Merge tag 'net-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
 "This is again larger than usual: the backlog accumulated in the past weeks
  is not done yet. I'm not aware of any known pending regression.

  Including fixes from netfilter, Bluetooth, WiFi and CAN.

  Current release - regressions:

   - bluetooth: remove unnecessary hci_conn_get in create_conn_sync

   - can: isotp: fix timer drain order, wakeup handling and tx_gen
     ordering

   - eth:
       - tun/vhost: revert avoid ptr_ring tail-drop when a qdisc is
         present

  Previous releases - regressions:

   - core: do not send ICMP/NDISC Redirects when peer allocation fails

   - ipv6: take nexthop lock for f6i_list walks in replace check and
     notify

   - wifi: fix an ath12k MLO regression impacting WCN7850/QCC2072.

   - netfilter: nf_tables: make nft_object rhltable per table

   - af_unix: fix listen() succeeding on sockets in the wrong state

   - openvswitch: fix potential UAF on meter attach failure

   - bluetooth:
       - fix advertising data UAFs
       - avoid deadlocks in iso_sock_timeout

   - smc: fix socket use-after-free during link group termination

   - dpll: use pin owner's dpll ref for pin-level attribute reporting

   - eth:
       - veth: convert frag_list skbs before running XDP
       - ice: wait for reset completion in ice_resume()
       - igc: remove napi_synchronize() in igc_down()
       - vxlan: use pskb_network_may_pull() for transmit path header pulls

  Previous releases - always broken:

   - xsk: fix AF_XDP multi-buffer Tx descriptor reclaim

   - psp: fix NULL genl_sock deref race with concurrent netns teardown

   - netfilter: widen NAT rewrite delta to s32 in sip_help_tcp()

   - can: peak_usb: fix double free of transfer buffer on URB submit error

   - dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister

   - sctp: prevent peer transport count overflow

   - dsa: mt7530: error out on failed reads in MT7531 PHY polling

   - eth:
       - idpf: bound interrupt-vector register fill to the allocated array"

* tag 'net-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (156 commits)
  qede: sync udp_tunnel ports outside qede_lock in the recovery path
  net: openvswitch: fix potential UAF on meter attach failure
  octeontx2-pf: Set correct sequence for carrier off and tx queue stop
  net: libwx: fix FDIR ATR queue mismatch for software VLAN packets
  net: dsa: realtek: use devm_mutex_init for l2_lock
  net: dsa: realtek: use devm_mutex_init for vlan_lock
  net: dsa: realtek: use devm_mutex_init for regmap lock
  net: dsa: realtek: rtl8365mb: use devm_mutex_init for mib_lock
  ptp: netc: fix potential interrupt storm caused by incorrect unbind order
  net: mana: Return error code from mana_create_rxq()
  net: openvswitch: fix skb leak on flow key update failure during ct
  net: openvswitch: fix skb leak on flow key update failure during recirculation
  net: stmmac: Fix E2E delay mechanism
  net: dsa: mt7530: error out on failed reads in MT7531 PHY polling
  net: dsa: mt7530: error out on failed reads in ATC/VTCR command polling
  net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend
  Revert "tun/tap: add ptr_ring consume helper with netdev queue wakeup"
  Revert "vhost-net: wake queue of tun/tap after ptr_ring consume"
  Revert "ptr_ring: move free-space check into separate helper"
  Revert "tun/tap & vhost-net: avoid ptr_ring tail-drop when a qdisc is present"
  ...

4 files changed, 4 insertions, 22 deletions

diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h
index 5d491a98265e..12683b5d125e 100644
--- a/include/linux/ethtool.h
+++ b/include/linux/ethtool.h
@@ -562,6 +562,7 @@ struct ethtool_fec_hist {
 		u64 per_lane[ETHTOOL_MAX_LANES];
 	} values[ETHTOOL_FEC_HIST_MAX];
 	const struct ethtool_fec_hist_range *ranges;
+	struct ethtool_fec_hist_range ranges_buf[ETHTOOL_FEC_HIST_MAX];
 };
 /**
  * struct ethtool_fec_stats - statistics for IEEE 802.3 FEC
diff --git a/include/linux/if_tun.h b/include/linux/if_tun.h
index 5f3e206c7a73..80166eb62f41 100644
--- a/include/linux/if_tun.h
+++ b/include/linux/if_tun.h
@@ -22,7 +22,6 @@ struct tun_msg_ctl {
 #if defined(CONFIG_TUN) || defined(CONFIG_TUN_MODULE)
 struct socket *tun_get_socket(struct file *);
 struct ptr_ring *tun_get_tx_ring(struct file *file);
-void tun_wake_queue(struct file *file, int consumed);
 
 static inline bool tun_is_xdp_frame(void *ptr)
 {
@@ -56,8 +55,6 @@ static inline struct ptr_ring *tun_get_tx_ring(struct file *f)
 	return ERR_PTR(-EINVAL);
 }
 
-static inline void tun_wake_queue(struct file *f, int consumed) {}
-
 static inline bool tun_is_xdp_frame(void *ptr)
 {
 	return false;
diff --git a/include/linux/netfilter/nf_conntrack_sip.h b/include/linux/netfilter/nf_conntrack_sip.h
index dbc614dfe0d5..aafa0c04f917 100644
--- a/include/linux/netfilter/nf_conntrack_sip.h
+++ b/include/linux/netfilter/nf_conntrack_sip.h
@@ -115,7 +115,7 @@ struct nf_nat_sip_hooks {
 			    unsigned int *datalen);
 
 	void (*seq_adjust)(struct sk_buff *skb,
-			   unsigned int protoff, s16 off);
+			   unsigned int protoff, s32 off);
 
 	unsigned int (*expect)(struct sk_buff *skb,
 			       unsigned int protoff,
diff --git a/include/linux/ptr_ring.h b/include/linux/ptr_ring.h
index c95e891903f0..d2c3629bbe45 100644
--- a/include/linux/ptr_ring.h
+++ b/include/linux/ptr_ring.h
@@ -98,29 +98,13 @@ static inline bool ptr_ring_full_bh(struct ptr_ring *r)
 
 /* Note: callers invoking this in a loop must use a compiler barrier,
  * for example cpu_relax(). Callers must hold producer_lock.
- */
-static inline int __ptr_ring_check_produce(struct ptr_ring *r)
-{
-	if (unlikely(!r->size))
-		return -EINVAL;
-
-	if (data_race(r->queue[r->producer]))
-		return -ENOSPC;
-
-	return 0;
-}
-
-/* Note: callers invoking this in a loop must use a compiler barrier,
- * for example cpu_relax(). Callers must hold producer_lock.
  * Callers are responsible for making sure pointer that is being queued
  * points to a valid data.
  */
 static inline int __ptr_ring_produce(struct ptr_ring *r, void *ptr)
 {
-	int p = __ptr_ring_check_produce(r);
-
-	if (p)
-		return p;
+	if (unlikely(!r->size) || data_race(r->queue[r->producer]))
+		return -ENOSPC;
 
 	/* Make sure the pointer we are storing points to a valid data. */
 	/* Pairs with the dependency ordering in __ptr_ring_consume. */