mirror of
https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git
synced 2026-10-30 19:51:31 -04:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking fixes from David Miller:
"Several fixes here. Basically split down the line between newly
introduced regressions and long existing problems:
1) Double free in tipc_enable_bearer(), from Cong Wang.
2) Many fixes to nf_conncount, from Florian Westphal.
3) op->get_regs_len() can throw an error, check it, from Yunsheng
Lin.
4) Need to use GFP_ATOMIC in *_add_hash_mac_address() of fsl/fman
driver, from Scott Wood.
5) Inifnite loop in fib_empty_table(), from Yue Haibing.
6) Use after free in ax25_fillin_cb(), from Cong Wang.
7) Fix socket locking in nr_find_socket(), also from Cong Wang.
8) Fix WoL wakeup enable in r8169, from Heiner Kallweit.
9) On 32-bit sock->sk_stamp is not thread-safe, from Deepa Dinamani.
10) Fix ptr_ring wrap during queue swap, from Cong Wang.
11) Missing shutdown callback in hinic driver, from Xue Chaojing.
12) Need to return NULL on error from ip6_neigh_lookup(), from Stefano
Brivio.
13) BPF out of bounds speculation fixes from Daniel Borkmann"
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (57 commits)
ipv6: Consider sk_bound_dev_if when binding a socket to an address
ipv6: Fix dump of specific table with strict checking
bpf: add various test cases to selftests
bpf: prevent out of bounds speculation on pointer arithmetic
bpf: fix check_map_access smin_value test when pointer contains offset
bpf: restrict unknown scalars of mixed signed bounds for unprivileged
bpf: restrict stack pointer arithmetic for unprivileged
bpf: restrict map value pointer arithmetic for unprivileged
bpf: enable access to ax register also from verifier rewrite
bpf: move tmp variable into ax register in interpreter
bpf: move {prev_,}insn_idx into verifier env
isdn: fix kernel-infoleak in capi_unlocked_ioctl
ipv6: route: Fix return value of ip6_neigh_lookup() on neigh_create() error
net/hamradio/6pack: use mod_timer() to rearm timers
net-next/hinic:add shutdown callback
net: hns3: call hns3_nic_net_open() while doing HNAE3_UP_CLIENT
ip: validate header length on virtual device xmit
tap: call skb_probe_transport_header after setting skb->dev
ptr_ring: wrap back ->producer in __ptr_ring_swap_queue()
net: rds: remove unnecessary NULL check
...
This commit is contained in:
commit
43d86ee8c6
60 changed files with 2079 additions and 404 deletions
|
|
@ -198,11 +198,15 @@ static int fib4_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
|
|||
|
||||
static struct fib_table *fib_empty_table(struct net *net)
|
||||
{
|
||||
u32 id;
|
||||
u32 id = 1;
|
||||
|
||||
for (id = 1; id <= RT_TABLE_MAX; id++)
|
||||
while (1) {
|
||||
if (!fib_get_table(net, id))
|
||||
return fib_new_table(net, id);
|
||||
|
||||
if (id++ == RT_TABLE_MAX)
|
||||
break;
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -676,6 +676,9 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
|
|||
struct ip_tunnel *tunnel = netdev_priv(dev);
|
||||
const struct iphdr *tnl_params;
|
||||
|
||||
if (!pskb_inet_may_pull(skb))
|
||||
goto free_skb;
|
||||
|
||||
if (tunnel->collect_md) {
|
||||
gre_fb_xmit(skb, dev, skb->protocol);
|
||||
return NETDEV_TX_OK;
|
||||
|
|
@ -719,6 +722,9 @@ static netdev_tx_t erspan_xmit(struct sk_buff *skb,
|
|||
struct ip_tunnel *tunnel = netdev_priv(dev);
|
||||
bool truncate = false;
|
||||
|
||||
if (!pskb_inet_may_pull(skb))
|
||||
goto free_skb;
|
||||
|
||||
if (tunnel->collect_md) {
|
||||
erspan_fb_xmit(skb, dev, skb->protocol);
|
||||
return NETDEV_TX_OK;
|
||||
|
|
@ -762,6 +768,9 @@ static netdev_tx_t gre_tap_xmit(struct sk_buff *skb,
|
|||
{
|
||||
struct ip_tunnel *tunnel = netdev_priv(dev);
|
||||
|
||||
if (!pskb_inet_may_pull(skb))
|
||||
goto free_skb;
|
||||
|
||||
if (tunnel->collect_md) {
|
||||
gre_fb_xmit(skb, dev, htons(ETH_P_TEB));
|
||||
return NETDEV_TX_OK;
|
||||
|
|
|
|||
|
|
@ -627,7 +627,6 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
|
|||
const struct iphdr *tnl_params, u8 protocol)
|
||||
{
|
||||
struct ip_tunnel *tunnel = netdev_priv(dev);
|
||||
unsigned int inner_nhdr_len = 0;
|
||||
const struct iphdr *inner_iph;
|
||||
struct flowi4 fl4;
|
||||
u8 tos, ttl;
|
||||
|
|
@ -637,14 +636,6 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
|
|||
__be32 dst;
|
||||
bool connected;
|
||||
|
||||
/* ensure we can access the inner net header, for several users below */
|
||||
if (skb->protocol == htons(ETH_P_IP))
|
||||
inner_nhdr_len = sizeof(struct iphdr);
|
||||
else if (skb->protocol == htons(ETH_P_IPV6))
|
||||
inner_nhdr_len = sizeof(struct ipv6hdr);
|
||||
if (unlikely(!pskb_may_pull(skb, inner_nhdr_len)))
|
||||
goto tx_error;
|
||||
|
||||
inner_iph = (const struct iphdr *)skb_inner_network_header(skb);
|
||||
connected = (tunnel->parms.iph.daddr != 0);
|
||||
|
||||
|
|
|
|||
|
|
@ -241,6 +241,9 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
|
|||
struct ip_tunnel *tunnel = netdev_priv(dev);
|
||||
struct flowi fl;
|
||||
|
||||
if (!pskb_inet_may_pull(skb))
|
||||
goto tx_err;
|
||||
|
||||
memset(&fl, 0, sizeof(fl));
|
||||
|
||||
switch (skb->protocol) {
|
||||
|
|
@ -253,15 +256,18 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
|
|||
memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
|
||||
break;
|
||||
default:
|
||||
dev->stats.tx_errors++;
|
||||
dev_kfree_skb(skb);
|
||||
return NETDEV_TX_OK;
|
||||
goto tx_err;
|
||||
}
|
||||
|
||||
/* override mark with tunnel output key */
|
||||
fl.flowi_mark = be32_to_cpu(tunnel->parms.o_key);
|
||||
|
||||
return vti_xmit(skb, dev, &fl);
|
||||
|
||||
tx_err:
|
||||
dev->stats.tx_errors++;
|
||||
kfree_skb(skb);
|
||||
return NETDEV_TX_OK;
|
||||
}
|
||||
|
||||
static int vti4_err(struct sk_buff *skb, u32 info)
|
||||
|
|
|
|||
Loading…
Reference in a new issue