--- /dev/null
+From 1030d5e9492c01629e5d14e77dd44e2437dbf1eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 May 2023 13:28:57 -0700
+Subject: af_packet: Don't send zero-byte data in packet_sendmsg_spkt().
+
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+
+[ Upstream commit 6a341729fb31b4c5df9f74f24b4b1c98410c9b87 ]
+
+syzkaller reported a warning below [0].
+
+We can reproduce it by sending 0-byte data from the (AF_PACKET,
+SOCK_PACKET) socket via some devices whose dev->hard_header_len
+is 0.
+
+ struct sockaddr_pkt addr = {
+ .spkt_family = AF_PACKET,
+ .spkt_device = "tun0",
+ };
+ int fd;
+
+ fd = socket(AF_PACKET, SOCK_PACKET, 0);
+ sendto(fd, NULL, 0, 0, (struct sockaddr *)&addr, sizeof(addr));
+
+We have a similar fix for the (AF_PACKET, SOCK_RAW) socket as
+commit dc633700f00f ("net/af_packet: check len when min_header_len
+equals to 0").
+
+Let's add the same test for the SOCK_PACKET socket.
+
+[0]:
+skb_assert_len
+WARNING: CPU: 1 PID: 19945 at include/linux/skbuff.h:2552 skb_assert_len include/linux/skbuff.h:2552 [inline]
+WARNING: CPU: 1 PID: 19945 at include/linux/skbuff.h:2552 __dev_queue_xmit+0x1f26/0x31d0 net/core/dev.c:4159
+Modules linked in:
+CPU: 1 PID: 19945 Comm: syz-executor.0 Not tainted 6.3.0-rc7-02330-gca6270c12e20 #1
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
+RIP: 0010:skb_assert_len include/linux/skbuff.h:2552 [inline]
+RIP: 0010:__dev_queue_xmit+0x1f26/0x31d0 net/core/dev.c:4159
+Code: 89 de e8 1d a2 85 fd 84 db 75 21 e8 64 a9 85 fd 48 c7 c6 80 2a 1f 86 48 c7 c7 c0 06 1f 86 c6 05 23 cf 27 04 01 e8 fa ee 56 fd <0f> 0b e8 43 a9 85 fd 0f b6 1d 0f cf 27 04 31 ff 89 de e8 e3 a1 85
+RSP: 0018:ffff8880217af6e0 EFLAGS: 00010282
+RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffc90001133000
+RDX: 0000000000040000 RSI: ffffffff81186922 RDI: 0000000000000001
+RBP: ffff8880217af8b0 R08: 0000000000000001 R09: 0000000000000000
+R10: 0000000000000001 R11: 0000000000000001 R12: ffff888030045640
+R13: ffff8880300456b0 R14: ffff888030045650 R15: ffff888030045718
+FS: 00007fc5864da640(0000) GS:ffff88806cd00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000000020005740 CR3: 000000003f856003 CR4: 0000000000770ee0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+PKRU: 55555554
+Call Trace:
+ <TASK>
+ dev_queue_xmit include/linux/netdevice.h:3085 [inline]
+ packet_sendmsg_spkt+0xc4b/0x1230 net/packet/af_packet.c:2066
+ sock_sendmsg_nosec net/socket.c:724 [inline]
+ sock_sendmsg+0x1b4/0x200 net/socket.c:747
+ ____sys_sendmsg+0x331/0x970 net/socket.c:2503
+ ___sys_sendmsg+0x11d/0x1c0 net/socket.c:2557
+ __sys_sendmmsg+0x18c/0x430 net/socket.c:2643
+ __do_sys_sendmmsg net/socket.c:2672 [inline]
+ __se_sys_sendmmsg net/socket.c:2669 [inline]
+ __x64_sys_sendmmsg+0x9c/0x100 net/socket.c:2669
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x3c/0x90 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x72/0xdc
+RIP: 0033:0x7fc58791de5d
+Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48
+RSP: 002b:00007fc5864d9cc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
+RAX: ffffffffffffffda RBX: 00000000004bbf80 RCX: 00007fc58791de5d
+RDX: 0000000000000001 RSI: 0000000020005740 RDI: 0000000000000004
+RBP: 00000000004bbf80 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
+R13: 000000000000000b R14: 00007fc58797e530 R15: 0000000000000000
+ </TASK>
+---[ end trace 0000000000000000 ]---
+skb len=0 headroom=16 headlen=0 tailroom=304
+mac=(16,0) net=(16,-1) trans=-1
+shinfo(txflags=0 nr_frags=0 gso(size=0 type=0 segs=0))
+csum(0x0 ip_summed=0 complete_sw=0 valid=0 level=0)
+hash(0x0 sw=0 l4=0) proto=0x0000 pkttype=0 iif=0
+dev name=sit0 feat=0x00000006401d7869
+sk family=17 type=10 proto=0
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/packet/af_packet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 13666fe787db7..109a848aca151 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1975,7 +1975,7 @@ static int packet_sendmsg_spkt(struct socket *sock, struct msghdr *msg,
+ goto retry;
+ }
+
+- if (!dev_validate_header(dev, skb->data, len)) {
++ if (!dev_validate_header(dev, skb->data, len) || !skb->len) {
+ err = -EINVAL;
+ goto out_unlock;
+ }
+--
+2.39.2
+
--- /dev/null
+From 1bf27c6cd0ebda501e1061ae0261700821e4ea1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 May 2023 14:50:53 +0800
+Subject: ALSA: caiaq: input: Add error handling for unsupported input methods
+ in `snd_usb_caiaq_input_init`
+
+From: Ruliang Lin <u202112092@hust.edu.cn>
+
+[ Upstream commit 0d727e1856ef22dd9337199430258cb64cbbc658 ]
+
+Smatch complains that:
+snd_usb_caiaq_input_init() warn: missing error code 'ret'
+
+This patch adds a new case to handle the situation where the
+device does not support any input methods in the
+`snd_usb_caiaq_input_init` function. It returns an `-EINVAL` error code
+to indicate that no input methods are supported on the device.
+
+Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support")
+Signed-off-by: Ruliang Lin <u202112092@hust.edu.cn>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Acked-by: Daniel Mack <daniel@zonque.org>
+Link: https://lore.kernel.org/r/20230504065054.3309-1-u202112092@hust.edu.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/caiaq/input.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/usb/caiaq/input.c b/sound/usb/caiaq/input.c
+index 533eb69fe4e69..cd5a8584dbe32 100644
+--- a/sound/usb/caiaq/input.c
++++ b/sound/usb/caiaq/input.c
+@@ -804,6 +804,7 @@ int snd_usb_caiaq_input_init(struct snd_usb_caiaqdev *cdev)
+
+ default:
+ /* no input methods supported on this device */
++ ret = -EINVAL;
+ goto exit_free_idev;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 1d55f319e9c360e0b8440c6e779fbd64ce5601e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 15:54:55 -0700
+Subject: drm/amdgpu: add a missing lock for AMDGPU_SCHED
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chia-I Wu <olvaffe@gmail.com>
+
+[ Upstream commit 2397e3d8d2e120355201a8310b61929f5a8bd2c0 ]
+
+mgr->ctx_handles should be protected by mgr->lock.
+
+v2: improve commit message
+v3: add a Fixes tag
+
+Signed-off-by: Chia-I Wu <olvaffe@gmail.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Fixes: 52c6a62c64fa ("drm/amdgpu: add interface for editing a foreign process's priority v3")
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c
+index c799691dfa848..94a503dc08b72 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c
+@@ -58,6 +58,7 @@ static int amdgpu_sched_process_priority_override(struct amdgpu_device *adev,
+ {
+ struct fd f = fdget(fd);
+ struct amdgpu_fpriv *fpriv;
++ struct amdgpu_ctx_mgr *mgr;
+ struct amdgpu_ctx *ctx;
+ uint32_t id;
+ int r;
+@@ -71,8 +72,11 @@ static int amdgpu_sched_process_priority_override(struct amdgpu_device *adev,
+ return r;
+ }
+
+- idr_for_each_entry(&fpriv->ctx_mgr.ctx_handles, ctx, id)
++ mgr = &fpriv->ctx_mgr;
++ mutex_lock(&mgr->lock);
++ idr_for_each_entry(&mgr->ctx_handles, ctx, id)
+ amdgpu_ctx_priority_override(ctx, priority);
++ mutex_unlock(&mgr->lock);
+
+ fdput(f);
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 05df0bfd73fa149783a3167043f0be96131ae7e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 May 2023 11:47:40 -0700
+Subject: ionic: remove noise from ethtool rxnfc error msg
+
+From: Shannon Nelson <shannon.nelson@amd.com>
+
+[ Upstream commit 3711d44fac1f80ea69ecb7315fed05b3812a7401 ]
+
+It seems that ethtool is calling into .get_rxnfc more often with
+ETHTOOL_GRXCLSRLCNT which ionic doesn't know about. We don't
+need to log a message about it, just return not supported.
+
+Fixes: aa3198819bea6 ("ionic: Add RSS support")
+Signed-off-by: Shannon Nelson <shannon.nelson@amd.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/pensando/ionic/ionic_ethtool.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c b/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c
+index b8de3784d9769..c53d2271d8abc 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c
+@@ -573,7 +573,7 @@ static int ionic_get_rxnfc(struct net_device *netdev,
+ info->data = lif->nxqs;
+ break;
+ default:
+- netdev_err(netdev, "Command parameter %d is not supported\n",
++ netdev_dbg(netdev, "Command parameter %d is not supported\n",
+ info->cmd);
+ err = -EOPNOTSUPP;
+ }
+--
+2.39.2
+
--- /dev/null
+From e5826e4a0f7a2bf79a7a34f3b78e41d51133ccaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 May 2023 16:07:27 -0700
+Subject: net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop()
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 93e0401e0fc0c54b0ac05b687cd135c2ac38187c ]
+
+The call to phy_stop() races with the later call to phy_disconnect(),
+resulting in concurrent phy_suspend() calls being run from different
+CPUs. The final call to phy_disconnect() ensures that the PHY is
+stopped and suspended, too.
+
+Fixes: c96e731c93ff ("net: bcmgenet: connect and disconnect from the PHY state machine")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/genet/bcmgenet.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index 1b725a021455b..468f79c270ac3 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -2988,7 +2988,6 @@ static void bcmgenet_netif_stop(struct net_device *dev)
+ /* Disable MAC transmit. TX DMA disabled must be done before this */
+ umac_enable_set(priv, CMD_TX_EN, false);
+
+- phy_stop(dev->phydev);
+ bcmgenet_disable_rx_napi(priv);
+ bcmgenet_intr_disable(priv);
+
+--
+2.39.2
+
--- /dev/null
+From 171eca69f01d2a0c4a7f6b4cfb9e98476b1c733a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 May 2023 00:09:46 +0300
+Subject: net: dsa: mt7530: fix corrupt frames using trgmii on 40 MHz XTAL
+ MT7621
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arınç ÜNAL <arinc.unal@arinc9.com>
+
+[ Upstream commit 37c218d8021e36e226add4bab93d071d30fe0704 ]
+
+The multi-chip module MT7530 switch with a 40 MHz oscillator on the
+MT7621AT, MT7621DAT, and MT7621ST SoCs forwards corrupt frames using
+trgmii.
+
+This is caused by the assumption that MT7621 SoCs have got 150 MHz PLL,
+hence using the ncpo1 value, 0x0780.
+
+My testing shows this value works on Unielec U7621-06, Bartel's testing
+shows it won't work on Hi-Link HLK-MT7621A and Netgear WAC104. All devices
+tested have got 40 MHz oscillators.
+
+Using the value for 125 MHz PLL, 0x0640, works on all boards at hand. The
+definitions for 125 MHz PLL exist on the Banana Pi BPI-R2 BSP source code
+whilst 150 MHz PLL don't.
+
+Forwarding frames using trgmii on the MCM MT7530 switch with a 25 MHz
+oscillator on the said MT7621 SoCs works fine because the ncpo1 value
+defined for it is for 125 MHz PLL.
+
+Change the 150 MHz PLL comment to 125 MHz PLL, and use the 125 MHz PLL
+ncpo1 values for both oscillator frequencies.
+
+Link: https://github.com/BPI-SINOVOIP/BPI-R2-bsp/blob/81d24bbce7d99524d0771a8bdb2d6663e4eb4faa/u-boot-mt/drivers/net/rt2880_eth.c#L2195
+Fixes: 7ef6f6f8d237 ("net: dsa: mt7530: Add MT7621 TRGMII mode support")
+Tested-by: Bartel Eerdekens <bartel.eerdekens@constell8.be>
+Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mt7530.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
+index 2d8382eb9add3..baa994b7f78b5 100644
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -397,9 +397,9 @@ mt7530_pad_clk_setup(struct dsa_switch *ds, int mode)
+ case PHY_INTERFACE_MODE_TRGMII:
+ trgint = 1;
+ if (priv->id == ID_MT7621) {
+- /* PLL frequency: 150MHz: 1.2GBit */
++ /* PLL frequency: 125MHz: 1.0GBit */
+ if (xtal == HWTRAP_XTAL_40MHZ)
+- ncpo1 = 0x0780;
++ ncpo1 = 0x0640;
+ if (xtal == HWTRAP_XTAL_25MHZ)
+ ncpo1 = 0x0a00;
+ } else { /* PLL frequency: 250MHz: 2.0Gbit */
+--
+2.39.2
+
--- /dev/null
+From 8d96da5ef82197cec4325628459573bb8979c16f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 22:28:15 +0200
+Subject: net: dsa: mv88e6xxx: add mv88e6321 rsvd2cpu
+
+From: Angelo Dureghello <angelo.dureghello@timesys.com>
+
+[ Upstream commit 6686317855c6997671982d4489ccdd946f644957 ]
+
+Add rsvd2cpu capability for mv88e6321 model, to allow proper bpdu
+processing.
+
+Signed-off-by: Angelo Dureghello <angelo.dureghello@timesys.com>
+Fixes: 51c901a775621 ("net: dsa: mv88e6xxx: distinguish Global 2 Rsvd2CPU")
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mv88e6xxx/chip.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index ea32be579e7b1..3a8a49b7ec3d9 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -3876,6 +3876,7 @@ static const struct mv88e6xxx_ops mv88e6321_ops = {
+ .set_cpu_port = mv88e6095_g1_set_cpu_port,
+ .set_egress_port = mv88e6095_g1_set_egress_port,
+ .watchdog_ops = &mv88e6390_watchdog_ops,
++ .mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu,
+ .reset = mv88e6352_g1_reset,
+ .vtu_getnext = mv88e6185_g1_vtu_getnext,
+ .vtu_loadpurge = mv88e6185_g1_vtu_loadpurge,
+--
+2.39.2
+
--- /dev/null
+From a35dc104e4ef8733195017d054d3b925348f933e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 16:13:50 +0800
+Subject: net/ncsi: clear Tx enable mode when handling a Config required AEN
+
+From: Cosmo Chou <chou.cosmo@gmail.com>
+
+[ Upstream commit 6f75cd166a5a3c0bc50441faa8b8304f60522fdd ]
+
+ncsi_channel_is_tx() determines whether a given channel should be
+used for Tx or not. However, when reconfiguring the channel by
+handling a Configuration Required AEN, there is a misjudgment that
+the channel Tx has already been enabled, which results in the Enable
+Channel Network Tx command not being sent.
+
+Clear the channel Tx enable flag before reconfiguring the channel to
+avoid the misjudgment.
+
+Fixes: 8d951a75d022 ("net/ncsi: Configure multi-package, multi-channel modes with failover")
+Signed-off-by: Cosmo Chou <chou.cosmo@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ncsi/ncsi-aen.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/ncsi/ncsi-aen.c b/net/ncsi/ncsi-aen.c
+index b635c194f0a85..62fb1031763d1 100644
+--- a/net/ncsi/ncsi-aen.c
++++ b/net/ncsi/ncsi-aen.c
+@@ -165,6 +165,7 @@ static int ncsi_aen_handler_cr(struct ncsi_dev_priv *ndp,
+ nc->state = NCSI_CHANNEL_INACTIVE;
+ list_add_tail_rcu(&nc->link, &ndp->channel_queue);
+ spin_unlock_irqrestore(&ndp->lock, flags);
++ nc->modes[NCSI_MODE_TX_ENABLE].enable = 0;
+
+ return ncsi_process_next_channel(ndp);
+ }
+--
+2.39.2
+
--- /dev/null
+From c87146535abdaa5985aa1b4b2c48466d899cd5c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 15:19:40 +0000
+Subject: net/sched: act_mirred: Add carrier check
+
+From: Victor Nogueira <victor@mojatatu.com>
+
+[ Upstream commit 526f28bd0fbdc699cda31426928802650c1528e5 ]
+
+There are cases where the device is adminstratively UP, but operationally
+down. For example, we have a physical device (Nvidia ConnectX-6 Dx, 25Gbps)
+who's cable was pulled out, here is its ip link output:
+
+5: ens2f1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN mode DEFAULT group default qlen 1000
+ link/ether b8:ce:f6:4b:68:35 brd ff:ff:ff:ff:ff:ff
+ altname enp179s0f1np1
+
+As you can see, it's administratively UP but operationally down.
+In this case, sending a packet to this port caused a nasty kernel hang (so
+nasty that we were unable to capture it). Aborting a transmit based on
+operational status (in addition to administrative status) fixes the issue.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Signed-off-by: Victor Nogueira <victor@mojatatu.com>
+v1->v2: Add fixes tag
+v2->v3: Remove blank line between tags + add change log, suggested by Leon
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/act_mirred.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
+index b87d2a1ee0b16..e3f28cb03f7e5 100644
+--- a/net/sched/act_mirred.c
++++ b/net/sched/act_mirred.c
+@@ -244,7 +244,7 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a,
+ goto out;
+ }
+
+- if (unlikely(!(dev->flags & IFF_UP))) {
++ if (unlikely(!(dev->flags & IFF_UP)) || !netif_carrier_ok(dev)) {
+ net_notice_ratelimited("tc mirred to Houston: device %s is down\n",
+ dev->name);
+ goto out;
+--
+2.39.2
+
--- /dev/null
+From 9f13b88933be2fdb5a7ca17270dbe992c803c782 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 14:31:11 +0200
+Subject: net/sched: cls_api: remove block_cb from driver_list before freeing
+
+From: Vlad Buslov <vladbu@nvidia.com>
+
+[ Upstream commit da94a7781fc3c92e7df7832bc2746f4d39bc624e ]
+
+Error handler of tcf_block_bind() frees the whole bo->cb_list on error.
+However, by that time the flow_block_cb instances are already in the driver
+list because driver ndo_setup_tc() callback is called before that up the
+call chain in tcf_block_offload_cmd(). This leaves dangling pointers to
+freed objects in the list and causes use-after-free[0]. Fix it by also
+removing flow_block_cb instances from driver_list before deallocating them.
+
+[0]:
+[ 279.868433] ==================================================================
+[ 279.869964] BUG: KASAN: slab-use-after-free in flow_block_cb_setup_simple+0x631/0x7c0
+[ 279.871527] Read of size 8 at addr ffff888147e2bf20 by task tc/2963
+
+[ 279.873151] CPU: 6 PID: 2963 Comm: tc Not tainted 6.3.0-rc6+ #4
+[ 279.874273] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+[ 279.876295] Call Trace:
+[ 279.876882] <TASK>
+[ 279.877413] dump_stack_lvl+0x33/0x50
+[ 279.878198] print_report+0xc2/0x610
+[ 279.878987] ? flow_block_cb_setup_simple+0x631/0x7c0
+[ 279.879994] kasan_report+0xae/0xe0
+[ 279.880750] ? flow_block_cb_setup_simple+0x631/0x7c0
+[ 279.881744] ? mlx5e_tc_reoffload_flows_work+0x240/0x240 [mlx5_core]
+[ 279.883047] flow_block_cb_setup_simple+0x631/0x7c0
+[ 279.884027] tcf_block_offload_cmd.isra.0+0x189/0x2d0
+[ 279.885037] ? tcf_block_setup+0x6b0/0x6b0
+[ 279.885901] ? mutex_lock+0x7d/0xd0
+[ 279.886669] ? __mutex_unlock_slowpath.constprop.0+0x2d0/0x2d0
+[ 279.887844] ? ingress_init+0x1c0/0x1c0 [sch_ingress]
+[ 279.888846] tcf_block_get_ext+0x61c/0x1200
+[ 279.889711] ingress_init+0x112/0x1c0 [sch_ingress]
+[ 279.890682] ? clsact_init+0x2b0/0x2b0 [sch_ingress]
+[ 279.891701] qdisc_create+0x401/0xea0
+[ 279.892485] ? qdisc_tree_reduce_backlog+0x470/0x470
+[ 279.893473] tc_modify_qdisc+0x6f7/0x16d0
+[ 279.894344] ? tc_get_qdisc+0xac0/0xac0
+[ 279.895213] ? mutex_lock+0x7d/0xd0
+[ 279.896005] ? __mutex_lock_slowpath+0x10/0x10
+[ 279.896910] rtnetlink_rcv_msg+0x5fe/0x9d0
+[ 279.897770] ? rtnl_calcit.isra.0+0x2b0/0x2b0
+[ 279.898672] ? __sys_sendmsg+0xb5/0x140
+[ 279.899494] ? do_syscall_64+0x3d/0x90
+[ 279.900302] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0
+[ 279.901337] ? kasan_save_stack+0x2e/0x40
+[ 279.902177] ? kasan_save_stack+0x1e/0x40
+[ 279.903058] ? kasan_set_track+0x21/0x30
+[ 279.903913] ? kasan_save_free_info+0x2a/0x40
+[ 279.904836] ? ____kasan_slab_free+0x11a/0x1b0
+[ 279.905741] ? kmem_cache_free+0x179/0x400
+[ 279.906599] netlink_rcv_skb+0x12c/0x360
+[ 279.907450] ? rtnl_calcit.isra.0+0x2b0/0x2b0
+[ 279.908360] ? netlink_ack+0x1550/0x1550
+[ 279.909192] ? rhashtable_walk_peek+0x170/0x170
+[ 279.910135] ? kmem_cache_alloc_node+0x1af/0x390
+[ 279.911086] ? _copy_from_iter+0x3d6/0xc70
+[ 279.912031] netlink_unicast+0x553/0x790
+[ 279.912864] ? netlink_attachskb+0x6a0/0x6a0
+[ 279.913763] ? netlink_recvmsg+0x416/0xb50
+[ 279.914627] netlink_sendmsg+0x7a1/0xcb0
+[ 279.915473] ? netlink_unicast+0x790/0x790
+[ 279.916334] ? iovec_from_user.part.0+0x4d/0x220
+[ 279.917293] ? netlink_unicast+0x790/0x790
+[ 279.918159] sock_sendmsg+0xc5/0x190
+[ 279.918938] ____sys_sendmsg+0x535/0x6b0
+[ 279.919813] ? import_iovec+0x7/0x10
+[ 279.920601] ? kernel_sendmsg+0x30/0x30
+[ 279.921423] ? __copy_msghdr+0x3c0/0x3c0
+[ 279.922254] ? import_iovec+0x7/0x10
+[ 279.923041] ___sys_sendmsg+0xeb/0x170
+[ 279.923854] ? copy_msghdr_from_user+0x110/0x110
+[ 279.924797] ? ___sys_recvmsg+0xd9/0x130
+[ 279.925630] ? __perf_event_task_sched_in+0x183/0x470
+[ 279.926656] ? ___sys_sendmsg+0x170/0x170
+[ 279.927529] ? ctx_sched_in+0x530/0x530
+[ 279.928369] ? update_curr+0x283/0x4f0
+[ 279.929185] ? perf_event_update_userpage+0x570/0x570
+[ 279.930201] ? __fget_light+0x57/0x520
+[ 279.931023] ? __switch_to+0x53d/0xe70
+[ 279.931846] ? sockfd_lookup_light+0x1a/0x140
+[ 279.932761] __sys_sendmsg+0xb5/0x140
+[ 279.933560] ? __sys_sendmsg_sock+0x20/0x20
+[ 279.934436] ? fpregs_assert_state_consistent+0x1d/0xa0
+[ 279.935490] do_syscall_64+0x3d/0x90
+[ 279.936300] entry_SYSCALL_64_after_hwframe+0x46/0xb0
+[ 279.937311] RIP: 0033:0x7f21c814f887
+[ 279.938085] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
+[ 279.941448] RSP: 002b:00007fff11efd478 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
+[ 279.942964] RAX: ffffffffffffffda RBX: 0000000064401979 RCX: 00007f21c814f887
+[ 279.944337] RDX: 0000000000000000 RSI: 00007fff11efd4e0 RDI: 0000000000000003
+[ 279.945660] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
+[ 279.947003] R10: 00007f21c8008708 R11: 0000000000000246 R12: 0000000000000001
+[ 279.948345] R13: 0000000000409980 R14: 000000000047e538 R15: 0000000000485400
+[ 279.949690] </TASK>
+
+[ 279.950706] Allocated by task 2960:
+[ 279.951471] kasan_save_stack+0x1e/0x40
+[ 279.952338] kasan_set_track+0x21/0x30
+[ 279.953165] __kasan_kmalloc+0x77/0x90
+[ 279.954006] flow_block_cb_setup_simple+0x3dd/0x7c0
+[ 279.955001] tcf_block_offload_cmd.isra.0+0x189/0x2d0
+[ 279.956020] tcf_block_get_ext+0x61c/0x1200
+[ 279.956881] ingress_init+0x112/0x1c0 [sch_ingress]
+[ 279.957873] qdisc_create+0x401/0xea0
+[ 279.958656] tc_modify_qdisc+0x6f7/0x16d0
+[ 279.959506] rtnetlink_rcv_msg+0x5fe/0x9d0
+[ 279.960392] netlink_rcv_skb+0x12c/0x360
+[ 279.961216] netlink_unicast+0x553/0x790
+[ 279.962044] netlink_sendmsg+0x7a1/0xcb0
+[ 279.962906] sock_sendmsg+0xc5/0x190
+[ 279.963702] ____sys_sendmsg+0x535/0x6b0
+[ 279.964534] ___sys_sendmsg+0xeb/0x170
+[ 279.965343] __sys_sendmsg+0xb5/0x140
+[ 279.966132] do_syscall_64+0x3d/0x90
+[ 279.966908] entry_SYSCALL_64_after_hwframe+0x46/0xb0
+
+[ 279.968407] Freed by task 2960:
+[ 279.969114] kasan_save_stack+0x1e/0x40
+[ 279.969929] kasan_set_track+0x21/0x30
+[ 279.970729] kasan_save_free_info+0x2a/0x40
+[ 279.971603] ____kasan_slab_free+0x11a/0x1b0
+[ 279.972483] __kmem_cache_free+0x14d/0x280
+[ 279.973337] tcf_block_setup+0x29d/0x6b0
+[ 279.974173] tcf_block_offload_cmd.isra.0+0x226/0x2d0
+[ 279.975186] tcf_block_get_ext+0x61c/0x1200
+[ 279.976080] ingress_init+0x112/0x1c0 [sch_ingress]
+[ 279.977065] qdisc_create+0x401/0xea0
+[ 279.977857] tc_modify_qdisc+0x6f7/0x16d0
+[ 279.978695] rtnetlink_rcv_msg+0x5fe/0x9d0
+[ 279.979562] netlink_rcv_skb+0x12c/0x360
+[ 279.980388] netlink_unicast+0x553/0x790
+[ 279.981214] netlink_sendmsg+0x7a1/0xcb0
+[ 279.982043] sock_sendmsg+0xc5/0x190
+[ 279.982827] ____sys_sendmsg+0x535/0x6b0
+[ 279.983703] ___sys_sendmsg+0xeb/0x170
+[ 279.984510] __sys_sendmsg+0xb5/0x140
+[ 279.985298] do_syscall_64+0x3d/0x90
+[ 279.986076] entry_SYSCALL_64_after_hwframe+0x46/0xb0
+
+[ 279.987532] The buggy address belongs to the object at ffff888147e2bf00
+ which belongs to the cache kmalloc-192 of size 192
+[ 279.989747] The buggy address is located 32 bytes inside of
+ freed 192-byte region [ffff888147e2bf00, ffff888147e2bfc0)
+
+[ 279.992367] The buggy address belongs to the physical page:
+[ 279.993430] page:00000000550f405c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x147e2a
+[ 279.995182] head:00000000550f405c order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0
+[ 279.996713] anon flags: 0x200000000010200(slab|head|node=0|zone=2)
+[ 279.997878] raw: 0200000000010200 ffff888100042a00 0000000000000000 dead000000000001
+[ 279.999384] raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000
+[ 280.000894] page dumped because: kasan: bad access detected
+
+[ 280.002386] Memory state around the buggy address:
+[ 280.003338] ffff888147e2be00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[ 280.004781] ffff888147e2be80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
+[ 280.006224] >ffff888147e2bf00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[ 280.007700] ^
+[ 280.008592] ffff888147e2bf80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
+[ 280.010035] ffff888147e2c000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[ 280.011564] ==================================================================
+
+Fixes: 59094b1e5094 ("net: sched: use flow block API")
+Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/cls_api.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
+index 77a1988d5ddc7..49777da9f2634 100644
+--- a/net/sched/cls_api.c
++++ b/net/sched/cls_api.c
+@@ -1500,6 +1500,7 @@ static int tcf_block_bind(struct tcf_block *block,
+
+ err_unroll:
+ list_for_each_entry_safe(block_cb, next, &bo->cb_list, list) {
++ list_del(&block_cb->driver_list);
+ if (i-- > 0) {
+ list_del(&block_cb->list);
+ tcf_block_playback_offloads(block, block_cb->cb,
+--
+2.39.2
+
--- /dev/null
+From 526ff192d74f95f742834c0b1118486e00e92e53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 14:46:39 +0200
+Subject: perf map: Delete two variable initialisations before null pointer
+ checks in sort__sym_from_cmp()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Markus Elfring <Markus.Elfring@web.de>
+
+[ Upstream commit c160118a90d4acf335993d8d59b02ae2147a524e ]
+
+Addresses of two data structure members were determined before
+corresponding null pointer checks in the implementation of the function
+“sort__sym_from_cmp”.
+
+Thus avoid the risk for undefined behaviour by removing extra
+initialisations for the local variables “from_l” and “from_r” (also
+because they were already reassigned with the same value behind this
+pointer check).
+
+This issue was detected by using the Coccinelle software.
+
+Fixes: 1b9e97a2a95e4941 ("perf tools: Fix report -F symbol_from for data without branch info")
+Signed-off-by: <elfring@users.sourceforge.net>
+Acked-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: German Gomez <german.gomez@arm.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/cocci/54a21fea-64e3-de67-82ef-d61b90ffad05@web.de/
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/sort.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c
+index 4027906fd3e38..baf73ca66a2bd 100644
+--- a/tools/perf/util/sort.c
++++ b/tools/perf/util/sort.c
+@@ -830,8 +830,7 @@ static int hist_entry__dso_to_filter(struct hist_entry *he, int type,
+ static int64_t
+ sort__sym_from_cmp(struct hist_entry *left, struct hist_entry *right)
+ {
+- struct addr_map_symbol *from_l = &left->branch_info->from;
+- struct addr_map_symbol *from_r = &right->branch_info->from;
++ struct addr_map_symbol *from_l, *from_r;
+
+ if (!left->branch_info || !right->branch_info)
+ return cmp_null(left->branch_info, right->branch_info);
+--
+2.39.2
+
--- /dev/null
+From aed5aa48e69b028fcad747d4afef490569eed2b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Apr 2023 01:28:41 +0000
+Subject: perf symbols: Fix return incorrect build_id size in
+ elf_read_build_id()
+
+From: Yang Jihong <yangjihong1@huawei.com>
+
+[ Upstream commit 1511e4696acb715a4fe48be89e1e691daec91c0e ]
+
+In elf_read_build_id(), if gnu build_id is found, should return the size of
+the actually copied data. If descsz is greater thanBuild_ID_SIZE,
+write_buildid data access may occur.
+
+Fixes: be96ea8ffa788dcc ("perf symbols: Fix issue with binaries using 16-bytes buildids (v2)")
+Reported-by: Will Ochowicz <Will.Ochowicz@genusplc.com>
+Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
+Tested-by: Will Ochowicz <Will.Ochowicz@genusplc.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Leo Yan <leo.yan@linaro.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Link: https://lore.kernel.org/lkml/CWLP265MB49702F7BA3D6D8F13E4B1A719C649@CWLP265MB4970.GBRP265.PROD.OUTLOOK.COM/T/
+Link: https://lore.kernel.org/r/20230427012841.231729-1-yangjihong1@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/symbol-elf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
+index 4fef8d6bc2255..73f890664be5e 100644
+--- a/tools/perf/util/symbol-elf.c
++++ b/tools/perf/util/symbol-elf.c
+@@ -546,7 +546,7 @@ static int elf_read_build_id(Elf *elf, void *bf, size_t size)
+ size_t sz = min(size, descsz);
+ memcpy(bf, ptr, sz);
+ memset(bf + sz, 0, size - sz);
+- err = descsz;
++ err = sz;
+ break;
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From 63f82559e54c7e5682cb44b6fa5e38d694111c8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 16:59:08 +0530
+Subject: perf vendor events power9: Remove UTF-8 characters from JSON files
+
+From: Kajol Jain <kjain@linux.ibm.com>
+
+[ Upstream commit 5d9df8731c0941f3add30f96745a62586a0c9d52 ]
+
+Commit 3c22ba5243040c13 ("perf vendor events powerpc: Update POWER9
+events") added and updated power9 PMU JSON events. However some of the
+JSON events which are part of other.json and pipeline.json files,
+contains UTF-8 characters in their brief description. Having UTF-8
+character could breaks the perf build on some distros.
+
+Fix this issue by removing the UTF-8 characters from other.json and
+pipeline.json files.
+
+Result without the fix:
+
+ [command]# file -i pmu-events/arch/powerpc/power9/*
+ pmu-events/arch/powerpc/power9/cache.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/floating-point.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/frontend.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/marked.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/memory.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/metrics.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/nest_metrics.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/other.json: application/json; charset=utf-8
+ pmu-events/arch/powerpc/power9/pipeline.json: application/json; charset=utf-8
+ pmu-events/arch/powerpc/power9/pmc.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/translation.json: application/json; charset=us-ascii
+ [command]#
+
+Result with the fix:
+
+ [command]# file -i pmu-events/arch/powerpc/power9/*
+ pmu-events/arch/powerpc/power9/cache.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/floating-point.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/frontend.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/marked.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/memory.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/metrics.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/nest_metrics.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/other.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/pipeline.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/pmc.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/translation.json: application/json; charset=us-ascii
+ [command]#
+
+Fixes: 3c22ba5243040c13 ("perf vendor events powerpc: Update POWER9 events")
+Reported-by: Arnaldo Carvalho de Melo <acme@kernel.com>
+Signed-off-by: Kajol Jain <kjain@linux.ibm.com>
+Acked-by: Ian Rogers <irogers@google.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+Cc: Disha Goel <disgoel@linux.ibm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
+Cc: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
+Cc: linuxppc-dev@lists.ozlabs.org
+Link: https://lore.kernel.org/lkml/ZBxP77deq7ikTxwG@kernel.org/
+Link: https://lore.kernel.org/r/20230328112908.113158-1-kjain@linux.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/pmu-events/arch/powerpc/power9/other.json | 4 ++--
+ tools/perf/pmu-events/arch/powerpc/power9/pipeline.json | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/perf/pmu-events/arch/powerpc/power9/other.json b/tools/perf/pmu-events/arch/powerpc/power9/other.json
+index 62b8642696237..ce75652e90516 100644
+--- a/tools/perf/pmu-events/arch/powerpc/power9/other.json
++++ b/tools/perf/pmu-events/arch/powerpc/power9/other.json
+@@ -1417,7 +1417,7 @@
+ {,
+ "EventCode": "0x45054",
+ "EventName": "PM_FMA_CMPL",
+- "BriefDescription": "two flops operation completed (fmadd, fnmadd, fmsub, fnmsub) Scalar instructions only. "
++ "BriefDescription": "two flops operation completed (fmadd, fnmadd, fmsub, fnmsub) Scalar instructions only."
+ },
+ {,
+ "EventCode": "0x201E8",
+@@ -2017,7 +2017,7 @@
+ {,
+ "EventCode": "0xC0BC",
+ "EventName": "PM_LSU_FLUSH_OTHER",
+- "BriefDescription": "Other LSU flushes including: Sync (sync ack from L2 caused search of LRQ for oldest snooped load, This will either signal a Precise Flush of the oldest snooped loa or a Flush Next PPC); Data Valid Flush Next (several cases of this, one example is store and reload are lined up such that a store-hit-reload scenario exists and the CDF has already launched and has gotten bad/stale data); Bad Data Valid Flush Next (might be a few cases of this, one example is a larxa (D$ hit) return data and dval but can't allocate to LMQ (LMQ full or other reason). Already gave dval but can't watch it for snoop_hit_larx. Need to take the “bad dval” back and flush all younger ops)"
++ "BriefDescription": "Other LSU flushes including: Sync (sync ack from L2 caused search of LRQ for oldest snooped load, This will either signal a Precise Flush of the oldest snooped loa or a Flush Next PPC); Data Valid Flush Next (several cases of this, one example is store and reload are lined up such that a store-hit-reload scenario exists and the CDF has already launched and has gotten bad/stale data); Bad Data Valid Flush Next (might be a few cases of this, one example is a larxa (D$ hit) return data and dval but can't allocate to LMQ (LMQ full or other reason). Already gave dval but can't watch it for snoop_hit_larx. Need to take the 'bad dval' back and flush all younger ops)"
+ },
+ {,
+ "EventCode": "0x5094",
+diff --git a/tools/perf/pmu-events/arch/powerpc/power9/pipeline.json b/tools/perf/pmu-events/arch/powerpc/power9/pipeline.json
+index b4772f54a2718..e2f2ed0a35496 100644
+--- a/tools/perf/pmu-events/arch/powerpc/power9/pipeline.json
++++ b/tools/perf/pmu-events/arch/powerpc/power9/pipeline.json
+@@ -442,7 +442,7 @@
+ {,
+ "EventCode": "0x4D052",
+ "EventName": "PM_2FLOP_CMPL",
+- "BriefDescription": "DP vector version of fmul, fsub, fcmp, fsel, fabs, fnabs, fres ,fsqrte, fneg "
++ "BriefDescription": "DP vector version of fmul, fsub, fcmp, fsel, fabs, fnabs, fres ,fsqrte, fneg"
+ },
+ {,
+ "EventCode": "0x1F142",
+--
+2.39.2
+
--- /dev/null
+From 3a83354ed157ee493a0b884151a61f919d5156c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Apr 2023 21:27:54 +0100
+Subject: rxrpc: Fix hard call timeout units
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 0d098d83c5d9e107b2df7f5e11f81492f56d2fe7 ]
+
+The hard call timeout is specified in the RXRPC_SET_CALL_TIMEOUT cmsg in
+seconds, so fix the point at which sendmsg() applies it to the call to
+convert to jiffies from seconds, not milliseconds.
+
+Fixes: a158bdd3247b ("rxrpc: Fix timeout of a call that hasn't yet been granted a channel")
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: "David S. Miller" <davem@davemloft.net>
+cc: Eric Dumazet <edumazet@google.com>
+cc: Jakub Kicinski <kuba@kernel.org>
+cc: Paolo Abeni <pabeni@redhat.com>
+cc: linux-afs@lists.infradead.org
+cc: netdev@vger.kernel.org
+cc: linux-kernel@vger.kernel.org
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rxrpc/sendmsg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
+index 1cb90d32d553d..3439d14168e81 100644
+--- a/net/rxrpc/sendmsg.c
++++ b/net/rxrpc/sendmsg.c
+@@ -738,7 +738,7 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
+ /* Fall through */
+ case 1:
+ if (p.call.timeouts.hard > 0) {
+- j = msecs_to_jiffies(p.call.timeouts.hard);
++ j = p.call.timeouts.hard * HZ;
+ now = jiffies;
+ j += now;
+ WRITE_ONCE(call->expect_term_by, j);
+--
+2.39.2
+
crypto-safexcel-cleanup-ring-irq-workqueues-on-load-.patch
kernel-relay.c-fix-read_pos-error-when-multiple-read.patch
relayfs-fix-out-of-bounds-access-in-relay_file_read.patch
+net-ncsi-clear-tx-enable-mode-when-handling-a-config.patch
+net-sched-cls_api-remove-block_cb-from-driver_list-b.patch
+sit-update-dev-needed_headroom-in-ipip6_tunnel_bind_.patch
+net-dsa-mv88e6xxx-add-mv88e6321-rsvd2cpu.patch
+writeback-fix-call-of-incorrect-macro.patch
+net-sched-act_mirred-add-carrier-check.patch
+rxrpc-fix-hard-call-timeout-units.patch
+ionic-remove-noise-from-ethtool-rxnfc-error-msg.patch
+af_packet-don-t-send-zero-byte-data-in-packet_sendms.patch
+drm-amdgpu-add-a-missing-lock-for-amdgpu_sched.patch
+alsa-caiaq-input-add-error-handling-for-unsupported-.patch
+net-dsa-mt7530-fix-corrupt-frames-using-trgmii-on-40.patch
+virtio_net-split-free_unused_bufs.patch
+virtio_net-suppress-cpu-stall-when-free_unused_bufs.patch
+net-bcmgenet-remove-phy_stop-from-bcmgenet_netif_sto.patch
+perf-vendor-events-power9-remove-utf-8-characters-fr.patch
+perf-map-delete-two-variable-initialisations-before-.patch
+perf-symbols-fix-return-incorrect-build_id-size-in-e.patch
--- /dev/null
+From 7466e9d6e42c6335577dbc6ead4d248cc3ad9e1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 23:00:06 -0700
+Subject: sit: update dev->needed_headroom in ipip6_tunnel_bind_dev()
+
+From: Cong Wang <cong.wang@bytedance.com>
+
+[ Upstream commit c88f8d5cd95fd039cff95d682b8e71100c001df0 ]
+
+When a tunnel device is bound with the underlying device, its
+dev->needed_headroom needs to be updated properly. IPv4 tunnels
+already do the same in ip_tunnel_bind_dev(). Otherwise we may
+not have enough header room for skb, especially after commit
+b17f709a2401 ("gue: TX support for using remote checksum offload option").
+
+Fixes: 32b8a8e59c9c ("sit: add IPv4 over IPv4 support")
+Reported-by: Palash Oswal <oswalpalash@gmail.com>
+Link: https://lore.kernel.org/netdev/CAGyP=7fDcSPKu6nttbGwt7RXzE3uyYxLjCSE97J64pRxJP8jPA@mail.gmail.com/
+Cc: Kuniyuki Iwashima <kuniyu@amazon.com>
+Cc: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Cong Wang <cong.wang@bytedance.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/sit.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index 1179608955f5f..8d704ea946933 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -1054,12 +1054,13 @@ static netdev_tx_t sit_tunnel_xmit(struct sk_buff *skb,
+
+ static void ipip6_tunnel_bind_dev(struct net_device *dev)
+ {
++ struct ip_tunnel *tunnel = netdev_priv(dev);
++ int t_hlen = tunnel->hlen + sizeof(struct iphdr);
+ struct net_device *tdev = NULL;
+- struct ip_tunnel *tunnel;
++ int hlen = LL_MAX_HEADER;
+ const struct iphdr *iph;
+ struct flowi4 fl4;
+
+- tunnel = netdev_priv(dev);
+ iph = &tunnel->parms.iph;
+
+ if (iph->daddr) {
+@@ -1082,14 +1083,15 @@ static void ipip6_tunnel_bind_dev(struct net_device *dev)
+ tdev = __dev_get_by_index(tunnel->net, tunnel->parms.link);
+
+ if (tdev && !netif_is_l3_master(tdev)) {
+- int t_hlen = tunnel->hlen + sizeof(struct iphdr);
+ int mtu;
+
+ mtu = tdev->mtu - t_hlen;
+ if (mtu < IPV6_MIN_MTU)
+ mtu = IPV6_MIN_MTU;
+ WRITE_ONCE(dev->mtu, mtu);
++ hlen = tdev->hard_header_len + tdev->needed_headroom;
+ }
++ dev->needed_headroom = t_hlen + hlen;
+ }
+
+ static void ipip6_tunnel_update(struct ip_tunnel *t, struct ip_tunnel_parm *p,
+--
+2.39.2
+
--- /dev/null
+From 5826b68cbfa056c8eb6e4cfedbceedd1db3ead23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Aug 2022 14:38:59 +0800
+Subject: virtio_net: split free_unused_bufs()
+
+From: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
+
+[ Upstream commit 6e345f8c7cd029ad3aaece15ad4425ac26e4eb63 ]
+
+This patch separates two functions for freeing sq buf and rq buf from
+free_unused_bufs().
+
+When supporting the enable/disable tx/rq queue in the future, it is
+necessary to support separate recovery of a sq buf or a rq buf.
+
+Signed-off-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Message-Id: <20220801063902.129329-40-xuanzhuo@linux.alibaba.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Stable-dep-of: f8bb51043945 ("virtio_net: suppress cpu stall when free_unused_bufs")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/virtio_net.c | 41 ++++++++++++++++++++++++----------------
+ 1 file changed, 25 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 59d4449450ee8..b77181f04b119 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -2792,6 +2792,27 @@ static void free_receive_page_frags(struct virtnet_info *vi)
+ put_page(vi->rq[i].alloc_frag.page);
+ }
+
++static void virtnet_sq_free_unused_buf(struct virtqueue *vq, void *buf)
++{
++ if (!is_xdp_frame(buf))
++ dev_kfree_skb(buf);
++ else
++ xdp_return_frame(ptr_to_xdp(buf));
++}
++
++static void virtnet_rq_free_unused_buf(struct virtqueue *vq, void *buf)
++{
++ struct virtnet_info *vi = vq->vdev->priv;
++ int i = vq2rxq(vq);
++
++ if (vi->mergeable_rx_bufs)
++ put_page(virt_to_head_page(buf));
++ else if (vi->big_packets)
++ give_pages(&vi->rq[i], buf);
++ else
++ put_page(virt_to_head_page(buf));
++}
++
+ static void free_unused_bufs(struct virtnet_info *vi)
+ {
+ void *buf;
+@@ -2799,26 +2820,14 @@ static void free_unused_bufs(struct virtnet_info *vi)
+
+ for (i = 0; i < vi->max_queue_pairs; i++) {
+ struct virtqueue *vq = vi->sq[i].vq;
+- while ((buf = virtqueue_detach_unused_buf(vq)) != NULL) {
+- if (!is_xdp_frame(buf))
+- dev_kfree_skb(buf);
+- else
+- xdp_return_frame(ptr_to_xdp(buf));
+- }
++ while ((buf = virtqueue_detach_unused_buf(vq)) != NULL)
++ virtnet_sq_free_unused_buf(vq, buf);
+ }
+
+ for (i = 0; i < vi->max_queue_pairs; i++) {
+ struct virtqueue *vq = vi->rq[i].vq;
+-
+- while ((buf = virtqueue_detach_unused_buf(vq)) != NULL) {
+- if (vi->mergeable_rx_bufs) {
+- put_page(virt_to_head_page(buf));
+- } else if (vi->big_packets) {
+- give_pages(&vi->rq[i], buf);
+- } else {
+- put_page(virt_to_head_page(buf));
+- }
+- }
++ while ((buf = virtqueue_detach_unused_buf(vq)) != NULL)
++ virtnet_rq_free_unused_buf(vq, buf);
+ }
+ }
+
+--
+2.39.2
+
--- /dev/null
+From b8974557fe2a5ceb5f01441d8a993eb39e9cc472 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 May 2023 10:27:06 +0800
+Subject: virtio_net: suppress cpu stall when free_unused_bufs
+
+From: Wenliang Wang <wangwenliang.1995@bytedance.com>
+
+[ Upstream commit f8bb5104394560e29017c25bcade4c6b7aabd108 ]
+
+For multi-queue and large ring-size use case, the following error
+occurred when free_unused_bufs:
+rcu: INFO: rcu_sched self-detected stall on CPU.
+
+Fixes: 986a4f4d452d ("virtio_net: multiqueue support")
+Signed-off-by: Wenliang Wang <wangwenliang.1995@bytedance.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/virtio_net.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index b77181f04b119..7922e833620e8 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -2822,12 +2822,14 @@ static void free_unused_bufs(struct virtnet_info *vi)
+ struct virtqueue *vq = vi->sq[i].vq;
+ while ((buf = virtqueue_detach_unused_buf(vq)) != NULL)
+ virtnet_sq_free_unused_buf(vq, buf);
++ cond_resched();
+ }
+
+ for (i = 0; i < vi->max_queue_pairs; i++) {
+ struct virtqueue *vq = vi->rq[i].vq;
+ while ((buf = virtqueue_detach_unused_buf(vq)) != NULL)
+ virtnet_rq_free_unused_buf(vq, buf);
++ cond_resched();
+ }
+ }
+
+--
+2.39.2
+
--- /dev/null
+From f8c3f8b3bb16637f40ba9f7e7ab2dea3ce60ee92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 13:44:43 +0300
+Subject: writeback: fix call of incorrect macro
+
+From: Maxim Korotkov <korotkov.maxim.s@gmail.com>
+
+[ Upstream commit 3e46c89c74f2c38e5337d2cf44b0b551adff1cb4 ]
+
+ the variable 'history' is of type u16, it may be an error
+ that the hweight32 macro was used for it
+ I guess macro hweight16 should be used
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 2a81490811d0 ("writeback: implement foreign cgroup inode detection")
+Signed-off-by: Maxim Korotkov <korotkov.maxim.s@gmail.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20230119104443.3002-1-korotkov.maxim.s@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fs-writeback.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
+index 5b3a288e0f14b..3ec2c16abece3 100644
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -700,7 +700,7 @@ void wbc_detach_inode(struct writeback_control *wbc)
+ * is okay. The main goal is avoiding keeping an inode on
+ * the wrong wb for an extended period of time.
+ */
+- if (hweight32(history) > WB_FRN_HIST_THR_SLOTS)
++ if (hweight16(history) > WB_FRN_HIST_THR_SLOTS)
+ inode_switch_wbs(inode, max_id);
+ }
+
+--
+2.39.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
