Merge tag 'net-7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

fcee7d82 · Linus Torvalds <[email protected]> · 2026-05-07 10:32:03 -07:00

Pull networking fixes from Jakub Kicinski:
 "Including fixes from Netfilter, IPsec, Bluetooth and WiFi.

  Current release - fix to a fix:

   - ipmr: add __rcu to netns_ipv4.mrt, make sure we hold the RCU lock
     in all relevant places

  Current release - new code bugs:

   - fixes for the recently added resizable hash tables

   - ipv6: make sure we default IPv6 tunnel drivers to =m now that IPv6
     itself is built in

   - drv: octeontx2-af: fixes for parser/CAM fixes

  Previous releases - regressions:

   - phy: micrel: fix LAN8814 QSGMII soft reset

   - wifi:
       - cw1200: revert "Fix locking in error paths"
       - ath12k: fix crash on WCN7850, due to adding the same queue
         buffer to a list multiple times

  Previous releases - always broken:

   - number of info leak fixes

   - ipv6: implement limits on extension header parsing

   - wifi: number of fixes for missing bound checks in the drivers

   - Bluetooth: fixes for races and locking issues

   - af_unix:
       - fix an issue between garbage collection and PEEK
       - fix yet another issue with OOB data

   - xfrm: esp: avoid in-place decrypt on shared skb frags

   - netfilter: replace skb_try_make_writable() by skb_ensure_writable()

   - openvswitch: vport: fix race between tunnel creation and linking
     leading to invalid memory accesses (type confusion)

   - drv: amd-xgbe: fix PTP addend overflow causing frozen clock

  Misc:

   - sched/isolation: make HK_TYPE_KTHREAD an alias of HK_TYPE_DOMAIN
     (for relevant IPVS change)"

* tag 'net-7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (190 commits)
  net: sparx5: configure serdes for 1000BASE-X in sparx5_port_init()
  net: sparx5: fix wrong chip ids for TSN SKUs
  net: stmmac: dwmac-nuvoton: fix NULL pointer dereference in nvt_set_phy_intf_sel()
  tcp: Fix dst leak in tcp_v6_connect().
  ipmr: Call ipmr_fib_lookup() under RCU.
  net: phy: broadcom: Save PHY counters during suspend
  net/smc: fix missing sk_err when TCP handshake fails
  af_unix: Reject SIOCATMARK on non-stream sockets
  veth: fix OOB txq access in veth_poll() with asymmetric queue counts
  eth: fbnic: fix double-free of PCS on phylink creation failure
  net: ethernet: cortina: Drop half-assembled SKB
  selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl
  selftests: mptcp: check output: catch cmd errors
  mptcp: pm: prio: skip closed subflows
  mptcp: pm: ADD_ADDR rtx: return early if no retrans
  mptcp: pm: ADD_ADDR rtx: skip inactive subflows
  mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker
  mptcp: pm: ADD_ADDR rtx: free sk if last
  mptcp: pm: ADD_ADDR rtx: always decrease sk refcount
  mptcp: pm: ADD_ADDR rtx: fix potential data-race
  ...

Commit: fcee7d82f27d6a8b1ddc5bbefda59b4e441e9bc0
Parents: 19cbc75c · 41ae1407

Merge commit. Changes below are compared with the first parent: 19cbc75c.

Changes

189 files changed · +3479 −1154

File	Status	Add	Del	Content
MAINTAINERS	modified	+6	−0	View file
drivers/bluetooth/btintel_pcie.c	modified	+10	−3	View file
drivers/bluetooth/btintel_pcie.h	modified	+1	−1	View file
drivers/bluetooth/btmtk.c	modified	+13	−2	View file
drivers/bluetooth/hci_ath.c	modified	+3	−0	View file
drivers/bluetooth/hci_bcsp.c	modified	+3	−0	View file
drivers/bluetooth/hci_h4.c	modified	+3	−0	View file
drivers/bluetooth/hci_h5.c	modified	+3	−0	View file
drivers/bluetooth/virtio_bt.c	modified	+32	−7	View file
drivers/net/dsa/mt7530.c	modified	+72	−3	View file
drivers/net/dsa/mt7530.h	modified	+8	−0	View file
drivers/net/ethernet/airoha/airoha_eth.c	modified	+2	−4	View file
drivers/net/ethernet/amd/xgbe/xgbe.h	modified	+2	−2	View file
drivers/net/ethernet/broadcom/bnxt/bnxt.c	modified	+12	−4	View file
drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c	modified	+5	−24	View file
drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c	modified	+8	−2	View file
drivers/net/ethernet/cortina/gemini.c	modified	+5	−0	View file
drivers/net/ethernet/freescale/enetc/enetc.h	modified	+1	−0	View file
drivers/net/ethernet/freescale/enetc/enetc_vf.c	modified	+34	−8	View file
drivers/net/ethernet/marvell/octeontx2/af/cn20k/debugfs.c	modified	+10	−23	View file
drivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c	modified	+250	−124	View file
drivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.h	modified	+12	−12	View file
drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c	modified	+3	−0	View file
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c	modified	+199	−32	View file
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c	modified	+22	−8	View file
drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp.c	modified	+20	−16	View file
drivers/net/ethernet/mellanox/mlx5/core/en_main.c	modified	+23	−7	View file
drivers/net/ethernet/mellanox/mlx5/core/lib/sd.c	modified	+99	−15	View file
drivers/net/ethernet/mellanox/mlx5/core/lib/sd.h	modified	+2	−0	View file
drivers/net/ethernet/meta/fbnic/fbnic_netdev.c	modified	+2	−1	View file
drivers/net/ethernet/microchip/sparx5/sparx5_main.h	modified	+5	−5	View file
drivers/net/ethernet/microchip/sparx5/sparx5_port.c	modified	+2	−1	View file
drivers/net/ethernet/microsoft/mana/gdma_main.c	modified	+35	−5	View file
drivers/net/ethernet/microsoft/mana/mana_en.c	modified	+5	−5	View file
drivers/net/ethernet/microsoft/mana/shm_channel.c	modified	+0	−5	View file
drivers/net/ethernet/renesas/rtsn.c	modified	+4	−2	View file
drivers/net/ethernet/stmicro/stmmac/dwmac-nuvoton.c	modified	+2	−0	View file
drivers/net/ethernet/wangxun/libwx/wx_hw.c	modified	+5	−2	View file
drivers/net/ethernet/wangxun/libwx/wx_vf_common.c	modified	+2	−2	View file
drivers/net/netdevsim/netdev.c	modified	+2	−1	View file
drivers/net/netdevsim/netdevsim.h	modified	+3	−1	View file
drivers/net/netdevsim/psp.c	modified	+46	−19	View file
drivers/net/ovpn/io.c	modified	+7	−0	View file
drivers/net/phy/bcm-phy-lib.c	modified	+9	−0	View file
drivers/net/phy/bcm-phy-lib.h	modified	+1	−0	View file
drivers/net/phy/bcm7xxx.c	modified	+14	−0	View file
drivers/net/phy/broadcom.c	modified	+5	−0	View file
drivers/net/phy/micrel.c	modified	+8	−7	View file
drivers/net/usb/asix_devices.c	modified	+2	−0	View file
drivers/net/usb/cdc_ncm.c	modified	+8	−0	View file
drivers/net/usb/r8152.c	modified	+1	−0	View file
drivers/net/veth.c	modified	+2	−1	View file
drivers/net/wan/fsl_ucc_hdlc.c	modified	+2	−7	View file
drivers/net/wireless/ath/ath10k/Kconfig	modified	+1	−0	View file
drivers/net/wireless/ath/ath12k/core.c	modified	+48	−29	View file
drivers/net/wireless/ath/ath12k/dp_rx.c	modified	+4	−1	View file
drivers/net/wireless/ath/ath12k/mac.c	modified	+1	−1	View file
drivers/net/wireless/ath/ath12k/p2p.c	modified	+1	−1	View file
drivers/net/wireless/ath/ath12k/wmi.c	modified	+89	−16	View file
drivers/net/wireless/ath/ath5k/base.c	modified	+2	−1	View file
drivers/net/wireless/broadcom/b43/xmit.c	modified	+2	−1	View file
drivers/net/wireless/broadcom/b43legacy/xmit.c	modified	+2	−1	View file
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c	modified	+4	−2	View file
drivers/net/wireless/marvell/libertas/if_usb.c	modified	+4	−2	View file
drivers/net/wireless/rsi/rsi_common.h	modified	+2	−3	View file
drivers/net/wireless/st/cw1200/pm.c	modified	+0	−2	View file
drivers/net/wwan/t7xx/t7xx_modem_ops.c	modified	+17	−3	View file
drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c	modified	+16	−2	View file
drivers/net/wwan/t7xx/t7xx_port_proxy.h	modified	+1	−1	View file
include/linux/netfilter/x_tables.h	modified	+8	−0	View file
include/linux/sched/isolation.h	modified	+5	−1	View file
include/net/bluetooth/hci_core.h	modified	+1	−1	View file
include/net/dropreason-core.h	modified	+6	−0	View file
include/net/ip_vs.h	modified	+26	−5	View file
include/net/ipv6.h	modified	+3	−0	View file
include/net/mana/shm_channel.h	modified	+6	−0	View file
include/net/netfilter/nf_dup_netdev.h	modified	+13	−0	View file
include/net/netfilter/nf_flow_table.h	modified	+3	−1	View file
include/net/netns/ipv4.h	modified	+1	−1	View file
net/bluetooth/bnep/core.c	modified	+10	−3	View file
net/bluetooth/hci_conn.c	modified	+104	−20	View file
net/bluetooth/hci_event.c	modified	+26	−3	View file
net/bluetooth/hidp/core.c	modified	+24	−3	View file
net/bluetooth/iso.c	modified	+31	−25	View file
net/bluetooth/l2cap_core.c	modified	+3	−11	View file
net/bluetooth/l2cap_sock.c	modified	+9	−0	View file
net/bluetooth/rfcomm/core.c	modified	+5	−2	View file
net/bluetooth/sco.c	modified	+39	−21	View file
net/core/dev.c	modified	+1	−1	View file
net/core/netpoll.c	modified	+13	−10	View file
net/core/rtnetlink.c	modified	+1	−0	View file
net/ipv4/ah4.c	modified	+12	−2	View file
net/ipv4/esp4.c	modified	+2	−1	View file
net/ipv4/igmp.c	modified	+36	−22	View file
net/ipv4/inetpeer.c	modified	+2	−1	View file
net/ipv4/ip_output.c	modified	+2	−0	View file
net/ipv4/ipmr.c	modified	+6	−4	View file
net/ipv4/netfilter/nf_socket_ipv4.c	modified	+3	−0	View file
net/ipv4/tcp_ipv4.c	modified	+6	−8	View file
net/ipv4/tcp_minisocks.c	modified	+1	−1	View file
net/ipv6/Kconfig	modified	+2	−2	View file
net/ipv6/ah6.c	modified	+12	−2	View file
net/ipv6/esp6.c	modified	+2	−1	View file
net/ipv6/exthdrs_core.c	modified	+7	−0	View file
net/ipv6/ip6_gre.c	modified	+3	−2	View file
net/ipv6/ip6_input.c	modified	+5	−0	View file
net/ipv6/ip6_output.c	modified	+5	−0	View file
net/ipv6/ip6_tunnel.c	modified	+4	−0	View file
net/ipv6/netfilter/nf_socket_ipv6.c	modified	+3	−2	View file
net/ipv6/route.c	modified	+5	−0	View file
net/ipv6/tcp_ipv6.c	modified	+11	−6	View file
net/ipv6/xfrm6_protocol.c	modified	+3	−1	View file
net/mac80211/mlme.c	modified	+13	−5	View file
net/mac80211/rx.c	modified	+4	−2	View file
net/mac80211/tests/chan-mode.c	modified	+1	−0	View file
net/mac80211/util.c	modified	+2	−2	View file
net/mctp/test/route-test.c	modified	+1	−1	View file
net/mctp/test/utils.c	modified	+1	−1	View file
net/mptcp/fastopen.c	modified	+3	−1	View file
net/mptcp/pm.c	modified	+42	−20	View file
net/mptcp/pm_kernel.c	modified	+8	−5	View file
net/mptcp/sockopt.c	modified	+4	−0	View file
net/mptcp/subflow.c	modified	+2	−2	View file
net/netfilter/ipvs/ip_vs_conn.c	modified	+42	−34	View file
net/netfilter/ipvs/ip_vs_core.c	modified	+1	−1	View file
net/netfilter/ipvs/ip_vs_ctl.c	modified	+119	−45	View file
net/netfilter/ipvs/ip_vs_est.c	modified	+48	−35	View file
net/netfilter/nf_dup_netdev.c	modified	+0	−16	View file
net/netfilter/nf_flow_table_core.c	modified	+1	−0	View file
net/netfilter/nf_flow_table_ip.c	modified	+116	−35	View file
net/netfilter/nf_flow_table_path.c	modified	+6	−1	View file
net/netfilter/nf_tables_api.c	modified	+21	−14	View file
net/netfilter/nf_tables_core.c	modified	+1	−1	View file
net/netfilter/nft_compat.c	modified	+35	−10	View file
net/netfilter/nft_exthdr.c	modified	+1	−1	View file
net/netfilter/nft_fwd_netdev.c	modified	+25	−4	View file
net/netfilter/nft_osf.c	modified	+1	−1	View file
net/netfilter/nft_tproxy.c	modified	+4	−4	View file
net/netfilter/x_tables.c	modified	+71	−8	View file
net/netfilter/xt_CT.c	modified	+4	−4	View file
net/netfilter/xt_TCPMSS.c	modified	+17	−16	View file
net/netfilter/xt_TPROXY.c	modified	+9	−2	View file
net/netfilter/xt_addrtype.c	modified	+19	−6	View file
net/netfilter/xt_devgroup.c	modified	+13	−5	View file
net/netfilter/xt_ecn.c	modified	+4	−0	View file
net/netfilter/xt_hashlimit.c	modified	+3	−1	View file
net/netfilter/xt_osf.c	modified	+3	−0	View file
net/netfilter/xt_physdev.c	modified	+15	−5	View file
net/netfilter/xt_policy.c	modified	+19	−5	View file
net/netfilter/xt_set.c	modified	+25	−14	View file
net/netfilter/xt_tcpmss.c	modified	+4	−0	View file
net/openvswitch/vport-geneve.c	modified	+4	−1	View file
net/openvswitch/vport-gre.c	modified	+4	−1	View file
net/openvswitch/vport-netdev.c	modified	+40	−24	View file
net/openvswitch/vport-netdev.h	modified	+1	−1	View file
net/openvswitch/vport-vxlan.c	modified	+4	−1	View file
net/psp/psp_main.c	modified	+31	−11	View file
net/rds/message.c	modified	+15	−5	View file
net/sched/sch_cake.c	modified	+83	−72	View file
net/sched/sch_fq_codel.c	modified	+20	−19	View file
net/sched/sch_pie.c	modified	+6	−8	View file
net/sched/sch_red.c	modified	+1	−1	View file
net/sched/sch_sfb.c	modified	+1	−1	View file
net/sched/sch_sfq.c	modified	+25	−23	View file
net/smc/af_smc.c	modified	+2	−6	View file
net/tls/tls_sw.c	modified	+3	−3	View file
net/unix/af_unix.c	modified	+3	−0	View file
net/unix/garbage.c	modified	+3	−3	View file
net/vmw_vsock/virtio_transport_common.c	modified	+3	−1	View file
net/wireless/nl80211.c	modified	+27	−0	View file
net/wireless/pmsr.c	modified	+1	−1	View file
net/xdp/xsk.c	modified	+74	−41	View file
net/xdp/xsk_buff_pool.c	modified	+3	−0	View file
net/xfrm/xfrm_output.c	modified	+14	−6	View file
net/xfrm/xfrm_state.c	modified	+6	−6	View file
net/xfrm/xfrm_user.c	modified	+1	−0	View file
tools/testing/selftests/drivers/net/hw/Makefile	modified	+1	−0	View file
tools/testing/selftests/drivers/net/hw/config	modified	+5	−0	View file
tools/testing/selftests/drivers/net/hw/ipsec_vxlan.py	added	+204	−0	View file
tools/testing/selftests/drivers/net/lib/py/load.py	modified	+4	−1	View file
tools/testing/selftests/net/Makefile	modified	+1	−0	View file
tools/testing/selftests/net/mptcp/mptcp_lib.sh	modified	+10	−6	View file
tools/testing/selftests/net/mptcp/pm_netlink.sh	modified	+13	−7	View file
tools/testing/selftests/net/openvswitch/openvswitch.sh	modified	+37	−0	View file
tools/testing/selftests/net/openvswitch/ovs-dpctl.py	modified	+13	−6	View file
tools/testing/selftests/net/ovpn/test.sh	modified	+2	−2	View file
tools/testing/selftests/net/tcp_ecmp_failover.sh	added	+216	−0	View file
tools/testing/selftests/net/tls.c	modified	+43	−0	View file
tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json	modified	+148	−0	View file

Only the first 600 diff lines are shown. Download the complete patch.

MAINTAINERS

View file

diff --git a/MAINTAINERS b/MAINTAINERS
index 37b105a..0650fa0 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -7077,6 +7077,12 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git core/debugobjec
 F:	include/linux/debugobjects.h
 F:	lib/debugobjects.c
 
+DEC LANCE NETWORK DRIVER
+M:	"Maciej W. Rozycki" <[email protected]>
+L:	[email protected]
+S:	Maintained
+F:	drivers/net/ethernet/amd/declance.c
+
 DECSTATION PLATFORM SUPPORT
 M:	"Maciej W. Rozycki" <[email protected]>
 L:	[email protected]

drivers/bluetooth/btintel_pcie.c

View file

diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index 2f59c0d..a3643e6 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -289,6 +289,9 @@ static inline void btintel_pcie_dump_debug_registers(struct hci_dev *hdev)
 	skb_put_data(skb, buf, strlen(buf));
 	data->boot_stage_cache = reg;
 
+	if (reg & BTINTEL_PCIE_CSR_BOOT_STAGE_DEVICE_WARNING)
+		bt_dev_warn(hdev, "Controller device warning (boot_stage: 0x%8.8x)", reg);
+
 	reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_IPC_STATUS_REG);
 	snprintf(buf, sizeof(buf), "ipc status: 0x%8.8x", reg);
 	skb_put_data(skb, buf, strlen(buf));
@@ -880,8 +883,11 @@ static inline bool btintel_pcie_in_lockdown(struct btintel_pcie_data *data)
 
 static inline bool btintel_pcie_in_error(struct btintel_pcie_data *data)
 {
-	return (data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_DEVICE_ERR) ||
-		(data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_ABORT_HANDLER);
+	if (data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_DEVICE_WARNING)
+		bt_dev_warn(data->hdev, "Controller device warning (boot_stage: 0x%8.8x)",
+			    data->boot_stage_cache);
+
+	return	data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_ABORT_HANDLER;
 }
 
 static void btintel_pcie_msix_gp1_handler(struct btintel_pcie_data *data)
@@ -914,7 +920,8 @@ static void btintel_pcie_msix_gp0_handler(struct btintel_pcie_data *data)
 		data->img_resp_cache = reg;
 
 	if (btintel_pcie_in_error(data)) {
-		bt_dev_err(data->hdev, "Controller in error state");
+		bt_dev_err(data->hdev, "Controller in error state (boot_stage: 0x%8.8x)",
+			   data->boot_stage_cache);
 		btintel_pcie_dump_debug_registers(data->hdev);
 		return;
 	}

drivers/bluetooth/btintel_pcie.h

View file

diff --git a/drivers/bluetooth/btintel_pcie.h b/drivers/bluetooth/btintel_pcie.h
index 3c7bb70..f922abd 100644
--- a/drivers/bluetooth/btintel_pcie.h
+++ b/drivers/bluetooth/btintel_pcie.h
@@ -48,7 +48,7 @@
 #define BTINTEL_PCIE_CSR_BOOT_STAGE_OPFW		(BIT(2))
 #define BTINTEL_PCIE_CSR_BOOT_STAGE_ROM_LOCKDOWN	(BIT(10))
 #define BTINTEL_PCIE_CSR_BOOT_STAGE_IML_LOCKDOWN	(BIT(11))
-#define BTINTEL_PCIE_CSR_BOOT_STAGE_DEVICE_ERR		(BIT(12))
+#define BTINTEL_PCIE_CSR_BOOT_STAGE_DEVICE_WARNING	(BIT(12))
 #define BTINTEL_PCIE_CSR_BOOT_STAGE_ABORT_HANDLER	(BIT(13))
 #define BTINTEL_PCIE_CSR_BOOT_STAGE_DEVICE_HALTED	(BIT(14))
 #define BTINTEL_PCIE_CSR_BOOT_STAGE_MAC_ACCESS_ON	(BIT(16))

drivers/bluetooth/btmtk.c

View file

diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c
index 6fb6ca2..f70c1b0 100644
--- a/drivers/bluetooth/btmtk.c
+++ b/drivers/bluetooth/btmtk.c
@@ -695,8 +695,13 @@ static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
 	if (data->evt_skb == NULL)
 		goto err_free_wc;
 
-	/* Parse and handle the return WMT event */
-	wmt_evt = (struct btmtk_hci_wmt_evt *)data->evt_skb->data;
+	wmt_evt = skb_pull_data(data->evt_skb, sizeof(*wmt_evt));
+	if (!wmt_evt) {
+		bt_dev_err(hdev, "WMT event too short (%u bytes)",
+			   data->evt_skb->len);
+		err = -EINVAL;
+		goto err_free_skb;
+	}
 	if (wmt_evt->whdr.op != hdr->op) {
 		bt_dev_err(hdev, "Wrong op received %d expected %d",
 			   wmt_evt->whdr.op, hdr->op);
@@ -712,6 +717,12 @@ static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
 			status = BTMTK_WMT_PATCH_DONE;
 		break;
 	case BTMTK_WMT_FUNC_CTRL:
+		if (!skb_pull_data(data->evt_skb,
+				   sizeof(wmt_evt_funcc->status))) {
+			err = -EINVAL;
+			goto err_free_skb;
+		}
+
 		wmt_evt_funcc = (struct btmtk_hci_wmt_evt_funcc *)wmt_evt;
 		if (be16_to_cpu(wmt_evt_funcc->status) == 0x404)
 			status = BTMTK_WMT_ON_DONE;

drivers/bluetooth/hci_ath.c

View file

diff --git a/drivers/bluetooth/hci_ath.c b/drivers/bluetooth/hci_ath.c
index fa679ad..8201fa7 100644
--- a/drivers/bluetooth/hci_ath.c
+++ b/drivers/bluetooth/hci_ath.c
@@ -191,6 +191,9 @@ static int ath_recv(struct hci_uart *hu, const void *data, int count)
 {
 	struct ath_struct *ath = hu->priv;
 
+	if (!ath)
+		return -ENODEV;
+
 	ath->rx_skb = h4_recv_buf(hu, ath->rx_skb, data, count,
 				  ath_recv_pkts, ARRAY_SIZE(ath_recv_pkts));
 	if (IS_ERR(ath->rx_skb)) {

drivers/bluetooth/hci_bcsp.c

View file

diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c
index b386f91..db56eea 100644
--- a/drivers/bluetooth/hci_bcsp.c
+++ b/drivers/bluetooth/hci_bcsp.c
@@ -585,6 +585,9 @@ static int bcsp_recv(struct hci_uart *hu, const void *data, int count)
 	if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
 		return -EUNATCH;
 
+	if (!bcsp)
+		return -ENODEV;
+
 	BT_DBG("hu %p count %d rx_state %d rx_count %ld",
 	       hu, count, bcsp->rx_state, bcsp->rx_count);
 

drivers/bluetooth/hci_h4.c

View file

diff --git a/drivers/bluetooth/hci_h4.c b/drivers/bluetooth/hci_h4.c
index a889a66..7673727 100644
--- a/drivers/bluetooth/hci_h4.c
+++ b/drivers/bluetooth/hci_h4.c
@@ -109,6 +109,9 @@ static int h4_recv(struct hci_uart *hu, const void *data, int count)
 {
 	struct h4_struct *h4 = hu->priv;
 
+	if (!h4)
+		return -ENODEV;
+
 	h4->rx_skb = h4_recv_buf(hu, h4->rx_skb, data, count,
 				 h4_recv_pkts, ARRAY_SIZE(h4_recv_pkts));
 	if (IS_ERR(h4->rx_skb)) {

drivers/bluetooth/hci_h5.c

View file

diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
index cfdf75d..d353837 100644
--- a/drivers/bluetooth/hci_h5.c
+++ b/drivers/bluetooth/hci_h5.c
@@ -587,6 +587,9 @@ static int h5_recv(struct hci_uart *hu, const void *data, int count)
 	struct h5 *h5 = hu->priv;
 	const unsigned char *ptr = data;
 
+	if (!h5)
+		return -ENODEV;
+
 	BT_DBG("%s pending %zu count %d", hu->hdev->name, h5->rx_pending,
 	       count);
 

drivers/bluetooth/virtio_bt.c

View file

diff --git a/drivers/bluetooth/virtio_bt.c b/drivers/bluetooth/virtio_bt.c
index 76d61af..140ab55 100644
--- a/drivers/bluetooth/virtio_bt.c
+++ b/drivers/bluetooth/virtio_bt.c
@@ -12,6 +12,7 @@
 #include <net/bluetooth/hci_core.h>
 
 #define VERSION "0.1"
+#define VIRTBT_RX_BUF_SIZE 1000
 
 enum {
 	VIRTBT_VQ_TX,
@@ -33,11 +34,11 @@ static int virtbt_add_inbuf(struct virtio_bluetooth *vbt)
 	struct sk_buff *skb;
 	int err;
 
-	skb = alloc_skb(1000, GFP_KERNEL);
+	skb = alloc_skb(VIRTBT_RX_BUF_SIZE, GFP_KERNEL);
 	if (!skb)
 		return -ENOMEM;
 
-	sg_init_one(sg, skb->data, 1000);
+	sg_init_one(sg, skb->data, VIRTBT_RX_BUF_SIZE);
 
 	err = virtqueue_add_inbuf(vq, sg, 1, skb, GFP_KERNEL);
 	if (err < 0) {
@@ -197,6 +198,7 @@ static int virtbt_shutdown_generic(struct hci_dev *hdev)
 
 static void virtbt_rx_handle(struct virtio_bluetooth *vbt, struct sk_buff *skb)
 {
+	size_t min_hdr;
 	__u8 pkt_type;
 
 	pkt_type = *((__u8 *) skb->data);
@@ -204,16 +206,32 @@ static void virtbt_rx_handle(struct virtio_bluetooth *vbt, struct sk_buff *skb)
 
 	switch (pkt_type) {
 	case HCI_EVENT_PKT:
+		min_hdr = sizeof(struct hci_event_hdr);
+		break;
 	case HCI_ACLDATA_PKT:
+		min_hdr = sizeof(struct hci_acl_hdr);
+		break;
 	case HCI_SCODATA_PKT:
+		min_hdr = sizeof(struct hci_sco_hdr);
+		break;
 	case HCI_ISODATA_PKT:
-		hci_skb_pkt_type(skb) = pkt_type;
-		hci_recv_frame(vbt->hdev, skb);
+		min_hdr = sizeof(struct hci_iso_hdr);
 		break;
 	default:
 		kfree_skb(skb);
-		break;
+		return;
+	}
+
+	if (skb->len < min_hdr) {
+		bt_dev_err_ratelimited(vbt->hdev,
+				       "rx pkt_type 0x%02x payload %u < hdr %zu\n",
+				       pkt_type, skb->len, min_hdr);
+		kfree_skb(skb);
+		return;
 	}
+
+	hci_skb_pkt_type(skb) = pkt_type;
+	hci_recv_frame(vbt->hdev, skb);
 }
 
 static void virtbt_rx_work(struct work_struct *work)
@@ -227,8 +245,15 @@ static void virtbt_rx_work(struct work_struct *work)
 	if (!skb)
 		return;
 
-	skb_put(skb, len);
-	virtbt_rx_handle(vbt, skb);
+	if (!len || len > VIRTBT_RX_BUF_SIZE) {
+		bt_dev_err_ratelimited(vbt->hdev,
+				       "rx reply len %u outside [1, %u]\n",
+				       len, VIRTBT_RX_BUF_SIZE);
+		kfree_skb(skb);
+	} else {
+		skb_put(skb, len);
+		virtbt_rx_handle(vbt, skb);
+	}
 
 	if (virtbt_add_inbuf(vbt) < 0)
 		return;

drivers/net/dsa/mt7530.c

View file

diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
index b942338..44d6709 100644
--- a/drivers/net/dsa/mt7530.c
+++ b/drivers/net/dsa/mt7530.c
@@ -25,6 +25,9 @@
 
 #include "mt7530.h"
 
+#define MT7530_STATS_POLL_INTERVAL	(1 * HZ)
+#define MT7530_STATS_RATE_LIMIT		(HZ / 10)
+
 static struct mt753x_pcs *pcs_to_mt753x_pcs(struct phylink_pcs *pcs)
 {
 	return container_of(pcs, struct mt753x_pcs, pcs);
@@ -906,10 +909,9 @@ static void mt7530_get_rmon_stats(struct dsa_switch *ds, int port,
 	*ranges = mt7530_rmon_ranges;
 }
 
-static void mt7530_get_stats64(struct dsa_switch *ds, int port,
-			       struct rtnl_link_stats64 *storage)
+static void mt7530_read_port_stats64(struct mt7530_priv *priv, int port,
+				     struct rtnl_link_stats64 *storage)
 {
-	struct mt7530_priv *priv = ds->priv;
 	uint64_t data;
 
 	/* MIB counter doesn't provide a FramesTransmittedOK but instead
@@ -951,6 +953,54 @@ static void mt7530_get_stats64(struct dsa_switch *ds, int port,
 			       &storage->rx_crc_errors);
 }
 
+static void mt7530_stats_refresh(struct mt7530_priv *priv)
+{
+	struct rtnl_link_stats64 stats = {};
+	struct dsa_port *dp;
+	int port;
+
+	dsa_switch_for_each_user_port(dp, priv->ds) {
+		port = dp->index;
+
+		mt7530_read_port_stats64(priv, port, &stats);
+
+		spin_lock_bh(&priv->stats_lock);
+		priv->ports[port].stats = stats;
+		priv->stats_last = jiffies;
+		spin_unlock_bh(&priv->stats_lock);
+	}
+}
+
+static void mt7530_stats_poll(struct work_struct *work)
+{
+	struct mt7530_priv *priv = container_of(work, struct mt7530_priv,
+						stats_work.work);
+
+	mt7530_stats_refresh(priv);
+	schedule_delayed_work(&priv->stats_work,
+			      MT7530_STATS_POLL_INTERVAL);
+}
+
+static void mt7530_get_stats64(struct dsa_switch *ds, int port,
+			       struct rtnl_link_stats64 *storage)
+{
+	struct mt7530_priv *priv = ds->priv;
+	bool refresh;
+
+	if (priv->bus) {
+		spin_lock_bh(&priv->stats_lock);
+		*storage = priv->ports[port].stats;
+		refresh = time_after(jiffies, priv->stats_last +
+					      MT7530_STATS_RATE_LIMIT);
+		spin_unlock_bh(&priv->stats_lock);
+		if (refresh)
+			mod_delayed_work(system_percpu_wq,
+					 &priv->stats_work, 0);
+	} else {
+		mt7530_read_port_stats64(priv, port, storage);
+	}
+}
+
 static void mt7530_get_eth_ctrl_stats(struct dsa_switch *ds, int port,
 				      struct ethtool_eth_ctrl_stats *ctrl_stats)
 {
@@ -3137,9 +3187,24 @@ mt753x_setup(struct dsa_switch *ds)
 	if (ret && priv->irq_domain)
 		mt7530_free_mdio_irq(priv);
 
+	if (!ret && priv->bus) {
+		mt7530_stats_refresh(priv);
+		schedule_delayed_work(&priv->stats_work,
+				      MT7530_STATS_POLL_INTERVAL);
+	}
+
 	return ret;
 }
 
+static void
+mt753x_teardown(struct dsa_switch *ds)
+{
+	struct mt7530_priv *priv = ds->priv;
+
+	if (priv->bus)
+		cancel_delayed_work_sync(&priv->stats_work);
+}
+
 static int mt753x_set_mac_eee(struct dsa_switch *ds, int port,
 			      struct ethtool_keee *e)
 {
@@ -3257,6 +3322,7 @@ static int mt7988_setup(struct dsa_switch *ds)
 static const struct dsa_switch_ops mt7530_switch_ops = {
 	.get_tag_protocol	= mtk_get_tag_protocol,
 	.setup			= mt753x_setup,
+	.teardown		= mt753x_teardown,
 	.preferred_default_local_cpu_port = mt753x_preferred_default_local_cpu_port,
 	.get_strings		= mt7530_get_strings,
 	.get_ethtool_stats	= mt7530_get_ethtool_stats,
@@ -3395,6 +3461,9 @@ mt7530_probe_common(struct mt7530_priv *priv)
 	priv->ds->ops = &mt7530_switch_ops;
 	priv->ds->phylink_mac_ops = &mt753x_phylink_mac_ops;
 	mutex_init(&priv->reg_mutex);
+	spin_lock_init(&priv->stats_lock);
+	INIT_DELAYED_WORK(&priv->stats_work, mt7530_stats_poll);
+
 	dev_set_drvdata(dev, priv);
 
 	return 0;

drivers/net/dsa/mt7530.h

View file

diff --git a/drivers/net/dsa/mt7530.h b/drivers/net/dsa/mt7530.h
index 3e0090b..dd33b0d 100644
--- a/drivers/net/dsa/mt7530.h
+++ b/drivers/net/dsa/mt7530.h
@@ -796,6 +796,7 @@ struct mt7530_fdb {
  * @pvid:	The VLAN specified is to be considered a PVID at ingress.  Any
  *		untagged frames will be assigned to the related VLAN.
  * @sgmii_pcs:	Pointer to PCS instance for SerDes ports
+ * @stats:	Cached port statistics for MDIO-connected switches
  */
 struct mt7530_port {
 	bool enable;
@@ -803,6 +804,7 @@ struct mt7530_port {
 	u32 pm;
 	u16 pvid;
 	struct phylink_pcs *sgmii_pcs;
+	struct rtnl_link_stats64 stats;
 };
 
 /* Port 5 mode definitions of the MT7530 switch */
@@ -875,6 +877,9 @@ struct mt753x_info {
  * @create_sgmii:	Pointer to function creating SGMII PCS instance(s)
  * @active_cpu_ports:	Holding the active CPU ports
  * @mdiodev:		The pointer to the MDIO device structure
+ * @stats_lock:		Protects cached per-port stats from concurrent access
+ * @stats_work:		Delayed work for polling MIB counters on MDIO switches
+ * @stats_last:		Jiffies timestamp of last MIB counter poll
  */
 struct mt7530_priv {
 	struct device		*dev;
@@ -900,6 +905,9 @@ struct mt7530_priv {
 	int (*create_sgmii)(struct mt7530_priv *priv);
 	u8 active_cpu_ports;
 	struct mdio_device *mdiodev;
+	spinlock_t stats_lock; /* protects cached stats counters */
+	struct delayed_work stats_work;
+	unsigned long stats_last;
 };
 
 struct mt7530_hw_vlan_entry {

drivers/net/ethernet/airoha/airoha_eth.c

View file

diff --git a/drivers/net/ethernet/airoha/airoha_eth.c b/drivers/net/ethernet/airoha/airoha_eth.c
index f8b3d53..d0c0c0e 100644
--- a/drivers/net/ethernet/airoha/airoha_eth.c
+++ b/drivers/net/ethernet/airoha/airoha_eth.c
@@ -2120,14 +2120,12 @@ static netdev_tx_t airoha_dev_xmit(struct sk_buff *skb,
 	return NETDEV_TX_OK;
 
 error_unmap:
-	while (!list_empty(&tx_list)) {
-		e = list_first_entry(&tx_list, struct airoha_queue_entry,
-				     list);
+	list_for_each_entry(e, &tx_list, list) {
 		dma_unmap_single(dev->dev.parent, e->dma_addr, e->dma_len,
 				 DMA_TO_DEVICE);
 		e->dma_addr = 0;
-		list_move_tail(&e->list, &q->tx_list);
 	}
+	list_splice(&tx_list, &q->tx_list);
 
 	spin_unlock_bh(&q->lock);
 error:

drivers/net/ethernet/amd/xgbe/xgbe.h

View file

diff --git a/drivers/net/ethernet/amd/xgbe/xgbe.h b/drivers/net/ethernet/amd/xgbe/xgbe.h
index 60b7e53..3d3b090 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe.h
+++ b/drivers/net/ethernet/amd/xgbe/xgbe.h
@@ -135,11 +135,11 @@
  */
 #define XGBE_TSTAMP_SSINC	20
 #define XGBE_TSTAMP_SNSINC	0
-#define XGBE_PTP_ACT_CLK_FREQ	500000000
+#define XGBE_PTP_ACT_CLK_FREQ	(NSEC_PER_SEC / XGBE_TSTAMP_SSINC)
 
 #define XGBE_V2_TSTAMP_SSINC	0xA
 #define XGBE_V2_TSTAMP_SNSINC	0
-#define XGBE_V2_PTP_ACT_CLK_FREQ	1000000000
+#define XGBE_V2_PTP_ACT_CLK_FREQ	(NSEC_PER_SEC / XGBE_V2_TSTAMP_SSINC)
 
 /* Define maximum supported values */
 #define XGBE_MAX_PPS_OUT	4

drivers/net/ethernet/broadcom/bnxt/bnxt.c

View file

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 8c55874..008c34c 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -3825,7 +3825,10 @@ static int bnxt_alloc_tpa_info(struct bnxt *bp)
 	if (bp->flags & BNXT_FLAG_CHIP_P5_PLUS) {
 		if (!bp->max_tpa_v2)
 			return 0;
-		bp->max_tpa = max_t(u16, bp->max_tpa_v2, MAX_TPA_P5);
+		bp->max_tpa = min_t(u16, bp->max_tpa_v2, MAX_TPA_P5);
+		/* Older P5 FW sets max_tpa_v2 low by mistake except NPAR */
+		if (bp->max_tpa <= 32 && BNXT_CHIP_P5(bp) && !BNXT_NPAR(bp))
+			bp->max_tpa = MAX_TPA_P5;
 	}
 
 	for (i = 0; i < bp->rx_nr_rings; i++) {
@@ -17360,9 +17363,14 @@ static pci_ers_result_t bnxt_io_slot_reset(struct pci_dev *pdev)
 
 	netdev_info(bp->dev, "PCI Slot Reset\n");
 
-	if (!(bp->flags & BNXT_FLAG_CHIP_P5_PLUS) &&
-	    test_bit(BNXT_STATE_PCI_CHANNEL_IO_FROZEN, &bp->state))
-		msleep(900);
+	if (test_bit(BNXT_STATE_PCI_CHANNEL_IO_FROZEN, &bp->state)) {
+		/* After DPC, the chip should return CRS when the vendor ID
+		 * config register is read until it is ready.  On all chips,
+		 * this is not happening reliably so add a 5-second delay as a
+		 * workaround.
+		 */
+		msleep(5000);
+	}
 
 	netdev_lock(netdev);
 

drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c

View file

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c
index 53f336d..5d41dc1 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c
@@ -419,31 +419,13 @@ void bnxt_ptp_reapply_pps(struct bnxt *bp)
 	}
 }
 
-static int bnxt_get_target_cycles(struct bnxt_ptp_cfg *ptp, u64 target_ns,
-				  u64 *cycles_delta)
-{
-	u64 cycles_now;
-	u64 nsec_now, nsec_delta;
-	int rc;
-
-	rc = bnxt_refclk_read(ptp->bp, NULL, &cycles_now);
-	if (rc)
-		return rc;
-
-	nsec_now = bnxt_timecounter_cyc2time(ptp, cycles_now);
-
-	nsec_delta = target_ns - nsec_now;
-	*cycles_delta = div64_u64(nsec_delta << ptp->cc.shift, ptp->cc.mult);
-	return 0;
-}
-
 static int bnxt_ptp_perout_cfg(struct bnxt_ptp_cfg *ptp,
 			       struct ptp_clock_request *rq)
 {
 	struct hwrm_func_ptp_cfg_input *req;
 	struct bnxt *bp = ptp->bp;
 	struct timespec64 ts;
-	u64 target_ns, delta;
+	u64 target_ns;
 	u16 enables;
 	int rc;
 
@@ -451,10 +433,6 @@ static int bnxt_ptp_perout_cfg(struct bnxt_ptp_cfg *ptp,
 	ts.tv_nsec = rq->perout.start.nsec;
 	target_ns = timespec64_to_ns(&ts);
 
-	rc = bnxt_get_target_cycles(ptp, target_ns, &delta);
-	if (rc)
-		return rc;
-
 	rc = hwrm_req_init(bp, req, HWRM_FUNC_PTP_CFG);
 	if (rc)
 		return rc;
@@ -468,7 +446,10 @@ static int bnxt_ptp_perout_cfg(struct bnxt_ptp_cfg *ptp,
 	req->ptp_freq_adj_dll_phase = 0;
 	req->ptp_freq_adj_ext_period = cpu_to_le32(NSEC_PER_SEC);
 	req->ptp_freq_adj_ext_up = 0;
-	req->ptp_freq_adj_ext_phase_lower = cpu_to_le32(delta);
+	req->ptp_freq_adj_ext_phase_lower =
+		cpu_to_le32(lower_32_bits(target_ns));
+	req->ptp_freq_adj_ext_phase_upper =
+		cpu_to_le32(upper_32_bits(target_ns));
 
 	return hwrm_req_send(bp, req);
 }

drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c

View file

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
index 052bf69..5c75193 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
@@ -175,8 +175,14 @@ int bnxt_register_dev(struct bnxt_en_dev *edev,
 	ulp->handle = handle;
 	rcu_assign_pointer(ulp->ulp_ops, ulp_ops);
 
-	if (test_bit(BNXT_STATE_OPEN, &bp->state))
-		bnxt_hwrm_vnic_cfg(bp, &bp->vnic_info[BNXT_VNIC_DEFAULT]);
+	if (test_bit(BNXT_STATE_OPEN, &bp->state)) {
+		rc = bnxt_hwrm_vnic_cfg(bp, &bp->vnic_info[BNXT_VNIC_DEFAULT]);
+		if (rc) {
+			netdev_err(dev, "Failed to configure dual VNIC mode\n");
+			RCU_INIT_POINTER(ulp->ulp_ops, NULL);
+			goto exit;
+		}
+	}
 
 	edev->ulp_tbl->msix_requested = bnxt_get_ulp_msix_num(bp);
 

drivers/net/ethernet/cortina/gemini.c

View file

diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
index 4824232..065cbbf 100644
--- a/drivers/net/ethernet/cortina/gemini.c
+++ b/drivers/net/ethernet/cortina/gemini.c
@@ -1491,6 +1491,11 @@ static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget)
 		gpage = gmac_get_queue_page(geth, port, mapping + PAGE_SIZE);
 		if (!gpage) {
 			dev_err(geth->dev, "could not find mapping\n");
+			if (skb) {
+				napi_free_frags(&port->napi);
+				port->stats.rx_dropped++;
+				skb = NULL;
+			}
 			continue;
 		}
 		page = gpage->page;

drivers/net/ethernet/freescale/enetc/enetc.h

View file

diff --git a/drivers/net/ethernet/freescale/enetc/enetc.h b/drivers/net/ethernet/freescale/enetc/enetc.h
index e663bb5..e691144 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc.h
+++ b/drivers/net/ethernet/freescale/enetc/enetc.h
@@ -330,6 +330,7 @@ struct enetc_si {
 	struct workqueue_struct *workqueue;
 	struct work_struct rx_mode_task;
 	struct dentry *debugfs_root;
+	struct enetc_msg_swbd msg; /* Only valid for VSI */
 };
 
 #define ENETC_SI_ALIGN	32

drivers/net/ethernet/freescale/enetc/enetc_vf.c

View file

diff --git a/drivers/net/ethernet/freescale/enetc/enetc_vf.c b/drivers/net/ethernet/freescale/enetc/enetc_vf.c
index 6c4b374..df8e95c 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc_vf.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc_vf.c
@@ -17,11 +17,36 @@ static void enetc_msg_vsi_write_msg(struct enetc_hw *hw,
 	enetc_wr(hw, ENETC_VSIMSGSNDAR0, val);
 }
 

This diff is incomplete. Download the complete patch.