Skip to content
10 changes: 5 additions & 5 deletions drivers/net/ethernet/broadcom/bnxt/bnxt.c
Original file line number Diff line number Diff line change
Expand Up @@ -710,7 +710,6 @@ static void bnxt_tx_int(struct bnxt *bp, struct bnxt_napi *bnapi, int nr_pkts)

for (i = 0; i < nr_pkts; i++) {
struct bnxt_sw_tx_bd *tx_buf;
bool compl_deferred = false;
struct sk_buff *skb;
int j, last;

Expand All @@ -719,6 +718,8 @@ static void bnxt_tx_int(struct bnxt *bp, struct bnxt_napi *bnapi, int nr_pkts)
skb = tx_buf->skb;
tx_buf->skb = NULL;

tx_bytes += skb->len;

if (tx_buf->is_push) {
tx_buf->is_push = 0;
goto next_tx_int;
Expand All @@ -739,8 +740,9 @@ static void bnxt_tx_int(struct bnxt *bp, struct bnxt_napi *bnapi, int nr_pkts)
}
if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS)) {
if (bp->flags & BNXT_FLAG_CHIP_P5) {
/* PTP worker takes ownership of the skb */
if (!bnxt_get_tx_ts_p5(bp, skb))
compl_deferred = true;
skb = NULL;
else
atomic_inc(&bp->ptp_cfg->tx_avail);
}
Expand All @@ -749,9 +751,7 @@ static void bnxt_tx_int(struct bnxt *bp, struct bnxt_napi *bnapi, int nr_pkts)
next_tx_int:
cons = NEXT_TX(cons);

tx_bytes += skb->len;
if (!compl_deferred)
dev_kfree_skb_any(skb);
dev_kfree_skb_any(skb);
}

netdev_tx_completed_queue(txq, nr_pkts, tx_bytes);
Expand Down
7 changes: 3 additions & 4 deletions drivers/uio/uio.c
Original file line number Diff line number Diff line change
Expand Up @@ -464,13 +464,13 @@ static int uio_open(struct inode *inode, struct file *filep)

mutex_lock(&minor_lock);
idev = idr_find(&uio_idr, iminor(inode));
mutex_unlock(&minor_lock);
if (!idev) {
ret = -ENODEV;
mutex_unlock(&minor_lock);
goto out;
}

get_device(&idev->dev);
mutex_unlock(&minor_lock);

if (!try_module_get(idev->owner)) {
ret = -ENODEV;
Expand Down Expand Up @@ -1024,9 +1024,8 @@ void uio_unregister_device(struct uio_info *info)
wake_up_interruptible(&idev->wait);
kill_fasync(&idev->async_queue, SIGIO, POLL_HUP);

device_unregister(&idev->dev);

uio_free_minor(minor);
device_unregister(&idev->dev);

return;
}
Expand Down
3 changes: 3 additions & 0 deletions fs/cifs/link.c
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,9 @@ parse_mf_symlink(const u8 *buf, unsigned int buf_len, unsigned int *_link_len,
if (rc != 1)
return -EINVAL;

if (link_len > CIFS_MF_SYMLINK_LINK_MAXLEN)
return -EINVAL;

rc = symlink_hash(link_len, link_str, md5_hash);
if (rc) {
cifs_dbg(FYI, "%s: MD5 hash failure: %d\n", __func__, rc);
Expand Down
12 changes: 9 additions & 3 deletions fs/userfaultfd.c
Original file line number Diff line number Diff line change
Expand Up @@ -1801,9 +1801,15 @@ static int userfaultfd_writeprotect(struct userfaultfd_ctx *ctx,
if (mode_wp && mode_dontwake)
return -EINVAL;

ret = mwriteprotect_range(ctx->mm, uffdio_wp.range.start,
uffdio_wp.range.len, mode_wp,
&ctx->mmap_changing);
if (mmget_not_zero(ctx->mm)) {
ret = mwriteprotect_range(ctx->mm, uffdio_wp.range.start,
uffdio_wp.range.len, mode_wp,
&ctx->mmap_changing);
mmput(ctx->mm);
} else {
return -ESRCH;
}

if (ret)
return ret;

Expand Down
3 changes: 2 additions & 1 deletion net/bluetooth/hci_event.c
Original file line number Diff line number Diff line change
Expand Up @@ -5099,8 +5099,9 @@ static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
hci_dev_lock(hdev);

hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
if (hcon) {
if (hcon && hcon->type == AMP_LINK) {
hcon->state = BT_CLOSED;
hci_disconn_cfm(hcon, ev->reason);
hci_conn_del(hcon);
}

Expand Down
8 changes: 7 additions & 1 deletion net/ipv4/tcp_ipv4.c
Original file line number Diff line number Diff line change
Expand Up @@ -158,6 +158,12 @@ int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp)
if (tcptw->tw_ts_recent_stamp &&
(!twp || (reuse && time_after32(ktime_get_seconds(),
tcptw->tw_ts_recent_stamp)))) {
/* inet_twsk_hashdance() sets sk_refcnt after putting twsk
* and releasing the bucket lock.
*/
if (unlikely(!refcount_inc_not_zero(&sktw->sk_refcnt)))
return 0;

/* In case of repair and re-using TIME-WAIT sockets we still
* want to be sure that it is safe as above but honor the
* sequence numbers and time stamps set as part of the repair
Expand All @@ -178,7 +184,7 @@ int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp)
tp->rx_opt.ts_recent = tcptw->tw_ts_recent;
tp->rx_opt.ts_recent_stamp = tcptw->tw_ts_recent_stamp;
}
sock_hold(sktw);

return 1;
}

Expand Down
21 changes: 7 additions & 14 deletions net/ipv6/route.c
Original file line number Diff line number Diff line change
Expand Up @@ -4549,25 +4549,19 @@ static int ip6_route_multipath_add(struct fib6_config *cfg,
err_nh = NULL;
list_for_each_entry(nh, &rt6_nh_list, next) {
err = __ip6_ins_rt(nh->fib6_info, info, extack);
fib6_info_release(nh->fib6_info);

if (!err) {
/* save reference to last route successfully inserted */
rt_last = nh->fib6_info;

/* save reference to first route for notification */
if (!rt_notif)
rt_notif = nh->fib6_info;
}

/* nh->fib6_info is used or freed at this point, reset to NULL*/
nh->fib6_info = NULL;
if (err) {
if (replace && nhn)
ip6_print_replace_route_err(&rt6_nh_list);
err_nh = nh;
goto add_errout;
}
/* save reference to last route successfully inserted */
rt_last = nh->fib6_info;

/* save reference to first route for notification */
if (!rt_notif)
rt_notif = nh->fib6_info;

/* Because each route is added like a single route we remove
* these flags after the first nexthop: if there is a collision,
Expand Down Expand Up @@ -4626,8 +4620,7 @@ static int ip6_route_multipath_add(struct fib6_config *cfg,

cleanup:
list_for_each_entry_safe(nh, nh_safe, &rt6_nh_list, next) {
if (nh->fib6_info)
fib6_info_release(nh->fib6_info);
fib6_info_release(nh->fib6_info);
list_del(&nh->next);
kfree(nh);
}
Expand Down
13 changes: 9 additions & 4 deletions net/mptcp/pm_netlink.c
Original file line number Diff line number Diff line change
Expand Up @@ -351,15 +351,21 @@ mptcp_pm_del_add_timer(struct mptcp_sock *msk,
{
struct mptcp_pm_add_entry *entry;
struct sock *sk = (struct sock *)msk;
struct timer_list *add_timer = NULL;

spin_lock_bh(&msk->pm.lock);
entry = mptcp_lookup_anno_list_by_saddr(msk, addr);
if (entry && (!check_id || entry->addr.id == addr->id))
if (entry && (!check_id || entry->addr.id == addr->id)) {
entry->retrans_times = ADD_ADDR_RETRANS_MAX;
add_timer = &entry->add_timer;
}
if (!check_id && entry)
list_del(&entry->list);
spin_unlock_bh(&msk->pm.lock);

if (entry && (!check_id || entry->addr.id == addr->id))
sk_stop_timer_sync(sk, &entry->add_timer);
/* no lock, because sk_stop_timer_sync() is calling del_timer_sync() */
if (add_timer)
sk_stop_timer_sync(sk, add_timer);

return entry;
}
Expand Down Expand Up @@ -1107,7 +1113,6 @@ static bool remove_anno_list_by_saddr(struct mptcp_sock *msk,

entry = mptcp_pm_del_add_timer(msk, addr, false);
if (entry) {
list_del(&entry->list);
kfree(entry);
return true;
}
Expand Down