Skip to content

Commit c7d1022

Browse files
torvaldstorvalds
committed
Merge tag 'net-5.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Jakub Kicinski: "Networking fixes for 5.14-rc4, including fixes from bpf, can, WiFi (mac80211) and netfilter trees. Current release - regressions: - mac80211: fix starting aggregation sessions on mesh interfaces Current release - new code bugs: - sctp: send pmtu probe only if packet loss in Search Complete state - bnxt_en: add missing periodic PHC overflow check - devlink: fix phys_port_name of virtual port and merge error - hns3: change the method of obtaining default ptp cycle - can: mcba_usb_start(): add missing urb->transfer_dma initialization Previous releases - regressions: - set true network header for ECN decapsulation - mlx5e: RX, avoid possible data corruption w/ relaxed ordering and LRO - phy: re-add check for PHY_BRCM_DIS_TXCRXC_NOENRGY on the BCM54811 PHY - sctp: fix return value check in __sctp_rcv_asconf_lookup Previous releases - always broken: - bpf: - more spectre corner case fixes, introduce a BPF nospec instruction for mitigating Spectre v4 - fix OOB read when printing XDP link fdinfo - sockmap: fix cleanup related races - mac80211: fix enabling 4-address mode on a sta vif after assoc - can: - raw: raw_setsockopt(): fix raw_rcv panic for sock UAF - j1939: j1939_session_deactivate(): clarify lifetime of session object, avoid UAF - fix number of identical memory leaks in USB drivers - tipc: - do not blindly write skb_shinfo frags when doing decryption - fix sleeping in tipc accept routine" * tag 'net-5.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (91 commits) gve: Update MAINTAINERS list can: esd_usb2: fix memory leak can: ems_usb: fix memory leak can: usb_8dev: fix memory leak can: mcba_usb_start(): add missing urb->transfer_dma initialization can: hi311x: fix a signedness bug in hi3110_cmd() MAINTAINERS: add Yasushi SHOJI as reviewer for the Microchip CAN BUS Analyzer Tool driver bpf: Fix leakage due to insufficient speculative store bypass mitigation bpf: Introduce BPF nospec instruction for mitigating Spectre v4 sis900: Fix missing pci_disable_device() in probe and remove net: let flow have same hash in two directions nfc: nfcsim: fix use after free during module unload tulip: windbond-840: Fix missing pci_disable_device() in probe and remove sctp: fix return value check in __sctp_rcv_asconf_lookup nfc: s3fwrn5: fix undefined parameter values in dev_err() net/mlx5: Fix mlx5_vport_tbl_attr chain from u16 to u32 net/mlx5e: Fix nullptr in mlx5e_hairpin_get_mdev() net/mlx5: Unload device upon firmware fatal error net/mlx5e: Fix page allocation failure for ptp-RQ over SF net/mlx5e: Fix page allocation failure for trap-RQ over SF ...
2 parents e1dab4c + 8d67041 commit c7d1022

File tree

104 files changed

+1230
-547
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

104 files changed

+1230
-547
lines changed

‎MAINTAINERS

+9-3
Original file line numberDiff line numberDiff line change
@@ -7858,9 +7858,9 @@ S: Maintained
78587858
F: drivers/input/touchscreen/goodix.c
78597859

78607860
GOOGLE ETHERNET DRIVERS
7861-
M: Catherine Sullivan <csully@google.com>
7862-
R: Sagi Shahar <sagis@google.com>
7863-
R: Jon Olson <jonolson@google.com>
7861+
M: Jeroen de Borst <jeroendb@google.com>
7862+
R: Catherine Sullivan <csully@google.com>
7863+
R: David Awogbemila <awogbemila@google.com>
78647864
L: [email protected]
78657865
S: Supported
78667866
F: Documentation/networking/device_drivers/ethernet/google/gve.rst
@@ -11327,6 +11327,12 @@ W: https://linuxtv.org
1132711327
T: git git://linuxtv.org/media_tree.git
1132811328
F: drivers/media/radio/radio-maxiradio*
1132911329

11330+
MCAB MICROCHIP CAN BUS ANALYZER TOOL DRIVER
11331+
R: Yasushi SHOJI <[email protected]>
11332+
L: [email protected]
11333+
S: Maintained
11334+
F: drivers/net/can/usb/mcba_usb.c
11335+
1133011336
MCAN MMIO DEVICE DRIVER
1133111337
M: Chandrasekar Ramakrishnan <[email protected]>
1133211338
L: [email protected]

‎arch/arm/net/bpf_jit_32.c

+3
Original file line numberDiff line numberDiff line change
@@ -1602,6 +1602,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
16021602
rn = arm_bpf_get_reg32(src_lo, tmp2[1], ctx);
16031603
emit_ldx_r(dst, rn, off, ctx, BPF_SIZE(code));
16041604
break;
1605+
/* speculation barrier */
1606+
case BPF_ST | BPF_NOSPEC:
1607+
break;
16051608
/* ST: *(size *)(dst + off) = imm */
16061609
case BPF_ST | BPF_MEM | BPF_W:
16071610
case BPF_ST | BPF_MEM | BPF_H:

‎arch/arm64/boot/dts/freescale/imx8mp.dtsi

+2-2
Original file line numberDiff line numberDiff line change
@@ -579,7 +579,7 @@
579579
};
580580

581581
flexcan1: can@308c0000 {
582-
compatible = "fsl,imx8mp-flexcan", "fsl,imx6q-flexcan";
582+
compatible = "fsl,imx8mp-flexcan";
583583
reg = <0x308c0000 0x10000>;
584584
interrupts = <GIC_SPI 142 IRQ_TYPE_LEVEL_HIGH>;
585585
clocks = <&clk IMX8MP_CLK_IPG_ROOT>,
@@ -594,7 +594,7 @@
594594
};
595595

596596
flexcan2: can@308d0000 {
597-
compatible = "fsl,imx8mp-flexcan", "fsl,imx6q-flexcan";
597+
compatible = "fsl,imx8mp-flexcan";
598598
reg = <0x308d0000 0x10000>;
599599
interrupts = <GIC_SPI 144 IRQ_TYPE_LEVEL_HIGH>;
600600
clocks = <&clk IMX8MP_CLK_IPG_ROOT>,

‎arch/arm64/net/bpf_jit_comp.c

+13
Original file line numberDiff line numberDiff line change
@@ -823,6 +823,19 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx,
823823
return ret;
824824
break;
825825

826+
/* speculation barrier */
827+
case BPF_ST | BPF_NOSPEC:
828+
/*
829+
* Nothing required here.
830+
*
831+
* In case of arm64, we rely on the firmware mitigation of
832+
* Speculative Store Bypass as controlled via the ssbd kernel
833+
* parameter. Whenever the mitigation is enabled, it works
834+
* for all of the kernel code with no need to provide any
835+
* additional instructions.
836+
*/
837+
break;
838+
826839
/* ST: *(size *)(dst + off) = imm */
827840
case BPF_ST | BPF_MEM | BPF_W:
828841
case BPF_ST | BPF_MEM | BPF_H:

‎arch/mips/net/ebpf_jit.c

+3
Original file line numberDiff line numberDiff line change
@@ -1355,6 +1355,9 @@ static int build_one_insn(const struct bpf_insn *insn, struct jit_ctx *ctx,
13551355
}
13561356
break;
13571357

1358+
case BPF_ST | BPF_NOSPEC: /* speculation barrier */
1359+
break;
1360+
13581361
case BPF_ST | BPF_B | BPF_MEM:
13591362
case BPF_ST | BPF_H | BPF_MEM:
13601363
case BPF_ST | BPF_W | BPF_MEM:

‎arch/powerpc/net/bpf_jit_comp32.c

+6
Original file line numberDiff line numberDiff line change
@@ -737,6 +737,12 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, struct codegen_context *
737737
}
738738
break;
739739

740+
/*
741+
* BPF_ST NOSPEC (speculation barrier)
742+
*/
743+
case BPF_ST | BPF_NOSPEC:
744+
break;
745+
740746
/*
741747
* BPF_ST(X)
742748
*/

‎arch/powerpc/net/bpf_jit_comp64.c

+6
Original file line numberDiff line numberDiff line change
@@ -627,6 +627,12 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, struct codegen_context *
627627
}
628628
break;
629629

630+
/*
631+
* BPF_ST NOSPEC (speculation barrier)
632+
*/
633+
case BPF_ST | BPF_NOSPEC:
634+
break;
635+
630636
/*
631637
* BPF_ST(X)
632638
*/

‎arch/riscv/net/bpf_jit_comp32.c

+4
Original file line numberDiff line numberDiff line change
@@ -1251,6 +1251,10 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
12511251
return -1;
12521252
break;
12531253

1254+
/* speculation barrier */
1255+
case BPF_ST | BPF_NOSPEC:
1256+
break;
1257+
12541258
case BPF_ST | BPF_MEM | BPF_B:
12551259
case BPF_ST | BPF_MEM | BPF_H:
12561260
case BPF_ST | BPF_MEM | BPF_W:

‎arch/riscv/net/bpf_jit_comp64.c

+4
Original file line numberDiff line numberDiff line change
@@ -939,6 +939,10 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
939939
emit_ld(rd, 0, RV_REG_T1, ctx);
940940
break;
941941

942+
/* speculation barrier */
943+
case BPF_ST | BPF_NOSPEC:
944+
break;
945+
942946
/* ST: *(size *)(dst + off) = imm */
943947
case BPF_ST | BPF_MEM | BPF_B:
944948
emit_imm(RV_REG_T1, imm, ctx);

‎arch/s390/net/bpf_jit_comp.c

+5
Original file line numberDiff line numberDiff line change
@@ -1153,6 +1153,11 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
11531153
break;
11541154
}
11551155
break;
1156+
/*
1157+
* BPF_NOSPEC (speculation barrier)
1158+
*/
1159+
case BPF_ST | BPF_NOSPEC:
1160+
break;
11561161
/*
11571162
* BPF_ST(X)
11581163
*/

‎arch/sparc/net/bpf_jit_comp_64.c

+3
Original file line numberDiff line numberDiff line change
@@ -1287,6 +1287,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
12871287
return 1;
12881288
break;
12891289
}
1290+
/* speculation barrier */
1291+
case BPF_ST | BPF_NOSPEC:
1292+
break;
12901293
/* ST: *(size *)(dst + off) = imm */
12911294
case BPF_ST | BPF_MEM | BPF_W:
12921295
case BPF_ST | BPF_MEM | BPF_H:

‎arch/x86/net/bpf_jit_comp.c

+7
Original file line numberDiff line numberDiff line change
@@ -1219,6 +1219,13 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
12191219
}
12201220
break;
12211221

1222+
/* speculation barrier */
1223+
case BPF_ST | BPF_NOSPEC:
1224+
if (boot_cpu_has(X86_FEATURE_XMM2))
1225+
/* Emit 'lfence' */
1226+
EMIT3(0x0F, 0xAE, 0xE8);
1227+
break;
1228+
12221229
/* ST: *(u8*)(dst_reg + off) = imm */
12231230
case BPF_ST | BPF_MEM | BPF_B:
12241231
if (is_ereg(dst_reg))

‎arch/x86/net/bpf_jit_comp32.c

+6
Original file line numberDiff line numberDiff line change
@@ -1886,6 +1886,12 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
18861886
i++;
18871887
break;
18881888
}
1889+
/* speculation barrier */
1890+
case BPF_ST | BPF_NOSPEC:
1891+
if (boot_cpu_has(X86_FEATURE_XMM2))
1892+
/* Emit 'lfence' */
1893+
EMIT3(0x0F, 0xAE, 0xE8);
1894+
break;
18891895
/* ST: *(u8*)(dst_reg + off) = imm */
18901896
case BPF_ST | BPF_MEM | BPF_H:
18911897
case BPF_ST | BPF_MEM | BPF_B:

‎drivers/net/can/spi/hi311x.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -218,7 +218,7 @@ static int hi3110_spi_trans(struct spi_device *spi, int len)
218218
return ret;
219219
}
220220

221-
static u8 hi3110_cmd(struct spi_device *spi, u8 command)
221+
static int hi3110_cmd(struct spi_device *spi, u8 command)
222222
{
223223
struct hi3110_priv *priv = spi_get_drvdata(spi);
224224

‎drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c

+1
Original file line numberDiff line numberDiff line change
@@ -2300,6 +2300,7 @@ static irqreturn_t mcp251xfd_irq(int irq, void *dev_id)
23002300
err, priv->regs_status.intf);
23012301
mcp251xfd_dump(priv);
23022302
mcp251xfd_chip_interrupts_disable(priv);
2303+
mcp251xfd_timestamp_stop(priv);
23032304

23042305
return handled;
23052306
}

‎drivers/net/can/usb/ems_usb.c

+13-1
Original file line numberDiff line numberDiff line change
@@ -255,6 +255,8 @@ struct ems_usb {
255255
unsigned int free_slots; /* remember number of available slots */
256256

257257
struct ems_cpc_msg active_params; /* active controller parameters */
258+
void *rxbuf[MAX_RX_URBS];
259+
dma_addr_t rxbuf_dma[MAX_RX_URBS];
258260
};
259261

260262
static void ems_usb_read_interrupt_callback(struct urb *urb)
@@ -587,6 +589,7 @@ static int ems_usb_start(struct ems_usb *dev)
587589
for (i = 0; i < MAX_RX_URBS; i++) {
588590
struct urb *urb = NULL;
589591
u8 *buf = NULL;
592+
dma_addr_t buf_dma;
590593

591594
/* create a URB, and a buffer for it */
592595
urb = usb_alloc_urb(0, GFP_KERNEL);
@@ -596,14 +599,16 @@ static int ems_usb_start(struct ems_usb *dev)
596599
}
597600

598601
buf = usb_alloc_coherent(dev->udev, RX_BUFFER_SIZE, GFP_KERNEL,
599-
&urb->transfer_dma);
602+
&buf_dma);
600603
if (!buf) {
601604
netdev_err(netdev, "No memory left for USB buffer\n");
602605
usb_free_urb(urb);
603606
err = -ENOMEM;
604607
break;
605608
}
606609

610+
urb->transfer_dma = buf_dma;
611+
607612
usb_fill_bulk_urb(urb, dev->udev, usb_rcvbulkpipe(dev->udev, 2),
608613
buf, RX_BUFFER_SIZE,
609614
ems_usb_read_bulk_callback, dev);
@@ -619,6 +624,9 @@ static int ems_usb_start(struct ems_usb *dev)
619624
break;
620625
}
621626

627+
dev->rxbuf[i] = buf;
628+
dev->rxbuf_dma[i] = buf_dma;
629+
622630
/* Drop reference, USB core will take care of freeing it */
623631
usb_free_urb(urb);
624632
}
@@ -684,6 +692,10 @@ static void unlink_all_urbs(struct ems_usb *dev)
684692

685693
usb_kill_anchored_urbs(&dev->rx_submitted);
686694

695+
for (i = 0; i < MAX_RX_URBS; ++i)
696+
usb_free_coherent(dev->udev, RX_BUFFER_SIZE,
697+
dev->rxbuf[i], dev->rxbuf_dma[i]);
698+
687699
usb_kill_anchored_urbs(&dev->tx_submitted);
688700
atomic_set(&dev->active_tx_urbs, 0);
689701

‎drivers/net/can/usb/esd_usb2.c

+15-1
Original file line numberDiff line numberDiff line change
@@ -195,6 +195,8 @@ struct esd_usb2 {
195195
int net_count;
196196
u32 version;
197197
int rxinitdone;
198+
void *rxbuf[MAX_RX_URBS];
199+
dma_addr_t rxbuf_dma[MAX_RX_URBS];
198200
};
199201

200202
struct esd_usb2_net_priv {
@@ -545,6 +547,7 @@ static int esd_usb2_setup_rx_urbs(struct esd_usb2 *dev)
545547
for (i = 0; i < MAX_RX_URBS; i++) {
546548
struct urb *urb = NULL;
547549
u8 *buf = NULL;
550+
dma_addr_t buf_dma;
548551

549552
/* create a URB, and a buffer for it */
550553
urb = usb_alloc_urb(0, GFP_KERNEL);
@@ -554,14 +557,16 @@ static int esd_usb2_setup_rx_urbs(struct esd_usb2 *dev)
554557
}
555558

556559
buf = usb_alloc_coherent(dev->udev, RX_BUFFER_SIZE, GFP_KERNEL,
557-
&urb->transfer_dma);
560+
&buf_dma);
558561
if (!buf) {
559562
dev_warn(dev->udev->dev.parent,
560563
"No memory left for USB buffer\n");
561564
err = -ENOMEM;
562565
goto freeurb;
563566
}
564567

568+
urb->transfer_dma = buf_dma;
569+
565570
usb_fill_bulk_urb(urb, dev->udev,
566571
usb_rcvbulkpipe(dev->udev, 1),
567572
buf, RX_BUFFER_SIZE,
@@ -574,8 +579,12 @@ static int esd_usb2_setup_rx_urbs(struct esd_usb2 *dev)
574579
usb_unanchor_urb(urb);
575580
usb_free_coherent(dev->udev, RX_BUFFER_SIZE, buf,
576581
urb->transfer_dma);
582+
goto freeurb;
577583
}
578584

585+
dev->rxbuf[i] = buf;
586+
dev->rxbuf_dma[i] = buf_dma;
587+
579588
freeurb:
580589
/* Drop reference, USB core will take care of freeing it */
581590
usb_free_urb(urb);
@@ -663,6 +672,11 @@ static void unlink_all_urbs(struct esd_usb2 *dev)
663672
int i, j;
664673

665674
usb_kill_anchored_urbs(&dev->rx_submitted);
675+
676+
for (i = 0; i < MAX_RX_URBS; ++i)
677+
usb_free_coherent(dev->udev, RX_BUFFER_SIZE,
678+
dev->rxbuf[i], dev->rxbuf_dma[i]);
679+
666680
for (i = 0; i < dev->net_count; i++) {
667681
priv = dev->nets[i];
668682
if (priv) {

‎drivers/net/can/usb/mcba_usb.c

+2
Original file line numberDiff line numberDiff line change
@@ -653,6 +653,8 @@ static int mcba_usb_start(struct mcba_priv *priv)
653653
break;
654654
}
655655

656+
urb->transfer_dma = buf_dma;
657+
656658
usb_fill_bulk_urb(urb, priv->udev,
657659
usb_rcvbulkpipe(priv->udev, MCBA_USB_EP_IN),
658660
buf, MCBA_USB_RX_BUFF_SIZE,

‎drivers/net/can/usb/peak_usb/pcan_usb.c

+6-4
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,8 @@
117117
#define PCAN_USB_BERR_MASK (PCAN_USB_ERR_RXERR | PCAN_USB_ERR_TXERR)
118118

119119
/* identify bus event packets with rx/tx error counters */
120-
#define PCAN_USB_ERR_CNT 0x80
120+
#define PCAN_USB_ERR_CNT_DEC 0x00 /* counters are decreasing */
121+
#define PCAN_USB_ERR_CNT_INC 0x80 /* counters are increasing */
121122

122123
/* private to PCAN-USB adapter */
123124
struct pcan_usb {
@@ -608,11 +609,12 @@ static int pcan_usb_handle_bus_evt(struct pcan_usb_msg_context *mc, u8 ir)
608609

609610
/* acccording to the content of the packet */
610611
switch (ir) {
611-
case PCAN_USB_ERR_CNT:
612+
case PCAN_USB_ERR_CNT_DEC:
613+
case PCAN_USB_ERR_CNT_INC:
612614

613615
/* save rx/tx error counters from in the device context */
614-
pdev->bec.rxerr = mc->ptr[0];
615-
pdev->bec.txerr = mc->ptr[1];
616+
pdev->bec.rxerr = mc->ptr[1];
617+
pdev->bec.txerr = mc->ptr[2];
616618
break;
617619

618620
default:

0 commit comments

Comments
 (0)