lp:~bladernr/ubuntu/+source/linux/+git/mantic

Author: Chandrakanth Patil
Author Date: 2023-12-05 19:16:30 UTC

scsi: mpi3mr: Update driver version to 8.5.1.0.0

BugLink: https://bugs.launchpad.net/bugs/2045233

Update driver version to 8.5.1.0.0

Signed-off-by: Chandrakanth patil <chandrakanth.patil@broadcom.com>
Link: https://lore.kernel.org/r/20231205191630.12201-5-chandrakanth.patil@broadcom.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit d0a60e3edaa4a12e52fe8ea1d8b125f0405934cf)
Signed-off-by: Jeff Lane <jeffrey.lane@canonical.com>

Author: Dinghao Liu
Author Date: 2023-12-04 02:40:04 UTC

net: bnxt: fix a potential use-after-free in bnxt_init_tc

BugLink: https://bugs.launchpad.net/bugs/2045796

When flow_indr_dev_register() fails, bnxt_init_tc will free
bp->tc_info through kfree(). However, the caller function
bnxt_init_one() will ignore this failure and call
bnxt_shutdown_tc() on failure of bnxt_dl_register(), where
a use-after-free happens. Fix this issue by setting
bp->tc_info to NULL after kfree().

Fixes: 627c89d00fb9 ("bnxt_en: flow_offload: offload tunnel decap rules via indirect callbacks")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Reviewed-by: Somnath Kotur <somnath.kotur@broadcom.com>
Link: https://lore.kernel.org/r/20231204024004.8245-1-dinghao.liu@zju.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit d007caaaf052f82ca2340d4c7b32d04a3f5dbf3f linux-next)
Signed-off-by: Jeff Lane <jeffrey.lane@canonical.com>