--- /dev/null
+From d3b38596875dbc709b4e721a5873f4663d8a9ea2 Mon Sep 17 00:00:00 2001
+From: Yufen Yu <yuyufen@huawei.com>
+Date: Wed, 3 Aug 2022 10:33:55 +0800
+Subject: blk-mq: run queue no matter whether the request is the last request
+
+From: Yufen Yu <yuyufen@huawei.com>
+
+commit d3b38596875dbc709b4e721a5873f4663d8a9ea2 upstream.
+
+We do test on a virtio scsi device (/dev/sda) and the default mq
+scheduler is 'none'. We found a IO hung as following:
+
+blk_finish_plug
+ blk_mq_plug_issue_direct
+ scsi_mq_get_budget
+ //get budget_token fail and sdev->restarts=1
+
+ scsi_end_request
+ scsi_run_queue_async
+ //sdev->restart=0 and run queue
+
+ blk_mq_request_bypass_insert
+ //add request to hctx->dispatch list
+
+ //continue to dispath plug list
+ blk_mq_dispatch_plug_list
+ blk_mq_try_issue_list_directly
+ //success issue all requests from plug list
+
+After .get_budget fail, scsi_mq_get_budget will increase 'restarts'.
+Normally, it will run hw queue when io complete and set 'restarts'
+as 0. But if we run queue before adding request to the dispatch list
+and blk_mq_dispatch_plug_list also success issue all requests, then
+on one will run queue, and the request will be stall in the dispatch
+list and cannot complete forever.
+
+It is wrong to use last request of plug list to decide if run queue is
+needed since all the remained requests in plug list may be from other
+hctxs. To fix the bug, pass run_queue as true always to
+blk_mq_request_bypass_insert().
+
+Fix-suggested-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Yufen Yu <yuyufen@huawei.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Fixes: dc5fc361d891 ("block: attempt direct issue of plug list")
+Link: https://lore.kernel.org/r/20220803023355.3687360-1-yuyufen@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-mq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -2568,7 +2568,7 @@ static void blk_mq_plug_issue_direct(str
+ break;
+ case BLK_STS_RESOURCE:
+ case BLK_STS_DEV_RESOURCE:
+- blk_mq_request_bypass_insert(rq, false, last);
++ blk_mq_request_bypass_insert(rq, false, true);
+ blk_mq_commit_rqs(hctx, &queued, from_schedule);
+ return;
+ default:
--- /dev/null
+From 2a29f80e155a9cf40ca8b6648bcdc8422db4c4e4 Mon Sep 17 00:00:00 2001
+From: Samuel Holland <samuel@sholland.org>
+Date: Fri, 12 Aug 2022 02:37:02 -0500
+Subject: dt-bindings: display: sun4i: Add D1 TCONs to conditionals
+
+From: Samuel Holland <samuel@sholland.org>
+
+commit 2a29f80e155a9cf40ca8b6648bcdc8422db4c4e4 upstream.
+
+When adding the D1 TCON bindings, I missed the conditional blocks that
+restrict the binding for TCON LCD vs TCON TV hardware. Add the D1 TCON
+variants to the appropriate blocks for DE2 TCON LCDs and TCON TVs.
+
+Fixes: ae5a5d26c15c ("dt-bindings: display: Add D1 display engine compatibles")
+Signed-off-by: Samuel Holland <samuel@sholland.org>
+Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20220812073702.57618-1-samuel@sholland.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ .../devicetree/bindings/display/allwinner,sun4i-a10-tcon.yaml | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/Documentation/devicetree/bindings/display/allwinner,sun4i-a10-tcon.yaml b/Documentation/devicetree/bindings/display/allwinner,sun4i-a10-tcon.yaml
+index 4a92a4c7dcd7..f8168986a0a9 100644
+--- a/Documentation/devicetree/bindings/display/allwinner,sun4i-a10-tcon.yaml
++++ b/Documentation/devicetree/bindings/display/allwinner,sun4i-a10-tcon.yaml
+@@ -233,6 +233,7 @@ allOf:
+ - allwinner,sun8i-a83t-tcon-lcd
+ - allwinner,sun8i-v3s-tcon
+ - allwinner,sun9i-a80-tcon-lcd
++ - allwinner,sun20i-d1-tcon-lcd
+
+ then:
+ properties:
+@@ -252,6 +253,7 @@ allOf:
+ - allwinner,sun8i-a83t-tcon-tv
+ - allwinner,sun8i-r40-tcon-tv
+ - allwinner,sun9i-a80-tcon-tv
++ - allwinner,sun20i-d1-tcon-tv
+
+ then:
+ properties:
+@@ -278,6 +280,7 @@ allOf:
+ - allwinner,sun9i-a80-tcon-lcd
+ - allwinner,sun4i-a10-tcon
+ - allwinner,sun8i-a83t-tcon-lcd
++ - allwinner,sun20i-d1-tcon-lcd
+
+ then:
+ required:
+@@ -294,6 +297,7 @@ allOf:
+ - allwinner,sun8i-a23-tcon
+ - allwinner,sun8i-a33-tcon
+ - allwinner,sun8i-a83t-tcon-lcd
++ - allwinner,sun20i-d1-tcon-lcd
+
+ then:
+ properties:
+--
+2.37.2
+
--- /dev/null
+From 61d5e2a251fb20c2c5e998c3f1d52ed6d5360319 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Cs=C3=B3k=C3=A1s=20Bence?= <csokas.bence@prolan.hu>
+Date: Thu, 11 Aug 2022 12:13:49 +0200
+Subject: fec: Fix timer capture timing in `fec_ptp_enable_pps()`
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Csókás Bence <csokas.bence@prolan.hu>
+
+commit 61d5e2a251fb20c2c5e998c3f1d52ed6d5360319 upstream.
+
+Code reimplements functionality already in `fec_ptp_read()`,
+but misses check for FEC_QUIRK_BUG_CAPTURE. Replace with function call.
+
+Fixes: 28b5f058cf1d ("net: fec: ptp: fix convergence issue to support LinuxPTP stack")
+Signed-off-by: Csókás Bence <csokas.bence@prolan.hu>
+Link: https://lore.kernel.org/r/20220811101348.13755-1-csokas.bence@prolan.hu
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/fec_ptp.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/freescale/fec_ptp.c
++++ b/drivers/net/ethernet/freescale/fec_ptp.c
+@@ -135,11 +135,7 @@ static int fec_ptp_enable_pps(struct fec
+ * NSEC_PER_SEC - ts.tv_nsec. Add the remaining nanoseconds
+ * to current timer would be next second.
+ */
+- tempval = readl(fep->hwp + FEC_ATIME_CTRL);
+- tempval |= FEC_T_CTRL_CAPTURE;
+- writel(tempval, fep->hwp + FEC_ATIME_CTRL);
+-
+- tempval = readl(fep->hwp + FEC_ATIME);
++ tempval = fep->cc.read(&fep->cc);
+ /* Convert the ptp local counter to 1588 timestamp */
+ ns = timecounter_cyc2time(&fep->tc, tempval);
+ ts = ns_to_timespec64(ns);
--- /dev/null
+From 012e8d2034f1bda8863435cd589636e618d6a659 Mon Sep 17 00:00:00 2001
+From: Andrew Donnellan <ajd@linux.ibm.com>
+Date: Tue, 16 Aug 2022 15:17:20 +1000
+Subject: gcc-plugins: Undefine LATENT_ENTROPY_PLUGIN when plugin disabled for a file
+
+From: Andrew Donnellan <ajd@linux.ibm.com>
+
+commit 012e8d2034f1bda8863435cd589636e618d6a659 upstream.
+
+Commit 36d4b36b6959 ("lib/nodemask: inline next_node_in() and
+node_random()") refactored some code by moving node_random() from
+lib/nodemask.c to include/linux/nodemask.h, thus requiring nodemask.h to
+include random.h, which conditionally defines add_latent_entropy()
+depending on whether the macro LATENT_ENTROPY_PLUGIN is defined.
+
+This broke the build on powerpc, where nodemask.h is indirectly included
+in arch/powerpc/kernel/prom_init.c, part of the early boot machinery that
+is excluded from the latent entropy plugin using
+DISABLE_LATENT_ENTROPY_PLUGIN. It turns out that while we add a gcc flag
+to disable the actual plugin, we don't undefine LATENT_ENTROPY_PLUGIN.
+
+This leads to the following:
+
+ CC arch/powerpc/kernel/prom_init.o
+ In file included from ./include/linux/nodemask.h:97,
+ from ./include/linux/mmzone.h:17,
+ from ./include/linux/gfp.h:7,
+ from ./include/linux/xarray.h:15,
+ from ./include/linux/radix-tree.h:21,
+ from ./include/linux/idr.h:15,
+ from ./include/linux/kernfs.h:12,
+ from ./include/linux/sysfs.h:16,
+ from ./include/linux/kobject.h:20,
+ from ./include/linux/pci.h:35,
+ from arch/powerpc/kernel/prom_init.c:24:
+ ./include/linux/random.h: In function 'add_latent_entropy':
+ ./include/linux/random.h:25:46: error: 'latent_entropy' undeclared (first use in this function); did you mean 'add_latent_entropy'?
+ 25 | add_device_randomness((const void *)&latent_entropy, sizeof(latent_entropy));
+ | ^~~~~~~~~~~~~~
+ | add_latent_entropy
+ ./include/linux/random.h:25:46: note: each undeclared identifier is reported only once for each function it appears in
+ make[2]: *** [scripts/Makefile.build:249: arch/powerpc/kernel/prom_init.o] Fehler 1
+ make[1]: *** [scripts/Makefile.build:465: arch/powerpc/kernel] Fehler 2
+ make: *** [Makefile:1855: arch/powerpc] Error 2
+
+Change the DISABLE_LATENT_ENTROPY_PLUGIN flags to undefine
+LATENT_ENTROPY_PLUGIN for files where the plugin is disabled.
+
+Cc: Yury Norov <yury.norov@gmail.com>
+Fixes: 38addce8b600 ("gcc-plugins: Add latent_entropy plugin")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=216367
+Link: https://lore.kernel.org/linuxppc-dev/alpine.DEB.2.22.394.2208152006320.289321@ramsan.of.borg/
+Reported-by: Erhard Furtner <erhard_f@mailbox.org>
+Signed-off-by: Andrew Donnellan <ajd@linux.ibm.com>
+Reviewed-by: Yury Norov <yury.norov@gmail.com>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20220816051720.44108-1-ajd@linux.ibm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ scripts/Makefile.gcc-plugins | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/scripts/Makefile.gcc-plugins
++++ b/scripts/Makefile.gcc-plugins
+@@ -4,7 +4,7 @@ gcc-plugin-$(CONFIG_GCC_PLUGIN_LATENT_EN
+ gcc-plugin-cflags-$(CONFIG_GCC_PLUGIN_LATENT_ENTROPY) \
+ += -DLATENT_ENTROPY_PLUGIN
+ ifdef CONFIG_GCC_PLUGIN_LATENT_ENTROPY
+- DISABLE_LATENT_ENTROPY_PLUGIN += -fplugin-arg-latent_entropy_plugin-disable
++ DISABLE_LATENT_ENTROPY_PLUGIN += -fplugin-arg-latent_entropy_plugin-disable -ULATENT_ENTROPY_PLUGIN
+ endif
+ export DISABLE_LATENT_ENTROPY_PLUGIN
+
--- /dev/null
+From d98bdd3a5b50446d8e010be5b04ce81c4eabf728 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
+Date: Wed, 20 Jul 2022 17:09:33 +0200
+Subject: i2c: imx: Make sure to unregister adapter on remove()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+commit d98bdd3a5b50446d8e010be5b04ce81c4eabf728 upstream.
+
+If for whatever reasons pm_runtime_resume_and_get() fails and .remove() is
+exited early, the i2c adapter stays around and the irq still calls its
+handler, while the driver data and the register mapping go away. So if
+later the i2c adapter is accessed or the irq triggers this results in
+havoc accessing freed memory and unmapped registers.
+
+So unregister the software resources even if resume failed, and only skip
+the hardware access in that case.
+
+Fixes: 588eb93ea49f ("i2c: imx: add runtime pm support to improve the performance")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-imx.c | 20 +++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-imx.c
++++ b/drivers/i2c/busses/i2c-imx.c
+@@ -1572,9 +1572,7 @@ static int i2c_imx_remove(struct platfor
+ struct imx_i2c_struct *i2c_imx = platform_get_drvdata(pdev);
+ int irq, ret;
+
+- ret = pm_runtime_resume_and_get(&pdev->dev);
+- if (ret < 0)
+- return ret;
++ ret = pm_runtime_get_sync(&pdev->dev);
+
+ hrtimer_cancel(&i2c_imx->slave_timer);
+
+@@ -1585,17 +1583,21 @@ static int i2c_imx_remove(struct platfor
+ if (i2c_imx->dma)
+ i2c_imx_dma_free(i2c_imx);
+
+- /* setup chip registers to defaults */
+- imx_i2c_write_reg(0, i2c_imx, IMX_I2C_IADR);
+- imx_i2c_write_reg(0, i2c_imx, IMX_I2C_IFDR);
+- imx_i2c_write_reg(0, i2c_imx, IMX_I2C_I2CR);
+- imx_i2c_write_reg(0, i2c_imx, IMX_I2C_I2SR);
++ if (ret == 0) {
++ /* setup chip registers to defaults */
++ imx_i2c_write_reg(0, i2c_imx, IMX_I2C_IADR);
++ imx_i2c_write_reg(0, i2c_imx, IMX_I2C_IFDR);
++ imx_i2c_write_reg(0, i2c_imx, IMX_I2C_I2CR);
++ imx_i2c_write_reg(0, i2c_imx, IMX_I2C_I2SR);
++ clk_disable(i2c_imx->clk);
++ }
+
+ clk_notifier_unregister(i2c_imx->clk, &i2c_imx->clk_change_nb);
+ irq = platform_get_irq(pdev, 0);
+ if (irq >= 0)
+ free_irq(irq, i2c_imx);
+- clk_disable_unprepare(i2c_imx->clk);
++
++ clk_unprepare(i2c_imx->clk);
+
+ pm_runtime_put_noidle(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
--- /dev/null
+From 57c942bc3bef0970f0b21f8e0998e76a900ea80d Mon Sep 17 00:00:00 2001
+From: Alan Brady <alan.brady@intel.com>
+Date: Tue, 2 Aug 2022 10:19:17 +0200
+Subject: i40e: Fix to stop tx_timeout recovery if GLOBR fails
+
+From: Alan Brady <alan.brady@intel.com>
+
+commit 57c942bc3bef0970f0b21f8e0998e76a900ea80d upstream.
+
+When a tx_timeout fires, the PF attempts to recover by incrementally
+resetting. First we try a PFR, then CORER and finally a GLOBR. If the
+GLOBR fails, then we keep hitting the tx_timeout and incrementing the
+recovery level and issuing dmesgs, which is both annoying to the user
+and accomplishes nothing.
+
+If the GLOBR fails, then we're pretty much totally hosed, and there's
+not much else we can do to recover, so this makes it such that we just
+kill the VSI and stop hitting the tx_timeout in such a case.
+
+Fixes: 41c445ff0f48 ("i40e: main driver core")
+Signed-off-by: Alan Brady <alan.brady@intel.com>
+Signed-off-by: Mateusz Palczewski <mateusz.palczewski@intel.com>
+Tested-by: Gurucharan <gurucharanx.g@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -384,7 +384,9 @@ static void i40e_tx_timeout(struct net_d
+ set_bit(__I40E_GLOBAL_RESET_REQUESTED, pf->state);
+ break;
+ default:
+- netdev_err(netdev, "tx_timeout recovery unsuccessful\n");
++ netdev_err(netdev, "tx_timeout recovery unsuccessful, device is in non-recoverable state.\n");
++ set_bit(__I40E_DOWN_REQUESTED, pf->state);
++ set_bit(__I40E_VSI_DOWN_REQUESTED, vsi->state);
+ break;
+ }
+
--- /dev/null
+From 2c6482091f01ba104cf8ee549aa5c717e80d43ea Mon Sep 17 00:00:00 2001
+From: Przemyslaw Patynowski <przemyslawx.patynowski@intel.com>
+Date: Wed, 27 Jul 2022 11:19:40 +0200
+Subject: i40e: Fix tunnel checksum offload with fragmented traffic
+
+From: Przemyslaw Patynowski <przemyslawx.patynowski@intel.com>
+
+commit 2c6482091f01ba104cf8ee549aa5c717e80d43ea upstream.
+
+Fix checksum offload on VXLAN tunnels.
+In case, when mpls protocol is not used, set l4 header to transport
+header of skb. This fixes case, when user tries to offload checksums
+of VXLAN tunneled traffic.
+
+Steps for reproduction (requires link partner with tunnels):
+ip l s enp130s0f0 up
+ip a f enp130s0f0
+ip a a 10.10.110.2/24 dev enp130s0f0
+ip l s enp130s0f0 mtu 1600
+ip link add vxlan12_sut type vxlan id 12 group 238.168.100.100 dev \
+enp130s0f0 dstport 4789
+ip l s vxlan12_sut up
+ip a a 20.10.110.2/24 dev vxlan12_sut
+iperf3 -c 20.10.110.1 #should connect
+
+Without this patch, TX descriptor was using wrong data, due to
+l4 header pointing wrong address. NIC would then drop those packets
+internally, due to incorrect TX descriptor data, which increased
+GLV_TEPC register.
+
+Fixes: b4fb2d33514a ("i40e: Add support for MPLS + TSO")
+Signed-off-by: Przemyslaw Patynowski <przemyslawx.patynowski@intel.com>
+Signed-off-by: Mateusz Palczewski <mateusz.palczewski@intel.com>
+Tested-by: Marek Szlosek <marek.szlosek@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_txrx.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+@@ -3204,11 +3204,13 @@ static int i40e_tx_enable_csum(struct sk
+
+ protocol = vlan_get_protocol(skb);
+
+- if (eth_p_mpls(protocol))
++ if (eth_p_mpls(protocol)) {
+ ip.hdr = skb_inner_network_header(skb);
+- else
++ l4.hdr = skb_checksum_start(skb);
++ } else {
+ ip.hdr = skb_network_header(skb);
+- l4.hdr = skb_checksum_start(skb);
++ l4.hdr = skb_transport_header(skb);
++ }
+
+ /* set the tx_flags to indicate the IP protocol type. this is
+ * required so that checksum header computation below is accurate.
--- /dev/null
+From cf90b74341eecc32ceef0c136954a1668e43b1e7 Mon Sep 17 00:00:00 2001
+From: Michal Jaron <michalx.jaron@intel.com>
+Date: Mon, 25 Jul 2022 10:32:43 +0200
+Subject: ice: Fix call trace with null VSI during VF reset
+
+From: Michal Jaron <michalx.jaron@intel.com>
+
+commit cf90b74341eecc32ceef0c136954a1668e43b1e7 upstream.
+
+During stress test with attaching and detaching VF from KVM and
+simultaneously changing VFs spoofcheck and trust there was a
+call trace in ice_reset_vf that VF's VSI is null.
+
+[145237.352797] WARNING: CPU: 46 PID: 840629 at drivers/net/ethernet/intel/ice/ice_vf_lib.c:508 ice_reset_vf+0x3d6/0x410 [ice]
+[145237.352851] Modules linked in: ice(E) vfio_pci vfio_pci_core vfio_virqfd vfio_iommu_type1 vfio iavf dm_mod xt_CHECKSUM xt_MASQUERADE
+xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink tun
+ bridge stp llc sunrpc intel_rapl_msr intel_rapl_common sb_edac x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm iTCO_wdt iTC
+O_vendor_support irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel rapl ipmi_si intel_cstate ipmi_devintf joydev intel_uncore m
+ei_me ipmi_msghandler i2c_i801 pcspkr mei lpc_ich ioatdma i2c_smbus acpi_pad acpi_power_meter ip_tables xfs libcrc32c i2c_algo_bit drm_sh
+mem_helper drm_kms_helper sd_mod t10_pi crc64_rocksoft syscopyarea crc64 sysfillrect sg sysimgblt fb_sys_fops drm i40e ixgbe ahci libahci
+ libata crc32c_intel mdio dca wmi fuse [last unloaded: ice]
+[145237.352917] CPU: 46 PID: 840629 Comm: kworker/46:2 Tainted: G S W I E 5.19.0-rc6+ #24
+[145237.352921] Hardware name: Intel Corporation S2600WTT/S2600WTT, BIOS SE5C610.86B.01.01.0008.021120151325 02/11/2015
+[145237.352923] Workqueue: ice ice_service_task [ice]
+[145237.352948] RIP: 0010:ice_reset_vf+0x3d6/0x410 [ice]
+[145237.352984] Code: 30 ec f3 cc e9 28 fd ff ff 0f b7 4b 50 48 c7 c2 48 19 9c c0 4c 89 ee 48 c7 c7 30 fe 9e c0 e8 d1 21 9d cc 31 c0 e9 a
+9 fe ff ff <0f> 0b b8 ea ff ff ff e9 c1 fc ff ff 0f 0b b8 fb ff ff ff e9 91 fe
+[145237.352987] RSP: 0018:ffffb453e257fdb8 EFLAGS: 00010246
+[145237.352990] RAX: ffff8bd0040181c0 RBX: ffff8be68db8f800 RCX: 0000000000000000
+[145237.352991] RDX: 000000000000ffff RSI: 0000000000000000 RDI: ffff8be68db8f800
+[145237.352993] RBP: ffff8bd0040181c0 R08: 0000000000001000 R09: ffff8bcfd520e000
+[145237.352995] R10: 0000000000000000 R11: 00008417b5ab0bc0 R12: 0000000000000005
+[145237.352996] R13: ffff8bcee061c0d0 R14: ffff8bd004019640 R15: 0000000000000000
+[145237.352998] FS: 0000000000000000(0000) GS:ffff8be5dfb00000(0000) knlGS:0000000000000000
+[145237.353000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[145237.353002] CR2: 00007fd81f651d68 CR3: 0000001a0fe10001 CR4: 00000000001726e0
+[145237.353003] Call Trace:
+[145237.353008] <TASK>
+[145237.353011] ice_process_vflr_event+0x8d/0xb0 [ice]
+[145237.353049] ice_service_task+0x79f/0xef0 [ice]
+[145237.353074] process_one_work+0x1c8/0x390
+[145237.353081] ? process_one_work+0x390/0x390
+[145237.353084] worker_thread+0x30/0x360
+[145237.353087] ? process_one_work+0x390/0x390
+[145237.353090] kthread+0xe8/0x110
+[145237.353094] ? kthread_complete_and_exit+0x20/0x20
+[145237.353097] ret_from_fork+0x22/0x30
+[145237.353103] </TASK>
+
+Remove WARN_ON() from check if VSI is null in ice_reset_vf.
+Add "VF is already removed\n" in dev_dbg().
+
+This WARN_ON() is unnecessary and causes call trace, despite that
+call trace, driver still works. There is no need for this warn
+because this piece of code is responsible for disabling VF's Tx/Rx
+queues when VF is disabled, but when VF is already removed there
+is no need to do reset or disable queues.
+
+Fixes: efe41860008e ("ice: Fix memory corruption in VF driver")
+Signed-off-by: Michal Jaron <michalx.jaron@intel.com>
+Signed-off-by: Jedrzej Jagielski <jedrzej.jagielski@intel.com>
+Tested-by: Marek Szlosek <marek.szlosek@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ice/ice_vf_lib.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/ice/ice_vf_lib.c
++++ b/drivers/net/ethernet/intel/ice/ice_vf_lib.c
+@@ -505,8 +505,10 @@ int ice_reset_vf(struct ice_vf *vf, u32
+
+ if (ice_is_vf_disabled(vf)) {
+ vsi = ice_get_vf_vsi(vf);
+- if (WARN_ON(!vsi))
++ if (!vsi) {
++ dev_dbg(dev, "VF is already removed\n");
+ return -EINVAL;
++ }
+ ice_vsi_stop_lan_tx_rings(vsi, ICE_NO_RESET, vf->vf_id);
+ ice_vsi_stop_all_rx_rings(vsi);
+ dev_dbg(dev, "VF is already disabled, there is no need for resetting it, telling VM, all is fine %d\n",
--- /dev/null
+From abddafd4585cc825d454da3cf308ad1226f6c554 Mon Sep 17 00:00:00 2001
+From: Grzegorz Siwik <grzegorz.siwik@intel.com>
+Date: Fri, 12 Aug 2022 15:25:49 +0200
+Subject: ice: Fix clearing of promisc mode with bridge over bond
+
+From: Grzegorz Siwik <grzegorz.siwik@intel.com>
+
+commit abddafd4585cc825d454da3cf308ad1226f6c554 upstream.
+
+When at least two interfaces are bonded and a bridge is enabled on the
+bond, an error can occur when the bridge is removed and re-added. The
+reason for the error is because promiscuous mode was not fully cleared from
+the VLAN VSI in the hardware. With this change, promiscuous mode is
+properly removed when the bridge disconnects from bonding.
+
+[ 1033.676359] bond1: link status definitely down for interface enp95s0f0, disabling it
+[ 1033.676366] bond1: making interface enp175s0f0 the new active one
+[ 1033.676369] device enp95s0f0 left promiscuous mode
+[ 1033.676522] device enp175s0f0 entered promiscuous mode
+[ 1033.676901] ice 0000:af:00.0 enp175s0f0: Error setting Multicast promiscuous mode on VSI 6
+[ 1041.795662] ice 0000:af:00.0 enp175s0f0: Error setting Multicast promiscuous mode on VSI 6
+[ 1041.944826] bond1: link status definitely down for interface enp175s0f0, disabling it
+[ 1041.944874] device enp175s0f0 left promiscuous mode
+[ 1041.944918] bond1: now running without any active interface!
+
+Fixes: c31af68a1b94 ("ice: Add outer_vlan_ops and VSI specific VLAN ops implementations")
+Co-developed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Signed-off-by: Grzegorz Siwik <grzegorz.siwik@intel.com>
+Link: https://lore.kernel.org/all/CAK8fFZ7m-KR57M_rYX6xZN39K89O=LGooYkKsu6HKt0Bs+x6xQ@mail.gmail.com/
+Tested-by: Jaroslav Pulchart <jaroslav.pulchart@gooddata.com>
+Tested-by: Igor Raits <igor@gooddata.com>
+Tested-by: Gurucharan <gurucharanx.g@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ice/ice_lib.c | 6 +++++-
+ drivers/net/ethernet/intel/ice/ice_main.c | 12 +++++++++++-
+ 2 files changed, 16 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/intel/ice/ice_lib.c
++++ b/drivers/net/ethernet/intel/ice/ice_lib.c
+@@ -4048,7 +4048,11 @@ int ice_vsi_add_vlan_zero(struct ice_vsi
+ if (err && err != -EEXIST)
+ return err;
+
+- return 0;
++ /* when deleting the last VLAN filter, make sure to disable the VLAN
++ * promisc mode so the filter isn't left by accident
++ */
++ return ice_clear_vsi_promisc(&vsi->back->hw, vsi->idx,
++ ICE_MCAST_VLAN_PROMISC_BITS, 0);
+ }
+
+ /**
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -267,8 +267,10 @@ static int ice_set_promisc(struct ice_vs
+ status = ice_fltr_set_vsi_promisc(&vsi->back->hw, vsi->idx,
+ promisc_m, 0);
+ }
++ if (status && status != -EEXIST)
++ return status;
+
+- return status;
++ return 0;
+ }
+
+ /**
+@@ -3572,6 +3574,14 @@ ice_vlan_rx_kill_vid(struct net_device *
+ while (test_and_set_bit(ICE_CFG_BUSY, vsi->state))
+ usleep_range(1000, 2000);
+
++ ret = ice_clear_vsi_promisc(&vsi->back->hw, vsi->idx,
++ ICE_MCAST_VLAN_PROMISC_BITS, vid);
++ if (ret) {
++ netdev_err(netdev, "Error clearing multicast promiscuous mode on VSI %i\n",
++ vsi->vsi_num);
++ vsi->current_netdev_flags |= IFF_ALLMULTI;
++ }
++
+ vlan_ops = ice_get_compat_vsi_vlan_ops(vsi);
+
+ /* Make sure VLAN delete is successful before updating VLAN
--- /dev/null
+From ffa9ed86522f1c08d4face4e0a4ebf366037bf19 Mon Sep 17 00:00:00 2001
+From: Grzegorz Siwik <grzegorz.siwik@intel.com>
+Date: Fri, 12 Aug 2022 15:25:47 +0200
+Subject: ice: Fix double VLAN error when entering promisc mode
+
+From: Grzegorz Siwik <grzegorz.siwik@intel.com>
+
+commit ffa9ed86522f1c08d4face4e0a4ebf366037bf19 upstream.
+
+Avoid enabling or disabling VLAN 0 when trying to set promiscuous
+VLAN mode if double VLAN mode is enabled. This fix is needed
+because the driver tries to add the VLAN 0 filter twice (once for
+inner and once for outer) when double VLAN mode is enabled. The
+filter program is rejected by the firmware when double VLAN is
+enabled, because the promiscuous filter only needs to be set once.
+
+This issue was missed in the initial implementation of double VLAN
+mode.
+
+Fixes: 5eda8afd6bcc ("ice: Add support for PF/VF promiscuous mode")
+Signed-off-by: Grzegorz Siwik <grzegorz.siwik@intel.com>
+Link: https://lore.kernel.org/all/CAK8fFZ7m-KR57M_rYX6xZN39K89O=LGooYkKsu6HKt0Bs+x6xQ@mail.gmail.com/
+Tested-by: Jaroslav Pulchart <jaroslav.pulchart@gooddata.com>
+Tested-by: Igor Raits <igor@gooddata.com>
+Tested-by: Gurucharan <gurucharanx.g@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ice/ice_switch.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/net/ethernet/intel/ice/ice_switch.c
++++ b/drivers/net/ethernet/intel/ice/ice_switch.c
+@@ -4414,6 +4414,13 @@ ice_set_vlan_vsi_promisc(struct ice_hw *
+ goto free_fltr_list;
+
+ list_for_each_entry(list_itr, &vsi_list_head, list_entry) {
++ /* Avoid enabling or disabling VLAN zero twice when in double
++ * VLAN mode
++ */
++ if (ice_is_dvm_ena(hw) &&
++ list_itr->fltr_info.l_data.vlan.tpid == 0)
++ continue;
++
+ vlan_id = list_itr->fltr_info.l_data.vlan.vlan_id;
+ if (rm_vlan_promisc)
+ status = ice_clear_vsi_promisc(hw, vsi_handle,
--- /dev/null
+From 664d4646184ed986f8195df684cc4660563fb02a Mon Sep 17 00:00:00 2001
+From: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
+Date: Wed, 3 Aug 2022 10:42:46 +0200
+Subject: ice: Fix VF not able to send tagged traffic with no VLAN filters
+
+From: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
+
+commit 664d4646184ed986f8195df684cc4660563fb02a upstream.
+
+VF was not able to send tagged traffic when it didn't
+have any VLAN interfaces and VLAN anti-spoofing was enabled.
+Fix this by allowing VFs with no VLAN filters to send tagged
+traffic. After VF adds a VLAN interface it will be able to
+send tagged traffic matching VLAN filters only.
+
+Testing hints:
+1. Spawn VF
+2. Send tagged packet from a VF
+3. The packet should be sent out and not dropped
+4. Add a VLAN interface on VF
+5. Send tagged packet on that VLAN interface
+6. Packet should be sent out and not dropped
+7. Send tagged packet with id different than VLAN interface
+8. Packet should be dropped
+
+Fixes: daf4dd16438b ("ice: Refactor spoofcheck configuration functions")
+Signed-off-by: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
+Signed-off-by: Mateusz Palczewski <mateusz.palczewski@intel.com>
+Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ice/ice_vf_lib.c | 11 +++--
+ drivers/net/ethernet/intel/ice/ice_virtchnl.c | 57 ++++++++++++++++++++++----
+ 2 files changed, 57 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/ethernet/intel/ice/ice_vf_lib.c
++++ b/drivers/net/ethernet/intel/ice/ice_vf_lib.c
+@@ -707,13 +707,16 @@ static int ice_cfg_mac_antispoof(struct
+ static int ice_vsi_ena_spoofchk(struct ice_vsi *vsi)
+ {
+ struct ice_vsi_vlan_ops *vlan_ops;
+- int err;
++ int err = 0;
+
+ vlan_ops = ice_get_compat_vsi_vlan_ops(vsi);
+
+- err = vlan_ops->ena_tx_filtering(vsi);
+- if (err)
+- return err;
++ /* Allow VF with VLAN 0 only to send all tagged traffic */
++ if (vsi->type != ICE_VSI_VF || ice_vsi_has_non_zero_vlans(vsi)) {
++ err = vlan_ops->ena_tx_filtering(vsi);
++ if (err)
++ return err;
++ }
+
+ return ice_cfg_mac_antispoof(vsi, true);
+ }
+--- a/drivers/net/ethernet/intel/ice/ice_virtchnl.c
++++ b/drivers/net/ethernet/intel/ice/ice_virtchnl.c
+@@ -2264,6 +2264,15 @@ static int ice_vc_process_vlan_msg(struc
+
+ /* Enable VLAN filtering on first non-zero VLAN */
+ if (!vlan_promisc && vid && !ice_is_dvm_ena(&pf->hw)) {
++ if (vf->spoofchk) {
++ status = vsi->inner_vlan_ops.ena_tx_filtering(vsi);
++ if (status) {
++ v_ret = VIRTCHNL_STATUS_ERR_PARAM;
++ dev_err(dev, "Enable VLAN anti-spoofing on VLAN ID: %d failed error-%d\n",
++ vid, status);
++ goto error_param;
++ }
++ }
+ if (vsi->inner_vlan_ops.ena_rx_filtering(vsi)) {
+ v_ret = VIRTCHNL_STATUS_ERR_PARAM;
+ dev_err(dev, "Enable VLAN pruning on VLAN ID: %d failed error-%d\n",
+@@ -2309,8 +2318,10 @@ static int ice_vc_process_vlan_msg(struc
+ }
+
+ /* Disable VLAN filtering when only VLAN 0 is left */
+- if (!ice_vsi_has_non_zero_vlans(vsi))
++ if (!ice_vsi_has_non_zero_vlans(vsi)) {
++ vsi->inner_vlan_ops.dis_tx_filtering(vsi);
+ vsi->inner_vlan_ops.dis_rx_filtering(vsi);
++ }
+
+ if (vlan_promisc)
+ ice_vf_dis_vlan_promisc(vsi, &vlan);
+@@ -2814,6 +2825,13 @@ ice_vc_del_vlans(struct ice_vf *vf, stru
+
+ if (vlan_promisc)
+ ice_vf_dis_vlan_promisc(vsi, &vlan);
++
++ /* Disable VLAN filtering when only VLAN 0 is left */
++ if (!ice_vsi_has_non_zero_vlans(vsi) && ice_is_dvm_ena(&vsi->back->hw)) {
++ err = vsi->outer_vlan_ops.dis_tx_filtering(vsi);
++ if (err)
++ return err;
++ }
+ }
+
+ vc_vlan = &vlan_fltr->inner;
+@@ -2829,8 +2847,17 @@ ice_vc_del_vlans(struct ice_vf *vf, stru
+ /* no support for VLAN promiscuous on inner VLAN unless
+ * we are in Single VLAN Mode (SVM)
+ */
+- if (!ice_is_dvm_ena(&vsi->back->hw) && vlan_promisc)
+- ice_vf_dis_vlan_promisc(vsi, &vlan);
++ if (!ice_is_dvm_ena(&vsi->back->hw)) {
++ if (vlan_promisc)
++ ice_vf_dis_vlan_promisc(vsi, &vlan);
++
++ /* Disable VLAN filtering when only VLAN 0 is left */
++ if (!ice_vsi_has_non_zero_vlans(vsi)) {
++ err = vsi->inner_vlan_ops.dis_tx_filtering(vsi);
++ if (err)
++ return err;
++ }
++ }
+ }
+ }
+
+@@ -2907,6 +2934,13 @@ ice_vc_add_vlans(struct ice_vf *vf, stru
+ if (err)
+ return err;
+ }
++
++ /* Enable VLAN filtering on first non-zero VLAN */
++ if (vf->spoofchk && vlan.vid && ice_is_dvm_ena(&vsi->back->hw)) {
++ err = vsi->outer_vlan_ops.ena_tx_filtering(vsi);
++ if (err)
++ return err;
++ }
+ }
+
+ vc_vlan = &vlan_fltr->inner;
+@@ -2922,10 +2956,19 @@ ice_vc_add_vlans(struct ice_vf *vf, stru
+ /* no support for VLAN promiscuous on inner VLAN unless
+ * we are in Single VLAN Mode (SVM)
+ */
+- if (!ice_is_dvm_ena(&vsi->back->hw) && vlan_promisc) {
+- err = ice_vf_ena_vlan_promisc(vsi, &vlan);
+- if (err)
+- return err;
++ if (!ice_is_dvm_ena(&vsi->back->hw)) {
++ if (vlan_promisc) {
++ err = ice_vf_ena_vlan_promisc(vsi, &vlan);
++ if (err)
++ return err;
++ }
++
++ /* Enable VLAN filtering on first non-zero VLAN */
++ if (vf->spoofchk && vlan.vid) {
++ err = vsi->inner_vlan_ops.ena_tx_filtering(vsi);
++ if (err)
++ return err;
++ }
+ }
+ }
+ }
--- /dev/null
+From 7fe05e125d5f730bd2d0fc53985bee77b6c762f0 Mon Sep 17 00:00:00 2001
+From: Benjamin Mikailenko <benjamin.mikailenko@intel.com>
+Date: Fri, 15 Jul 2022 18:27:07 -0400
+Subject: ice: Fix VSI rebuild WARN_ON check for VF
+
+From: Benjamin Mikailenko <benjamin.mikailenko@intel.com>
+
+commit 7fe05e125d5f730bd2d0fc53985bee77b6c762f0 upstream.
+
+In commit b03d519d3460 ("ice: store VF pointer instead of VF ID")
+WARN_ON checks were added to validate the vsi->vf pointer and
+catch programming errors. However, one check to vsi->vf was missed.
+This caused a call trace when resetting VFs.
+
+Fix ice_vsi_rebuild by encompassing VF pointer in WARN_ON check.
+
+Fixes: b03d519d3460 ("ice: store VF pointer instead of VF ID")
+Signed-off-by: Benjamin Mikailenko <benjamin.mikailenko@intel.com>
+Tested-by: Marek Szlosek <marek.szlosek@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ice/ice_lib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/ice/ice_lib.c
++++ b/drivers/net/ethernet/intel/ice/ice_lib.c
+@@ -3178,7 +3178,7 @@ int ice_vsi_rebuild(struct ice_vsi *vsi,
+
+ pf = vsi->back;
+ vtype = vsi->type;
+- if (WARN_ON(vtype == ICE_VSI_VF) && !vsi->vf)
++ if (WARN_ON(vtype == ICE_VSI_VF && !vsi->vf))
+ return -EINVAL;
+
+ ice_vsi_init_vlan_ops(vsi);
--- /dev/null
+From 11e551a2efa4481bd4f616ab75374a2710b480e9 Mon Sep 17 00:00:00 2001
+From: Grzegorz Siwik <grzegorz.siwik@intel.com>
+Date: Fri, 12 Aug 2022 15:25:48 +0200
+Subject: ice: Ignore EEXIST when setting promisc mode
+
+From: Grzegorz Siwik <grzegorz.siwik@intel.com>
+
+commit 11e551a2efa4481bd4f616ab75374a2710b480e9 upstream.
+
+Ignore EEXIST error when setting promiscuous mode.
+This fix is needed because the driver could set promiscuous mode
+when it still has not cleared properly.
+Promiscuous mode could be set only once, so setting it second
+time will be rejected.
+
+Fixes: 5eda8afd6bcc ("ice: Add support for PF/VF promiscuous mode")
+Signed-off-by: Grzegorz Siwik <grzegorz.siwik@intel.com>
+Link: https://lore.kernel.org/all/CAK8fFZ7m-KR57M_rYX6xZN39K89O=LGooYkKsu6HKt0Bs+x6xQ@mail.gmail.com/
+Tested-by: Jaroslav Pulchart <jaroslav.pulchart@gooddata.com>
+Tested-by: Igor Raits <igor@gooddata.com>
+Tested-by: Gurucharan <gurucharanx.g@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ice/ice_switch.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/ice/ice_switch.c
++++ b/drivers/net/ethernet/intel/ice/ice_switch.c
+@@ -4428,7 +4428,7 @@ ice_set_vlan_vsi_promisc(struct ice_hw *
+ else
+ status = ice_set_vsi_promisc(hw, vsi_handle,
+ promisc_mask, vlan_id);
+- if (status)
++ if (status && status != -EEXIST)
+ break;
+ }
+
--- /dev/null
+From 79956b83ed4281c35561c39254558092d96a9ed1 Mon Sep 17 00:00:00 2001
+From: Benjamin Mikailenko <benjamin.mikailenko@intel.com>
+Date: Fri, 12 Aug 2022 15:25:50 +0200
+Subject: ice: Ignore error message when setting same promiscuous mode
+
+From: Benjamin Mikailenko <benjamin.mikailenko@intel.com>
+
+commit 79956b83ed4281c35561c39254558092d96a9ed1 upstream.
+
+Commit 1273f89578f2 ("ice: Fix broken IFF_ALLMULTI handling")
+introduced new checks when setting/clearing promiscuous mode. But if the
+requested promiscuous mode setting already exists, an -EEXIST error
+message would be printed. This is incorrect because promiscuous mode is
+either on/off and shouldn't print an error when the requested
+configuration is already set.
+
+This can happen when removing a bridge with two bonded interfaces and
+promiscuous most isn't fully cleared from VLAN VSI in hardware.
+
+Fix this by ignoring cases where requested promiscuous mode exists.
+
+Fixes: 1273f89578f2 ("ice: Fix broken IFF_ALLMULTI handling")
+Signed-off-by: Benjamin Mikailenko <benjamin.mikailenko@intel.com>
+Signed-off-by: Grzegorz Siwik <grzegorz.siwik@intel.com>
+Link: https://lore.kernel.org/all/CAK8fFZ7m-KR57M_rYX6xZN39K89O=LGooYkKsu6HKt0Bs+x6xQ@mail.gmail.com/
+Tested-by: Gurucharan <gurucharanx.g@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ice/ice_fltr.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/intel/ice/ice_fltr.c
++++ b/drivers/net/ethernet/intel/ice/ice_fltr.c
+@@ -62,7 +62,7 @@ ice_fltr_set_vlan_vsi_promisc(struct ice
+ int result;
+
+ result = ice_set_vlan_vsi_promisc(hw, vsi->idx, promisc_mask, false);
+- if (result)
++ if (result && result != -EEXIST)
+ dev_err(ice_pf_to_dev(pf),
+ "Error setting promisc mode on VSI %i (rc=%d)\n",
+ vsi->vsi_num, result);
+@@ -86,7 +86,7 @@ ice_fltr_clear_vlan_vsi_promisc(struct i
+ int result;
+
+ result = ice_set_vlan_vsi_promisc(hw, vsi->idx, promisc_mask, true);
+- if (result)
++ if (result && result != -EEXIST)
+ dev_err(ice_pf_to_dev(pf),
+ "Error clearing promisc mode on VSI %i (rc=%d)\n",
+ vsi->vsi_num, result);
+@@ -109,7 +109,7 @@ ice_fltr_clear_vsi_promisc(struct ice_hw
+ int result;
+
+ result = ice_clear_vsi_promisc(hw, vsi_handle, promisc_mask, vid);
+- if (result)
++ if (result && result != -EEXIST)
+ dev_err(ice_pf_to_dev(pf),
+ "Error clearing promisc mode on VSI %i for VID %u (rc=%d)\n",
+ ice_get_hw_vsi_num(hw, vsi_handle), vid, result);
+@@ -132,7 +132,7 @@ ice_fltr_set_vsi_promisc(struct ice_hw *
+ int result;
+
+ result = ice_set_vsi_promisc(hw, vsi_handle, promisc_mask, vid);
+- if (result)
++ if (result && result != -EEXIST)
+ dev_err(ice_pf_to_dev(pf),
+ "Error setting promisc mode on VSI %i for VID %u (rc=%d)\n",
+ ice_get_hw_vsi_num(hw, vsi_handle), vid, result);
--- /dev/null
+From 6faee3d4ee8be0f0367d0c3d826afb3571b7a5e0 Mon Sep 17 00:00:00 2001
+From: Lin Ma <linma@zju.edu.cn>
+Date: Wed, 17 Aug 2022 11:49:21 -0700
+Subject: igb: Add lock to avoid data race
+
+From: Lin Ma <linma@zju.edu.cn>
+
+commit 6faee3d4ee8be0f0367d0c3d826afb3571b7a5e0 upstream.
+
+The commit c23d92b80e0b ("igb: Teardown SR-IOV before
+unregister_netdev()") places the unregister_netdev() call after the
+igb_disable_sriov() call to avoid functionality issue.
+
+However, it introduces several race conditions when detaching a device.
+For example, when .remove() is called, the below interleaving leads to
+use-after-free.
+
+ (FREE from device detaching) | (USE from netdev core)
+igb_remove | igb_ndo_get_vf_config
+ igb_disable_sriov | vf >= adapter->vfs_allocated_count?
+ kfree(adapter->vf_data) |
+ adapter->vfs_allocated_count = 0 |
+ | memcpy(... adapter->vf_data[vf]
+
+Moreover, the igb_disable_sriov() also suffers from data race with the
+requests from VF driver.
+
+ (FREE from device detaching) | (USE from requests)
+igb_remove | igb_msix_other
+ igb_disable_sriov | igb_msg_task
+ kfree(adapter->vf_data) | vf < adapter->vfs_allocated_count
+ adapter->vfs_allocated_count = 0 |
+
+To this end, this commit first eliminates the data races from netdev
+core by using rtnl_lock (similar to commit 719479230893 ("dpaa2-eth: add
+MAC/PHY support through phylink")). And then adds a spinlock to
+eliminate races from driver requests. (similar to commit 1e53834ce541
+("ixgbe: Add locking to prevent panic when setting sriov_numvfs to zero")
+
+Fixes: c23d92b80e0b ("igb: Teardown SR-IOV before unregister_netdev()")
+Signed-off-by: Lin Ma <linma@zju.edu.cn>
+Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Link: https://lore.kernel.org/r/20220817184921.735244-1-anthony.l.nguyen@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/igb/igb.h | 2 ++
+ drivers/net/ethernet/intel/igb/igb_main.c | 12 +++++++++++-
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/igb/igb.h
++++ b/drivers/net/ethernet/intel/igb/igb.h
+@@ -664,6 +664,8 @@ struct igb_adapter {
+ struct igb_mac_addr *mac_table;
+ struct vf_mac_filter vf_macs;
+ struct vf_mac_filter *vf_mac_list;
++ /* lock for VF resources */
++ spinlock_t vfs_lock;
+ };
+
+ /* flags controlling PTP/1588 function */
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -3637,6 +3637,7 @@ static int igb_disable_sriov(struct pci_
+ struct net_device *netdev = pci_get_drvdata(pdev);
+ struct igb_adapter *adapter = netdev_priv(netdev);
+ struct e1000_hw *hw = &adapter->hw;
++ unsigned long flags;
+
+ /* reclaim resources allocated to VFs */
+ if (adapter->vf_data) {
+@@ -3649,12 +3650,13 @@ static int igb_disable_sriov(struct pci_
+ pci_disable_sriov(pdev);
+ msleep(500);
+ }
+-
++ spin_lock_irqsave(&adapter->vfs_lock, flags);
+ kfree(adapter->vf_mac_list);
+ adapter->vf_mac_list = NULL;
+ kfree(adapter->vf_data);
+ adapter->vf_data = NULL;
+ adapter->vfs_allocated_count = 0;
++ spin_unlock_irqrestore(&adapter->vfs_lock, flags);
+ wr32(E1000_IOVCTL, E1000_IOVCTL_REUSE_VFQ);
+ wrfl();
+ msleep(100);
+@@ -3814,7 +3816,9 @@ static void igb_remove(struct pci_dev *p
+ igb_release_hw_control(adapter);
+
+ #ifdef CONFIG_PCI_IOV
++ rtnl_lock();
+ igb_disable_sriov(pdev);
++ rtnl_unlock();
+ #endif
+
+ unregister_netdev(netdev);
+@@ -3974,6 +3978,9 @@ static int igb_sw_init(struct igb_adapte
+
+ spin_lock_init(&adapter->nfc_lock);
+ spin_lock_init(&adapter->stats64_lock);
++
++ /* init spinlock to avoid concurrency of VF resources */
++ spin_lock_init(&adapter->vfs_lock);
+ #ifdef CONFIG_PCI_IOV
+ switch (hw->mac.type) {
+ case e1000_82576:
+@@ -7924,8 +7931,10 @@ unlock:
+ static void igb_msg_task(struct igb_adapter *adapter)
+ {
+ struct e1000_hw *hw = &adapter->hw;
++ unsigned long flags;
+ u32 vf;
+
++ spin_lock_irqsave(&adapter->vfs_lock, flags);
+ for (vf = 0; vf < adapter->vfs_allocated_count; vf++) {
+ /* process any reset requests */
+ if (!igb_check_for_rst(hw, vf))
+@@ -7939,6 +7948,7 @@ static void igb_msg_task(struct igb_adap
+ if (!igb_check_for_ack(hw, vf))
+ igb_rcv_ack_from_vf(adapter, vf);
+ }
++ spin_unlock_irqrestore(&adapter->vfs_lock, flags);
+ }
+
+ /**
--- /dev/null
+From 113147510b48e764e624e3d0e6707a1e48bc05a9 Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <masahiroy@kernel.org>
+Date: Sun, 14 Aug 2022 08:09:28 +0900
+Subject: kbuild: fix the modules order between drivers and libs
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+commit 113147510b48e764e624e3d0e6707a1e48bc05a9 upstream.
+
+Commit b2c885549122 ("kbuild: update modules.order only when contained
+modules are updated") accidentally changed the modules order.
+
+Prior to that commit, the modules order was determined based on
+vmlinux-dirs, which lists core-y/m, drivers-y/m, libs-y/m, in this order.
+
+Now, subdir-modorder lists them in a different order: core-y/m, libs-y/m,
+drivers-y/m.
+
+Presumably, there was no practical issue because the modules in drivers
+and libs are orthogonal, but there is no reason to have this distortion.
+
+Get back to the original order.
+
+Fixes: b2c885549122 ("kbuild: update modules.order only when contained modules are updated")
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Makefile | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/Makefile
++++ b/Makefile
+@@ -1112,13 +1112,11 @@ vmlinux-alldirs := $(sort $(vmlinux-dirs
+ $(patsubst %/,%,$(filter %/, $(core-) \
+ $(drivers-) $(libs-))))
+
+-subdir-modorder := $(addsuffix modules.order,$(filter %/, \
+- $(core-y) $(core-m) $(libs-y) $(libs-m) \
+- $(drivers-y) $(drivers-m)))
+-
+ build-dirs := $(vmlinux-dirs)
+ clean-dirs := $(vmlinux-alldirs)
+
++subdir-modorder := $(addsuffix /modules.order, $(build-dirs))
++
+ # Externally visible symbols (used by link-vmlinux.sh)
+ KBUILD_VMLINUX_OBJS := $(head-y) $(patsubst %/,%/built-in.a, $(core-y))
+ KBUILD_VMLINUX_OBJS += $(addsuffix built-in.a, $(filter %/, $(libs-y)))
--- /dev/null
+From a159e986ad26d3f35c0157ac92760ba5e44e6785 Mon Sep 17 00:00:00 2001
+From: Amit Cohen <amcohen@nvidia.com>
+Date: Fri, 12 Aug 2022 17:32:01 +0200
+Subject: mlxsw: spectrum: Clear PTP configuration after unregistering the netdevice
+
+From: Amit Cohen <amcohen@nvidia.com>
+
+commit a159e986ad26d3f35c0157ac92760ba5e44e6785 upstream.
+
+Currently as part of removing port, PTP API is called to clear the
+existing configuration and set the 'rx_filter' and 'tx_type' to zero.
+The clearing is done before unregistering the netdevice, which means that
+there is a window of time in which the user can reconfigure PTP in the
+port, and this configuration will not be cleared.
+
+Reorder the operations, clear PTP configuration after unregistering the
+netdevice.
+
+Fixes: 8748642751ede ("mlxsw: spectrum: PTP: Support SIOCGHWTSTAMP, SIOCSHWTSTAMP ioctls")
+Signed-off-by: Amit Cohen <amcohen@nvidia.com>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Signed-off-by: Petr Machata <petrm@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -1822,9 +1822,9 @@ static void mlxsw_sp_port_remove(struct
+
+ cancel_delayed_work_sync(&mlxsw_sp_port->periodic_hw_stats.update_dw);
+ cancel_delayed_work_sync(&mlxsw_sp_port->ptp.shaper_dw);
+- mlxsw_sp_port_ptp_clear(mlxsw_sp_port);
+ mlxsw_core_port_clear(mlxsw_sp->core, local_port, mlxsw_sp);
+ unregister_netdev(mlxsw_sp_port->dev); /* This calls ndo_stop */
++ mlxsw_sp_port_ptp_clear(mlxsw_sp_port);
+ mlxsw_sp_port_vlan_classification_set(mlxsw_sp_port, true, true);
+ mlxsw_sp->ports[local_port] = NULL;
+ mlxsw_sp_port_vlan_flush(mlxsw_sp_port, true);
--- /dev/null
+From 5b8a9a8fd1f0c3d55d407cf759d54ca68798d9ad Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <masahiroy@kernel.org>
+Date: Tue, 9 Aug 2022 23:11:17 +0900
+Subject: modpost: fix module versioning when a symbol lacks valid CRC
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+commit 5b8a9a8fd1f0c3d55d407cf759d54ca68798d9ad upstream.
+
+Since commit 7b4537199a4a ("kbuild: link symbol CRCs at final link,
+removing CONFIG_MODULE_REL_CRCS"), module versioning is broken on
+some architectures. Loading a module fails with "disagrees about
+version of symbol module_layout".
+
+On such architectures (e.g. ARCH=sparc build with sparc64_defconfig),
+modpost shows a warning, like follows:
+
+ WARNING: modpost: EXPORT symbol "_mcount" [vmlinux] version generation failed, symbol will not be versioned.
+ Is "_mcount" prototyped in <asm/asm-prototypes.h>?
+
+Previously, it was a harmless warning (CRC check was just skipped),
+but now wrong CRCs are used for comparison because invalid CRCs are
+just skipped.
+
+ $ sparc64-linux-gnu-nm -n vmlinux
+ [snip]
+ 0000000000c2cea0 r __ksymtab__kstrtol
+ 0000000000c2ceb8 r __ksymtab__kstrtoul
+ 0000000000c2ced0 r __ksymtab__local_bh_enable
+ 0000000000c2cee8 r __ksymtab__mcount
+ 0000000000c2cf00 r __ksymtab__printk
+ 0000000000c2cf18 r __ksymtab__raw_read_lock
+ 0000000000c2cf30 r __ksymtab__raw_read_lock_bh
+ [snip]
+ 0000000000c53b34 D __crc__kstrtol
+ 0000000000c53b38 D __crc__kstrtoul
+ 0000000000c53b3c D __crc__local_bh_enable
+ 0000000000c53b40 D __crc__printk
+ 0000000000c53b44 D __crc__raw_read_lock
+ 0000000000c53b48 D __crc__raw_read_lock_bh
+
+Please notice __crc__mcount is missing here.
+
+When the module subsystem looks up a CRC that comes after, it results
+in reading out a wrong address. For example, when __crc__printk is
+needed, the module subsystem reads 0xc53b44 instead of 0xc53b40.
+
+All CRC entries must be output for correct index accessing. Invalid
+CRCs will be unused, but are needed to keep the one-to-one mapping
+between __ksymtab_* and __crc_*.
+
+The best is to fix all modpost warnings, but several warnings are still
+remaining on less popular architectures.
+
+Fixes: 7b4537199a4a ("kbuild: link symbol CRCs at final link, removing CONFIG_MODULE_REL_CRCS")
+Reported-by: matoro <matoro_mailinglist_kernel@matoro.tk>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Tested-by: matoro <matoro_mailinglist_kernel@matoro.tk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ scripts/mod/modpost.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -2203,13 +2203,11 @@ static void add_exported_symbols(struct
+ /* record CRCs for exported symbols */
+ buf_printf(buf, "\n");
+ list_for_each_entry(sym, &mod->exported_symbols, list) {
+- if (!sym->crc_valid) {
++ if (!sym->crc_valid)
+ warn("EXPORT symbol \"%s\" [%s%s] version generation failed, symbol will not be versioned.\n"
+ "Is \"%s\" prototyped in <asm/asm-prototypes.h>?\n",
+ sym->name, mod->name, mod->is_vmlinux ? "" : ".ko",
+ sym->name);
+- continue;
+- }
+
+ buf_printf(buf, "SYMBOL_CRC(%s, 0x%08x, \"%s\");\n",
+ sym->name, sym->crc, sym->is_gpl_only ? "_gpl" : "");
--- /dev/null
+From 211987f3ac734000ea1548784b2a4539a974fbc8 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Tue, 16 Aug 2022 23:14:45 +0300
+Subject: net: dsa: don't warn in dsa_port_set_state_now() when driver doesn't support it
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+commit 211987f3ac734000ea1548784b2a4539a974fbc8 upstream.
+
+ds->ops->port_stp_state_set() is, like most DSA methods, optional, and
+if absent, the port is supposed to remain in the forwarding state (as
+standalone). Such is the case with the mv88e6060 driver, which does not
+offload the bridge layer. DSA warns that the STP state can't be changed
+to FORWARDING as part of dsa_port_enable_rt(), when in fact it should not.
+
+The error message is also not up to modern standards, so take the
+opportunity to make it more descriptive.
+
+Fixes: fd3645413197 ("net: dsa: change scope of STP state setter")
+Reported-by: Sergei Antonov <saproj@gmail.com>
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Sergei Antonov <saproj@gmail.com>
+Link: https://lore.kernel.org/r/20220816201445.1809483-1-vladimir.oltean@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/dsa/port.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/net/dsa/port.c
++++ b/net/dsa/port.c
+@@ -145,11 +145,14 @@ int dsa_port_set_state(struct dsa_port *
+ static void dsa_port_set_state_now(struct dsa_port *dp, u8 state,
+ bool do_fast_age)
+ {
++ struct dsa_switch *ds = dp->ds;
+ int err;
+
+ err = dsa_port_set_state(dp, state, do_fast_age);
+- if (err)
+- pr_err("DSA: failed to set STP state %u (%d)\n", state, err);
++ if (err && err != -EOPNOTSUPP) {
++ dev_err(ds->dev, "port %d failed to set STP state %u: %pe\n",
++ dp->index, state, ERR_PTR(err));
++ }
+ }
+
+ int dsa_port_set_mst_state(struct dsa_port *dp,
--- /dev/null
+From 40d21c4565bce064c73a03b79a157a3493c518b9 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Tue, 16 Aug 2022 16:53:45 +0300
+Subject: net: dsa: felix: fix ethtool 256-511 and 512-1023 TX packet counters
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+commit 40d21c4565bce064c73a03b79a157a3493c518b9 upstream.
+
+What the driver actually reports as 256-511 is in fact 512-1023, and the
+TX packets in the 256-511 bucket are not reported. Fix that.
+
+Fixes: 56051948773e ("net: dsa: ocelot: add driver for Felix switch family")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/ocelot/felix_vsc9959.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/dsa/ocelot/felix_vsc9959.c
++++ b/drivers/net/dsa/ocelot/felix_vsc9959.c
+@@ -601,7 +601,8 @@ static const struct ocelot_stat_layout v
+ { .offset = 0x87, .name = "tx_frames_below_65_octets", },
+ { .offset = 0x88, .name = "tx_frames_65_to_127_octets", },
+ { .offset = 0x89, .name = "tx_frames_128_255_octets", },
+- { .offset = 0x8B, .name = "tx_frames_256_511_octets", },
++ { .offset = 0x8A, .name = "tx_frames_256_511_octets", },
++ { .offset = 0x8B, .name = "tx_frames_512_1023_octets", },
+ { .offset = 0x8C, .name = "tx_frames_1024_1526_octets", },
+ { .offset = 0x8D, .name = "tx_frames_over_1526_octets", },
+ { .offset = 0x8E, .name = "tx_yellow_prio_0", },
--- /dev/null
+From 36c0d935015766bf20d621c18313f17691bda5e3 Mon Sep 17 00:00:00 2001
+From: Arun Ramadoss <arun.ramadoss@microchip.com>
+Date: Tue, 16 Aug 2022 16:25:16 +0530
+Subject: net: dsa: microchip: ksz9477: fix fdb_dump last invalid entry
+
+From: Arun Ramadoss <arun.ramadoss@microchip.com>
+
+commit 36c0d935015766bf20d621c18313f17691bda5e3 upstream.
+
+In the ksz9477_fdb_dump function it reads the ALU control register and
+exit from the timeout loop if there is valid entry or search is
+complete. After exiting the loop, it reads the alu entry and report to
+the user space irrespective of entry is valid. It works till the valid
+entry. If the loop exited when search is complete, it reads the alu
+table. The table returns all ones and it is reported to user space. So
+bridge fdb show gives ff:ff:ff:ff:ff:ff as last entry for every port.
+To fix it, after exiting the loop the entry is reported only if it is
+valid one.
+
+Fixes: b987e98e50ab ("dsa: add DSA switch driver for Microchip KSZ9477")
+Signed-off-by: Arun Ramadoss <arun.ramadoss@microchip.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Link: https://lore.kernel.org/r/20220816105516.18350-1-arun.ramadoss@microchip.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/microchip/ksz9477.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/dsa/microchip/ksz9477.c
++++ b/drivers/net/dsa/microchip/ksz9477.c
+@@ -658,6 +658,9 @@ static int ksz9477_port_fdb_dump(struct
+ goto exit;
+ }
+
++ if (!(ksz_data & ALU_VALID))
++ continue;
++
+ /* read ALU table */
+ ksz9477_read_table(dev, alu_table);
+
--- /dev/null
+From 246bbf2f977ea36aaf41f5d24370fef433250728 Mon Sep 17 00:00:00 2001
+From: Sergei Antonov <saproj@gmail.com>
+Date: Thu, 11 Aug 2022 10:09:39 +0300
+Subject: net: dsa: mv88e6060: prevent crash on an unused port
+
+From: Sergei Antonov <saproj@gmail.com>
+
+commit 246bbf2f977ea36aaf41f5d24370fef433250728 upstream.
+
+If the port isn't a CPU port nor a user port, 'cpu_dp'
+is a null pointer and a crash happened on dereferencing
+it in mv88e6060_setup_port():
+
+[ 9.575872] Unable to handle kernel NULL pointer dereference at virtual address 00000014
+...
+[ 9.942216] mv88e6060_setup from dsa_register_switch+0x814/0xe84
+[ 9.948616] dsa_register_switch from mdio_probe+0x2c/0x54
+[ 9.954433] mdio_probe from really_probe.part.0+0x98/0x2a0
+[ 9.960375] really_probe.part.0 from driver_probe_device+0x30/0x10c
+[ 9.967029] driver_probe_device from __device_attach_driver+0xb8/0x13c
+[ 9.973946] __device_attach_driver from bus_for_each_drv+0x90/0xe0
+[ 9.980509] bus_for_each_drv from __device_attach+0x110/0x184
+[ 9.986632] __device_attach from bus_probe_device+0x8c/0x94
+[ 9.992577] bus_probe_device from deferred_probe_work_func+0x78/0xa8
+[ 9.999311] deferred_probe_work_func from process_one_work+0x290/0x73c
+[ 10.006292] process_one_work from worker_thread+0x30/0x4b8
+[ 10.012155] worker_thread from kthread+0xd4/0x10c
+[ 10.017238] kthread from ret_from_fork+0x14/0x3c
+
+Fixes: 0abfd494deef ("net: dsa: use dedicated CPU port")
+CC: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
+CC: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sergei Antonov <saproj@gmail.com>
+Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
+Link: https://lore.kernel.org/r/20220811070939.1717146-1-saproj@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/mv88e6060.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/dsa/mv88e6060.c
++++ b/drivers/net/dsa/mv88e6060.c
+@@ -118,6 +118,9 @@ static int mv88e6060_setup_port(struct m
+ int addr = REG_PORT(p);
+ int ret;
+
++ if (dsa_is_unused_port(priv->ds, p))
++ return 0;
++
+ /* Do not force flow control, disable Ingress and Egress
+ * Header tagging, disable VLAN tunneling, and set the port
+ * state to Forwarding. Additionally, if this is the CPU
--- /dev/null
+From fd8e899cdb5ecaf8e8ee73854a99e10807eef1de Mon Sep 17 00:00:00 2001
+From: Rustam Subkhankulov <subkhankulov@ispras.ru>
+Date: Wed, 17 Aug 2022 03:38:45 +0300
+Subject: net: dsa: sja1105: fix buffer overflow in sja1105_setup_devlink_regions()
+
+From: Rustam Subkhankulov <subkhankulov@ispras.ru>
+
+commit fd8e899cdb5ecaf8e8ee73854a99e10807eef1de upstream.
+
+If an error occurs in dsa_devlink_region_create(), then 'priv->regions'
+array will be accessed by negative index '-1'.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Signed-off-by: Rustam Subkhankulov <subkhankulov@ispras.ru>
+Fixes: bf425b82059e ("net: dsa: sja1105: expose static config as devlink region")
+Link: https://lore.kernel.org/r/20220817003845.389644-1-subkhankulov@ispras.ru
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/sja1105/sja1105_devlink.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/dsa/sja1105/sja1105_devlink.c
++++ b/drivers/net/dsa/sja1105/sja1105_devlink.c
+@@ -93,7 +93,7 @@ static int sja1105_setup_devlink_regions
+
+ region = dsa_devlink_region_create(ds, ops, 1, size);
+ if (IS_ERR(region)) {
+- while (i-- >= 0)
++ while (--i >= 0)
+ dsa_devlink_region_destroy(priv->regions[i]);
+ return PTR_ERR(region);
+ }
--- /dev/null
+From 7396ba87f1edf549284869451665c7c4e74ecd4f Mon Sep 17 00:00:00 2001
+From: Xin Xiong <xiongx18@fudan.edu.cn>
+Date: Sat, 13 Aug 2022 20:49:08 +0800
+Subject: net: fix potential refcount leak in ndisc_router_discovery()
+
+From: Xin Xiong <xiongx18@fudan.edu.cn>
+
+commit 7396ba87f1edf549284869451665c7c4e74ecd4f upstream.
+
+The issue happens on specific paths in the function. After both the
+object `rt` and `neigh` are grabbed successfully, when `lifetime` is
+nonzero but the metric needs change, the function just deletes the
+route and set `rt` to NULL. Then, it may try grabbing `rt` and `neigh`
+again if above conditions hold. The function simply overwrite `neigh`
+if succeeds or returns if fails, without decreasing the reference
+count of previous `neigh`. This may result in memory leaks.
+
+Fix it by decrementing the reference count of `neigh` in place.
+
+Fixes: 6b2e04bc240f ("net: allow user to set metric on default route learned via Router Advertisement")
+Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
+Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/ndisc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/ipv6/ndisc.c
++++ b/net/ipv6/ndisc.c
+@@ -1358,6 +1358,9 @@ static void ndisc_router_discovery(struc
+ if (!rt && lifetime) {
+ ND_PRINTK(3, info, "RA: adding default router\n");
+
++ if (neigh)
++ neigh_release(neigh);
++
+ rt = rt6_add_dflt_router(net, &ipv6_hdr(skb)->saddr,
+ skb->dev, pref, defrtr_usr_metric);
+ if (!rt) {
--- /dev/null
+From 249801360db3dec4f73768c502192020bfddeacc Mon Sep 17 00:00:00 2001
+From: Jakub Kicinski <kuba@kernel.org>
+Date: Tue, 16 Aug 2022 09:19:39 -0700
+Subject: net: genl: fix error path memory leak in policy dumping
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+commit 249801360db3dec4f73768c502192020bfddeacc upstream.
+
+If construction of the array of policies fails when recording
+non-first policy we need to unwind.
+
+netlink_policy_dump_add_policy() itself also needs fixing as
+it currently gives up on error without recording the allocated
+pointer in the pstate pointer.
+
+Reported-by: syzbot+dc54d9ba8153b216cae0@syzkaller.appspotmail.com
+Fixes: 50a896cf2d6f ("genetlink: properly support per-op policy dumping")
+Link: https://lore.kernel.org/r/20220816161939.577583-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netlink/genetlink.c | 6 +++++-
+ net/netlink/policy.c | 14 ++++++++++++--
+ 2 files changed, 17 insertions(+), 3 deletions(-)
+
+--- a/net/netlink/genetlink.c
++++ b/net/netlink/genetlink.c
+@@ -1174,13 +1174,17 @@ static int ctrl_dumppolicy_start(struct
+ op.policy,
+ op.maxattr);
+ if (err)
+- return err;
++ goto err_free_state;
+ }
+ }
+
+ if (!ctx->state)
+ return -ENODATA;
+ return 0;
++
++err_free_state:
++ netlink_policy_dump_free(ctx->state);
++ return err;
+ }
+
+ static void *ctrl_dumppolicy_prep(struct sk_buff *skb,
+--- a/net/netlink/policy.c
++++ b/net/netlink/policy.c
+@@ -144,7 +144,7 @@ int netlink_policy_dump_add_policy(struc
+
+ err = add_policy(&state, policy, maxtype);
+ if (err)
+- return err;
++ goto err_try_undo;
+
+ for (policy_idx = 0;
+ policy_idx < state->n_alloc && state->policies[policy_idx].policy;
+@@ -164,7 +164,7 @@ int netlink_policy_dump_add_policy(struc
+ policy[type].nested_policy,
+ policy[type].len);
+ if (err)
+- return err;
++ goto err_try_undo;
+ break;
+ default:
+ break;
+@@ -174,6 +174,16 @@ int netlink_policy_dump_add_policy(struc
+
+ *pstate = state;
+ return 0;
++
++err_try_undo:
++ /* Try to preserve reasonable unwind semantics - if we're starting from
++ * scratch clean up fully, otherwise record what we got and caller will.
++ */
++ if (!*pstate)
++ netlink_policy_dump_free(state);
++ else
++ *pstate = state;
++ return err;
+ }
+
+ static bool
--- /dev/null
+From 3a12df22a8f68954a4ba48435c06b3d1791c87c4 Mon Sep 17 00:00:00 2001
+From: Sergei Antonov <saproj@gmail.com>
+Date: Fri, 12 Aug 2022 20:13:39 +0300
+Subject: net: moxa: pass pdev instead of ndev to DMA functions
+
+From: Sergei Antonov <saproj@gmail.com>
+
+commit 3a12df22a8f68954a4ba48435c06b3d1791c87c4 upstream.
+
+dma_map_single() calls fail in moxart_mac_setup_desc_ring() and
+moxart_mac_start_xmit() which leads to an incessant output of this:
+
+[ 16.043925] moxart-ethernet 92000000.mac eth0: DMA mapping error
+[ 16.050957] moxart-ethernet 92000000.mac eth0: DMA mapping error
+[ 16.058229] moxart-ethernet 92000000.mac eth0: DMA mapping error
+
+Passing pdev to DMA is a common approach among net drivers.
+
+Fixes: 6c821bd9edc9 ("net: Add MOXA ART SoCs ethernet driver")
+Signed-off-by: Sergei Antonov <saproj@gmail.com>
+Suggested-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lore.kernel.org/r/20220812171339.2271788-1-saproj@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/moxa/moxart_ether.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/ethernet/moxa/moxart_ether.c
++++ b/drivers/net/ethernet/moxa/moxart_ether.c
+@@ -77,7 +77,7 @@ static void moxart_mac_free_memory(struc
+ int i;
+
+ for (i = 0; i < RX_DESC_NUM; i++)
+- dma_unmap_single(&ndev->dev, priv->rx_mapping[i],
++ dma_unmap_single(&priv->pdev->dev, priv->rx_mapping[i],
+ priv->rx_buf_size, DMA_FROM_DEVICE);
+
+ if (priv->tx_desc_base)
+@@ -147,11 +147,11 @@ static void moxart_mac_setup_desc_ring(s
+ desc + RX_REG_OFFSET_DESC1);
+
+ priv->rx_buf[i] = priv->rx_buf_base + priv->rx_buf_size * i;
+- priv->rx_mapping[i] = dma_map_single(&ndev->dev,
++ priv->rx_mapping[i] = dma_map_single(&priv->pdev->dev,
+ priv->rx_buf[i],
+ priv->rx_buf_size,
+ DMA_FROM_DEVICE);
+- if (dma_mapping_error(&ndev->dev, priv->rx_mapping[i]))
++ if (dma_mapping_error(&priv->pdev->dev, priv->rx_mapping[i]))
+ netdev_err(ndev, "DMA mapping error\n");
+
+ moxart_desc_write(priv->rx_mapping[i],
+@@ -240,7 +240,7 @@ static int moxart_rx_poll(struct napi_st
+ if (len > RX_BUF_SIZE)
+ len = RX_BUF_SIZE;
+
+- dma_sync_single_for_cpu(&ndev->dev,
++ dma_sync_single_for_cpu(&priv->pdev->dev,
+ priv->rx_mapping[rx_head],
+ priv->rx_buf_size, DMA_FROM_DEVICE);
+ skb = netdev_alloc_skb_ip_align(ndev, len);
+@@ -294,7 +294,7 @@ static void moxart_tx_finished(struct ne
+ unsigned int tx_tail = priv->tx_tail;
+
+ while (tx_tail != tx_head) {
+- dma_unmap_single(&ndev->dev, priv->tx_mapping[tx_tail],
++ dma_unmap_single(&priv->pdev->dev, priv->tx_mapping[tx_tail],
+ priv->tx_len[tx_tail], DMA_TO_DEVICE);
+
+ ndev->stats.tx_packets++;
+@@ -358,9 +358,9 @@ static netdev_tx_t moxart_mac_start_xmit
+
+ len = skb->len > TX_BUF_SIZE ? TX_BUF_SIZE : skb->len;
+
+- priv->tx_mapping[tx_head] = dma_map_single(&ndev->dev, skb->data,
++ priv->tx_mapping[tx_head] = dma_map_single(&priv->pdev->dev, skb->data,
+ len, DMA_TO_DEVICE);
+- if (dma_mapping_error(&ndev->dev, priv->tx_mapping[tx_head])) {
++ if (dma_mapping_error(&priv->pdev->dev, priv->tx_mapping[tx_head])) {
+ netdev_err(ndev, "DMA mapping error\n");
+ goto out_unlock;
+ }
+@@ -379,7 +379,7 @@ static netdev_tx_t moxart_mac_start_xmit
+ len = ETH_ZLEN;
+ }
+
+- dma_sync_single_for_device(&ndev->dev, priv->tx_mapping[tx_head],
++ dma_sync_single_for_device(&priv->pdev->dev, priv->tx_mapping[tx_head],
+ priv->tx_buf_size, DMA_TO_DEVICE);
+
+ txdes1 = TX_DESC1_LTS | TX_DESC1_FTS | (len & TX_DESC1_BUF_SIZE_MASK);
+@@ -493,7 +493,7 @@ static int moxart_mac_probe(struct platf
+ priv->tx_buf_size = TX_BUF_SIZE;
+ priv->rx_buf_size = RX_BUF_SIZE;
+
+- priv->tx_desc_base = dma_alloc_coherent(&pdev->dev, TX_REG_DESC_SIZE *
++ priv->tx_desc_base = dma_alloc_coherent(p_dev, TX_REG_DESC_SIZE *
+ TX_DESC_NUM, &priv->tx_base,
+ GFP_DMA | GFP_KERNEL);
+ if (!priv->tx_desc_base) {
+@@ -501,7 +501,7 @@ static int moxart_mac_probe(struct platf
+ goto init_fail;
+ }
+
+- priv->rx_desc_base = dma_alloc_coherent(&pdev->dev, RX_REG_DESC_SIZE *
++ priv->rx_desc_base = dma_alloc_coherent(p_dev, RX_REG_DESC_SIZE *
+ RX_DESC_NUM, &priv->rx_base,
+ GFP_DMA | GFP_KERNEL);
+ if (!priv->rx_desc_base) {
--- /dev/null
+From 173ca86618d751bd183456c9cdbb69952ba283c8 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Tue, 16 Aug 2022 16:53:47 +0300
+Subject: net: mscc: ocelot: fix address of SYS_COUNT_TX_AGING counter
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+commit 173ca86618d751bd183456c9cdbb69952ba283c8 upstream.
+
+This register, used as part of stats->tx_dropped in
+ocelot_get_stats64(), has a wrong address. At the address currently
+given, there is actually the c_tx_green_prio_6 counter.
+
+Fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mscc/vsc7514_regs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mscc/vsc7514_regs.c
++++ b/drivers/net/ethernet/mscc/vsc7514_regs.c
+@@ -202,7 +202,7 @@ const u32 vsc7514_sys_regmap[] = {
+ REG(SYS_COUNT_TX_512_1023, 0x00012c),
+ REG(SYS_COUNT_TX_1024_1526, 0x000130),
+ REG(SYS_COUNT_TX_1527_MAX, 0x000134),
+- REG(SYS_COUNT_TX_AGING, 0x000170),
++ REG(SYS_COUNT_TX_AGING, 0x000178),
+ REG(SYS_RESET_CFG, 0x000508),
+ REG(SYS_CMID, 0x00050c),
+ REG(SYS_VLAN_ETYPE_CFG, 0x000510),
--- /dev/null
+From 5152de7b79ab0be150f5966481b0c8f996192531 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Tue, 16 Aug 2022 16:53:46 +0300
+Subject: net: mscc: ocelot: fix incorrect ndo_get_stats64 packet counters
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+commit 5152de7b79ab0be150f5966481b0c8f996192531 upstream.
+
+Reading stats using the SYS_COUNT_* register definitions is only used by
+ocelot_get_stats64() from the ocelot switchdev driver, however,
+currently the bucket definitions are incorrect.
+
+Separately, on both RX and TX, we have the following problems:
+- a 256-1023 bucket which actually tracks the 256-511 packets
+- the 1024-1526 bucket actually tracks the 512-1023 packets
+- the 1527-max bucket actually tracks the 1024-1526 packets
+
+=> nobody tracks the packets from the real 1527-max bucket
+
+Additionally, the RX_PAUSE, RX_CONTROL, RX_LONGS and RX_CLASSIFIED_DROPS
+all track the wrong thing. However this doesn't seem to have any
+consequence, since ocelot_get_stats64() doesn't use these.
+
+Even though this problem only manifests itself for the switchdev driver,
+we cannot split the fix for ocelot and for DSA, since it requires fixing
+the bucket definitions from enum ocelot_reg, which makes us necessarily
+adapt the structures from felix and seville as well.
+
+Fixes: 84705fc16552 ("net: dsa: felix: introduce support for Seville VSC9953 switch")
+Fixes: 56051948773e ("net: dsa: ocelot: add driver for Felix switch family")
+Fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/ocelot/felix_vsc9959.c | 20 ++++++++++++--------
+ drivers/net/dsa/ocelot/seville_vsc9953.c | 16 +++++++++-------
+ drivers/net/ethernet/mscc/ocelot_net.c | 6 ++++--
+ drivers/net/ethernet/mscc/vsc7514_regs.c | 24 +++++++++++++-----------
+ include/soc/mscc/ocelot.h | 6 ++++--
+ 5 files changed, 42 insertions(+), 30 deletions(-)
+
+--- a/drivers/net/dsa/ocelot/felix_vsc9959.c
++++ b/drivers/net/dsa/ocelot/felix_vsc9959.c
+@@ -280,19 +280,23 @@ static const u32 vsc9959_sys_regmap[] =
+ REG(SYS_COUNT_RX_64, 0x000024),
+ REG(SYS_COUNT_RX_65_127, 0x000028),
+ REG(SYS_COUNT_RX_128_255, 0x00002c),
+- REG(SYS_COUNT_RX_256_1023, 0x000030),
+- REG(SYS_COUNT_RX_1024_1526, 0x000034),
+- REG(SYS_COUNT_RX_1527_MAX, 0x000038),
+- REG(SYS_COUNT_RX_LONGS, 0x000044),
++ REG(SYS_COUNT_RX_256_511, 0x000030),
++ REG(SYS_COUNT_RX_512_1023, 0x000034),
++ REG(SYS_COUNT_RX_1024_1526, 0x000038),
++ REG(SYS_COUNT_RX_1527_MAX, 0x00003c),
++ REG(SYS_COUNT_RX_PAUSE, 0x000040),
++ REG(SYS_COUNT_RX_CONTROL, 0x000044),
++ REG(SYS_COUNT_RX_LONGS, 0x000048),
+ REG(SYS_COUNT_TX_OCTETS, 0x000200),
+ REG(SYS_COUNT_TX_COLLISION, 0x000210),
+ REG(SYS_COUNT_TX_DROPS, 0x000214),
+ REG(SYS_COUNT_TX_64, 0x00021c),
+ REG(SYS_COUNT_TX_65_127, 0x000220),
+- REG(SYS_COUNT_TX_128_511, 0x000224),
+- REG(SYS_COUNT_TX_512_1023, 0x000228),
+- REG(SYS_COUNT_TX_1024_1526, 0x00022c),
+- REG(SYS_COUNT_TX_1527_MAX, 0x000230),
++ REG(SYS_COUNT_TX_128_255, 0x000224),
++ REG(SYS_COUNT_TX_256_511, 0x000228),
++ REG(SYS_COUNT_TX_512_1023, 0x00022c),
++ REG(SYS_COUNT_TX_1024_1526, 0x000230),
++ REG(SYS_COUNT_TX_1527_MAX, 0x000234),
+ REG(SYS_COUNT_TX_AGING, 0x000278),
+ REG(SYS_RESET_CFG, 0x000e00),
+ REG(SYS_SR_ETYPE_CFG, 0x000e04),
+--- a/drivers/net/dsa/ocelot/seville_vsc9953.c
++++ b/drivers/net/dsa/ocelot/seville_vsc9953.c
+@@ -277,19 +277,21 @@ static const u32 vsc9953_sys_regmap[] =
+ REG(SYS_COUNT_RX_64, 0x000024),
+ REG(SYS_COUNT_RX_65_127, 0x000028),
+ REG(SYS_COUNT_RX_128_255, 0x00002c),
+- REG(SYS_COUNT_RX_256_1023, 0x000030),
+- REG(SYS_COUNT_RX_1024_1526, 0x000034),
+- REG(SYS_COUNT_RX_1527_MAX, 0x000038),
++ REG(SYS_COUNT_RX_256_511, 0x000030),
++ REG(SYS_COUNT_RX_512_1023, 0x000034),
++ REG(SYS_COUNT_RX_1024_1526, 0x000038),
++ REG(SYS_COUNT_RX_1527_MAX, 0x00003c),
+ REG(SYS_COUNT_RX_LONGS, 0x000048),
+ REG(SYS_COUNT_TX_OCTETS, 0x000100),
+ REG(SYS_COUNT_TX_COLLISION, 0x000110),
+ REG(SYS_COUNT_TX_DROPS, 0x000114),
+ REG(SYS_COUNT_TX_64, 0x00011c),
+ REG(SYS_COUNT_TX_65_127, 0x000120),
+- REG(SYS_COUNT_TX_128_511, 0x000124),
+- REG(SYS_COUNT_TX_512_1023, 0x000128),
+- REG(SYS_COUNT_TX_1024_1526, 0x00012c),
+- REG(SYS_COUNT_TX_1527_MAX, 0x000130),
++ REG(SYS_COUNT_TX_128_255, 0x000124),
++ REG(SYS_COUNT_TX_256_511, 0x000128),
++ REG(SYS_COUNT_TX_512_1023, 0x00012c),
++ REG(SYS_COUNT_TX_1024_1526, 0x000130),
++ REG(SYS_COUNT_TX_1527_MAX, 0x000134),
+ REG(SYS_COUNT_TX_AGING, 0x000178),
+ REG(SYS_RESET_CFG, 0x000318),
+ REG_RESERVED(SYS_SR_ETYPE_CFG),
+--- a/drivers/net/ethernet/mscc/ocelot_net.c
++++ b/drivers/net/ethernet/mscc/ocelot_net.c
+@@ -739,7 +739,8 @@ static void ocelot_get_stats64(struct ne
+ ocelot_read(ocelot, SYS_COUNT_RX_64) +
+ ocelot_read(ocelot, SYS_COUNT_RX_65_127) +
+ ocelot_read(ocelot, SYS_COUNT_RX_128_255) +
+- ocelot_read(ocelot, SYS_COUNT_RX_256_1023) +
++ ocelot_read(ocelot, SYS_COUNT_RX_256_511) +
++ ocelot_read(ocelot, SYS_COUNT_RX_512_1023) +
+ ocelot_read(ocelot, SYS_COUNT_RX_1024_1526) +
+ ocelot_read(ocelot, SYS_COUNT_RX_1527_MAX);
+ stats->multicast = ocelot_read(ocelot, SYS_COUNT_RX_MULTICAST);
+@@ -749,7 +750,8 @@ static void ocelot_get_stats64(struct ne
+ stats->tx_bytes = ocelot_read(ocelot, SYS_COUNT_TX_OCTETS);
+ stats->tx_packets = ocelot_read(ocelot, SYS_COUNT_TX_64) +
+ ocelot_read(ocelot, SYS_COUNT_TX_65_127) +
+- ocelot_read(ocelot, SYS_COUNT_TX_128_511) +
++ ocelot_read(ocelot, SYS_COUNT_TX_128_255) +
++ ocelot_read(ocelot, SYS_COUNT_TX_256_511) +
+ ocelot_read(ocelot, SYS_COUNT_TX_512_1023) +
+ ocelot_read(ocelot, SYS_COUNT_TX_1024_1526) +
+ ocelot_read(ocelot, SYS_COUNT_TX_1527_MAX);
+--- a/drivers/net/ethernet/mscc/vsc7514_regs.c
++++ b/drivers/net/ethernet/mscc/vsc7514_regs.c
+@@ -180,13 +180,14 @@ const u32 vsc7514_sys_regmap[] = {
+ REG(SYS_COUNT_RX_64, 0x000024),
+ REG(SYS_COUNT_RX_65_127, 0x000028),
+ REG(SYS_COUNT_RX_128_255, 0x00002c),
+- REG(SYS_COUNT_RX_256_1023, 0x000030),
+- REG(SYS_COUNT_RX_1024_1526, 0x000034),
+- REG(SYS_COUNT_RX_1527_MAX, 0x000038),
+- REG(SYS_COUNT_RX_PAUSE, 0x00003c),
+- REG(SYS_COUNT_RX_CONTROL, 0x000040),
+- REG(SYS_COUNT_RX_LONGS, 0x000044),
+- REG(SYS_COUNT_RX_CLASSIFIED_DROPS, 0x000048),
++ REG(SYS_COUNT_RX_256_511, 0x000030),
++ REG(SYS_COUNT_RX_512_1023, 0x000034),
++ REG(SYS_COUNT_RX_1024_1526, 0x000038),
++ REG(SYS_COUNT_RX_1527_MAX, 0x00003c),
++ REG(SYS_COUNT_RX_PAUSE, 0x000040),
++ REG(SYS_COUNT_RX_CONTROL, 0x000044),
++ REG(SYS_COUNT_RX_LONGS, 0x000048),
++ REG(SYS_COUNT_RX_CLASSIFIED_DROPS, 0x00004c),
+ REG(SYS_COUNT_TX_OCTETS, 0x000100),
+ REG(SYS_COUNT_TX_UNICAST, 0x000104),
+ REG(SYS_COUNT_TX_MULTICAST, 0x000108),
+@@ -196,10 +197,11 @@ const u32 vsc7514_sys_regmap[] = {
+ REG(SYS_COUNT_TX_PAUSE, 0x000118),
+ REG(SYS_COUNT_TX_64, 0x00011c),
+ REG(SYS_COUNT_TX_65_127, 0x000120),
+- REG(SYS_COUNT_TX_128_511, 0x000124),
+- REG(SYS_COUNT_TX_512_1023, 0x000128),
+- REG(SYS_COUNT_TX_1024_1526, 0x00012c),
+- REG(SYS_COUNT_TX_1527_MAX, 0x000130),
++ REG(SYS_COUNT_TX_128_255, 0x000124),
++ REG(SYS_COUNT_TX_256_511, 0x000128),
++ REG(SYS_COUNT_TX_512_1023, 0x00012c),
++ REG(SYS_COUNT_TX_1024_1526, 0x000130),
++ REG(SYS_COUNT_TX_1527_MAX, 0x000134),
+ REG(SYS_COUNT_TX_AGING, 0x000170),
+ REG(SYS_RESET_CFG, 0x000508),
+ REG(SYS_CMID, 0x00050c),
+--- a/include/soc/mscc/ocelot.h
++++ b/include/soc/mscc/ocelot.h
+@@ -335,7 +335,8 @@ enum ocelot_reg {
+ SYS_COUNT_RX_64,
+ SYS_COUNT_RX_65_127,
+ SYS_COUNT_RX_128_255,
+- SYS_COUNT_RX_256_1023,
++ SYS_COUNT_RX_256_511,
++ SYS_COUNT_RX_512_1023,
+ SYS_COUNT_RX_1024_1526,
+ SYS_COUNT_RX_1527_MAX,
+ SYS_COUNT_RX_PAUSE,
+@@ -351,7 +352,8 @@ enum ocelot_reg {
+ SYS_COUNT_TX_PAUSE,
+ SYS_COUNT_TX_64,
+ SYS_COUNT_TX_65_127,
+- SYS_COUNT_TX_128_511,
++ SYS_COUNT_TX_128_255,
++ SYS_COUNT_TX_256_511,
+ SYS_COUNT_TX_512_1023,
+ SYS_COUNT_TX_1024_1526,
+ SYS_COUNT_TX_1527_MAX,
--- /dev/null
+From 68a838b84effb7b57ba7d50b1863fc6ae35a54ce Mon Sep 17 00:00:00 2001
+From: Maxim Kochetkov <fido_max@inbox.ru>
+Date: Thu, 11 Aug 2022 12:48:40 +0300
+Subject: net: qrtr: start MHI channel after endpoit creation
+
+From: Maxim Kochetkov <fido_max@inbox.ru>
+
+commit 68a838b84effb7b57ba7d50b1863fc6ae35a54ce upstream.
+
+MHI channel may generates event/interrupt right after enabling.
+It may leads to 2 race conditions issues.
+
+1)
+Such event may be dropped by qcom_mhi_qrtr_dl_callback() at check:
+
+ if (!qdev || mhi_res->transaction_status)
+ return;
+
+Because dev_set_drvdata(&mhi_dev->dev, qdev) may be not performed at
+this moment. In this situation qrtr-ns will be unable to enumerate
+services in device.
+---------------------------------------------------------------
+
+2)
+Such event may come at the moment after dev_set_drvdata() and
+before qrtr_endpoint_register(). In this case kernel will panic with
+accessing wrong pointer at qcom_mhi_qrtr_dl_callback():
+
+ rc = qrtr_endpoint_post(&qdev->ep, mhi_res->buf_addr,
+ mhi_res->bytes_xferd);
+
+Because endpoint is not created yet.
+--------------------------------------------------------------
+So move mhi_prepare_for_transfer_autoqueue after endpoint creation
+to fix it.
+
+Fixes: a2e2cc0dbb11 ("net: qrtr: Start MHI channels during init")
+Signed-off-by: Maxim Kochetkov <fido_max@inbox.ru>
+Reviewed-by: Hemant Kumar <quic_hemantk@quicinc.com>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Reviewed-by: Loic Poulain <loic.poulain@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/qrtr/mhi.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/net/qrtr/mhi.c
++++ b/net/qrtr/mhi.c
+@@ -78,11 +78,6 @@ static int qcom_mhi_qrtr_probe(struct mh
+ struct qrtr_mhi_dev *qdev;
+ int rc;
+
+- /* start channels */
+- rc = mhi_prepare_for_transfer_autoqueue(mhi_dev);
+- if (rc)
+- return rc;
+-
+ qdev = devm_kzalloc(&mhi_dev->dev, sizeof(*qdev), GFP_KERNEL);
+ if (!qdev)
+ return -ENOMEM;
+@@ -96,6 +91,13 @@ static int qcom_mhi_qrtr_probe(struct mh
+ if (rc)
+ return rc;
+
++ /* start channels */
++ rc = mhi_prepare_for_transfer_autoqueue(mhi_dev);
++ if (rc) {
++ qrtr_endpoint_unregister(&qdev->ep);
++ return rc;
++ }
++
+ dev_dbg(qdev->dev, "Qualcomm MHI QRTR driver probed\n");
+
+ return 0;
--- /dev/null
+From 5b22f62724a0a09e00d301abf5b57b0c12be8a16 Mon Sep 17 00:00:00 2001
+From: Zhengchao Shao <shaozhengchao@huawei.com>
+Date: Mon, 15 Aug 2022 10:46:29 +0800
+Subject: net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg
+
+From: Zhengchao Shao <shaozhengchao@huawei.com>
+
+commit 5b22f62724a0a09e00d301abf5b57b0c12be8a16 upstream.
+
+When bulk delete command is received in the rtnetlink_rcv_msg function,
+if bulk delete is not supported, module_put is not called to release
+the reference counting. As a result, module reference count is leaked.
+
+Fixes: a6cec0bcd342 ("net: rtnetlink: add bulk delete support flag")
+Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
+Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://lore.kernel.org/r/20220815024629.240367-1-shaozhengchao@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/rtnetlink.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index ac45328607f7..4b5b15c684ed 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -6070,6 +6070,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
+ if (kind == RTNL_KIND_DEL && (nlh->nlmsg_flags & NLM_F_BULK) &&
+ !(flags & RTNL_FLAG_BULK_DEL_SUPPORTED)) {
+ NL_SET_ERR_MSG(extack, "Bulk delete is not supported");
++ module_put(owner);
+ goto err_unlock;
+ }
+
+--
+2.37.2
+
--- /dev/null
+From de64b6b6fb6f369840d171b7c5a9baf31b8b2630 Mon Sep 17 00:00:00 2001
+From: Zhengchao Shao <shaozhengchao@huawei.com>
+Date: Mon, 15 Aug 2022 11:08:48 +0800
+Subject: net: sched: fix misuse of qcpu->backlog in gnet_stats_add_queue_cpu
+
+From: Zhengchao Shao <shaozhengchao@huawei.com>
+
+commit de64b6b6fb6f369840d171b7c5a9baf31b8b2630 upstream.
+
+In the gnet_stats_add_queue_cpu function, the qstats->qlen statistics
+are incorrectly set to qcpu->backlog.
+
+Fixes: 448e163f8b9b ("gen_stats: Add gnet_stats_add_queue()")
+Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
+Link: https://lore.kernel.org/r/20220815030848.276746-1-shaozhengchao@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/gen_stats.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/core/gen_stats.c
++++ b/net/core/gen_stats.c
+@@ -345,7 +345,7 @@ static void gnet_stats_add_queue_cpu(str
+ for_each_possible_cpu(i) {
+ const struct gnet_stats_queue *qcpu = per_cpu_ptr(q, i);
+
+- qstats->qlen += qcpu->backlog;
++ qstats->qlen += qcpu->qlen;
+ qstats->backlog += qcpu->backlog;
+ qstats->drops += qcpu->drops;
+ qstats->requeues += qcpu->requeues;
--- /dev/null
+From bfc48f1b0505ffcb03a6d749139b7577d6b81ae0 Mon Sep 17 00:00:00 2001
+From: Xin Xiong <xiongx18@fudan.edu.cn>
+Date: Wed, 10 Aug 2022 23:29:13 +0800
+Subject: net/sunrpc: fix potential memory leaks in rpc_sysfs_xprt_state_change()
+
+From: Xin Xiong <xiongx18@fudan.edu.cn>
+
+commit bfc48f1b0505ffcb03a6d749139b7577d6b81ae0 upstream.
+
+The issue happens on some error handling paths. When the function
+fails to grab the object `xprt`, it simply returns 0, forgetting to
+decrease the reference count of another object `xps`, which is
+increased by rpc_sysfs_xprt_kobj_get_xprt_switch(), causing refcount
+leaks. Also, the function forgets to check whether `xps` is valid
+before using it, which may result in NULL-dereferencing issues.
+
+Fix it by adding proper error handling code when either `xprt` or
+`xps` is NULL.
+
+Fixes: 5b7eb78486cd ("SUNRPC: take a xprt offline using sysfs")
+Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
+Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sunrpc/sysfs.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/net/sunrpc/sysfs.c
++++ b/net/sunrpc/sysfs.c
+@@ -291,8 +291,10 @@ static ssize_t rpc_sysfs_xprt_state_chan
+ int offline = 0, online = 0, remove = 0;
+ struct rpc_xprt_switch *xps = rpc_sysfs_xprt_kobj_get_xprt_switch(kobj);
+
+- if (!xprt)
+- return 0;
++ if (!xprt || !xps) {
++ count = 0;
++ goto out_put;
++ }
+
+ if (!strncmp(buf, "offline", 7))
+ offline = 1;
--- /dev/null
+From c783a29c7e5934eabac2b760571489ad83bf4fd1 Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Tue, 9 Aug 2022 15:16:34 +0200
+Subject: netfilter: nf_ct_ftp: prefer skb_linearize
+
+From: Florian Westphal <fw@strlen.de>
+
+commit c783a29c7e5934eabac2b760571489ad83bf4fd1 upstream.
+
+This uses a pseudo-linearization scheme with a 64k global buffer,
+but BIG TCP arrival means IPv6 TCP stack can generate skbs
+that exceed this size.
+
+Use skb_linearize. It should be possible to rewrite this to properly
+deal with segmented skbs (i.e., only do small chunk-wise accesses),
+but this is going to be a lot more intrusive than this because every
+helper function needs to get the sk_buff instead of a pointer to a raw
+data buffer.
+
+In practice, provided we're really looking at FTP control channel packets,
+there should never be a case where we deal with huge packets.
+
+Fixes: 7c4e983c4f3c ("net: allow gso_max_size to exceed 65536")
+Fixes: 0fe79f28bfaf ("net: allow gro_max_size to exceed 65536")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_conntrack_ftp.c | 24 ++++++------------------
+ 1 file changed, 6 insertions(+), 18 deletions(-)
+
+diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
+index a414274338cf..0d9332e9cf71 100644
+--- a/net/netfilter/nf_conntrack_ftp.c
++++ b/net/netfilter/nf_conntrack_ftp.c
+@@ -34,11 +34,6 @@ MODULE_DESCRIPTION("ftp connection tracking helper");
+ MODULE_ALIAS("ip_conntrack_ftp");
+ MODULE_ALIAS_NFCT_HELPER(HELPER_NAME);
+
+-/* This is slow, but it's simple. --RR */
+-static char *ftp_buffer;
+-
+-static DEFINE_SPINLOCK(nf_ftp_lock);
+-
+ #define MAX_PORTS 8
+ static u_int16_t ports[MAX_PORTS];
+ static unsigned int ports_c;
+@@ -398,6 +393,9 @@ static int help(struct sk_buff *skb,
+ return NF_ACCEPT;
+ }
+
++ if (unlikely(skb_linearize(skb)))
++ return NF_DROP;
++
+ th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
+ if (th == NULL)
+ return NF_ACCEPT;
+@@ -411,12 +409,8 @@ static int help(struct sk_buff *skb,
+ }
+ datalen = skb->len - dataoff;
+
+- spin_lock_bh(&nf_ftp_lock);
+- fb_ptr = skb_header_pointer(skb, dataoff, datalen, ftp_buffer);
+- if (!fb_ptr) {
+- spin_unlock_bh(&nf_ftp_lock);
+- return NF_ACCEPT;
+- }
++ spin_lock_bh(&ct->lock);
++ fb_ptr = skb->data + dataoff;
+
+ ends_in_nl = (fb_ptr[datalen - 1] == '\n');
+ seq = ntohl(th->seq) + datalen;
+@@ -544,7 +538,7 @@ static int help(struct sk_buff *skb,
+ if (ends_in_nl)
+ update_nl_seq(ct, seq, ct_ftp_info, dir, skb);
+ out:
+- spin_unlock_bh(&nf_ftp_lock);
++ spin_unlock_bh(&ct->lock);
+ return ret;
+ }
+
+@@ -571,7 +565,6 @@ static const struct nf_conntrack_expect_policy ftp_exp_policy = {
+ static void __exit nf_conntrack_ftp_fini(void)
+ {
+ nf_conntrack_helpers_unregister(ftp, ports_c * 2);
+- kfree(ftp_buffer);
+ }
+
+ static int __init nf_conntrack_ftp_init(void)
+@@ -580,10 +573,6 @@ static int __init nf_conntrack_ftp_init(void)
+
+ NF_CT_HELPER_BUILD_BUG_ON(sizeof(struct nf_ct_ftp_master));
+
+- ftp_buffer = kmalloc(65536, GFP_KERNEL);
+- if (!ftp_buffer)
+- return -ENOMEM;
+-
+ if (ports_c == 0)
+ ports[ports_c++] = FTP_PORT;
+
+@@ -603,7 +592,6 @@ static int __init nf_conntrack_ftp_init(void)
+ ret = nf_conntrack_helpers_register(ftp, ports_c * 2);
+ if (ret < 0) {
+ pr_err("failed to register helpers\n");
+- kfree(ftp_buffer);
+ return ret;
+ }
+
+--
+2.37.2
+
--- /dev/null
+From f3e124c36f70d5ffcdd4e8bdbe7bb28a98a715c0 Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Tue, 9 Aug 2022 15:16:33 +0200
+Subject: netfilter: nf_ct_h323: cap packet size at 64k
+
+From: Florian Westphal <fw@strlen.de>
+
+commit f3e124c36f70d5ffcdd4e8bdbe7bb28a98a715c0 upstream.
+
+With BIG TCP, packets generated by tcp stack may exceed 64kb.
+Cap datalen at 64kb. The internal message format uses 16bit fields,
+so no embedded message can exceed 64k size.
+
+Multiple h323 messages in a single superpacket may now result
+in a message to get treated as incomplete/truncated, but thats
+better than scribbling past h323_buffer.
+
+Another alternative suitable for net tree would be a switch to
+skb_linearize().
+
+Fixes: 7c4e983c4f3c ("net: allow gso_max_size to exceed 65536")
+Fixes: 0fe79f28bfaf ("net: allow gro_max_size to exceed 65536")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_conntrack_h323_main.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/net/netfilter/nf_conntrack_h323_main.c
++++ b/net/netfilter/nf_conntrack_h323_main.c
+@@ -34,6 +34,8 @@
+ #include <net/netfilter/nf_conntrack_zones.h>
+ #include <linux/netfilter/nf_conntrack_h323.h>
+
++#define H323_MAX_SIZE 65535
++
+ /* Parameters */
+ static unsigned int default_rrq_ttl __read_mostly = 300;
+ module_param(default_rrq_ttl, uint, 0600);
+@@ -142,6 +144,9 @@ static int get_tpkt_data(struct sk_buff
+ if (tcpdatalen <= 0) /* No TCP data */
+ goto clear_out;
+
++ if (tcpdatalen > H323_MAX_SIZE)
++ tcpdatalen = H323_MAX_SIZE;
++
+ if (*data == NULL) { /* first TPKT */
+ /* Get first TPKT pointer */
+ tpkt = skb_header_pointer(skb, tcpdataoff, tcpdatalen,
+@@ -1220,6 +1225,9 @@ static unsigned char *get_udp_data(struc
+ if (dataoff >= skb->len)
+ return NULL;
+ *datalen = skb->len - dataoff;
++ if (*datalen > H323_MAX_SIZE)
++ *datalen = H323_MAX_SIZE;
++
+ return skb_header_pointer(skb, dataoff, *datalen, h323_buffer);
+ }
+
+@@ -1821,7 +1829,7 @@ static int __init nf_conntrack_h323_init
+
+ NF_CT_HELPER_BUILD_BUG_ON(sizeof(struct nf_ct_h323_master));
+
+- h323_buffer = kmalloc(65536, GFP_KERNEL);
++ h323_buffer = kmalloc(H323_MAX_SIZE + 1, GFP_KERNEL);
+ if (!h323_buffer)
+ return -ENOMEM;
+ ret = h323_helper_init();
--- /dev/null
+From 976bf59c69cd2e2c17f0ab20a14c0e700cba0f15 Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Tue, 9 Aug 2022 15:16:35 +0200
+Subject: netfilter: nf_ct_irc: cap packet search space to 4k
+
+From: Florian Westphal <fw@strlen.de>
+
+commit 976bf59c69cd2e2c17f0ab20a14c0e700cba0f15 upstream.
+
+This uses a pseudo-linearization scheme with a 64k global buffer,
+but BIG TCP arrival means IPv6 TCP stack can generate skbs
+that exceed this size.
+
+In practice, IRC commands are not expected to exceed 512 bytes, plus
+this is interactive protocol, so we should not see large packets
+in practice.
+
+Given most IRC connections nowadays use TLS so this helper could also be
+removed in the near future.
+
+Fixes: 7c4e983c4f3c ("net: allow gso_max_size to exceed 65536")
+Fixes: 0fe79f28bfaf ("net: allow gro_max_size to exceed 65536")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_conntrack_irc.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
+index 08ee4e760a3d..1796c456ac98 100644
+--- a/net/netfilter/nf_conntrack_irc.c
++++ b/net/netfilter/nf_conntrack_irc.c
+@@ -39,6 +39,7 @@ unsigned int (*nf_nat_irc_hook)(struct sk_buff *skb,
+ EXPORT_SYMBOL_GPL(nf_nat_irc_hook);
+
+ #define HELPER_NAME "irc"
++#define MAX_SEARCH_SIZE 4095
+
+ MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
+ MODULE_DESCRIPTION("IRC (DCC) connection tracking helper");
+@@ -121,6 +122,7 @@ static int help(struct sk_buff *skb, unsigned int protoff,
+ int i, ret = NF_ACCEPT;
+ char *addr_beg_p, *addr_end_p;
+ typeof(nf_nat_irc_hook) nf_nat_irc;
++ unsigned int datalen;
+
+ /* If packet is coming from IRC server */
+ if (dir == IP_CT_DIR_REPLY)
+@@ -140,8 +142,12 @@ static int help(struct sk_buff *skb, unsigned int protoff,
+ if (dataoff >= skb->len)
+ return NF_ACCEPT;
+
++ datalen = skb->len - dataoff;
++ if (datalen > MAX_SEARCH_SIZE)
++ datalen = MAX_SEARCH_SIZE;
++
+ spin_lock_bh(&irc_buffer_lock);
+- ib_ptr = skb_header_pointer(skb, dataoff, skb->len - dataoff,
++ ib_ptr = skb_header_pointer(skb, dataoff, datalen,
+ irc_buffer);
+ if (!ib_ptr) {
+ spin_unlock_bh(&irc_buffer_lock);
+@@ -149,7 +155,7 @@ static int help(struct sk_buff *skb, unsigned int protoff,
+ }
+
+ data = ib_ptr;
+- data_limit = ib_ptr + skb->len - dataoff;
++ data_limit = ib_ptr + datalen;
+
+ /* strlen("\1DCC SENT t AAAAAAAA P\1\n")=24
+ * 5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14 */
+@@ -251,7 +257,7 @@ static int __init nf_conntrack_irc_init(void)
+ irc_exp_policy.max_expected = max_dcc_channels;
+ irc_exp_policy.timeout = dcc_timeout;
+
+- irc_buffer = kmalloc(65536, GFP_KERNEL);
++ irc_buffer = kmalloc(MAX_SEARCH_SIZE + 1, GFP_KERNEL);
+ if (!irc_buffer)
+ return -ENOMEM;
+
+--
+2.37.2
+
--- /dev/null
+From a664375da76c6da8f83dc7997e43c568e1eb9a6a Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Tue, 9 Aug 2022 15:16:32 +0200
+Subject: netfilter: nf_ct_sane: remove pseudo skb linearization
+
+From: Florian Westphal <fw@strlen.de>
+
+commit a664375da76c6da8f83dc7997e43c568e1eb9a6a upstream.
+
+For historical reason this code performs pseudo linearization of skbs
+via skb_header_pointer and a global 64k buffer.
+
+With arrival of BIG TCP, packets generated by TCP stack can exceed 64kb.
+
+Rewrite this to only extract the needed header data. This also allows
+to get rid of the locking.
+
+Fixes: 7c4e983c4f3c ("net: allow gso_max_size to exceed 65536")
+Fixes: 0fe79f28bfaf ("net: allow gro_max_size to exceed 65536")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_conntrack_sane.c | 68 ++++++++++++++++----------------------
+ 1 file changed, 30 insertions(+), 38 deletions(-)
+
+--- a/net/netfilter/nf_conntrack_sane.c
++++ b/net/netfilter/nf_conntrack_sane.c
+@@ -34,10 +34,6 @@ MODULE_AUTHOR("Michal Schmidt <mschmidt@
+ MODULE_DESCRIPTION("SANE connection tracking helper");
+ MODULE_ALIAS_NFCT_HELPER(HELPER_NAME);
+
+-static char *sane_buffer;
+-
+-static DEFINE_SPINLOCK(nf_sane_lock);
+-
+ #define MAX_PORTS 8
+ static u_int16_t ports[MAX_PORTS];
+ static unsigned int ports_c;
+@@ -67,14 +63,16 @@ static int help(struct sk_buff *skb,
+ unsigned int dataoff, datalen;
+ const struct tcphdr *th;
+ struct tcphdr _tcph;
+- void *sb_ptr;
+ int ret = NF_ACCEPT;
+ int dir = CTINFO2DIR(ctinfo);
+ struct nf_ct_sane_master *ct_sane_info = nfct_help_data(ct);
+ struct nf_conntrack_expect *exp;
+ struct nf_conntrack_tuple *tuple;
+- struct sane_request *req;
+ struct sane_reply_net_start *reply;
++ union {
++ struct sane_request req;
++ struct sane_reply_net_start repl;
++ } buf;
+
+ /* Until there's been traffic both ways, don't look in packets. */
+ if (ctinfo != IP_CT_ESTABLISHED &&
+@@ -92,59 +90,62 @@ static int help(struct sk_buff *skb,
+ return NF_ACCEPT;
+
+ datalen = skb->len - dataoff;
+-
+- spin_lock_bh(&nf_sane_lock);
+- sb_ptr = skb_header_pointer(skb, dataoff, datalen, sane_buffer);
+- if (!sb_ptr) {
+- spin_unlock_bh(&nf_sane_lock);
+- return NF_ACCEPT;
+- }
+-
+ if (dir == IP_CT_DIR_ORIGINAL) {
++ const struct sane_request *req;
++
+ if (datalen != sizeof(struct sane_request))
+- goto out;
++ return NF_ACCEPT;
++
++ req = skb_header_pointer(skb, dataoff, datalen, &buf.req);
++ if (!req)
++ return NF_ACCEPT;
+
+- req = sb_ptr;
+ if (req->RPC_code != htonl(SANE_NET_START)) {
+ /* Not an interesting command */
+- ct_sane_info->state = SANE_STATE_NORMAL;
+- goto out;
++ WRITE_ONCE(ct_sane_info->state, SANE_STATE_NORMAL);
++ return NF_ACCEPT;
+ }
+
+ /* We're interested in the next reply */
+- ct_sane_info->state = SANE_STATE_START_REQUESTED;
+- goto out;
++ WRITE_ONCE(ct_sane_info->state, SANE_STATE_START_REQUESTED);
++ return NF_ACCEPT;
+ }
+
++ /* IP_CT_DIR_REPLY */
++
+ /* Is it a reply to an uninteresting command? */
+- if (ct_sane_info->state != SANE_STATE_START_REQUESTED)
+- goto out;
++ if (READ_ONCE(ct_sane_info->state) != SANE_STATE_START_REQUESTED)
++ return NF_ACCEPT;
+
+ /* It's a reply to SANE_NET_START. */
+- ct_sane_info->state = SANE_STATE_NORMAL;
++ WRITE_ONCE(ct_sane_info->state, SANE_STATE_NORMAL);
+
+ if (datalen < sizeof(struct sane_reply_net_start)) {
+ pr_debug("NET_START reply too short\n");
+- goto out;
++ return NF_ACCEPT;
+ }
+
+- reply = sb_ptr;
++ datalen = sizeof(struct sane_reply_net_start);
++
++ reply = skb_header_pointer(skb, dataoff, datalen, &buf.repl);
++ if (!reply)
++ return NF_ACCEPT;
++
+ if (reply->status != htonl(SANE_STATUS_SUCCESS)) {
+ /* saned refused the command */
+ pr_debug("unsuccessful SANE_STATUS = %u\n",
+ ntohl(reply->status));
+- goto out;
++ return NF_ACCEPT;
+ }
+
+ /* Invalid saned reply? Ignore it. */
+ if (reply->zero != 0)
+- goto out;
++ return NF_ACCEPT;
+
+ exp = nf_ct_expect_alloc(ct);
+ if (exp == NULL) {
+ nf_ct_helper_log(skb, ct, "cannot alloc expectation");
+- ret = NF_DROP;
+- goto out;
++ return NF_DROP;
+ }
+
+ tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
+@@ -162,9 +163,6 @@ static int help(struct sk_buff *skb,
+ }
+
+ nf_ct_expect_put(exp);
+-
+-out:
+- spin_unlock_bh(&nf_sane_lock);
+ return ret;
+ }
+
+@@ -178,7 +176,6 @@ static const struct nf_conntrack_expect_
+ static void __exit nf_conntrack_sane_fini(void)
+ {
+ nf_conntrack_helpers_unregister(sane, ports_c * 2);
+- kfree(sane_buffer);
+ }
+
+ static int __init nf_conntrack_sane_init(void)
+@@ -187,10 +184,6 @@ static int __init nf_conntrack_sane_init
+
+ NF_CT_HELPER_BUILD_BUG_ON(sizeof(struct nf_ct_sane_master));
+
+- sane_buffer = kmalloc(65536, GFP_KERNEL);
+- if (!sane_buffer)
+- return -ENOMEM;
+-
+ if (ports_c == 0)
+ ports[ports_c++] = SANE_PORT;
+
+@@ -210,7 +203,6 @@ static int __init nf_conntrack_sane_init
+ ret = nf_conntrack_helpers_register(sane, ports_c * 2);
+ if (ret < 0) {
+ pr_err("failed to register helpers\n");
+- kfree(sane_buffer);
+ return ret;
+ }
+
--- /dev/null
+From 1b6345d4160ecd3d04bd8cd75df90c67811e8cc9 Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Mon, 15 Aug 2022 17:55:07 +0200
+Subject: netfilter: nf_tables: check NFT_SET_CONCAT flag if field_count is specified
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+commit 1b6345d4160ecd3d04bd8cd75df90c67811e8cc9 upstream.
+
+Since f3a2181e16f1 ("netfilter: nf_tables: Support for sets with
+multiple ranged fields"), it possible to combine intervals and
+concatenations. Later on, ef516e8625dd ("netfilter: nf_tables:
+reintroduce the NFT_SET_CONCAT flag") provides the NFT_SET_CONCAT flag
+for userspace to report that the set stores a concatenation.
+
+Make sure NFT_SET_CONCAT is set on if field_count is specified for
+consistency. Otherwise, if NFT_SET_CONCAT is specified with no
+field_count, bail out with EINVAL.
+
+Fixes: ef516e8625dd ("netfilter: nf_tables: reintroduce the NFT_SET_CONCAT flag")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_tables_api.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -4451,6 +4451,11 @@ static int nf_tables_newset(struct sk_bu
+ err = nf_tables_set_desc_parse(&desc, nla[NFTA_SET_DESC]);
+ if (err < 0)
+ return err;
++
++ if (desc.field_count > 1 && !(flags & NFT_SET_CONCAT))
++ return -EINVAL;
++ } else if (flags & NFT_SET_CONCAT) {
++ return -EINVAL;
+ }
+
+ if (nla[NFTA_SET_EXPR] || nla[NFTA_SET_EXPRESSIONS])
--- /dev/null
+From fc0ae524b5fd2938c94d56da3f749f11eb3273d5 Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Sat, 13 Aug 2022 15:22:05 +0200
+Subject: netfilter: nf_tables: disallow NFT_SET_ELEM_CATCHALL and NFT_SET_ELEM_INTERVAL_END
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+commit fc0ae524b5fd2938c94d56da3f749f11eb3273d5 upstream.
+
+These flags are mutually exclusive, report EINVAL in this case.
+
+Fixes: aaa31047a6d2 ("netfilter: nftables: add catch-all set element support")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_tables_api.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -5198,6 +5198,9 @@ static int nft_setelem_parse_flags(const
+ if (!(set->flags & NFT_SET_INTERVAL) &&
+ *flags & NFT_SET_ELEM_INTERVAL_END)
+ return -EINVAL;
++ if ((*flags & (NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL)) ==
++ (NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL))
++ return -EINVAL;
+
+ return 0;
+ }
--- /dev/null
+From 4963674c2e71fc062f8f089f0f58ffbb5533060b Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Tue, 9 Aug 2022 13:39:18 +0200
+Subject: netfilter: nf_tables: disallow NFTA_SET_ELEM_KEY_END with NFT_SET_ELEM_INTERVAL_END flag
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+commit 4963674c2e71fc062f8f089f0f58ffbb5533060b upstream.
+
+These are mutually exclusive, actually NFTA_SET_ELEM_KEY_END replaces
+the flag notation.
+
+Fixes: 7b225d0b5c6d ("netfilter: nf_tables: add NFTA_SET_ELEM_KEY_END attribute")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_tables_api.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -5855,6 +5855,7 @@ static int nft_add_set_elem(struct nft_c
+ nla[NFTA_SET_ELEM_EXPIRATION] ||
+ nla[NFTA_SET_ELEM_USERDATA] ||
+ nla[NFTA_SET_ELEM_EXPR] ||
++ nla[NFTA_SET_ELEM_KEY_END] ||
+ nla[NFTA_SET_ELEM_EXPRESSIONS]))
+ return -EINVAL;
+
--- /dev/null
+From 2024439bd5ceb145eeeb428b2a59e9b905153ac3 Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Thu, 11 Aug 2022 13:30:39 +0200
+Subject: netfilter: nf_tables: fix scheduling-while-atomic splat
+
+From: Florian Westphal <fw@strlen.de>
+
+commit 2024439bd5ceb145eeeb428b2a59e9b905153ac3 upstream.
+
+nf_tables_check_loops() can be called from rhashtable list
+walk so cond_resched() cannot be used here.
+
+Fixes: 81ea01066741 ("netfilter: nf_tables: add rescheduling points during loop detection walks")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_tables_api.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -9372,13 +9372,9 @@ static int nf_tables_check_loops(const s
+ break;
+ }
+ }
+-
+- cond_resched();
+ }
+
+ list_for_each_entry(set, &ctx->table->sets, list) {
+- cond_resched();
+-
+ if (!nft_is_active_next(ctx->net, set))
+ continue;
+ if (!(set->flags & NFT_SET_MAP) ||
--- /dev/null
+From 88cccd908d51397f9754f89a937cd13fa59dee37 Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Fri, 12 Aug 2022 16:21:28 +0200
+Subject: netfilter: nf_tables: NFTA_SET_ELEM_KEY_END requires concat and interval flags
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+commit 88cccd908d51397f9754f89a937cd13fa59dee37 upstream.
+
+If the NFT_SET_CONCAT|NFT_SET_INTERVAL flags are set on, then the
+netlink attribute NFTA_SET_ELEM_KEY_END must be specified. Otherwise,
+NFTA_SET_ELEM_KEY_END should not be present.
+
+For catch-all element, NFTA_SET_ELEM_KEY_END should not be present.
+The NFT_SET_ELEM_INTERVAL_END is never used with this set flags
+combination.
+
+Fixes: 7b225d0b5c6d ("netfilter: nf_tables: add NFTA_SET_ELEM_KEY_END attribute")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_tables_api.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -5798,6 +5798,24 @@ static void nft_setelem_remove(const str
+ set->ops->remove(net, set, elem);
+ }
+
++static bool nft_setelem_valid_key_end(const struct nft_set *set,
++ struct nlattr **nla, u32 flags)
++{
++ if ((set->flags & (NFT_SET_CONCAT | NFT_SET_INTERVAL)) ==
++ (NFT_SET_CONCAT | NFT_SET_INTERVAL)) {
++ if (flags & NFT_SET_ELEM_INTERVAL_END)
++ return false;
++ if (!nla[NFTA_SET_ELEM_KEY_END] &&
++ !(flags & NFT_SET_ELEM_CATCHALL))
++ return false;
++ } else {
++ if (nla[NFTA_SET_ELEM_KEY_END])
++ return false;
++ }
++
++ return true;
++}
++
+ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ const struct nlattr *attr, u32 nlmsg_flags)
+ {
+@@ -5857,6 +5875,9 @@ static int nft_add_set_elem(struct nft_c
+ return -EINVAL;
+ }
+
++ if (!nft_setelem_valid_key_end(set, nla, flags))
++ return -EINVAL;
++
+ if ((flags & NFT_SET_ELEM_INTERVAL_END) &&
+ (nla[NFTA_SET_ELEM_DATA] ||
+ nla[NFTA_SET_ELEM_OBJREF] ||
+@@ -6281,6 +6302,9 @@ static int nft_del_setelem(struct nft_ct
+ if (!nla[NFTA_SET_ELEM_KEY] && !(flags & NFT_SET_ELEM_CATCHALL))
+ return -EINVAL;
+
++ if (!nft_setelem_valid_key_end(set, nla, flags))
++ return -EINVAL;
++
+ nft_set_ext_prepare(&tmpl);
+
+ if (flags != 0) {
--- /dev/null
+From c485c35ff6783ccd12c160fcac6a0e504e83e0bf Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Tue, 9 Aug 2022 17:23:52 +0200
+Subject: netfilter: nf_tables: possible module reference underflow in error path
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+commit c485c35ff6783ccd12c160fcac6a0e504e83e0bf upstream.
+
+dst->ops is set on when nft_expr_clone() fails, but module refcount has
+not been bumped yet, therefore nft_expr_destroy() leads to module
+reference underflow.
+
+Fixes: 8cfd9b0f8515 ("netfilter: nftables: generalize set expressions support")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_tables_api.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -5566,7 +5566,7 @@ int nft_set_elem_expr_clone(const struct
+
+ err = nft_expr_clone(expr, set->exprs[i]);
+ if (err < 0) {
+- nft_expr_destroy(ctx, expr);
++ kfree(expr);
+ goto err_expr;
+ }
+ expr_array[i] = expr;
--- /dev/null
+From 271c5ca826e0c3c53e0eb4032f8eaedea1ee391c Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Tue, 9 Aug 2022 17:23:53 +0200
+Subject: netfilter: nf_tables: really skip inactive sets when allocating name
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+commit 271c5ca826e0c3c53e0eb4032f8eaedea1ee391c upstream.
+
+While looping to build the bitmap of used anonymous set names, check the
+current set in the iteration, instead of the one that is being created.
+
+Fixes: 37a9cc525525 ("netfilter: nf_tables: add generation mask to sets")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_tables_api.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -3907,7 +3907,7 @@ cont:
+ list_for_each_entry(i, &ctx->table->sets, list) {
+ int tmp;
+
+- if (!nft_is_active_next(ctx->net, set))
++ if (!nft_is_active_next(ctx->net, i))
+ continue;
+ if (!sscanf(i->name, name, &tmp))
+ continue;
--- /dev/null
+From 5a2f3dc31811e93be15522d9eb13ed61460b76c8 Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Fri, 12 Aug 2022 16:19:23 +0200
+Subject: netfilter: nf_tables: validate NFTA_SET_ELEM_OBJREF based on NFT_SET_OBJECT flag
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+commit 5a2f3dc31811e93be15522d9eb13ed61460b76c8 upstream.
+
+If the NFTA_SET_ELEM_OBJREF netlink attribute is present and
+NFT_SET_OBJECT flag is set on, report EINVAL.
+
+Move existing sanity check earlier to validate that NFT_SET_OBJECT
+requires NFTA_SET_ELEM_OBJREF.
+
+Fixes: 8aeff920dcc9 ("netfilter: nf_tables: add stateful object reference to set elements")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_tables_api.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -5848,6 +5848,15 @@ static int nft_add_set_elem(struct nft_c
+ return -EINVAL;
+ }
+
++ if (set->flags & NFT_SET_OBJECT) {
++ if (!nla[NFTA_SET_ELEM_OBJREF] &&
++ !(flags & NFT_SET_ELEM_INTERVAL_END))
++ return -EINVAL;
++ } else {
++ if (nla[NFTA_SET_ELEM_OBJREF])
++ return -EINVAL;
++ }
++
+ if ((flags & NFT_SET_ELEM_INTERVAL_END) &&
+ (nla[NFTA_SET_ELEM_DATA] ||
+ nla[NFTA_SET_ELEM_OBJREF] ||
+@@ -5986,10 +5995,6 @@ static int nft_add_set_elem(struct nft_c
+ }
+
+ if (nla[NFTA_SET_ELEM_OBJREF] != NULL) {
+- if (!(set->flags & NFT_SET_OBJECT)) {
+- err = -EINVAL;
+- goto err_parse_key_end;
+- }
+ obj = nft_obj_lookup(ctx->net, ctx->table,
+ nla[NFTA_SET_ELEM_OBJREF],
+ set->objtype, genmask);
--- /dev/null
+From 8d48562a2729742f767b0fdd994d6b2a56a49c63 Mon Sep 17 00:00:00 2001
+From: Michael Ellerman <mpe@ellerman.id.au>
+Date: Mon, 15 Aug 2022 16:55:23 +1000
+Subject: powerpc/pci: Fix get_phb_number() locking
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+commit 8d48562a2729742f767b0fdd994d6b2a56a49c63 upstream.
+
+The recent change to get_phb_number() causes a DEBUG_ATOMIC_SLEEP
+warning on some systems:
+
+ BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580
+ in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper
+ preempt_count: 1, expected: 0
+ RCU nest depth: 0, expected: 0
+ 1 lock held by swapper/1:
+ #0: c157efb0 (hose_spinlock){+.+.}-{2:2}, at: pcibios_alloc_controller+0x64/0x220
+ Preemption disabled at:
+ [<00000000>] 0x0
+ CPU: 0 PID: 1 Comm: swapper Not tainted 5.19.0-yocto-standard+ #1
+ Call Trace:
+ [d101dc90] [c073b264] dump_stack_lvl+0x50/0x8c (unreliable)
+ [d101dcb0] [c0093b70] __might_resched+0x258/0x2a8
+ [d101dcd0] [c0d3e634] __mutex_lock+0x6c/0x6ec
+ [d101dd50] [c0a84174] of_alias_get_id+0x50/0xf4
+ [d101dd80] [c002ec78] pcibios_alloc_controller+0x1b8/0x220
+ [d101ddd0] [c140c9dc] pmac_pci_init+0x198/0x784
+ [d101de50] [c140852c] discover_phbs+0x30/0x4c
+ [d101de60] [c0007fd4] do_one_initcall+0x94/0x344
+ [d101ded0] [c1403b40] kernel_init_freeable+0x1a8/0x22c
+ [d101df10] [c00086e0] kernel_init+0x34/0x160
+ [d101df30] [c001b334] ret_from_kernel_thread+0x5c/0x64
+
+This is because pcibios_alloc_controller() holds hose_spinlock but
+of_alias_get_id() takes of_mutex which can sleep.
+
+The hose_spinlock protects the phb_bitmap, and also the hose_list, but
+it doesn't need to be held while get_phb_number() calls the OF routines,
+because those are only looking up information in the device tree.
+
+So fix it by having get_phb_number() take the hose_spinlock itself, only
+where required, and then dropping the lock before returning.
+pcibios_alloc_controller() then needs to take the lock again before the
+list_add() but that's safe, the order of the list is not important.
+
+Fixes: 0fe1e96fef0a ("powerpc/pci: Prefer PCI domain assignment via DT 'linux,pci-domain' and alias")
+Reported-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220815065550.1303620-1-mpe@ellerman.id.au
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/kernel/pci-common.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/arch/powerpc/kernel/pci-common.c
++++ b/arch/powerpc/kernel/pci-common.c
+@@ -67,10 +67,6 @@ void __init set_pci_dma_ops(const struct
+ pci_dma_ops = dma_ops;
+ }
+
+-/*
+- * This function should run under locking protection, specifically
+- * hose_spinlock.
+- */
+ static int get_phb_number(struct device_node *dn)
+ {
+ int ret, phb_id = -1;
+@@ -107,15 +103,20 @@ static int get_phb_number(struct device_
+ if (!ret)
+ phb_id = (int)(prop & (MAX_PHBS - 1));
+
++ spin_lock(&hose_spinlock);
++
+ /* We need to be sure to not use the same PHB number twice. */
+ if ((phb_id >= 0) && !test_and_set_bit(phb_id, phb_bitmap))
+- return phb_id;
++ goto out_unlock;
+
+ /* If everything fails then fallback to dynamic PHB numbering. */
+ phb_id = find_first_zero_bit(phb_bitmap, MAX_PHBS);
+ BUG_ON(phb_id >= MAX_PHBS);
+ set_bit(phb_id, phb_bitmap);
+
++out_unlock:
++ spin_unlock(&hose_spinlock);
++
+ return phb_id;
+ }
+
+@@ -126,10 +127,13 @@ struct pci_controller *pcibios_alloc_con
+ phb = zalloc_maybe_bootmem(sizeof(struct pci_controller), GFP_KERNEL);
+ if (phb == NULL)
+ return NULL;
+- spin_lock(&hose_spinlock);
++
+ phb->global_number = get_phb_number(dev);
++
++ spin_lock(&hose_spinlock);
+ list_add_tail(&phb->list_node, &hose_list);
+ spin_unlock(&hose_spinlock);
++
+ phb->dn = dev;
+ phb->is_dynamic = slab_is_available();
+ #ifdef CONFIG_PPC64
--- /dev/null
+From b0de7fa706506bf0591037908376351beda8c5d6 Mon Sep 17 00:00:00 2001
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+Date: Tue, 2 Aug 2022 08:43:34 +0200
+Subject: regulator: pca9450: Remove restrictions for regulator-name
+
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+
+commit b0de7fa706506bf0591037908376351beda8c5d6 upstream.
+
+The device bindings shouldn't put any constraints on the regulator-name
+property specified in the generic bindings. This allows using arbitrary
+and descriptive names for the regulators.
+
+Suggested-by: Mark Brown <broonie@kernel.org>
+Fixes: 7ae9e3a6bf3f ("dt-bindings: regulator: add pca9450 regulator yaml")
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Link: https://lore.kernel.org/r/20220802064335.8481-1-frieder@fris.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/regulator/nxp,pca9450-regulator.yaml | 11 ----------
+ 1 file changed, 11 deletions(-)
+
+--- a/Documentation/devicetree/bindings/regulator/nxp,pca9450-regulator.yaml
++++ b/Documentation/devicetree/bindings/regulator/nxp,pca9450-regulator.yaml
+@@ -47,12 +47,6 @@ properties:
+ description:
+ Properties for single LDO regulator.
+
+- properties:
+- regulator-name:
+- pattern: "^LDO[1-5]$"
+- description:
+- should be "LDO1", ..., "LDO5"
+-
+ unevaluatedProperties: false
+
+ "^BUCK[1-6]$":
+@@ -62,11 +56,6 @@ properties:
+ Properties for single BUCK regulator.
+
+ properties:
+- regulator-name:
+- pattern: "^BUCK[1-6]$"
+- description:
+- should be "BUCK1", ..., "BUCK6"
+-
+ nxp,dvs-run-voltage:
+ $ref: "/schemas/types.yaml#/definitions/uint32"
+ minimum: 600000
netfilter-nfnetlink-re-enable-conntrack-expectation-events.patch
netfilter-nf_tables-use-read_once-and-write_once-for-shared-generation-id-access.patch
fs-ntfs3-uninitialized-variable-in-ntfs_set_acl_ex.patch
+netfilter-nf_tables-disallow-nfta_set_elem_key_end-with-nft_set_elem_interval_end-flag.patch
+netfilter-nf_ct_sane-remove-pseudo-skb-linearization.patch
+netfilter-nf_ct_h323-cap-packet-size-at-64k.patch
+netfilter-nf_ct_ftp-prefer-skb_linearize.patch
+netfilter-nf_ct_irc-cap-packet-search-space-to-4k.patch
+netfilter-nf_tables-possible-module-reference-underflow-in-error-path.patch
+netfilter-nf_tables-really-skip-inactive-sets-when-allocating-name.patch
+netfilter-nf_tables-fix-scheduling-while-atomic-splat.patch
+netfilter-nf_tables-validate-nfta_set_elem_objref-based-on-nft_set_object-flag.patch
+netfilter-nf_tables-nfta_set_elem_key_end-requires-concat-and-interval-flags.patch
+netfilter-nf_tables-disallow-nft_set_elem_catchall-and-nft_set_elem_interval_end.patch
+netfilter-nf_tables-check-nft_set_concat-flag-if-field_count-is-specified.patch
+powerpc-pci-fix-get_phb_number-locking.patch
+spi-meson-spicc-add-local-pow2-clock-ops-to-preserve-rate-between-messages.patch
+net-sunrpc-fix-potential-memory-leaks-in-rpc_sysfs_xprt_state_change.patch
+net-dsa-mv88e6060-prevent-crash-on-an-unused-port.patch
+net-qrtr-start-mhi-channel-after-endpoit-creation.patch
+virtio_net-fix-endian-ness-for-rss.patch
+mlxsw-spectrum-clear-ptp-configuration-after-unregistering-the-netdevice.patch
+net-moxa-pass-pdev-instead-of-ndev-to-dma-functions.patch
+net-fix-potential-refcount-leak-in-ndisc_router_discovery.patch
+net-rtnetlink-fix-module-reference-count-leak-issue-in-rtnetlink_rcv_msg.patch
+net-sched-fix-misuse-of-qcpu-backlog-in-gnet_stats_add_queue_cpu.patch
+net-dsa-microchip-ksz9477-fix-fdb_dump-last-invalid-entry.patch
+net-dsa-felix-fix-ethtool-256-511-and-512-1023-tx-packet-counters.patch
+net-mscc-ocelot-fix-incorrect-ndo_get_stats64-packet-counters.patch
+net-mscc-ocelot-fix-address-of-sys_count_tx_aging-counter.patch
+net-genl-fix-error-path-memory-leak-in-policy-dumping.patch
+net-dsa-don-t-warn-in-dsa_port_set_state_now-when-driver-doesn-t-support-it.patch
+net-dsa-sja1105-fix-buffer-overflow-in-sja1105_setup_devlink_regions.patch
+ice-fix-vsi-rebuild-warn_on-check-for-vf.patch
+ice-fix-call-trace-with-null-vsi-during-vf-reset.patch
+ice-fix-vf-not-able-to-send-tagged-traffic-with-no-vlan-filters.patch
+ice-fix-double-vlan-error-when-entering-promisc-mode.patch
+ice-ignore-eexist-when-setting-promisc-mode.patch
+ice-fix-clearing-of-promisc-mode-with-bridge-over-bond.patch
+ice-ignore-error-message-when-setting-same-promiscuous-mode.patch
+modpost-fix-module-versioning-when-a-symbol-lacks-valid-crc.patch
+i2c-imx-make-sure-to-unregister-adapter-on-remove.patch
+i40e-fix-tunnel-checksum-offload-with-fragmented-traffic.patch
+regulator-pca9450-remove-restrictions-for-regulator-name.patch
+i40e-fix-to-stop-tx_timeout-recovery-if-globr-fails.patch
+blk-mq-run-queue-no-matter-whether-the-request-is-the-last-request.patch
+tools-rtla-fix-command-symlinks.patch
+fec-fix-timer-capture-timing-in-fec_ptp_enable_pps.patch
+dt-bindings-display-sun4i-add-d1-tcons-to-conditionals.patch
+stmmac-intel-add-a-missing-clk_disable_unprepare-call-in-intel_eth_pci_remove.patch
+igb-add-lock-to-avoid-data-race.patch
+kbuild-fix-the-modules-order-between-drivers-and-libs.patch
+gcc-plugins-undefine-latent_entropy_plugin-when-plugin-disabled-for-a-file.patch
--- /dev/null
+From 09992025dacd258c823f50e82db09d7ef06cdac4 Mon Sep 17 00:00:00 2001
+From: Neil Armstrong <narmstrong@baylibre.com>
+Date: Thu, 11 Aug 2022 15:44:45 +0200
+Subject: spi: meson-spicc: add local pow2 clock ops to preserve rate between messages
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+commit 09992025dacd258c823f50e82db09d7ef06cdac4 upstream.
+
+At the end of a message, the HW gets a reset in meson_spicc_unprepare_transfer(),
+this resets the SPICC_CONREG register and notably the value set by the
+Common Clock Framework.
+
+This is problematic because:
+- the register value CCF can be different from the corresponding CCF cached rate
+- CCF is allowed to change the clock rate whenever the HW state
+
+This introduces:
+- local pow2 clock ops checking the HW state before allowing a clock operation
+- separation of legacy pow2 clock patch and new enhanced clock path
+- SPICC_CONREG datarate value is now value kepts across messages
+
+It has been checked that:
+- SPICC_CONREG datarate value is kept across messages
+- CCF is only allowed to change the SPICC_CONREG datarate value when busy
+- SPICC_CONREG datarate value is correct for each transfer
+
+This didn't appear before commit 3e0cf4d3fc29 ("spi: meson-spicc: add a linear clock divider support")
+because we recalculated and wrote the rate for each xfer.
+
+Fixes: 3e0cf4d3fc29 ("spi: meson-spicc: add a linear clock divider support")
+Reported-by: Da Xue <da@libre.computer>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://lore.kernel.org/r/20220811134445.678446-1-narmstrong@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-meson-spicc.c | 129 ++++++++++++++++++++++++++++++++----------
+ 1 file changed, 101 insertions(+), 28 deletions(-)
+
+--- a/drivers/spi/spi-meson-spicc.c
++++ b/drivers/spi/spi-meson-spicc.c
+@@ -156,6 +156,7 @@ struct meson_spicc_device {
+ void __iomem *base;
+ struct clk *core;
+ struct clk *pclk;
++ struct clk_divider pow2_div;
+ struct clk *clk;
+ struct spi_message *message;
+ struct spi_transfer *xfer;
+@@ -168,6 +169,8 @@ struct meson_spicc_device {
+ unsigned long xfer_remain;
+ };
+
++#define pow2_clk_to_spicc(_div) container_of(_div, struct meson_spicc_device, pow2_div)
++
+ static void meson_spicc_oen_enable(struct meson_spicc_device *spicc)
+ {
+ u32 conf;
+@@ -421,7 +424,7 @@ static int meson_spicc_prepare_message(s
+ {
+ struct meson_spicc_device *spicc = spi_master_get_devdata(master);
+ struct spi_device *spi = message->spi;
+- u32 conf = 0;
++ u32 conf = readl_relaxed(spicc->base + SPICC_CONREG) & SPICC_DATARATE_MASK;
+
+ /* Store current message */
+ spicc->message = message;
+@@ -458,8 +461,6 @@ static int meson_spicc_prepare_message(s
+ /* Select CS */
+ conf |= FIELD_PREP(SPICC_CS_MASK, spi->chip_select);
+
+- /* Default Clock rate core/4 */
+-
+ /* Default 8bit word */
+ conf |= FIELD_PREP(SPICC_BITLENGTH_MASK, 8 - 1);
+
+@@ -476,12 +477,16 @@ static int meson_spicc_prepare_message(s
+ static int meson_spicc_unprepare_transfer(struct spi_master *master)
+ {
+ struct meson_spicc_device *spicc = spi_master_get_devdata(master);
++ u32 conf = readl_relaxed(spicc->base + SPICC_CONREG) & SPICC_DATARATE_MASK;
+
+ /* Disable all IRQs */
+ writel(0, spicc->base + SPICC_INTREG);
+
+ device_reset_optional(&spicc->pdev->dev);
+
++ /* Set default configuration, keeping datarate field */
++ writel_relaxed(conf, spicc->base + SPICC_CONREG);
++
+ return 0;
+ }
+
+@@ -518,14 +523,60 @@ static void meson_spicc_cleanup(struct s
+ * Clk path for G12A series:
+ * pclk -> pow2 fixed div -> pow2 div -> mux -> out
+ * pclk -> enh fixed div -> enh div -> mux -> out
++ *
++ * The pow2 divider is tied to the controller HW state, and the
++ * divider is only valid when the controller is initialized.
++ *
++ * A set of clock ops is added to make sure we don't read/set this
++ * clock rate while the controller is in an unknown state.
+ */
+
+-static int meson_spicc_clk_init(struct meson_spicc_device *spicc)
++static unsigned long meson_spicc_pow2_recalc_rate(struct clk_hw *hw,
++ unsigned long parent_rate)
++{
++ struct clk_divider *divider = to_clk_divider(hw);
++ struct meson_spicc_device *spicc = pow2_clk_to_spicc(divider);
++
++ if (!spicc->master->cur_msg || !spicc->master->busy)
++ return 0;
++
++ return clk_divider_ops.recalc_rate(hw, parent_rate);
++}
++
++static int meson_spicc_pow2_determine_rate(struct clk_hw *hw,
++ struct clk_rate_request *req)
++{
++ struct clk_divider *divider = to_clk_divider(hw);
++ struct meson_spicc_device *spicc = pow2_clk_to_spicc(divider);
++
++ if (!spicc->master->cur_msg || !spicc->master->busy)
++ return -EINVAL;
++
++ return clk_divider_ops.determine_rate(hw, req);
++}
++
++static int meson_spicc_pow2_set_rate(struct clk_hw *hw, unsigned long rate,
++ unsigned long parent_rate)
++{
++ struct clk_divider *divider = to_clk_divider(hw);
++ struct meson_spicc_device *spicc = pow2_clk_to_spicc(divider);
++
++ if (!spicc->master->cur_msg || !spicc->master->busy)
++ return -EINVAL;
++
++ return clk_divider_ops.set_rate(hw, rate, parent_rate);
++}
++
++const struct clk_ops meson_spicc_pow2_clk_ops = {
++ .recalc_rate = meson_spicc_pow2_recalc_rate,
++ .determine_rate = meson_spicc_pow2_determine_rate,
++ .set_rate = meson_spicc_pow2_set_rate,
++};
++
++static int meson_spicc_pow2_clk_init(struct meson_spicc_device *spicc)
+ {
+ struct device *dev = &spicc->pdev->dev;
+- struct clk_fixed_factor *pow2_fixed_div, *enh_fixed_div;
+- struct clk_divider *pow2_div, *enh_div;
+- struct clk_mux *mux;
++ struct clk_fixed_factor *pow2_fixed_div;
+ struct clk_init_data init;
+ struct clk *clk;
+ struct clk_parent_data parent_data[2];
+@@ -560,31 +611,45 @@ static int meson_spicc_clk_init(struct m
+ if (WARN_ON(IS_ERR(clk)))
+ return PTR_ERR(clk);
+
+- pow2_div = devm_kzalloc(dev, sizeof(*pow2_div), GFP_KERNEL);
+- if (!pow2_div)
+- return -ENOMEM;
+-
+ snprintf(name, sizeof(name), "%s#pow2_div", dev_name(dev));
+ init.name = name;
+- init.ops = &clk_divider_ops;
+- init.flags = CLK_SET_RATE_PARENT;
++ init.ops = &meson_spicc_pow2_clk_ops;
++ /*
++ * Set NOCACHE here to make sure we read the actual HW value
++ * since we reset the HW after each transfer.
++ */
++ init.flags = CLK_SET_RATE_PARENT | CLK_GET_RATE_NOCACHE;
+ parent_data[0].hw = &pow2_fixed_div->hw;
+ init.num_parents = 1;
+
+- pow2_div->shift = 16,
+- pow2_div->width = 3,
+- pow2_div->flags = CLK_DIVIDER_POWER_OF_TWO,
+- pow2_div->reg = spicc->base + SPICC_CONREG;
+- pow2_div->hw.init = &init;
++ spicc->pow2_div.shift = 16,
++ spicc->pow2_div.width = 3,
++ spicc->pow2_div.flags = CLK_DIVIDER_POWER_OF_TWO,
++ spicc->pow2_div.reg = spicc->base + SPICC_CONREG;
++ spicc->pow2_div.hw.init = &init;
+
+- clk = devm_clk_register(dev, &pow2_div->hw);
+- if (WARN_ON(IS_ERR(clk)))
+- return PTR_ERR(clk);
++ spicc->clk = devm_clk_register(dev, &spicc->pow2_div.hw);
++ if (WARN_ON(IS_ERR(spicc->clk)))
++ return PTR_ERR(spicc->clk);
+
+- if (!spicc->data->has_enhance_clk_div) {
+- spicc->clk = clk;
+- return 0;
+- }
++ return 0;
++}
++
++static int meson_spicc_enh_clk_init(struct meson_spicc_device *spicc)
++{
++ struct device *dev = &spicc->pdev->dev;
++ struct clk_fixed_factor *enh_fixed_div;
++ struct clk_divider *enh_div;
++ struct clk_mux *mux;
++ struct clk_init_data init;
++ struct clk *clk;
++ struct clk_parent_data parent_data[2];
++ char name[64];
++
++ memset(&init, 0, sizeof(init));
++ memset(&parent_data, 0, sizeof(parent_data));
++
++ init.parent_data = parent_data;
+
+ /* algorithm for enh div: rate = freq / 2 / (N + 1) */
+
+@@ -637,7 +702,7 @@ static int meson_spicc_clk_init(struct m
+ snprintf(name, sizeof(name), "%s#sel", dev_name(dev));
+ init.name = name;
+ init.ops = &clk_mux_ops;
+- parent_data[0].hw = &pow2_div->hw;
++ parent_data[0].hw = &spicc->pow2_div.hw;
+ parent_data[1].hw = &enh_div->hw;
+ init.num_parents = 2;
+ init.flags = CLK_SET_RATE_PARENT;
+@@ -754,12 +819,20 @@ static int meson_spicc_probe(struct plat
+
+ meson_spicc_oen_enable(spicc);
+
+- ret = meson_spicc_clk_init(spicc);
++ ret = meson_spicc_pow2_clk_init(spicc);
+ if (ret) {
+- dev_err(&pdev->dev, "clock registration failed\n");
++ dev_err(&pdev->dev, "pow2 clock registration failed\n");
+ goto out_clk;
+ }
+
++ if (spicc->data->has_enhance_clk_div) {
++ ret = meson_spicc_enh_clk_init(spicc);
++ if (ret) {
++ dev_err(&pdev->dev, "clock registration failed\n");
++ goto out_clk;
++ }
++ }
++
+ ret = devm_spi_register_master(&pdev->dev, master);
+ if (ret) {
+ dev_err(&pdev->dev, "spi master registration failed\n");
--- /dev/null
+From 5c23d6b717e4e956376f3852b90f58e262946b50 Mon Sep 17 00:00:00 2001
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Tue, 16 Aug 2022 16:23:57 +0200
+Subject: stmmac: intel: Add a missing clk_disable_unprepare() call in intel_eth_pci_remove()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+commit 5c23d6b717e4e956376f3852b90f58e262946b50 upstream.
+
+Commit 09f012e64e4b ("stmmac: intel: Fix clock handling on error and remove
+paths") removed this clk_disable_unprepare()
+
+This was partly revert by commit ac322f86b56c ("net: stmmac: Fix clock
+handling on remove path") which removed this clk_disable_unprepare()
+because:
+"
+ While unloading the dwmac-intel driver, clk_disable_unprepare() is
+ being called twice in stmmac_dvr_remove() and
+ intel_eth_pci_remove(). This causes kernel panic on the second call.
+"
+
+However later on, commit 5ec55823438e8 ("net: stmmac: add clocks management
+for gmac driver") has updated stmmac_dvr_remove() which do not call
+clk_disable_unprepare() anymore.
+
+So this call should now be called from intel_eth_pci_remove().
+
+Fixes: 5ec55823438e8 ("net: stmmac: add clocks management for gmac driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/d7c8c1dadf40df3a7c9e643f76ffadd0ccc1ad1b.1660659689.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c
+@@ -1104,6 +1104,7 @@ static void intel_eth_pci_remove(struct
+
+ stmmac_dvr_remove(&pdev->dev);
+
++ clk_disable_unprepare(priv->plat->stmmac_clk);
+ clk_unregister_fixed_rate(priv->plat->stmmac_clk);
+
+ pcim_iounmap_regions(pdev, BIT(0));
--- /dev/null
+From ff5a55dcdb343e3db9b9fb08795b78544b032773 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <benh@debian.org>
+Date: Sat, 16 Jul 2022 15:47:08 +0200
+Subject: tools/rtla: Fix command symlinks
+
+From: Ben Hutchings <benh@debian.org>
+
+commit ff5a55dcdb343e3db9b9fb08795b78544b032773 upstream.
+
+"ln -s" stores the next argument directly as the symlink target, so
+it needs to be a relative path. In this case, just "rtla".
+
+Link: https://lore.kernel.org/linux-trace-devel/YtLBXMI6Ui4HLIF1@decadent.org.uk
+
+Fixes: 0605bf009f18 ("rtla: Add osnoise tool")
+Fixes: a828cd18bc4a ("rtla: Add timerlat tool and timelart top mode")
+Signed-off-by: Ben Hutchings <benh@debian.org>
+Acked-by: Daniel Bristot de Oliveira <bristot@kernel.org>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/tracing/rtla/Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/tracing/rtla/Makefile b/tools/tracing/rtla/Makefile
+index 1bea2d16d4c1..b8fe10d941ce 100644
+--- a/tools/tracing/rtla/Makefile
++++ b/tools/tracing/rtla/Makefile
+@@ -108,9 +108,9 @@ install: doc_install
+ $(INSTALL) rtla -m 755 $(DESTDIR)$(BINDIR)
+ $(STRIP) $(DESTDIR)$(BINDIR)/rtla
+ @test ! -f $(DESTDIR)$(BINDIR)/osnoise || rm $(DESTDIR)$(BINDIR)/osnoise
+- ln -s $(DESTDIR)$(BINDIR)/rtla $(DESTDIR)$(BINDIR)/osnoise
++ ln -s rtla $(DESTDIR)$(BINDIR)/osnoise
+ @test ! -f $(DESTDIR)$(BINDIR)/timerlat || rm $(DESTDIR)$(BINDIR)/timerlat
+- ln -s $(DESTDIR)$(BINDIR)/rtla $(DESTDIR)$(BINDIR)/timerlat
++ ln -s rtla $(DESTDIR)$(BINDIR)/timerlat
+
+ .PHONY: clean tarball
+ clean: doc_clean
+--
+2.37.2
+
--- /dev/null
+From 95bb633048fab742230eb2cdf20b8e2676240a54 Mon Sep 17 00:00:00 2001
+From: "Michael S. Tsirkin" <mst@redhat.com>
+Date: Thu, 11 Aug 2022 08:51:58 -0400
+Subject: virtio_net: fix endian-ness for RSS
+
+From: Michael S. Tsirkin <mst@redhat.com>
+
+commit 95bb633048fab742230eb2cdf20b8e2676240a54 upstream.
+
+Using native endian-ness for device supplied fields is wrong
+on BE platforms. Sparse warns about this.
+
+Fixes: 91f41f01d219 ("drivers/net/virtio_net: Added RSS hash report.")
+Cc: "Andrew Melnychenko" <andrew@daynix.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/virtio_net.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 3b3eebad3977..d4e0a775b1ba 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -1199,7 +1199,7 @@ static void virtio_skb_set_hash(const struct virtio_net_hdr_v1_hash *hdr_hash,
+ if (!hdr_hash || !skb)
+ return;
+
+- switch ((int)hdr_hash->hash_report) {
++ switch (__le16_to_cpu(hdr_hash->hash_report)) {
+ case VIRTIO_NET_HASH_REPORT_TCPv4:
+ case VIRTIO_NET_HASH_REPORT_UDPv4:
+ case VIRTIO_NET_HASH_REPORT_TCPv6:
+@@ -1217,7 +1217,7 @@ static void virtio_skb_set_hash(const struct virtio_net_hdr_v1_hash *hdr_hash,
+ default:
+ rss_hash_type = PKT_HASH_TYPE_NONE;
+ }
+- skb_set_hash(skb, (unsigned int)hdr_hash->hash_value, rss_hash_type);
++ skb_set_hash(skb, __le32_to_cpu(hdr_hash->hash_value), rss_hash_type);
+ }
+
+ static void receive_buf(struct virtnet_info *vi, struct receive_queue *rq,
+--
+2.37.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
