronously (netdev_work): doing it synchronously from
	9	# the real device's notifier could deadlock. If the real device is brought up
	10	# while enslaved to a bond - so its instance lock is held across NETDEV_UP - and
	11	# a VLAN on top of it is itself a bond member, the synchronous propagation
	12	# re-entered the stack and tried to take the same instance lock again.
	13	#
	14	# Cover both halves:
	15	# - the deferred UP/DOWN, MTU and feature propagation actually lands on the
	16	# VLAN (link state and MTU use an ops-locked dummy, i.e. the deferral path),
	17	# - the deadlock-prone topology - a VLAN on a dummy, with the VLAN and the
	18	# dummy each enslaved to a different bond - can be built without hanging.
	19
	20	ALL_TESTS="
	21	vlan_link_state
	22	vlan_mtu
	23	vlan_features
	24	vlan_real_dev_enslave
	25	"
	26
	27	REQUIRE_MZ=no
	28	NUM_NETIFS=0
	29	lib_dir=$(dirname "$0")
	30	source "$lib_dir"/../../../net/forwarding/lib.sh
	31
	32	# Return 0 if $dev in netns $ns has flag $flag set (e.g. UP) in its <...> flags.
	33	link_has_flag()
	34	{
	35	local ns=$1 dev=$2 flag=$3
	36
	37	ip -n "$ns" link show dev "$dev" 2>/dev/null \| grep -q "[<,]${flag}[,>]"
	38	}
	39
	40	link_lacks_flag()
	41	{
	42	! link_has_flag "$@"
	43	}
	44
	45	link_mtu_is()
	46	{
	47	local ns=$1 dev=$2 want=$3 cur
	48
	49	cur=$(ip -n "$ns" link show dev "$dev" 2>/dev/null \| \
	50	sed -n 's/.* mtu $[0-9]\+$.*/\1/p')
	51	[ "$cur" = "$want" ]
	52	}
	53
	54	vlan_feature_is()
	55	{
	56	local ns=$1 dev=$2 feature=$3 value=$4
	57
	58	ip netns exec "$ns" ethtool -k "$dev" 2>/dev/null \| \
	59	grep -q "^$feature: $value"
	60	}
	61
	62	link_has_master()
	63	{
	64	local ns=$1 dev=$2 master=$3
	65
	66	ip -n "$ns" -o link show dev "$dev" 2>/dev/null \| grep -q "master $master"
	67	}
	68
	69	vlan_link_state()
	70	{
	71	RET=0
	72
	73	ip -n "$NS" link add ls_dummy type dummy
	74	ip -n "$NS" link add link ls_dummy name ls_vlan type vlan id 100
	75
	76	# Bringing the real device up must propagate UP to the VLAN.
	77	ip -n "$NS" link set ls_dummy up
	78	busywait "$BUSYWAIT_TIMEOUT" link_has_flag "$NS" ls_vlan UP
	79	check_err $? "VLAN did not go UP after the real device went UP"
	80
	81	# ... and likewise for DOWN.
	82	ip -n "$NS" link set ls_dummy down
	83	busywait "$BUSYWAIT_TIMEOUT" link_lacks_flag "$NS" ls_vlan UP
	84	check_err $? "VLAN did not go DOWN after the real device went DOWN"
	85
	86	ip -n "$NS" link del ls_vlan
	87	ip -n "$NS" link del ls_dummy
	88
	89	log_test "VLAN link state follows the real device"
	90	}
	91
	92	vlan_mtu()
	93	{
	94	RET=0
	95
	96	# The VLAN inherits the real device's MTU (2000) at creation time.
	97	ip -n "$NS" link add mtu_dummy mtu 2000 type dummy
	98	ip -n "$NS" link add link mtu_dummy name mtu_vlan type vlan id 100
	99
	100	# Shrinking the real device's MTU must clamp the VLAN's MTU.
	101	ip -n "$NS" link set mtu_dummy mtu 1500
	102	busywait "$BUSYWAIT_TIMEOUT" link_mtu_is "$NS" mtu_vlan 1500
	103	check_err $? "VLAN MTU not clamped after the real device's MTU shrank"
	104
	105	ip -n "$NS" link del mtu_vlan
	106	ip -n "$NS" link del mtu_dummy
	107
	108	log_test "VLAN MTU clamped to the real device"
	109	}
	110
	111	vlan_features()
	112	{
	113	RET=0
	114
	115	# Use veth as the real device: unlike dummy it exports vlan_features, so
	116	# the VLAN actually inherits a toggleable offload to assert on.
	117	ip -n "$NS" link add ft_veth type veth peer name ft_veth_pr
	118	ip -n "$NS" link add link ft_veth name ft_vlan type vlan id 100
	119
	120	vlan_feature_is "$NS" ft_vlan scatter-gather on
	121	check_err $? "VLAN did not inherit scatter-gather from the real device"
	122
	123	# Toggling the offload on the real device must propagate to the VLAN.
	124	ip netns exec "$NS" ethtool -K ft_veth sg off
	125	busywait "$BUSYWAIT_TIMEOUT" \
	126	vlan_feature_is "$NS" ft_vlan scatter-gather off
	127	check_err $? "VLAN scatter-gather still on after disabling it on real dev"
	128
	129	ip netns exec "$NS" ethtool -K ft_veth sg on
	130	busywait "$BUSYWAIT_TIMEOUT" \
	131	vlan_feature_is "$NS" ft_vlan scatter-gather on
	132	check_err $? "VLAN scatter-gather still off after enabling it on real dev"
	133
	134	ip -n "$NS" link del ft_vlan
	135	ip -n "$NS" link del ft_veth
	136
	137	log_test "VLAN features follow the real device"
	138	}
	139
	140	vlan_real_dev_enslave()
	141	{
	142	RET=0
	143
	144	# dummy <- VLAN -> bond0, then enslave the dummy itself to bond1. The
	145	# last step brings the dummy up under bond1's instance lock, which used
	146	# to deadlock while synchronously propagating UP to the (bond-enslaved)
	147	# VLAN on top.
	148	ip -n "$NS" link add dl_dummy type dummy
	149	ip -n "$NS" link set dl_dummy up
	150	ip -n "$NS" link add link dl_dummy name dl_vlan type vlan id 100
	151
	152	ip -n "$NS" link add dl_bond0 type bond mode active-backup
	153	ip -n "$NS" link set dl_vlan down
	154	ip -n "$NS" link set dl_vlan master dl_bond0
	155	check_err $? "could not enslave the VLAN to bond0"
	156
	157	ip -n "$NS" link add dl_bond1 type bond mode active-backup
	158	ip -n "$NS" link set dl_dummy down
	159	ip -n "$NS" link set dl_dummy master dl_bond1
	160	check_err $? "could not enslave the real device to bond1"
	161
	162	# If we got here the kernel did not deadlock; make sure it is still
	163	# responsive and the enslave really took effect.
	164	link_has_master "$NS" dl_dummy dl_bond1
	165	check_err $? "real device not enslaved to bond1"
	166
	167	ip -n "$NS" link del dl_bond1
	168	ip -n "$NS" link del dl_bond0
	169	ip -n "$NS" link del dl_vlan
	170	ip -n "$NS" link del dl_dummy
	171
	172	log_test "VLAN real device enslaved to a second bond"
	173	}
	174
	175	setup_ns NS
	176	trap 'cleanup_ns $NS' EXIT
	177
	178	tests_run
	179
	180	exit "$EXIT_STATUS"

tools/testing/selftests/drivers/net/so_txtime.c+1−1

@@ -37,7 +37,7 @@ · 36 unmodified lines
37		37
38	static int cfg_clockid = CLOCK_TAI;	38	static int cfg_clockid = CLOCK_TAI;
39	static uint16_t cfg_port = 8000;	39	static uint16_t cfg_port = 8000;
40	static int cfg_variance_us = 4000;	40	static int cfg_variance_us = 8000;
41	static bool cfg_machine_slow;	41	static bool cfg_machine_slow;
42	static uint64_t cfg_start_time_ns;	42	static uint64_t cfg_start_time_ns;
43	static int cfg_mark;	43	static int cfg_mark;

tools/testing/selftests/net/broadcast_ether_dst.sh+1−1

@@ -44,7 +44,7 @@ test_broadcast_ether_dst() { · 43 unmodified lines
44	# tcpdump will exit after receiving a single packet	44	# tcpdump will exit after receiving a single packet
45	# timeout will kill tcpdump if it is still running after 2s	45	# timeout will kill tcpdump if it is still running after 2s
46	timeout 2s ip netns exec "${CLIENT_NS}" \	46	timeout 2s ip netns exec "${CLIENT_NS}" \
47	tcpdump -i link0 -c 1 -w "${CAPFILE}" icmp &> "${OUTPUT}" &	47	tcpdump -i link0 -c 1 -w "${CAPFILE}" -Z root icmp &> "${OUTPUT}" &
48	pid=$!	48	pid=$!
49	slowwait 1 grep -qs "listening" "${OUTPUT}"	49	slowwait 1 grep -qs "listening" "${OUTPUT}"
50		50

tools/testing/selftests/net/netfilter/conntrack_sctp_collision.sh+67−22

@@ -2,18 +2,32 @@ · 1 unmodified line
2	# SPDX-License-Identifier: GPL-2.0	2	# SPDX-License-Identifier: GPL-2.0
3	#	3	#
4	# Testing For SCTP COLLISION SCENARIO as Below:	4	# Testing For SCTP COLLISION SCENARIO as Below:
5	#	5	# 1. Stale INIT_ACK capture:
6	# 14:35:47.655279 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [INIT] [init tag: 2017837359]	6	# 14:35:47.655279 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [INIT] [init tag: 2017837359]
7	# 14:35:48.353250 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [INIT] [init tag: 1187206187]	7	# 14:35:48.353250 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [INIT] [init tag: 1187206187]
8	# 14:35:48.353275 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [INIT ACK] [init tag: 2017837359]	8	# 14:35:48.353275 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [INIT ACK] [init tag: 2017837359]
9	# 14:35:48.353283 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [COOKIE ECHO]	9	# 14:35:48.353283 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [COOKIE ECHO]
10	# 14:35:48.353977 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [COOKIE ACK]	10	# 14:35:48.353977 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [COOKIE ACK]
11	# 14:35:48.855335 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [INIT ACK] [init tag: 164579970]	11	# 14:35:48.855335 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [INIT ACK] [init tag: 164579970]
		12	# (Delayed)
		13	#
		14	# 2. Stale INIT capture:
		15	# 14:35:48.353250 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [INIT] [init tag: 1187206187]
		16	# 14:35:48.353275 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [INIT ACK] [init tag: 2017837359]
		17	# 14:35:48.353283 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [COOKIE ECHO]
		18	# 14:35:48.353977 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [COOKIE ACK]
		19	# 14:35:47.655279 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [INIT] [init tag: 2017837359]
		20	# (Delayed)
		21	# 14:35:48.855335 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [INIT ACK] [init tag: 164579970]
12	#	22	#
13	# TOPO: SERVER_NS (link0)<--->(link1) ROUTER_NS (link2)<--->(link3) CLIENT_NS	23	# TOPO: SERVER_NS (link0)<--->(link1) ROUTER_NS (link2)<--->(link3) CLIENT_NS
14		24
15	source lib.sh	25	source lib.sh
16		26
		27	checktool "nft --version" "run test without nft"
		28	checktool "tc -h" "run test without tc"
		29	checktool "modprobe -q sctp" "load sctp module"
		30
17	CLIENT_IP="198.51.200.1"	31	CLIENT_IP="198.51.200.1"
18	CLIENT_PORT=1234	32	CLIENT_PORT=1234
19		33
@@ -24,7 +38,8 @@ CLIENT_GW="198.51.200.2" · 4 unmodified lines
24	SERVER_GW="198.51.100.2"	38	SERVER_GW="198.51.100.2"
25		39
26	# setup the topo	40	# setup the topo
27	setup() {	41	topo_setup() {
		42	# setup_ns cleans up existing net namespaces first.
28	setup_ns CLIENT_NS SERVER_NS ROUTER_NS	43	setup_ns CLIENT_NS SERVER_NS ROUTER_NS
29	ip -n "$SERVER_NS" link add link0 type veth peer name link1 netns "$ROUTER_NS"	44	ip -n "$SERVER_NS" link add link0 type veth peer name link1 netns "$ROUTER_NS"
30	ip -n "$CLIENT_NS" link add link3 type veth peer name link2 netns "$ROUTER_NS"	45	ip -n "$CLIENT_NS" link add link3 type veth peer name link2 netns "$ROUTER_NS"
@@ -38,35 +53,53 @@ setup() { · 7 unmodified lines
38	ip -n "$ROUTER_NS" addr add $SERVER_GW/24 dev link1	53	ip -n "$ROUTER_NS" addr add $SERVER_GW/24 dev link1
39	ip -n "$ROUTER_NS" addr add $CLIENT_GW/24 dev link2	54	ip -n "$ROUTER_NS" addr add $CLIENT_GW/24 dev link2
40	ip net exec "$ROUTER_NS" sysctl -wq net.ipv4.ip_forward=1	55	ip net exec "$ROUTER_NS" sysctl -wq net.ipv4.ip_forward=1
		56	sysctl -wq net.netfilter.nf_log_all_netns=1
41		57
42	ip -n "$CLIENT_NS" link set link3 up	58	ip -n "$CLIENT_NS" link set link3 up
43	ip -n "$CLIENT_NS" addr add $CLIENT_IP/24 dev link3	59	ip -n "$CLIENT_NS" addr add $CLIENT_IP/24 dev link3
44	ip -n "$CLIENT_NS" route add $SERVER_IP dev link3 via $CLIENT_GW	60	ip -n "$CLIENT_NS" route add $SERVER_IP dev link3 via $CLIENT_GW
		61	}
		62
		63	conf_delay()
		64	{
		65	# simulate the delay on OVS upcall by setting up a delay for INIT_ACK/INIT with
		66	local ns=$1
		67	local link=$2
		68	local chunk_type=$3
45		69
46	# simulate the delay on OVS upcall by setting up a delay for INIT_ACK with	70	# use a smaller number for assoc's max_retrans to reproduce the issue
47	# tc on $SERVER_NS side	71	ip net exec "$CLIENT_NS" sysctl -wq net.sctp.association_max_retrans=3
48	tc -n "$SERVER_NS" qdisc add dev link0 root handle 1: htb r2q 64	72
49	tc -n "$SERVER_NS" class add dev link0 parent 1: classid 1:1 htb rate 100mbit	73	tc -n "$ns" qdisc add dev "$link" root handle 1: htb r2q 64
50	tc -n "$SERVER_NS" filter add dev link0 parent 1: protocol ip u32 match ip protocol 132 \	74	tc -n "$ns" class add dev "$link" parent 1: classid 1:1 htb rate 100mbit
51	0xff match u8 2 0xff at 32 flowid 1:1	75	tc -n "$ns" filter add dev "$link" parent 1: protocol ip \
52	if ! tc -n "$SERVER_NS" qdisc add dev link0 parent 1:1 handle 10: netem delay 1200ms; then	76	u32 match ip protocol 132 0xff match u8 "$chunk_type" 0xff at 32 flowid 1:1
		77	if ! tc -n "$ns" qdisc add dev "$link" parent 1:1 handle 10: netem delay 1200ms; then
53	echo "SKIP: Cannot add netem qdisc"	78	echo "SKIP: Cannot add netem qdisc"
54	exit $ksft_skip	79	return $ksft_skip
55	fi	80	fi
56		81
57	# simulate the ctstate check on OVS nf_conntrack	82	# simulate the ctstate check on OVS nf_conntrack
58	ip net exec "$ROUTER_NS" iptables -A FORWARD -m state --state INVALID,UNTRACKED -j DROP	83	ip net exec "$ROUTER_NS" nft -f - <<-EOF
59	ip net exec "$ROUTER_NS" iptables -A INPUT -p sctp -j DROP	84	table ip t {
60		85	chain forward {
61	# use a smaller number for assoc's max_retrans to reproduce the issue	86	type filter hook forward priority filter; policy accept;
62	modprobe -q sctp	87	meta l4proto icmp counter accept
63	ip net exec "$CLIENT_NS" sysctl -wq net.sctp.association_max_retrans=3	88	ct state new counter accept
		89	ct state established,related counter accept
		90	ct state invalid log flags all counter drop comment \
		91	"Expect to drop stale INIT/INIT_ACK chunks"
		92	counter
		93	}
		94	}
		95	EOF
		96	return 0
64	}	97	}
65		98
66	cleanup() {	99	cleanup() {
67	ip net exec "$CLIENT_NS" pkill sctp_collision >/dev/null 2>&1	100	# cleanup_all_ns terminates running processes in the namespaces.
68	ip net exec "$SERVER_NS" pkill sctp_collision >/dev/null 2>&1
69	cleanup_all_ns	101	cleanup_all_ns
		102	sysctl -wq net.netfilter.nf_log_all_netns=0
70	}	103	}
71		104
72	do_test() {	105	do_test() {
@@ -81,7 +114,19 @@ do_test() { · 8 unmodified lines
81		114
82	# run the test case	115	# run the test case
83	trap cleanup EXIT	116	trap cleanup EXIT
84	setup && \	117
85	echo "Test for SCTP Collision in nf_conntrack:" && \	118	echo "Test for SCTP INIT_ACK Collision in nf_conntrack:"
86	do_test && echo "PASS!"	119	topo_setup \|\| exit $?
87	exit $?	120	conf_delay $SERVER_NS link0 2 \|\| exit $?
		121
		122	if ! do_test; then
		123	exit $ksft_fail
		124	fi
		125
		126	echo "Test for SCTP INIT Collision in nf_conntrack:"
		127	topo_setup \|\| exit $?
		128	conf_delay $CLIENT_NS link3 1 \|\| exit $?
		129
		130	if ! do_test; then
		131	exit $ksft_fail
		132	fi

tools/testing/selftests/net/netfilter/nft_flowtable.sh+4−4

tools/testing/selftests/net/netfilter/nft_queue.sh+58−8

 ip -net "$ns3" route add default via dead:3::1
 load_ruleset() {
-	local name=$1
+	local family=$1
-	local prio=$2
+	local name=$2
+	local prio=$3
 ip netns exec "$nsrouter" nft -f /dev/stdin <<EOF
-table inet $name {
+table $family $name {
 	chain nfq {
 		ip protocol icmp queue bypass
 		icmpv6 type { "echo-request", "echo-reply" } queue num 1 bypass
 test_queue()
 {
 	local expected="$1"
+	local family="$2"
 	local last=""
 	# spawn nf_queue listeners
 		if [ x"$last" != x"$expected packets total" ]; then
 			echo "FAIL: Expected $expected packets total, but got $last" 1>&2
 			ip netns exec "$nsrouter" nft list ruleset
+			echo -n "$TMPFILE0: ";cat "$TMPFILE0"
+			echo -n "$TMPFILE1: ";cat "$TMPFILE1"
 			exit 1
 		fi
 	done
-	echo "PASS: Expected and received $last"
+	echo "PASS: Expected and received $last ($family)"
 }
 listener_ready()
 	kill "$nfqpid"
 	echo "PASS: icmp+nfqueue via vrf"
+	ip -net "$ns1" link del tvrf
+	ip netns exec "$ns1" nft flush ruleset
 }
 sctp_listener_ready()
 	check_tainted "queue program exiting while packets queued"
 }
+test_queue_bridge()
+{
+	ip -net "$nsrouter" addr flush dev veth0
+	ip -net "$nsrouter" addr flush dev veth1
+	ip -net "$nsrouter" link add br0 type bridge
+	ip -net "$nsrouter" link set veth0 master br0
+	ip -net "$nsrouter" link set veth1 master br0
+	ip -net "$nsrouter" link set br0 up
+	ip -net "$nsrouter" addr add 10.0.2.1/16 dev br0
+	ip -net "$nsrouter" addr add dead:2::1/64 dev br0 nodad
+	ip -net "$ns1" addr flush dev eth0
+	ip -net "$ns2" addr flush dev eth0
+	ip -net "$ns1" addr add 10.0.1.1/16 dev eth0
+	ip -net "$ns1" addr add dead:2::2/64 dev eth0 nodad
+	ip -net "$ns2" addr add 10.0.2.99/16 dev eth0
+	ip -net "$ns2" addr add dead:2::99/64 dev eth0 nodad
+	ip netns exec "$nsrouter" nft flush ruleset
+	ip netns exec "$nsrouter" sysctl net.ipv6.conf.all.forwarding=0 > /dev/null
+	ip netns exec "$nsrouter" sysctl net.ipv4.conf.veth0.forwarding=0 > /dev/null
+	ip netns exec "$nsrouter" sysctl net.ipv4.conf.veth1.forwarding=0 > /dev/null
+	if ! test_ping;then
+		echo "FAIL: netns bridge connectivity" 1>&2
+		exit $ret
+	fi
+	load_ruleset "bridge" "filter" 10
+	test_queue 10 "bridge"
+	load_ruleset "bridge" "filter2" 20
+	test_queue 20 "bridge"
+}
 ip netns exec "$nsrouter" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
 ip netns exec "$nsrouter" sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
 ip netns exec "$nsrouter" sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
 ip netns exec "$nsrouter" sysctl net.ipv4.conf.veth2.forwarding=1 > /dev/null
-load_ruleset "filter" 0
+load_ruleset "inet" "filter" 0
 if test_ping; then
 	# queue bypass works (rules were skipped, no listener)
 # 1x icmp prerouting,forward,postrouting -> 3 queue events (6 incl. reply).
 # 1x icmp prerouting,input,output postrouting -> 4 queue events incl. reply.
 # so we expect that userspace program receives 10 packets.
-test_queue 10
+test_queue 10 "inet"
 # same.  We queue to a second program as well.
-load_ruleset "filter2" 20
+load_ruleset "inet" "filter2" 20
-test_queue 20
+test_queue 20 "inet"
 ip netns exec "$ns1" nft flush ruleset
 test_tcp_forward
 test_icmp_vrf
 test_queue_removal
+# turns router into a bridge
+test_queue_bridge
 exit $ret

tools/testing/selftests/net/tls.c+7−1

 	char sendbuf[0x100];
 	char sendchar = 'S';
 	int pipefds[2];
+	int pipe_sz;
+	int ret;
 	int i;
 	sendchar_iov.iov_base = &sendchar;
 	memset(sendbuf, 's', sizeof(sendbuf));
 	ASSERT_GE(pipe2(pipefds, O_NONBLOCK), 0);
-	ASSERT_GE(fcntl(pipefds[0], F_SETPIPE_SZ, (MAX_FRAGS + 1) * 0x1000), 0);
+	pipe_sz = (MAX_FRAGS + 1) * getpagesize();
+	ret = fcntl(pipefds[0], F_SETPIPE_SZ, pipe_sz);
+	if (ret < 0 && errno == EPERM)
+		SKIP(return, "insufficient pipe capacity");
+	ASSERT_GE(ret, pipe_sz);
 	for (i = 0; i < MAX_FRAGS; i++)
 		ASSERT_GE(vmsplice(pipefds[1], &sendchar_iov, 1, 0), 0);

tools/testing/selftests/net/vlan_bridge_binding.sh+1−1

@@ -64,7 +64,7 @@ check_operstate() · 63 unmodified lines
64	local expect=$1; shift	64	local expect=$1; shift
65	local operstate	65	local operstate
66		66
67	operstate=$(busywait 1000 \	67	operstate=$(busywait 2000 \
68	operstate_is "$dev" "$expect")	68	operstate_is "$dev" "$expect")
69	check_err $? "Got operstate of $operstate, expected $expect"	69	check_err $? "Got operstate of $operstate, expected $expect"
70	}	70	}

tools/testing/selftests/tc-testing/tc-tests/actions/ct.json+38−0

@@ -664,5 +664,43 @@ · 663 unmodified lines
664	"teardown": [	664	"teardown": [
665	"$TC qdisc del dev $DEV1 ingress_block 21 clsact"	665	"$TC qdisc del dev $DEV1 ingress_block 21 clsact"
666	]	666	]
		667	},
		668	{
		669	"id": "9c2a",
		670	"name": "Act_ct preserves skb cb across defrag before prio dequeue",
		671	"category": [
		672	"actions",
		673	"ct",
		674	"scapy"
		675	],
		676	"plugins": {
		677	"requires": [
		678	"nsPlugin",
		679	"scapyPlugin"
		680	]
		681	},
		682	"setup": [
		683	"$TC qdisc add dev $DUMMY root handle 1: prio",
		684	"$TC qdisc add dev $DUMMY clsact",
		685	"$TC qdisc add dev $DEV1 clsact",
		686	"$TC filter add dev $DEV1 ingress protocol ip prio 1 matchall action mirred egress redirect dev $DUMMY"
		687	],
		688	"cmdUnderTest": "$TC filter add dev $DUMMY egress protocol ip prio 1 matchall action ct zone 1 pipe",
		689	"scapy": [
		690	{
		691	"iface": "$DEV0",
		692	"count": 1,
		693	"packet": "[Ether()/frag for frag in fragment(IP(src='10.0.0.10', dst='10.0.0.1', id=1)/UDP(sport=12345, dport=9)/Raw(b'A' * 4000), fragsize=1400)]"
		694	}
		695	],
		696	"expExitCode": "0",
		697	"verifyCmd": "$TC -s qdisc show dev $DUMMY \| grep -A 1 '^qdisc prio 1:'",
		698	"matchPattern": "Sent [1-9][0-9]* bytes [1-9][0-9]* pkt",
		699	"matchCount": "1",
		700	"teardown": [
		701	"$TC qdisc del dev $DEV1 clsact",
		702	"$TC qdisc del dev $DUMMY clsact",
		703	"$TC qdisc del dev $DUMMY root handle 1:"
		704	]
667	}	705	}
668	]	706	]

tools/testing/selftests/tc-testing/tc-tests/qdiscs/dualpi2.json+44−0

@@ -250,5 +250,49 @@ · 249 unmodified lines
250	"teardown": [	250	"teardown": [
251	"$TC qdisc del dev $DUMMY handle 1: root"	251	"$TC qdisc del dev $DUMMY handle 1: root"
252	]	252	]
		253	},
		254	{
		255	"id": "891f",
		256	"name": "Verify DualPI2 GSO backlog accounting with QFQ parent",
		257	"category": [
		258	"qdisc",
		259	"dualpi2",
		260	"qfq",
		261	"gso"
		262	],
		263	"plugins": {
		264	"requires": "nsPlugin"
		265	},
		266	"setup": [
		267	"$IP link set dev $DUMMY up \|\| true",
		268	"$IP addr add 10.10.10.10/24 dev $DUMMY \|\| true",
		269	"$TC qdisc add dev $DUMMY root handle 1: qfq",
		270	"$TC class add dev $DUMMY parent 1: classid 1:1 qfq weight 1 maxpkt 4096",
		271	"$TC qdisc add dev $DUMMY parent 1:1 handle 2: dualpi2",
		272	"$TC filter add dev $DUMMY parent 1: matchall classid 1:1"
		273	],
		274	"cmdUnderTest": "./tdc_gso.py 10.10.10.10 10.10.10.1 9000 1200 2400",
		275	"expExitCode": "0",
		276	"verifyCmd": "$TC -j -s qdisc ls dev $DUMMY",
		277	"matchJSON": [
		278	{
		279	"kind": "qfq",
		280	"handle": "1:",
		281	"packets": 2,
		282	"backlog": 0,
		283	"qlen": 0
		284	},
		285	{
		286	"kind": "dualpi2",
		287	"handle": "2:",
		288	"packets": 2,
		289	"backlog": 0,
		290	"qlen": 0
		291	}
		292	],
		293	"teardown": [
		294	"$TC qdisc del dev $DUMMY root",
		295	"$IP addr del 10.10.10.10/24 dev $DUMMY \|\| true"
		296	]
253	}	297	}
254	]	298	]

tools/testing/selftests/tc-testing/tdc_gso.py+43−0

@@ -0,0 +1,43 @@
	1	#!/usr/bin/env python3
	2	# SPDX-License-Identifier: GPL-2.0
	3
	4	"""
	5	tdc_gso.py - send a UDP GSO datagram
	6
	7	Copyright (C) 2026 Xingquan Liu <b1n@b1n.io>
	8	"""
	9
	10	import argparse
	11	import socket
	12	import struct
	13	import sys
	14
	15	UDP_MAX_SEGMENTS = 1 << 7
	16
	17
	18	parser = argparse.ArgumentParser(description="UDP GSO datagram sender")
	19	parser.add_argument("src", help="source IPv4 address")
	20	parser.add_argument("dst", help="destination IPv4 address")
	21	parser.add_argument("port", type=int, help="destination UDP port")
	22	parser.add_argument("gso_size", type=int, help="UDP GSO segment payload size")
	23	parser.add_argument("payload_len", type=int, help="total UDP payload length")
	24	args = parser.parse_args()
	25
	26	if args.gso_size <= 0 or args.gso_size > 0xFFFF:
	27	parser.error("gso_size must fit in an unsigned 16-bit integer")
	28	if args.payload_len <= args.gso_size:
	29	parser.error("payload_len must be larger than gso_size")
	30	if args.payload_len > args.gso_size * UDP_MAX_SEGMENTS:
	31	parser.error("payload_len exceeds UDP_MAX_SEGMENTS")
	32
	33	SOL_UDP = getattr(socket, "SOL_UDP", socket.IPPROTO_UDP)
	34	UDP_SEGMENT = getattr(socket, "UDP_SEGMENT", 103)
	35
	36	sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
	37	sock.bind((args.src, 0))
	38
	39	payload = b"b" * args.payload_len
	40	cmsg = [(SOL_UDP, UDP_SEGMENT, struct.pack("=H", args.gso_size))]
	41
	42	sent = sock.sendmsg([payload], cmsg, 0, (args.dst, args.port))
	43	sys.exit(sent != len(payload))

Merge tag 'net-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code

@@ -98,24 +98,24 @@ static const struct genl_small_ops ieee802154_ops[] = { · 97 unmodified lines
98	IEEE802154_OP(IEEE802154_SET_MACPARAMS, ieee802154_set_macparams),	98	IEEE802154_OP(IEEE802154_SET_MACPARAMS, ieee802154_set_macparams),
99	IEEE802154_OP(IEEE802154_LLSEC_GETPARAMS, ieee802154_llsec_getparams),	99	IEEE802154_OP(IEEE802154_LLSEC_GETPARAMS, ieee802154_llsec_getparams),
100	IEEE802154_OP(IEEE802154_LLSEC_SETPARAMS, ieee802154_llsec_setparams),	100	IEEE802154_OP(IEEE802154_LLSEC_SETPARAMS, ieee802154_llsec_setparams),
101	IEEE802154_DUMP(IEEE802154_LLSEC_LIST_KEY, NULL,	101	IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_KEY, NULL,
102	ieee802154_llsec_dump_keys),	102	ieee802154_llsec_dump_keys),
103	IEEE802154_OP(IEEE802154_LLSEC_ADD_KEY, ieee802154_llsec_add_key),	103	IEEE802154_OP_RELAXED(IEEE802154_LLSEC_ADD_KEY, ieee802154_llsec_add_key),
104	IEEE802154_OP(IEEE802154_LLSEC_DEL_KEY, ieee802154_llsec_del_key),	104	IEEE802154_OP_RELAXED(IEEE802154_LLSEC_DEL_KEY, ieee802154_llsec_del_key),
105	IEEE802154_DUMP(IEEE802154_LLSEC_LIST_DEV, NULL,	105	IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_DEV, NULL,
106	ieee802154_llsec_dump_devs),	106	ieee802154_llsec_dump_devs),
107	IEEE802154_OP(IEEE802154_LLSEC_ADD_DEV, ieee802154_llsec_add_dev),	107	IEEE802154_OP_RELAXED(IEEE802154_LLSEC_ADD_DEV, ieee802154_llsec_add_dev),
108	IEEE802154_OP(IEEE802154_LLSEC_DEL_DEV, ieee802154_llsec_del_dev),	108	IEEE802154_OP_RELAXED(IEEE802154_LLSEC_DEL_DEV, ieee802154_llsec_del_dev),
109	IEEE802154_DUMP(IEEE802154_LLSEC_LIST_DEVKEY, NULL,	109	IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_DEVKEY, NULL,
110	ieee802154_llsec_dump_devkeys),	110	ieee802154_llsec_dump_devkeys),
111	IEEE802154_OP(IEEE802154_LLSEC_ADD_DEVKEY, ieee802154_llsec_add_devkey),	111	IEEE802154_OP_RELAXED(IEEE802154_LLSEC_ADD_DEVKEY, ieee802154_llsec_add_devkey),
112	IEEE802154_OP(IEEE802154_LLSEC_DEL_DEVKEY, ieee802154_llsec_del_devkey),	112	IEEE802154_OP_RELAXED(IEEE802154_LLSEC_DEL_DEVKEY, ieee802154_llsec_del_devkey),
113	IEEE802154_DUMP(IEEE802154_LLSEC_LIST_SECLEVEL, NULL,	113	IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_SECLEVEL, NULL,
114	ieee802154_llsec_dump_seclevels),	114	ieee802154_llsec_dump_seclevels),
115	IEEE802154_OP(IEEE802154_LLSEC_ADD_SECLEVEL,	115	IEEE802154_OP_RELAXED(IEEE802154_LLSEC_ADD_SECLEVEL,
116	ieee802154_llsec_add_seclevel),	116	ieee802154_llsec_add_seclevel),
117	IEEE802154_OP(IEEE802154_LLSEC_DEL_SECLEVEL,	117	IEEE802154_OP_RELAXED(IEEE802154_LLSEC_DEL_SECLEVEL,
118	ieee802154_llsec_del_seclevel),	118	ieee802154_llsec_del_seclevel),
119	};	119	};
120		120
121	static const struct genl_multicast_group ieee802154_mcgrps[] = {	121	static const struct genl_multicast_group ieee802154_mcgrps[] = {

@@ -592,7 +592,7 @@ ip -net "$nsr1" link set tun0 up · 591 unmodified lines
592	ip -net "$nsr1" addr add 192.168.100.1/24 dev tun0	592	ip -net "$nsr1" addr add 192.168.100.1/24 dev tun0
593	ip netns exec "$nsr1" sysctl net.ipv4.conf.tun0.forwarding=1 > /dev/null	593	ip netns exec "$nsr1" sysctl net.ipv4.conf.tun0.forwarding=1 > /dev/null
594		594
595	ip -net "$nsr1" link add name tun6 type ip6tnl local fee1:2::1 remote fee1:2::2	595	ip -net "$nsr1" link add name tun6 type ip6tnl local fee1:2::1 remote fee1:2::2 encaplimit none
596	ip -net "$nsr1" link set tun6 up	596	ip -net "$nsr1" link set tun6 up
597	ip -net "$nsr1" addr add fee1:3::1/64 dev tun6 nodad	597	ip -net "$nsr1" addr add fee1:3::1/64 dev tun6 nodad
598		598
@@ -601,7 +601,7 @@ ip -net "$nsr2" link set tun0 up · 2 unmodified lines
601	ip -net "$nsr2" addr add 192.168.100.2/24 dev tun0	601	ip -net "$nsr2" addr add 192.168.100.2/24 dev tun0
602	ip netns exec "$nsr2" sysctl net.ipv4.conf.tun0.forwarding=1 > /dev/null	602	ip netns exec "$nsr2" sysctl net.ipv4.conf.tun0.forwarding=1 > /dev/null
603		603
604	ip -net "$nsr2" link add name tun6 type ip6tnl local fee1:2::2 remote fee1:2::1 \|\| ret=1	604	ip -net "$nsr2" link add name tun6 type ip6tnl local fee1:2::2 remote fee1:2::1 encaplimit none \|\| ret=1
605	ip -net "$nsr2" link set tun6 up	605	ip -net "$nsr2" link set tun6 up
606	ip -net "$nsr2" addr add fee1:3::2/64 dev tun6 nodad	606	ip -net "$nsr2" addr add fee1:3::2/64 dev tun6 nodad
607		607
@@ -651,7 +651,7 @@ ip -net "$nsr1" route change default via 192.168.200.2 · 43 unmodified lines
651	ip netns exec "$nsr1" sysctl net.ipv4.conf.tun0/10.forwarding=1 > /dev/null	651	ip netns exec "$nsr1" sysctl net.ipv4.conf.tun0/10.forwarding=1 > /dev/null
652	ip netns exec "$nsr1" nft -a insert rule inet filter forward 'meta oif tun0.10 accept'	652	ip netns exec "$nsr1" nft -a insert rule inet filter forward 'meta oif tun0.10 accept'
653		653
654	ip -net "$nsr1" link add name tun6.10 type ip6tnl local fee1:4::1 remote fee1:4::2	654	ip -net "$nsr1" link add name tun6.10 type ip6tnl local fee1:4::1 remote fee1:4::2 encaplimit none
655	ip -net "$nsr1" link set tun6.10 up	655	ip -net "$nsr1" link set tun6.10 up
656	ip -net "$nsr1" addr add fee1:5::1/64 dev tun6.10 nodad	656	ip -net "$nsr1" addr add fee1:5::1/64 dev tun6.10 nodad
657	ip -6 -net "$nsr1" route delete default	657	ip -6 -net "$nsr1" route delete default
@@ -670,7 +670,7 @@ ip -net "$nsr2" addr add 192.168.200.2/24 dev tun0.10 · 12 unmodified lines
670	ip -net "$nsr2" route change default via 192.168.200.1	670	ip -net "$nsr2" route change default via 192.168.200.1
671	ip netns exec "$nsr2" sysctl net.ipv4.conf.tun0/10.forwarding=1 > /dev/null	671	ip netns exec "$nsr2" sysctl net.ipv4.conf.tun0/10.forwarding=1 > /dev/null
672		672
673	ip -net "$nsr2" link add name tun6.10 type ip6tnl local fee1:4::2 remote fee1:4::1 \|\| ret=1	673	ip -net "$nsr2" link add name tun6.10 type ip6tnl local fee1:4::2 remote fee1:4::1 encaplimit none \|\| ret=1
674	ip -net "$nsr2" link set tun6.10 up	674	ip -net "$nsr2" link set tun6.10 up
675	ip -net "$nsr2" addr add fee1:5::2/64 dev tun6.10 nodad	675	ip -net "$nsr2" addr add fee1:5::2/64 dev tun6.10 nodad
676	ip -6 -net "$nsr2" route delete default	676	ip -6 -net "$nsr2" route delete default