Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net...
authorDavid S. Miller <davem@davemloft.net>
Wed, 17 May 2023 08:19:23 +0000 (09:19 +0100)
committerDavid S. Miller <davem@davemloft.net>
Wed, 17 May 2023 08:19:23 +0000 (09:19 +0100)
Tony nguyen says:

====================
Intel Wired LAN Driver Updates 2023-05-16

This series contains updates to ice and iavf drivers.

Ahmed adds setting of missed condition for statistics which caused
incorrect reporting of values for ice. For iavf, he removes a call to set
VLAN offloads during re-initialization which can cause incorrect values
to be set.

Dawid adds checks to ensure VF is ready to be reset before executing
commands that will require it to be reset on ice.
---
v2:
Patch 2
- Redo commit message
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
18 files changed:
Documentation/devicetree/bindings/net/can/st,stm32-bxcan.yaml
arch/arm/boot/dts/stm32f429.dtsi
arch/arm/boot/dts/stm32f7-pinctrl.dtsi
arch/arm/boot/dts/stm32f746.dtsi
drivers/net/can/Kconfig
drivers/net/can/bxcan.c
drivers/net/can/dev/skb.c
drivers/net/dsa/mv88e6xxx/port.h
drivers/net/ethernet/sun/cassini.c
drivers/net/tun.c
net/can/isotp.c
net/can/j1939/socket.c
net/devlink/core.c
net/key/af_key.c
net/xfrm/xfrm_device.c
net/xfrm/xfrm_interface_core.c
net/xfrm/xfrm_policy.c
net/xfrm/xfrm_user.c

index 769fa5c27b76ee427a46daeef2055a516f29268f..de1d4298893be8b7f3c2090f338484d1bb9d6a5d 100644 (file)
@@ -21,11 +21,22 @@ properties:
 
   st,can-primary:
     description:
-      Primary and secondary mode of the bxCAN peripheral is only relevant
-      if the chip has two CAN peripherals. In that case they share some
-      of the required logic.
+      Primary mode of the bxCAN peripheral is only relevant if the chip has
+      two CAN peripherals in dual CAN configuration. In that case they share
+      some of the required logic.
+      Not to be used if the peripheral is in single CAN configuration.
       To avoid misunderstandings, it should be noted that ST documentation
-      uses the terms master/slave instead of primary/secondary.
+      uses the terms master instead of primary.
+    type: boolean
+
+  st,can-secondary:
+    description:
+      Secondary mode of the bxCAN peripheral is only relevant if the chip
+      has two CAN peripherals in dual CAN configuration. In that case they
+      share some of the required logic.
+      Not to be used if the peripheral is in single CAN configuration.
+      To avoid misunderstandings, it should be noted that ST documentation
+      uses the terms slave instead of secondary.
     type: boolean
 
   reg:
index c9e05e3540d6408791be69435b23bb3b131d554b..00bf53f99c294c6c183366798bbd3bca7569456b 100644 (file)
                        interrupt-names = "tx", "rx0", "rx1", "sce";
                        resets = <&rcc STM32F4_APB1_RESET(CAN2)>;
                        clocks = <&rcc 0 STM32F4_APB1_CLOCK(CAN2)>;
+                       st,can-secondary;
                        st,gcan = <&gcan>;
                        status = "disabled";
                };
index c8e6c52fb248e0bb405472ceefa11828fa7e07a9..9f65403295ca059fc917e1c575a32b77cab96a56 100644 (file)
                                        slew-rate = <2>;
                                };
                        };
+
+                       can1_pins_a: can1-0 {
+                               pins1 {
+                                       pinmux = <STM32_PINMUX('A', 12, AF9)>; /* CAN1_TX */
+                               };
+                               pins2 {
+                                       pinmux = <STM32_PINMUX('A', 11, AF9)>; /* CAN1_RX */
+                                       bias-pull-up;
+                               };
+                       };
+
+                       can1_pins_b: can1-1 {
+                               pins1 {
+                                       pinmux = <STM32_PINMUX('B', 9, AF9)>; /* CAN1_TX */
+                               };
+                               pins2 {
+                                       pinmux = <STM32_PINMUX('B', 8, AF9)>; /* CAN1_RX */
+                                       bias-pull-up;
+                               };
+                       };
+
+                       can1_pins_c: can1-2 {
+                               pins1 {
+                                       pinmux = <STM32_PINMUX('D', 1, AF9)>; /* CAN1_TX */
+                               };
+                               pins2 {
+                                       pinmux = <STM32_PINMUX('D', 0, AF9)>; /* CAN1_RX */
+                                       bias-pull-up;
+
+                               };
+                       };
+
+                       can1_pins_d: can1-3 {
+                               pins1 {
+                                       pinmux = <STM32_PINMUX('H', 13, AF9)>; /* CAN1_TX */
+                               };
+                               pins2 {
+                                       pinmux = <STM32_PINMUX('H', 14, AF9)>; /* CAN1_RX */
+                                       bias-pull-up;
+
+                               };
+                       };
+
+                       can2_pins_a: can2-0 {
+                               pins1 {
+                                       pinmux = <STM32_PINMUX('B', 6, AF9)>; /* CAN2_TX */
+                               };
+                               pins2 {
+                                       pinmux = <STM32_PINMUX('B', 5, AF9)>; /* CAN2_RX */
+                                       bias-pull-up;
+                               };
+                       };
+
+                       can2_pins_b: can2-1 {
+                               pins1 {
+                                       pinmux = <STM32_PINMUX('B', 13, AF9)>; /* CAN2_TX */
+                               };
+                               pins2 {
+                                       pinmux = <STM32_PINMUX('B', 12, AF9)>; /* CAN2_RX */
+                                       bias-pull-up;
+                               };
+                       };
+
+                       can3_pins_a: can3-0 {
+                               pins1 {
+                                       pinmux = <STM32_PINMUX('A', 15, AF11)>; /* CAN3_TX */
+                               };
+                               pins2 {
+                                       pinmux = <STM32_PINMUX('A', 8, AF11)>; /* CAN3_RX */
+                                       bias-pull-up;
+                               };
+                       };
+
+                       can3_pins_b: can3-1 {
+                               pins1 {
+                                       pinmux = <STM32_PINMUX('B', 4, AF11)>;  /* CAN3_TX */
+                               };
+                               pins2 {
+                                       pinmux = <STM32_PINMUX('B', 3, AF11)>; /* CAN3_RX */
+                                       bias-pull-up;
+                               };
+                       };
                };
        };
 };
index dc868e6da40e0fae8e98cfca3f3674efa61210d7..973698bc9ef4b63c6d2d9fedb7fa4eb375e18f28 100644 (file)
                        status = "disabled";
                };
 
+               can3: can@40003400 {
+                       compatible = "st,stm32f4-bxcan";
+                       reg = <0x40003400 0x200>;
+                       interrupts = <104>, <105>, <106>, <107>;
+                       interrupt-names = "tx", "rx0", "rx1", "sce";
+                       resets = <&rcc STM32F7_APB1_RESET(CAN3)>;
+                       clocks = <&rcc 0 STM32F7_APB1_CLOCK(CAN3)>;
+                       st,gcan = <&gcan3>;
+                       status = "disabled";
+               };
+
+               gcan3: gcan@40003600 {
+                       compatible = "st,stm32f4-gcan", "syscon";
+                       reg = <0x40003600 0x200>;
+                       clocks = <&rcc 0 STM32F7_APB1_CLOCK(CAN3)>;
+               };
+
                usart2: serial@40004400 {
                        compatible = "st,stm32f7-uart";
                        reg = <0x40004400 0x400>;
                        status = "disabled";
                };
 
+               can1: can@40006400 {
+                       compatible = "st,stm32f4-bxcan";
+                       reg = <0x40006400 0x200>;
+                       interrupts = <19>, <20>, <21>, <22>;
+                       interrupt-names = "tx", "rx0", "rx1", "sce";
+                       resets = <&rcc STM32F7_APB1_RESET(CAN1)>;
+                       clocks = <&rcc 0 STM32F7_APB1_CLOCK(CAN1)>;
+                       st,can-primary;
+                       st,gcan = <&gcan1>;
+                       status = "disabled";
+               };
+
+               gcan1: gcan@40006600 {
+                       compatible = "st,stm32f4-gcan", "syscon";
+                       reg = <0x40006600 0x200>;
+                       clocks = <&rcc 0 STM32F7_APB1_CLOCK(CAN1)>;
+               };
+
+               can2: can@40006800 {
+                       compatible = "st,stm32f4-bxcan";
+                       reg = <0x40006800 0x200>;
+                       interrupts = <63>, <64>, <65>, <66>;
+                       interrupt-names = "tx", "rx0", "rx1", "sce";
+                       resets = <&rcc STM32F7_APB1_RESET(CAN2)>;
+                       clocks = <&rcc 0 STM32F7_APB1_CLOCK(CAN2)>;
+                       st,can-secondary;
+                       st,gcan = <&gcan1>;
+                       status = "disabled";
+               };
+
                cec: cec@40006c00 {
                        compatible = "st,stm32-cec";
                        reg = <0x40006C00 0x400>;
index 3ceccafd701b2a319535791edd73d69513df45bc..b190007c01bec5f4e3b6bf11a60026560e09f333 100644 (file)
@@ -95,7 +95,7 @@ config CAN_AT91
 
 config CAN_BXCAN
        tristate "STM32 Basic Extended CAN (bxCAN) devices"
-       depends on OF || ARCH_STM32 || COMPILE_TEST
+       depends on ARCH_STM32 || COMPILE_TEST
        depends on HAS_IOMEM
        select CAN_RX_OFFLOAD
        help
index e26ccd41e3cba5ae4a13256e3b4dd3bca4ba3b0b..027a8a162fe49fb3457dd943b8d84cd55e4f319e 100644 (file)
 #define BXCAN_FiR1_REG(b) (0x40 + (b) * 8)
 #define BXCAN_FiR2_REG(b) (0x44 + (b) * 8)
 
-#define BXCAN_FILTER_ID(primary) (primary ? 0 : 14)
+#define BXCAN_FILTER_ID(cfg) ((cfg) == BXCAN_CFG_DUAL_SECONDARY ? 14 : 0)
 
 /* Filter primary register (FMR) bits */
 #define BXCAN_FMR_CANSB_MASK GENMASK(13, 8)
@@ -135,6 +135,12 @@ enum bxcan_lec_code {
        BXCAN_LEC_UNUSED
 };
 
+enum bxcan_cfg {
+       BXCAN_CFG_SINGLE = 0,
+       BXCAN_CFG_DUAL_PRIMARY,
+       BXCAN_CFG_DUAL_SECONDARY
+};
+
 /* Structure of the message buffer */
 struct bxcan_mb {
        u32 id;                 /* can identifier */
@@ -167,7 +173,7 @@ struct bxcan_priv {
        struct regmap *gcan;
        int tx_irq;
        int sce_irq;
-       bool primary;
+       enum bxcan_cfg cfg;
        struct clk *clk;
        spinlock_t rmw_lock;    /* lock for read-modify-write operations */
        unsigned int tx_head;
@@ -202,17 +208,17 @@ static inline void bxcan_rmw(struct bxcan_priv *priv, void __iomem *addr,
        spin_unlock_irqrestore(&priv->rmw_lock, flags);
 }
 
-static void bxcan_disable_filters(struct bxcan_priv *priv, bool primary)
+static void bxcan_disable_filters(struct bxcan_priv *priv, enum bxcan_cfg cfg)
 {
-       unsigned int fid = BXCAN_FILTER_ID(primary);
+       unsigned int fid = BXCAN_FILTER_ID(cfg);
        u32 fmask = BIT(fid);
 
        regmap_update_bits(priv->gcan, BXCAN_FA1R_REG, fmask, 0);
 }
 
-static void bxcan_enable_filters(struct bxcan_priv *priv, bool primary)
+static void bxcan_enable_filters(struct bxcan_priv *priv, enum bxcan_cfg cfg)
 {
-       unsigned int fid = BXCAN_FILTER_ID(primary);
+       unsigned int fid = BXCAN_FILTER_ID(cfg);
        u32 fmask = BIT(fid);
 
        /* Filter settings:
@@ -680,7 +686,7 @@ static int bxcan_chip_start(struct net_device *ndev)
                  BXCAN_BTR_BRP_MASK | BXCAN_BTR_TS1_MASK | BXCAN_BTR_TS2_MASK |
                  BXCAN_BTR_SJW_MASK, set);
 
-       bxcan_enable_filters(priv, priv->primary);
+       bxcan_enable_filters(priv, priv->cfg);
 
        /* Clear all internal status */
        priv->tx_head = 0;
@@ -806,7 +812,7 @@ static void bxcan_chip_stop(struct net_device *ndev)
                  BXCAN_IER_EPVIE | BXCAN_IER_EWGIE | BXCAN_IER_FOVIE1 |
                  BXCAN_IER_FFIE1 | BXCAN_IER_FMPIE1 | BXCAN_IER_FOVIE0 |
                  BXCAN_IER_FFIE0 | BXCAN_IER_FMPIE0 | BXCAN_IER_TMEIE, 0);
-       bxcan_disable_filters(priv, priv->primary);
+       bxcan_disable_filters(priv, priv->cfg);
        bxcan_enter_sleep_mode(priv);
        priv->can.state = CAN_STATE_STOPPED;
 }
@@ -931,7 +937,7 @@ static int bxcan_probe(struct platform_device *pdev)
        struct clk *clk = NULL;
        void __iomem *regs;
        struct regmap *gcan;
-       bool primary;
+       enum bxcan_cfg cfg;
        int err, rx_irq, tx_irq, sce_irq;
 
        regs = devm_platform_ioremap_resource(pdev, 0);
@@ -946,7 +952,13 @@ static int bxcan_probe(struct platform_device *pdev)
                return PTR_ERR(gcan);
        }
 
-       primary = of_property_read_bool(np, "st,can-primary");
+       if (of_property_read_bool(np, "st,can-primary"))
+               cfg = BXCAN_CFG_DUAL_PRIMARY;
+       else if (of_property_read_bool(np, "st,can-secondary"))
+               cfg = BXCAN_CFG_DUAL_SECONDARY;
+       else
+               cfg = BXCAN_CFG_SINGLE;
+
        clk = devm_clk_get(dev, NULL);
        if (IS_ERR(clk)) {
                dev_err(dev, "failed to get clock\n");
@@ -992,7 +1004,7 @@ static int bxcan_probe(struct platform_device *pdev)
        priv->clk = clk;
        priv->tx_irq = tx_irq;
        priv->sce_irq = sce_irq;
-       priv->primary = primary;
+       priv->cfg = cfg;
        priv->can.clock.freq = clk_get_rate(clk);
        spin_lock_init(&priv->rmw_lock);
        priv->tx_head = 0;
index 241ec636e91fd09f5006b694a3f32fec46662af6..f6d05b3ef59abf85a0bd7f40f9333983b44e4a90 100644 (file)
@@ -54,7 +54,8 @@ int can_put_echo_skb(struct sk_buff *skb, struct net_device *dev,
        /* check flag whether this packet has to be looped back */
        if (!(dev->flags & IFF_ECHO) ||
            (skb->protocol != htons(ETH_P_CAN) &&
-            skb->protocol != htons(ETH_P_CANFD))) {
+            skb->protocol != htons(ETH_P_CANFD) &&
+            skb->protocol != htons(ETH_P_CANXL))) {
                kfree_skb(skb);
                return 0;
        }
index aec9d4fd20e3631cbb9cc6eb3951b8e2d74ff644..d19b6303b91f0aafc6924d6098a93f93fc07213c 100644 (file)
 /* Offset 0x10: Extended Port Control Command */
 #define MV88E6393X_PORT_EPC_CMD                0x10
 #define MV88E6393X_PORT_EPC_CMD_BUSY   0x8000
-#define MV88E6393X_PORT_EPC_CMD_WRITE  0x0300
+#define MV88E6393X_PORT_EPC_CMD_WRITE  0x3000
 #define MV88E6393X_PORT_EPC_INDEX_PORT_ETYPE   0x02
 
 /* Offset 0x11: Extended Port Control Data */
index 4ef05bad4613c9309a81b00ba896b365a698eec7..d61dfa250feb722b67352104b272dbeebd056f0d 100644 (file)
@@ -5077,6 +5077,8 @@ err_out_iounmap:
                cas_shutdown(cp);
        mutex_unlock(&cp->pm_mutex);
 
+       vfree(cp->fw_data);
+
        pci_iounmap(pdev, cp->regs);
 
 
index d4d0a41a905a7e7fb332af8279136041b9229f23..d75456adc62ac82a4f9da10c50c48266c5a9a0c0 100644 (file)
@@ -1977,6 +1977,14 @@ napi_busy:
                int queue_len;
 
                spin_lock_bh(&queue->lock);
+
+               if (unlikely(tfile->detached)) {
+                       spin_unlock_bh(&queue->lock);
+                       rcu_read_unlock();
+                       err = -EBUSY;
+                       goto free_skb;
+               }
+
                __skb_queue_tail(queue, skb);
                queue_len = skb_queue_len(queue);
                spin_unlock(&queue->lock);
@@ -2512,6 +2520,13 @@ build:
        if (tfile->napi_enabled) {
                queue = &tfile->sk.sk_write_queue;
                spin_lock(&queue->lock);
+
+               if (unlikely(tfile->detached)) {
+                       spin_unlock(&queue->lock);
+                       kfree_skb(skb);
+                       return -EBUSY;
+               }
+
                __skb_queue_tail(queue, skb);
                spin_unlock(&queue->lock);
                ret = 1;
index a750259cb79c4fb93cfc6d7b50193d585831cca7..84f9aba029017c47349aaed84639228a538fece1 100644 (file)
@@ -1139,7 +1139,7 @@ static int isotp_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
        struct isotp_sock *so = isotp_sk(sk);
        int ret = 0;
 
-       if (flags & ~(MSG_DONTWAIT | MSG_TRUNC | MSG_PEEK))
+       if (flags & ~(MSG_DONTWAIT | MSG_TRUNC | MSG_PEEK | MSG_CMSG_COMPAT))
                return -EINVAL;
 
        if (!so->bound)
index 7e90f9e61d9bc5bac7e903fed4c8a7eadc7a8906..1790469b25808a8357e92ee3e42ffef9c06c0422 100644 (file)
@@ -798,7 +798,7 @@ static int j1939_sk_recvmsg(struct socket *sock, struct msghdr *msg,
        struct j1939_sk_buff_cb *skcb;
        int ret = 0;
 
-       if (flags & ~(MSG_DONTWAIT | MSG_ERRQUEUE))
+       if (flags & ~(MSG_DONTWAIT | MSG_ERRQUEUE | MSG_CMSG_COMPAT))
                return -EINVAL;
 
        if (flags & MSG_ERRQUEUE)
index 0e58eee44bdb20ab7265e5466f3054d1956de83a..c23ebabadc526e742b7f27f4c383ac7e3f5d62f2 100644 (file)
@@ -294,7 +294,7 @@ static struct pernet_operations devlink_pernet_ops __net_initdata = {
        .pre_exit = devlink_pernet_pre_exit,
 };
 
-static struct notifier_block devlink_port_netdevice_nb __net_initdata = {
+static struct notifier_block devlink_port_netdevice_nb = {
        .notifier_call = devlink_port_netdevice_event,
 };
 
index a815f5ab4c49a08a51f7ae5e1200e589621799e8..31ab12fd720aefdab9e3eced63d2a37d169516f9 100644 (file)
@@ -1940,7 +1940,8 @@ static u32 gen_reqid(struct net *net)
 }
 
 static int
-parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq)
+parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_policy *pol,
+                  struct sadb_x_ipsecrequest *rq)
 {
        struct net *net = xp_net(xp);
        struct xfrm_tmpl *t = xp->xfrm_vec + xp->xfrm_nr;
@@ -1958,9 +1959,12 @@ parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq)
        if ((mode = pfkey_mode_to_xfrm(rq->sadb_x_ipsecrequest_mode)) < 0)
                return -EINVAL;
        t->mode = mode;
-       if (rq->sadb_x_ipsecrequest_level == IPSEC_LEVEL_USE)
+       if (rq->sadb_x_ipsecrequest_level == IPSEC_LEVEL_USE) {
+               if ((mode == XFRM_MODE_TUNNEL || mode == XFRM_MODE_BEET) &&
+                   pol->sadb_x_policy_dir == IPSEC_DIR_OUTBOUND)
+                       return -EINVAL;
                t->optional = 1;
-       else if (rq->sadb_x_ipsecrequest_level == IPSEC_LEVEL_UNIQUE) {
+       else if (rq->sadb_x_ipsecrequest_level == IPSEC_LEVEL_UNIQUE) {
                t->reqid = rq->sadb_x_ipsecrequest_reqid;
                if (t->reqid > IPSEC_MANUAL_REQID_MAX)
                        t->reqid = 0;
@@ -2002,7 +2006,7 @@ parse_ipsecrequests(struct xfrm_policy *xp, struct sadb_x_policy *pol)
                    rq->sadb_x_ipsecrequest_len < sizeof(*rq))
                        return -EINVAL;
 
-               if ((err = parse_ipsecrequest(xp, rq)) < 0)
+               if ((err = parse_ipsecrequest(xp, pol, rq)) < 0)
                        return err;
                len -= rq->sadb_x_ipsecrequest_len;
                rq = (void*)((u8*)rq + rq->sadb_x_ipsecrequest_len);
index bef28c6187ebdd0cfc34c8594aab96ac0b13dd24..408f5e55744edd1c865fe679da6bc43e4413f2db 100644 (file)
@@ -378,7 +378,7 @@ int xfrm_dev_policy_add(struct net *net, struct xfrm_policy *xp,
                break;
        default:
                xdo->dev = NULL;
-               dev_put(dev);
+               netdev_put(dev, &xdo->dev_tracker);
                NL_SET_ERR_MSG(extack, "Unrecognized offload direction");
                return -EINVAL;
        }
index 35279c220bd786750da0ead2765a99b290539c5d..1f99dc46902719e6716b0cb93f95d1087d2c8bd8 100644 (file)
@@ -310,52 +310,6 @@ static void xfrmi_scrub_packet(struct sk_buff *skb, bool xnet)
        skb->mark = 0;
 }
 
-static int xfrmi_input(struct sk_buff *skb, int nexthdr, __be32 spi,
-                      int encap_type, unsigned short family)
-{
-       struct sec_path *sp;
-
-       sp = skb_sec_path(skb);
-       if (sp && (sp->len || sp->olen) &&
-           !xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family))
-               goto discard;
-
-       XFRM_SPI_SKB_CB(skb)->family = family;
-       if (family == AF_INET) {
-               XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
-               XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;
-       } else {
-               XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr);
-               XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = NULL;
-       }
-
-       return xfrm_input(skb, nexthdr, spi, encap_type);
-discard:
-       kfree_skb(skb);
-       return 0;
-}
-
-static int xfrmi4_rcv(struct sk_buff *skb)
-{
-       return xfrmi_input(skb, ip_hdr(skb)->protocol, 0, 0, AF_INET);
-}
-
-static int xfrmi6_rcv(struct sk_buff *skb)
-{
-       return xfrmi_input(skb, skb_network_header(skb)[IP6CB(skb)->nhoff],
-                          0, 0, AF_INET6);
-}
-
-static int xfrmi4_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
-{
-       return xfrmi_input(skb, nexthdr, spi, encap_type, AF_INET);
-}
-
-static int xfrmi6_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
-{
-       return xfrmi_input(skb, nexthdr, spi, encap_type, AF_INET6);
-}
-
 static int xfrmi_rcv_cb(struct sk_buff *skb, int err)
 {
        const struct xfrm_mode *inner_mode;
@@ -991,8 +945,8 @@ static struct pernet_operations xfrmi_net_ops = {
 };
 
 static struct xfrm6_protocol xfrmi_esp6_protocol __read_mostly = {
-       .handler        =       xfrmi6_rcv,
-       .input_handler  =       xfrmi6_input,
+       .handler        =       xfrm6_rcv,
+       .input_handler  =       xfrm_input,
        .cb_handler     =       xfrmi_rcv_cb,
        .err_handler    =       xfrmi6_err,
        .priority       =       10,
@@ -1042,8 +996,8 @@ static struct xfrm6_tunnel xfrmi_ip6ip_handler __read_mostly = {
 #endif
 
 static struct xfrm4_protocol xfrmi_esp4_protocol __read_mostly = {
-       .handler        =       xfrmi4_rcv,
-       .input_handler  =       xfrmi4_input,
+       .handler        =       xfrm4_rcv,
+       .input_handler  =       xfrm_input,
        .cb_handler     =       xfrmi_rcv_cb,
        .err_handler    =       xfrmi4_err,
        .priority       =       10,
index 5c61ec04b839ba1e0c7da13d96f9804c04b71f53..6d15788b512315f030899998354a7c8f4edc4e8c 100644 (file)
@@ -3312,7 +3312,7 @@ xfrm_secpath_reject(int idx, struct sk_buff *skb, const struct flowi *fl)
 
 static inline int
 xfrm_state_ok(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x,
-             unsigned short family)
+             unsigned short family, u32 if_id)
 {
        if (xfrm_state_kern(x))
                return tmpl->optional && !xfrm_state_addr_cmp(tmpl, x, tmpl->encap_family);
@@ -3323,7 +3323,8 @@ xfrm_state_ok(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x,
                (tmpl->allalgs || (tmpl->aalgos & (1<<x->props.aalgo)) ||
                 !(xfrm_id_proto_match(tmpl->id.proto, IPSEC_PROTO_ANY))) &&
                !(x->props.mode != XFRM_MODE_TRANSPORT &&
-                 xfrm_state_addr_cmp(tmpl, x, family));
+                 xfrm_state_addr_cmp(tmpl, x, family)) &&
+               (if_id == 0 || if_id == x->if_id);
 }
 
 /*
@@ -3335,7 +3336,7 @@ xfrm_state_ok(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x,
  */
 static inline int
 xfrm_policy_ok(const struct xfrm_tmpl *tmpl, const struct sec_path *sp, int start,
-              unsigned short family)
+              unsigned short family, u32 if_id)
 {
        int idx = start;
 
@@ -3345,7 +3346,7 @@ xfrm_policy_ok(const struct xfrm_tmpl *tmpl, const struct sec_path *sp, int star
        } else
                start = -1;
        for (; idx < sp->len; idx++) {
-               if (xfrm_state_ok(tmpl, sp->xvec[idx], family))
+               if (xfrm_state_ok(tmpl, sp->xvec[idx], family, if_id))
                        return ++idx;
                if (sp->xvec[idx]->props.mode != XFRM_MODE_TRANSPORT) {
                        if (start == -1)
@@ -3712,12 +3713,6 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
                }
                xfrm_nr = ti;
 
-               if (net->xfrm.policy_default[dir] == XFRM_USERPOLICY_BLOCK &&
-                   !xfrm_nr) {
-                       XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOSTATES);
-                       goto reject;
-               }
-
                if (npols > 1) {
                        xfrm_tmpl_sort(stp, tpp, xfrm_nr, family);
                        tpp = stp;
@@ -3730,7 +3725,7 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
                 * are implied between each two transformations.
                 */
                for (i = xfrm_nr-1, k = 0; i >= 0; i--) {
-                       k = xfrm_policy_ok(tpp[i], sp, k, family);
+                       k = xfrm_policy_ok(tpp[i], sp, k, family, if_id);
                        if (k < 0) {
                                if (k < -1)
                                        /* "-2 - errored_index" returned */
@@ -3745,9 +3740,6 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
                        goto reject;
                }
 
-               if (if_id)
-                       secpath_reset(skb);
-
                xfrm_pols_put(pols, npols);
                return 1;
        }
index d720e163ae6e5efb8342402f59be0db284fb0663..c34a2a06ca9407230ab66426bf14e39fd04637f4 100644 (file)
@@ -1770,7 +1770,7 @@ static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut,
 }
 
 static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family,
-                        struct netlink_ext_ack *extack)
+                        int dir, struct netlink_ext_ack *extack)
 {
        u16 prev_family;
        int i;
@@ -1796,6 +1796,10 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family,
                switch (ut[i].mode) {
                case XFRM_MODE_TUNNEL:
                case XFRM_MODE_BEET:
+                       if (ut[i].optional && dir == XFRM_POLICY_OUT) {
+                               NL_SET_ERR_MSG(extack, "Mode in optional template not allowed in outbound policy");
+                               return -EINVAL;
+                       }
                        break;
                default:
                        if (ut[i].family != prev_family) {
@@ -1833,7 +1837,7 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family,
 }
 
 static int copy_from_user_tmpl(struct xfrm_policy *pol, struct nlattr **attrs,
-                              struct netlink_ext_ack *extack)
+                              int dir, struct netlink_ext_ack *extack)
 {
        struct nlattr *rt = attrs[XFRMA_TMPL];
 
@@ -1844,7 +1848,7 @@ static int copy_from_user_tmpl(struct xfrm_policy *pol, struct nlattr **attrs,
                int nr = nla_len(rt) / sizeof(*utmpl);
                int err;
 
-               err = validate_tmpl(nr, utmpl, pol->family, extack);
+               err = validate_tmpl(nr, utmpl, pol->family, dir, extack);
                if (err)
                        return err;
 
@@ -1921,7 +1925,7 @@ static struct xfrm_policy *xfrm_policy_construct(struct net *net,
        if (err)
                goto error;
 
-       if (!(err = copy_from_user_tmpl(xp, attrs, extack)))
+       if (!(err = copy_from_user_tmpl(xp, attrs, p->dir, extack)))
                err = copy_from_user_sec_ctx(xp, attrs);
        if (err)
                goto error;
@@ -1980,6 +1984,7 @@ static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
 
        if (err) {
                xfrm_dev_policy_delete(xp);
+               xfrm_dev_policy_free(xp);
                security_xfrm_policy_free(xp->security);
                kfree(xp);
                return err;
@@ -3499,7 +3504,7 @@ static struct xfrm_policy *xfrm_compile_policy(struct sock *sk, int opt,
                return NULL;
 
        nr = ((len - sizeof(*p)) / sizeof(*ut));
-       if (validate_tmpl(nr, ut, p->sel.family, NULL))
+       if (validate_tmpl(nr, ut, p->sel.family, p->dir, NULL))
                return NULL;
 
        if (p->dir > XFRM_POLICY_OUT)