--- /dev/null
+From 92f44c00086ae9a88b5003e71d554b22dc87d2a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Jan 2021 06:36:53 +0000
+Subject: bpf: Check for integer overflow when using roundup_pow_of_two()
+
+From: Bui Quang Minh <minhquangbui99@gmail.com>
+
+[ Upstream commit 6183f4d3a0a2ad230511987c6c362ca43ec0055f ]
+
+On 32-bit architecture, roundup_pow_of_two() can return 0 when the argument
+has upper most bit set due to resulting 1UL << 32. Add a check for this case.
+
+Fixes: d5a3b1f69186 ("bpf: introduce BPF_MAP_TYPE_STACK_TRACE")
+Signed-off-by: Bui Quang Minh <minhquangbui99@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20210127063653.3576-1-minhquangbui99@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/stackmap.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
+index 135be433e9a0f..1d4c3fba0f8cd 100644
+--- a/kernel/bpf/stackmap.c
++++ b/kernel/bpf/stackmap.c
+@@ -71,6 +71,8 @@ static struct bpf_map *stack_map_alloc(union bpf_attr *attr)
+
+ /* hash table size must be power of 2 */
+ n_buckets = roundup_pow_of_two(attr->max_entries);
++ if (!n_buckets)
++ return ERR_PTR(-E2BIG);
+
+ cost = n_buckets * sizeof(struct stack_map_bucket *) + sizeof(*smap);
+ if (cost >= U32_MAX - PAGE_SIZE)
+--
+2.27.0
+
--- /dev/null
+From dd299def7ccb80964fdf76e0f12a287e4aa90b7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Feb 2021 20:52:54 -0800
+Subject: h8300: fix PREEMPTION build, TI_PRE_COUNT undefined
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit ade9679c159d5bbe14fb7e59e97daf6062872e2b ]
+
+Fix a build error for undefined 'TI_PRE_COUNT' by adding it to
+asm-offsets.c.
+
+ h8300-linux-ld: arch/h8300/kernel/entry.o: in function `resume_kernel': (.text+0x29a): undefined reference to `TI_PRE_COUNT'
+
+Link: https://lkml.kernel.org/r/20210212021650.22740-1-rdunlap@infradead.org
+Fixes: df2078b8daa7 ("h8300: Low level entry")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: kernel test robot <lkp@intel.com>
+Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/h8300/kernel/asm-offsets.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/h8300/kernel/asm-offsets.c b/arch/h8300/kernel/asm-offsets.c
+index 85e60509f0a83..d4b53af657c84 100644
+--- a/arch/h8300/kernel/asm-offsets.c
++++ b/arch/h8300/kernel/asm-offsets.c
+@@ -63,6 +63,9 @@ int main(void)
+ OFFSET(TI_FLAGS, thread_info, flags);
+ OFFSET(TI_CPU, thread_info, cpu);
+ OFFSET(TI_PRE, thread_info, preempt_count);
++#ifdef CONFIG_PREEMPTION
++ DEFINE(TI_PRE_COUNT, offsetof(struct thread_info, preempt_count));
++#endif
+
+ return 0;
+ }
+--
+2.27.0
+
--- /dev/null
+From 83da291aa2321d9c3a5dacf2ae17b823dd91e247 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 09:51:40 +0100
+Subject: i2c: stm32f7: fix configuration of the digital filter
+
+From: Alain Volmat <alain.volmat@foss.st.com>
+
+[ Upstream commit 3d6a3d3a2a7a3a60a824e7c04e95fd50dec57812 ]
+
+The digital filter related computation are present in the driver
+however the programming of the filter within the IP is missing.
+The maximum value for the DNF is wrong and should be 15 instead of 16.
+
+Fixes: aeb068c57214 ("i2c: i2c-stm32f7: add driver")
+
+Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
+Signed-off-by: Pierre-Yves MORDRET <pierre-yves.mordret@foss.st.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-stm32f7.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
+index 14f60751729e7..9768921a164c0 100644
+--- a/drivers/i2c/busses/i2c-stm32f7.c
++++ b/drivers/i2c/busses/i2c-stm32f7.c
+@@ -42,6 +42,8 @@
+
+ /* STM32F7 I2C control 1 */
+ #define STM32F7_I2C_CR1_ANFOFF BIT(12)
++#define STM32F7_I2C_CR1_DNF_MASK GENMASK(11, 8)
++#define STM32F7_I2C_CR1_DNF(n) (((n) & 0xf) << 8)
+ #define STM32F7_I2C_CR1_ERRIE BIT(7)
+ #define STM32F7_I2C_CR1_TCIE BIT(6)
+ #define STM32F7_I2C_CR1_STOPIE BIT(5)
+@@ -95,7 +97,7 @@
+ #define STM32F7_I2C_MAX_LEN 0xff
+
+ #define STM32F7_I2C_DNF_DEFAULT 0
+-#define STM32F7_I2C_DNF_MAX 16
++#define STM32F7_I2C_DNF_MAX 15
+
+ #define STM32F7_I2C_ANALOG_FILTER_ENABLE 1
+ #define STM32F7_I2C_ANALOG_FILTER_DELAY_MIN 50 /* ns */
+@@ -543,6 +545,13 @@ static void stm32f7_i2c_hw_config(struct stm32f7_i2c_dev *i2c_dev)
+ else
+ stm32f7_i2c_set_bits(i2c_dev->base + STM32F7_I2C_CR1,
+ STM32F7_I2C_CR1_ANFOFF);
++
++ /* Program the Digital Filter */
++ stm32f7_i2c_clr_bits(i2c_dev->base + STM32F7_I2C_CR1,
++ STM32F7_I2C_CR1_DNF_MASK);
++ stm32f7_i2c_set_bits(i2c_dev->base + STM32F7_I2C_CR1,
++ STM32F7_I2C_CR1_DNF(i2c_dev->setup.dnf));
++
+ stm32f7_i2c_set_bits(i2c_dev->base + STM32F7_I2C_CR1,
+ STM32F7_I2C_CR1_PE);
+ }
+--
+2.27.0
+
--- /dev/null
+From 8307be8c2413fd6f4c88806e172da378c279acae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 12:56:43 +0100
+Subject: netfilter: conntrack: skip identical origin tuple in same zone only
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 07998281c268592963e1cd623fe6ab0270b65ae4 ]
+
+The origin skip check needs to re-test the zone. Else, we might skip
+a colliding tuple in the reply direction.
+
+This only occurs when using 'directional zones' where origin tuples
+reside in different zones but the reply tuples share the same zone.
+
+This causes the new conntrack entry to be dropped at confirmation time
+because NAT clash resolution was elided.
+
+Fixes: 4e35c1cb9460240 ("netfilter: nf_nat: skip nat clash resolution for same-origin entries")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
+index 8064d769c953c..ede0ab5dc400a 100644
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -939,7 +939,8 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
+ * Let nf_ct_resolve_clash() deal with this later.
+ */
+ if (nf_ct_tuple_equal(&ignored_conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
+- &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple))
++ &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple) &&
++ nf_ct_zone_equal(ct, zone, IP_CT_DIR_ORIGINAL))
+ continue;
+
+ NF_CT_STAT_INC_ATOMIC(net, found);
+--
+2.27.0
+
--- /dev/null
+From dc6d94b38ecf949f35efe9688060ab8fd0125b7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Jan 2021 20:57:43 +0100
+Subject: netfilter: xt_recent: Fix attempt to update deleted entry
+
+From: Jozsef Kadlecsik <kadlec@mail.kfki.hu>
+
+[ Upstream commit b1bdde33b72366da20d10770ab7a49fe87b5e190 ]
+
+When both --reap and --update flag are specified, there's a code
+path at which the entry to be updated is reaped beforehand,
+which then leads to kernel crash. Reap only entries which won't be
+updated.
+
+Fixes kernel bugzilla #207773.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=207773
+Reported-by: Reindl Harald <h.reindl@thelounge.net>
+Fixes: 0079c5aee348 ("netfilter: xt_recent: add an entry reaper")
+Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/xt_recent.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
+index cf96d230e5a3c..cafbddf844d62 100644
+--- a/net/netfilter/xt_recent.c
++++ b/net/netfilter/xt_recent.c
+@@ -155,7 +155,8 @@ static void recent_entry_remove(struct recent_table *t, struct recent_entry *e)
+ /*
+ * Drop entries with timestamps older then 'time'.
+ */
+-static void recent_entry_reap(struct recent_table *t, unsigned long time)
++static void recent_entry_reap(struct recent_table *t, unsigned long time,
++ struct recent_entry *working, bool update)
+ {
+ struct recent_entry *e;
+
+@@ -164,6 +165,12 @@ static void recent_entry_reap(struct recent_table *t, unsigned long time)
+ */
+ e = list_entry(t->lru_list.next, struct recent_entry, lru_list);
+
++ /*
++ * Do not reap the entry which are going to be updated.
++ */
++ if (e == working && update)
++ return;
++
+ /*
+ * The last time stamp is the most recent.
+ */
+@@ -306,7 +313,8 @@ recent_mt(const struct sk_buff *skb, struct xt_action_param *par)
+
+ /* info->seconds must be non-zero */
+ if (info->check_set & XT_RECENT_REAP)
+- recent_entry_reap(t, time);
++ recent_entry_reap(t, time, e,
++ info->check_set & XT_RECENT_UPDATE && ret);
+ }
+
+ if (info->check_set & XT_RECENT_SET ||
+--
+2.27.0
+
arm-dts-lpc32xx-revert-set-default-clock-rate-of-hcl.patch
arm-ensure-the-signal-page-contains-defined-contents.patch
memblock-do-not-start-bottom-up-allocations-with-ker.patch
+bpf-check-for-integer-overflow-when-using-roundup_po.patch
+netfilter-xt_recent-fix-attempt-to-update-deleted-en.patch
+xen-netback-avoid-race-in-xenvif_rx_ring_slots_avail.patch
+netfilter-conntrack-skip-identical-origin-tuple-in-s.patch
+i2c-stm32f7-fix-configuration-of-the-digital-filter.patch
+h8300-fix-preemption-build-ti_pre_count-undefined.patch
--- /dev/null
+From b51a633c7d80893bdf672ff47d888a627933743d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 08:09:38 +0100
+Subject: xen/netback: avoid race in xenvif_rx_ring_slots_available()
+
+From: Juergen Gross <jgross@suse.com>
+
+[ Upstream commit ec7d8e7dd3a59528e305a18e93f1cb98f7faf83b ]
+
+Since commit 23025393dbeb3b8b3 ("xen/netback: use lateeoi irq binding")
+xenvif_rx_ring_slots_available() is no longer called only from the rx
+queue kernel thread, so it needs to access the rx queue with the
+associated queue held.
+
+Reported-by: Igor Druzhinin <igor.druzhinin@citrix.com>
+Fixes: 23025393dbeb3b8b3 ("xen/netback: use lateeoi irq binding")
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Acked-by: Wei Liu <wl@xen.org>
+Link: https://lore.kernel.org/r/20210202070938.7863-1-jgross@suse.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/xen-netback/rx.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/xen-netback/rx.c b/drivers/net/xen-netback/rx.c
+index f152246c7dfb7..ddfb1cfa2dd94 100644
+--- a/drivers/net/xen-netback/rx.c
++++ b/drivers/net/xen-netback/rx.c
+@@ -38,10 +38,15 @@ static bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue)
+ RING_IDX prod, cons;
+ struct sk_buff *skb;
+ int needed;
++ unsigned long flags;
++
++ spin_lock_irqsave(&queue->rx_queue.lock, flags);
+
+ skb = skb_peek(&queue->rx_queue);
+- if (!skb)
++ if (!skb) {
++ spin_unlock_irqrestore(&queue->rx_queue.lock, flags);
+ return false;
++ }
+
+ needed = DIV_ROUND_UP(skb->len, XEN_PAGE_SIZE);
+ if (skb_is_gso(skb))
+@@ -49,6 +54,8 @@ static bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue)
+ if (skb->sw_hash)
+ needed++;
+
++ spin_unlock_irqrestore(&queue->rx_queue.lock, flags);
++
+ do {
+ prod = queue->rx.sring->req_prod;
+ cons = queue->rx.req_cons;
+--
+2.27.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
