mirror of
https://github.com/openwrt/openwrt.git
synced 2025-01-19 11:16:32 +00:00
kernel: bump 6.6 to 6.6.48
Changelog: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.48 Removed upstreamed: generic/backport-6.6/752-04-v6.6-net-ethernet-mtk_wed-check-update_wo_rx_stats-in-mtk.patch[1] generic/pending-6.6/601-udp-fix-receiving-fraglist-GSO_packets.patch[2] mediatek/patches-6.6/951-net-ethernet-mtk_wed-fix-use-after-free-panic-in-mtk.patch[3] rockchip/patches-6.6/302-mmc-allow-probe-to-defer-if-clock-is-not-ready.patch[4] Manually rebased: bcm27xx/patches-6.6/950-0058-Revert-Bluetooth-Always-request-for-user-confirmatio.patch All other patches automatically rebased. 1. https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.6.48&id=7ede6ef04c9ffc466844a297d3d68bea8a06093d 2. https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.6.48&id=cfa692e7e71b22d35174a796d10b9111bafa0686 3. https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.6.48&id=326a89321f9d5fe399fe6f9ff7c0fc766582a6a0 4. https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.6.48&id=7bbf8f8b8861dd2a6215f1aded425c66e6c376a0 Build system: x86/64 Build-tested: x86/64/AMD Cezanne, flogic/xiaomi_redmi-router-ax6000-ubootmod, ramips/tplink_archer-a6-v3 Run-tested: x86/64/AMD Cezanne, flogic/xiaomi_redmi-router-ax6000-ubootmod, ramips/tplink_archer-a6-v3 Signed-off-by: John Audia <therealgraysky@proton.me> Link: https://github.com/openwrt/openwrt/pull/16282 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit is contained in:
parent
8b2f7beb07
commit
93cca95434
@ -1,2 +1,2 @@
|
||||
LINUX_VERSION-6.6 = .47
|
||||
LINUX_KERNEL_HASH-6.6.47 = d43376c9e9eaa92bb1b926054bd160d329c58a62d64bd65fe1222c11c6564f50
|
||||
LINUX_VERSION-6.6 = .48
|
||||
LINUX_KERNEL_HASH-6.6.48 = 6b16df7b2aba3116b78fdfd8aea0b6cd7abe8f0cb699b04a66d3169141772029
|
||||
|
@ -751,7 +751,7 @@ SVN-Revision: 35130
|
||||
EXPORT_SYMBOL(xfrm_parse_spi);
|
||||
--- a/net/ipv4/tcp_input.c
|
||||
+++ b/net/ipv4/tcp_input.c
|
||||
@@ -4225,14 +4225,16 @@ static bool tcp_parse_aligned_timestamp(
|
||||
@@ -4221,14 +4221,16 @@ static bool tcp_parse_aligned_timestamp(
|
||||
{
|
||||
const __be32 *ptr = (const __be32 *)(th + 1);
|
||||
|
||||
|
@ -24,16 +24,16 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
|
||||
|
||||
--- a/net/bluetooth/smp.c
|
||||
+++ b/net/bluetooth/smp.c
|
||||
@@ -2221,7 +2221,7 @@ mackey_and_ltk:
|
||||
@@ -2222,7 +2222,7 @@ mackey_and_ltk:
|
||||
if (err)
|
||||
return SMP_UNSPECIFIED;
|
||||
|
||||
- if (smp->method == REQ_OOB) {
|
||||
+ if (smp->method == JUST_WORKS || smp->method == REQ_OOB) {
|
||||
if (hcon->out) {
|
||||
if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
|
||||
sc_dhkey_check(smp);
|
||||
SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
|
||||
@@ -2236,9 +2236,6 @@ mackey_and_ltk:
|
||||
@@ -2237,9 +2237,6 @@ mackey_and_ltk:
|
||||
confirm_hint = 0;
|
||||
|
||||
confirm:
|
||||
|
@ -17583,7 +17583,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
|
||||
* For devices with more than one control interface, we assume the
|
||||
--- a/sound/usb/quirks.c
|
||||
+++ b/sound/usb/quirks.c
|
||||
@@ -2189,6 +2189,8 @@ static const struct usb_audio_quirk_flag
|
||||
@@ -2191,6 +2191,8 @@ static const struct usb_audio_quirk_flag
|
||||
QUIRK_FLAG_ALIGN_TRANSFER),
|
||||
DEVICE_FLG(0x534d, 0x2109, /* MacroSilicon MS2109 */
|
||||
QUIRK_FLAG_ALIGN_TRANSFER),
|
||||
|
@ -125,7 +125,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
|
||||
* non-error returns are a promise to giveback() the urb later
|
||||
* we drop ownership so next owner (or urb unlink) can get it
|
||||
*/
|
||||
@@ -5326,6 +5429,7 @@ static const struct hc_driver xhci_hc_dr
|
||||
@@ -5328,6 +5431,7 @@ static const struct hc_driver xhci_hc_dr
|
||||
.endpoint_reset = xhci_endpoint_reset,
|
||||
.check_bandwidth = xhci_check_bandwidth,
|
||||
.reset_bandwidth = xhci_reset_bandwidth,
|
||||
|
@ -212,7 +212,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
|
||||
},
|
||||
--- a/drivers/usb/dwc3/core.c
|
||||
+++ b/drivers/usb/dwc3/core.c
|
||||
@@ -1181,6 +1181,24 @@ static void dwc3_config_threshold(struct
|
||||
@@ -1194,6 +1194,24 @@ static void dwc3_config_threshold(struct
|
||||
}
|
||||
}
|
||||
|
||||
@ -237,7 +237,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
|
||||
/**
|
||||
* dwc3_core_init - Low-level initialization of DWC3 Core
|
||||
* @dwc: Pointer to our controller context structure
|
||||
@@ -1246,6 +1264,8 @@ static int dwc3_core_init(struct dwc3 *d
|
||||
@@ -1259,6 +1277,8 @@ static int dwc3_core_init(struct dwc3 *d
|
||||
|
||||
dwc3_set_incr_burst_type(dwc);
|
||||
|
||||
@ -246,7 +246,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
|
||||
ret = dwc3_phy_power_on(dwc);
|
||||
if (ret)
|
||||
goto err_exit_phy;
|
||||
@@ -1320,6 +1340,24 @@ static int dwc3_core_init(struct dwc3 *d
|
||||
@@ -1333,6 +1353,24 @@ static int dwc3_core_init(struct dwc3 *d
|
||||
|
||||
dwc3_config_threshold(dwc);
|
||||
|
||||
@ -271,7 +271,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
|
||||
return 0;
|
||||
|
||||
err_power_off_phy:
|
||||
@@ -1463,6 +1501,7 @@ static void dwc3_get_properties(struct d
|
||||
@@ -1476,6 +1514,7 @@ static void dwc3_get_properties(struct d
|
||||
u8 tx_thr_num_pkt_prd = 0;
|
||||
u8 tx_max_burst_prd = 0;
|
||||
u8 tx_fifo_resize_max_num;
|
||||
@ -279,7 +279,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
|
||||
const char *usb_psy_name;
|
||||
int ret;
|
||||
|
||||
@@ -1485,6 +1524,9 @@ static void dwc3_get_properties(struct d
|
||||
@@ -1498,6 +1537,9 @@ static void dwc3_get_properties(struct d
|
||||
*/
|
||||
tx_fifo_resize_max_num = 6;
|
||||
|
||||
@ -289,7 +289,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
|
||||
dwc->maximum_speed = usb_get_maximum_speed(dev);
|
||||
dwc->max_ssp_rate = usb_get_maximum_ssp_rate(dev);
|
||||
dwc->dr_mode = usb_get_dr_mode(dev);
|
||||
@@ -1606,6 +1648,9 @@ static void dwc3_get_properties(struct d
|
||||
@@ -1619,6 +1661,9 @@ static void dwc3_get_properties(struct d
|
||||
dwc->dis_split_quirk = device_property_read_bool(dev,
|
||||
"snps,dis-split-quirk");
|
||||
|
||||
@ -299,7 +299,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
|
||||
dwc->lpm_nyet_threshold = lpm_nyet_threshold;
|
||||
dwc->tx_de_emphasis = tx_de_emphasis;
|
||||
|
||||
@@ -1623,6 +1668,8 @@ static void dwc3_get_properties(struct d
|
||||
@@ -1636,6 +1681,8 @@ static void dwc3_get_properties(struct d
|
||||
dwc->tx_thr_num_pkt_prd = tx_thr_num_pkt_prd;
|
||||
dwc->tx_max_burst_prd = tx_max_burst_prd;
|
||||
|
||||
@ -308,7 +308,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
|
||||
dwc->imod_interval = 0;
|
||||
|
||||
dwc->tx_fifo_resize_max_num = tx_fifo_resize_max_num;
|
||||
@@ -1898,6 +1945,12 @@ static int dwc3_probe(struct platform_de
|
||||
@@ -1911,6 +1958,12 @@ static int dwc3_probe(struct platform_de
|
||||
|
||||
dwc3_get_properties(dwc);
|
||||
|
||||
|
@ -16,7 +16,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
|
||||
|
||||
--- a/drivers/usb/dwc3/core.c
|
||||
+++ b/drivers/usb/dwc3/core.c
|
||||
@@ -1330,6 +1330,9 @@ static int dwc3_core_init(struct dwc3 *d
|
||||
@@ -1343,6 +1343,9 @@ static int dwc3_core_init(struct dwc3 *d
|
||||
if (dwc->parkmode_disable_hs_quirk)
|
||||
reg |= DWC3_GUCTL1_PARKMODE_DISABLE_HS;
|
||||
|
||||
@ -26,7 +26,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
|
||||
if (DWC3_VER_IS_WITHIN(DWC3, 290A, ANY) &&
|
||||
(dwc->maximum_speed == USB_SPEED_HIGH ||
|
||||
dwc->maximum_speed == USB_SPEED_FULL))
|
||||
@@ -1628,6 +1631,8 @@ static void dwc3_get_properties(struct d
|
||||
@@ -1641,6 +1644,8 @@ static void dwc3_get_properties(struct d
|
||||
"snps,parkmode-disable-ss-quirk");
|
||||
dwc->parkmode_disable_hs_quirk = device_property_read_bool(dev,
|
||||
"snps,parkmode-disable-hs-quirk");
|
||||
|
@ -65,7 +65,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
||||
}
|
||||
--- a/net/ipv4/udp_offload.c
|
||||
+++ b/net/ipv4/udp_offload.c
|
||||
@@ -361,6 +361,14 @@ struct sk_buff *__udp_gso_segment(struct
|
||||
@@ -362,6 +362,14 @@ struct sk_buff *__udp_gso_segment(struct
|
||||
else
|
||||
uh->check = gso_make_checksum(seg, ~check) ? : CSUM_MANGLED_0;
|
||||
|
||||
|
@ -71,8 +71,8 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
||||
|
||||
--- a/net/ipv4/udp_offload.c
|
||||
+++ b/net/ipv4/udp_offload.c
|
||||
@@ -282,6 +282,12 @@ struct sk_buff *__udp_gso_segment(struct
|
||||
skb_transport_header(gso_skb)))
|
||||
@@ -283,6 +283,12 @@ struct sk_buff *__udp_gso_segment(struct
|
||||
!(skb_shinfo(gso_skb)->gso_type & SKB_GSO_FRAGLIST)))
|
||||
return ERR_PTR(-EINVAL);
|
||||
|
||||
+ /* We don't know if egress device can segment and checksum the packet
|
||||
|
@ -1,26 +0,0 @@
|
||||
From: Lorenzo Bianconi <lorenzo@kernel.org>
|
||||
Date: Tue, 12 Sep 2023 10:28:00 +0200
|
||||
Subject: [PATCH] net: ethernet: mtk_wed: check update_wo_rx_stats in
|
||||
mtk_wed_update_rx_stats()
|
||||
|
||||
Check if update_wo_rx_stats function pointer is properly set in
|
||||
mtk_wed_update_rx_stats routine before accessing it.
|
||||
|
||||
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
|
||||
Reviewed-by: Simon Horman <horms@kernel.org>
|
||||
Link: https://lore.kernel.org/r/b0d233386e059bccb59f18f69afb79a7806e5ded.1694507226.git.lorenzo@kernel.org
|
||||
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
||||
---
|
||||
|
||||
--- a/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
|
||||
+++ b/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
|
||||
@@ -68,6 +68,9 @@ mtk_wed_update_rx_stats(struct mtk_wed_d
|
||||
struct mtk_wed_wo_rx_stats *stats;
|
||||
int i;
|
||||
|
||||
+ if (!wed->wlan.update_wo_rx_stats)
|
||||
+ return;
|
||||
+
|
||||
if (count * sizeof(*stats) > skb->len - sizeof(u32))
|
||||
return;
|
||||
|
@ -168,7 +168,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
||||
ext_mask |= MTK_WED_EXT_INT_STATUS_TX_DRV_R_RESP_ERR;
|
||||
else
|
||||
ext_mask |= MTK_WED_EXT_INT_STATUS_RX_FBUF_LO_TH |
|
||||
@@ -1840,7 +1840,7 @@ mtk_wed_setup_tc(struct mtk_wed_device *
|
||||
@@ -1842,7 +1842,7 @@ mtk_wed_setup_tc(struct mtk_wed_device *
|
||||
{
|
||||
struct mtk_wed_hw *hw = wed->hw;
|
||||
|
||||
@ -177,7 +177,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
||||
return -EOPNOTSUPP;
|
||||
|
||||
switch (type) {
|
||||
@@ -1914,9 +1914,9 @@ void mtk_wed_add_hw(struct device_node *
|
||||
@@ -1916,9 +1916,9 @@ void mtk_wed_add_hw(struct device_node *
|
||||
hw->wdma = wdma;
|
||||
hw->index = index;
|
||||
hw->irq = irq;
|
||||
|
@ -142,7 +142,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
||||
return -ENOMEM;
|
||||
|
||||
wdma_w32(dev, MTK_WDMA_RING_TX(idx) + MTK_WED_RING_OFS_BASE,
|
||||
@@ -1928,7 +1935,12 @@ void mtk_wed_add_hw(struct device_node *
|
||||
@@ -1930,7 +1937,12 @@ void mtk_wed_add_hw(struct device_node *
|
||||
hw->irq = irq;
|
||||
hw->version = eth->soc->version;
|
||||
|
||||
@ -156,7 +156,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
||||
hw->mirror = syscon_regmap_lookup_by_phandle(eth_np,
|
||||
"mediatek,pcie-mirror");
|
||||
hw->hifsys = syscon_regmap_lookup_by_phandle(eth_np,
|
||||
@@ -1942,6 +1954,8 @@ void mtk_wed_add_hw(struct device_node *
|
||||
@@ -1944,6 +1956,8 @@ void mtk_wed_add_hw(struct device_node *
|
||||
regmap_write(hw->mirror, 0, 0);
|
||||
regmap_write(hw->mirror, 4, 0);
|
||||
}
|
||||
|
@ -759,7 +759,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
||||
|
||||
val = wed_r32(dev, MTK_WED_EXT_INT_STATUS);
|
||||
wed_w32(dev, MTK_WED_EXT_INT_STATUS, val);
|
||||
@@ -1939,6 +2130,9 @@ void mtk_wed_add_hw(struct device_node *
|
||||
@@ -1941,6 +2132,9 @@ void mtk_wed_add_hw(struct device_node *
|
||||
case 2:
|
||||
hw->soc = &mt7986_data;
|
||||
break;
|
||||
|
@ -364,7 +364,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
||||
mtk_wed_start(struct mtk_wed_device *dev, u32 irq_mask)
|
||||
{
|
||||
int i;
|
||||
@@ -2212,6 +2503,10 @@ void mtk_wed_add_hw(struct device_node *
|
||||
@@ -2214,6 +2505,10 @@ void mtk_wed_add_hw(struct device_node *
|
||||
.detach = mtk_wed_detach,
|
||||
.ppe_check = mtk_wed_ppe_check,
|
||||
.setup_tc = mtk_wed_setup_tc,
|
||||
|
@ -10,7 +10,7 @@ Subject: [PATCH] Kconfig: add tristate for OID and ASNI string
|
||||
|
||||
--- a/init/Kconfig
|
||||
+++ b/init/Kconfig
|
||||
@@ -1990,7 +1990,7 @@ config PADATA
|
||||
@@ -1993,7 +1993,7 @@ config PADATA
|
||||
bool
|
||||
|
||||
config ASN1
|
||||
|
@ -131,7 +131,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
|
||||
struct gpio_desc *desc)
|
||||
--- a/drivers/gpio/gpiolib-sysfs.c
|
||||
+++ b/drivers/gpio/gpiolib-sysfs.c
|
||||
@@ -557,7 +557,7 @@ static struct class gpio_class = {
|
||||
@@ -558,7 +558,7 @@ static struct class gpio_class = {
|
||||
*
|
||||
* Returns zero on success, else an error.
|
||||
*/
|
||||
@ -140,7 +140,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
|
||||
{
|
||||
struct gpio_chip *chip;
|
||||
struct gpio_device *gdev;
|
||||
@@ -619,6 +619,8 @@ int gpiod_export(struct gpio_desc *desc,
|
||||
@@ -620,6 +620,8 @@ int gpiod_export(struct gpio_desc *desc,
|
||||
offset = gpio_chip_hwgpio(desc);
|
||||
if (chip->names && chip->names[offset])
|
||||
ioname = chip->names[offset];
|
||||
@ -149,7 +149,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
|
||||
|
||||
dev = device_create_with_groups(&gpio_class, &gdev->dev,
|
||||
MKDEV(0, 0), data, gpio_groups,
|
||||
@@ -640,8 +642,21 @@ err_unlock:
|
||||
@@ -641,8 +643,21 @@ err_unlock:
|
||||
gpiod_dbg(desc, "%s: status %d\n", __func__, status);
|
||||
return status;
|
||||
}
|
||||
|
@ -235,7 +235,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
|
||||
if (!pe)
|
||||
--- a/mm/vmalloc.c
|
||||
+++ b/mm/vmalloc.c
|
||||
@@ -4455,6 +4455,8 @@ static const struct seq_operations vmall
|
||||
@@ -4448,6 +4448,8 @@ static const struct seq_operations vmall
|
||||
|
||||
static int __init proc_vmalloc_init(void)
|
||||
{
|
||||
|
@ -1,26 +0,0 @@
|
||||
From 32412565c27d63e15f25e76d86ee04c29b201b96 Mon Sep 17 00:00:00 2001
|
||||
From: Felix Fietkau <nbd@nbd.name>
|
||||
Date: Mon, 19 Aug 2024 15:20:42 +0200
|
||||
Subject: [PATCH] udp: fix receiving fraglist GSO packets
|
||||
|
||||
When assembling fraglist GSO packets, udp4_gro_complete does not set
|
||||
skb->csum_start, which makes the extra validation in __udp_gso_segment fail.
|
||||
|
||||
Fixes: 89add40066f9 ("net: drop bad gso csum_start and offset in virtio_net_hdr")
|
||||
Signed-off-by: Felix Fietkau <nbd@nbd.name>
|
||||
---
|
||||
net/ipv4/udp_offload.c | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
--- a/net/ipv4/udp_offload.c
|
||||
+++ b/net/ipv4/udp_offload.c
|
||||
@@ -279,7 +279,8 @@ struct sk_buff *__udp_gso_segment(struct
|
||||
return ERR_PTR(-EINVAL);
|
||||
|
||||
if (unlikely(skb_checksum_start(gso_skb) !=
|
||||
- skb_transport_header(gso_skb)))
|
||||
+ skb_transport_header(gso_skb) &&
|
||||
+ !(skb_shinfo(gso_skb)->gso_type & SKB_GSO_FRAGLIST)))
|
||||
return ERR_PTR(-EINVAL);
|
||||
|
||||
/* We don't know if egress device can segment and checksum the packet
|
@ -338,7 +338,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
|
||||
if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6))
|
||||
return -1;
|
||||
|
||||
@@ -1543,6 +1704,14 @@ ip6_tnl_change(struct ip6_tnl *t, const
|
||||
@@ -1544,6 +1705,14 @@ ip6_tnl_change(struct ip6_tnl *t, const
|
||||
t->parms.link = p->link;
|
||||
t->parms.proto = p->proto;
|
||||
t->parms.fwmark = p->fwmark;
|
||||
@ -353,7 +353,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
|
||||
dst_cache_reset(&t->dst_cache);
|
||||
ip6_tnl_link_config(t);
|
||||
}
|
||||
@@ -1577,6 +1746,7 @@ ip6_tnl_parm_from_user(struct __ip6_tnl_
|
||||
@@ -1578,6 +1747,7 @@ ip6_tnl_parm_from_user(struct __ip6_tnl_
|
||||
p->flowinfo = u->flowinfo;
|
||||
p->link = u->link;
|
||||
p->proto = u->proto;
|
||||
@ -361,7 +361,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
|
||||
memcpy(p->name, u->name, sizeof(u->name));
|
||||
}
|
||||
|
||||
@@ -1964,6 +2134,15 @@ static int ip6_tnl_validate(struct nlatt
|
||||
@@ -1966,6 +2136,15 @@ static int ip6_tnl_validate(struct nlatt
|
||||
return 0;
|
||||
}
|
||||
|
||||
@ -377,7 +377,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
|
||||
static void ip6_tnl_netlink_parms(struct nlattr *data[],
|
||||
struct __ip6_tnl_parm *parms)
|
||||
{
|
||||
@@ -2001,6 +2180,46 @@ static void ip6_tnl_netlink_parms(struct
|
||||
@@ -2003,6 +2182,46 @@ static void ip6_tnl_netlink_parms(struct
|
||||
|
||||
if (data[IFLA_IPTUN_FWMARK])
|
||||
parms->fwmark = nla_get_u32(data[IFLA_IPTUN_FWMARK]);
|
||||
@ -424,7 +424,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
|
||||
}
|
||||
|
||||
static int ip6_tnl_newlink(struct net *src_net, struct net_device *dev,
|
||||
@@ -2084,6 +2303,12 @@ static void ip6_tnl_dellink(struct net_d
|
||||
@@ -2086,6 +2305,12 @@ static void ip6_tnl_dellink(struct net_d
|
||||
|
||||
static size_t ip6_tnl_get_size(const struct net_device *dev)
|
||||
{
|
||||
@ -437,7 +437,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
|
||||
return
|
||||
/* IFLA_IPTUN_LINK */
|
||||
nla_total_size(4) +
|
||||
@@ -2113,6 +2338,24 @@ static size_t ip6_tnl_get_size(const str
|
||||
@@ -2115,6 +2340,24 @@ static size_t ip6_tnl_get_size(const str
|
||||
nla_total_size(0) +
|
||||
/* IFLA_IPTUN_FWMARK */
|
||||
nla_total_size(4) +
|
||||
@ -462,7 +462,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
|
||||
0;
|
||||
}
|
||||
|
||||
@@ -2120,6 +2363,9 @@ static int ip6_tnl_fill_info(struct sk_b
|
||||
@@ -2122,6 +2365,9 @@ static int ip6_tnl_fill_info(struct sk_b
|
||||
{
|
||||
struct ip6_tnl *tunnel = netdev_priv(dev);
|
||||
struct __ip6_tnl_parm *parm = &tunnel->parms;
|
||||
@ -472,7 +472,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
|
||||
|
||||
if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) ||
|
||||
nla_put_in6_addr(skb, IFLA_IPTUN_LOCAL, &parm->laddr) ||
|
||||
@@ -2129,9 +2375,27 @@ static int ip6_tnl_fill_info(struct sk_b
|
||||
@@ -2131,9 +2377,27 @@ static int ip6_tnl_fill_info(struct sk_b
|
||||
nla_put_be32(skb, IFLA_IPTUN_FLOWINFO, parm->flowinfo) ||
|
||||
nla_put_u32(skb, IFLA_IPTUN_FLAGS, parm->flags) ||
|
||||
nla_put_u8(skb, IFLA_IPTUN_PROTO, parm->proto) ||
|
||||
@ -501,7 +501,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
|
||||
if (nla_put_u16(skb, IFLA_IPTUN_ENCAP_TYPE, tunnel->encap.type) ||
|
||||
nla_put_be16(skb, IFLA_IPTUN_ENCAP_SPORT, tunnel->encap.sport) ||
|
||||
nla_put_be16(skb, IFLA_IPTUN_ENCAP_DPORT, tunnel->encap.dport) ||
|
||||
@@ -2171,6 +2435,7 @@ static const struct nla_policy ip6_tnl_p
|
||||
@@ -2173,6 +2437,7 @@ static const struct nla_policy ip6_tnl_p
|
||||
[IFLA_IPTUN_ENCAP_DPORT] = { .type = NLA_U16 },
|
||||
[IFLA_IPTUN_COLLECT_METADATA] = { .type = NLA_FLAG },
|
||||
[IFLA_IPTUN_FWMARK] = { .type = NLA_U32 },
|
||||
|
@ -18,7 +18,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
|
||||
|
||||
--- a/net/netfilter/nf_tables_api.c
|
||||
+++ b/net/netfilter/nf_tables_api.c
|
||||
@@ -8279,7 +8279,7 @@ static int nft_register_flowtable_net_ho
|
||||
@@ -8322,7 +8322,7 @@ static int nft_register_flowtable_net_ho
|
||||
err = flowtable->data.type->setup(&flowtable->data,
|
||||
hook->ops.dev,
|
||||
FLOW_BLOCK_BIND);
|
||||
|
@ -1,59 +0,0 @@
|
||||
From 3da41fe88ff52c578f3155550bcbe0ecf388f079 Mon Sep 17 00:00:00 2001
|
||||
From: Zheng Zhang <everything411@qq.com>
|
||||
Date: Sat, 10 Aug 2024 12:01:56 +0800
|
||||
Subject: [PATCH] net: ethernet: mtk_wed: fix use-after-free panic in
|
||||
mtk_wed_setup_tc_block_cb()
|
||||
|
||||
When there are multiple ap interfaces on one band and with WED on,
|
||||
turning the interface down will cause a kernel panic on MT798X.
|
||||
|
||||
Previously, cb_priv was freed in mtk_wed_setup_tc_block() without
|
||||
marking NULL,and mtk_wed_setup_tc_block_cb() didn't check the value, too.
|
||||
|
||||
Assign NULL after free cb_priv in mtk_wed_setup_tc_block() and check NULL
|
||||
in mtk_wed_setup_tc_block_cb().
|
||||
|
||||
----------
|
||||
Unable to handle kernel paging request at virtual address 0072460bca32b4f5
|
||||
Call trace:
|
||||
mtk_wed_setup_tc_block_cb+0x4/0x38
|
||||
0xffffffc0794084bc
|
||||
tcf_block_playback_offloads+0x70/0x1e8
|
||||
tcf_block_unbind+0x6c/0xc8
|
||||
...
|
||||
---------
|
||||
|
||||
Fixes: 799684448e3e ("net: ethernet: mtk_wed: introduce wed wo support")
|
||||
Signed-off-by: Zheng Zhang <everything411@qq.com>
|
||||
---
|
||||
drivers/net/ethernet/mediatek/mtk_wed.c | 6 ++++--
|
||||
1 file changed, 4 insertions(+), 2 deletions(-)
|
||||
|
||||
--- a/drivers/net/ethernet/mediatek/mtk_wed.c
|
||||
+++ b/drivers/net/ethernet/mediatek/mtk_wed.c
|
||||
@@ -2685,14 +2685,15 @@ mtk_wed_setup_tc_block_cb(enum tc_setup_
|
||||
{
|
||||
struct mtk_wed_flow_block_priv *priv = cb_priv;
|
||||
struct flow_cls_offload *cls = type_data;
|
||||
- struct mtk_wed_hw *hw = priv->hw;
|
||||
+ struct mtk_wed_hw *hw = NULL;
|
||||
|
||||
- if (!tc_can_offload(priv->dev))
|
||||
+ if (!priv || !tc_can_offload(priv->dev))
|
||||
return -EOPNOTSUPP;
|
||||
|
||||
if (type != TC_SETUP_CLSFLOWER)
|
||||
return -EOPNOTSUPP;
|
||||
|
||||
+ hw = priv->hw;
|
||||
return mtk_flow_offload_cmd(hw->eth, cls, hw->index);
|
||||
}
|
||||
|
||||
@@ -2748,6 +2749,7 @@ mtk_wed_setup_tc_block(struct mtk_wed_hw
|
||||
flow_block_cb_remove(block_cb, f);
|
||||
list_del(&block_cb->driver_list);
|
||||
kfree(block_cb->cb_priv);
|
||||
+ block_cb->cb_priv = NULL;
|
||||
}
|
||||
return 0;
|
||||
default:
|
@ -18,7 +18,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
|
||||
--- a/drivers/usb/dwc3/core.c
|
||||
+++ b/drivers/usb/dwc3/core.c
|
||||
@@ -818,8 +818,20 @@ static int dwc3_clk_enable(struct dwc3 *
|
||||
@@ -831,8 +831,20 @@ static int dwc3_clk_enable(struct dwc3 *
|
||||
if (ret)
|
||||
goto disable_ref_clk;
|
||||
|
||||
@ -39,7 +39,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
disable_ref_clk:
|
||||
clk_disable_unprepare(dwc->ref_clk);
|
||||
disable_bus_clk:
|
||||
@@ -829,6 +841,8 @@ disable_bus_clk:
|
||||
@@ -842,6 +854,8 @@ disable_bus_clk:
|
||||
|
||||
static void dwc3_clk_disable(struct dwc3 *dwc)
|
||||
{
|
||||
@ -48,7 +48,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
clk_disable_unprepare(dwc->susp_clk);
|
||||
clk_disable_unprepare(dwc->ref_clk);
|
||||
clk_disable_unprepare(dwc->bus_clk);
|
||||
@@ -1842,6 +1856,20 @@ static int dwc3_get_clocks(struct dwc3 *
|
||||
@@ -1855,6 +1869,20 @@ static int dwc3_get_clocks(struct dwc3 *
|
||||
}
|
||||
}
|
||||
|
||||
|
@ -1,25 +0,0 @@
|
||||
--- a/drivers/mmc/host/dw_mmc.c
|
||||
+++ b/drivers/mmc/host/dw_mmc.c
|
||||
@@ -3294,6 +3294,10 @@ int dw_mci_probe(struct dw_mci *host)
|
||||
host->biu_clk = devm_clk_get(host->dev, "biu");
|
||||
if (IS_ERR(host->biu_clk)) {
|
||||
dev_dbg(host->dev, "biu clock not available\n");
|
||||
+ ret = PTR_ERR(host->biu_clk);
|
||||
+ if (ret == -EPROBE_DEFER) {
|
||||
+ return ret;
|
||||
+ }
|
||||
} else {
|
||||
ret = clk_prepare_enable(host->biu_clk);
|
||||
if (ret) {
|
||||
@@ -3305,6 +3309,11 @@ int dw_mci_probe(struct dw_mci *host)
|
||||
host->ciu_clk = devm_clk_get(host->dev, "ciu");
|
||||
if (IS_ERR(host->ciu_clk)) {
|
||||
dev_dbg(host->dev, "ciu clock not available\n");
|
||||
+ ret = PTR_ERR(host->ciu_clk);
|
||||
+ if (ret == -EPROBE_DEFER) {
|
||||
+ goto err_clk_biu;
|
||||
+ }
|
||||
+
|
||||
host->bus_hz = host->pdata->bus_hz;
|
||||
} else {
|
||||
ret = clk_prepare_enable(host->ciu_clk);
|
Loading…
Reference in New Issue
Block a user