Networking fixes for 5.18-rc6, including fixes from can, rxrpc and

Previous releases - regressions:
  - igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter()

  - mld: respect RCU rules in ip6_mc_source() and ip6_mc_msfilter()

  - rds: acquire netns refcount on TCP sockets

  - rxrpc: enable IPv6 checksums on transport socket

  - nic: hinic: fix bug of wq out of bound access

  - nic: thunder: don't use pci_irq_vector() in atomic context

  - nic: bnxt_en: fix possible bnxt_open() failure caused by wrong RFS flag

  - nic: mlx5e:
    - lag, fix use-after-free in fib event handler
    - fix deadlock in sync reset flow

Previous releases - always broken:
  - tcp: fix insufficient TCP source port randomness

  - can: grcan: grcan_close(): fix deadlock

  - nfc: reorder destructive operations in to avoid bugs

  - wireguard: improve selftests reliability

Signed-off-by: Paolo Abeni <>
NFC: netlink: fix sleep in atomic bug when firmware download timeout

There are sleep in atomic bug that could cause kernel panic during
firmware download process. The root cause is that nlmsg_new with
GFP_KERNEL parameter is called in fw_dnld_timeout which is a timer
handler. The call trace is shown below:

BUG: sleeping function called from invalid context at include/linux/sched/mm.h:265
Call Trace:

The nlmsg_new with GFP_KERNEL parameter may sleep during memory
allocation process, and the timer handler is run as the result of
a "software interrupt" that should not call any other function
that could sleep.

This patch changes allocation mode of netlink message from GFP_KERNEL
to GFP_ATOMIC in order to prevent sleep in atomic bug. The GFP_ATOMIC
flag makes memory allocation operation could be used in atomic context.

Fixes: 9674da8759df ("NFC: Add firmware upload netlink command")
Fixes: 9ea7187c53f6 ("NFC: netlink: Rename CMD_FW_UPLOAD to CMD_FW_DOWNLOAD")
Signed-off-by: Duoming Zhou <>
Reviewed-by: Krzysztof Kozlowski <>
Signed-off-by: Paolo Abeni <>
1 file changed