Merge tag 'net-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netHEADmaster

Pull networking fixes from Jakub Kicinski:
 "Including fixes from wireless, wireguard, CAN and Bluetooth.
  We have one known regression to wrap up in VLAN handling.

  Current release - regressions:

   - Bluetooth: RFCOMM: fix deadlock on rfcomm_mutex

  Previous releases - regressions:

   - can: fix regression in handling RPS after migrating metadata to skb_ext

   - eth:
      - iavf: fix regressions in reconfig impacting bonding
      - mana: fix packet forwarding performance regression
      - stmmac: remove buggy VLAN acceleration support

  Previous releases - always broken:

   - a few high prio fixes for tun, and af_packet

   - amt: fix a UaF on tunnel teardown

   - eth:
      - bnxt: fix PCIe AER recovery and FLR handling issues
      - macb: don't modify Tx skbs before taking ownership
      - axienet: don't leak Tx skbs on interface stop

   - wifi:
      - nxpwifi: number of LLM-ish fixes
      - assorted mt76 fixes"

* tag 'net-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (128 commits)
  net: macb: copy shared skbs before appending the FCS
  net: macb: check TX ring before modifying skb
  vsock: Fix memory leak in vmci_transport_recv_dgram_cb()
  wireguard: noise: reject response consumption after intermediate initiation
  wireguard: queueing: preserve tstamp_type when encapsulating packet
  net: openvswitch: validate transport header presence in set_ipv6_addr
  net/smc: protect clcsock lifetime in smc_getname
  ipv6: do not warn on route notification size race
  ipv4: do not warn on route notification size race
  ipv4: validate checksum_start before completing checksum
  ptp: ocp: fix PCIe delay estimation calculation
  xen/netfront: don't leak the skb when xennet_fill_frags() fails
  net/packet: call packet_parse_headers after virtio_net_hdr_to_skb
  xen/netfront: drop RX packets with a short Ethernet header
  net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()
  net: sparx5: free the matchall entry on destroy
  selftests: mlxsw: Test port range occupancy on template create
  mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()
  net: dsa: microchip: fix KSZ8765 fiber detection
  net/mlx5e: Order ICOSQ cc update after CQ doorbell
  ...

8 files changed, 42 insertions, 18 deletions

diff --git a/drivers/net/wireless/nxp/nxpwifi/11n.c b/drivers/net/wireless/nxp/nxpwifi/11n.c
index c2a54d781b42..25b2e430f3f9 100644
--- a/drivers/net/wireless/nxp/nxpwifi/11n.c
+++ b/drivers/net/wireless/nxp/nxpwifi/11n.c
@@ -451,7 +451,7 @@ void
 nxpwifi_11n_delete_tx_ba_stream_tbl_entry(struct nxpwifi_private *priv,
 					  struct nxpwifi_tx_ba_stream_tbl *tbl)
 {
-	if (!tbl || nxpwifi_is_tx_ba_stream_ptr_valid(priv, tbl))
+	if (!tbl || !nxpwifi_is_tx_ba_stream_ptr_valid(priv, tbl))
 		return;
 
 	nxpwifi_dbg(priv->adapter, INFO,
diff --git a/drivers/net/wireless/nxp/nxpwifi/11n_aggr.c b/drivers/net/wireless/nxp/nxpwifi/11n_aggr.c
index be7080f2a6ce..54933c42c960 100644
--- a/drivers/net/wireless/nxp/nxpwifi/11n_aggr.c
+++ b/drivers/net/wireless/nxp/nxpwifi/11n_aggr.c
@@ -168,6 +168,7 @@ nxpwifi_11n_aggregate_pkt(struct nxpwifi_private *priv,
 
 		if (!nxpwifi_is_ralist_valid(priv, pra_list, ptrindex)) {
 			spin_unlock_bh(&priv->wmm.ra_list_spinlock);
+			nxpwifi_write_data_complete(adapter, skb_aggr, 1, -1);
 			return -ENOENT;
 		}
 
diff --git a/drivers/net/wireless/nxp/nxpwifi/11n_rxreorder.c b/drivers/net/wireless/nxp/nxpwifi/11n_rxreorder.c
index 65b628411543..87cf2ec85991 100644
--- a/drivers/net/wireless/nxp/nxpwifi/11n_rxreorder.c
+++ b/drivers/net/wireless/nxp/nxpwifi/11n_rxreorder.c
@@ -205,11 +205,12 @@ void nxpwifi_11n_del_rx_reorder_tbl_by_ta(struct nxpwifi_private *priv, u8 *ta)
 		return;
 
 	for (i = 0; i < MAX_NUM_TID; i++) {
-		guard(rcu)();
-		list_for_each_entry_rcu(tbl, &priv->rx_reorder_tbl_ptr[i], list) {
-			if (!memcmp(tbl->ta, ta, ETH_ALEN)) {
-				INIT_LIST_HEAD(&tbl->tmp_list);
-				list_add_tail(&tbl->tmp_list, &to_delete);
+		scoped_guard(rcu) {
+			list_for_each_entry_rcu(tbl, &priv->rx_reorder_tbl_ptr[i], list) {
+				if (!memcmp(tbl->ta, ta, ETH_ALEN)) {
+					INIT_LIST_HEAD(&tbl->tmp_list);
+					list_add_tail(&tbl->tmp_list, &to_delete);
+				}
 			}
 		}
 
diff --git a/drivers/net/wireless/nxp/nxpwifi/cfg80211.c b/drivers/net/wireless/nxp/nxpwifi/cfg80211.c
index 86304ea3331c..473e81304ca8 100644
--- a/drivers/net/wireless/nxp/nxpwifi/cfg80211.c
+++ b/drivers/net/wireless/nxp/nxpwifi/cfg80211.c
@@ -1539,9 +1539,11 @@ nxpwifi_cfg80211_del_station(struct wiphy *wiphy, struct wireless_dev *wdev,
 
 	eth_zero_addr(deauth_mac);
 
+	rcu_read_lock();
 	sta_node = nxpwifi_get_sta_entry(priv, params->mac);
 	if (sta_node)
 		ether_addr_copy(deauth_mac, params->mac);
+	rcu_read_unlock();
 
 	if (is_valid_ether_addr(deauth_mac)) {
 		ret = nxpwifi_uap_sta_deauth(priv, deauth_mac);
@@ -3323,6 +3325,7 @@ nxpwifi_cfg80211_authenticate(struct wiphy *wiphy,
 	struct nxpwifi_adapter *adapter = priv->adapter;
 	struct sk_buff *skb;
 	u16 pkt_len, auth_alg;
+	size_t frame_len;
 	int ret;
 	struct ieee80211_mgmt *mgmt;
 	struct nxpwifi_txinfo *tx_info;
@@ -3396,13 +3399,25 @@ nxpwifi_cfg80211_authenticate(struct wiphy *wiphy,
 
 	nxpwifi_cancel_scan(adapter);
 
-	pkt_len = (u16)req->ie_len + req->auth_data_len +
-		NXPWIFI_MGMT_HEADER_LEN + NXPWIFI_AUTH_BODY_LEN;
+	frame_len = req->ie_len + req->auth_data_len +
+		sizeof(struct ieee80211_hdr_3addr) + NXPWIFI_AUTH_BODY_LEN;
 
 	if (req->auth_data_len >= 4)
-		pkt_len -= 4;
+		frame_len -= 4;
+
+	/* nxpwifi_form_mgmt_frame() inserts address4, so the frame handed to
+	 * the firmware is ETH_ALEN longer than the one built here.
+	 */
+	if (frame_len > U16_MAX - ETH_ALEN) {
+		nxpwifi_dbg(adapter, ERROR,
+			    "auth frame too long: %zu bytes\n", frame_len);
+		return -EINVAL;
+	}
+	pkt_len = frame_len + ETH_ALEN;
 
-	mgmt = kzalloc(pkt_len, GFP_KERNEL);
+	mgmt = kzalloc(frame_len, GFP_KERNEL);
+	if (!mgmt)
+		return -ENOMEM;
 
 	skb = dev_alloc_skb(NXPWIFI_MIN_DATA_HEADER_LEN +
 			    NXPWIFI_MGMT_FRAME_HEADER_SIZE +
@@ -3410,6 +3425,7 @@ nxpwifi_cfg80211_authenticate(struct wiphy *wiphy,
 	if (!skb) {
 		nxpwifi_dbg(adapter, ERROR,
 			    "allocate skb failed for management frame\n");
+		kfree(mgmt);
 		return -ENOMEM;
 	}
 
@@ -3448,7 +3464,7 @@ nxpwifi_cfg80211_authenticate(struct wiphy *wiphy,
 		memcpy((u8 *)varptr, req->ie, req->ie_len);
 	}
 
-	nxpwifi_form_mgmt_frame(skb, (const u8 *)mgmt, pkt_len);
+	nxpwifi_form_mgmt_frame(skb, (const u8 *)mgmt, frame_len);
 	kfree(mgmt);
 	priv->auth_flag = HOST_MLME_AUTH_PENDING;
 	priv->auth_alg = auth_alg;
@@ -3729,8 +3745,9 @@ int nxpwifi_init_channel_scan_gap(struct nxpwifi_adapter *adapter)
 	 * additional active scan request for hidden SSIDs on passive channels.
 	 */
 	adapter->num_in_chan_stats = 2 * (n_channels_bg + n_channels_a);
-	adapter->chan_stats = vmalloc(array_size(sizeof(*adapter->chan_stats),
-						 adapter->num_in_chan_stats));
+	adapter->chan_stats = kcalloc(adapter->num_in_chan_stats,
+				      sizeof(*adapter->chan_stats),
+				      GFP_KERNEL);
 
 	if (!adapter->chan_stats)
 		return -ENOMEM;
diff --git a/drivers/net/wireless/nxp/nxpwifi/init.c b/drivers/net/wireless/nxp/nxpwifi/init.c
index 7c75dca5d0a8..3c4df37333d8 100644
--- a/drivers/net/wireless/nxp/nxpwifi/init.c
+++ b/drivers/net/wireless/nxp/nxpwifi/init.c
@@ -328,7 +328,7 @@ static void nxpwifi_invalidate_lists(struct nxpwifi_adapter *adapter)
 static void
 nxpwifi_adapter_cleanup(struct nxpwifi_adapter *adapter)
 {
-	timer_delete(&adapter->wakeup_timer);
+	timer_delete_sync(&adapter->wakeup_timer);
 	nxpwifi_cancel_all_pending_cmd(adapter);
 	wake_up_interruptible(&adapter->cmd_wait_q.wait);
 	wake_up_interruptible(&adapter->hs_activate_wait_q);
diff --git a/drivers/net/wireless/nxp/nxpwifi/main.c b/drivers/net/wireless/nxp/nxpwifi/main.c
index 55b962430f37..9e13348105c3 100644
--- a/drivers/net/wireless/nxp/nxpwifi/main.c
+++ b/drivers/net/wireless/nxp/nxpwifi/main.c
@@ -644,7 +644,7 @@ static int _nxpwifi_fw_dpc(const struct firmware *firmware, void *context)
 	goto done;
 
 err_add_intf:
-	vfree(adapter->chan_stats);
+	kfree(adapter->chan_stats);
 err_init_chan_scan:
 	wiphy_unregister(adapter->wiphy);
 	wiphy_free(adapter->wiphy);
@@ -1384,7 +1384,7 @@ static void nxpwifi_uninit_sw(struct nxpwifi_adapter *adapter)
 	wiphy_free(adapter->wiphy);
 	adapter->wiphy = NULL;
 
-	vfree(adapter->chan_stats);
+	kfree(adapter->chan_stats);
 	nxpwifi_free_cmd_buffers(adapter);
 }
 
diff --git a/drivers/net/wireless/nxp/nxpwifi/uap_event.c b/drivers/net/wireless/nxp/nxpwifi/uap_event.c
index ab5c15686f54..20b7b53db236 100644
--- a/drivers/net/wireless/nxp/nxpwifi/uap_event.c
+++ b/drivers/net/wireless/nxp/nxpwifi/uap_event.c
@@ -75,6 +75,7 @@ nxpwifi_uap_event_sta_deauth(struct nxpwifi_private *priv)
 		nxpwifi_del_tx_ba_stream_tbl_by_ra(priv, deauth_mac);
 	}
 	nxpwifi_wmm_del_peer_ra_list(priv, deauth_mac);
+	nxpwifi_del_sta_entry(priv, deauth_mac);
 
 	return 0;
 }
diff --git a/drivers/net/wireless/nxp/nxpwifi/util.c b/drivers/net/wireless/nxp/nxpwifi/util.c
index bbfefb81d8d3..ae8444a14105 100644
--- a/drivers/net/wireless/nxp/nxpwifi/util.c
+++ b/drivers/net/wireless/nxp/nxpwifi/util.c
@@ -1041,19 +1041,23 @@ nxpwifi_set_sta_ht_cap(struct nxpwifi_private *priv, const u8 *ies,
 	}
 }
 
-/* Delete a station from list; called under cfg80211 mutex. */
+/* Delete a station from list. */
 
 void nxpwifi_del_sta_entry(struct nxpwifi_private *priv, const u8 *mac)
 {
 	struct nxpwifi_sta_node *node;
 
-	list_for_each_entry_rcu(node, &priv->sta_list, list) {
+	spin_lock_bh(&priv->sta_list_spinlock);
+
+	list_for_each_entry(node, &priv->sta_list, list) {
 		if (!memcmp(node->mac_addr, mac, ETH_ALEN)) {
 			list_del_rcu(&node->list);
 			kfree_rcu(node, rcu);
 			break;
 		}
 	}
+
+	spin_unlock_bh(&priv->sta_list_spinlock);
 }
 
 /* Delete all stations from list. */