4.9-stable patches

added patches:
	net-mlx4_en-fix-mlx4-ethtool-n-insertion.patch
	net-mlx5e-fix-set-vf-link-state-error-flow.patch
	net-rtnetlink-prevent-underflows-in-do_setvfinfo.patch
	net-sched-act_pedit-fix-warn-in-the-traffic-path.patch
	sfc-only-cancel-the-pps-workqueue-if-it-exists.patch

diff --git a/queue-4.9/net-mlx4_en-fix-mlx4-ethtool-n-insertion.patch b/queue-4.9/net-mlx4_en-fix-mlx4-ethtool-n-insertion.patch
new file mode 100644 (file)
index 0000000..737d26a
--- /dev/null
+++ b/queue-4.9/net-mlx4_en-fix-mlx4-ethtool-n-insertion.patch
@@ -0,0 +1,35 @@
+From foo@baz Mon 25 Nov 2019 02:41:56 PM CET
+From: Luigi Rizzo <lrizzo@google.com>
+Date: Fri, 15 Nov 2019 12:12:25 -0800
+Subject: net/mlx4_en: fix mlx4 ethtool -N insertion
+
+From: Luigi Rizzo <lrizzo@google.com>
+
+[ Upstream commit 34e59836565e36fade1464e054a3551c1a0364be ]
+
+ethtool expects ETHTOOL_GRXCLSRLALL to set ethtool_rxnfc->data with the
+total number of entries in the rx classifier table.  Surprisingly, mlx4
+is missing this part (in principle ethtool could still move forward and
+try the insert).
+
+Tested: compiled and run command:
+       phh13:~# ethtool -N eth1 flow-type udp4  queue 4
+       Added rule with ID 255
+
+Signed-off-by: Luigi Rizzo <lrizzo@google.com>
+Reviewed-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/en_ethtool.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+@@ -1679,6 +1679,7 @@ static int mlx4_en_get_rxnfc(struct net_
+               err = mlx4_en_get_flow(dev, cmd, cmd->fs.location);
+               break;
+       case ETHTOOL_GRXCLSRLALL:
++              cmd->data = MAX_NUM_OF_FS_RULES;
+               while ((!err || err == -ENOENT) && priority < cmd->rule_cnt) {
+                       err = mlx4_en_get_flow(dev, cmd, i);
+                       if (!err)

diff --git a/queue-4.9/net-mlx5e-fix-set-vf-link-state-error-flow.patch b/queue-4.9/net-mlx5e-fix-set-vf-link-state-error-flow.patch
new file mode 100644 (file)
index 0000000..20cd674
--- /dev/null
+++ b/queue-4.9/net-mlx5e-fix-set-vf-link-state-error-flow.patch
@@ -0,0 +1,32 @@
+From foo@baz Mon 25 Nov 2019 02:41:56 PM CET
+From: Roi Dayan <roid@mellanox.com>
+Date: Wed, 13 Nov 2019 14:42:00 +0200
+Subject: net/mlx5e: Fix set vf link state error flow
+
+From: Roi Dayan <roid@mellanox.com>
+
+[ Upstream commit 751021218f7e66ee9bbaa2be23056e447cd75ec4 ]
+
+Before this commit the ndo always returned success.
+Fix that.
+
+Fixes: 1ab2068a4c66 ("net/mlx5: Implement vports admin state backup/restore")
+Signed-off-by: Roi Dayan <roid@mellanox.com>
+Reviewed-by: Vlad Buslov <vladbu@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/eswitch.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+@@ -1757,7 +1757,7 @@ int mlx5_eswitch_set_vport_state(struct
+ 
+ unlock:
+       mutex_unlock(&esw->state_lock);
+-      return 0;
++      return err;
+ }
+ 
+ int mlx5_eswitch_get_vport_config(struct mlx5_eswitch *esw,

diff --git a/queue-4.9/net-rtnetlink-prevent-underflows-in-do_setvfinfo.patch b/queue-4.9/net-rtnetlink-prevent-underflows-in-do_setvfinfo.patch
new file mode 100644 (file)
index 0000000..476b104
--- /dev/null
+++ b/queue-4.9/net-rtnetlink-prevent-underflows-in-do_setvfinfo.patch
@@ -0,0 +1,189 @@
+From foo@baz Mon 25 Nov 2019 02:41:56 PM CET
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 20 Nov 2019 15:34:38 +0300
+Subject: net: rtnetlink: prevent underflows in do_setvfinfo()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit d658c8f56ec7b3de8051a24afb25da9ba3c388c5 ]
+
+The "ivm->vf" variable is a u32, but the problem is that a number of
+drivers cast it to an int and then forget to check for negatives.  An
+example of this is in the cxgb4 driver.
+
+drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+  2890  static int cxgb4_mgmt_get_vf_config(struct net_device *dev,
+  2891                                      int vf, struct ifla_vf_info *ivi)
+                                            ^^^^^^
+  2892  {
+  2893          struct port_info *pi = netdev_priv(dev);
+  2894          struct adapter *adap = pi->adapter;
+  2895          struct vf_info *vfinfo;
+  2896
+  2897          if (vf >= adap->num_vfs)
+                    ^^^^^^^^^^^^^^^^^^^
+  2898                  return -EINVAL;
+  2899          vfinfo = &adap->vfinfo[vf];
+                ^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+There are 48 functions affected.
+
+drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:8435 hclge_set_vf_vlan_filter() warn: can 'vfid' underflow 's32min-2147483646'
+drivers/net/ethernet/freescale/enetc/enetc_pf.c:377 enetc_pf_set_vf_mac() warn: can 'vf' underflow 's32min-2147483646'
+drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c:2899 cxgb4_mgmt_get_vf_config() warn: can 'vf' underflow 's32min-254'
+drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c:2960 cxgb4_mgmt_set_vf_rate() warn: can 'vf' underflow 's32min-254'
+drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c:3019 cxgb4_mgmt_set_vf_rate() warn: can 'vf' underflow 's32min-254'
+drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c:3038 cxgb4_mgmt_set_vf_vlan() warn: can 'vf' underflow 's32min-254'
+drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c:3086 cxgb4_mgmt_set_vf_link_state() warn: can 'vf' underflow 's32min-254'
+drivers/net/ethernet/chelsio/cxgb/cxgb2.c:791 get_eeprom() warn: can 'i' underflow 's32min-(-4),0,4-s32max'
+drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c:82 bnxt_set_vf_spoofchk() warn: can 'vf_id' underflow 's32min-65534'
+drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c:164 bnxt_set_vf_trust() warn: can 'vf_id' underflow 's32min-65534'
+drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c:186 bnxt_get_vf_config() warn: can 'vf_id' underflow 's32min-65534'
+drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c:228 bnxt_set_vf_mac() warn: can 'vf_id' underflow 's32min-65534'
+drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c:264 bnxt_set_vf_vlan() warn: can 'vf_id' underflow 's32min-65534'
+drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c:293 bnxt_set_vf_bw() warn: can 'vf_id' underflow 's32min-65534'
+drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c:333 bnxt_set_vf_link_state() warn: can 'vf_id' underflow 's32min-65534'
+drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c:2595 bnx2x_vf_op_prep() warn: can 'vfidx' underflow 's32min-63'
+drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c:2595 bnx2x_vf_op_prep() warn: can 'vfidx' underflow 's32min-63'
+drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c:2281 bnx2x_post_vf_bulletin() warn: can 'vf' underflow 's32min-63'
+drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c:2285 bnx2x_post_vf_bulletin() warn: can 'vf' underflow 's32min-63'
+drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c:2286 bnx2x_post_vf_bulletin() warn: can 'vf' underflow 's32min-63'
+drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c:2292 bnx2x_post_vf_bulletin() warn: can 'vf' underflow 's32min-63'
+drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c:2297 bnx2x_post_vf_bulletin() warn: can 'vf' underflow 's32min-63'
+drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c:1832 qlcnic_sriov_set_vf_mac() warn: can 'vf' underflow 's32min-254'
+drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c:1864 qlcnic_sriov_set_vf_tx_rate() warn: can 'vf' underflow 's32min-254'
+drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c:1937 qlcnic_sriov_set_vf_vlan() warn: can 'vf' underflow 's32min-254'
+drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c:2005 qlcnic_sriov_get_vf_config() warn: can 'vf' underflow 's32min-254'
+drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c:2036 qlcnic_sriov_set_vf_spoofchk() warn: can 'vf' underflow 's32min-254'
+drivers/net/ethernet/emulex/benet/be_main.c:1914 be_get_vf_config() warn: can 'vf' underflow 's32min-65534'
+drivers/net/ethernet/emulex/benet/be_main.c:1915 be_get_vf_config() warn: can 'vf' underflow 's32min-65534'
+drivers/net/ethernet/emulex/benet/be_main.c:1922 be_set_vf_tvt() warn: can 'vf' underflow 's32min-65534'
+drivers/net/ethernet/emulex/benet/be_main.c:1951 be_clear_vf_tvt() warn: can 'vf' underflow 's32min-65534'
+drivers/net/ethernet/emulex/benet/be_main.c:2063 be_set_vf_tx_rate() warn: can 'vf' underflow 's32min-65534'
+drivers/net/ethernet/emulex/benet/be_main.c:2091 be_set_vf_link_state() warn: can 'vf' underflow 's32min-65534'
+drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c:2609 ice_set_vf_port_vlan() warn: can 'vf_id' underflow 's32min-65534'
+drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c:3050 ice_get_vf_cfg() warn: can 'vf_id' underflow 's32min-65534'
+drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c:3103 ice_set_vf_spoofchk() warn: can 'vf_id' underflow 's32min-65534'
+drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c:3181 ice_set_vf_mac() warn: can 'vf_id' underflow 's32min-65534'
+drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c:3237 ice_set_vf_trust() warn: can 'vf_id' underflow 's32min-65534'
+drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c:3286 ice_set_vf_link_state() warn: can 'vf_id' underflow 's32min-65534'
+drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c:3919 i40e_validate_vf() warn: can 'vf_id' underflow 's32min-2147483646'
+drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c:3957 i40e_ndo_set_vf_mac() warn: can 'vf_id' underflow 's32min-2147483646'
+drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c:4104 i40e_ndo_set_vf_port_vlan() warn: can 'vf_id' underflow 's32min-2147483646'
+drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c:4263 i40e_ndo_set_vf_bw() warn: can 'vf_id' underflow 's32min-2147483646'
+drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c:4309 i40e_ndo_get_vf_config() warn: can 'vf_id' underflow 's32min-2147483646'
+drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c:4371 i40e_ndo_set_vf_link_state() warn: can 'vf_id' underflow 's32min-2147483646'
+drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c:4441 i40e_ndo_set_vf_spoofchk() warn: can 'vf_id' underflow 's32min-2147483646'
+drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c:4441 i40e_ndo_set_vf_spoofchk() warn: can 'vf_id' underflow 's32min-2147483646'
+drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c:4504 i40e_ndo_set_vf_trust() warn: can 'vf_id' underflow 's32min-2147483646'
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/rtnetlink.c |   23 ++++++++++++++++++++++-
+ 1 file changed, 22 insertions(+), 1 deletion(-)
+
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -1724,6 +1724,8 @@ static int do_setvfinfo(struct net_devic
+       if (tb[IFLA_VF_MAC]) {
+               struct ifla_vf_mac *ivm = nla_data(tb[IFLA_VF_MAC]);
+ 
++              if (ivm->vf >= INT_MAX)
++                      return -EINVAL;
+               err = -EOPNOTSUPP;
+               if (ops->ndo_set_vf_mac)
+                       err = ops->ndo_set_vf_mac(dev, ivm->vf,
+@@ -1735,6 +1737,8 @@ static int do_setvfinfo(struct net_devic
+       if (tb[IFLA_VF_VLAN]) {
+               struct ifla_vf_vlan *ivv = nla_data(tb[IFLA_VF_VLAN]);
+ 
++              if (ivv->vf >= INT_MAX)
++                      return -EINVAL;
+               err = -EOPNOTSUPP;
+               if (ops->ndo_set_vf_vlan)
+                       err = ops->ndo_set_vf_vlan(dev, ivv->vf, ivv->vlan,
+@@ -1767,6 +1771,8 @@ static int do_setvfinfo(struct net_devic
+               if (len == 0)
+                       return -EINVAL;
+ 
++              if (ivvl[0]->vf >= INT_MAX)
++                      return -EINVAL;
+               err = ops->ndo_set_vf_vlan(dev, ivvl[0]->vf, ivvl[0]->vlan,
+                                          ivvl[0]->qos, ivvl[0]->vlan_proto);
+               if (err < 0)
+@@ -1777,6 +1783,8 @@ static int do_setvfinfo(struct net_devic
+               struct ifla_vf_tx_rate *ivt = nla_data(tb[IFLA_VF_TX_RATE]);
+               struct ifla_vf_info ivf;
+ 
++              if (ivt->vf >= INT_MAX)
++                      return -EINVAL;
+               err = -EOPNOTSUPP;
+               if (ops->ndo_get_vf_config)
+                       err = ops->ndo_get_vf_config(dev, ivt->vf, &ivf);
+@@ -1795,6 +1803,8 @@ static int do_setvfinfo(struct net_devic
+       if (tb[IFLA_VF_RATE]) {
+               struct ifla_vf_rate *ivt = nla_data(tb[IFLA_VF_RATE]);
+ 
++              if (ivt->vf >= INT_MAX)
++                      return -EINVAL;
+               err = -EOPNOTSUPP;
+               if (ops->ndo_set_vf_rate)
+                       err = ops->ndo_set_vf_rate(dev, ivt->vf,
+@@ -1807,6 +1817,8 @@ static int do_setvfinfo(struct net_devic
+       if (tb[IFLA_VF_SPOOFCHK]) {
+               struct ifla_vf_spoofchk *ivs = nla_data(tb[IFLA_VF_SPOOFCHK]);
+ 
++              if (ivs->vf >= INT_MAX)
++                      return -EINVAL;
+               err = -EOPNOTSUPP;
+               if (ops->ndo_set_vf_spoofchk)
+                       err = ops->ndo_set_vf_spoofchk(dev, ivs->vf,
+@@ -1818,6 +1830,8 @@ static int do_setvfinfo(struct net_devic
+       if (tb[IFLA_VF_LINK_STATE]) {
+               struct ifla_vf_link_state *ivl = nla_data(tb[IFLA_VF_LINK_STATE]);
+ 
++              if (ivl->vf >= INT_MAX)
++                      return -EINVAL;
+               err = -EOPNOTSUPP;
+               if (ops->ndo_set_vf_link_state)
+                       err = ops->ndo_set_vf_link_state(dev, ivl->vf,
+@@ -1831,6 +1845,8 @@ static int do_setvfinfo(struct net_devic
+ 
+               err = -EOPNOTSUPP;
+               ivrssq_en = nla_data(tb[IFLA_VF_RSS_QUERY_EN]);
++              if (ivrssq_en->vf >= INT_MAX)
++                      return -EINVAL;
+               if (ops->ndo_set_vf_rss_query_en)
+                       err = ops->ndo_set_vf_rss_query_en(dev, ivrssq_en->vf,
+                                                          ivrssq_en->setting);
+@@ -1841,6 +1857,8 @@ static int do_setvfinfo(struct net_devic
+       if (tb[IFLA_VF_TRUST]) {
+               struct ifla_vf_trust *ivt = nla_data(tb[IFLA_VF_TRUST]);
+ 
++              if (ivt->vf >= INT_MAX)
++                      return -EINVAL;
+               err = -EOPNOTSUPP;
+               if (ops->ndo_set_vf_trust)
+                       err = ops->ndo_set_vf_trust(dev, ivt->vf, ivt->setting);
+@@ -1851,15 +1869,18 @@ static int do_setvfinfo(struct net_devic
+       if (tb[IFLA_VF_IB_NODE_GUID]) {
+               struct ifla_vf_guid *ivt = nla_data(tb[IFLA_VF_IB_NODE_GUID]);
+ 
++              if (ivt->vf >= INT_MAX)
++                      return -EINVAL;
+               if (!ops->ndo_set_vf_guid)
+                       return -EOPNOTSUPP;
+-
+               return handle_vf_guid(dev, ivt, IFLA_VF_IB_NODE_GUID);
+       }
+ 
+       if (tb[IFLA_VF_IB_PORT_GUID]) {
+               struct ifla_vf_guid *ivt = nla_data(tb[IFLA_VF_IB_PORT_GUID]);
+ 
++              if (ivt->vf >= INT_MAX)
++                      return -EINVAL;
+               if (!ops->ndo_set_vf_guid)
+                       return -EOPNOTSUPP;
+ 

diff --git a/queue-4.9/net-sched-act_pedit-fix-warn-in-the-traffic-path.patch b/queue-4.9/net-sched-act_pedit-fix-warn-in-the-traffic-path.patch
new file mode 100644 (file)
index 0000000..13f5abf
--- /dev/null
+++ b/queue-4.9/net-sched-act_pedit-fix-warn-in-the-traffic-path.patch
@@ -0,0 +1,80 @@
+From foo@baz Mon 25 Nov 2019 02:37:38 PM CET
+From: Davide Caratti <dcaratti@redhat.com>
+Date: Tue, 19 Nov 2019 23:47:33 +0100
+Subject: net/sched: act_pedit: fix WARN() in the traffic path
+
+From: Davide Caratti <dcaratti@redhat.com>
+
+[ Upstream commit f67169fef8dbcc1ac6a6a109ecaad0d3b259002c ]
+
+when configuring act_pedit rules, the number of keys is validated only on
+addition of a new entry. This is not sufficient to avoid hitting a WARN()
+in the traffic path: for example, it is possible to replace a valid entry
+with a new one having 0 extended keys, thus causing splats in dmesg like:
+
+ pedit BUG: index 42
+ WARNING: CPU: 2 PID: 4054 at net/sched/act_pedit.c:410 tcf_pedit_act+0xc84/0x1200 [act_pedit]
+ [...]
+ RIP: 0010:tcf_pedit_act+0xc84/0x1200 [act_pedit]
+ Code: 89 fa 48 c1 ea 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e ac 00 00 00 48 8b 44 24 10 48 c7 c7 a0 c4 e4 c0 8b 70 18 e8 1c 30 95 ea <0f> 0b e9 a0 fa ff ff e8 00 03 f5 ea e9 14 f4 ff ff 48 89 58 40 e9
+ RSP: 0018:ffff888077c9f320 EFLAGS: 00010286
+ RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffffac2983a2
+ RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff888053927bec
+ RBP: dffffc0000000000 R08: ffffed100a726209 R09: ffffed100a726209
+ R10: 0000000000000001 R11: ffffed100a726208 R12: ffff88804beea780
+ R13: ffff888079a77400 R14: ffff88804beea780 R15: ffff888027ab2000
+ FS:  00007fdeec9bd740(0000) GS:ffff888053900000(0000) knlGS:0000000000000000
+ CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00007ffdb3dfd000 CR3: 000000004adb4006 CR4: 00000000001606e0
+ Call Trace:
+  tcf_action_exec+0x105/0x3f0
+  tcf_classify+0xf2/0x410
+  __dev_queue_xmit+0xcbf/0x2ae0
+  ip_finish_output2+0x711/0x1fb0
+  ip_output+0x1bf/0x4b0
+  ip_send_skb+0x37/0xa0
+  raw_sendmsg+0x180c/0x2430
+  sock_sendmsg+0xdb/0x110
+  __sys_sendto+0x257/0x2b0
+  __x64_sys_sendto+0xdd/0x1b0
+  do_syscall_64+0xa5/0x4e0
+  entry_SYSCALL_64_after_hwframe+0x49/0xbe
+ RIP: 0033:0x7fdeeb72e993
+ Code: 48 8b 0d e0 74 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 0d d6 2c 00 00 75 13 49 89 ca b8 2c 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 34 c3 48 83 ec 08 e8 4b cc 00 00 48 89 04 24
+ RSP: 002b:00007ffdb3de8a18 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
+ RAX: ffffffffffffffda RBX: 000055c81972b700 RCX: 00007fdeeb72e993
+ RDX: 0000000000000040 RSI: 000055c81972b700 RDI: 0000000000000003
+ RBP: 00007ffdb3dea130 R08: 000055c819728510 R09: 0000000000000010
+ R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000040
+ R13: 000055c81972b6c0 R14: 000055c81972969c R15: 0000000000000080
+
+Fix this moving the check on 'nkeys' earlier in tcf_pedit_init(), so that
+attempts to install rules having 0 keys are always rejected with -EINVAL.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Davide Caratti <dcaratti@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/act_pedit.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/sched/act_pedit.c
++++ b/net/sched/act_pedit.c
+@@ -54,13 +54,14 @@ static int tcf_pedit_init(struct net *ne
+       if (tb[TCA_PEDIT_PARMS] == NULL)
+               return -EINVAL;
+       parm = nla_data(tb[TCA_PEDIT_PARMS]);
++      if (!parm->nkeys)
++              return -EINVAL;
++
+       ksize = parm->nkeys * sizeof(struct tc_pedit_key);
+       if (nla_len(tb[TCA_PEDIT_PARMS]) < sizeof(*parm) + ksize)
+               return -EINVAL;
+ 
+       if (!tcf_hash_check(tn, parm->index, a, bind)) {
+-              if (!parm->nkeys)
+-                      return -EINVAL;
+               ret = tcf_hash_create(tn, parm->index, est, a,
+                                     &act_pedit_ops, bind, false);
+               if (ret)

diff --git a/queue-4.9/series b/queue-4.9/series
new file mode 100644 (file)
index 0000000..574ce72
--- /dev/null
+++ b/queue-4.9/series
@@ -0,0 +1,5 @@
+net-mlx4_en-fix-mlx4-ethtool-n-insertion.patch
+net-rtnetlink-prevent-underflows-in-do_setvfinfo.patch
+sfc-only-cancel-the-pps-workqueue-if-it-exists.patch
+net-mlx5e-fix-set-vf-link-state-error-flow.patch
+net-sched-act_pedit-fix-warn-in-the-traffic-path.patch

diff --git a/queue-4.9/sfc-only-cancel-the-pps-workqueue-if-it-exists.patch b/queue-4.9/sfc-only-cancel-the-pps-workqueue-if-it-exists.patch
new file mode 100644 (file)
index 0000000..4403cae
--- /dev/null
+++ b/queue-4.9/sfc-only-cancel-the-pps-workqueue-if-it-exists.patch
@@ -0,0 +1,32 @@
+From foo@baz Mon 25 Nov 2019 02:41:56 PM CET
+From: Martin Habets <mhabets@solarflare.com>
+Date: Thu, 21 Nov 2019 17:52:15 +0000
+Subject: sfc: Only cancel the PPS workqueue if it exists
+
+From: Martin Habets <mhabets@solarflare.com>
+
+[ Upstream commit 723eb53690041740a13ac78efeaf6804f5d684c9 ]
+
+The workqueue only exists for the primary PF. For other functions
+we hit a WARN_ON in kernel/workqueue.c.
+
+Fixes: 7c236c43b838 ("sfc: Add support for IEEE-1588 PTP")
+Signed-off-by: Martin Habets <mhabets@solarflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/sfc/ptp.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/sfc/ptp.c
++++ b/drivers/net/ethernet/sfc/ptp.c
+@@ -1320,7 +1320,8 @@ void efx_ptp_remove(struct efx_nic *efx)
+       (void)efx_ptp_disable(efx);
+ 
+       cancel_work_sync(&efx->ptp_data->work);
+-      cancel_work_sync(&efx->ptp_data->pps_work);
++      if (efx->ptp_data->pps_workwq)
++              cancel_work_sync(&efx->ptp_data->pps_work);
+ 
+       skb_queue_purge(&efx->ptp_data->rxq);
+       skb_queue_purge(&efx->ptp_data->txq);