Skip to content

Commit 5cdb2c7

Browse files
torvaldstorvalds
committed
Merge tag 'net-6.15-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Paolo Abeni: "This is somewhat larger than what I hoped for, with a few PRs from subsystems and follow-ups for the recent netdev locking changes, anyhow there are no known pending regressions. Including fixes from bluetooth, ipsec and CAN. Current release - regressions: - eth: team: grab team lock during team_change_rx_flags - eth: bnxt_en: fix netdev locking in ULP IRQ functions Current release - new code bugs: - xfrm: ipcomp: fix truesize computation on receive - eth: airoha: fix page recycling in airoha_qdma_rx_process() Previous releases - regressions: - sched: hfsc: fix qlen accounting bug when using peek in hfsc_enqueue() - mr: consolidate the ipmr_can_free_table() checks. - bridge: netfilter: fix forwarding of fragmented packets - xsk: bring back busy polling support in XDP_COPY - can: - add missing rcu read protection for procfs content - kvaser_pciefd: force IRQ edge in case of nested IRQ Previous releases - always broken: - xfrm: espintcp: remove encap socket caching to avoid reference leak - bluetooth: use skb_pull to avoid unsafe access in QCA dump handling - eth: idpf: - fix null-ptr-deref in idpf_features_check - fix idpf_vport_splitq_napi_poll() - eth: hibmcge: fix wrong ndo.open() after reset fail issue" * tag 'net-6.15-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (40 commits) octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG octeontx2-af: Set LMT_ENA bit for APR table entries net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done octeontx2-pf: Avoid adding dcbnl_ops for LBK and SDP vf selftests/tc-testing: Add an HFSC qlen accounting test sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() idpf: fix idpf_vport_splitq_napi_poll() net: hibmcge: fix wrong ndo.open() after reset fail issue. net: hibmcge: fix incorrect statistics update issue xsk: Bring back busy polling support in XDP_COPY can: slcan: allow reception of short error messages net: lan743x: Restore SGMII CTRL register on resume bnxt_en: Fix netdev locking in ULP IRQ functions MAINTAINERS: Drop myself to reviewer for ravb driver net: dwmac-sun8i: Use parsed internal PHY address instead of 1 net: ethernet: ti: am65-cpsw: Lower random mac address error print to info can: kvaser_pciefd: Continue parsing DMA buf after dropped RX can: kvaser_pciefd: Fix echo_skb race can: kvaser_pciefd: Force IRQ edge in case of nested IRQ idpf: fix null-ptr-deref in idpf_features_check ...
2 parents b1819ae + 3fab2d2 commit 5cdb2c7

File tree

46 files changed

+452
-407
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

46 files changed

+452
-407
lines changed

‎Documentation/devicetree/bindings/net/can/microchip,mcp2510.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
22
%YAML 1.2
33
---
4-
$id: http://devicetree.org/schemas/can/microchip,mcp2510.yaml#
4+
$id: http://devicetree.org/schemas/net/can/microchip,mcp2510.yaml#
55
$schema: http://devicetree.org/meta-schemas/core.yaml#
66

77
title: Microchip MCP251X stand-alone CAN controller

‎MAINTAINERS

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20613,8 +20613,8 @@ F: Documentation/devicetree/bindings/i2c/renesas,iic-emev2.yaml
2061320613
F: drivers/i2c/busses/i2c-emev2.c
2061420614

2061520615
RENESAS ETHERNET AVB DRIVER
20616-
M: Paul Barker <[email protected]>
2061720616
M: Niklas Söderlund <[email protected]>
20617+
R: Paul Barker <[email protected]>
2061820618
L: [email protected]
2061920619
L: [email protected]
2062020620
S: Maintained

‎drivers/bluetooth/btusb.c

Lines changed: 40 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -3014,9 +3014,8 @@ static void btusb_coredump_qca(struct hci_dev *hdev)
30143014
static int handle_dump_pkt_qca(struct hci_dev *hdev, struct sk_buff *skb)
30153015
{
30163016
int ret = 0;
3017+
unsigned int skip = 0;
30173018
u8 pkt_type;
3018-
u8 *sk_ptr;
3019-
unsigned int sk_len;
30203019
u16 seqno;
30213020
u32 dump_size;
30223021

@@ -3025,18 +3024,13 @@ static int handle_dump_pkt_qca(struct hci_dev *hdev, struct sk_buff *skb)
30253024
struct usb_device *udev = btdata->udev;
30263025

30273026
pkt_type = hci_skb_pkt_type(skb);
3028-
sk_ptr = skb->data;
3029-
sk_len = skb->len;
3027+
skip = sizeof(struct hci_event_hdr);
3028+
if (pkt_type == HCI_ACLDATA_PKT)
3029+
skip += sizeof(struct hci_acl_hdr);
30303030

3031-
if (pkt_type == HCI_ACLDATA_PKT) {
3032-
sk_ptr += HCI_ACL_HDR_SIZE;
3033-
sk_len -= HCI_ACL_HDR_SIZE;
3034-
}
3035-
3036-
sk_ptr += HCI_EVENT_HDR_SIZE;
3037-
sk_len -= HCI_EVENT_HDR_SIZE;
3031+
skb_pull(skb, skip);
3032+
dump_hdr = (struct qca_dump_hdr *)skb->data;
30383033

3039-
dump_hdr = (struct qca_dump_hdr *)sk_ptr;
30403034
seqno = le16_to_cpu(dump_hdr->seqno);
30413035
if (seqno == 0) {
30423036
set_bit(BTUSB_HW_SSR_ACTIVE, &btdata->flags);
@@ -3056,16 +3050,15 @@ static int handle_dump_pkt_qca(struct hci_dev *hdev, struct sk_buff *skb)
30563050

30573051
btdata->qca_dump.ram_dump_size = dump_size;
30583052
btdata->qca_dump.ram_dump_seqno = 0;
3059-
sk_ptr += offsetof(struct qca_dump_hdr, data0);
3060-
sk_len -= offsetof(struct qca_dump_hdr, data0);
3053+
3054+
skb_pull(skb, offsetof(struct qca_dump_hdr, data0));
30613055

30623056
usb_disable_autosuspend(udev);
30633057
bt_dev_info(hdev, "%s memdump size(%u)\n",
30643058
(pkt_type == HCI_ACLDATA_PKT) ? "ACL" : "event",
30653059
dump_size);
30663060
} else {
3067-
sk_ptr += offsetof(struct qca_dump_hdr, data);
3068-
sk_len -= offsetof(struct qca_dump_hdr, data);
3061+
skb_pull(skb, offsetof(struct qca_dump_hdr, data));
30693062
}
30703063

30713064
if (!btdata->qca_dump.ram_dump_size) {
@@ -3085,7 +3078,6 @@ static int handle_dump_pkt_qca(struct hci_dev *hdev, struct sk_buff *skb)
30853078
return ret;
30863079
}
30873080

3088-
skb_pull(skb, skb->len - sk_len);
30893081
hci_devcd_append(hdev, skb);
30903082
btdata->qca_dump.ram_dump_seqno++;
30913083
if (seqno == QCA_LAST_SEQUENCE_NUM) {
@@ -3113,68 +3105,58 @@ static int handle_dump_pkt_qca(struct hci_dev *hdev, struct sk_buff *skb)
31133105
/* Return: true if the ACL packet is a dump packet, false otherwise. */
31143106
static bool acl_pkt_is_dump_qca(struct hci_dev *hdev, struct sk_buff *skb)
31153107
{
3116-
u8 *sk_ptr;
3117-
unsigned int sk_len;
3118-
31193108
struct hci_event_hdr *event_hdr;
31203109
struct hci_acl_hdr *acl_hdr;
31213110
struct qca_dump_hdr *dump_hdr;
3111+
struct sk_buff *clone = skb_clone(skb, GFP_ATOMIC);
3112+
bool is_dump = false;
31223113

3123-
sk_ptr = skb->data;
3124-
sk_len = skb->len;
3125-
3126-
acl_hdr = hci_acl_hdr(skb);
3127-
if (le16_to_cpu(acl_hdr->handle) != QCA_MEMDUMP_ACL_HANDLE)
3114+
if (!clone)
31283115
return false;
31293116

3130-
sk_ptr += HCI_ACL_HDR_SIZE;
3131-
sk_len -= HCI_ACL_HDR_SIZE;
3132-
event_hdr = (struct hci_event_hdr *)sk_ptr;
3133-
3134-
if ((event_hdr->evt != HCI_VENDOR_PKT) ||
3135-
(event_hdr->plen != (sk_len - HCI_EVENT_HDR_SIZE)))
3136-
return false;
3117+
acl_hdr = skb_pull_data(clone, sizeof(*acl_hdr));
3118+
if (!acl_hdr || (le16_to_cpu(acl_hdr->handle) != QCA_MEMDUMP_ACL_HANDLE))
3119+
goto out;
31373120

3138-
sk_ptr += HCI_EVENT_HDR_SIZE;
3139-
sk_len -= HCI_EVENT_HDR_SIZE;
3121+
event_hdr = skb_pull_data(clone, sizeof(*event_hdr));
3122+
if (!event_hdr || (event_hdr->evt != HCI_VENDOR_PKT))
3123+
goto out;
31403124

3141-
dump_hdr = (struct qca_dump_hdr *)sk_ptr;
3142-
if ((sk_len < offsetof(struct qca_dump_hdr, data)) ||
3143-
(dump_hdr->vse_class != QCA_MEMDUMP_VSE_CLASS) ||
3144-
(dump_hdr->msg_type != QCA_MEMDUMP_MSG_TYPE))
3145-
return false;
3125+
dump_hdr = skb_pull_data(clone, sizeof(*dump_hdr));
3126+
if (!dump_hdr || (dump_hdr->vse_class != QCA_MEMDUMP_VSE_CLASS) ||
3127+
(dump_hdr->msg_type != QCA_MEMDUMP_MSG_TYPE))
3128+
goto out;
31463129

3147-
return true;
3130+
is_dump = true;
3131+
out:
3132+
consume_skb(clone);
3133+
return is_dump;
31483134
}
31493135

31503136
/* Return: true if the event packet is a dump packet, false otherwise. */
31513137
static bool evt_pkt_is_dump_qca(struct hci_dev *hdev, struct sk_buff *skb)
31523138
{
3153-
u8 *sk_ptr;
3154-
unsigned int sk_len;
3155-
31563139
struct hci_event_hdr *event_hdr;
31573140
struct qca_dump_hdr *dump_hdr;
3141+
struct sk_buff *clone = skb_clone(skb, GFP_ATOMIC);
3142+
bool is_dump = false;
31583143

3159-
sk_ptr = skb->data;
3160-
sk_len = skb->len;
3161-
3162-
event_hdr = hci_event_hdr(skb);
3163-
3164-
if ((event_hdr->evt != HCI_VENDOR_PKT)
3165-
|| (event_hdr->plen != (sk_len - HCI_EVENT_HDR_SIZE)))
3144+
if (!clone)
31663145
return false;
31673146

3168-
sk_ptr += HCI_EVENT_HDR_SIZE;
3169-
sk_len -= HCI_EVENT_HDR_SIZE;
3147+
event_hdr = skb_pull_data(clone, sizeof(*event_hdr));
3148+
if (!event_hdr || (event_hdr->evt != HCI_VENDOR_PKT))
3149+
goto out;
31703150

3171-
dump_hdr = (struct qca_dump_hdr *)sk_ptr;
3172-
if ((sk_len < offsetof(struct qca_dump_hdr, data)) ||
3173-
(dump_hdr->vse_class != QCA_MEMDUMP_VSE_CLASS) ||
3174-
(dump_hdr->msg_type != QCA_MEMDUMP_MSG_TYPE))
3175-
return false;
3151+
dump_hdr = skb_pull_data(clone, sizeof(*dump_hdr));
3152+
if (!dump_hdr || (dump_hdr->vse_class != QCA_MEMDUMP_VSE_CLASS) ||
3153+
(dump_hdr->msg_type != QCA_MEMDUMP_MSG_TYPE))
3154+
goto out;
31763155

3177-
return true;
3156+
is_dump = true;
3157+
out:
3158+
consume_skb(clone);
3159+
return is_dump;
31783160
}
31793161

31803162
static int btusb_recv_acl_qca(struct hci_dev *hdev, struct sk_buff *skb)

0 commit comments

Comments
 (0)