--- /dev/null
+From beef5300cedf64ce8efc40386e2e76de5d8c7568 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 14:50:26 +0900
+Subject: dmaengine: pl330: issue_pending waits until WFP state
+
+From: Bumyong Lee <bumyong.lee@samsung.com>
+
+[ Upstream commit 22a9d9585812440211b0b34a6bc02ade62314be4 ]
+
+According to DMA-330 errata notice[1] 71930, DMAKILL
+cannot clear internal signal, named pipeline_req_active.
+it makes that pl330 would wait forever in WFP state
+although dma already send dma request if pl330 gets
+dma request before entering WFP state.
+
+The errata suggests that polling until entering WFP state
+as workaround and then peripherals allows to issue dma request.
+
+[1]: https://developer.arm.com/documentation/genc008428/latest
+
+Signed-off-by: Bumyong Lee <bumyong.lee@samsung.com>
+Link: https://lore.kernel.org/r/20231219055026.118695-1-bumyong.lee@samsung.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Stable-dep-of: afc89870ea67 ("dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state"")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/pl330.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
+index 1bba1fa3a8096..54bb6e46c1803 100644
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -1045,6 +1045,9 @@ static bool _trigger(struct pl330_thread *thrd)
+
+ thrd->req_running = idx;
+
++ if (desc->rqtype == DMA_MEM_TO_DEV || desc->rqtype == DMA_DEV_TO_MEM)
++ UNTIL(thrd, PL330_STATE_WFP);
++
+ return true;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From 6b79e5219af8cdd4e4e19509112582d63b2de740 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Mar 2024 12:21:51 +0530
+Subject: dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP
+ state"
+
+From: Vinod Koul <vkoul@kernel.org>
+
+[ Upstream commit afc89870ea677bd5a44516eb981f7a259b74280c ]
+
+This reverts commit 22a9d9585812 ("dmaengine: pl330: issue_pending waits
+until WFP state") as it seems to cause regression in pl330 driver.
+Note the issue now exists in mainline so a fix to be done.
+
+Cc: stable@vger.kernel.org
+Reported-by: karthikeyan <karthikeyan@linumiz.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/pl330.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
+index 54bb6e46c1803..1bba1fa3a8096 100644
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -1045,9 +1045,6 @@ static bool _trigger(struct pl330_thread *thrd)
+
+ thrd->req_running = idx;
+
+- if (desc->rqtype == DMA_MEM_TO_DEV || desc->rqtype == DMA_DEV_TO_MEM)
+- UNTIL(thrd, PL330_STATE_WFP);
+-
+ return true;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From f97012ff378cfadea0518d158544a4214e10bf46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Apr 2024 11:32:34 -0400
+Subject: drm/amdgpu: Fix leak when GPU memory allocation fails
+
+From: Mukul Joshi <mukul.joshi@amd.com>
+
+[ Upstream commit 25e9227c6afd200bed6774c866980b8e36d033af ]
+
+Free the sync object if the memory allocation fails for any
+reason.
+
+Signed-off-by: Mukul Joshi <mukul.joshi@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+index 13a03f467688a..e15f9da25c7d1 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+@@ -1273,6 +1273,7 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu(
+ err_bo_create:
+ unreserve_system_mem_limit(adev, size, alloc_domain, false);
+ err_reserve_limit:
++ amdgpu_sync_free(&(*mem)->sync);
+ mutex_destroy(&(*mem)->lock);
+ kfree(*mem);
+ return ret;
+--
+2.43.0
+
--- /dev/null
+From 139e701f1dcbd438ad32f6b0120a2e0951d75898 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Sep 2018 11:46:14 -0400
+Subject: drm/amdkfd: change system memory overcommit limit
+
+From: Eric Huang <JinhuiEric.Huang@amd.com>
+
+[ Upstream commit 5d240da93edc29adb68320c5e475dc9c7fcad5dd ]
+
+It is to improve system limit by:
+1. replacing userptrlimit with a total memory limit that
+conunts TTM memory usage and userptr usage.
+2. counting acc size for all BOs.
+
+Signed-off-by: Eric Huang <JinHuiEric.Huang@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: 25e9227c6afd ("drm/amdgpu: Fix leak when GPU memory allocation fails")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 99 +++++++++++--------
+ 1 file changed, 58 insertions(+), 41 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+index 4488aad64643b..13a03f467688a 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+@@ -46,9 +46,9 @@
+ /* Impose limit on how much memory KFD can use */
+ static struct {
+ uint64_t max_system_mem_limit;
+- uint64_t max_userptr_mem_limit;
++ uint64_t max_ttm_mem_limit;
+ int64_t system_mem_used;
+- int64_t userptr_mem_used;
++ int64_t ttm_mem_used;
+ spinlock_t mem_limit_lock;
+ } kfd_mem_limit;
+
+@@ -90,8 +90,8 @@ static bool check_if_add_bo_to_vm(struct amdgpu_vm *avm,
+ }
+
+ /* Set memory usage limits. Current, limits are
+- * System (kernel) memory - 3/8th System RAM
+- * Userptr memory - 3/4th System RAM
++ * System (TTM + userptr) memory - 3/4th System RAM
++ * TTM memory - 3/8th System RAM
+ */
+ void amdgpu_amdkfd_gpuvm_init_mem_limits(void)
+ {
+@@ -103,48 +103,54 @@ void amdgpu_amdkfd_gpuvm_init_mem_limits(void)
+ mem *= si.mem_unit;
+
+ spin_lock_init(&kfd_mem_limit.mem_limit_lock);
+- kfd_mem_limit.max_system_mem_limit = (mem >> 1) - (mem >> 3);
+- kfd_mem_limit.max_userptr_mem_limit = mem - (mem >> 2);
+- pr_debug("Kernel memory limit %lluM, userptr limit %lluM\n",
++ kfd_mem_limit.max_system_mem_limit = (mem >> 1) + (mem >> 2);
++ kfd_mem_limit.max_ttm_mem_limit = (mem >> 1) - (mem >> 3);
++ pr_debug("Kernel memory limit %lluM, TTM limit %lluM\n",
+ (kfd_mem_limit.max_system_mem_limit >> 20),
+- (kfd_mem_limit.max_userptr_mem_limit >> 20));
++ (kfd_mem_limit.max_ttm_mem_limit >> 20));
+ }
+
+ static int amdgpu_amdkfd_reserve_system_mem_limit(struct amdgpu_device *adev,
+- uint64_t size, u32 domain)
++ uint64_t size, u32 domain, bool sg)
+ {
+- size_t acc_size;
++ size_t acc_size, system_mem_needed, ttm_mem_needed;
+ int ret = 0;
+
+ acc_size = ttm_bo_dma_acc_size(&adev->mman.bdev, size,
+ sizeof(struct amdgpu_bo));
+
+ spin_lock(&kfd_mem_limit.mem_limit_lock);
++
+ if (domain == AMDGPU_GEM_DOMAIN_GTT) {
+- if (kfd_mem_limit.system_mem_used + (acc_size + size) >
+- kfd_mem_limit.max_system_mem_limit) {
+- ret = -ENOMEM;
+- goto err_no_mem;
+- }
+- kfd_mem_limit.system_mem_used += (acc_size + size);
+- } else if (domain == AMDGPU_GEM_DOMAIN_CPU) {
+- if ((kfd_mem_limit.system_mem_used + acc_size >
+- kfd_mem_limit.max_system_mem_limit) ||
+- (kfd_mem_limit.userptr_mem_used + (size + acc_size) >
+- kfd_mem_limit.max_userptr_mem_limit)) {
+- ret = -ENOMEM;
+- goto err_no_mem;
+- }
+- kfd_mem_limit.system_mem_used += acc_size;
+- kfd_mem_limit.userptr_mem_used += size;
++ /* TTM GTT memory */
++ system_mem_needed = acc_size + size;
++ ttm_mem_needed = acc_size + size;
++ } else if (domain == AMDGPU_GEM_DOMAIN_CPU && !sg) {
++ /* Userptr */
++ system_mem_needed = acc_size + size;
++ ttm_mem_needed = acc_size;
++ } else {
++ /* VRAM and SG */
++ system_mem_needed = acc_size;
++ ttm_mem_needed = acc_size;
++ }
++
++ if ((kfd_mem_limit.system_mem_used + system_mem_needed >
++ kfd_mem_limit.max_system_mem_limit) ||
++ (kfd_mem_limit.ttm_mem_used + ttm_mem_needed >
++ kfd_mem_limit.max_ttm_mem_limit))
++ ret = -ENOMEM;
++ else {
++ kfd_mem_limit.system_mem_used += system_mem_needed;
++ kfd_mem_limit.ttm_mem_used += ttm_mem_needed;
+ }
+-err_no_mem:
++
+ spin_unlock(&kfd_mem_limit.mem_limit_lock);
+ return ret;
+ }
+
+ static void unreserve_system_mem_limit(struct amdgpu_device *adev,
+- uint64_t size, u32 domain)
++ uint64_t size, u32 domain, bool sg)
+ {
+ size_t acc_size;
+
+@@ -154,14 +160,18 @@ static void unreserve_system_mem_limit(struct amdgpu_device *adev,
+ spin_lock(&kfd_mem_limit.mem_limit_lock);
+ if (domain == AMDGPU_GEM_DOMAIN_GTT) {
+ kfd_mem_limit.system_mem_used -= (acc_size + size);
+- } else if (domain == AMDGPU_GEM_DOMAIN_CPU) {
++ kfd_mem_limit.ttm_mem_used -= (acc_size + size);
++ } else if (domain == AMDGPU_GEM_DOMAIN_CPU && !sg) {
++ kfd_mem_limit.system_mem_used -= (acc_size + size);
++ kfd_mem_limit.ttm_mem_used -= acc_size;
++ } else {
+ kfd_mem_limit.system_mem_used -= acc_size;
+- kfd_mem_limit.userptr_mem_used -= size;
++ kfd_mem_limit.ttm_mem_used -= acc_size;
+ }
+ WARN_ONCE(kfd_mem_limit.system_mem_used < 0,
+ "kfd system memory accounting unbalanced");
+- WARN_ONCE(kfd_mem_limit.userptr_mem_used < 0,
+- "kfd userptr memory accounting unbalanced");
++ WARN_ONCE(kfd_mem_limit.ttm_mem_used < 0,
++ "kfd TTM memory accounting unbalanced");
+
+ spin_unlock(&kfd_mem_limit.mem_limit_lock);
+ }
+@@ -171,16 +181,22 @@ void amdgpu_amdkfd_unreserve_system_memory_limit(struct amdgpu_bo *bo)
+ spin_lock(&kfd_mem_limit.mem_limit_lock);
+
+ if (bo->flags & AMDGPU_AMDKFD_USERPTR_BO) {
+- kfd_mem_limit.system_mem_used -= bo->tbo.acc_size;
+- kfd_mem_limit.userptr_mem_used -= amdgpu_bo_size(bo);
++ kfd_mem_limit.system_mem_used -=
++ (bo->tbo.acc_size + amdgpu_bo_size(bo));
++ kfd_mem_limit.ttm_mem_used -= bo->tbo.acc_size;
+ } else if (bo->preferred_domains == AMDGPU_GEM_DOMAIN_GTT) {
+ kfd_mem_limit.system_mem_used -=
+ (bo->tbo.acc_size + amdgpu_bo_size(bo));
++ kfd_mem_limit.ttm_mem_used -=
++ (bo->tbo.acc_size + amdgpu_bo_size(bo));
++ } else {
++ kfd_mem_limit.system_mem_used -= bo->tbo.acc_size;
++ kfd_mem_limit.ttm_mem_used -= bo->tbo.acc_size;
+ }
+ WARN_ONCE(kfd_mem_limit.system_mem_used < 0,
+ "kfd system memory accounting unbalanced");
+- WARN_ONCE(kfd_mem_limit.userptr_mem_used < 0,
+- "kfd userptr memory accounting unbalanced");
++ WARN_ONCE(kfd_mem_limit.ttm_mem_used < 0,
++ "kfd TTM memory accounting unbalanced");
+
+ spin_unlock(&kfd_mem_limit.mem_limit_lock);
+ }
+@@ -1201,10 +1217,11 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu(
+
+ amdgpu_sync_create(&(*mem)->sync);
+
+- ret = amdgpu_amdkfd_reserve_system_mem_limit(adev, size, alloc_domain);
++ ret = amdgpu_amdkfd_reserve_system_mem_limit(adev, size,
++ alloc_domain, false);
+ if (ret) {
+ pr_debug("Insufficient system memory\n");
+- goto err_reserve_system_mem;
++ goto err_reserve_limit;
+ }
+
+ pr_debug("\tcreate BO VA 0x%llx size 0x%llx domain %s\n",
+@@ -1252,10 +1269,10 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu(
+ allocate_init_user_pages_failed:
+ amdgpu_bo_unref(&bo);
+ /* Don't unreserve system mem limit twice */
+- goto err_reserve_system_mem;
++ goto err_reserve_limit;
+ err_bo_create:
+- unreserve_system_mem_limit(adev, size, alloc_domain);
+-err_reserve_system_mem:
++ unreserve_system_mem_limit(adev, size, alloc_domain, false);
++err_reserve_limit:
+ mutex_destroy(&(*mem)->lock);
+ kfree(*mem);
+ return ret;
+--
+2.43.0
+
--- /dev/null
+From 3c666f7b3d78de38c4a15b011b91edecb6dfd146 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Oct 2021 14:10:02 -0700
+Subject: ethernet: add a helper for assigning port addresses
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit e80094a473eefad9d856ce3ab0d7afdbb64800c4 ]
+
+We have 5 drivers which offset base MAC addr by port id.
+Create a helper for them.
+
+This helper takes care of overflows, which some drivers
+did not do, please complain if that's going to break
+anything!
+
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Shannon Nelson <snelson@pensando.io>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Stable-dep-of: 6e159fd653d7 ("ethernet: Add helper for assigning packet type when dest address does not match device address")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/etherdevice.h | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h
+index 2932a40060c1d..fef4bb77f7590 100644
+--- a/include/linux/etherdevice.h
++++ b/include/linux/etherdevice.h
+@@ -522,6 +522,27 @@ static inline unsigned long compare_ether_header(const void *a, const void *b)
+ #endif
+ }
+
++/**
++ * eth_hw_addr_gen - Generate and assign Ethernet address to a port
++ * @dev: pointer to port's net_device structure
++ * @base_addr: base Ethernet address
++ * @id: offset to add to the base address
++ *
++ * Generate a MAC address using a base address and an offset and assign it
++ * to a net_device. Commonly used by switch drivers which need to compute
++ * addresses for all their ports. addr_assign_type is not changed.
++ */
++static inline void eth_hw_addr_gen(struct net_device *dev, const u8 *base_addr,
++ unsigned int id)
++{
++ u64 u = ether_addr_to_u64(base_addr);
++ u8 addr[ETH_ALEN];
++
++ u += id;
++ u64_to_ether_addr(u, addr);
++ eth_hw_addr_set(dev, addr);
++}
++
+ /**
+ * eth_skb_pad - Pad buffer to mininum number of octets for Ethernet frame
+ * @skb: Buffer to pad
+--
+2.43.0
+
--- /dev/null
+From 5ec0913220c78c2da6448f8932935710168c25c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Apr 2024 11:13:03 -0700
+Subject: ethernet: Add helper for assigning packet type when dest address does
+ not match device address
+
+From: Rahul Rameshbabu <rrameshbabu@nvidia.com>
+
+[ Upstream commit 6e159fd653d7ebf6290358e0330a0cb8a75cf73b ]
+
+Enable reuse of logic in eth_type_trans for determining packet type.
+
+Suggested-by: Sabrina Dubroca <sd@queasysnail.net>
+Cc: stable@vger.kernel.org
+Signed-off-by: Rahul Rameshbabu <rrameshbabu@nvidia.com>
+Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://lore.kernel.org/r/20240423181319.115860-3-rrameshbabu@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/etherdevice.h | 25 +++++++++++++++++++++++++
+ net/ethernet/eth.c | 12 +-----------
+ 2 files changed, 26 insertions(+), 11 deletions(-)
+
+diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h
+index fef4bb77f7590..267b3cbc7ae13 100644
+--- a/include/linux/etherdevice.h
++++ b/include/linux/etherdevice.h
+@@ -543,6 +543,31 @@ static inline void eth_hw_addr_gen(struct net_device *dev, const u8 *base_addr,
+ eth_hw_addr_set(dev, addr);
+ }
+
++/**
++ * eth_skb_pkt_type - Assign packet type if destination address does not match
++ * @skb: Assigned a packet type if address does not match @dev address
++ * @dev: Network device used to compare packet address against
++ *
++ * If the destination MAC address of the packet does not match the network
++ * device address, assign an appropriate packet type.
++ */
++static inline void eth_skb_pkt_type(struct sk_buff *skb,
++ const struct net_device *dev)
++{
++ const struct ethhdr *eth = eth_hdr(skb);
++
++ if (unlikely(!ether_addr_equal_64bits(eth->h_dest, dev->dev_addr))) {
++ if (unlikely(is_multicast_ether_addr_64bits(eth->h_dest))) {
++ if (ether_addr_equal_64bits(eth->h_dest, dev->broadcast))
++ skb->pkt_type = PACKET_BROADCAST;
++ else
++ skb->pkt_type = PACKET_MULTICAST;
++ } else {
++ skb->pkt_type = PACKET_OTHERHOST;
++ }
++ }
++}
++
+ /**
+ * eth_skb_pad - Pad buffer to mininum number of octets for Ethernet frame
+ * @skb: Buffer to pad
+diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
+index 88a074dd983e6..31be0b426e839 100644
+--- a/net/ethernet/eth.c
++++ b/net/ethernet/eth.c
+@@ -165,17 +165,7 @@ __be16 eth_type_trans(struct sk_buff *skb, struct net_device *dev)
+ eth = (struct ethhdr *)skb->data;
+ skb_pull_inline(skb, ETH_HLEN);
+
+- if (unlikely(!ether_addr_equal_64bits(eth->h_dest,
+- dev->dev_addr))) {
+- if (unlikely(is_multicast_ether_addr_64bits(eth->h_dest))) {
+- if (ether_addr_equal_64bits(eth->h_dest, dev->broadcast))
+- skb->pkt_type = PACKET_BROADCAST;
+- else
+- skb->pkt_type = PACKET_MULTICAST;
+- } else {
+- skb->pkt_type = PACKET_OTHERHOST;
+- }
+- }
++ eth_skb_pkt_type(skb, dev);
+
+ /*
+ * Some variants of DSA tagging don't have an ethertype field
+--
+2.43.0
+
--- /dev/null
+From bd6ac739b17bc821e48f4d5e85249cf94fceab29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Nov 2018 09:34:31 +0800
+Subject: net: slightly optimize eth_type_trans
+
+From: Li RongQing <lirongqing@baidu.com>
+
+[ Upstream commit 45cf7959c30402d7c4ea43568a6f1bab0ba6ca63 ]
+
+netperf udp stream shows that eth_type_trans takes certain cpu,
+so adjust the mac address check order, and firstly check if it
+is device address, and only check if it is multicast address
+only if not the device address.
+
+After this change:
+To unicast, and skb dst mac is device mac, this is most of time
+reduce a comparision
+To unicast, and skb dst mac is not device mac, nothing change
+To multicast, increase a comparision
+
+Before:
+1.03% [kernel] [k] eth_type_trans
+
+After:
+0.78% [kernel] [k] eth_type_trans
+
+Signed-off-by: Zhang Yu <zhangyu31@baidu.com>
+Signed-off-by: Li RongQing <lirongqing@baidu.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Stable-dep-of: 6e159fd653d7 ("ethernet: Add helper for assigning packet type when dest address does not match device address")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ethernet/eth.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
+index ca06e9a53d15c..88a074dd983e6 100644
+--- a/net/ethernet/eth.c
++++ b/net/ethernet/eth.c
+@@ -165,15 +165,17 @@ __be16 eth_type_trans(struct sk_buff *skb, struct net_device *dev)
+ eth = (struct ethhdr *)skb->data;
+ skb_pull_inline(skb, ETH_HLEN);
+
+- if (unlikely(is_multicast_ether_addr_64bits(eth->h_dest))) {
+- if (ether_addr_equal_64bits(eth->h_dest, dev->broadcast))
+- skb->pkt_type = PACKET_BROADCAST;
+- else
+- skb->pkt_type = PACKET_MULTICAST;
++ if (unlikely(!ether_addr_equal_64bits(eth->h_dest,
++ dev->dev_addr))) {
++ if (unlikely(is_multicast_ether_addr_64bits(eth->h_dest))) {
++ if (ether_addr_equal_64bits(eth->h_dest, dev->broadcast))
++ skb->pkt_type = PACKET_BROADCAST;
++ else
++ skb->pkt_type = PACKET_MULTICAST;
++ } else {
++ skb->pkt_type = PACKET_OTHERHOST;
++ }
+ }
+- else if (unlikely(!ether_addr_equal_64bits(eth->h_dest,
+- dev->dev_addr)))
+- skb->pkt_type = PACKET_OTHERHOST;
+
+ /*
+ * Some variants of DSA tagging don't have an ethertype field
+--
+2.43.0
+
--- /dev/null
+From 369919f8ebf9296790ec72105f960cff4cc2b804 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Mar 2024 09:38:39 +0300
+Subject: pinctrl: core: delete incorrect free in pinctrl_enable()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 5038a66dad0199de60e5671603ea6623eb9e5c79 ]
+
+The "pctldev" struct is allocated in devm_pinctrl_register_and_init().
+It's a devm_ managed pointer that is freed by devm_pinctrl_dev_release(),
+so freeing it in pinctrl_enable() will lead to a double free.
+
+The devm_pinctrl_dev_release() function frees the pindescs and destroys
+the mutex as well.
+
+Fixes: 6118714275f0 ("pinctrl: core: Fix pinctrl_register_and_init() with pinctrl_enable()")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Message-ID: <578fbe56-44e9-487c-ae95-29b695650f7c@moroto.mountain>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/core.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
+index 99f062546f77e..052894d3a2047 100644
+--- a/drivers/pinctrl/core.c
++++ b/drivers/pinctrl/core.c
+@@ -2036,13 +2036,7 @@ int pinctrl_enable(struct pinctrl_dev *pctldev)
+
+ error = pinctrl_claim_hogs(pctldev);
+ if (error) {
+- dev_err(pctldev->dev, "could not claim hogs: %i\n",
+- error);
+- pinctrl_free_pindescs(pctldev, pctldev->desc->pins,
+- pctldev->desc->npins);
+- mutex_destroy(&pctldev->mutex);
+- kfree(pctldev);
+-
++ dev_err(pctldev->dev, "could not claim hogs: %i\n", error);
+ return error;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From 6dd2a15cfedc80e8a89350b779b4a38f7236c69c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Apr 2024 18:53:28 +0800
+Subject: pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
+
+From: Zeng Heng <zengheng4@huawei.com>
+
+[ Upstream commit a0cedbcc8852d6c77b00634b81e41f17f29d9404 ]
+
+If we fail to allocate propname buffer, we need to drop the reference
+count we just took. Because the pinctrl_dt_free_maps() includes the
+droping operation, here we call it directly.
+
+Fixes: 91d5c5060ee2 ("pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map")
+Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Zeng Heng <zengheng4@huawei.com>
+Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
+Message-ID: <20240415105328.3651441-1-zengheng4@huawei.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/devicetree.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c
+index 6f5acfcba57ce..01cc09e2bccbe 100644
+--- a/drivers/pinctrl/devicetree.c
++++ b/drivers/pinctrl/devicetree.c
+@@ -235,14 +235,16 @@ int pinctrl_dt_to_map(struct pinctrl *p, struct pinctrl_dev *pctldev)
+ for (state = 0; ; state++) {
+ /* Retrieve the pinctrl-* property */
+ propname = kasprintf(GFP_KERNEL, "pinctrl-%d", state);
+- if (!propname)
+- return -ENOMEM;
++ if (!propname) {
++ ret = -ENOMEM;
++ goto err;
++ }
+ prop = of_find_property(np, propname, &size);
+ kfree(propname);
+ if (!prop) {
+ if (state == 0) {
+- of_node_put(np);
+- return -ENODEV;
++ ret = -ENODEV;
++ goto err;
+ }
+ break;
+ }
+--
+2.43.0
+
--- /dev/null
+From 563e26e63bf41b6d651b720715f607e8ee010bf2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Apr 2024 10:06:27 +0200
+Subject: power: rt9455: hide unused rt9455_boost_voltage_values
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 452d8950db3e839aba1bb13bc5378f4bac11fa04 ]
+
+The rt9455_boost_voltage_values[] array is only used when USB PHY
+support is enabled, causing a W=1 warning otherwise:
+
+drivers/power/supply/rt9455_charger.c:200:18: error: 'rt9455_boost_voltage_values' defined but not used [-Werror=unused-const-variable=]
+
+Enclose the definition in the same #ifdef as the references to it.
+
+Fixes: e86d69dd786e ("power_supply: Add support for Richtek RT9455 battery charger")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20240403080702.3509288-10-arnd@kernel.org
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/rt9455_charger.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/power/supply/rt9455_charger.c b/drivers/power/supply/rt9455_charger.c
+index cfdbde9daf94b..70722c0709936 100644
+--- a/drivers/power/supply/rt9455_charger.c
++++ b/drivers/power/supply/rt9455_charger.c
+@@ -202,6 +202,7 @@ static const int rt9455_voreg_values[] = {
+ 4450000, 4450000, 4450000, 4450000, 4450000, 4450000, 4450000, 4450000
+ };
+
++#if IS_ENABLED(CONFIG_USB_PHY)
+ /*
+ * When the charger is in boost mode, REG02[7:2] represent boost output
+ * voltage.
+@@ -217,6 +218,7 @@ static const int rt9455_boost_voltage_values[] = {
+ 5600000, 5600000, 5600000, 5600000, 5600000, 5600000, 5600000, 5600000,
+ 5600000, 5600000, 5600000, 5600000, 5600000, 5600000, 5600000, 5600000,
+ };
++#endif
+
+ /* REG07[3:0] (VMREG) in uV */
+ static const int rt9455_vmreg_values[] = {
+--
+2.43.0
+
--- /dev/null
+dmaengine-pl330-issue_pending-waits-until-wfp-state.patch
+dmaengine-revert-dmaengine-pl330-issue_pending-waits.patch
+wifi-nl80211-don-t-free-null-coalescing-rule.patch
+drm-amdkfd-change-system-memory-overcommit-limit.patch
+drm-amdgpu-fix-leak-when-gpu-memory-allocation-fails.patch
+net-slightly-optimize-eth_type_trans.patch
+ethernet-add-a-helper-for-assigning-port-addresses.patch
+ethernet-add-helper-for-assigning-packet-type-when-d.patch
+pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
+power-rt9455-hide-unused-rt9455_boost_voltage_values.patch
+pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
--- /dev/null
+From 8dcd958f624920570caf21ac9e81d30aa5e72a7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Apr 2024 10:52:23 +0200
+Subject: wifi: nl80211: don't free NULL coalescing rule
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 801ea33ae82d6a9d954074fbcf8ea9d18f1543a7 ]
+
+If the parsing fails, we can dereference a NULL pointer here.
+
+Cc: stable@vger.kernel.org
+Fixes: be29b99a9b51 ("cfg80211/nl80211: Add packet coalesce support")
+Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20240418105220.b328f80406e7.Id75d961050deb05b3e4e354e024866f350c68103@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/nl80211.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index df2989c35fd86..15f28203445cb 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -11492,6 +11492,8 @@ static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
+ error:
+ for (i = 0; i < new_coalesce.n_rules; i++) {
+ tmp_rule = &new_coalesce.rules[i];
++ if (!tmp_rule)
++ continue;
+ for (j = 0; j < tmp_rule->n_patterns; j++)
+ kfree(tmp_rule->patterns[j].mask);
+ kfree(tmp_rule->patterns);
+--
+2.43.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
