--- /dev/null
+From 9d77089619a46c89f192facfb7aaf37da672fd44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jul 2020 15:40:38 +0100
+Subject: ARM: dts: armada-38x: fix NETA lockup when repeatedly switching
+ speeds
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 09781ba0395c46b1c844f47e405e3ce7856f5989 ]
+
+To support the change in "phy: armada-38x: fix NETA lockup when
+repeatedly switching speeds" we need to update the DT with the
+additional register.
+
+Fixes: 14dc100b4411 ("phy: armada38x: add common phy support")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/armada-38x.dtsi | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/armada-38x.dtsi b/arch/arm/boot/dts/armada-38x.dtsi
+index 3f4bb44d85f00..669da3a33d82c 100644
+--- a/arch/arm/boot/dts/armada-38x.dtsi
++++ b/arch/arm/boot/dts/armada-38x.dtsi
+@@ -339,7 +339,8 @@
+
+ comphy: phy@18300 {
+ compatible = "marvell,armada-380-comphy";
+- reg = <0x18300 0x100>;
++ reg-names = "comphy", "conf";
++ reg = <0x18300 0x100>, <0x18460 4>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+--
+2.25.1
+
--- /dev/null
+From 3d9719401706c0268728db0d3d3ad64ba80c307d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Jul 2020 15:08:29 +0200
+Subject: ARM: dts sunxi: Relax a bit the CMA pool allocation range
+
+From: Maxime Ripard <maxime@cerno.tech>
+
+[ Upstream commit 92025b90f18d45e26b7f17d68756b1abd771b9d3 ]
+
+The hardware codec on the A10, A10s, A13 and A20 needs buffer in the
+first 256MB of RAM. This was solved by setting the CMA pool at a fixed
+address in that range.
+
+However, in recent kernels there's something else that comes in and
+reserve some range that end up conflicting with our default pool
+requirement, and thus makes its reservation fail.
+
+The video codec will then use buffers from the usual default pool,
+outside of the range it can access, and will fail to decode anything.
+
+Since we're only concerned about that 256MB, we can however relax the
+allocation to just specify the range that's allowed, and not try to
+enforce a specific address.
+
+Fixes: 5949bc5602cc ("ARM: dts: sun4i-a10: Add Video Engine and reserved memory nodes")
+Fixes: 960432010156 ("ARM: dts: sun5i: Add Video Engine and reserved memory nodes")
+Fixes: c2a641a74850 ("ARM: dts: sun7i-a20: Add Video Engine and reserved memory nodes")
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Link: https://lore.kernel.org/r/20200704130829.34297-1-maxime@cerno.tech
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun4i-a10.dtsi | 2 +-
+ arch/arm/boot/dts/sun5i.dtsi | 2 +-
+ arch/arm/boot/dts/sun7i-a20.dtsi | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun4i-a10.dtsi b/arch/arm/boot/dts/sun4i-a10.dtsi
+index 4c268b70b7357..e0a9b371c248f 100644
+--- a/arch/arm/boot/dts/sun4i-a10.dtsi
++++ b/arch/arm/boot/dts/sun4i-a10.dtsi
+@@ -198,7 +198,7 @@
+ default-pool {
+ compatible = "shared-dma-pool";
+ size = <0x6000000>;
+- alloc-ranges = <0x4a000000 0x6000000>;
++ alloc-ranges = <0x40000000 0x10000000>;
+ reusable;
+ linux,cma-default;
+ };
+diff --git a/arch/arm/boot/dts/sun5i.dtsi b/arch/arm/boot/dts/sun5i.dtsi
+index 6befa236ba99d..fd31da8fd3112 100644
+--- a/arch/arm/boot/dts/sun5i.dtsi
++++ b/arch/arm/boot/dts/sun5i.dtsi
+@@ -117,7 +117,7 @@
+ default-pool {
+ compatible = "shared-dma-pool";
+ size = <0x6000000>;
+- alloc-ranges = <0x4a000000 0x6000000>;
++ alloc-ranges = <0x40000000 0x10000000>;
+ reusable;
+ linux,cma-default;
+ };
+diff --git a/arch/arm/boot/dts/sun7i-a20.dtsi b/arch/arm/boot/dts/sun7i-a20.dtsi
+index 8aebefd6accfe..1f8b45f07e58f 100644
+--- a/arch/arm/boot/dts/sun7i-a20.dtsi
++++ b/arch/arm/boot/dts/sun7i-a20.dtsi
+@@ -180,7 +180,7 @@
+ default-pool {
+ compatible = "shared-dma-pool";
+ size = <0x6000000>;
+- alloc-ranges = <0x4a000000 0x6000000>;
++ alloc-ranges = <0x40000000 0x10000000>;
+ reusable;
+ linux,cma-default;
+ };
+--
+2.25.1
+
--- /dev/null
+From 32b087dd5ffff4b1654621580c9d4bcff0efb949 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2020 08:37:01 -0700
+Subject: arm64/alternatives: move length validation inside the subsection
+
+From: Sami Tolvanen <samitolvanen@google.com>
+
+[ Upstream commit 966a0acce2fca776391823381dba95c40e03c339 ]
+
+Commit f7b93d42945c ("arm64/alternatives: use subsections for replacement
+sequences") breaks LLVM's integrated assembler, because due to its
+one-pass design, it cannot compute instruction sequence lengths before the
+layout for the subsection has been finalized. This change fixes the build
+by moving the .org directives inside the subsection, so they are processed
+after the subsection layout is known.
+
+Fixes: f7b93d42945c ("arm64/alternatives: use subsections for replacement sequences")
+Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
+Link: https://github.com/ClangBuiltLinux/linux/issues/1078
+Link: https://lore.kernel.org/r/20200730153701.3892953-1-samitolvanen@google.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/alternative.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/include/asm/alternative.h b/arch/arm64/include/asm/alternative.h
+index 12f0eb56a1cc3..619db9b4c9d5c 100644
+--- a/arch/arm64/include/asm/alternative.h
++++ b/arch/arm64/include/asm/alternative.h
+@@ -77,9 +77,9 @@ static inline void apply_alternatives_module(void *start, size_t length) { }
+ "663:\n\t" \
+ newinstr "\n" \
+ "664:\n\t" \
+- ".previous\n\t" \
+ ".org . - (664b-663b) + (662b-661b)\n\t" \
+- ".org . - (662b-661b) + (664b-663b)\n" \
++ ".org . - (662b-661b) + (664b-663b)\n\t" \
++ ".previous\n" \
+ ".endif\n"
+
+ #define __ALTERNATIVE_CFG_CB(oldinstr, feature, cfg_enabled, cb) \
+--
+2.25.1
+
--- /dev/null
+From b98129c416b68c6def5c8eabdce5c925138ec2b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2020 10:56:49 +0100
+Subject: arm64: csum: Fix handling of bad packets
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit 05fb3dbda187bbd9cc1cd0e97e5d6595af570ac6 ]
+
+Although iph is expected to point to at least 20 bytes of valid memory,
+ihl may be bogus, for example on reception of a corrupt packet. If it
+happens to be less than 5, we really don't want to run away and
+dereference 16GB worth of memory until it wraps back to exactly zero...
+
+Fixes: 0e455d8e80aa ("arm64: Implement optimised IP checksum helpers")
+Reported-by: guodeqing <geffrey.guo@huawei.com>
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/checksum.h | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/include/asm/checksum.h b/arch/arm64/include/asm/checksum.h
+index d064a50deb5fb..5665a3fc14be0 100644
+--- a/arch/arm64/include/asm/checksum.h
++++ b/arch/arm64/include/asm/checksum.h
+@@ -19,16 +19,17 @@ static inline __sum16 ip_fast_csum(const void *iph, unsigned int ihl)
+ {
+ __uint128_t tmp;
+ u64 sum;
++ int n = ihl; /* we want it signed */
+
+ tmp = *(const __uint128_t *)iph;
+ iph += 16;
+- ihl -= 4;
++ n -= 4;
+ tmp += ((tmp >> 64) | (tmp << 64));
+ sum = tmp >> 64;
+ do {
+ sum += *(const u32 *)iph;
+ iph += 4;
+- } while (--ihl);
++ } while (--n > 0);
+
+ sum += ((sum >> 32) | (sum << 32));
+ return csum_fold((__force u32)(sum >> 32));
+--
+2.25.1
+
--- /dev/null
+From 9727fdb03f28087067c7eae2c3f7f8366cc1c691 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Jul 2020 20:48:55 +0000
+Subject: Bluetooth: fix kernel oops in store_pending_adv_report
+
+From: Alain Michaud <alainm@chromium.org>
+
+[ Upstream commit a2ec905d1e160a33b2e210e45ad30445ef26ce0e ]
+
+Fix kernel oops observed when an ext adv data is larger than 31 bytes.
+
+This can be reproduced by setting up an advertiser with advertisement
+larger than 31 bytes. The issue is not sensitive to the advertisement
+content. In particular, this was reproduced with an advertisement of
+229 bytes filled with 'A'. See stack trace below.
+
+This is fixed by not catching ext_adv as legacy adv are only cached to
+be able to concatenate a scanable adv with its scan response before
+sending it up through mgmt.
+
+With ext_adv, this is no longer necessary.
+
+ general protection fault: 0000 [#1] SMP PTI
+ CPU: 6 PID: 205 Comm: kworker/u17:0 Not tainted 5.4.0-37-generic #41-Ubuntu
+ Hardware name: Dell Inc. XPS 15 7590/0CF6RR, BIOS 1.7.0 05/11/2020
+ Workqueue: hci0 hci_rx_work [bluetooth]
+ RIP: 0010:hci_bdaddr_list_lookup+0x1e/0x40 [bluetooth]
+ Code: ff ff e9 26 ff ff ff 0f 1f 44 00 00 0f 1f 44 00 00 55 48 8b 07 48 89 e5 48 39 c7 75 0a eb 24 48 8b 00 48 39 f8 74 1c 44 8b 06 <44> 39 40 10 75 ef 44 0f b7 4e 04 66 44 39 48 14 75 e3 38 50 16 75
+ RSP: 0018:ffffbc6a40493c70 EFLAGS: 00010286
+ RAX: 4141414141414141 RBX: 000000000000001b RCX: 0000000000000000
+ RDX: 0000000000000000 RSI: ffff9903e76c100f RDI: ffff9904289d4b28
+ RBP: ffffbc6a40493c70 R08: 0000000093570362 R09: 0000000000000000
+ R10: 0000000000000000 R11: ffff9904344eae38 R12: ffff9904289d4000
+ R13: 0000000000000000 R14: 00000000ffffffa3 R15: ffff9903e76c100f
+ FS: 0000000000000000(0000) GS:ffff990434580000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00007feed125a000 CR3: 00000001b860a003 CR4: 00000000003606e0
+ Call Trace:
+ process_adv_report+0x12e/0x560 [bluetooth]
+ hci_le_meta_evt+0x7b2/0xba0 [bluetooth]
+ hci_event_packet+0x1c29/0x2a90 [bluetooth]
+ hci_rx_work+0x19b/0x360 [bluetooth]
+ process_one_work+0x1eb/0x3b0
+ worker_thread+0x4d/0x400
+ kthread+0x104/0x140
+
+Fixes: c215e9397b00 ("Bluetooth: Process extended ADV report event")
+Reported-by: Andy Nguyen <theflow@google.com>
+Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
+Reported-by: Balakrishna Godavarthi <bgodavar@codeaurora.org>
+Signed-off-by: Alain Michaud <alainm@chromium.org>
+Tested-by: Sonny Sasaka <sonnysasaka@chromium.org>
+Acked-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_event.c | 26 +++++++++++++++++++-------
+ 1 file changed, 19 insertions(+), 7 deletions(-)
+
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 88cd410e57289..44385252d7b6a 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -1274,6 +1274,9 @@ static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
+ {
+ struct discovery_state *d = &hdev->discovery;
+
++ if (len > HCI_MAX_AD_LENGTH)
++ return;
++
+ bacpy(&d->last_adv_addr, bdaddr);
+ d->last_adv_addr_type = bdaddr_type;
+ d->last_adv_rssi = rssi;
+@@ -5231,7 +5234,8 @@ static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
+
+ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
+ u8 bdaddr_type, bdaddr_t *direct_addr,
+- u8 direct_addr_type, s8 rssi, u8 *data, u8 len)
++ u8 direct_addr_type, s8 rssi, u8 *data, u8 len,
++ bool ext_adv)
+ {
+ struct discovery_state *d = &hdev->discovery;
+ struct smp_irk *irk;
+@@ -5253,6 +5257,11 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
+ return;
+ }
+
++ if (!ext_adv && len > HCI_MAX_AD_LENGTH) {
++ bt_dev_err_ratelimited(hdev, "legacy adv larger than 31 bytes");
++ return;
++ }
++
+ /* Find the end of the data in case the report contains padded zero
+ * bytes at the end causing an invalid length value.
+ *
+@@ -5312,7 +5321,7 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
+ */
+ conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type,
+ direct_addr);
+- if (conn && type == LE_ADV_IND) {
++ if (!ext_adv && conn && type == LE_ADV_IND && len <= HCI_MAX_AD_LENGTH) {
+ /* Store report for later inclusion by
+ * mgmt_device_connected
+ */
+@@ -5366,7 +5375,7 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
+ * event or send an immediate device found event if the data
+ * should not be stored for later.
+ */
+- if (!has_pending_adv_report(hdev)) {
++ if (!ext_adv && !has_pending_adv_report(hdev)) {
+ /* If the report will trigger a SCAN_REQ store it for
+ * later merging.
+ */
+@@ -5401,7 +5410,8 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
+ /* If the new report will trigger a SCAN_REQ store it for
+ * later merging.
+ */
+- if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
++ if (!ext_adv && (type == LE_ADV_IND ||
++ type == LE_ADV_SCAN_IND)) {
+ store_pending_adv_report(hdev, bdaddr, bdaddr_type,
+ rssi, flags, data, len);
+ return;
+@@ -5441,7 +5451,7 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
+ rssi = ev->data[ev->length];
+ process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
+ ev->bdaddr_type, NULL, 0, rssi,
+- ev->data, ev->length);
++ ev->data, ev->length, false);
+ } else {
+ bt_dev_err(hdev, "Dropping invalid advertising data");
+ }
+@@ -5515,7 +5525,8 @@ static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
+ if (legacy_evt_type != LE_ADV_INVALID) {
+ process_adv_report(hdev, legacy_evt_type, &ev->bdaddr,
+ ev->bdaddr_type, NULL, 0, ev->rssi,
+- ev->data, ev->length);
++ ev->data, ev->length,
++ !(evt_type & LE_EXT_ADV_LEGACY_PDU));
+ }
+
+ ptr += sizeof(*ev) + ev->length;
+@@ -5713,7 +5724,8 @@ static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
+
+ process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
+ ev->bdaddr_type, &ev->direct_addr,
+- ev->direct_addr_type, ev->rssi, NULL, 0);
++ ev->direct_addr_type, ev->rssi, NULL, 0,
++ false);
+
+ ptr += sizeof(*ev);
+ }
+--
+2.25.1
+
--- /dev/null
+From fa01220fc94bbfe1f703fb89fb0c76434bce39f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jul 2020 21:09:12 -0700
+Subject: bpf: Fix map leak in HASH_OF_MAPS map
+
+From: Andrii Nakryiko <andriin@fb.com>
+
+[ Upstream commit 1d4e1eab456e1ee92a94987499b211db05f900ea ]
+
+Fix HASH_OF_MAPS bug of not putting inner map pointer on bpf_map_elem_update()
+operation. This is due to per-cpu extra_elems optimization, which bypassed
+free_htab_elem() logic doing proper clean ups. Make sure that inner map is put
+properly in optimized case as well.
+
+Fixes: 8c290e60fa2a ("bpf: fix hashmap extra_elems logic")
+Signed-off-by: Andrii Nakryiko <andriin@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Song Liu <songliubraving@fb.com>
+Link: https://lore.kernel.org/bpf/20200729040913.2815687-1-andriin@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/hashtab.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
+index 22066a62c8c97..039d64b1bfb7d 100644
+--- a/kernel/bpf/hashtab.c
++++ b/kernel/bpf/hashtab.c
+@@ -675,15 +675,20 @@ static void htab_elem_free_rcu(struct rcu_head *head)
+ preempt_enable();
+ }
+
+-static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l)
++static void htab_put_fd_value(struct bpf_htab *htab, struct htab_elem *l)
+ {
+ struct bpf_map *map = &htab->map;
++ void *ptr;
+
+ if (map->ops->map_fd_put_ptr) {
+- void *ptr = fd_htab_map_get_ptr(map, l);
+-
++ ptr = fd_htab_map_get_ptr(map, l);
+ map->ops->map_fd_put_ptr(ptr);
+ }
++}
++
++static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l)
++{
++ htab_put_fd_value(htab, l);
+
+ if (htab_is_prealloc(htab)) {
+ __pcpu_freelist_push(&htab->freelist, &l->fnode);
+@@ -735,6 +740,7 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key,
+ */
+ pl_new = this_cpu_ptr(htab->extra_elems);
+ l_new = *pl_new;
++ htab_put_fd_value(htab, old_elem);
+ *pl_new = old_elem;
+ } else {
+ struct pcpu_freelist_node *l;
+--
+2.25.1
+
--- /dev/null
+From 32b089ebcbf5df7a85dc953fc4e2df656d514716 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jul 2020 21:58:39 -0500
+Subject: cxgb4: add missing release on skb in uld_send()
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit e6827d1abdc9b061a57d7b7d3019c4e99fabea2f ]
+
+In the implementation of uld_send(), the skb is consumed on all
+execution paths except one. Release skb when returning NET_XMIT_DROP.
+
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/sge.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
+index 506170fe3a8b7..049f1bbe27ab3 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
+@@ -2441,6 +2441,7 @@ static inline int uld_send(struct adapter *adap, struct sk_buff *skb,
+ txq_info = adap->sge.uld_txq_info[tx_uld_type];
+ if (unlikely(!txq_info)) {
+ WARN_ON(true);
++ kfree_skb(skb);
+ return NET_XMIT_DROP;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 73726a63b72782a64f580934006dac7c50e19bf5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jul 2020 09:33:47 -0700
+Subject: drivers/net/wan: lapb: Corrected the usage of skb_cow
+
+From: Xie He <xie.he.0141@gmail.com>
+
+[ Upstream commit 8754e1379e7089516a449821f88e1fe1ebbae5e1 ]
+
+This patch fixed 2 issues with the usage of skb_cow in LAPB drivers
+"lapbether" and "hdlc_x25":
+
+1) After skb_cow fails, kfree_skb should be called to drop a reference
+to the skb. But in both drivers, kfree_skb is not called.
+
+2) skb_cow should be called before skb_push so that is can ensure the
+safety of skb_push. But in "lapbether", it is incorrectly called after
+skb_push.
+
+More details about these 2 issues:
+
+1) The behavior of calling kfree_skb on failure is also the behavior of
+netif_rx, which is called by this function with "return netif_rx(skb);".
+So this function should follow this behavior, too.
+
+2) In "lapbether", skb_cow is called after skb_push. This results in 2
+logical issues:
+ a) skb_push is not protected by skb_cow;
+ b) An extra headroom of 1 byte is ensured after skb_push. This extra
+ headroom has no use in this function. It also has no use in the
+ upper-layer function that this function passes the skb to
+ (x25_lapb_receive_frame in net/x25/x25_dev.c).
+So logically skb_cow should instead be called before skb_push.
+
+Cc: Eric Dumazet <edumazet@google.com>
+Cc: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: Xie He <xie.he.0141@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/hdlc_x25.c | 4 +++-
+ drivers/net/wan/lapbether.c | 8 +++++---
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wan/hdlc_x25.c b/drivers/net/wan/hdlc_x25.c
+index bf78073ee7fd9..e2a83f4cd3bb6 100644
+--- a/drivers/net/wan/hdlc_x25.c
++++ b/drivers/net/wan/hdlc_x25.c
+@@ -62,8 +62,10 @@ static int x25_data_indication(struct net_device *dev, struct sk_buff *skb)
+ {
+ unsigned char *ptr;
+
+- if (skb_cow(skb, 1))
++ if (skb_cow(skb, 1)) {
++ kfree_skb(skb);
+ return NET_RX_DROP;
++ }
+
+ skb_push(skb, 1);
+ skb_reset_network_header(skb);
+diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
+index 5a6f27298b90f..134e4dd916c1a 100644
+--- a/drivers/net/wan/lapbether.c
++++ b/drivers/net/wan/lapbether.c
+@@ -128,10 +128,12 @@ static int lapbeth_data_indication(struct net_device *dev, struct sk_buff *skb)
+ {
+ unsigned char *ptr;
+
+- skb_push(skb, 1);
+-
+- if (skb_cow(skb, 1))
++ if (skb_cow(skb, 1)) {
++ kfree_skb(skb);
+ return NET_RX_DROP;
++ }
++
++ skb_push(skb, 1);
+
+ ptr = skb->data;
+ *ptr = X25_IFACE_DATA;
+--
+2.25.1
+
--- /dev/null
+From fa90cbad16ab02b45003e0aa73da350831606517 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jul 2020 16:36:32 -0500
+Subject: ibmvnic: Fix IRQ mapping disposal in error path
+
+From: Thomas Falcon <tlfalcon@linux.ibm.com>
+
+[ Upstream commit 27a2145d6f826d1fad9de06ac541b1016ced3427 ]
+
+RX queue IRQ mappings are disposed in both the TX IRQ and RX IRQ
+error paths. Fix this and dispose of TX IRQ mappings correctly in
+case of an error.
+
+Fixes: ea22d51a7831 ("ibmvnic: simplify and improve driver probe function")
+Signed-off-by: Thomas Falcon <tlfalcon@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index d585973606990..2d20a48f0ba0a 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -3086,7 +3086,7 @@ req_rx_irq_failed:
+ req_tx_irq_failed:
+ for (j = 0; j < i; j++) {
+ free_irq(adapter->tx_scrq[j]->irq, adapter->tx_scrq[j]);
+- irq_dispose_mapping(adapter->rx_scrq[j]->irq);
++ irq_dispose_mapping(adapter->tx_scrq[j]->irq);
+ }
+ release_sub_crqs(adapter, 1);
+ return rc;
+--
+2.25.1
+
--- /dev/null
+From 50b7d54decdad18dfa8448b69dc92cef7a364646 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Jul 2020 15:50:07 +0200
+Subject: mac80211: mesh: Free ie data when leaving mesh
+
+From: Remi Pommarel <repk@triplefau.lt>
+
+[ Upstream commit 6a01afcf8468d3ca2bd8bbb27503f60dcf643b20 ]
+
+At ieee80211_join_mesh() some ie data could have been allocated (see
+copy_mesh_setup()) and need to be cleaned up when leaving the mesh.
+
+This fixes the following kmemleak report:
+
+unreferenced object 0xffff0000116bc600 (size 128):
+ comm "wpa_supplicant", pid 608, jiffies 4294898983 (age 293.484s)
+ hex dump (first 32 bytes):
+ 30 14 01 00 00 0f ac 04 01 00 00 0f ac 04 01 00 0...............
+ 00 0f ac 08 00 00 00 00 c4 65 40 00 00 00 00 00 .........e@.....
+ backtrace:
+ [<00000000bebe439d>] __kmalloc_track_caller+0x1c0/0x330
+ [<00000000a349dbe1>] kmemdup+0x28/0x50
+ [<0000000075d69baa>] ieee80211_join_mesh+0x6c/0x3b8 [mac80211]
+ [<00000000683bb98b>] __cfg80211_join_mesh+0x1e8/0x4f0 [cfg80211]
+ [<0000000072cb507f>] nl80211_join_mesh+0x520/0x6b8 [cfg80211]
+ [<0000000077e9bcf9>] genl_family_rcv_msg+0x374/0x680
+ [<00000000b1bd936d>] genl_rcv_msg+0x78/0x108
+ [<0000000022c53788>] netlink_rcv_skb+0xb0/0x1c0
+ [<0000000011af8ec9>] genl_rcv+0x34/0x48
+ [<0000000069e41f53>] netlink_unicast+0x268/0x2e8
+ [<00000000a7517316>] netlink_sendmsg+0x320/0x4c0
+ [<0000000069cba205>] ____sys_sendmsg+0x354/0x3a0
+ [<00000000e06bab0f>] ___sys_sendmsg+0xd8/0x120
+ [<0000000037340728>] __sys_sendmsg+0xa4/0xf8
+ [<000000004fed9776>] __arm64_sys_sendmsg+0x44/0x58
+ [<000000001c1e5647>] el0_svc_handler+0xd0/0x1a0
+
+Fixes: c80d545da3f7 (mac80211: Let userspace enable and configure vendor specific path selection.)
+Signed-off-by: Remi Pommarel <repk@triplefau.lt>
+Link: https://lore.kernel.org/r/20200704135007.27292-1-repk@triplefau.lt
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/cfg.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 0daaf7e37a211..a9dda5c228f60 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -2140,6 +2140,7 @@ static int ieee80211_leave_mesh(struct wiphy *wiphy, struct net_device *dev)
+ ieee80211_stop_mesh(sdata);
+ mutex_lock(&sdata->local->mtx);
+ ieee80211_vif_release_channel(sdata);
++ kfree(sdata->u.mesh.ie);
+ mutex_unlock(&sdata->local->mtx);
+
+ return 0;
+--
+2.25.1
+
--- /dev/null
+From e1ea886020f0219d94a1f8307db66ce86056091b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Jul 2020 15:54:19 +0200
+Subject: mac80211: mesh: Free pending skb when destroying a mpath
+
+From: Remi Pommarel <repk@triplefau.lt>
+
+[ Upstream commit 5e43540c2af0a0c0a18e39579b1ad49541f87506 ]
+
+A mpath object can hold reference on a list of skb that are waiting for
+mpath resolution to be sent. When destroying a mpath this skb list
+should be cleaned up in order to not leak memory.
+
+Fixing that kind of leak:
+
+unreferenced object 0xffff0000181c9300 (size 1088):
+ comm "openvpn", pid 1782, jiffies 4295071698 (age 80.416s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 00 00 00 f9 80 36 00 00 00 00 00 ..........6.....
+ 02 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............
+ backtrace:
+ [<000000004bc6a443>] kmem_cache_alloc+0x1a4/0x2f0
+ [<000000002caaef13>] sk_prot_alloc.isra.39+0x34/0x178
+ [<00000000ceeaa916>] sk_alloc+0x34/0x228
+ [<00000000ca1f1d04>] inet_create+0x198/0x518
+ [<0000000035626b1c>] __sock_create+0x134/0x328
+ [<00000000a12b3a87>] __sys_socket+0xb0/0x158
+ [<00000000ff859f23>] __arm64_sys_socket+0x40/0x58
+ [<00000000263486ec>] el0_svc_handler+0xd0/0x1a0
+ [<0000000005b5157d>] el0_svc+0x8/0xc
+unreferenced object 0xffff000012973a40 (size 216):
+ comm "openvpn", pid 1782, jiffies 4295082137 (age 38.660s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ 00 c0 06 16 00 00 ff ff 00 93 1c 18 00 00 ff ff ................
+ backtrace:
+ [<000000004bc6a443>] kmem_cache_alloc+0x1a4/0x2f0
+ [<0000000023c8c8f9>] __alloc_skb+0xc0/0x2b8
+ [<000000007ad950bb>] alloc_skb_with_frags+0x60/0x320
+ [<00000000ef90023a>] sock_alloc_send_pskb+0x388/0x3c0
+ [<00000000104fb1a3>] sock_alloc_send_skb+0x1c/0x28
+ [<000000006919d2dd>] __ip_append_data+0xba4/0x11f0
+ [<0000000083477587>] ip_make_skb+0x14c/0x1a8
+ [<0000000024f3d592>] udp_sendmsg+0xaf0/0xcf0
+ [<000000005aabe255>] inet_sendmsg+0x5c/0x80
+ [<000000008651ea08>] __sys_sendto+0x15c/0x218
+ [<000000003505c99b>] __arm64_sys_sendto+0x74/0x90
+ [<00000000263486ec>] el0_svc_handler+0xd0/0x1a0
+ [<0000000005b5157d>] el0_svc+0x8/0xc
+
+Fixes: 2bdaf386f99c (mac80211: mesh: move path tables into if_mesh)
+Signed-off-by: Remi Pommarel <repk@triplefau.lt>
+Link: https://lore.kernel.org/r/20200704135419.27703-1-repk@triplefau.lt
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/mesh_pathtbl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
+index 117519bf33d65..aca608ae313fe 100644
+--- a/net/mac80211/mesh_pathtbl.c
++++ b/net/mac80211/mesh_pathtbl.c
+@@ -521,6 +521,7 @@ static void mesh_path_free_rcu(struct mesh_table *tbl,
+ del_timer_sync(&mpath->timer);
+ atomic_dec(&sdata->u.mesh.mpaths);
+ atomic_dec(&tbl->entries);
++ mesh_path_flush_pending(mpath);
+ kfree_rcu(mpath, rcu);
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 03405b380fb13f2d113c17d811f955aa700da2cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jul 2020 16:15:43 -0700
+Subject: mlx4: disable device on shutdown
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 3cab8c65525920f00d8f4997b3e9bb73aecb3a8e ]
+
+It appears that not disabling a PCI device on .shutdown may lead to
+a Hardware Error with particular (perhaps buggy) BIOS versions:
+
+ mlx4_en: eth0: Close port called
+ mlx4_en 0000:04:00.0: removed PHC
+ reboot: Restarting system
+ {1}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1
+ {1}[Hardware Error]: event severity: fatal
+ {1}[Hardware Error]: Error 0, type: fatal
+ {1}[Hardware Error]: section_type: PCIe error
+ {1}[Hardware Error]: port_type: 4, root port
+ {1}[Hardware Error]: version: 1.16
+ {1}[Hardware Error]: command: 0x4010, status: 0x0143
+ {1}[Hardware Error]: device_id: 0000:00:02.2
+ {1}[Hardware Error]: slot: 0
+ {1}[Hardware Error]: secondary_bus: 0x04
+ {1}[Hardware Error]: vendor_id: 0x8086, device_id: 0x2f06
+ {1}[Hardware Error]: class_code: 000604
+ {1}[Hardware Error]: bridge: secondary_status: 0x2000, control: 0x0003
+ {1}[Hardware Error]: aer_uncor_status: 0x00100000, aer_uncor_mask: 0x00000000
+ {1}[Hardware Error]: aer_uncor_severity: 0x00062030
+ {1}[Hardware Error]: TLP Header: 40000018 040000ff 791f4080 00000000
+[hw error repeats]
+ Kernel panic - not syncing: Fatal hardware error!
+ CPU: 0 PID: 2189 Comm: reboot Kdump: loaded Not tainted 5.6.x-blabla #1
+ Hardware name: HP ProLiant DL380 Gen9/ProLiant DL380 Gen9, BIOS P89 05/05/2017
+
+Fix the mlx4 driver.
+
+This is a very similar problem to what had been fixed in:
+commit 0d98ba8d70b0 ("scsi: hpsa: disable device during shutdown")
+to address https://bugzilla.kernel.org/show_bug.cgi?id=199779.
+
+Fixes: 2ba5fbd62b25 ("net/mlx4_core: Handle AER flow properly")
+Reported-by: Jake Lawrence <lawja@fb.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Reviewed-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
+index 87c2e8de61029..942646fb2256c 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/main.c
++++ b/drivers/net/ethernet/mellanox/mlx4/main.c
+@@ -4354,12 +4354,14 @@ end:
+ static void mlx4_shutdown(struct pci_dev *pdev)
+ {
+ struct mlx4_dev_persistent *persist = pci_get_drvdata(pdev);
++ struct mlx4_dev *dev = persist->dev;
+
+ mlx4_info(persist->dev, "mlx4_shutdown was called\n");
+ mutex_lock(&persist->interface_state_mutex);
+ if (persist->interface_state & MLX4_INTERFACE_STATE_UP)
+ mlx4_unload_one(pdev);
+ mutex_unlock(&persist->interface_state_mutex);
++ mlx4_pci_disable_device(dev);
+ }
+
+ static const struct pci_error_handlers mlx4_err_handler = {
+--
+2.25.1
+
--- /dev/null
+From eb42872eff5790bfb5754bc97470b3953d8851e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jul 2020 12:26:46 +0300
+Subject: mlxsw: core: Free EMAD transactions using kfree_rcu()
+
+From: Ido Schimmel <idosch@mellanox.com>
+
+[ Upstream commit 3c8ce24b037648a5a15b85888b259a74b05ff97d ]
+
+The lifetime of EMAD transactions (i.e., 'struct mlxsw_reg_trans') is
+managed using RCU. They are freed using kfree_rcu() once the transaction
+ends.
+
+However, in case the transaction failed it is freed immediately after being
+removed from the active transactions list. This is problematic because it is
+still possible for a different CPU to dereference the transaction from an RCU
+read-side critical section while traversing the active transaction list in
+mlxsw_emad_rx_listener_func(). In which case, a use-after-free is triggered
+[1].
+
+Fix this by freeing the transaction after a grace period by calling
+kfree_rcu().
+
+[1]
+BUG: KASAN: use-after-free in mlxsw_emad_rx_listener_func+0x969/0xac0 drivers/net/ethernet/mellanox/mlxsw/core.c:671
+Read of size 8 at addr ffff88800b7964e8 by task syz-executor.2/2881
+
+CPU: 0 PID: 2881 Comm: syz-executor.2 Not tainted 5.8.0-rc4+ #44
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
+Call Trace:
+ <IRQ>
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0xf6/0x16e lib/dump_stack.c:118
+ print_address_description.constprop.0+0x1c/0x250 mm/kasan/report.c:383
+ __kasan_report mm/kasan/report.c:513 [inline]
+ kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530
+ mlxsw_emad_rx_listener_func+0x969/0xac0 drivers/net/ethernet/mellanox/mlxsw/core.c:671
+ mlxsw_core_skb_receive+0x571/0x700 drivers/net/ethernet/mellanox/mlxsw/core.c:2061
+ mlxsw_pci_cqe_rdq_handle drivers/net/ethernet/mellanox/mlxsw/pci.c:595 [inline]
+ mlxsw_pci_cq_tasklet+0x12a6/0x2520 drivers/net/ethernet/mellanox/mlxsw/pci.c:651
+ tasklet_action_common.isra.0+0x13f/0x3e0 kernel/softirq.c:550
+ __do_softirq+0x223/0x964 kernel/softirq.c:292
+ asm_call_on_stack+0x12/0x20 arch/x86/entry/entry_64.S:711
+ </IRQ>
+ __run_on_irqstack arch/x86/include/asm/irq_stack.h:22 [inline]
+ run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:48 [inline]
+ do_softirq_own_stack+0x109/0x140 arch/x86/kernel/irq_64.c:77
+ invoke_softirq kernel/softirq.c:387 [inline]
+ __irq_exit_rcu kernel/softirq.c:417 [inline]
+ irq_exit_rcu+0x16f/0x1a0 kernel/softirq.c:429
+ sysvec_apic_timer_interrupt+0x4e/0xd0 arch/x86/kernel/apic/apic.c:1091
+ asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:587
+RIP: 0010:arch_local_irq_restore arch/x86/include/asm/irqflags.h:85 [inline]
+RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
+RIP: 0010:_raw_spin_unlock_irqrestore+0x3b/0x40 kernel/locking/spinlock.c:191
+Code: e8 2a c3 f4 fc 48 89 ef e8 12 96 f5 fc f6 c7 02 75 11 53 9d e8 d6 db 11 fd 65 ff 0d 1f 21 b3 56 5b 5d c3 e8 a7 d7 11 fd 53 9d <eb> ed 0f 1f 00 55 48 89 fd 65 ff 05 05 21 b3 56 ff 74 24 08 48 8d
+RSP: 0018:ffff8880446ffd80 EFLAGS: 00000286
+RAX: 0000000000000006 RBX: 0000000000000286 RCX: 0000000000000006
+RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffa94ecea9
+RBP: ffff888012934408 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000001 R11: fffffbfff57be301 R12: 1ffff110088dffc1
+R13: ffff888037b817c0 R14: ffff88802442415a R15: ffff888024424000
+ __do_sys_perf_event_open+0x1b5d/0x2bd0 kernel/events/core.c:11874
+ do_syscall_64+0x56/0xa0 arch/x86/entry/common.c:384
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+RIP: 0033:0x473dbd
+Code: Bad RIP value.
+RSP: 002b:00007f21e5e9cc28 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
+RAX: ffffffffffffffda RBX: 000000000057bf00 RCX: 0000000000473dbd
+RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000040
+RBP: 000000000057bf00 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000003 R11: 0000000000000246 R12: 000000000057bf0c
+R13: 00007ffd0493503f R14: 00000000004d0f46 R15: 00007f21e5e9cd80
+
+Allocated by task 871:
+ save_stack+0x1b/0x40 mm/kasan/common.c:48
+ set_track mm/kasan/common.c:56 [inline]
+ __kasan_kmalloc mm/kasan/common.c:494 [inline]
+ __kasan_kmalloc.constprop.0+0xc2/0xd0 mm/kasan/common.c:467
+ kmalloc include/linux/slab.h:555 [inline]
+ kzalloc include/linux/slab.h:669 [inline]
+ mlxsw_core_reg_access_emad+0x70/0x1410 drivers/net/ethernet/mellanox/mlxsw/core.c:1812
+ mlxsw_core_reg_access+0xeb/0x540 drivers/net/ethernet/mellanox/mlxsw/core.c:1991
+ mlxsw_sp_port_get_hw_xstats+0x335/0x7e0 drivers/net/ethernet/mellanox/mlxsw/spectrum.c:1130
+ update_stats_cache+0xf4/0x140 drivers/net/ethernet/mellanox/mlxsw/spectrum.c:1173
+ process_one_work+0xa3e/0x17a0 kernel/workqueue.c:2269
+ worker_thread+0x9e/0x1050 kernel/workqueue.c:2415
+ kthread+0x355/0x470 kernel/kthread.c:291
+ ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:293
+
+Freed by task 871:
+ save_stack+0x1b/0x40 mm/kasan/common.c:48
+ set_track mm/kasan/common.c:56 [inline]
+ kasan_set_free_info mm/kasan/common.c:316 [inline]
+ __kasan_slab_free+0x12c/0x170 mm/kasan/common.c:455
+ slab_free_hook mm/slub.c:1474 [inline]
+ slab_free_freelist_hook mm/slub.c:1507 [inline]
+ slab_free mm/slub.c:3072 [inline]
+ kfree+0xe6/0x320 mm/slub.c:4052
+ mlxsw_core_reg_access_emad+0xd45/0x1410 drivers/net/ethernet/mellanox/mlxsw/core.c:1819
+ mlxsw_core_reg_access+0xeb/0x540 drivers/net/ethernet/mellanox/mlxsw/core.c:1991
+ mlxsw_sp_port_get_hw_xstats+0x335/0x7e0 drivers/net/ethernet/mellanox/mlxsw/spectrum.c:1130
+ update_stats_cache+0xf4/0x140 drivers/net/ethernet/mellanox/mlxsw/spectrum.c:1173
+ process_one_work+0xa3e/0x17a0 kernel/workqueue.c:2269
+ worker_thread+0x9e/0x1050 kernel/workqueue.c:2415
+ kthread+0x355/0x470 kernel/kthread.c:291
+ ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:293
+
+The buggy address belongs to the object at ffff88800b796400
+ which belongs to the cache kmalloc-512 of size 512
+The buggy address is located 232 bytes inside of
+ 512-byte region [ffff88800b796400, ffff88800b796600)
+The buggy address belongs to the page:
+page:ffffea00002de500 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 head:ffffea00002de500 order:2 compound_mapcount:0 compound_pincount:0
+flags: 0x100000000010200(slab|head)
+raw: 0100000000010200 dead000000000100 dead000000000122 ffff88806c402500
+raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
+page dumped because: kasan: bad access detected
+
+Memory state around the buggy address:
+ ffff88800b796380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+ ffff88800b796400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+>ffff88800b796480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ^
+ ffff88800b796500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ffff88800b796580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+
+Fixes: caf7297e7ab5 ("mlxsw: core: Introduce support for asynchronous EMAD register access")
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Reviewed-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
+index 506bcdc32a8df..c7c3fc7d1126c 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
+@@ -1577,7 +1577,7 @@ static int mlxsw_core_reg_access_emad(struct mlxsw_core *mlxsw_core,
+ err = mlxsw_emad_reg_access(mlxsw_core, reg, payload, type, trans,
+ bulk_list, cb, cb_priv, tid);
+ if (err) {
+- kfree(trans);
++ kfree_rcu(trans, rcu);
+ return err;
+ }
+ return 0;
+--
+2.25.1
+
--- /dev/null
+From afb687d1958dc064475353eb2d6fd55668127b1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jul 2020 12:26:45 +0300
+Subject: mlxsw: core: Increase scope of RCU read-side critical section
+
+From: Ido Schimmel <idosch@mellanox.com>
+
+[ Upstream commit 7d8e8f3433dc8d1dc87c1aabe73a154978fb4c4d ]
+
+The lifetime of the Rx listener item ('rxl_item') is managed using RCU,
+but is dereferenced outside of RCU read-side critical section, which can
+lead to a use-after-free.
+
+Fix this by increasing the scope of the RCU read-side critical section.
+
+Fixes: 93c1edb27f9e ("mlxsw: Introduce Mellanox switch driver core")
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Reviewed-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
+index 1b204ce30ee42..506bcdc32a8df 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
+@@ -1802,11 +1802,13 @@ void mlxsw_core_skb_receive(struct mlxsw_core *mlxsw_core, struct sk_buff *skb,
+ break;
+ }
+ }
+- rcu_read_unlock();
+- if (!found)
++ if (!found) {
++ rcu_read_unlock();
+ goto drop;
++ }
+
+ rxl->func(skb, local_port, rxl_item->priv);
++ rcu_read_unlock();
+ return;
+
+ drop:
+--
+2.25.1
+
--- /dev/null
+From 37d0c17fbd292195314c086493d5ccb6b70aba95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jul 2020 15:23:12 +0900
+Subject: net: ethernet: ravb: exit if re-initialization fails in tx timeout
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+[ Upstream commit 015c5d5e6aa3523c758a70eb87b291cece2dbbb4 ]
+
+According to the report of [1], this driver is possible to cause
+the following error in ravb_tx_timeout_work().
+
+ravb e6800000.ethernet ethernet: failed to switch device to config mode
+
+This error means that the hardware could not change the state
+from "Operation" to "Configuration" while some tx and/or rx queue
+are operating. After that, ravb_config() in ravb_dmac_init() will fail,
+and then any descriptors will be not allocaled anymore so that NULL
+pointer dereference happens after that on ravb_start_xmit().
+
+To fix the issue, the ravb_tx_timeout_work() should check
+the return values of ravb_stop_dma() and ravb_dmac_init().
+If ravb_stop_dma() fails, ravb_tx_timeout_work() re-enables TX and RX
+and just exits. If ravb_dmac_init() fails, just exits.
+
+[1]
+https://lore.kernel.org/linux-renesas-soc/20200518045452.2390-1-dirk.behme@de.bosch.com/
+
+Reported-by: Dirk Behme <dirk.behme@de.bosch.com>
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Reviewed-by: Sergei Shtylyov <sergei.shtylyov@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/renesas/ravb_main.c | 26 ++++++++++++++++++++++--
+ 1 file changed, 24 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
+index 3f165c137236d..30cdabf64ccc1 100644
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -1444,6 +1444,7 @@ static void ravb_tx_timeout_work(struct work_struct *work)
+ struct ravb_private *priv = container_of(work, struct ravb_private,
+ work);
+ struct net_device *ndev = priv->ndev;
++ int error;
+
+ netif_tx_stop_all_queues(ndev);
+
+@@ -1452,15 +1453,36 @@ static void ravb_tx_timeout_work(struct work_struct *work)
+ ravb_ptp_stop(ndev);
+
+ /* Wait for DMA stopping */
+- ravb_stop_dma(ndev);
++ if (ravb_stop_dma(ndev)) {
++ /* If ravb_stop_dma() fails, the hardware is still operating
++ * for TX and/or RX. So, this should not call the following
++ * functions because ravb_dmac_init() is possible to fail too.
++ * Also, this should not retry ravb_stop_dma() again and again
++ * here because it's possible to wait forever. So, this just
++ * re-enables the TX and RX and skip the following
++ * re-initialization procedure.
++ */
++ ravb_rcv_snd_enable(ndev);
++ goto out;
++ }
+
+ ravb_ring_free(ndev, RAVB_BE);
+ ravb_ring_free(ndev, RAVB_NC);
+
+ /* Device init */
+- ravb_dmac_init(ndev);
++ error = ravb_dmac_init(ndev);
++ if (error) {
++ /* If ravb_dmac_init() fails, descriptors are freed. So, this
++ * should return here to avoid re-enabling the TX and RX in
++ * ravb_emac_init().
++ */
++ netdev_err(ndev, "%s: ravb_dmac_init() failed, error %d\n",
++ __func__, error);
++ return;
++ }
+ ravb_emac_init(ndev);
+
++out:
+ /* Initialise PTP Clock driver */
+ if (priv->chip_id == RCAR_GEN2)
+ ravb_ptp_init(ndev, priv->pdev);
+--
+2.25.1
+
--- /dev/null
+From dad08897260e16a10bcb666c57a9fd75588d8d60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2020 15:30:00 +0800
+Subject: net: gemini: Fix missing clk_disable_unprepare() in error path of
+ gemini_ethernet_port_probe()
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit 85496a29224188051b6135eb38da8afd4c584765 ]
+
+Fix the missing clk_disable_unprepare() before return
+from gemini_ethernet_port_probe() in the error handling case.
+
+Fixes: 4d5ae32f5e1e ("net: ethernet: Add a driver for Gemini gigabit ethernet")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cortina/gemini.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
+index 2814b96751b4f..01ae113f122a0 100644
+--- a/drivers/net/ethernet/cortina/gemini.c
++++ b/drivers/net/ethernet/cortina/gemini.c
+@@ -2445,6 +2445,7 @@ static int gemini_ethernet_port_probe(struct platform_device *pdev)
+ port->reset = devm_reset_control_get_exclusive(dev, NULL);
+ if (IS_ERR(port->reset)) {
+ dev_err(dev, "no reset\n");
++ clk_disable_unprepare(port->pclk);
+ return PTR_ERR(port->reset);
+ }
+ reset_control_reset(port->reset);
+@@ -2500,8 +2501,10 @@ static int gemini_ethernet_port_probe(struct platform_device *pdev)
+ IRQF_SHARED,
+ port_names[port->id],
+ port);
+- if (ret)
++ if (ret) {
++ clk_disable_unprepare(port->pclk);
+ return ret;
++ }
+
+ ret = register_netdev(netdev);
+ if (!ret) {
+--
+2.25.1
+
--- /dev/null
+From b6510be3acf144adb9869f4a024ed46840ce1b19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jul 2020 10:16:49 +0800
+Subject: net: hns3: fix a TX timeout issue
+
+From: Yonglong Liu <liuyonglong@huawei.com>
+
+[ Upstream commit a7e90ee5965fafc53d36e8b3205f08c88d7bc11f ]
+
+When the queue depth and queue parameters are modified, there is
+a low probability that TX timeout occurs. The two operations cause
+the link to be down or up when the watchdog is still working. All
+queues are stopped when the link is down. After the carrier is on,
+all queues are woken up. If the watchdog detects the link between
+the carrier on and wakeup queues, a false TX timeout occurs.
+
+So fix this issue by modifying the sequence of carrier on and queue
+wakeup, which is symmetrical to the link down action.
+
+Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC")
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 506381224559f..a8ce6ca0f5081 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -4014,8 +4014,8 @@ static void hns3_link_status_change(struct hnae3_handle *handle, bool linkup)
+ return;
+
+ if (linkup) {
+- netif_carrier_on(netdev);
+ netif_tx_wake_all_queues(netdev);
++ netif_carrier_on(netdev);
+ if (netif_msg_link(handle))
+ netdev_info(netdev, "link up\n");
+ } else {
+--
+2.25.1
+
--- /dev/null
+From 8f0559d739df6a108be34df6da804b672ae76b72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jul 2020 10:16:51 +0800
+Subject: net: hns3: fix aRFS FD rules leftover after add a user FD rule
+
+From: Guojia Liao <liaoguojia@huawei.com>
+
+[ Upstream commit efe3fa45f770f1d66e2734ee7a3523c75694ff04 ]
+
+When user had created a FD rule, all the aRFS rules should be clear up.
+HNS3 process flow as below:
+1.get spin lock of fd_ruls_list
+2.clear up all aRFS rules
+3.release lock
+4.get spin lock of fd_ruls_list
+5.creat a rules
+6.release lock;
+
+There is a short period of time between step 3 and step 4, which would
+creatting some new aRFS FD rules if driver was receiving packet.
+So refactor the fd_rule_lock to fix it.
+
+Fixes: 441228875706 ("net: hns3: refine the flow director handle")
+Signed-off-by: Guojia Liao <liaoguojia@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../hisilicon/hns3/hns3pf/hclge_main.c | 28 ++++++++++---------
+ 1 file changed, 15 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index d4652dea4569b..6c3d13110993f 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -5627,9 +5627,9 @@ static int hclge_add_fd_entry(struct hnae3_handle *handle,
+ /* to avoid rule conflict, when user configure rule by ethtool,
+ * we need to clear all arfs rules
+ */
++ spin_lock_bh(&hdev->fd_rule_lock);
+ hclge_clear_arfs_rules(handle);
+
+- spin_lock_bh(&hdev->fd_rule_lock);
+ ret = hclge_fd_config_rule(hdev, rule);
+
+ spin_unlock_bh(&hdev->fd_rule_lock);
+@@ -5672,6 +5672,7 @@ static int hclge_del_fd_entry(struct hnae3_handle *handle,
+ return ret;
+ }
+
++/* make sure being called after lock up with fd_rule_lock */
+ static void hclge_del_all_fd_entries(struct hnae3_handle *handle,
+ bool clear_list)
+ {
+@@ -5684,7 +5685,6 @@ static void hclge_del_all_fd_entries(struct hnae3_handle *handle,
+ if (!hnae3_dev_fd_supported(hdev))
+ return;
+
+- spin_lock_bh(&hdev->fd_rule_lock);
+ for_each_set_bit(location, hdev->fd_bmap,
+ hdev->fd_cfg.rule_num[HCLGE_FD_STAGE_1])
+ hclge_fd_tcam_config(hdev, HCLGE_FD_STAGE_1, true, location,
+@@ -5701,8 +5701,6 @@ static void hclge_del_all_fd_entries(struct hnae3_handle *handle,
+ bitmap_zero(hdev->fd_bmap,
+ hdev->fd_cfg.rule_num[HCLGE_FD_STAGE_1]);
+ }
+-
+- spin_unlock_bh(&hdev->fd_rule_lock);
+ }
+
+ static int hclge_restore_fd_entries(struct hnae3_handle *handle)
+@@ -6069,7 +6067,7 @@ static int hclge_add_fd_entry_by_arfs(struct hnae3_handle *handle, u16 queue_id,
+ u16 flow_id, struct flow_keys *fkeys)
+ {
+ struct hclge_vport *vport = hclge_get_vport(handle);
+- struct hclge_fd_rule_tuples new_tuples;
++ struct hclge_fd_rule_tuples new_tuples = {};
+ struct hclge_dev *hdev = vport->back;
+ struct hclge_fd_rule *rule;
+ u16 tmp_queue_id;
+@@ -6079,20 +6077,18 @@ static int hclge_add_fd_entry_by_arfs(struct hnae3_handle *handle, u16 queue_id,
+ if (!hnae3_dev_fd_supported(hdev))
+ return -EOPNOTSUPP;
+
+- memset(&new_tuples, 0, sizeof(new_tuples));
+- hclge_fd_get_flow_tuples(fkeys, &new_tuples);
+-
+- spin_lock_bh(&hdev->fd_rule_lock);
+-
+ /* when there is already fd rule existed add by user,
+ * arfs should not work
+ */
++ spin_lock_bh(&hdev->fd_rule_lock);
+ if (hdev->fd_active_type == HCLGE_FD_EP_ACTIVE) {
+ spin_unlock_bh(&hdev->fd_rule_lock);
+
+ return -EOPNOTSUPP;
+ }
+
++ hclge_fd_get_flow_tuples(fkeys, &new_tuples);
++
+ /* check is there flow director filter existed for this flow,
+ * if not, create a new filter for it;
+ * if filter exist with different queue id, modify the filter;
+@@ -6177,6 +6173,7 @@ static void hclge_rfs_filter_expire(struct hclge_dev *hdev)
+ #endif
+ }
+
++/* make sure being called after lock up with fd_rule_lock */
+ static void hclge_clear_arfs_rules(struct hnae3_handle *handle)
+ {
+ #ifdef CONFIG_RFS_ACCEL
+@@ -6221,10 +6218,14 @@ static void hclge_enable_fd(struct hnae3_handle *handle, bool enable)
+
+ hdev->fd_en = enable;
+ clear = hdev->fd_active_type == HCLGE_FD_ARFS_ACTIVE;
+- if (!enable)
++
++ if (!enable) {
++ spin_lock_bh(&hdev->fd_rule_lock);
+ hclge_del_all_fd_entries(handle, clear);
+- else
++ spin_unlock_bh(&hdev->fd_rule_lock);
++ } else {
+ hclge_restore_fd_entries(handle);
++ }
+ }
+
+ static void hclge_cfg_mac_mode(struct hclge_dev *hdev, bool enable)
+@@ -6678,8 +6679,9 @@ static void hclge_ae_stop(struct hnae3_handle *handle)
+ int i;
+
+ set_bit(HCLGE_STATE_DOWN, &hdev->state);
+-
++ spin_lock_bh(&hdev->fd_rule_lock);
+ hclge_clear_arfs_rules(handle);
++ spin_unlock_bh(&hdev->fd_rule_lock);
+
+ /* If it is not PF reset, the firmware will disable the MAC,
+ * so it only need to stop phy here.
+--
+2.25.1
+
--- /dev/null
+From 77e55241f65b6db9dc5a61d24fa695908f38de01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jul 2020 14:10:29 +0200
+Subject: net: lan78xx: add missing endpoint sanity check
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 8d8e95fd6d69d774013f51e5f2ee10c6e6d1fc14 ]
+
+Add the missing endpoint sanity check to prevent a NULL-pointer
+dereference should a malicious device lack the expected endpoints.
+
+Note that the driver has a broken endpoint-lookup helper,
+lan78xx_get_endpoints(), which can end up accepting interfaces in an
+altsetting without endpoints as long as *some* altsetting has a bulk-in
+and a bulk-out endpoint.
+
+Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
+Cc: Woojung.Huh@microchip.com <Woojung.Huh@microchip.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/lan78xx.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 0170a441208a7..54ce1ed1ea379 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -3767,6 +3767,11 @@ static int lan78xx_probe(struct usb_interface *intf,
+ netdev->max_mtu = MAX_SINGLE_PACKET_SIZE;
+ netif_set_gso_max_size(netdev, MAX_SINGLE_PACKET_SIZE - MAX_HEADER);
+
++ if (intf->cur_altsetting->desc.bNumEndpoints < 3) {
++ ret = -ENODEV;
++ goto out3;
++ }
++
+ dev->ep_blkin = (intf->cur_altsetting)->endpoint + 0;
+ dev->ep_blkout = (intf->cur_altsetting)->endpoint + 1;
+ dev->ep_intr = (intf->cur_altsetting)->endpoint + 2;
+--
+2.25.1
+
--- /dev/null
+From 74f7f9f9b561691ec3e923a2b6a163da46333046 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jul 2020 14:10:30 +0200
+Subject: net: lan78xx: fix transfer-buffer memory leak
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 63634aa679ba8b5e306ad0727120309ae6ba8a8e ]
+
+The interrupt URB transfer-buffer was never freed on disconnect or after
+probe errors.
+
+Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
+Cc: Woojung.Huh@microchip.com <Woojung.Huh@microchip.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/lan78xx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 54ce1ed1ea379..1da99abc6ed15 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -3796,6 +3796,7 @@ static int lan78xx_probe(struct usb_interface *intf,
+ usb_fill_int_urb(dev->urb_intr, dev->udev,
+ dev->pipe_intr, buf, maxp,
+ intr_complete, dev, period);
++ dev->urb_intr->transfer_flags |= URB_FREE_BUFFER;
+ }
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 3fa45d2a1d25a2e8d4770c7c1fb83bb6d1f438bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Jun 2020 13:29:28 +0300
+Subject: net/mlx5: E-switch, Destroy TSAR when fail to enable the mode
+
+From: Parav Pandit <parav@mellanox.com>
+
+[ Upstream commit 2b8e9c7c3fd0e31091edb1c66cc06ffe4988ca21 ]
+
+When either esw_legacy_enable() or esw_offloads_enable() fails,
+code missed to destroy the created TSAR.
+
+Hence, add the missing call to destroy the TSAR.
+
+Fixes: 610090ebce92 ("net/mlx5: E-switch, Initialize TSAR Qos hardware block before its user vports")
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Reviewed-by: Roi Dayan <roid@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+index c6ed4b7f4f972..422a57404407d 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+@@ -1919,7 +1919,7 @@ abort:
+ mlx5_reload_interface(esw->dev, MLX5_INTERFACE_PROTOCOL_IB);
+ mlx5_reload_interface(esw->dev, MLX5_INTERFACE_PROTOCOL_ETH);
+ }
+-
++ esw_destroy_tsar(esw);
+ return err;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From daeda3128280b507ea199be8787597cd51745d4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jul 2020 11:10:01 +0300
+Subject: net/mlx5: Verify Hardware supports requested ptp function on a given
+ pin
+
+From: Eran Ben Elisha <eranbe@mellanox.com>
+
+[ Upstream commit 071995c877a8646209d55ff8edddd2b054e7424c ]
+
+Fix a bug where driver did not verify Hardware pin capabilities for
+PTP functions.
+
+Fixes: ee7f12205abc ("net/mlx5e: Implement 1PPS support")
+Signed-off-by: Eran Ben Elisha <eranbe@mellanox.com>
+Reviewed-by: Ariel Levkovich <lariel@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/mellanox/mlx5/core/lib/clock.c | 23 ++++++++++++++++++-
+ 1 file changed, 22 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
+index 43f97601b5000..75fc283cacc36 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
+@@ -388,10 +388,31 @@ static int mlx5_ptp_enable(struct ptp_clock_info *ptp,
+ return 0;
+ }
+
++enum {
++ MLX5_MTPPS_REG_CAP_PIN_X_MODE_SUPPORT_PPS_IN = BIT(0),
++ MLX5_MTPPS_REG_CAP_PIN_X_MODE_SUPPORT_PPS_OUT = BIT(1),
++};
++
+ static int mlx5_ptp_verify(struct ptp_clock_info *ptp, unsigned int pin,
+ enum ptp_pin_function func, unsigned int chan)
+ {
+- return (func == PTP_PF_PHYSYNC) ? -EOPNOTSUPP : 0;
++ struct mlx5_clock *clock = container_of(ptp, struct mlx5_clock,
++ ptp_info);
++
++ switch (func) {
++ case PTP_PF_NONE:
++ return 0;
++ case PTP_PF_EXTTS:
++ return !(clock->pps_info.pin_caps[pin] &
++ MLX5_MTPPS_REG_CAP_PIN_X_MODE_SUPPORT_PPS_IN);
++ case PTP_PF_PEROUT:
++ return !(clock->pps_info.pin_caps[pin] &
++ MLX5_MTPPS_REG_CAP_PIN_X_MODE_SUPPORT_PPS_OUT);
++ default:
++ return -EOPNOTSUPP;
++ }
++
++ return -EOPNOTSUPP;
+ }
+
+ static const struct ptp_clock_info mlx5_ptp_clock_info = {
+--
+2.25.1
+
--- /dev/null
+From e50bcb9360b6b0f7fbf267e1ad90044c24783d2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2020 18:29:41 +0800
+Subject: net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq
+
+From: Xin Xiong <xiongx18@fudan.edu.cn>
+
+[ Upstream commit e692139e6af339a1495ef401b2d95f7f9d1c7a44 ]
+
+The function invokes bpf_prog_inc(), which increases the reference
+count of a bpf_prog object "rq->xdp_prog" if the object isn't NULL.
+
+The refcount leak issues take place in two error handling paths. When
+either mlx5_wq_ll_create() or mlx5_wq_cyc_create() fails, the function
+simply returns the error code and forgets to drop the reference count
+increased earlier, causing a reference count leak of "rq->xdp_prog".
+
+Fix this issue by jumping to the error handling path err_rq_wq_destroy
+while either function fails.
+
+Fixes: 422d4c401edd ("net/mlx5e: RX, Split WQ objects for different RQ types")
+Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
+Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
+Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index cb3dcfced89fa..ee0d78f801af5 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -432,7 +432,7 @@ static int mlx5e_alloc_rq(struct mlx5e_channel *c,
+ err = mlx5_wq_ll_create(mdev, &rqp->wq, rqc_wq, &rq->mpwqe.wq,
+ &rq->wq_ctrl);
+ if (err)
+- return err;
++ goto err_rq_wq_destroy;
+
+ rq->mpwqe.wq.db = &rq->mpwqe.wq.db[MLX5_RCV_DBR];
+
+@@ -485,7 +485,7 @@ static int mlx5e_alloc_rq(struct mlx5e_channel *c,
+ err = mlx5_wq_cyc_create(mdev, &rqp->wq, rqc_wq, &rq->wqe.wq,
+ &rq->wq_ctrl);
+ if (err)
+- return err;
++ goto err_rq_wq_destroy;
+
+ rq->wqe.wq.db = &rq->wqe.wq.db[MLX5_RCV_DBR];
+
+--
+2.25.1
+
--- /dev/null
+From 5cc9d18d8ca9fd0f6b54da1a98889ec934fe49f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Jul 2020 12:21:53 +0300
+Subject: net/mlx5e: Fix error path of device attach
+
+From: Aya Levin <ayal@mellanox.com>
+
+[ Upstream commit 5cd39b6e9a420329a9a408894be7ba8aa7dd755e ]
+
+On failure to attach the netdev, fix the rollback by re-setting the
+device's state back to MLX5E_STATE_DESTROYING.
+
+Failing to attach doesn't stop statistics polling via .ndo_get_stats64.
+In this case, although the device is not attached, it falsely continues
+to query the firmware for counters. Setting the device's state back to
+MLX5E_STATE_DESTROYING prevents the firmware counters query.
+
+Fixes: 26e59d8077a3 ("net/mlx5e: Implement mlx5e interface attach/detach callbacks")
+Signed-off-by: Aya Levin <ayal@mellanox.com>
+Reviewed-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index c133beb6a7a56..15db4a8746dd7 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -5356,6 +5356,8 @@ err_cleanup_tx:
+ profile->cleanup_tx(priv);
+
+ out:
++ set_bit(MLX5E_STATE_DESTROYING, &priv->state);
++ cancel_work_sync(&priv->update_stats_work);
+ return err;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 4deefd81fa43538c2a019a88d7c9af1d7cc70593 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jul 2020 11:46:30 +0300
+Subject: net/mlx5e: Fix kernel crash when setting vf VLANID on a VF dev
+
+From: Alaa Hleihel <alaa@mellanox.com>
+
+[ Upstream commit 350a63249d270b1f5bd05c7e2a24cd8de0f9db20 ]
+
+After the cited commit, function 'mlx5_eswitch_set_vport_vlan' started
+to acquire esw->state_lock.
+However, esw is not defined for VF devices, hence attempting to set vf
+VLANID on a VF dev will cause a kernel panic.
+
+Fix it by moving up the (redundant) esw validation from function
+'__mlx5_eswitch_set_vport_vlan' since the rest of the callers now have
+and use a valid esw.
+
+For example with vf device eth4:
+ # ip link set dev eth4 vf 0 vlan 0
+
+Trace of the panic:
+ [ 411.409842] BUG: unable to handle page fault for address: 00000000000011b8
+ [ 411.449745] #PF: supervisor read access in kernel mode
+ [ 411.452348] #PF: error_code(0x0000) - not-present page
+ [ 411.454938] PGD 80000004189c9067 P4D 80000004189c9067 PUD 41899a067 PMD 0
+ [ 411.458382] Oops: 0000 [#1] SMP PTI
+ [ 411.460268] CPU: 4 PID: 5711 Comm: ip Not tainted 5.8.0-rc4_for_upstream_min_debug_2020_07_08_22_04 #1
+ [ 411.462447] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
+ [ 411.464158] RIP: 0010:__mutex_lock+0x4e/0x940
+ [ 411.464928] Code: fd 41 54 49 89 f4 41 52 53 89 d3 48 83 ec 70 44 8b 1d ee 03 b0 01 65 48 8b 04 25 28 00 00 00 48 89 45 c8 31 c0 45 85 db 75 0a <48> 3b 7f 60 0f 85 7e 05 00 00 49 8d 45 68 41 56 41 b8 01 00 00 00
+ [ 411.467678] RSP: 0018:ffff88841fcd74b0 EFLAGS: 00010246
+ [ 411.468562] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
+ [ 411.469715] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000001158
+ [ 411.470812] RBP: ffff88841fcd7550 R08: ffffffffa00fa1ce R09: 0000000000000000
+ [ 411.471835] R10: ffff88841fcd7570 R11: 0000000000000000 R12: 0000000000000002
+ [ 411.472862] R13: 0000000000001158 R14: ffffffffa00fa1ce R15: 0000000000000000
+ [ 411.474004] FS: 00007faee7ca6b80(0000) GS:ffff88846fc00000(0000) knlGS:0000000000000000
+ [ 411.475237] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ [ 411.476129] CR2: 00000000000011b8 CR3: 000000041909c006 CR4: 0000000000360ea0
+ [ 411.477260] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ [ 411.478340] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ [ 411.479332] Call Trace:
+ [ 411.479760] ? __nla_validate_parse.part.6+0x57/0x8f0
+ [ 411.482825] ? mlx5_eswitch_set_vport_vlan+0x3e/0xa0 [mlx5_core]
+ [ 411.483804] mlx5_eswitch_set_vport_vlan+0x3e/0xa0 [mlx5_core]
+ [ 411.484733] mlx5e_set_vf_vlan+0x41/0x50 [mlx5_core]
+ [ 411.485545] do_setlink+0x613/0x1000
+ [ 411.486165] __rtnl_newlink+0x53d/0x8c0
+ [ 411.486791] ? mark_held_locks+0x49/0x70
+ [ 411.487429] ? __lock_acquire+0x8fe/0x1eb0
+ [ 411.488085] ? rcu_read_lock_sched_held+0x52/0x60
+ [ 411.488998] ? kmem_cache_alloc_trace+0x16d/0x2d0
+ [ 411.489759] rtnl_newlink+0x47/0x70
+ [ 411.490357] rtnetlink_rcv_msg+0x24e/0x450
+ [ 411.490978] ? netlink_deliver_tap+0x92/0x3d0
+ [ 411.491631] ? validate_linkmsg+0x330/0x330
+ [ 411.492262] netlink_rcv_skb+0x47/0x110
+ [ 411.492852] netlink_unicast+0x1ac/0x270
+ [ 411.493551] netlink_sendmsg+0x336/0x450
+ [ 411.494209] sock_sendmsg+0x30/0x40
+ [ 411.494779] ____sys_sendmsg+0x1dd/0x1f0
+ [ 411.495378] ? copy_msghdr_from_user+0x5c/0x90
+ [ 411.496082] ___sys_sendmsg+0x87/0xd0
+ [ 411.496683] ? lock_acquire+0xb9/0x3a0
+ [ 411.497322] ? lru_cache_add+0x5/0x170
+ [ 411.497944] ? find_held_lock+0x2d/0x90
+ [ 411.498568] ? handle_mm_fault+0xe46/0x18c0
+ [ 411.499205] ? __sys_sendmsg+0x51/0x90
+ [ 411.499784] __sys_sendmsg+0x51/0x90
+ [ 411.500341] do_syscall_64+0x59/0x2e0
+ [ 411.500938] ? asm_exc_page_fault+0x8/0x30
+ [ 411.501609] ? rcu_read_lock_sched_held+0x52/0x60
+ [ 411.502350] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ [ 411.503093] RIP: 0033:0x7faee73b85a7
+ [ 411.503654] Code: Bad RIP value.
+
+Fixes: 0e18134f4f9f ("net/mlx5e: Eswitch, use state_lock to synchronize vlan change")
+Signed-off-by: Alaa Hleihel <alaa@mellanox.com>
+Reviewed-by: Roi Dayan <roid@mellanox.com>
+Reviewed-by: Vlad Buslov <vladbu@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+index 6b711affb7da4..8e6ab82019398 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+@@ -2155,8 +2155,6 @@ int __mlx5_eswitch_set_vport_vlan(struct mlx5_eswitch *esw,
+ struct mlx5_vport *evport = mlx5_eswitch_get_vport(esw, vport);
+ int err = 0;
+
+- if (!ESW_ALLOWED(esw))
+- return -EPERM;
+ if (IS_ERR(evport))
+ return PTR_ERR(evport);
+ if (vlan > 4095 || qos > 7)
+@@ -2184,6 +2182,9 @@ int mlx5_eswitch_set_vport_vlan(struct mlx5_eswitch *esw,
+ u8 set_flags = 0;
+ int err;
+
++ if (!ESW_ALLOWED(esw))
++ return -EPERM;
++
+ if (vlan || qos)
+ set_flags = SET_VLAN_STRIP | SET_VLAN_INSERT;
+
+--
+2.25.1
+
--- /dev/null
+From e1b441a7307c632dc6ad08f4025a2bc6a3868906 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Apr 2020 13:58:40 +0300
+Subject: net/mlx5e: Modify uplink state on interface up/down
+
+From: Ron Diskin <rondi@mellanox.com>
+
+[ Upstream commit 7d0314b11cdd92bca8b89684c06953bf114605fc ]
+
+When setting the PF interface up/down, notify the firmware to update
+uplink state via MODIFY_VPORT_STATE, when E-Switch is enabled.
+
+This behavior will prevent sending traffic out on uplink port when PF is
+down, such as sending traffic from a VF interface which is still up.
+Currently when calling mlx5e_open/close(), the driver only sends PAOS
+command to notify the firmware to set the physical port state to
+up/down, however, it is not sufficient. When VF is in "auto" state, it
+follows the uplink state, which was not updated on mlx5e_open/close()
+before this patch.
+
+When switchdev mode is enabled and uplink representor is first enabled,
+set the uplink port state value back to its FW default "AUTO".
+
+Fixes: 63bfd399de55 ("net/mlx5e: Send PAOS command on interface up/down")
+Signed-off-by: Ron Diskin <rondi@mellanox.com>
+Reviewed-by: Roi Dayan <roid@mellanox.com>
+Reviewed-by: Moshe Shemesh <moshe@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlx5/core/en_main.c | 25 ++++++++++++++++---
+ .../net/ethernet/mellanox/mlx5/core/en_rep.c | 2 ++
+ .../net/ethernet/mellanox/mlx5/core/eswitch.c | 16 +++++++-----
+ .../net/ethernet/mellanox/mlx5/core/eswitch.h | 2 ++
+ include/linux/mlx5/mlx5_ifc.h | 1 +
+ 5 files changed, 37 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 15db4a8746dd7..cb3dcfced89fa 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -3038,6 +3038,25 @@ void mlx5e_timestamp_init(struct mlx5e_priv *priv)
+ priv->tstamp.rx_filter = HWTSTAMP_FILTER_NONE;
+ }
+
++static void mlx5e_modify_admin_state(struct mlx5_core_dev *mdev,
++ enum mlx5_port_status state)
++{
++ struct mlx5_eswitch *esw = mdev->priv.eswitch;
++ int vport_admin_state;
++
++ mlx5_set_port_admin_status(mdev, state);
++
++ if (!MLX5_ESWITCH_MANAGER(mdev) || mlx5_eswitch_mode(esw) == MLX5_ESWITCH_OFFLOADS)
++ return;
++
++ if (state == MLX5_PORT_UP)
++ vport_admin_state = MLX5_VPORT_ADMIN_STATE_AUTO;
++ else
++ vport_admin_state = MLX5_VPORT_ADMIN_STATE_DOWN;
++
++ mlx5_eswitch_set_vport_state(esw, MLX5_VPORT_UPLINK, vport_admin_state);
++}
++
+ int mlx5e_open_locked(struct net_device *netdev)
+ {
+ struct mlx5e_priv *priv = netdev_priv(netdev);
+@@ -3070,7 +3089,7 @@ int mlx5e_open(struct net_device *netdev)
+ mutex_lock(&priv->state_lock);
+ err = mlx5e_open_locked(netdev);
+ if (!err)
+- mlx5_set_port_admin_status(priv->mdev, MLX5_PORT_UP);
++ mlx5e_modify_admin_state(priv->mdev, MLX5_PORT_UP);
+ mutex_unlock(&priv->state_lock);
+
+ if (mlx5_vxlan_allowed(priv->mdev->vxlan))
+@@ -3107,7 +3126,7 @@ int mlx5e_close(struct net_device *netdev)
+ return -ENODEV;
+
+ mutex_lock(&priv->state_lock);
+- mlx5_set_port_admin_status(priv->mdev, MLX5_PORT_DOWN);
++ mlx5e_modify_admin_state(priv->mdev, MLX5_PORT_DOWN);
+ err = mlx5e_close_locked(netdev);
+ mutex_unlock(&priv->state_lock);
+
+@@ -5172,7 +5191,7 @@ static void mlx5e_nic_enable(struct mlx5e_priv *priv)
+
+ /* Marking the link as currently not needed by the Driver */
+ if (!netif_running(netdev))
+- mlx5_set_port_admin_status(mdev, MLX5_PORT_DOWN);
++ mlx5e_modify_admin_state(mdev, MLX5_PORT_DOWN);
+
+ mlx5e_set_netdev_mtu_boundaries(priv);
+ mlx5e_set_dev_port_mtu(priv);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+index 9b232ef36d53b..88b51f64a64ea 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+@@ -1736,6 +1736,8 @@ static void mlx5e_uplink_rep_enable(struct mlx5e_priv *priv)
+ INIT_WORK(&rpriv->uplink_priv.reoffload_flows_work,
+ mlx5e_tc_reoffload_flows_work);
+
++ mlx5_modify_vport_admin_state(mdev, MLX5_VPORT_STATE_OP_MOD_UPLINK,
++ 0, 0, MLX5_VPORT_ADMIN_STATE_AUTO);
+ mlx5_lag_add(mdev, netdev);
+ priv->events_nb.notifier_call = uplink_rep_async_event;
+ mlx5_notifier_register(mdev, &priv->events_nb);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+index 422a57404407d..6b711affb7da4 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+@@ -2094,6 +2094,8 @@ int mlx5_eswitch_set_vport_state(struct mlx5_eswitch *esw,
+ u16 vport, int link_state)
+ {
+ struct mlx5_vport *evport = mlx5_eswitch_get_vport(esw, vport);
++ int opmod = MLX5_VPORT_STATE_OP_MOD_ESW_VPORT;
++ int other_vport = 1;
+ int err = 0;
+
+ if (!ESW_ALLOWED(esw))
+@@ -2101,15 +2103,17 @@ int mlx5_eswitch_set_vport_state(struct mlx5_eswitch *esw,
+ if (IS_ERR(evport))
+ return PTR_ERR(evport);
+
++ if (vport == MLX5_VPORT_UPLINK) {
++ opmod = MLX5_VPORT_STATE_OP_MOD_UPLINK;
++ other_vport = 0;
++ vport = 0;
++ }
+ mutex_lock(&esw->state_lock);
+
+- err = mlx5_modify_vport_admin_state(esw->dev,
+- MLX5_VPORT_STATE_OP_MOD_ESW_VPORT,
+- vport, 1, link_state);
++ err = mlx5_modify_vport_admin_state(esw->dev, opmod, vport, other_vport, link_state);
+ if (err) {
+- mlx5_core_warn(esw->dev,
+- "Failed to set vport %d link state, err = %d",
+- vport, err);
++ mlx5_core_warn(esw->dev, "Failed to set vport %d link state, opmod = %d, err = %d",
++ vport, opmod, err);
+ goto unlock;
+ }
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
+index 6bd6f58952442..0ddbae1e64fad 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
+@@ -606,6 +606,8 @@ static inline int mlx5_eswitch_enable(struct mlx5_eswitch *esw, int mode) { ret
+ static inline void mlx5_eswitch_disable(struct mlx5_eswitch *esw) {}
+ static inline bool mlx5_esw_lag_prereq(struct mlx5_core_dev *dev0, struct mlx5_core_dev *dev1) { return true; }
+ static inline bool mlx5_eswitch_is_funcs_handler(struct mlx5_core_dev *dev) { return false; }
++static inline
++int mlx5_eswitch_set_vport_state(struct mlx5_eswitch *esw, u16 vport, int link_state) { return 0; }
+ static inline const u32 *mlx5_esw_query_functions(struct mlx5_core_dev *dev)
+ {
+ return ERR_PTR(-EOPNOTSUPP);
+diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
+index acd859ea09d42..aba56077cfda2 100644
+--- a/include/linux/mlx5/mlx5_ifc.h
++++ b/include/linux/mlx5/mlx5_ifc.h
+@@ -4177,6 +4177,7 @@ struct mlx5_ifc_query_vport_state_out_bits {
+ enum {
+ MLX5_VPORT_STATE_OP_MOD_VNIC_VPORT = 0x0,
+ MLX5_VPORT_STATE_OP_MOD_ESW_VPORT = 0x1,
++ MLX5_VPORT_STATE_OP_MOD_UPLINK = 0x2,
+ };
+
+ struct mlx5_ifc_arm_monitor_counter_in_bits {
+--
+2.25.1
+
--- /dev/null
+From 7a61fbd188a572db080f109ed8e79e8ebedbafa4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jul 2020 11:50:05 +0800
+Subject: net: nixge: fix potential memory leak in nixge_probe()
+
+From: Lu Wei <luwei32@huawei.com>
+
+[ Upstream commit 366228ed01f6882cc203e3d5b40010dfae0be1c3 ]
+
+If some processes in nixge_probe() fail, free_netdev(dev)
+needs to be called to aviod a memory leak.
+
+Fixes: 87ab207981ec ("net: nixge: Separate ctrl and dma resources")
+Fixes: abcd3d6fc640 ("net: nixge: Fix error path for obtaining mac address")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Lu Wei <luwei32@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ni/nixge.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/ni/nixge.c b/drivers/net/ethernet/ni/nixge.c
+index 2761f3a3ae508..56f285985b432 100644
+--- a/drivers/net/ethernet/ni/nixge.c
++++ b/drivers/net/ethernet/ni/nixge.c
+@@ -1318,19 +1318,21 @@ static int nixge_probe(struct platform_device *pdev)
+ netif_napi_add(ndev, &priv->napi, nixge_poll, NAPI_POLL_WEIGHT);
+ err = nixge_of_get_resources(pdev);
+ if (err)
+- return err;
++ goto free_netdev;
+ __nixge_hw_set_mac_address(ndev);
+
+ priv->tx_irq = platform_get_irq_byname(pdev, "tx");
+ if (priv->tx_irq < 0) {
+ netdev_err(ndev, "could not find 'tx' irq");
+- return priv->tx_irq;
++ err = priv->tx_irq;
++ goto free_netdev;
+ }
+
+ priv->rx_irq = platform_get_irq_byname(pdev, "rx");
+ if (priv->rx_irq < 0) {
+ netdev_err(ndev, "could not find 'rx' irq");
+- return priv->rx_irq;
++ err = priv->rx_irq;
++ goto free_netdev;
+ }
+
+ priv->coalesce_count_rx = XAXIDMA_DFT_RX_THRESHOLD;
+--
+2.25.1
+
--- /dev/null
+From f83da42246145ef018ea50e7aa3fdd69cdf3b5d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Jul 2020 00:31:49 -0500
+Subject: nfc: s3fwrn5: add missing release on skb in s3fwrn5_recv_frame
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit 1e8fd3a97f2d83a7197876ceb4f37b4c2b00a0f3 ]
+
+The implementation of s3fwrn5_recv_frame() is supposed to consume skb on
+all execution paths. Release skb before returning -ENODEV.
+
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nfc/s3fwrn5/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/nfc/s3fwrn5/core.c b/drivers/nfc/s3fwrn5/core.c
+index 91d4d5b28a7d9..ba6c486d64659 100644
+--- a/drivers/nfc/s3fwrn5/core.c
++++ b/drivers/nfc/s3fwrn5/core.c
+@@ -198,6 +198,7 @@ int s3fwrn5_recv_frame(struct nci_dev *ndev, struct sk_buff *skb,
+ case S3FWRN5_MODE_FW:
+ return s3fwrn5_fw_recv_frame(ndev, skb);
+ default:
++ kfree_skb(skb);
+ return -ENODEV;
+ }
+ }
+--
+2.25.1
+
--- /dev/null
+From 60f3c570187fb7ed509822af98becaf809e2234b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jul 2020 16:42:26 -0700
+Subject: nvme-tcp: fix possible hang waiting for icresp response
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit adc99fd378398f4c58798a1c57889872967d56a6 ]
+
+If the controller died exactly when we are receiving icresp
+we hang because icresp may never return. Make sure to set a
+high finite limit.
+
+Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver")
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/tcp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index 7900814355c28..53e113a18a549 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -1319,6 +1319,9 @@ static int nvme_tcp_alloc_queue(struct nvme_ctrl *nctrl,
+ }
+ }
+
++ /* Set 10 seconds timeout for icresp recvmsg */
++ queue->sock->sk->sk_rcvtimeo = 10 * HZ;
++
+ queue->sock->sk->sk_allocation = GFP_ATOMIC;
+ if (!qid)
+ n = 0;
+--
+2.25.1
+
--- /dev/null
+From fa60ac33778bfdd42ff4c1d16f686727ee76f6c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Jul 2020 16:10:21 -0400
+Subject: parisc: add support for cmpxchg on u8 pointers
+
+From: Liam Beguin <liambeguin@gmail.com>
+
+[ Upstream commit b344d6a83d01c52fddbefa6b3b4764da5b1022a0 ]
+
+The kernel test bot reported[1] that using set_mask_bits on a u8 causes
+the following issue on parisc:
+
+ hppa-linux-ld: drivers/phy/ti/phy-tusb1210.o: in function `tusb1210_probe':
+ >> (.text+0x2f4): undefined reference to `__cmpxchg_called_with_bad_pointer'
+ >> hppa-linux-ld: (.text+0x324): undefined reference to `__cmpxchg_called_with_bad_pointer'
+ hppa-linux-ld: (.text+0x354): undefined reference to `__cmpxchg_called_with_bad_pointer'
+
+Add support for cmpxchg on u8 pointers.
+
+[1] https://lore.kernel.org/patchwork/patch/1272617/#1468946
+
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Liam Beguin <liambeguin@gmail.com>
+Tested-by: Dave Anglin <dave.anglin@bell.net>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/include/asm/cmpxchg.h | 2 ++
+ arch/parisc/lib/bitops.c | 12 ++++++++++++
+ 2 files changed, 14 insertions(+)
+
+diff --git a/arch/parisc/include/asm/cmpxchg.h b/arch/parisc/include/asm/cmpxchg.h
+index ab5c215cf46c3..0689585758717 100644
+--- a/arch/parisc/include/asm/cmpxchg.h
++++ b/arch/parisc/include/asm/cmpxchg.h
+@@ -60,6 +60,7 @@ extern void __cmpxchg_called_with_bad_pointer(void);
+ extern unsigned long __cmpxchg_u32(volatile unsigned int *m, unsigned int old,
+ unsigned int new_);
+ extern u64 __cmpxchg_u64(volatile u64 *ptr, u64 old, u64 new_);
++extern u8 __cmpxchg_u8(volatile u8 *ptr, u8 old, u8 new_);
+
+ /* don't worry...optimizer will get rid of most of this */
+ static inline unsigned long
+@@ -71,6 +72,7 @@ __cmpxchg(volatile void *ptr, unsigned long old, unsigned long new_, int size)
+ #endif
+ case 4: return __cmpxchg_u32((unsigned int *)ptr,
+ (unsigned int)old, (unsigned int)new_);
++ case 1: return __cmpxchg_u8((u8 *)ptr, (u8)old, (u8)new_);
+ }
+ __cmpxchg_called_with_bad_pointer();
+ return old;
+diff --git a/arch/parisc/lib/bitops.c b/arch/parisc/lib/bitops.c
+index 70ffbcf889b8e..2e4d1f05a9264 100644
+--- a/arch/parisc/lib/bitops.c
++++ b/arch/parisc/lib/bitops.c
+@@ -79,3 +79,15 @@ unsigned long __cmpxchg_u32(volatile unsigned int *ptr, unsigned int old, unsign
+ _atomic_spin_unlock_irqrestore(ptr, flags);
+ return (unsigned long)prev;
+ }
++
++u8 __cmpxchg_u8(volatile u8 *ptr, u8 old, u8 new)
++{
++ unsigned long flags;
++ u8 prev;
++
++ _atomic_spin_lock_irqsave(ptr, flags);
++ if ((prev = *ptr) == old)
++ *ptr = new;
++ _atomic_spin_unlock_irqrestore(ptr, flags);
++ return prev;
++}
+--
+2.25.1
+
--- /dev/null
+From 869cf10f6e155068e5071937e29ea6149c8a27c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jul 2020 15:11:10 +0800
+Subject: perf tools: Fix record failure when mixed with ARM SPE event
+
+From: Wei Li <liwei391@huawei.com>
+
+[ Upstream commit bd3c628f8fafa6cbd6a1ca440034b841f0080160 ]
+
+When recording with cache-misses and arm_spe_x event, I found that it
+will just fail without showing any error info if i put cache-misses
+after 'arm_spe_x' event.
+
+ [root@localhost 0620]# perf record -e cache-misses \
+ -e arm_spe_0/ts_enable=1,pct_enable=1,pa_enable=1,load_filter=1,jitter=1,store_filter=1,min_latency=0/ sleep 1
+ [ perf record: Woken up 1 times to write data ]
+ [ perf record: Captured and wrote 0.067 MB perf.data ]
+ [root@localhost 0620]#
+ [root@localhost 0620]# perf record -e arm_spe_0/ts_enable=1,pct_enable=1,pa_enable=1,load_filter=1,jitter=1,store_filter=1,min_latency=0/ \
+ -e cache-misses sleep 1
+ [root@localhost 0620]#
+
+The current code can only work if the only event to be traced is an
+'arm_spe_x', or if it is the last event to be specified. Otherwise the
+last event type will be checked against all the arm_spe_pmus[i]->types,
+none will match and an out of bound 'i' index will be used in
+arm_spe_recording_init().
+
+We don't support concurrent multiple arm_spe_x events currently, that
+is checked in arm_spe_recording_options(), and it will show the relevant
+info. So add the check and record of the first found 'arm_spe_pmu' to
+fix this issue here.
+
+Fixes: ffd3d18c20b8 ("perf tools: Add ARM Statistical Profiling Extensions (SPE) support")
+Signed-off-by: Wei Li <liwei391@huawei.com>
+Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Tested-by-by: Leo Yan <leo.yan@linaro.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Hanjun Guo <guohanjun@huawei.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Kim Phillips <kim.phillips@arm.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Mike Leach <mike.leach@linaro.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Suzuki Poulouse <suzuki.poulose@arm.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Link: http://lore.kernel.org/lkml/20200724071111.35593-2-liwei391@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/arch/arm/util/auxtrace.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/tools/perf/arch/arm/util/auxtrace.c b/tools/perf/arch/arm/util/auxtrace.c
+index 0a6e75b8777a6..28a5d0c18b1d2 100644
+--- a/tools/perf/arch/arm/util/auxtrace.c
++++ b/tools/perf/arch/arm/util/auxtrace.c
+@@ -56,7 +56,7 @@ struct auxtrace_record
+ struct perf_pmu *cs_etm_pmu;
+ struct evsel *evsel;
+ bool found_etm = false;
+- bool found_spe = false;
++ struct perf_pmu *found_spe = NULL;
+ static struct perf_pmu **arm_spe_pmus = NULL;
+ static int nr_spes = 0;
+ int i = 0;
+@@ -74,12 +74,12 @@ struct auxtrace_record
+ evsel->core.attr.type == cs_etm_pmu->type)
+ found_etm = true;
+
+- if (!nr_spes)
++ if (!nr_spes || found_spe)
+ continue;
+
+ for (i = 0; i < nr_spes; i++) {
+ if (evsel->core.attr.type == arm_spe_pmus[i]->type) {
+- found_spe = true;
++ found_spe = arm_spe_pmus[i];
+ break;
+ }
+ }
+@@ -96,7 +96,7 @@ struct auxtrace_record
+
+ #if defined(__aarch64__)
+ if (found_spe)
+- return arm_spe_recording_init(err, arm_spe_pmus[i]);
++ return arm_spe_recording_init(err, found_spe);
+ #endif
+
+ /*
+--
+2.25.1
+
--- /dev/null
+From e3d7d5f63faba5010f50a1d286fab7a487eccc5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jul 2020 18:08:05 -0400
+Subject: qed: Disable "MFW indication via attention" SPAM every 5 minutes
+
+From: Laurence Oberman <loberman@redhat.com>
+
+[ Upstream commit 1d61e21852d3161f234b9656797669fe185c251b ]
+
+This is likely firmware causing this but its starting to annoy customers.
+Change the message level to verbose to prevent the spam.
+Note that this seems to only show up with ISCSI enabled on the HBA via the
+qedi driver.
+
+Signed-off-by: Laurence Oberman <loberman@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_int.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.c b/drivers/net/ethernet/qlogic/qed/qed_int.c
+index 8d106063e9275..666e43748a5f4 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_int.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_int.c
+@@ -1180,7 +1180,8 @@ static int qed_int_attentions(struct qed_hwfn *p_hwfn)
+ index, attn_bits, attn_acks, asserted_bits,
+ deasserted_bits, p_sb_attn_sw->known_attn);
+ } else if (asserted_bits == 0x100) {
+- DP_INFO(p_hwfn, "MFW indication via attention\n");
++ DP_VERBOSE(p_hwfn, NETIF_MSG_INTR,
++ "MFW indication via attention\n");
+ } else {
+ DP_VERBOSE(p_hwfn, NETIF_MSG_INTR,
+ "MFW indication [deassertion]\n");
+--
+2.25.1
+
--- /dev/null
+From 47910e85cec749d3566b8b204ba97644eb8aa2ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jul 2020 19:25:49 +0530
+Subject: Revert "i2c: cadence: Fix the hold bit setting"
+
+From: Raviteja Narayanam <raviteja.narayanam@xilinx.com>
+
+[ Upstream commit 0db9254d6b896b587759e2c844c277fb1a6da5b9 ]
+
+This reverts commit d358def706880defa4c9e87381c5bf086a97d5f9.
+
+There are two issues with "i2c: cadence: Fix the hold bit setting" commit.
+
+1. In case of combined message request from user space, when the HOLD
+bit is cleared in cdns_i2c_mrecv function, a STOP condition is sent
+on the bus even before the last message is started. This is because when
+the HOLD bit is cleared, the FIFOS are empty and there is no pending
+transfer. The STOP condition should occur only after the last message
+is completed.
+
+2. The code added by the commit is redundant. Driver is handling the
+setting/clearing of HOLD bit in right way before the commit.
+
+The setting of HOLD bit based on 'bus_hold_flag' is taken care in
+cdns_i2c_master_xfer function even before cdns_i2c_msend/cdns_i2c_recv
+functions.
+
+The clearing of HOLD bit is taken care at the end of cdns_i2c_msend and
+cdns_i2c_recv functions based on bus_hold_flag and byte count.
+Since clearing of HOLD bit is done after the slave address is written to
+the register (writing to address register triggers the message transfer),
+it is ensured that STOP condition occurs at the right time after
+completion of the pending transfer (last message).
+
+Signed-off-by: Raviteja Narayanam <raviteja.narayanam@xilinx.com>
+Acked-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-cadence.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
+index 9d71ce15db050..a51d3b7957701 100644
+--- a/drivers/i2c/busses/i2c-cadence.c
++++ b/drivers/i2c/busses/i2c-cadence.c
+@@ -377,10 +377,8 @@ static void cdns_i2c_mrecv(struct cdns_i2c *id)
+ * Check for the message size against FIFO depth and set the
+ * 'hold bus' bit if it is greater than FIFO depth.
+ */
+- if ((id->recv_count > CDNS_I2C_FIFO_DEPTH) || id->bus_hold_flag)
++ if (id->recv_count > CDNS_I2C_FIFO_DEPTH)
+ ctrl_reg |= CDNS_I2C_CR_HOLD;
+- else
+- ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD;
+
+ cdns_i2c_writereg(ctrl_reg, CDNS_I2C_CR_OFFSET);
+
+@@ -437,11 +435,8 @@ static void cdns_i2c_msend(struct cdns_i2c *id)
+ * Check for the message size against FIFO depth and set the
+ * 'hold bus' bit if it is greater than FIFO depth.
+ */
+- if ((id->send_count > CDNS_I2C_FIFO_DEPTH) || id->bus_hold_flag)
++ if (id->send_count > CDNS_I2C_FIFO_DEPTH)
+ ctrl_reg |= CDNS_I2C_CR_HOLD;
+- else
+- ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD;
+-
+ cdns_i2c_writereg(ctrl_reg, CDNS_I2C_CR_OFFSET);
+
+ /* Clear the interrupts in interrupt status register. */
+--
+2.25.1
+
--- /dev/null
+From 733ad5413b552fd1e069dcc9b9b33d60df39298d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jul 2020 20:12:53 +1000
+Subject: rhashtable: Fix unprotected RCU dereference in __rht_ptr
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 1748f6a2cbc4694523f16da1c892b59861045b9d ]
+
+The rcu_dereference call in rht_ptr_rcu is completely bogus because
+we've already dereferenced the value in __rht_ptr and operated on it.
+This causes potential double readings which could be fatal. The RCU
+dereference must occur prior to the comparison in __rht_ptr.
+
+This patch changes the order of RCU dereference so that it is done
+first and the result is then fed to __rht_ptr. The RCU marking
+changes have been minimised using casts which will be removed in
+a follow-up patch.
+
+Fixes: ba6306e3f648 ("rhashtable: Remove RCU marking from...")
+Reported-by: "Gong, Sishuai" <sishuai@purdue.edu>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/rhashtable.h | 25 +++++++++++++------------
+ 1 file changed, 13 insertions(+), 12 deletions(-)
+
+diff --git a/include/linux/rhashtable.h b/include/linux/rhashtable.h
+index beb9a9da16994..c5bf21261bb19 100644
+--- a/include/linux/rhashtable.h
++++ b/include/linux/rhashtable.h
+@@ -349,11 +349,11 @@ static inline void rht_unlock(struct bucket_table *tbl,
+ local_bh_enable();
+ }
+
+-static inline struct rhash_head __rcu *__rht_ptr(
+- struct rhash_lock_head *const *bkt)
++static inline struct rhash_head *__rht_ptr(
++ struct rhash_lock_head *p, struct rhash_lock_head __rcu *const *bkt)
+ {
+- return (struct rhash_head __rcu *)
+- ((unsigned long)*bkt & ~BIT(0) ?:
++ return (struct rhash_head *)
++ ((unsigned long)p & ~BIT(0) ?:
+ (unsigned long)RHT_NULLS_MARKER(bkt));
+ }
+
+@@ -365,25 +365,26 @@ static inline struct rhash_head __rcu *__rht_ptr(
+ * access is guaranteed, such as when destroying the table.
+ */
+ static inline struct rhash_head *rht_ptr_rcu(
+- struct rhash_lock_head *const *bkt)
++ struct rhash_lock_head *const *p)
+ {
+- struct rhash_head __rcu *p = __rht_ptr(bkt);
+-
+- return rcu_dereference(p);
++ struct rhash_lock_head __rcu *const *bkt = (void *)p;
++ return __rht_ptr(rcu_dereference(*bkt), bkt);
+ }
+
+ static inline struct rhash_head *rht_ptr(
+- struct rhash_lock_head *const *bkt,
++ struct rhash_lock_head *const *p,
+ struct bucket_table *tbl,
+ unsigned int hash)
+ {
+- return rht_dereference_bucket(__rht_ptr(bkt), tbl, hash);
++ struct rhash_lock_head __rcu *const *bkt = (void *)p;
++ return __rht_ptr(rht_dereference_bucket(*bkt, tbl, hash), bkt);
+ }
+
+ static inline struct rhash_head *rht_ptr_exclusive(
+- struct rhash_lock_head *const *bkt)
++ struct rhash_lock_head *const *p)
+ {
+- return rcu_dereference_protected(__rht_ptr(bkt), 1);
++ struct rhash_lock_head __rcu *const *bkt = (void *)p;
++ return __rht_ptr(rcu_dereference_protected(*bkt, 1), bkt);
+ }
+
+ static inline void rht_assign_locked(struct rhash_lock_head **bkt,
+--
+2.25.1
+
--- /dev/null
+From a173036c159e2dac726287630aebe8fffda0b184 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jul 2020 16:30:07 -0700
+Subject: RISC-V: Set maximum number of mapped pages correctly
+
+From: Atish Patra <atish.patra@wdc.com>
+
+[ Upstream commit d0d8aae64566b753c4330fbd5944b88af035f299 ]
+
+Currently, maximum number of mapper pages are set to the pfn calculated
+from the memblock size of the memblock containing kernel. This will work
+until that memblock spans the entire memory. However, it will be set to
+a wrong value if there are multiple memblocks defined in kernel
+(e.g. with efi runtime services).
+
+Set the the maximum value to the pfn calculated from dram size.
+
+Signed-off-by: Atish Patra <atish.patra@wdc.com>
+Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/mm/init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
+index 3198129230126..b1eb6a0411183 100644
+--- a/arch/riscv/mm/init.c
++++ b/arch/riscv/mm/init.c
+@@ -115,9 +115,9 @@ void __init setup_bootmem(void)
+ /* Reserve from the start of the kernel to the end of the kernel */
+ memblock_reserve(vmlinux_start, vmlinux_end - vmlinux_start);
+
+- set_max_mapnr(PFN_DOWN(mem_size));
+ max_pfn = PFN_DOWN(memblock_end_of_DRAM());
+ max_low_pfn = max_pfn;
++ set_max_mapnr(max_low_pfn);
+
+ #ifdef CONFIG_BLK_DEV_INITRD
+ setup_initrd();
+--
+2.25.1
+
--- /dev/null
+From 3b2693ea191c943c5165b902b0ea37a0b2d09fb8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2020 10:54:35 +0800
+Subject: scsi: core: Run queue in case of I/O resource contention failure
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 3f0dcfbcd2e162fc0a11c1f59b7acd42ee45f126 ]
+
+I/O requests may be held in scheduler queue because of resource contention.
+The starvation scenario was handled properly in the regular completion
+path but we failed to account for it during I/O submission. This lead to
+the hang captured below. Make sure we run the queue when resource
+contention is encountered in the submission path.
+
+[ 39.054963] scsi 13:0:0:0: rejecting I/O to dead device
+[ 39.058700] scsi 13:0:0:0: rejecting I/O to dead device
+[ 39.087855] sd 13:0:0:1: [sdd] Synchronizing SCSI cache
+[ 39.088909] scsi 13:0:0:1: rejecting I/O to dead device
+[ 39.095351] scsi 13:0:0:1: rejecting I/O to dead device
+[ 39.096962] scsi 13:0:0:1: rejecting I/O to dead device
+[ 247.021859] INFO: task scsi-stress-rem:813 blocked for more than 122 seconds.
+[ 247.023258] Not tainted 5.8.0-rc2 #8
+[ 247.024069] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+[ 247.025331] scsi-stress-rem D 0 813 802 0x00004000
+[ 247.025334] Call Trace:
+[ 247.025354] __schedule+0x504/0x55f
+[ 247.027987] schedule+0x72/0xa8
+[ 247.027991] blk_mq_freeze_queue_wait+0x63/0x8c
+[ 247.027994] ? do_wait_intr_irq+0x7a/0x7a
+[ 247.027996] blk_cleanup_queue+0x4b/0xc9
+[ 247.028000] __scsi_remove_device+0xf6/0x14e
+[ 247.028002] scsi_remove_device+0x21/0x2b
+[ 247.029037] sdev_store_delete+0x58/0x7c
+[ 247.029041] kernfs_fop_write+0x10d/0x14f
+[ 247.031281] vfs_write+0xa2/0xdf
+[ 247.032670] ksys_write+0x6b/0xb3
+[ 247.032673] do_syscall_64+0x56/0x82
+[ 247.034053] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[ 247.034059] RIP: 0033:0x7f69f39e9008
+[ 247.036330] Code: Bad RIP value.
+[ 247.036331] RSP: 002b:00007ffdd8116498 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
+[ 247.037613] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f69f39e9008
+[ 247.039714] RDX: 0000000000000002 RSI: 000055cde92a0ab0 RDI: 0000000000000001
+[ 247.039715] RBP: 000055cde92a0ab0 R08: 000000000000000a R09: 00007f69f3a79e80
+[ 247.039716] R10: 000000000000000a R11: 0000000000000246 R12: 00007f69f3abb780
+[ 247.039717] R13: 0000000000000002 R14: 00007f69f3ab6740 R15: 0000000000000002
+
+Link: https://lore.kernel.org/r/20200720025435.812030-1-ming.lei@redhat.com
+Cc: linux-block@vger.kernel.org
+Cc: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_lib.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index 206c9f53e9e7a..e6944e1cba2ba 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -568,6 +568,15 @@ static void scsi_mq_uninit_cmd(struct scsi_cmnd *cmd)
+ scsi_del_cmd_from_list(cmd);
+ }
+
++static void scsi_run_queue_async(struct scsi_device *sdev)
++{
++ if (scsi_target(sdev)->single_lun ||
++ !list_empty(&sdev->host->starved_list))
++ kblockd_schedule_work(&sdev->requeue_work);
++ else
++ blk_mq_run_hw_queues(sdev->request_queue, true);
++}
++
+ /* Returns false when no more bytes to process, true if there are more */
+ static bool scsi_end_request(struct request *req, blk_status_t error,
+ unsigned int bytes)
+@@ -612,11 +621,7 @@ static bool scsi_end_request(struct request *req, blk_status_t error,
+
+ __blk_mq_end_request(req, error);
+
+- if (scsi_target(sdev)->single_lun ||
+- !list_empty(&sdev->host->starved_list))
+- kblockd_schedule_work(&sdev->requeue_work);
+- else
+- blk_mq_run_hw_queues(q, true);
++ scsi_run_queue_async(sdev);
+
+ percpu_ref_put(&q->q_usage_counter);
+ return false;
+@@ -1729,6 +1734,7 @@ out_put_budget:
+ */
+ if (req->rq_flags & RQF_DONTPREP)
+ scsi_mq_uninit_cmd(cmd);
++ scsi_run_queue_async(sdev);
+ break;
+ }
+ return ret;
+--
+2.25.1
+
--- /dev/null
+From a666128a69823f1f6742ab8cbf96da534f590533 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jul 2020 17:40:55 +0200
+Subject: selftests: fib_nexthop_multiprefix: fix cleanup() netns deletion
+
+From: Paolo Pisati <paolo.pisati@canonical.com>
+
+[ Upstream commit 651149f60376758a4759f761767965040f9e4464 ]
+
+During setup():
+...
+ for ns in h0 r1 h1 h2 h3
+ do
+ create_ns ${ns}
+ done
+...
+
+while in cleanup():
+...
+ for n in h1 r1 h2 h3 h4
+ do
+ ip netns del ${n} 2>/dev/null
+ done
+...
+
+and after removing the stderr redirection in cleanup():
+
+$ sudo ./fib_nexthop_multiprefix.sh
+...
+TEST: IPv4: host 0 to host 3, mtu 1400 [ OK ]
+TEST: IPv6: host 0 to host 3, mtu 1400 [ OK ]
+Cannot remove namespace file "/run/netns/h4": No such file or directory
+$ echo $?
+1
+
+and a non-zero return code, make kselftests fail (even if the test
+itself is fine):
+
+...
+not ok 34 selftests: net: fib_nexthop_multiprefix.sh # exit=1
+...
+
+Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>
+Reviewed-by: David Ahern <dsahern@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/fib_nexthop_multiprefix.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/fib_nexthop_multiprefix.sh b/tools/testing/selftests/net/fib_nexthop_multiprefix.sh
+index 9dc35a16e4159..51df5e305855a 100755
+--- a/tools/testing/selftests/net/fib_nexthop_multiprefix.sh
++++ b/tools/testing/selftests/net/fib_nexthop_multiprefix.sh
+@@ -144,7 +144,7 @@ setup()
+
+ cleanup()
+ {
+- for n in h1 r1 h2 h3 h4
++ for n in h0 r1 h1 h2 h3
+ do
+ ip netns del ${n} 2>/dev/null
+ done
+--
+2.25.1
+
--- /dev/null
+From 37abb8aa76457231b6692fe5cc5d359e7f24a9c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jul 2020 17:51:14 +0200
+Subject: selftests: net: ip_defrag: modprobe missing nf_defrag_ipv6 support
+
+From: Paolo Pisati <paolo.pisati@canonical.com>
+
+[ Upstream commit aba69d49fb49c9166596dd78926514173b7f9ab5 ]
+
+Fix ip_defrag.sh when CONFIG_NF_DEFRAG_IPV6=m:
+
+$ sudo ./ip_defrag.sh
++ set -e
++ mktemp -u XXXXXX
++ readonly NETNS=ns-rGlXcw
++ trap cleanup EXIT
++ setup
++ ip netns add ns-rGlXcw
++ ip -netns ns-rGlXcw link set lo up
++ ip netns exec ns-rGlXcw sysctl -w net.ipv4.ipfrag_high_thresh=9000000
++ ip netns exec ns-rGlXcw sysctl -w net.ipv4.ipfrag_low_thresh=7000000
++ ip netns exec ns-rGlXcw sysctl -w net.ipv4.ipfrag_time=1
++ ip netns exec ns-rGlXcw sysctl -w net.ipv6.ip6frag_high_thresh=9000000
++ ip netns exec ns-rGlXcw sysctl -w net.ipv6.ip6frag_low_thresh=7000000
++ ip netns exec ns-rGlXcw sysctl -w net.ipv6.ip6frag_time=1
++ ip netns exec ns-rGlXcw sysctl -w net.netfilter.nf_conntrack_frag6_high_thresh=9000000
++ cleanup
++ ip netns del ns-rGlXcw
+
+$ ls -la /proc/sys/net/netfilter/nf_conntrack_frag6_high_thresh
+ls: cannot access '/proc/sys/net/netfilter/nf_conntrack_frag6_high_thresh': No such file or directory
+
+$ sudo modprobe nf_defrag_ipv6
+$ ls -la /proc/sys/net/netfilter/nf_conntrack_frag6_high_thresh
+-rw-r--r-- 1 root root 0 Jul 14 12:34 /proc/sys/net/netfilter/nf_conntrack_frag6_high_thresh
+
+Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>
+Reviewed-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/ip_defrag.sh | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/net/ip_defrag.sh b/tools/testing/selftests/net/ip_defrag.sh
+index 15d3489ecd9ce..ceb7ad4dbd945 100755
+--- a/tools/testing/selftests/net/ip_defrag.sh
++++ b/tools/testing/selftests/net/ip_defrag.sh
+@@ -6,6 +6,8 @@
+ set +x
+ set -e
+
++modprobe -q nf_defrag_ipv6
++
+ readonly NETNS="ns-$(mktemp -u XXXXXX)"
+
+ setup() {
+--
+2.25.1
+
--- /dev/null
+From 6b96f1f9edacbfd45ddb41f43ef51a192bda8ab6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Jul 2020 12:25:29 -0400
+Subject: selftests/net: psock_fanout: fix clang issues for target arch PowerPC
+
+From: Tanner Love <tannerlove@google.com>
+
+[ Upstream commit 64f9ede2274980076423583683d44480909b7a40 ]
+
+Clang 9 threw:
+warning: format specifies type 'unsigned short' but the argument has \
+type 'int' [-Wformat]
+ typeflags, PORT_BASE, PORT_BASE + port_off);
+
+Tested: make -C tools/testing/selftests TARGETS="net" run_tests
+
+Fixes: 77f65ebdca50 ("packet: packet fanout rollover during socket overload")
+Signed-off-by: Tanner Love <tannerlove@google.com>
+Acked-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/psock_fanout.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/psock_fanout.c b/tools/testing/selftests/net/psock_fanout.c
+index 8c8c7d79c38d9..2c522f7a0aeca 100644
+--- a/tools/testing/selftests/net/psock_fanout.c
++++ b/tools/testing/selftests/net/psock_fanout.c
+@@ -350,7 +350,8 @@ static int test_datapath(uint16_t typeflags, int port_off,
+ int fds[2], fds_udp[2][2], ret;
+
+ fprintf(stderr, "\ntest: datapath 0x%hx ports %hu,%hu\n",
+- typeflags, PORT_BASE, PORT_BASE + port_off);
++ typeflags, (uint16_t)PORT_BASE,
++ (uint16_t)(PORT_BASE + port_off));
+
+ fds[0] = sock_fanout_open(typeflags, 0);
+ fds[1] = sock_fanout_open(typeflags, 0);
+--
+2.25.1
+
--- /dev/null
+From 21988af5cb38e18a81cf9d4cfe4cdd0cba92db9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Jul 2020 12:25:28 -0400
+Subject: selftests/net: rxtimestamp: fix clang issues for target arch PowerPC
+
+From: Tanner Love <tannerlove@google.com>
+
+[ Upstream commit 955cbe91bcf782c09afe369c95a20f0a4b6dcc3c ]
+
+The signedness of char is implementation-dependent. Some systems
+(including PowerPC and ARM) use unsigned char. Clang 9 threw:
+warning: result of comparison of constant -1 with expression of type \
+'char' is always true [-Wtautological-constant-out-of-range-compare]
+ &arg_index)) != -1) {
+
+Tested: make -C tools/testing/selftests TARGETS="net" run_tests
+
+Fixes: 16e781224198 ("selftests/net: Add a test to validate behavior of rx timestamps")
+Signed-off-by: Tanner Love <tannerlove@google.com>
+Acked-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/networking/timestamping/rxtimestamp.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/networking/timestamping/rxtimestamp.c b/tools/testing/selftests/networking/timestamping/rxtimestamp.c
+index 422e7761254de..bcb79ba1f2143 100644
+--- a/tools/testing/selftests/networking/timestamping/rxtimestamp.c
++++ b/tools/testing/selftests/networking/timestamping/rxtimestamp.c
+@@ -329,8 +329,7 @@ int main(int argc, char **argv)
+ bool all_tests = true;
+ int arg_index = 0;
+ int failures = 0;
+- int s, t;
+- char opt;
++ int s, t, opt;
+
+ while ((opt = getopt_long(argc, argv, "", long_options,
+ &arg_index)) != -1) {
+--
+2.25.1
+
--- /dev/null
+From 1248e7de33b1b7618b0fd8f73ba115d90e846ce9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Jul 2020 12:25:30 -0400
+Subject: selftests/net: so_txtime: fix clang issues for target arch PowerPC
+
+From: Tanner Love <tannerlove@google.com>
+
+[ Upstream commit b4da96ffd30bd4a305045ba5c9b0de5d4aa20dc7 ]
+
+On powerpcle, int64_t maps to long long. Clang 9 threw:
+warning: absolute value function 'labs' given an argument of type \
+'long long' but has parameter of type 'long' which may cause \
+truncation of value [-Wabsolute-value]
+ if (labs(tstop - texpect) > cfg_variance_us)
+
+Tested: make -C tools/testing/selftests TARGETS="net" run_tests
+
+Fixes: af5136f95045 ("selftests/net: SO_TXTIME with ETF and FQ")
+Signed-off-by: Tanner Love <tannerlove@google.com>
+Acked-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/so_txtime.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/so_txtime.c b/tools/testing/selftests/net/so_txtime.c
+index ceaad78e96674..3155fbbf644b0 100644
+--- a/tools/testing/selftests/net/so_txtime.c
++++ b/tools/testing/selftests/net/so_txtime.c
+@@ -121,7 +121,7 @@ static bool do_recv_one(int fdr, struct timed_send *ts)
+ if (rbuf[0] != ts->data)
+ error(1, 0, "payload mismatch. expected %c", ts->data);
+
+- if (labs(tstop - texpect) > cfg_variance_us)
++ if (llabs(tstop - texpect) > cfg_variance_us)
+ error(1, 0, "exceeds variance (%d us)", cfg_variance_us);
+
+ return false;
+--
+2.25.1
+
random32-remove-net_rand_state-from-the-latent-entropy-gcc-plugin.patch
rds-prevent-kernel-infoleak-in-rds_notify_queue_get.patch
libtraceevent-fix-build-with-binutils-2.35.patch
+xfrm-policy-match-with-both-mark-and-mask-on-user-in.patch
+arm-dts-sunxi-relax-a-bit-the-cma-pool-allocation-ra.patch
+xfrm-fix-crash-when-the-hold-queue-is-used.patch
+arm-dts-armada-38x-fix-neta-lockup-when-repeatedly-s.patch
+nvme-tcp-fix-possible-hang-waiting-for-icresp-respon.patch
+selftests-net-rxtimestamp-fix-clang-issues-for-targe.patch
+selftests-net-psock_fanout-fix-clang-issues-for-targ.patch
+selftests-net-so_txtime-fix-clang-issues-for-target-.patch
+sh-tlb-fix-pgtable_levels-2.patch
+sh-fix-validation-of-system-call-number.patch
+net-hns3-fix-a-tx-timeout-issue.patch
+net-hns3-fix-arfs-fd-rules-leftover-after-add-a-user.patch
+net-mlx5-e-switch-destroy-tsar-when-fail-to-enable-t.patch
+net-mlx5e-fix-error-path-of-device-attach.patch
+net-mlx5-verify-hardware-supports-requested-ptp-func.patch
+net-mlx5e-modify-uplink-state-on-interface-up-down.patch
+net-mlx5e-fix-kernel-crash-when-setting-vf-vlanid-on.patch
+net-lan78xx-add-missing-endpoint-sanity-check.patch
+net-lan78xx-fix-transfer-buffer-memory-leak.patch
+rhashtable-fix-unprotected-rcu-dereference-in-__rht_.patch
+mlx4-disable-device-on-shutdown.patch
+mlxsw-core-increase-scope-of-rcu-read-side-critical-.patch
+mlxsw-core-free-emad-transactions-using-kfree_rcu.patch
+ibmvnic-fix-irq-mapping-disposal-in-error-path.patch
+bpf-fix-map-leak-in-hash_of_maps-map.patch
+mac80211-mesh-free-ie-data-when-leaving-mesh.patch
+mac80211-mesh-free-pending-skb-when-destroying-a-mpa.patch
+arm64-alternatives-move-length-validation-inside-the.patch
+arm64-csum-fix-handling-of-bad-packets.patch
+bluetooth-fix-kernel-oops-in-store_pending_adv_repor.patch
+net-nixge-fix-potential-memory-leak-in-nixge_probe.patch
+net-gemini-fix-missing-clk_disable_unprepare-in-erro.patch
+net-mlx5e-fix-bpf_prog-reference-count-leaks-in-mlx5.patch
+perf-tools-fix-record-failure-when-mixed-with-arm-sp.patch
+vxlan-fix-memleak-of-fdb.patch
+usb-hso-fix-debug-compile-warning-on-sparc32.patch
+selftests-fib_nexthop_multiprefix-fix-cleanup-netns-.patch
+qed-disable-mfw-indication-via-attention-spam-every-.patch
+selftests-net-ip_defrag-modprobe-missing-nf_defrag_i.patch
+nfc-s3fwrn5-add-missing-release-on-skb-in-s3fwrn5_re.patch
+scsi-core-run-queue-in-case-of-i-o-resource-contenti.patch
+parisc-add-support-for-cmpxchg-on-u8-pointers.patch
+net-ethernet-ravb-exit-if-re-initialization-fails-in.patch
+revert-i2c-cadence-fix-the-hold-bit-setting.patch
+x86-unwind-orc-fix-orc-for-newly-forked-tasks.patch
+x86-stacktrace-fix-reliable-check-for-empty-user-tas.patch
+cxgb4-add-missing-release-on-skb-in-uld_send.patch
+xen-netfront-fix-potential-deadlock-in-xennet_remove.patch
+risc-v-set-maximum-number-of-mapped-pages-correctly.patch
+drivers-net-wan-lapb-corrected-the-usage-of-skb_cow.patch
--- /dev/null
+From cfd8f617d5bb1a3c8660805a507bab74bfc6e5ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jul 2020 01:13:19 +0200
+Subject: sh: Fix validation of system call number
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 04a8a3d0a73f51c7c2da84f494db7ec1df230e69 ]
+
+The slow path for traced system call entries accessed a wrong memory
+location to get the number of the maximum allowed system call number.
+Renumber the numbered "local" label for the correct location to avoid
+collisions with actual local labels.
+
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Fixes: f3a8308864f920d2 ("sh: Add a few missing irqflags tracing markers.")
+Signed-off-by: Rich Felker <dalias@libc.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sh/kernel/entry-common.S | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/sh/kernel/entry-common.S b/arch/sh/kernel/entry-common.S
+index d31f66e82ce51..4a8ec9e40cc2a 100644
+--- a/arch/sh/kernel/entry-common.S
++++ b/arch/sh/kernel/entry-common.S
+@@ -199,7 +199,7 @@ syscall_trace_entry:
+ mov.l @(OFF_R7,r15), r7 ! arg3
+ mov.l @(OFF_R3,r15), r3 ! syscall_nr
+ !
+- mov.l 2f, r10 ! Number of syscalls
++ mov.l 6f, r10 ! Number of syscalls
+ cmp/hs r10, r3
+ bf syscall_call
+ mov #-ENOSYS, r0
+@@ -353,7 +353,7 @@ ENTRY(system_call)
+ tst r9, r8
+ bf syscall_trace_entry
+ !
+- mov.l 2f, r8 ! Number of syscalls
++ mov.l 6f, r8 ! Number of syscalls
+ cmp/hs r8, r3
+ bt syscall_badsys
+ !
+@@ -392,7 +392,7 @@ syscall_exit:
+ #if !defined(CONFIG_CPU_SH2)
+ 1: .long TRA
+ #endif
+-2: .long NR_syscalls
++6: .long NR_syscalls
+ 3: .long sys_call_table
+ 7: .long do_syscall_trace_enter
+ 8: .long do_syscall_trace_leave
+--
+2.25.1
+
--- /dev/null
+From 403d0cb72e5d2f0f1bb465ee80c6c3ecbf90da5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 13:10:07 +0200
+Subject: sh/tlb: Fix PGTABLE_LEVELS > 2
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit c7bcbc8ab9cb20536b8f50c62a48cebda965fdba ]
+
+Geert reported that his SH7722-based Migo-R board failed to boot after
+commit:
+
+ c5b27a889da9 ("sh/tlb: Convert SH to generic mmu_gather")
+
+That commit fell victim to copying the wrong pattern --
+__pmd_free_tlb() used to be implemented with pmd_free().
+
+Fixes: c5b27a889da9 ("sh/tlb: Convert SH to generic mmu_gather")
+Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Rich Felker <dalias@libc.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sh/include/asm/pgalloc.h | 10 +---------
+ 1 file changed, 1 insertion(+), 9 deletions(-)
+
+diff --git a/arch/sh/include/asm/pgalloc.h b/arch/sh/include/asm/pgalloc.h
+index 22d968bfe9bb6..d770da3f8b6fb 100644
+--- a/arch/sh/include/asm/pgalloc.h
++++ b/arch/sh/include/asm/pgalloc.h
+@@ -12,6 +12,7 @@ extern void pgd_free(struct mm_struct *mm, pgd_t *pgd);
+ extern void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd);
+ extern pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address);
+ extern void pmd_free(struct mm_struct *mm, pmd_t *pmd);
++#define __pmd_free_tlb(tlb, pmdp, addr) pmd_free((tlb)->mm, (pmdp))
+ #endif
+
+ static inline void pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmd,
+@@ -33,13 +34,4 @@ do { \
+ tlb_remove_page((tlb), (pte)); \
+ } while (0)
+
+-#if CONFIG_PGTABLE_LEVELS > 2
+-#define __pmd_free_tlb(tlb, pmdp, addr) \
+-do { \
+- struct page *page = virt_to_page(pmdp); \
+- pgtable_pmd_page_dtor(page); \
+- tlb_remove_page((tlb), page); \
+-} while (0);
+-#endif
+-
+ #endif /* __ASM_SH_PGALLOC_H */
+--
+2.25.1
+
--- /dev/null
+From dd8640de908410afbaaad43350b051d9d9e97a98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jul 2020 13:05:13 +0200
+Subject: usb: hso: Fix debug compile warning on sparc32
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+[ Upstream commit e0484010ec05191a8edf980413fc92f28050c1cc ]
+
+On sparc32, tcflag_t is "unsigned long", unlike on all other
+architectures, where it is "unsigned int":
+
+ drivers/net/usb/hso.c: In function ‘hso_serial_set_termios’:
+ include/linux/kern_levels.h:5:18: warning: format ‘%d’ expects argument of type ‘unsigned int’, but argument 4 has type ‘tcflag_t {aka long unsigned int}’ [-Wformat=]
+ drivers/net/usb/hso.c:1393:3: note: in expansion of macro ‘hso_dbg’
+ hso_dbg(0x16, "Termios called with: cflags new[%d] - old[%d]\n",
+ ^~~~~~~
+ include/linux/kern_levels.h:5:18: warning: format ‘%d’ expects argument of type ‘unsigned int’, but argument 5 has type ‘tcflag_t {aka long unsigned int}’ [-Wformat=]
+ drivers/net/usb/hso.c:1393:3: note: in expansion of macro ‘hso_dbg’
+ hso_dbg(0x16, "Termios called with: cflags new[%d] - old[%d]\n",
+ ^~~~~~~
+
+As "unsigned long" is 32-bit on sparc32, fix this by casting all tcflag_t
+parameters to "unsigned int".
+While at it, use "%u" to format unsigned numbers.
+
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/hso.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
+index 74849da031fab..66a8b835aa94c 100644
+--- a/drivers/net/usb/hso.c
++++ b/drivers/net/usb/hso.c
+@@ -1389,8 +1389,9 @@ static void hso_serial_set_termios(struct tty_struct *tty, struct ktermios *old)
+ unsigned long flags;
+
+ if (old)
+- hso_dbg(0x16, "Termios called with: cflags new[%d] - old[%d]\n",
+- tty->termios.c_cflag, old->c_cflag);
++ hso_dbg(0x16, "Termios called with: cflags new[%u] - old[%u]\n",
++ (unsigned int)tty->termios.c_cflag,
++ (unsigned int)old->c_cflag);
+
+ /* the actual setup */
+ spin_lock_irqsave(&serial->serial_lock, flags);
+--
+2.25.1
+
--- /dev/null
+From 72475b54af8b36255241f9331bd5b5d2d29d30a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Aug 2020 07:07:50 +0000
+Subject: vxlan: fix memleak of fdb
+
+From: Taehee Yoo <ap420073@gmail.com>
+
+[ Upstream commit fda2ec62cf1aa7cbee52289dc8059cd3662795da ]
+
+When vxlan interface is deleted, all fdbs are deleted by vxlan_flush().
+vxlan_flush() flushes fdbs but it doesn't delete fdb, which contains
+all-zeros-mac because it is deleted by vxlan_uninit().
+But vxlan_uninit() deletes only the fdb, which contains both all-zeros-mac
+and default vni.
+So, the fdb, which contains both all-zeros-mac and non-default vni
+will not be deleted.
+
+Test commands:
+ ip link add vxlan0 type vxlan dstport 4789 external
+ ip link set vxlan0 up
+ bridge fdb add to 00:00:00:00:00:00 dst 172.0.0.1 dev vxlan0 via lo \
+ src_vni 10000 self permanent
+ ip link del vxlan0
+
+kmemleak reports as follows:
+unreferenced object 0xffff9486b25ced88 (size 96):
+ comm "bridge", pid 2151, jiffies 4294701712 (age 35506.901s)
+ hex dump (first 32 bytes):
+ 02 00 00 00 ac 00 00 01 40 00 09 b1 86 94 ff ff ........@.......
+ 46 02 00 00 00 00 00 00 a7 03 00 00 12 b5 6a 6b F.............jk
+ backtrace:
+ [<00000000c10cf651>] vxlan_fdb_append.part.51+0x3c/0xf0 [vxlan]
+ [<000000006b31a8d9>] vxlan_fdb_create+0x184/0x1a0 [vxlan]
+ [<0000000049399045>] vxlan_fdb_update+0x12f/0x220 [vxlan]
+ [<0000000090b1ef00>] vxlan_fdb_add+0x12a/0x1b0 [vxlan]
+ [<0000000056633c2c>] rtnl_fdb_add+0x187/0x270
+ [<00000000dd5dfb6b>] rtnetlink_rcv_msg+0x264/0x490
+ [<00000000fc44dd54>] netlink_rcv_skb+0x4a/0x110
+ [<00000000dff433e7>] netlink_unicast+0x18e/0x250
+ [<00000000b87fb421>] netlink_sendmsg+0x2e9/0x400
+ [<000000002ed55153>] ____sys_sendmsg+0x237/0x260
+ [<00000000faa51c66>] ___sys_sendmsg+0x88/0xd0
+ [<000000006c3982f1>] __sys_sendmsg+0x4e/0x80
+ [<00000000a8f875d2>] do_syscall_64+0x56/0xe0
+ [<000000003610eefa>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+unreferenced object 0xffff9486b1c40080 (size 128):
+ comm "bridge", pid 2157, jiffies 4294701754 (age 35506.866s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 00 00 00 f8 dc 42 b2 86 94 ff ff ..........B.....
+ 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
+ backtrace:
+ [<00000000a2981b60>] vxlan_fdb_create+0x67/0x1a0 [vxlan]
+ [<0000000049399045>] vxlan_fdb_update+0x12f/0x220 [vxlan]
+ [<0000000090b1ef00>] vxlan_fdb_add+0x12a/0x1b0 [vxlan]
+ [<0000000056633c2c>] rtnl_fdb_add+0x187/0x270
+ [<00000000dd5dfb6b>] rtnetlink_rcv_msg+0x264/0x490
+ [<00000000fc44dd54>] netlink_rcv_skb+0x4a/0x110
+ [<00000000dff433e7>] netlink_unicast+0x18e/0x250
+ [<00000000b87fb421>] netlink_sendmsg+0x2e9/0x400
+ [<000000002ed55153>] ____sys_sendmsg+0x237/0x260
+ [<00000000faa51c66>] ___sys_sendmsg+0x88/0xd0
+ [<000000006c3982f1>] __sys_sendmsg+0x4e/0x80
+ [<00000000a8f875d2>] do_syscall_64+0x56/0xe0
+ [<000000003610eefa>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Fixes: 3ad7a4b141eb ("vxlan: support fdb and learning in COLLECT_METADATA mode")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Acked-by: Roopa Prabhu <roopa@cumulusnetworks.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/vxlan.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 03434db36b5c7..b49b6f0cee500 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -2863,8 +2863,10 @@ static void vxlan_flush(struct vxlan_dev *vxlan, bool do_all)
+ if (!do_all && (f->state & (NUD_PERMANENT | NUD_NOARP)))
+ continue;
+ /* the all_zeros_mac entry is deleted at vxlan_uninit */
+- if (!is_zero_ether_addr(f->eth_addr))
+- vxlan_fdb_destroy(vxlan, f, true, true);
++ if (is_zero_ether_addr(f->eth_addr) &&
++ f->vni == vxlan->cfg.vni)
++ continue;
++ vxlan_fdb_destroy(vxlan, f, true, true);
+ }
+ spin_unlock_bh(&vxlan->hash_lock[h]);
+ }
+--
+2.25.1
+
--- /dev/null
+From 611d6e89eef158cba6bf970d2a346ccdb4f6f135 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 09:04:26 -0500
+Subject: x86/stacktrace: Fix reliable check for empty user task stacks
+
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+
+[ Upstream commit 039a7a30ec102ec866d382a66f87f6f7654f8140 ]
+
+If a user task's stack is empty, or if it only has user regs, ORC
+reports it as a reliable empty stack. But arch_stack_walk_reliable()
+incorrectly treats it as unreliable.
+
+That happens because the only success path for user tasks is inside the
+loop, which only iterates on non-empty stacks. Generally, a user task
+must end in a user regs frame, but an empty stack is an exception to
+that rule.
+
+Thanks to commit 71c95825289f ("x86/unwind/orc: Fix error handling in
+__unwind_start()"), unwind_start() now sets state->error appropriately.
+So now for both ORC and FP unwinders, unwind_done() and !unwind_error()
+always means the end of the stack was successfully reached. So the
+success path for kthreads is no longer needed -- it can also be used for
+empty user tasks.
+
+Reported-by: Wang ShaoBo <bobo.shaobowang@huawei.com>
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Wang ShaoBo <bobo.shaobowang@huawei.com>
+Link: https://lkml.kernel.org/r/f136a4e5f019219cbc4f4da33b30c2f44fa65b84.1594994374.git.jpoimboe@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/stacktrace.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/arch/x86/kernel/stacktrace.c b/arch/x86/kernel/stacktrace.c
+index 2d6898c2cb647..6d83b4b857e6a 100644
+--- a/arch/x86/kernel/stacktrace.c
++++ b/arch/x86/kernel/stacktrace.c
+@@ -58,7 +58,6 @@ int arch_stack_walk_reliable(stack_trace_consume_fn consume_entry,
+ * or a page fault), which can make frame pointers
+ * unreliable.
+ */
+-
+ if (IS_ENABLED(CONFIG_FRAME_POINTER))
+ return -EINVAL;
+ }
+@@ -81,10 +80,6 @@ int arch_stack_walk_reliable(stack_trace_consume_fn consume_entry,
+ if (unwind_error(&state))
+ return -EINVAL;
+
+- /* Success path for non-user tasks, i.e. kthreads and idle tasks */
+- if (!(task->flags & (PF_KTHREAD | PF_IDLE)))
+- return -EINVAL;
+-
+ return 0;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 0b84cbd2399fbcc91166ab211b446e43e91343e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 09:04:25 -0500
+Subject: x86/unwind/orc: Fix ORC for newly forked tasks
+
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+
+[ Upstream commit 372a8eaa05998cd45b3417d0e0ffd3a70978211a ]
+
+The ORC unwinder fails to unwind newly forked tasks which haven't yet
+run on the CPU. It correctly reads the 'ret_from_fork' instruction
+pointer from the stack, but it incorrectly interprets that value as a
+call stack address rather than a "signal" one, so the address gets
+incorrectly decremented in the call to orc_find(), resulting in bad ORC
+data.
+
+Fix it by forcing 'ret_from_fork' frames to be signal frames.
+
+Reported-by: Wang ShaoBo <bobo.shaobowang@huawei.com>
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Wang ShaoBo <bobo.shaobowang@huawei.com>
+Link: https://lkml.kernel.org/r/f91a8778dde8aae7f71884b5df2b16d552040441.1594994374.git.jpoimboe@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/unwind_orc.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c
+index aa0f39dc81298..187a86e0e7531 100644
+--- a/arch/x86/kernel/unwind_orc.c
++++ b/arch/x86/kernel/unwind_orc.c
+@@ -431,8 +431,11 @@ bool unwind_next_frame(struct unwind_state *state)
+ /*
+ * Find the orc_entry associated with the text address.
+ *
+- * Decrement call return addresses by one so they work for sibling
+- * calls and calls to noreturn functions.
++ * For a call frame (as opposed to a signal frame), state->ip points to
++ * the instruction after the call. That instruction's stack layout
++ * could be different from the call instruction's layout, for example
++ * if the call was to a noreturn function. So get the ORC data for the
++ * call instruction itself.
+ */
+ orc = orc_find(state->signal ? state->ip : state->ip - 1);
+ if (!orc) {
+@@ -653,6 +656,7 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task,
+ state->sp = task->thread.sp;
+ state->bp = READ_ONCE_NOCHECK(frame->bp);
+ state->ip = READ_ONCE_NOCHECK(frame->ret_addr);
++ state->signal = (void *)state->ip == ret_from_fork;
+ }
+
+ if (get_stack_info((unsigned long *)state->sp, state->task,
+--
+2.25.1
+
--- /dev/null
+From 3c79f0fe9b9fb207d4a68d94a5ac9b3c5edf6d46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jul 2020 10:59:10 +0200
+Subject: xen-netfront: fix potential deadlock in xennet_remove()
+
+From: Andrea Righi <andrea.righi@canonical.com>
+
+[ Upstream commit c2c633106453611be07821f53dff9e93a9d1c3f0 ]
+
+There's a potential race in xennet_remove(); this is what the driver is
+doing upon unregistering a network device:
+
+ 1. state = read bus state
+ 2. if state is not "Closed":
+ 3. request to set state to "Closing"
+ 4. wait for state to be set to "Closing"
+ 5. request to set state to "Closed"
+ 6. wait for state to be set to "Closed"
+
+If the state changes to "Closed" immediately after step 1 we are stuck
+forever in step 4, because the state will never go back from "Closed" to
+"Closing".
+
+Make sure to check also for state == "Closed" in step 4 to prevent the
+deadlock.
+
+Also add a 5 sec timeout any time we wait for the bus state to change,
+to avoid getting stuck forever in wait_event().
+
+Signed-off-by: Andrea Righi <andrea.righi@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/xen-netfront.c | 64 +++++++++++++++++++++++++-------------
+ 1 file changed, 42 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index 482c6c8b0fb7e..88280057e0321 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -63,6 +63,8 @@ module_param_named(max_queues, xennet_max_queues, uint, 0644);
+ MODULE_PARM_DESC(max_queues,
+ "Maximum number of queues per virtual interface");
+
++#define XENNET_TIMEOUT (5 * HZ)
++
+ static const struct ethtool_ops xennet_ethtool_ops;
+
+ struct netfront_cb {
+@@ -1334,12 +1336,15 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev)
+
+ netif_carrier_off(netdev);
+
+- xenbus_switch_state(dev, XenbusStateInitialising);
+- wait_event(module_wq,
+- xenbus_read_driver_state(dev->otherend) !=
+- XenbusStateClosed &&
+- xenbus_read_driver_state(dev->otherend) !=
+- XenbusStateUnknown);
++ do {
++ xenbus_switch_state(dev, XenbusStateInitialising);
++ err = wait_event_timeout(module_wq,
++ xenbus_read_driver_state(dev->otherend) !=
++ XenbusStateClosed &&
++ xenbus_read_driver_state(dev->otherend) !=
++ XenbusStateUnknown, XENNET_TIMEOUT);
++ } while (!err);
++
+ return netdev;
+
+ exit:
+@@ -2139,28 +2144,43 @@ static const struct attribute_group xennet_dev_group = {
+ };
+ #endif /* CONFIG_SYSFS */
+
+-static int xennet_remove(struct xenbus_device *dev)
++static void xennet_bus_close(struct xenbus_device *dev)
+ {
+- struct netfront_info *info = dev_get_drvdata(&dev->dev);
+-
+- dev_dbg(&dev->dev, "%s\n", dev->nodename);
++ int ret;
+
+- if (xenbus_read_driver_state(dev->otherend) != XenbusStateClosed) {
++ if (xenbus_read_driver_state(dev->otherend) == XenbusStateClosed)
++ return;
++ do {
+ xenbus_switch_state(dev, XenbusStateClosing);
+- wait_event(module_wq,
+- xenbus_read_driver_state(dev->otherend) ==
+- XenbusStateClosing ||
+- xenbus_read_driver_state(dev->otherend) ==
+- XenbusStateUnknown);
++ ret = wait_event_timeout(module_wq,
++ xenbus_read_driver_state(dev->otherend) ==
++ XenbusStateClosing ||
++ xenbus_read_driver_state(dev->otherend) ==
++ XenbusStateClosed ||
++ xenbus_read_driver_state(dev->otherend) ==
++ XenbusStateUnknown,
++ XENNET_TIMEOUT);
++ } while (!ret);
++
++ if (xenbus_read_driver_state(dev->otherend) == XenbusStateClosed)
++ return;
+
++ do {
+ xenbus_switch_state(dev, XenbusStateClosed);
+- wait_event(module_wq,
+- xenbus_read_driver_state(dev->otherend) ==
+- XenbusStateClosed ||
+- xenbus_read_driver_state(dev->otherend) ==
+- XenbusStateUnknown);
+- }
++ ret = wait_event_timeout(module_wq,
++ xenbus_read_driver_state(dev->otherend) ==
++ XenbusStateClosed ||
++ xenbus_read_driver_state(dev->otherend) ==
++ XenbusStateUnknown,
++ XENNET_TIMEOUT);
++ } while (!ret);
++}
++
++static int xennet_remove(struct xenbus_device *dev)
++{
++ struct netfront_info *info = dev_get_drvdata(&dev->dev);
+
++ xennet_bus_close(dev);
+ xennet_disconnect_backend(info);
+
+ if (info->netdev->reg_state == NETREG_REGISTERED)
+--
+2.25.1
+
--- /dev/null
+From ca62743fea37f7ee61fbb37abd725a90f07ab87f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 10:34:27 +0200
+Subject: xfrm: Fix crash when the hold queue is used.
+
+From: Steffen Klassert <steffen.klassert@secunet.com>
+
+[ Upstream commit 101dde4207f1daa1fda57d714814a03835dccc3f ]
+
+The commits "xfrm: Move dst->path into struct xfrm_dst"
+and "net: Create and use new helper xfrm_dst_child()."
+changed xfrm bundle handling under the assumption
+that xdst->path and dst->child are not a NULL pointer
+only if dst->xfrm is not a NULL pointer. That is true
+with one exception. If the xfrm hold queue is used
+to wait until a SA is installed by the key manager,
+we create a dummy bundle without a valid dst->xfrm
+pointer. The current xfrm bundle handling crashes
+in that case. Fix this by extending the NULL check
+of dst->xfrm with a test of the DST_XFRM_QUEUE flag.
+
+Fixes: 0f6c480f23f4 ("xfrm: Move dst->path into struct xfrm_dst")
+Fixes: b92cf4aab8e6 ("net: Create and use new helper xfrm_dst_child().")
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/xfrm.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/net/xfrm.h b/include/net/xfrm.h
+index e7a480a4ffb90..12aa6e15e43f6 100644
+--- a/include/net/xfrm.h
++++ b/include/net/xfrm.h
+@@ -945,7 +945,7 @@ struct xfrm_dst {
+ static inline struct dst_entry *xfrm_dst_path(const struct dst_entry *dst)
+ {
+ #ifdef CONFIG_XFRM
+- if (dst->xfrm) {
++ if (dst->xfrm || (dst->flags & DST_XFRM_QUEUE)) {
+ const struct xfrm_dst *xdst = (const struct xfrm_dst *) dst;
+
+ return xdst->path;
+@@ -957,7 +957,7 @@ static inline struct dst_entry *xfrm_dst_path(const struct dst_entry *dst)
+ static inline struct dst_entry *xfrm_dst_child(const struct dst_entry *dst)
+ {
+ #ifdef CONFIG_XFRM
+- if (dst->xfrm) {
++ if (dst->xfrm || (dst->flags & DST_XFRM_QUEUE)) {
+ struct xfrm_dst *xdst = (struct xfrm_dst *) dst;
+ return xdst->child;
+ }
+--
+2.25.1
+
--- /dev/null
+From 403b9c115dd4735538c9f34d1d5b465e5a2d756f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jun 2020 16:40:29 +0800
+Subject: xfrm: policy: match with both mark and mask on user interfaces
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit 4f47e8ab6ab796b5380f74866fa5287aca4dcc58 ]
+
+In commit ed17b8d377ea ("xfrm: fix a warning in xfrm_policy_insert_list"),
+it would take 'priority' to make a policy unique, and allow duplicated
+policies with different 'priority' to be added, which is not expected
+by userland, as Tobias reported in strongswan.
+
+To fix this duplicated policies issue, and also fix the issue in
+commit ed17b8d377ea ("xfrm: fix a warning in xfrm_policy_insert_list"),
+when doing add/del/get/update on user interfaces, this patch is to change
+to look up a policy with both mark and mask by doing:
+
+ mark.v == pol->mark.v && mark.m == pol->mark.m
+
+and leave the check:
+
+ (mark & pol->mark.m) == pol->mark.v
+
+for tx/rx path only.
+
+As the userland expects an exact mark and mask match to manage policies.
+
+v1->v2:
+ - make xfrm_policy_mark_match inline and fix the changelog as
+ Tobias suggested.
+
+Fixes: 295fae568885 ("xfrm: Allow user space manipulation of SPD mark")
+Fixes: ed17b8d377ea ("xfrm: fix a warning in xfrm_policy_insert_list")
+Reported-by: Tobias Brunner <tobias@strongswan.org>
+Tested-by: Tobias Brunner <tobias@strongswan.org>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/xfrm.h | 11 +++++++----
+ net/key/af_key.c | 4 ++--
+ net/xfrm/xfrm_policy.c | 39 ++++++++++++++++-----------------------
+ net/xfrm/xfrm_user.c | 18 +++++++++++-------
+ 4 files changed, 36 insertions(+), 36 deletions(-)
+
+diff --git a/include/net/xfrm.h b/include/net/xfrm.h
+index fb391c00c19ac..e7a480a4ffb90 100644
+--- a/include/net/xfrm.h
++++ b/include/net/xfrm.h
+@@ -1636,13 +1636,16 @@ int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
+ void *);
+ void xfrm_policy_walk_done(struct xfrm_policy_walk *walk, struct net *net);
+ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
+-struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u32 if_id,
+- u8 type, int dir,
++struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net,
++ const struct xfrm_mark *mark,
++ u32 if_id, u8 type, int dir,
+ struct xfrm_selector *sel,
+ struct xfrm_sec_ctx *ctx, int delete,
+ int *err);
+-struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u32 if_id, u8,
+- int dir, u32 id, int delete, int *err);
++struct xfrm_policy *xfrm_policy_byid(struct net *net,
++ const struct xfrm_mark *mark, u32 if_id,
++ u8 type, int dir, u32 id, int delete,
++ int *err);
+ int xfrm_policy_flush(struct net *net, u8 type, bool task_valid);
+ void xfrm_policy_hash_rebuild(struct net *net);
+ u32 xfrm_get_acqseq(void);
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index b67ed3a8486c2..979c579afc63b 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -2400,7 +2400,7 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, const struct sa
+ return err;
+ }
+
+- xp = xfrm_policy_bysel_ctx(net, DUMMY_MARK, 0, XFRM_POLICY_TYPE_MAIN,
++ xp = xfrm_policy_bysel_ctx(net, &dummy_mark, 0, XFRM_POLICY_TYPE_MAIN,
+ pol->sadb_x_policy_dir - 1, &sel, pol_ctx,
+ 1, &err);
+ security_xfrm_policy_free(pol_ctx);
+@@ -2651,7 +2651,7 @@ static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, const struct sadb_
+ return -EINVAL;
+
+ delete = (hdr->sadb_msg_type == SADB_X_SPDDELETE2);
+- xp = xfrm_policy_byid(net, DUMMY_MARK, 0, XFRM_POLICY_TYPE_MAIN,
++ xp = xfrm_policy_byid(net, &dummy_mark, 0, XFRM_POLICY_TYPE_MAIN,
+ dir, pol->sadb_x_policy_id, delete, &err);
+ if (xp == NULL)
+ return -ENOENT;
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index 6a1a21ae47bbd..2917711ff8ab6 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -1430,14 +1430,10 @@ static void xfrm_policy_requeue(struct xfrm_policy *old,
+ spin_unlock_bh(&pq->hold_queue.lock);
+ }
+
+-static bool xfrm_policy_mark_match(struct xfrm_policy *policy,
+- struct xfrm_policy *pol)
++static inline bool xfrm_policy_mark_match(const struct xfrm_mark *mark,
++ struct xfrm_policy *pol)
+ {
+- if (policy->mark.v == pol->mark.v &&
+- policy->priority == pol->priority)
+- return true;
+-
+- return false;
++ return mark->v == pol->mark.v && mark->m == pol->mark.m;
+ }
+
+ static u32 xfrm_pol_bin_key(const void *data, u32 len, u32 seed)
+@@ -1500,7 +1496,7 @@ static void xfrm_policy_insert_inexact_list(struct hlist_head *chain,
+ if (pol->type == policy->type &&
+ pol->if_id == policy->if_id &&
+ !selector_cmp(&pol->selector, &policy->selector) &&
+- xfrm_policy_mark_match(policy, pol) &&
++ xfrm_policy_mark_match(&policy->mark, pol) &&
+ xfrm_sec_ctx_match(pol->security, policy->security) &&
+ !WARN_ON(delpol)) {
+ delpol = pol;
+@@ -1535,7 +1531,7 @@ static struct xfrm_policy *xfrm_policy_insert_list(struct hlist_head *chain,
+ if (pol->type == policy->type &&
+ pol->if_id == policy->if_id &&
+ !selector_cmp(&pol->selector, &policy->selector) &&
+- xfrm_policy_mark_match(policy, pol) &&
++ xfrm_policy_mark_match(&policy->mark, pol) &&
+ xfrm_sec_ctx_match(pol->security, policy->security) &&
+ !WARN_ON(delpol)) {
+ if (excl)
+@@ -1607,9 +1603,8 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
+ EXPORT_SYMBOL(xfrm_policy_insert);
+
+ static struct xfrm_policy *
+-__xfrm_policy_bysel_ctx(struct hlist_head *chain, u32 mark, u32 if_id,
+- u8 type, int dir,
+- struct xfrm_selector *sel,
++__xfrm_policy_bysel_ctx(struct hlist_head *chain, const struct xfrm_mark *mark,
++ u32 if_id, u8 type, int dir, struct xfrm_selector *sel,
+ struct xfrm_sec_ctx *ctx)
+ {
+ struct xfrm_policy *pol;
+@@ -1620,7 +1615,7 @@ __xfrm_policy_bysel_ctx(struct hlist_head *chain, u32 mark, u32 if_id,
+ hlist_for_each_entry(pol, chain, bydst) {
+ if (pol->type == type &&
+ pol->if_id == if_id &&
+- (mark & pol->mark.m) == pol->mark.v &&
++ xfrm_policy_mark_match(mark, pol) &&
+ !selector_cmp(sel, &pol->selector) &&
+ xfrm_sec_ctx_match(ctx, pol->security))
+ return pol;
+@@ -1629,11 +1624,10 @@ __xfrm_policy_bysel_ctx(struct hlist_head *chain, u32 mark, u32 if_id,
+ return NULL;
+ }
+
+-struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u32 if_id,
+- u8 type, int dir,
+- struct xfrm_selector *sel,
+- struct xfrm_sec_ctx *ctx, int delete,
+- int *err)
++struct xfrm_policy *
++xfrm_policy_bysel_ctx(struct net *net, const struct xfrm_mark *mark, u32 if_id,
++ u8 type, int dir, struct xfrm_selector *sel,
++ struct xfrm_sec_ctx *ctx, int delete, int *err)
+ {
+ struct xfrm_pol_inexact_bin *bin = NULL;
+ struct xfrm_policy *pol, *ret = NULL;
+@@ -1700,9 +1694,9 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u32 if_id,
+ }
+ EXPORT_SYMBOL(xfrm_policy_bysel_ctx);
+
+-struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u32 if_id,
+- u8 type, int dir, u32 id, int delete,
+- int *err)
++struct xfrm_policy *
++xfrm_policy_byid(struct net *net, const struct xfrm_mark *mark, u32 if_id,
++ u8 type, int dir, u32 id, int delete, int *err)
+ {
+ struct xfrm_policy *pol, *ret;
+ struct hlist_head *chain;
+@@ -1717,8 +1711,7 @@ struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u32 if_id,
+ ret = NULL;
+ hlist_for_each_entry(pol, chain, byidx) {
+ if (pol->type == type && pol->index == id &&
+- pol->if_id == if_id &&
+- (mark & pol->mark.m) == pol->mark.v) {
++ pol->if_id == if_id && xfrm_policy_mark_match(mark, pol)) {
+ xfrm_pol_hold(pol);
+ if (delete) {
+ *err = security_xfrm_policy_delete(
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index e6cfaa680ef3d..fbb7d9d064787 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -1863,7 +1863,6 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
+ struct km_event c;
+ int delete;
+ struct xfrm_mark m;
+- u32 mark = xfrm_mark_get(attrs, &m);
+ u32 if_id = 0;
+
+ p = nlmsg_data(nlh);
+@@ -1880,8 +1879,11 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
+ if (attrs[XFRMA_IF_ID])
+ if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
+
++ xfrm_mark_get(attrs, &m);
++
+ if (p->index)
+- xp = xfrm_policy_byid(net, mark, if_id, type, p->dir, p->index, delete, &err);
++ xp = xfrm_policy_byid(net, &m, if_id, type, p->dir,
++ p->index, delete, &err);
+ else {
+ struct nlattr *rt = attrs[XFRMA_SEC_CTX];
+ struct xfrm_sec_ctx *ctx;
+@@ -1898,8 +1900,8 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
+ if (err)
+ return err;
+ }
+- xp = xfrm_policy_bysel_ctx(net, mark, if_id, type, p->dir, &p->sel,
+- ctx, delete, &err);
++ xp = xfrm_policy_bysel_ctx(net, &m, if_id, type, p->dir,
++ &p->sel, ctx, delete, &err);
+ security_xfrm_policy_free(ctx);
+ }
+ if (xp == NULL)
+@@ -2166,7 +2168,6 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
+ u8 type = XFRM_POLICY_TYPE_MAIN;
+ int err = -ENOENT;
+ struct xfrm_mark m;
+- u32 mark = xfrm_mark_get(attrs, &m);
+ u32 if_id = 0;
+
+ err = copy_from_user_policy_type(&type, attrs);
+@@ -2180,8 +2181,11 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
+ if (attrs[XFRMA_IF_ID])
+ if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
+
++ xfrm_mark_get(attrs, &m);
++
+ if (p->index)
+- xp = xfrm_policy_byid(net, mark, if_id, type, p->dir, p->index, 0, &err);
++ xp = xfrm_policy_byid(net, &m, if_id, type, p->dir, p->index,
++ 0, &err);
+ else {
+ struct nlattr *rt = attrs[XFRMA_SEC_CTX];
+ struct xfrm_sec_ctx *ctx;
+@@ -2198,7 +2202,7 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
+ if (err)
+ return err;
+ }
+- xp = xfrm_policy_bysel_ctx(net, mark, if_id, type, p->dir,
++ xp = xfrm_policy_bysel_ctx(net, &m, if_id, type, p->dir,
+ &p->sel, ctx, 0, &err);
+ security_xfrm_policy_free(ctx);
+ }
+--
+2.25.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
