--- /dev/null
+From b0c52b467e511a3b35a74ebfb7298024b4058a1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Aug 2021 02:59:42 +0530
+Subject: cxgb4: dont touch blocked freelist bitmap after free
+
+From: Rahul Lakkireddy <rahul.lakkireddy@chelsio.com>
+
+[ Upstream commit 43fed4d48d325e0a61dc2638a84da972fbb1087b ]
+
+When adapter init fails, the blocked freelist bitmap is already freed
+up and should not be touched. So, move the bitmap zeroing closer to
+where it was successfully allocated. Also handle adapter init failure
+unwind path immediately and avoid setting up RDMA memory windows.
+
+Fixes: 5b377d114f2b ("cxgb4: Add debugfs facility to inject FL starvation")
+Signed-off-by: Rahul Lakkireddy <rahul.lakkireddy@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+index 9f62ffe64781..920046717638 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+@@ -5068,6 +5068,7 @@ static int adap_init0(struct adapter *adap, int vpd_skip)
+ ret = -ENOMEM;
+ goto bye;
+ }
++ bitmap_zero(adap->sge.blocked_fl, adap->sge.egr_sz);
+ #endif
+
+ params[0] = FW_PARAM_PFVF(CLIP_START);
+@@ -6788,13 +6789,11 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+
+ setup_memwin(adapter);
+ err = adap_init0(adapter, 0);
+-#ifdef CONFIG_DEBUG_FS
+- bitmap_zero(adapter->sge.blocked_fl, adapter->sge.egr_sz);
+-#endif
+- setup_memwin_rdma(adapter);
+ if (err)
+ goto out_unmap_bar;
+
++ setup_memwin_rdma(adapter);
++
+ /* configure SGE_STAT_CFG_A to read WC stats */
+ if (!is_t4(adapter->params.chip))
+ t4_write_reg(adapter, SGE_STAT_CFG_A, STATSOURCE_T5_V(7) |
+--
+2.30.2
+
--- /dev/null
+From b953e59b49d20ef65875cacb61f379d3e1b33c87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Jul 2021 07:10:31 +0300
+Subject: e1000e: Do not take care about recovery NVM checksum
+
+From: Sasha Neftin <sasha.neftin@intel.com>
+
+[ Upstream commit 4051f68318ca9f3d3becef3b54e70ad2c146df97 ]
+
+On new platforms, the NVM is read-only. Attempting to update the NVM
+is causing a lockup to occur. Do not attempt to write to the NVM
+on platforms where it's not supported.
+Emit an error message when the NVM checksum is invalid.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=213667
+Fixes: fb776f5d57ee ("e1000e: Add support for Tiger Lake")
+Suggested-by: Dima Ruinskiy <dima.ruinskiy@intel.com>
+Suggested-by: Vitaly Lifshits <vitaly.lifshits@intel.com>
+Signed-off-by: Sasha Neftin <sasha.neftin@intel.com>
+Tested-by: Dvora Fuxbrumer <dvorax.fuxbrumer@linux.intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/e1000e/ich8lan.c | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+index 8f6ed3b31db4..c6ec669aa7bd 100644
+--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+@@ -4127,13 +4127,17 @@ static s32 e1000_validate_nvm_checksum_ich8lan(struct e1000_hw *hw)
+ return ret_val;
+
+ if (!(data & valid_csum_mask)) {
+- data |= valid_csum_mask;
+- ret_val = e1000_write_nvm(hw, word, 1, &data);
+- if (ret_val)
+- return ret_val;
+- ret_val = e1000e_update_nvm_checksum(hw);
+- if (ret_val)
+- return ret_val;
++ e_dbg("NVM Checksum Invalid\n");
++
++ if (hw->mac.type < e1000_pch_cnp) {
++ data |= valid_csum_mask;
++ ret_val = e1000_write_nvm(hw, word, 1, &data);
++ if (ret_val)
++ return ret_val;
++ ret_val = e1000e_update_nvm_checksum(hw);
++ if (ret_val)
++ return ret_val;
++ }
+ }
+
+ return e1000e_validate_nvm_checksum_generic(hw);
+--
+2.30.2
+
--- /dev/null
+From 5ab7527e90e9a8d31918bb8b8cd4b0139bc580a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jul 2021 10:11:41 +0300
+Subject: e1000e: Fix the max snoop/no-snoop latency for 10M
+
+From: Sasha Neftin <sasha.neftin@intel.com>
+
+[ Upstream commit 44a13a5d99c71bf9e1676d9e51679daf4d7b3d73 ]
+
+We should decode the latency and the max_latency before directly compare.
+The latency should be presented as lat_enc = scale x value:
+lat_enc_d = (lat_enc & 0x0x3ff) x (1U << (5*((max_ltr_enc & 0x1c00)
+>> 10)))
+
+Fixes: cf8fb73c23aa ("e1000e: add support for LTR on I217/I218")
+Suggested-by: Yee Li <seven.yi.lee@gmail.com>
+Signed-off-by: Sasha Neftin <sasha.neftin@intel.com>
+Tested-by: Dvora Fuxbrumer <dvorax.fuxbrumer@linux.intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/e1000e/ich8lan.c | 14 +++++++++++++-
+ drivers/net/ethernet/intel/e1000e/ich8lan.h | 3 +++
+ 2 files changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+index 590ad110d383..8f6ed3b31db4 100644
+--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+@@ -1006,6 +1006,8 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link)
+ {
+ u32 reg = link << (E1000_LTRV_REQ_SHIFT + E1000_LTRV_NOSNOOP_SHIFT) |
+ link << E1000_LTRV_REQ_SHIFT | E1000_LTRV_SEND;
++ u16 max_ltr_enc_d = 0; /* maximum LTR decoded by platform */
++ u16 lat_enc_d = 0; /* latency decoded */
+ u16 lat_enc = 0; /* latency encoded */
+
+ if (link) {
+@@ -1059,7 +1061,17 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link)
+ E1000_PCI_LTR_CAP_LPT + 2, &max_nosnoop);
+ max_ltr_enc = max_t(u16, max_snoop, max_nosnoop);
+
+- if (lat_enc > max_ltr_enc)
++ lat_enc_d = (lat_enc & E1000_LTRV_VALUE_MASK) *
++ (1U << (E1000_LTRV_SCALE_FACTOR *
++ ((lat_enc & E1000_LTRV_SCALE_MASK)
++ >> E1000_LTRV_SCALE_SHIFT)));
++
++ max_ltr_enc_d = (max_ltr_enc & E1000_LTRV_VALUE_MASK) *
++ (1U << (E1000_LTRV_SCALE_FACTOR *
++ ((max_ltr_enc & E1000_LTRV_SCALE_MASK)
++ >> E1000_LTRV_SCALE_SHIFT)));
++
++ if (lat_enc_d > max_ltr_enc_d)
+ lat_enc = max_ltr_enc;
+ }
+
+diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h
+index 1502895eb45d..e757896287eb 100644
+--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h
++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h
+@@ -274,8 +274,11 @@
+
+ /* Latency Tolerance Reporting */
+ #define E1000_LTRV 0x000F8
++#define E1000_LTRV_VALUE_MASK 0x000003FF
+ #define E1000_LTRV_SCALE_MAX 5
+ #define E1000_LTRV_SCALE_FACTOR 5
++#define E1000_LTRV_SCALE_SHIFT 10
++#define E1000_LTRV_SCALE_MASK 0x00001C00
+ #define E1000_LTRV_REQ_SHIFT 15
+ #define E1000_LTRV_NOSNOOP_SHIFT 16
+ #define E1000_LTRV_SEND (1 << 30)
+--
+2.30.2
+
--- /dev/null
+From 252fbc7d41cab932c829e84235ac46567c26a6c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Aug 2021 06:30:29 -0700
+Subject: IB/hfi1: Fix possible null-pointer dereference in
+ _extend_sdma_tx_descs()
+
+From: Tuo Li <islituo@gmail.com>
+
+[ Upstream commit cbe71c61992c38f72c2b625b2ef25916b9f0d060 ]
+
+kmalloc_array() is called to allocate memory for tx->descp. If it fails,
+the function __sdma_txclean() is called:
+ __sdma_txclean(dd, tx);
+
+However, in the function __sdma_txclean(), tx-descp is dereferenced if
+tx->num_desc is not zero:
+ sdma_unmap_desc(dd, &tx->descp[0]);
+
+To fix this possible null-pointer dereference, assign the return value of
+kmalloc_array() to a local variable descp, and then assign it to tx->descp
+if it is not NULL. Otherwise, go to enomem.
+
+Fixes: 7724105686e7 ("IB/hfi1: add driver files")
+Link: https://lore.kernel.org/r/20210806133029.194964-1-islituo@gmail.com
+Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
+Signed-off-by: Tuo Li <islituo@gmail.com>
+Tested-by: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
+Acked-by: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/sdma.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c
+index 1fcc6e9666e0..8e902b83ce26 100644
+--- a/drivers/infiniband/hw/hfi1/sdma.c
++++ b/drivers/infiniband/hw/hfi1/sdma.c
+@@ -3055,6 +3055,7 @@ static void __sdma_process_event(struct sdma_engine *sde,
+ static int _extend_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx)
+ {
+ int i;
++ struct sdma_desc *descp;
+
+ /* Handle last descriptor */
+ if (unlikely((tx->num_desc == (MAX_DESC - 1)))) {
+@@ -3075,12 +3076,10 @@ static int _extend_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx)
+ if (unlikely(tx->num_desc == MAX_DESC))
+ goto enomem;
+
+- tx->descp = kmalloc_array(
+- MAX_DESC,
+- sizeof(struct sdma_desc),
+- GFP_ATOMIC);
+- if (!tx->descp)
++ descp = kmalloc_array(MAX_DESC, sizeof(struct sdma_desc), GFP_ATOMIC);
++ if (!descp)
+ goto enomem;
++ tx->descp = descp;
+
+ /* reserve last descriptor for coalescing */
+ tx->desc_limit = MAX_DESC - 1;
+--
+2.30.2
+
--- /dev/null
+From fbba7a6c87d4d3c22a3ae998c8569f40e6b86991 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Aug 2021 15:34:51 -0700
+Subject: ice: do not abort devlink info if board identifier can't be found
+
+From: Jacob Keller <jacob.e.keller@intel.com>
+
+[ Upstream commit a8f89fa27773a8c96fd09fb4e2f4892d794f21f6 ]
+
+The devlink dev info command reports version information about the
+device and firmware running on the board. This includes the "board.id"
+field which is supposed to represent an identifier of the board design.
+The ice driver uses the Product Board Assembly identifier for this.
+
+In some cases, the PBA is not present in the NVM. If this happens,
+devlink dev info will fail with an error. Instead, modify the
+ice_info_pba function to just exit without filling in the context
+buffer. This will cause the board.id field to be skipped. Log a dev_dbg
+message in case someone wants to confirm why board.id is not showing up
+for them.
+
+Fixes: e961b679fb0b ("ice: add board identifier info to devlink .info_get")
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Link: https://lore.kernel.org/r/20210819223451.245613-1-anthony.l.nguyen@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_devlink.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_devlink.c b/drivers/net/ethernet/intel/ice/ice_devlink.c
+index cf685eeea198..e256f70cf59d 100644
+--- a/drivers/net/ethernet/intel/ice/ice_devlink.c
++++ b/drivers/net/ethernet/intel/ice/ice_devlink.c
+@@ -42,7 +42,9 @@ static int ice_info_pba(struct ice_pf *pf, struct ice_info_ctx *ctx)
+
+ status = ice_read_pba_string(hw, (u8 *)ctx->buf, sizeof(ctx->buf));
+ if (status)
+- return -EIO;
++ /* We failed to locate the PBA, so just skip this entry */
++ dev_dbg(ice_pf_to_dev(pf), "Failed to read Product Board Assembly string, status %s\n",
++ ice_stat_str(status));
+
+ return 0;
+ }
+--
+2.30.2
+
--- /dev/null
+From 7172507c69039143ebbf15f54c4e746bb5f60e75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jul 2021 21:00:36 +0800
+Subject: igc: fix page fault when thunderbolt is unplugged
+
+From: Aaron Ma <aaron.ma@canonical.com>
+
+[ Upstream commit 4b79959510e6612d80f8d86022e0cb44eee6f4a2 ]
+
+After unplug thunderbolt dock with i225, pciehp interrupt is triggered,
+remove call will read/write mmio address which is already disconnected,
+then cause page fault and make system hang.
+
+Check PCI state to remove device safely.
+
+Trace:
+BUG: unable to handle page fault for address: 000000000000b604
+Oops: 0000 [#1] SMP NOPTI
+RIP: 0010:igc_rd32+0x1c/0x90 [igc]
+Call Trace:
+igc_ptp_suspend+0x6c/0xa0 [igc]
+igc_ptp_stop+0x12/0x50 [igc]
+igc_remove+0x7f/0x1c0 [igc]
+pci_device_remove+0x3e/0xb0
+__device_release_driver+0x181/0x240
+
+Fixes: 13b5b7fd6a4a ("igc: Add support for Tx/Rx rings")
+Fixes: b03c49cde61f ("igc: Save PTP time before a reset")
+Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
+Tested-by: Dvora Fuxbrumer <dvorax.fuxbrumer@linux.intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igc/igc_main.c | 32 ++++++++++++++---------
+ drivers/net/ethernet/intel/igc/igc_ptp.c | 3 ++-
+ 2 files changed, 21 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
+index a8d5f196fdbd..3db86daf3568 100644
+--- a/drivers/net/ethernet/intel/igc/igc_main.c
++++ b/drivers/net/ethernet/intel/igc/igc_main.c
+@@ -146,6 +146,9 @@ static void igc_release_hw_control(struct igc_adapter *adapter)
+ struct igc_hw *hw = &adapter->hw;
+ u32 ctrl_ext;
+
++ if (!pci_device_is_present(adapter->pdev))
++ return;
++
+ /* Let firmware take over control of h/w */
+ ctrl_ext = rd32(IGC_CTRL_EXT);
+ wr32(IGC_CTRL_EXT,
+@@ -4037,26 +4040,29 @@ void igc_down(struct igc_adapter *adapter)
+
+ igc_ptp_suspend(adapter);
+
+- /* disable receives in the hardware */
+- rctl = rd32(IGC_RCTL);
+- wr32(IGC_RCTL, rctl & ~IGC_RCTL_EN);
+- /* flush and sleep below */
+-
++ if (pci_device_is_present(adapter->pdev)) {
++ /* disable receives in the hardware */
++ rctl = rd32(IGC_RCTL);
++ wr32(IGC_RCTL, rctl & ~IGC_RCTL_EN);
++ /* flush and sleep below */
++ }
+ /* set trans_start so we don't get spurious watchdogs during reset */
+ netif_trans_update(netdev);
+
+ netif_carrier_off(netdev);
+ netif_tx_stop_all_queues(netdev);
+
+- /* disable transmits in the hardware */
+- tctl = rd32(IGC_TCTL);
+- tctl &= ~IGC_TCTL_EN;
+- wr32(IGC_TCTL, tctl);
+- /* flush both disables and wait for them to finish */
+- wrfl();
+- usleep_range(10000, 20000);
++ if (pci_device_is_present(adapter->pdev)) {
++ /* disable transmits in the hardware */
++ tctl = rd32(IGC_TCTL);
++ tctl &= ~IGC_TCTL_EN;
++ wr32(IGC_TCTL, tctl);
++ /* flush both disables and wait for them to finish */
++ wrfl();
++ usleep_range(10000, 20000);
+
+- igc_irq_disable(adapter);
++ igc_irq_disable(adapter);
++ }
+
+ adapter->flags &= ~IGC_FLAG_NEED_LINK_UPDATE;
+
+diff --git a/drivers/net/ethernet/intel/igc/igc_ptp.c b/drivers/net/ethernet/intel/igc/igc_ptp.c
+index 69617d2c1be2..4ae19c6a3247 100644
+--- a/drivers/net/ethernet/intel/igc/igc_ptp.c
++++ b/drivers/net/ethernet/intel/igc/igc_ptp.c
+@@ -849,7 +849,8 @@ void igc_ptp_suspend(struct igc_adapter *adapter)
+ adapter->ptp_tx_skb = NULL;
+ clear_bit_unlock(__IGC_PTP_TX_IN_PROGRESS, &adapter->state);
+
+- igc_ptp_time_save(adapter);
++ if (pci_device_is_present(adapter->pdev))
++ igc_ptp_time_save(adapter);
+ }
+
+ /**
+--
+2.30.2
+
--- /dev/null
+From 30261d72b25d0a0b8c5b76a8027f07d1704aa20c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jul 2021 17:34:03 -0700
+Subject: igc: Use num_tx_queues when iterating over tx_ring queue
+
+From: Toshiki Nishioka <toshiki.nishioka@intel.com>
+
+[ Upstream commit 691bd4d7761992914a0e83c27a4ce57d01474cda ]
+
+Use num_tx_queues rather than the IGC_MAX_TX_QUEUES fixed number 4 when
+iterating over tx_ring queue since instantiated queue count could be
+less than 4 where on-line cpu count is less than 4.
+
+Fixes: ec50a9d437f0 ("igc: Add support for taprio offloading")
+Signed-off-by: Toshiki Nishioka <toshiki.nishioka@intel.com>
+Signed-off-by: Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli@intel.com>
+Tested-by: Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli@intel.com>
+Acked-by: Sasha Neftin <sasha.neftin@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igc/igc_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
+index 3db86daf3568..9b85fdf01297 100644
+--- a/drivers/net/ethernet/intel/igc/igc_main.c
++++ b/drivers/net/ethernet/intel/igc/igc_main.c
+@@ -5080,7 +5080,7 @@ static bool validate_schedule(struct igc_adapter *adapter,
+ if (e->command != TC_TAPRIO_CMD_SET_GATES)
+ return false;
+
+- for (i = 0; i < IGC_MAX_TX_QUEUES; i++) {
++ for (i = 0; i < adapter->num_tx_queues; i++) {
+ if (e->gate_mask & BIT(i))
+ queue_uses[i]++;
+
+@@ -5137,7 +5137,7 @@ static int igc_save_qbv_schedule(struct igc_adapter *adapter,
+
+ end_time += e->interval;
+
+- for (i = 0; i < IGC_MAX_TX_QUEUES; i++) {
++ for (i = 0; i < adapter->num_tx_queues; i++) {
+ struct igc_ring *ring = adapter->tx_ring[i];
+
+ if (!(e->gate_mask & BIT(i)))
+--
+2.30.2
+
--- /dev/null
+From e16bba5bd5f4086ca512332e6c8c6f7a276e868e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Aug 2021 12:44:24 +0530
+Subject: ip_gre: add validation for csum_start
+
+From: Shreyansh Chouhan <chouhan.shreyansh630@gmail.com>
+
+[ Upstream commit 1d011c4803c72f3907eccfc1ec63caefb852fcbf ]
+
+Validate csum_start in gre_handle_offloads before we call _gre_xmit so
+that we do not crash later when the csum_start value is used in the
+lco_csum function call.
+
+This patch deals with ipv4 code.
+
+Fixes: c54419321455 ("GRE: Refactor GRE tunneling code.")
+Reported-by: syzbot+ff8e1b9f2f36481e2efc@syzkaller.appspotmail.com
+Signed-off-by: Shreyansh Chouhan <chouhan.shreyansh630@gmail.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_gre.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index a68bf4c6fe9b..ff34cde983d4 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -468,6 +468,8 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev,
+
+ static int gre_handle_offloads(struct sk_buff *skb, bool csum)
+ {
++ if (csum && skb_checksum_start(skb) < skb->data)
++ return -EINVAL;
+ return iptunnel_handle_offloads(skb, csum ? SKB_GSO_GRE_CSUM : SKB_GSO_GRE);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 9c6cf4b36987b1d7e250a3d9630afd0d92f5e101 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Aug 2021 16:17:29 -0700
+Subject: ipv4: use siphash instead of Jenkins in fnhe_hashfun()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 6457378fe796815c973f631a1904e147d6ee33b1 ]
+
+A group of security researchers brought to our attention
+the weakness of hash function used in fnhe_hashfun().
+
+Lets use siphash instead of Jenkins Hash, to considerably
+reduce security risks.
+
+Also remove the inline keyword, this really is distracting.
+
+Fixes: d546c621542d ("ipv4: harden fnhe_hashfun()")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: Keyu Man <kman001@ucr.edu>
+Cc: Willy Tarreau <w@1wt.eu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/route.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 78d1e5afc452..d8811e1fbd6c 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -600,14 +600,14 @@ static struct fib_nh_exception *fnhe_oldest(struct fnhe_hash_bucket *hash)
+ return oldest;
+ }
+
+-static inline u32 fnhe_hashfun(__be32 daddr)
++static u32 fnhe_hashfun(__be32 daddr)
+ {
+- static u32 fnhe_hashrnd __read_mostly;
+- u32 hval;
++ static siphash_key_t fnhe_hash_key __read_mostly;
++ u64 hval;
+
+- net_get_random_once(&fnhe_hashrnd, sizeof(fnhe_hashrnd));
+- hval = jhash_1word((__force u32)daddr, fnhe_hashrnd);
+- return hash_32(hval, FNHE_HASH_SHIFT);
++ net_get_random_once(&fnhe_hash_key, sizeof(fnhe_hash_key));
++ hval = siphash_1u32((__force u32)daddr, &fnhe_hash_key);
++ return hash_64(hval, FNHE_HASH_SHIFT);
+ }
+
+ static void fill_route_from_fnhe(struct rtable *rt, struct fib_nh_exception *fnhe)
+--
+2.30.2
+
--- /dev/null
+From 524e6bed71c0fc1969aea6c00eb54a32000fe38e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Aug 2021 16:17:28 -0700
+Subject: ipv6: use siphash in rt6_exception_hash()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 4785305c05b25a242e5314cc821f54ade4c18810 ]
+
+A group of security researchers brought to our attention
+the weakness of hash function used in rt6_exception_hash()
+
+Lets use siphash instead of Jenkins Hash, to considerably
+reduce security risks.
+
+Following patch deals with IPv4.
+
+Fixes: 35732d01fe31 ("ipv6: introduce a hash table to store dst cache")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: Keyu Man <kman001@ucr.edu>
+Cc: Wei Wang <weiwan@google.com>
+Cc: Martin KaFai Lau <kafai@fb.com>
+Acked-by: Wei Wang <weiwan@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/route.c | 20 ++++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 09e84161b731..67c74469503a 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -41,6 +41,7 @@
+ #include <linux/nsproxy.h>
+ #include <linux/slab.h>
+ #include <linux/jhash.h>
++#include <linux/siphash.h>
+ #include <net/net_namespace.h>
+ #include <net/snmp.h>
+ #include <net/ipv6.h>
+@@ -1484,17 +1485,24 @@ static void rt6_exception_remove_oldest(struct rt6_exception_bucket *bucket)
+ static u32 rt6_exception_hash(const struct in6_addr *dst,
+ const struct in6_addr *src)
+ {
+- static u32 seed __read_mostly;
+- u32 val;
++ static siphash_key_t rt6_exception_key __read_mostly;
++ struct {
++ struct in6_addr dst;
++ struct in6_addr src;
++ } __aligned(SIPHASH_ALIGNMENT) combined = {
++ .dst = *dst,
++ };
++ u64 val;
+
+- net_get_random_once(&seed, sizeof(seed));
+- val = jhash2((const u32 *)dst, sizeof(*dst)/sizeof(u32), seed);
++ net_get_random_once(&rt6_exception_key, sizeof(rt6_exception_key));
+
+ #ifdef CONFIG_IPV6_SUBTREES
+ if (src)
+- val = jhash2((const u32 *)src, sizeof(*src)/sizeof(u32), val);
++ combined.src = *src;
+ #endif
+- return hash_32(val, FIB6_EXCEPTION_BUCKET_SIZE_SHIFT);
++ val = siphash(&combined, sizeof(combined), &rt6_exception_key);
++
++ return hash_64(val, FIB6_EXCEPTION_BUCKET_SIZE_SHIFT);
+ }
+
+ /* Helper function to find the cached rt in the hash table
+--
+2.30.2
+
--- /dev/null
+From 55477d94d66fee283ad1d5b4a06d65a607273552 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Aug 2021 13:53:24 +0300
+Subject: media: ipu3-cio2: Drop reference on error path in
+ cio2_bridge_connect_sensor()
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 294c34e704e78d641b039064ce72d4531afe0088 ]
+
+The commit 71f642833284 ("ACPI: utils: Fix reference counting in
+for_each_acpi_dev_match()") moved adev assignment outside of error
+path and hence made acpi_dev_put(sensor->adev) a no-op. We still
+need to drop reference count on error path, and to achieve that,
+replace sensor->adev by locally assigned adev.
+
+Fixes: 71f642833284 ("ACPI: utils: Fix reference counting in for_each_acpi_dev_match()")
+Depends-on: fc68f42aa737 ("ACPI: fix NULL pointer dereference")
+Reported-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/intel/ipu3/cio2-bridge.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/intel/ipu3/cio2-bridge.c b/drivers/media/pci/intel/ipu3/cio2-bridge.c
+index 59a36f922675..30d29b96a339 100644
+--- a/drivers/media/pci/intel/ipu3/cio2-bridge.c
++++ b/drivers/media/pci/intel/ipu3/cio2-bridge.c
+@@ -226,7 +226,7 @@ static int cio2_bridge_connect_sensor(const struct cio2_sensor_config *cfg,
+ err_free_swnodes:
+ software_node_unregister_nodes(sensor->swnodes);
+ err_put_adev:
+- acpi_dev_put(sensor->adev);
++ acpi_dev_put(adev);
+ return ret;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 4ec55d018044e00e032266ed3e08b05289a43484 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Aug 2021 15:58:13 +0200
+Subject: net: dsa: hellcreek: Adjust schedule look ahead window
+
+From: Kurt Kanzenbach <kurt@linutronix.de>
+
+[ Upstream commit b7658ed35a5f5900f0f658e375f366513f3eb781 ]
+
+Traffic schedules can only be started up to eight seconds within the
+future. Therefore, the driver periodically checks every two seconds whether the
+admin base time provided by the user is inside that window. If so the schedule
+is started. Otherwise the check is deferred.
+
+However, according to the programming manual the look ahead window size should
+be four - not eight - seconds. By using the proposed value of four seconds
+starting a schedule at a specified admin base time actually works as expected.
+
+Fixes: 24dfc6eb39b2 ("net: dsa: hellcreek: Add TAPRIO offloading support")
+Signed-off-by: Kurt Kanzenbach <kurt@linutronix.de>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/hirschmann/hellcreek.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/dsa/hirschmann/hellcreek.c b/drivers/net/dsa/hirschmann/hellcreek.c
+index 3aab01c25f9a..512b1810a8bd 100644
+--- a/drivers/net/dsa/hirschmann/hellcreek.c
++++ b/drivers/net/dsa/hirschmann/hellcreek.c
+@@ -1551,7 +1551,7 @@ static bool hellcreek_schedule_startable(struct hellcreek *hellcreek, int port)
+ /* Calculate difference to admin base time */
+ base_time_ns = ktime_to_ns(hellcreek_port->current_schedule->base_time);
+
+- return base_time_ns - current_ns < (s64)8 * NSEC_PER_SEC;
++ return base_time_ns - current_ns < (s64)4 * NSEC_PER_SEC;
+ }
+
+ static void hellcreek_start_schedule(struct hellcreek *hellcreek, int port)
+--
+2.30.2
+
--- /dev/null
+From c86d06c247c7a2aedd34832a7c1493d580bf9f7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Aug 2021 15:58:12 +0200
+Subject: net: dsa: hellcreek: Fix incorrect setting of GCL
+
+From: Kurt Kanzenbach <kurt@linutronix.de>
+
+[ Upstream commit a7db5ed8632c88c029254d5d74765d52614af3fd ]
+
+Currently the gate control list which is programmed into the hardware is
+incorrect resulting in wrong traffic schedules. The problem is the loop
+variables are incremented before they are referenced. Therefore, move the
+increment to the end of the loop.
+
+Fixes: 24dfc6eb39b2 ("net: dsa: hellcreek: Add TAPRIO offloading support")
+Signed-off-by: Kurt Kanzenbach <kurt@linutronix.de>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/hirschmann/hellcreek.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/dsa/hirschmann/hellcreek.c b/drivers/net/dsa/hirschmann/hellcreek.c
+index 50109218baad..3aab01c25f9a 100644
+--- a/drivers/net/dsa/hirschmann/hellcreek.c
++++ b/drivers/net/dsa/hirschmann/hellcreek.c
+@@ -1473,9 +1473,6 @@ static void hellcreek_setup_gcl(struct hellcreek *hellcreek, int port,
+ u16 data;
+ u8 gates;
+
+- cur++;
+- next++;
+-
+ if (i == schedule->num_entries)
+ gates = initial->gate_mask ^
+ cur->gate_mask;
+@@ -1504,6 +1501,9 @@ static void hellcreek_setup_gcl(struct hellcreek *hellcreek, int port,
+ (initial->gate_mask <<
+ TR_GCLCMD_INIT_GATE_STATES_SHIFT);
+ hellcreek_write(hellcreek, data, TR_GCLCMD);
++
++ cur++;
++ next++;
+ }
+ }
+
+--
+2.30.2
+
--- /dev/null
+From c5b69bca554e101aff4aec472b57de17a1e7dde8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Aug 2021 19:21:56 +0800
+Subject: net: hns3: add waiting time before cmdq memory is released
+
+From: Yufeng Mo <moyufeng@huawei.com>
+
+[ Upstream commit a96d9330b02a3d051ae689bc2c5e7d3a2ba25594 ]
+
+After the cmdq registers are cleared, the firmware may take time to
+clear out possible left over commands in the cmdq. Driver must release
+cmdq memory only after firmware has completed processing of left over
+commands.
+
+Fixes: 232d0d55fca6 ("net: hns3: uninitialize command queue while unloading PF driver")
+Signed-off-by: Yufeng Mo <moyufeng@huawei.com>
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c | 6 +++++-
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 1 +
+ drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.c | 7 ++++++-
+ drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.h | 1 +
+ 4 files changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
+index 76a482456f1f..91445521dde1 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
+@@ -564,9 +564,13 @@ static void hclge_cmd_uninit_regs(struct hclge_hw *hw)
+
+ void hclge_cmd_uninit(struct hclge_dev *hdev)
+ {
++ set_bit(HCLGE_STATE_CMD_DISABLE, &hdev->state);
++ /* wait to ensure that the firmware completes the possible left
++ * over commands.
++ */
++ msleep(HCLGE_CMDQ_CLEAR_WAIT_TIME);
+ spin_lock_bh(&hdev->hw.cmq.csq.lock);
+ spin_lock(&hdev->hw.cmq.crq.lock);
+- set_bit(HCLGE_STATE_CMD_DISABLE, &hdev->state);
+ hclge_cmd_uninit_regs(&hdev->hw);
+ spin_unlock(&hdev->hw.cmq.crq.lock);
+ spin_unlock_bh(&hdev->hw.cmq.csq.lock);
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+index 8e055e1ce793..a836bdba5a4d 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+@@ -9,6 +9,7 @@
+ #include "hnae3.h"
+
+ #define HCLGE_CMDQ_TX_TIMEOUT 30000
++#define HCLGE_CMDQ_CLEAR_WAIT_TIME 200
+ #define HCLGE_DESC_DATA_LEN 6
+
+ struct hclge_dev;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.c
+index d8c5c5810b99..2267832037d8 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.c
+@@ -505,12 +505,17 @@ static void hclgevf_cmd_uninit_regs(struct hclgevf_hw *hw)
+
+ void hclgevf_cmd_uninit(struct hclgevf_dev *hdev)
+ {
++ set_bit(HCLGEVF_STATE_CMD_DISABLE, &hdev->state);
++ /* wait to ensure that the firmware completes the possible left
++ * over commands.
++ */
++ msleep(HCLGEVF_CMDQ_CLEAR_WAIT_TIME);
+ spin_lock_bh(&hdev->hw.cmq.csq.lock);
+ spin_lock(&hdev->hw.cmq.crq.lock);
+- set_bit(HCLGEVF_STATE_CMD_DISABLE, &hdev->state);
+ hclgevf_cmd_uninit_regs(&hdev->hw);
+ spin_unlock(&hdev->hw.cmq.crq.lock);
+ spin_unlock_bh(&hdev->hw.cmq.csq.lock);
++
+ hclgevf_free_cmd_desc(&hdev->hw.cmq.csq);
+ hclgevf_free_cmd_desc(&hdev->hw.cmq.crq);
+ }
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.h
+index c6dc11b32aa7..59f4c19bd846 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.h
+@@ -8,6 +8,7 @@
+ #include "hnae3.h"
+
+ #define HCLGEVF_CMDQ_TX_TIMEOUT 30000
++#define HCLGEVF_CMDQ_CLEAR_WAIT_TIME 200
+ #define HCLGEVF_CMDQ_RX_INVLD_B 0
+ #define HCLGEVF_CMDQ_RX_OUTVLD_B 1
+
+--
+2.30.2
+
--- /dev/null
+From 384478690a794d5a6115d7d1ff820f903931a664 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Aug 2021 19:21:55 +0800
+Subject: net: hns3: clear hardware resource when loading driver
+
+From: Yufeng Mo <moyufeng@huawei.com>
+
+[ Upstream commit 1a6d281946c330cee2855f6d0cd796616e54601f ]
+
+If a PF is bonded to a virtual machine and the virtual machine exits
+unexpectedly, some hardware resource cannot be cleared. In this case,
+loading driver may cause exceptions. Therefore, the hardware resource
+needs to be cleared when the driver is loaded.
+
+Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support")
+Signed-off-by: Yufeng Mo <moyufeng@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../hisilicon/hns3/hns3pf/hclge_cmd.h | 3 +++
+ .../hisilicon/hns3/hns3pf/hclge_main.c | 26 +++++++++++++++++++
+ 2 files changed, 29 insertions(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+index c6fc22e29581..8e055e1ce793 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+@@ -264,6 +264,9 @@ enum hclge_opcode_type {
+ /* Led command */
+ HCLGE_OPC_LED_STATUS_CFG = 0xB000,
+
++ /* clear hardware resource command */
++ HCLGE_OPC_CLEAR_HW_RESOURCE = 0x700B,
++
+ /* NCL config command */
+ HCLGE_OPC_QUERY_NCL_CONFIG = 0x7011,
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 6304aed49f22..9ea4007dbac9 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -11167,6 +11167,28 @@ static void hclge_clear_resetting_state(struct hclge_dev *hdev)
+ }
+ }
+
++static int hclge_clear_hw_resource(struct hclge_dev *hdev)
++{
++ struct hclge_desc desc;
++ int ret;
++
++ hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_CLEAR_HW_RESOURCE, false);
++
++ ret = hclge_cmd_send(&hdev->hw, &desc, 1);
++ /* This new command is only supported by new firmware, it will
++ * fail with older firmware. Error value -EOPNOSUPP can only be
++ * returned by older firmware running this command, to keep code
++ * backward compatible we will override this value and return
++ * success.
++ */
++ if (ret && ret != -EOPNOTSUPP) {
++ dev_err(&hdev->pdev->dev,
++ "failed to clear hw resource, ret = %d\n", ret);
++ return ret;
++ }
++ return 0;
++}
++
+ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)
+ {
+ struct pci_dev *pdev = ae_dev->pdev;
+@@ -11204,6 +11226,10 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)
+ if (ret)
+ goto err_cmd_uninit;
+
++ ret = hclge_clear_hw_resource(hdev);
++ if (ret)
++ goto err_cmd_uninit;
++
+ ret = hclge_get_cap(hdev);
+ if (ret)
+ goto err_cmd_uninit;
+--
+2.30.2
+
--- /dev/null
+From b793d85a6f4f0cea479fb939e2da5ed2e3148146 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Aug 2021 19:21:58 +0800
+Subject: net: hns3: fix duplicate node in VLAN list
+
+From: Guojia Liao <liaoguojia@huawei.com>
+
+[ Upstream commit 94391fae82f71c98ecc7716a32611fcca73c74eb ]
+
+VLAN list should not be added duplicate VLAN node, otherwise it would
+cause "add failed" when restore VLAN from VLAN list, so this patch adds
+VLAN ID check before adding node into VLAN list.
+
+Fixes: c6075b193462 ("net: hns3: Record VF vlan tables")
+Signed-off-by: Guojia Liao <liaoguojia@huawei.com>
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 00254d167904..f105ff9e3f4c 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -9869,7 +9869,11 @@ static int hclge_init_vlan_config(struct hclge_dev *hdev)
+ static void hclge_add_vport_vlan_table(struct hclge_vport *vport, u16 vlan_id,
+ bool writen_to_tbl)
+ {
+- struct hclge_vport_vlan_cfg *vlan;
++ struct hclge_vport_vlan_cfg *vlan, *tmp;
++
++ list_for_each_entry_safe(vlan, tmp, &vport->vlan_list, node)
++ if (vlan->vlan_id == vlan_id)
++ return;
+
+ vlan = kzalloc(sizeof(*vlan), GFP_KERNEL);
+ if (!vlan)
+--
+2.30.2
+
--- /dev/null
+From 7b440333681ab78a06f1768133d7efb49e2e3f95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Aug 2021 19:22:01 +0800
+Subject: net: hns3: fix get wrong pfc_en when query PFC configuration
+
+From: Guangbin Huang <huangguangbin2@huawei.com>
+
+[ Upstream commit 8c1671e0d13d4a0ba4fb3a0da932bf3736d7ff73 ]
+
+Currently, when query PFC configuration by dcbtool, driver will return
+PFC enable status based on TC. As all priorities are mapped to TC0 by
+default, if TC0 is enabled, then all priorities mapped to TC0 will be
+shown as enabled status when query PFC setting, even though some
+priorities have never been set.
+
+for example:
+$ dcb pfc show dev eth0
+pfc-cap 4 macsec-bypass off delay 0
+prio-pfc 0:off 1:off 2:off 3:off 4:off 5:off 6:off 7:off
+$ dcb pfc set dev eth0 prio-pfc 0:on 1:on 2:on 3:on
+$ dcb pfc show dev eth0
+pfc-cap 4 macsec-bypass off delay 0
+prio-pfc 0:on 1:on 2:on 3:on 4:on 5:on 6:on 7:on
+
+To fix this problem, just returns user's PFC config parameter saved in
+driver.
+
+Fixes: cacde272dd00 ("net: hns3: Add hclge_dcb module for the support of DCB feature")
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c | 13 ++-----------
+ 1 file changed, 2 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
+index 5bf5db91d16c..39f56f245d84 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
+@@ -255,21 +255,12 @@ static int hclge_ieee_getpfc(struct hnae3_handle *h, struct ieee_pfc *pfc)
+ u64 requests[HNAE3_MAX_TC], indications[HNAE3_MAX_TC];
+ struct hclge_vport *vport = hclge_get_vport(h);
+ struct hclge_dev *hdev = vport->back;
+- u8 i, j, pfc_map, *prio_tc;
+ int ret;
++ u8 i;
+
+ memset(pfc, 0, sizeof(*pfc));
+ pfc->pfc_cap = hdev->pfc_max;
+- prio_tc = hdev->tm_info.prio_tc;
+- pfc_map = hdev->tm_info.hw_pfc_map;
+-
+- /* Pfc setting is based on TC */
+- for (i = 0; i < hdev->tm_info.num_tc; i++) {
+- for (j = 0; j < HNAE3_MAX_USER_PRIO; j++) {
+- if ((prio_tc[j] == i) && (pfc_map & BIT(i)))
+- pfc->pfc_en |= BIT(j);
+- }
+- }
++ pfc->pfc_en = hdev->tm_info.pfc_en;
+
+ ret = hclge_pfc_tx_stats_get(hdev, requests);
+ if (ret)
+--
+2.30.2
+
--- /dev/null
+From 141e20ec14f330e9540f4e1e45d75f17a4d391f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Aug 2021 19:21:57 +0800
+Subject: net: hns3: fix speed unknown issue in bond 4
+
+From: Yonglong Liu <liuyonglong@huawei.com>
+
+[ Upstream commit b15c072a9f4a404c09ad589477f4389034742a8b ]
+
+In bond 4, when the link goes down and up repeatedly, the bond may get an
+unknown speed, and then this port can not work.
+
+The driver notify netif_carrier_on() before update the link state, when the
+bond receive carrier on, will query the speed of the port, if the query
+operation happens before updating the link state, will get an unknown
+speed. So need to notify netif_carrier_on() after update the link state.
+
+Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support")
+Fixes: e2cb1dec9779 ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support")
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 +-
+ drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 2 +-
+ drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 9ea4007dbac9..00254d167904 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -2924,12 +2924,12 @@ static void hclge_update_link_status(struct hclge_dev *hdev)
+ }
+
+ if (state != hdev->hw.mac.link) {
++ hdev->hw.mac.link = state;
+ client->ops->link_status_change(handle, state);
+ hclge_config_mac_tnl_int(hdev, state);
+ if (rclient && rclient->ops->link_status_change)
+ rclient->ops->link_status_change(rhandle, state);
+
+- hdev->hw.mac.link = state;
+ hclge_push_link_status(hdev);
+ }
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+index fe03c8419890..d3f36e2b2b90 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -498,10 +498,10 @@ void hclgevf_update_link_status(struct hclgevf_dev *hdev, int link_state)
+ link_state =
+ test_bit(HCLGEVF_STATE_DOWN, &hdev->state) ? 0 : link_state;
+ if (link_state != hdev->hw.mac.link) {
++ hdev->hw.mac.link = link_state;
+ client->ops->link_status_change(handle, !!link_state);
+ if (rclient && rclient->ops->link_status_change)
+ rclient->ops->link_status_change(rhandle, !!link_state);
+- hdev->hw.mac.link = link_state;
+ }
+
+ clear_bit(HCLGEVF_STATE_LINK_UPDATING, &hdev->state);
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c
+index 9b17735b9f4c..987b88d7e0c7 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c
+@@ -304,8 +304,8 @@ void hclgevf_mbx_async_handler(struct hclgevf_dev *hdev)
+ flag = (u8)msg_q[5];
+
+ /* update upper layer with new link link status */
+- hclgevf_update_link_status(hdev, link_status);
+ hclgevf_update_speed_duplex(hdev, speed, duplex);
++ hclgevf_update_link_status(hdev, link_status);
+
+ if (flag & HCLGE_MBX_PUSH_LINK_STATUS_EN)
+ set_bit(HCLGEVF_STATE_PF_PUSH_LINK_STATUS,
+--
+2.30.2
+
--- /dev/null
+From 599f3c20c8a2944143f52fd4624a15be8221785e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Aug 2021 18:39:51 +0300
+Subject: net: marvell: fix MVNETA_TX_IN_PRGRS bit number
+
+From: Maxim Kiselev <bigunclemax@gmail.com>
+
+[ Upstream commit 359f4cdd7d78fdf8c098713b05fee950a730f131 ]
+
+According to Armada XP datasheet bit at 0 position is corresponding for
+TxInProg indication.
+
+Fixes: c5aff18204da ("net: mvneta: driver for Marvell Armada 370/XP network unit")
+Signed-off-by: Maxim Kiselev <bigunclemax@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/mvneta.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index 618623014180..76c680515764 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -105,7 +105,7 @@
+ #define MVNETA_VLAN_PRIO_TO_RXQ 0x2440
+ #define MVNETA_VLAN_PRIO_RXQ_MAP(prio, rxq) ((rxq) << ((prio) * 3))
+ #define MVNETA_PORT_STATUS 0x2444
+-#define MVNETA_TX_IN_PRGRS BIT(1)
++#define MVNETA_TX_IN_PRGRS BIT(0)
+ #define MVNETA_TX_FIFO_EMPTY BIT(8)
+ #define MVNETA_RX_MIN_FRAME_SIZE 0x247c
+ /* Only exists on Armada XP and Armada 370 */
+--
+2.30.2
+
--- /dev/null
+From 28b4ac5800e68e26598331a8df2d701e23db2687 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Aug 2021 00:33:48 +0200
+Subject: net/sched: ets: fix crash when flipping from 'strict' to 'quantum'
+
+From: Davide Caratti <dcaratti@redhat.com>
+
+[ Upstream commit cd9b50adc6bb9ad3f7d244590a389522215865c4 ]
+
+While running kselftests, Hangbin observed that sch_ets.sh often crashes,
+and splats like the following one are seen in the output of 'dmesg':
+
+ BUG: kernel NULL pointer dereference, address: 0000000000000000
+ #PF: supervisor read access in kernel mode
+ #PF: error_code(0x0000) - not-present page
+ PGD 159f12067 P4D 159f12067 PUD 159f13067 PMD 0
+ Oops: 0000 [#1] SMP NOPTI
+ CPU: 2 PID: 921 Comm: tc Not tainted 5.14.0-rc6+ #458
+ Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014
+ RIP: 0010:__list_del_entry_valid+0x2d/0x50
+ Code: 48 8b 57 08 48 b9 00 01 00 00 00 00 ad de 48 39 c8 0f 84 ac 6e 5b 00 48 b9 22 01 00 00 00 00 ad de 48 39 ca 0f 84 cf 6e 5b 00 <48> 8b 32 48 39 fe 0f 85 af 6e 5b 00 48 8b 50 08 48 39 f2 0f 85 94
+ RSP: 0018:ffffb2da005c3890 EFLAGS: 00010217
+ RAX: 0000000000000000 RBX: ffff9073ba23f800 RCX: dead000000000122
+ RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff9073ba23fbc8
+ RBP: ffff9073ba23f890 R08: 0000000000000001 R09: 0000000000000001
+ R10: 0000000000000001 R11: 0000000000000001 R12: dead000000000100
+ R13: ffff9073ba23fb00 R14: 0000000000000002 R15: 0000000000000002
+ FS: 00007f93e5564e40(0000) GS:ffff9073bba00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000000000000000 CR3: 000000014ad34000 CR4: 0000000000350ee0
+ Call Trace:
+ ets_qdisc_reset+0x6e/0x100 [sch_ets]
+ qdisc_reset+0x49/0x1d0
+ tbf_reset+0x15/0x60 [sch_tbf]
+ qdisc_reset+0x49/0x1d0
+ dev_reset_queue.constprop.42+0x2f/0x90
+ dev_deactivate_many+0x1d3/0x3d0
+ dev_deactivate+0x56/0x90
+ qdisc_graft+0x47e/0x5a0
+ tc_get_qdisc+0x1db/0x3e0
+ rtnetlink_rcv_msg+0x164/0x4c0
+ netlink_rcv_skb+0x50/0x100
+ netlink_unicast+0x1a5/0x280
+ netlink_sendmsg+0x242/0x480
+ sock_sendmsg+0x5b/0x60
+ ____sys_sendmsg+0x1f2/0x260
+ ___sys_sendmsg+0x7c/0xc0
+ __sys_sendmsg+0x57/0xa0
+ do_syscall_64+0x3a/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+ RIP: 0033:0x7f93e44b8338
+ Code: 89 02 48 c7 c0 ff ff ff ff eb b5 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 8d 05 25 43 2c 00 8b 00 85 c0 75 17 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 41 54 41 89 d4 55
+ RSP: 002b:00007ffc0db737a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
+ RAX: ffffffffffffffda RBX: 0000000061255c06 RCX: 00007f93e44b8338
+ RDX: 0000000000000000 RSI: 00007ffc0db73810 RDI: 0000000000000003
+ RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
+ R10: 000000000000000b R11: 0000000000000246 R12: 0000000000000001
+ R13: 0000000000687880 R14: 0000000000000000 R15: 0000000000000000
+ Modules linked in: sch_ets sch_tbf dummy rfkill iTCO_wdt iTCO_vendor_support intel_rapl_msr intel_rapl_common joydev i2c_i801 pcspkr i2c_smbus lpc_ich virtio_balloon ip_tables xfs libcrc32c crct10dif_pclmul crc32_pclmul crc32c_intel ahci libahci ghash_clmulni_intel libata serio_raw virtio_blk virtio_console virtio_net net_failover failover sunrpc dm_mirror dm_region_hash dm_log dm_mod
+ CR2: 0000000000000000
+
+When the change() function decreases the value of 'nstrict', we must take
+into account that packets might be already enqueued on a class that flips
+from 'strict' to 'quantum': otherwise that class will not be added to the
+bandwidth-sharing list. Then, a call to ets_qdisc_reset() will attempt to
+do list_del(&alist) with 'alist' filled with zero, hence the NULL pointer
+dereference.
+For classes flipping from 'strict' to 'quantum', initialize an empty list
+and eventually add it to the bandwidth-sharing list, if there are packets
+already enqueued. In this way, the kernel will:
+ a) prevent crashing as described above.
+ b) avoid retaining the backlog packets (for an arbitrarily long time) in
+ case no packet is enqueued after a change from 'strict' to 'quantum'.
+
+Reported-by: Hangbin Liu <liuhangbin@gmail.com>
+Fixes: dcc68b4d8084 ("net: sch_ets: Add a new Qdisc")
+Signed-off-by: Davide Caratti <dcaratti@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_ets.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/net/sched/sch_ets.c b/net/sched/sch_ets.c
+index c1e84d1eeaba..c76701ac35ab 100644
+--- a/net/sched/sch_ets.c
++++ b/net/sched/sch_ets.c
+@@ -660,6 +660,13 @@ static int ets_qdisc_change(struct Qdisc *sch, struct nlattr *opt,
+ sch_tree_lock(sch);
+
+ q->nbands = nbands;
++ for (i = nstrict; i < q->nstrict; i++) {
++ INIT_LIST_HEAD(&q->classes[i].alist);
++ if (q->classes[i].qdisc->q.qlen) {
++ list_add_tail(&q->classes[i].alist, &q->active);
++ q->classes[i].deficit = quanta[i];
++ }
++ }
+ q->nstrict = nstrict;
+ memcpy(q->prio2band, priomap, sizeof(priomap));
+
+--
+2.30.2
+
--- /dev/null
+From e234fdc8287c9d93cc24532d9a774d4abc70c518 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jul 2021 18:26:54 +0800
+Subject: net: stmmac: add mutex lock to protect est parameters
+
+From: Xiaoliang Yang <xiaoliang.yang_1@nxp.com>
+
+[ Upstream commit b2aae654a4794ef898ad33a179f341eb610f6b85 ]
+
+Add a mutex lock to protect est structure parameters so that the
+EST parameters can be updated by other threads.
+
+Signed-off-by: Xiaoliang Yang <xiaoliang.yang_1@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 12 +++++++++++-
+ include/linux/stmmac.h | 1 +
+ 2 files changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+index 4e70efc45458..fb5207dcbcaa 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+@@ -775,14 +775,18 @@ static int tc_setup_taprio(struct stmmac_priv *priv,
+ GFP_KERNEL);
+ if (!plat->est)
+ return -ENOMEM;
++
++ mutex_init(&priv->plat->est->lock);
+ } else {
+ memset(plat->est, 0, sizeof(*plat->est));
+ }
+
+ size = qopt->num_entries;
+
++ mutex_lock(&priv->plat->est->lock);
+ priv->plat->est->gcl_size = size;
+ priv->plat->est->enable = qopt->enable;
++ mutex_unlock(&priv->plat->est->lock);
+
+ for (i = 0; i < size; i++) {
+ s64 delta_ns = qopt->entries[i].interval;
+@@ -813,6 +817,7 @@ static int tc_setup_taprio(struct stmmac_priv *priv,
+ priv->plat->est->gcl[i] = delta_ns | (gates << wid);
+ }
+
++ mutex_lock(&priv->plat->est->lock);
+ /* Adjust for real system time */
+ priv->ptp_clock_ops.gettime64(&priv->ptp_clock_ops, ¤t_time);
+ current_time_ns = timespec64_to_ktime(current_time);
+@@ -837,8 +842,10 @@ static int tc_setup_taprio(struct stmmac_priv *priv,
+ priv->plat->est->ctr[0] = do_div(ctr, NSEC_PER_SEC);
+ priv->plat->est->ctr[1] = (u32)ctr;
+
+- if (fpe && !priv->dma_cap.fpesel)
++ if (fpe && !priv->dma_cap.fpesel) {
++ mutex_unlock(&priv->plat->est->lock);
+ return -EOPNOTSUPP;
++ }
+
+ /* Actual FPE register configuration will be done after FPE handshake
+ * is success.
+@@ -847,6 +854,7 @@ static int tc_setup_taprio(struct stmmac_priv *priv,
+
+ ret = stmmac_est_configure(priv, priv->ioaddr, priv->plat->est,
+ priv->plat->clk_ptp_rate);
++ mutex_unlock(&priv->plat->est->lock);
+ if (ret) {
+ netdev_err(priv->dev, "failed to configure EST\n");
+ goto disable;
+@@ -862,9 +870,11 @@ static int tc_setup_taprio(struct stmmac_priv *priv,
+ return 0;
+
+ disable:
++ mutex_lock(&priv->plat->est->lock);
+ priv->plat->est->enable = false;
+ stmmac_est_configure(priv, priv->ioaddr, priv->plat->est,
+ priv->plat->clk_ptp_rate);
++ mutex_unlock(&priv->plat->est->lock);
+
+ priv->plat->fpe_cfg->enable = false;
+ stmmac_fpe_configure(priv, priv->ioaddr,
+diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h
+index 0db36360ef21..cb7fbd747ae1 100644
+--- a/include/linux/stmmac.h
++++ b/include/linux/stmmac.h
+@@ -115,6 +115,7 @@ struct stmmac_axi {
+
+ #define EST_GCL 1024
+ struct stmmac_est {
++ struct mutex lock;
+ int enable;
+ u32 btr_offset[2];
+ u32 btr[2];
+--
+2.30.2
+
--- /dev/null
+From 6603d94f0e7df4157d3a42e6cb6ea2fbaa9f0332 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Aug 2021 16:37:54 +0200
+Subject: net: stmmac: dwmac-rk: fix unbalanced pm_runtime_enable warnings
+
+From: Michael Riesch <michael.riesch@wolfvision.net>
+
+[ Upstream commit 2d26f6e39afb88d32b8f39e76a51b542c3c51674 ]
+
+This reverts commit 2c896fb02e7f65299646f295a007bda043e0f382
+"net: stmmac: dwmac-rk: add pd_gmac support for rk3399" and fixes
+unbalanced pm_runtime_enable warnings.
+
+In the commit to be reverted, support for power management was
+introduced to the Rockchip glue code. Later, power management support
+was introduced to the stmmac core code, resulting in multiple
+invocations of pm_runtime_{enable,disable,get_sync,put_sync}.
+
+The multiple invocations happen in rk_gmac_powerup and
+stmmac_{dvr_probe, resume} as well as in rk_gmac_powerdown and
+stmmac_{dvr_remove, suspend}, respectively, which are always called
+in conjunction.
+
+Fixes: 5ec55823438e850c91c6b92aec93fb04ebde29e2 ("net: stmmac: add clocks management for gmac driver")
+Signed-off-by: Michael Riesch <michael.riesch@wolfvision.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+index 8d28a536e1bb..084cede5190d 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+@@ -21,7 +21,6 @@
+ #include <linux/delay.h>
+ #include <linux/mfd/syscon.h>
+ #include <linux/regmap.h>
+-#include <linux/pm_runtime.h>
+
+ #include "stmmac_platform.h"
+
+@@ -1336,9 +1335,6 @@ static int rk_gmac_powerup(struct rk_priv_data *bsp_priv)
+ return ret;
+ }
+
+- pm_runtime_enable(dev);
+- pm_runtime_get_sync(dev);
+-
+ if (bsp_priv->integrated_phy)
+ rk_gmac_integrated_phy_powerup(bsp_priv);
+
+@@ -1347,14 +1343,9 @@ static int rk_gmac_powerup(struct rk_priv_data *bsp_priv)
+
+ static void rk_gmac_powerdown(struct rk_priv_data *gmac)
+ {
+- struct device *dev = &gmac->pdev->dev;
+-
+ if (gmac->integrated_phy)
+ rk_gmac_integrated_phy_powerdown(gmac);
+
+- pm_runtime_put_sync(dev);
+- pm_runtime_disable(dev);
+-
+ phy_power_on(gmac, false);
+ gmac_clk_enable(gmac, false);
+ }
+--
+2.30.2
+
--- /dev/null
+From 3745f2e75b46b559231cce7b85a65f43d9694624 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Aug 2021 21:26:22 +0800
+Subject: net: stmmac: fix kernel panic due to NULL pointer dereference of
+ plat->est
+
+From: Wong Vee Khee <vee.khee.wong@linux.intel.com>
+
+[ Upstream commit 82a44ae113b7b35850f4542f0443fcab221e376a ]
+
+In the case of taprio offload is not enabled, the error handling path
+causes a kernel crash due to kernel NULL pointer deference.
+
+Fix this by adding check for NULL before attempt to access 'plat->est'
+on the mutex_lock() call.
+
+The following kernel panic is observed without this patch:
+
+RIP: 0010:mutex_lock+0x10/0x20
+Call Trace:
+tc_setup_taprio+0x482/0x560 [stmmac]
+kmem_cache_alloc_trace+0x13f/0x490
+taprio_disable_offload.isra.0+0x9d/0x180 [sch_taprio]
+taprio_destroy+0x6c/0x100 [sch_taprio]
+qdisc_create+0x2e5/0x4f0
+tc_modify_qdisc+0x126/0x740
+rtnetlink_rcv_msg+0x12b/0x380
+_raw_spin_lock_irqsave+0x19/0x40
+_raw_spin_unlock_irqrestore+0x18/0x30
+create_object+0x212/0x340
+rtnl_calcit.isra.0+0x110/0x110
+netlink_rcv_skb+0x50/0x100
+netlink_unicast+0x191/0x230
+netlink_sendmsg+0x243/0x470
+sock_sendmsg+0x5e/0x60
+____sys_sendmsg+0x20b/0x280
+copy_msghdr_from_user+0x5c/0x90
+__mod_memcg_state+0x87/0xf0
+ ___sys_sendmsg+0x7c/0xc0
+lru_cache_add+0x7f/0xa0
+_raw_spin_unlock+0x16/0x30
+wp_page_copy+0x449/0x890
+handle_mm_fault+0x921/0xfc0
+__sys_sendmsg+0x59/0xa0
+do_syscall_64+0x33/0x40
+entry_SYSCALL_64_after_hwframe+0x44/0xa9
+---[ end trace b1f19b24368a96aa ]---
+
+Fixes: b60189e0392f ("net: stmmac: Integrate EST with TAPRIO scheduler API")
+Cc: <stable@vger.kernel.org> # 5.10.x
+Signed-off-by: Wong Vee Khee <vee.khee.wong@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+index fb5207dcbcaa..c7554db2962f 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+@@ -870,11 +870,13 @@ static int tc_setup_taprio(struct stmmac_priv *priv,
+ return 0;
+
+ disable:
+- mutex_lock(&priv->plat->est->lock);
+- priv->plat->est->enable = false;
+- stmmac_est_configure(priv, priv->ioaddr, priv->plat->est,
+- priv->plat->clk_ptp_rate);
+- mutex_unlock(&priv->plat->est->lock);
++ if (priv->plat->est) {
++ mutex_lock(&priv->plat->est->lock);
++ priv->plat->est->enable = false;
++ stmmac_est_configure(priv, priv->ioaddr, priv->plat->est,
++ priv->plat->clk_ptp_rate);
++ mutex_unlock(&priv->plat->est->lock);
++ }
+
+ priv->plat->fpe_cfg->enable = false;
+ stmmac_fpe_configure(priv, priv->ioaddr,
+--
+2.30.2
+
--- /dev/null
+From d8b2ac55ca3ca5d5a6940a0444c72e3d6eb083b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Aug 2021 09:57:53 +0300
+Subject: net: usb: pegasus: fixes of set_register(s) return value evaluation;
+
+From: Petko Manolov <petko.manolov@konsulko.com>
+
+[ Upstream commit ffc9c3ebb4af870a121da99826e9ccb63dc8b3d7 ]
+
+- restore the behavior in enable_net_traffic() to avoid regressions - Jakub
+ Kicinski;
+ - hurried up and removed redundant assignment in pegasus_open() before yet
+ another checker complains;
+
+Fixes: 8a160e2e9aeb ("net: usb: pegasus: Check the return value of get_geristers() and friends;")
+Reported-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Petko Manolov <petko.manolov@konsulko.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/pegasus.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
+index a08a46fef0d2..847372c6d9e8 100644
+--- a/drivers/net/usb/pegasus.c
++++ b/drivers/net/usb/pegasus.c
+@@ -471,7 +471,7 @@ static int enable_net_traffic(struct net_device *dev, struct usb_device *usb)
+ write_mii_word(pegasus, 0, 0x1b, &auxmode);
+ }
+
+- return 0;
++ return ret;
+ fail:
+ netif_dbg(pegasus, drv, pegasus->net, "%s failed\n", __func__);
+ return ret;
+@@ -860,7 +860,7 @@ static int pegasus_open(struct net_device *net)
+ if (!pegasus->rx_skb)
+ goto exit;
+
+- res = set_registers(pegasus, EthID, 6, net->dev_addr);
++ set_registers(pegasus, EthID, 6, net->dev_addr);
+
+ usb_fill_bulk_urb(pegasus->rx_urb, pegasus->usb,
+ usb_rcvbulkpipe(pegasus->usb, 1),
+--
+2.30.2
+
--- /dev/null
+From c3fc685c60ec23d809b7d31c36c782bf710a2e71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 20:25:52 -0700
+Subject: RDMA/bnxt_re: Add missing spin lock initialization
+
+From: Naresh Kumar PBS <nareshkumar.pbs@broadcom.com>
+
+[ Upstream commit 17f2569dce1848080825b8336e6b7c6900193b44 ]
+
+Add the missing initialization of srq lock.
+
+Fixes: 37cb11acf1f7 ("RDMA/bnxt_re: Add SRQ support for Broadcom adapters")
+Link: https://lore.kernel.org/r/1629343553-5843-3-git-send-email-selvin.xavier@broadcom.com
+Signed-off-by: Naresh Kumar PBS <nareshkumar.pbs@broadcom.com>
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/ib_verbs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+index 2efaa80bfbd2..9d79005befd6 100644
+--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+@@ -1691,6 +1691,7 @@ int bnxt_re_create_srq(struct ib_srq *ib_srq,
+ if (nq)
+ nq->budget++;
+ atomic_inc(&rdev->srq_count);
++ spin_lock_init(&srq->lock);
+
+ return 0;
+
+--
+2.30.2
+
--- /dev/null
+From 324320e099db43a4516d6261bf1145e9544934e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Aug 2021 16:55:31 +0800
+Subject: RDMA/bnxt_re: Remove unpaired rtnl unlock in bnxt_re_dev_init()
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit a036ad088306a88de87e973981f2b9224e466c3f ]
+
+The fixed commit removes all rtnl_lock() and rtnl_unlock() calls in
+function bnxt_re_dev_init(), but forgets to remove a rtnl_unlock() in the
+error handling path of bnxt_re_register_netdev(), which may cause a
+deadlock. This bug is suggested by a static analysis tool.
+
+Fixes: c2b777a95923 ("RDMA/bnxt_re: Refactor device add/remove functionalities")
+Link: https://lore.kernel.org/r/20210816085531.12167-1-dinghao.liu@zju.edu.cn
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Acked-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/main.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
+index 25550d982238..8097a8d8a49f 100644
+--- a/drivers/infiniband/hw/bnxt_re/main.c
++++ b/drivers/infiniband/hw/bnxt_re/main.c
+@@ -1406,7 +1406,6 @@ static int bnxt_re_dev_init(struct bnxt_re_dev *rdev, u8 wqe_mode)
+ memset(&rattr, 0, sizeof(rattr));
+ rc = bnxt_re_register_netdev(rdev);
+ if (rc) {
+- rtnl_unlock();
+ ibdev_err(&rdev->ibdev,
+ "Failed to register with netedev: %#x\n", rc);
+ return -EINVAL;
+--
+2.30.2
+
--- /dev/null
+From 6b9f52af09927efe91f5a85534b74a9961e6a60f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Aug 2021 18:11:28 +0300
+Subject: RDMA/efa: Free IRQ vectors on error flow
+
+From: Gal Pressman <galpress@amazon.com>
+
+[ Upstream commit dbe986bdfd6dfe6ef24b833767fff4151e024357 ]
+
+Make sure to free the IRQ vectors in case the allocation doesn't return
+the expected number of IRQs.
+
+Fixes: b7f5e880f377 ("RDMA/efa: Add the efa module")
+Link: https://lore.kernel.org/r/20210811151131.39138-2-galpress@amazon.com
+Reviewed-by: Firas JahJah <firasj@amazon.com>
+Reviewed-by: Yossi Leybovich <sleybo@amazon.com>
+Signed-off-by: Gal Pressman <galpress@amazon.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/efa/efa_main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/hw/efa/efa_main.c b/drivers/infiniband/hw/efa/efa_main.c
+index 816cfd65b7ac..0b61ef0d5983 100644
+--- a/drivers/infiniband/hw/efa/efa_main.c
++++ b/drivers/infiniband/hw/efa/efa_main.c
+@@ -356,6 +356,7 @@ static int efa_enable_msix(struct efa_dev *dev)
+ }
+
+ if (irq_num != msix_vecs) {
++ efa_disable_msix(dev);
+ dev_err(&dev->pdev->dev,
+ "Allocated %d MSI-X (out of %d requested)\n",
+ irq_num, msix_vecs);
+--
+2.30.2
+
--- /dev/null
+From 639732c377f8417527dff5d8c9edc8ee52873d9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 12:25:11 +0300
+Subject: RDMA/mlx5: Fix crash when unbind multiport slave
+
+From: Maor Gottlieb <maorg@nvidia.com>
+
+[ Upstream commit da78fe5fb35737058de52364484ffed74e7d329b ]
+
+Fix the below crash when deleting a slave from the unaffiliated list
+twice. First time when the slave is bound to the master and the second
+when the slave is unloaded.
+
+Fix it by checking if slave is unaffiliated (doesn't have ib device)
+before removing from the list.
+
+ RIP: 0010:mlx5r_mp_remove+0x4e/0xa0 [mlx5_ib]
+ Call Trace:
+ auxiliary_bus_remove+0x18/0x30
+ __device_release_driver+0x177/x220
+ device_release_driver+0x24/0x30
+ bus_remove_device+0xd8/0x140
+ device_del+0x18a/0x3e0
+ mlx5_rescan_drivers_locked+0xa9/0x210 [mlx5_core]
+ mlx5_unregister_device+0x34/0x60 [mlx5_core]
+ mlx5_uninit_one+0x32/0x100 [mlx5_core]
+ remove_one+0x6e/0xe0 [mlx5_core]
+ pci_device_remove+0x36/0xa0
+ __device_release_driver+0x177/0x220
+ device_driver_detach+0x3c/0xa0
+ unbind_store+0x113/0x130
+ kernfs_fop_write_iter+0x110/0x1a0
+ new_sync_write+0x116/0x1a0
+ vfs_write+0x1ba/0x260
+ ksys_write+0x5f/0xe0
+ do_syscall_64+0x3d/0x90
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+Fixes: 93f8244431ad ("RDMA/mlx5: Convert mlx5_ib to use auxiliary bus")
+Link: https://lore.kernel.org/r/17ec98989b0ba88f7adfbad68eb20bce8d567b44.1628587493.git.leonro@nvidia.com
+Signed-off-by: Maor Gottlieb <maorg@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index cca7296b12d0..9bb562c7cd24 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -4444,7 +4444,8 @@ static void mlx5r_mp_remove(struct auxiliary_device *adev)
+ mutex_lock(&mlx5_ib_multiport_mutex);
+ if (mpi->ibdev)
+ mlx5_ib_unbind_slave_port(mpi->ibdev, mpi);
+- list_del(&mpi->list);
++ else
++ list_del(&mpi->list);
+ mutex_unlock(&mlx5_ib_multiport_mutex);
+ kfree(mpi);
+ }
+--
+2.30.2
+
--- /dev/null
+From 0be860563ef9bb11293895e95c67c1031383910d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Aug 2021 16:06:26 -0500
+Subject: RDMA/rxe: Fix memory allocation while in a spin lock
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit 65a81b61d8c5e96748671824cc46339afbd831d0 ]
+
+rxe_mcast_add_grp_elem() in rxe_mcast.c calls rxe_alloc() while holding
+spinlocks which in turn calls kzalloc(size, GFP_KERNEL) which is
+incorrect. This patch replaces rxe_alloc() by rxe_alloc_locked() which
+uses GFP_ATOMIC. This bug was caused by the below mentioned commit and
+failing to handle the need for the atomic allocate.
+
+Fixes: 4276fd0dddc9 ("RDMA/rxe: Remove RXE_POOL_ATOMIC")
+Link: https://lore.kernel.org/r/20210813210625.4484-1-rpearsonhpe@gmail.com
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_mcast.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_mcast.c b/drivers/infiniband/sw/rxe/rxe_mcast.c
+index 0ea9a5aa4ec0..1c1d1b53312d 100644
+--- a/drivers/infiniband/sw/rxe/rxe_mcast.c
++++ b/drivers/infiniband/sw/rxe/rxe_mcast.c
+@@ -85,7 +85,7 @@ int rxe_mcast_add_grp_elem(struct rxe_dev *rxe, struct rxe_qp *qp,
+ goto out;
+ }
+
+- elem = rxe_alloc(&rxe->mc_elem_pool);
++ elem = rxe_alloc_locked(&rxe->mc_elem_pool);
+ if (!elem) {
+ err = -ENOMEM;
+ goto out;
+--
+2.30.2
+
--- /dev/null
+From f761523eaa88f86a77c537fc2fa4312d83f22831 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 16:56:06 +0300
+Subject: RDMA/uverbs: Track dmabuf memory regions
+
+From: Gal Pressman <galpress@amazon.com>
+
+[ Upstream commit f6018cc4602659e0e608849529704f3f41276c28 ]
+
+The dmabuf memory registrations are missing the restrack handling and
+hence do not appear in rdma tool.
+
+Fixes: bfe0cc6eb249 ("RDMA/uverbs: Add uverbs command for dma-buf based MR registration")
+Link: https://lore.kernel.org/r/20210812135607.6228-1-galpress@amazon.com
+Signed-off-by: Gal Pressman <galpress@amazon.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/uverbs_std_types_mr.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/infiniband/core/uverbs_std_types_mr.c b/drivers/infiniband/core/uverbs_std_types_mr.c
+index f782d5e1aa25..03e1db5d1e8c 100644
+--- a/drivers/infiniband/core/uverbs_std_types_mr.c
++++ b/drivers/infiniband/core/uverbs_std_types_mr.c
+@@ -249,6 +249,9 @@ static int UVERBS_HANDLER(UVERBS_METHOD_REG_DMABUF_MR)(
+ mr->uobject = uobj;
+ atomic_inc(&pd->usecnt);
+
++ rdma_restrack_new(&mr->res, RDMA_RESTRACK_MR);
++ rdma_restrack_set_name(&mr->res, NULL);
++ rdma_restrack_add(&mr->res);
+ uobj->object = mr;
+
+ uverbs_finalize_uobj_create(attrs, UVERBS_ATTR_REG_DMABUF_MR_HANDLE);
+--
+2.30.2
+
--- /dev/null
+From 0c9af7e524d73cf672233bbc8e675f535f120752 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Aug 2021 16:30:36 +0200
+Subject: Revert "mmc: sdhci-iproc: Set SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN on
+ BCM2711"
+
+From: Ulf Hansson <ulf.hansson@linaro.org>
+
+[ Upstream commit 885814a97f5a1a2daf66bde5f2076f0bf632c174 ]
+
+This reverts commit 419dd626e357e89fc9c4e3863592c8b38cfe1571.
+
+It turned out that the change from the reverted commit breaks the ACPI
+based rpi's because it causes the 100Mhz max clock to be overridden to the
+return from sdhci_iproc_get_max_clock(), which is 0 because there isn't a
+OF/DT based clock device.
+
+Reported-by: Jeremy Linton <jeremy.linton@arm.com>
+Fixes: 419dd626e357 ("mmc: sdhci-iproc: Set SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN on BCM2711")
+Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-iproc.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci-iproc.c b/drivers/mmc/host/sdhci-iproc.c
+index 9f0eef97ebdd..b9eb2ec61a83 100644
+--- a/drivers/mmc/host/sdhci-iproc.c
++++ b/drivers/mmc/host/sdhci-iproc.c
+@@ -295,8 +295,7 @@ static const struct sdhci_ops sdhci_iproc_bcm2711_ops = {
+ };
+
+ static const struct sdhci_pltfm_data sdhci_bcm2711_pltfm_data = {
+- .quirks = SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12 |
+- SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN,
++ .quirks = SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12,
+ .ops = &sdhci_iproc_bcm2711_ops,
+ };
+
+--
+2.30.2
+
--- /dev/null
+From 4bdccf0f14c4d8691533748697e515a07d92142f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Aug 2021 17:25:40 -0700
+Subject: rtnetlink: Return correct error on changing device netns
+
+From: Andrey Ignatov <rdna@fb.com>
+
+[ Upstream commit 96a6b93b69880b2c978e1b2be9cae6970b605008 ]
+
+Currently when device is moved between network namespaces using
+RTM_NEWLINK message type and one of netns attributes (FLA_NET_NS_PID,
+IFLA_NET_NS_FD, IFLA_TARGET_NETNSID) but w/o specifying IFLA_IFNAME, and
+target namespace already has device with same name, userspace will get
+EINVAL what is confusing and makes debugging harder.
+
+Fix it so that userspace gets more appropriate EEXIST instead what makes
+debugging much easier.
+
+Before:
+
+ # ./ifname.sh
+ + ip netns add ns0
+ + ip netns exec ns0 ip link add l0 type dummy
+ + ip netns exec ns0 ip link show l0
+ 8: l0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
+ link/ether 66:90:b5:d5:78:69 brd ff:ff:ff:ff:ff:ff
+ + ip link add l0 type dummy
+ + ip link show l0
+ 10: l0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
+ link/ether 6e:c6:1f:15:20:8d brd ff:ff:ff:ff:ff:ff
+ + ip link set l0 netns ns0
+ RTNETLINK answers: Invalid argument
+
+After:
+
+ # ./ifname.sh
+ + ip netns add ns0
+ + ip netns exec ns0 ip link add l0 type dummy
+ + ip netns exec ns0 ip link show l0
+ 8: l0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
+ link/ether 1e:4a:72:e3:e3:8f brd ff:ff:ff:ff:ff:ff
+ + ip link add l0 type dummy
+ + ip link show l0
+ 10: l0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
+ link/ether f2:fc:fe:2b:7d:a6 brd ff:ff:ff:ff:ff:ff
+ + ip link set l0 netns ns0
+ RTNETLINK answers: File exists
+
+The problem is that do_setlink() passes its `char *ifname` argument,
+that it gets from a caller, to __dev_change_net_namespace() as is (as
+`const char *pat`), but semantics of ifname and pat can be different.
+
+For example, __rtnl_newlink() does this:
+
+net/core/rtnetlink.c
+ 3270 char ifname[IFNAMSIZ];
+ ...
+ 3286 if (tb[IFLA_IFNAME])
+ 3287 nla_strscpy(ifname, tb[IFLA_IFNAME], IFNAMSIZ);
+ 3288 else
+ 3289 ifname[0] = '\0';
+ ...
+ 3364 if (dev) {
+ ...
+ 3394 return do_setlink(skb, dev, ifm, extack, tb, ifname, status);
+ 3395 }
+
+, i.e. do_setlink() gets ifname pointer that is always valid no matter
+if user specified IFLA_IFNAME or not and then do_setlink() passes this
+ifname pointer as is to __dev_change_net_namespace() as pat argument.
+
+But the pat (pattern) in __dev_change_net_namespace() is used as:
+
+net/core/dev.c
+ 11198 err = -EEXIST;
+ 11199 if (__dev_get_by_name(net, dev->name)) {
+ 11200 /* We get here if we can't use the current device name */
+ 11201 if (!pat)
+ 11202 goto out;
+ 11203 err = dev_get_valid_name(net, dev, pat);
+ 11204 if (err < 0)
+ 11205 goto out;
+ 11206 }
+
+As the result the `goto out` path on line 11202 is neven taken and
+instead of returning EEXIST defined on line 11198,
+__dev_change_net_namespace() returns an error from dev_get_valid_name()
+and this, in turn, will be EINVAL for ifname[0] = '\0' set earlier.
+
+Fixes: d8a5ec672768 ("[NET]: netlink support for moving devices between network namespaces.")
+Signed-off-by: Andrey Ignatov <rdna@fb.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/rtnetlink.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index c6e75bd0035d..89c7369805e9 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -2597,6 +2597,7 @@ static int do_setlink(const struct sk_buff *skb,
+ return err;
+
+ if (tb[IFLA_NET_NS_PID] || tb[IFLA_NET_NS_FD] || tb[IFLA_TARGET_NETNSID]) {
++ const char *pat = ifname && ifname[0] ? ifname : NULL;
+ struct net *net;
+ int new_ifindex;
+
+@@ -2612,7 +2613,7 @@ static int do_setlink(const struct sk_buff *skb,
+ else
+ new_ifindex = 0;
+
+- err = __dev_change_net_namespace(dev, net, ifname, new_ifindex);
++ err = __dev_change_net_namespace(dev, net, pat, new_ifindex);
+ put_net(net);
+ if (err)
+ goto errout;
+--
+2.30.2
+
usb-dwc3-gadget-fix-dwc3_calc_trbs_left.patch
usb-dwc3-gadget-stop-ep0-transfers-during-pullup-disable.patch
scsi-core-fix-hang-of-freezing-queue-between-blocking-and-running-device.patch
+rdma-mlx5-fix-crash-when-unbind-multiport-slave.patch
+rdma-uverbs-track-dmabuf-memory-regions.patch
+rdma-bnxt_re-add-missing-spin-lock-initialization.patch
+ib-hfi1-fix-possible-null-pointer-dereference-in-_ex.patch
+rdma-bnxt_re-remove-unpaired-rtnl-unlock-in-bnxt_re_.patch
+rdma-rxe-fix-memory-allocation-while-in-a-spin-lock.patch
+ice-do-not-abort-devlink-info-if-board-identifier-ca.patch
+net-usb-pegasus-fixes-of-set_register-s-return-value.patch
+igc-fix-page-fault-when-thunderbolt-is-unplugged.patch
+igc-use-num_tx_queues-when-iterating-over-tx_ring-qu.patch
+e1000e-fix-the-max-snoop-no-snoop-latency-for-10m.patch
+e1000e-do-not-take-care-about-recovery-nvm-checksum.patch
+rdma-efa-free-irq-vectors-on-error-flow.patch
+ip_gre-add-validation-for-csum_start.patch
+xgene-v2-fix-a-resource-leak-in-the-error-handling-p.patch
+net-marvell-fix-mvneta_tx_in_prgrs-bit-number.patch
+ucounts-increase-ucounts-reference-counter-before-th.patch
+net-stmmac-dwmac-rk-fix-unbalanced-pm_runtime_enable.patch
+net-sched-ets-fix-crash-when-flipping-from-strict-to.patch
+sunrpc-fix-xpt_busy-flag-leakage-in-svc_handle_xprt.patch
+ipv6-use-siphash-in-rt6_exception_hash.patch
+ipv4-use-siphash-instead-of-jenkins-in-fnhe_hashfun.patch
+cxgb4-dont-touch-blocked-freelist-bitmap-after-free.patch
+net-dsa-hellcreek-fix-incorrect-setting-of-gcl.patch
+net-dsa-hellcreek-adjust-schedule-look-ahead-window.patch
+rtnetlink-return-correct-error-on-changing-device-ne.patch
+net-hns3-clear-hardware-resource-when-loading-driver.patch
+net-hns3-add-waiting-time-before-cmdq-memory-is-rele.patch
+net-hns3-fix-speed-unknown-issue-in-bond-4.patch
+net-hns3-fix-duplicate-node-in-vlan-list.patch
+net-hns3-fix-get-wrong-pfc_en-when-query-pfc-configu.patch
+media-ipu3-cio2-drop-reference-on-error-path-in-cio2.patch
+revert-mmc-sdhci-iproc-set-sdhci_quirk_cap_clock_bas.patch
+net-stmmac-add-mutex-lock-to-protect-est-parameters.patch
+net-stmmac-fix-kernel-panic-due-to-null-pointer-dere.patch
+usb-gadget-u_audio-fix-race-condition-on-endpoint-st.patch
--- /dev/null
+From a3f34d4de63f5da46dfab91f5455cd9ad2b679f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Aug 2021 15:33:14 -0400
+Subject: SUNRPC: Fix XPT_BUSY flag leakage in svc_handle_xprt()...
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 062b829c52ef4ed5df14f4850fc07651bb7c3b33 ]
+
+If the attempt to reserve a slot fails, we currently leak the XPT_BUSY
+flag on the socket. Among other things, this make it impossible to close
+the socket.
+
+Fixes: 82011c80b3ec ("SUNRPC: Move svc_xprt_received() call sites")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/svc_xprt.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
+index d66a8e44a1ae..dbb41821b1b8 100644
+--- a/net/sunrpc/svc_xprt.c
++++ b/net/sunrpc/svc_xprt.c
+@@ -835,7 +835,8 @@ static int svc_handle_xprt(struct svc_rqst *rqstp, struct svc_xprt *xprt)
+ rqstp->rq_stime = ktime_get();
+ rqstp->rq_reserved = serv->sv_max_mesg;
+ atomic_add(rqstp->rq_reserved, &xprt->xpt_reserved);
+- }
++ } else
++ svc_xprt_received(xprt);
+ out:
+ trace_svc_handle_xprt(xprt, len);
+ return len;
+--
+2.30.2
+
--- /dev/null
+From 96c48104d3cde15027564be4bd78b843ee3b57b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Aug 2021 18:16:33 +0200
+Subject: ucounts: Increase ucounts reference counter before the security hook
+
+From: Alexey Gladkov <legion@kernel.org>
+
+[ Upstream commit bbb6d0f3e1feb43d663af089c7dedb23be6a04fb ]
+
+We need to increment the ucounts reference counter befor security_prepare_creds()
+because this function may fail and abort_creds() will try to decrement
+this reference.
+
+[ 96.465056][ T8641] FAULT_INJECTION: forcing a failure.
+[ 96.465056][ T8641] name fail_page_alloc, interval 1, probability 0, space 0, times 0
+[ 96.478453][ T8641] CPU: 1 PID: 8641 Comm: syz-executor668 Not tainted 5.14.0-rc6-syzkaller #0
+[ 96.487215][ T8641] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+[ 96.497254][ T8641] Call Trace:
+[ 96.500517][ T8641] dump_stack_lvl+0x1d3/0x29f
+[ 96.505758][ T8641] ? show_regs_print_info+0x12/0x12
+[ 96.510944][ T8641] ? log_buf_vmcoreinfo_setup+0x498/0x498
+[ 96.516652][ T8641] should_fail+0x384/0x4b0
+[ 96.521141][ T8641] prepare_alloc_pages+0x1d1/0x5a0
+[ 96.526236][ T8641] __alloc_pages+0x14d/0x5f0
+[ 96.530808][ T8641] ? __rmqueue_pcplist+0x2030/0x2030
+[ 96.536073][ T8641] ? lockdep_hardirqs_on_prepare+0x3e2/0x750
+[ 96.542056][ T8641] ? alloc_pages+0x3f3/0x500
+[ 96.546635][ T8641] allocate_slab+0xf1/0x540
+[ 96.551120][ T8641] ___slab_alloc+0x1cf/0x350
+[ 96.555689][ T8641] ? kzalloc+0x1d/0x30
+[ 96.559740][ T8641] __kmalloc+0x2e7/0x390
+[ 96.563980][ T8641] ? kzalloc+0x1d/0x30
+[ 96.568029][ T8641] kzalloc+0x1d/0x30
+[ 96.571903][ T8641] security_prepare_creds+0x46/0x220
+[ 96.577174][ T8641] prepare_creds+0x411/0x640
+[ 96.581747][ T8641] __sys_setfsuid+0xe2/0x3a0
+[ 96.586333][ T8641] do_syscall_64+0x3d/0xb0
+[ 96.590739][ T8641] entry_SYSCALL_64_after_hwframe+0x44/0xae
+[ 96.596611][ T8641] RIP: 0033:0x445a69
+[ 96.600483][ T8641] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
+[ 96.620152][ T8641] RSP: 002b:00007f1054173318 EFLAGS: 00000246 ORIG_RAX: 000000000000007a
+[ 96.628543][ T8641] RAX: ffffffffffffffda RBX: 00000000004ca4c8 RCX: 0000000000445a69
+[ 96.636600][ T8641] RDX: 0000000000000010 RSI: 00007f10541732f0 RDI: 0000000000000000
+[ 96.644550][ T8641] RBP: 00000000004ca4c0 R08: 0000000000000001 R09: 0000000000000000
+[ 96.652500][ T8641] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004ca4cc
+[ 96.660631][ T8641] R13: 00007fffffe0b62f R14: 00007f1054173400 R15: 0000000000022000
+
+Fixes: 905ae01c4ae2 ("Add a reference to ucounts for each cred")
+Reported-by: syzbot+01985d7909f9468f013c@syzkaller.appspotmail.com
+Signed-off-by: Alexey Gladkov <legion@kernel.org>
+Link: https://lkml.kernel.org/r/97433b1742c3331f02ad92de5a4f07d673c90613.1629735352.git.legion@kernel.org
+Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/cred.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/cred.c b/kernel/cred.c
+index 9c2759166bd8..0f84958d1db9 100644
+--- a/kernel/cred.c
++++ b/kernel/cred.c
+@@ -286,13 +286,13 @@ struct cred *prepare_creds(void)
+ new->security = NULL;
+ #endif
+
+- if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0)
+- goto error;
+-
+ new->ucounts = get_ucounts(new->ucounts);
+ if (!new->ucounts)
+ goto error;
+
++ if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0)
++ goto error;
++
+ validate_creds(new);
+ return new;
+
+@@ -753,13 +753,13 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
+ #ifdef CONFIG_SECURITY
+ new->security = NULL;
+ #endif
+- if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0)
+- goto error;
+-
+ new->ucounts = get_ucounts(new->ucounts);
+ if (!new->ucounts)
+ goto error;
+
++ if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0)
++ goto error;
++
+ put_cred(old);
+ validate_creds(new);
+ return new;
+--
+2.30.2
+
--- /dev/null
+From aac1e1dd4c79d3eebe6fefb05e329ef7cc8ba15b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Aug 2021 11:29:27 +0200
+Subject: usb: gadget: u_audio: fix race condition on endpoint stop
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 068fdad20454f815e61e6f6eb9f051a8b3120e88 ]
+
+If the endpoint completion callback is call right after the ep_enabled flag
+is cleared and before usb_ep_dequeue() is call, we could do a double free
+on the request and the associated buffer.
+
+Fix this by clearing ep_enabled after all the endpoint requests have been
+dequeued.
+
+Fixes: 7de8681be2cd ("usb: gadget: u_audio: Free requests only after callback")
+Cc: stable <stable@vger.kernel.org>
+Reported-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lore.kernel.org/r/20210827092927.366482-1-jbrunet@baylibre.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/u_audio.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
+index 5fbceee897a3..3b613ca06ae5 100644
+--- a/drivers/usb/gadget/function/u_audio.c
++++ b/drivers/usb/gadget/function/u_audio.c
+@@ -312,8 +312,6 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep)
+ if (!prm->ep_enabled)
+ return;
+
+- prm->ep_enabled = false;
+-
+ audio_dev = uac->audio_dev;
+ params = &audio_dev->params;
+
+@@ -331,11 +329,12 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep)
+ }
+ }
+
++ prm->ep_enabled = false;
++
+ if (usb_ep_disable(ep))
+ dev_err(uac->card->dev, "%s:%d Error!\n", __func__, __LINE__);
+ }
+
+-
+ int u_audio_start_capture(struct g_audio *audio_dev)
+ {
+ struct snd_uac_chip *uac = audio_dev->uac;
+--
+2.30.2
+
--- /dev/null
+From 6543e7698702ddb1810fad5b241e25b6bdd630cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Aug 2021 09:35:23 +0200
+Subject: xgene-v2: Fix a resource leak in the error handling path of
+ 'xge_probe()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 5ed74b03eb4d08f5dd281dcb5f1c9bb92b363a8d ]
+
+A successful 'xge_mdio_config()' call should be balanced by a corresponding
+'xge_mdio_remove()' call in the error handling path of the probe, as
+already done in the remove function.
+
+Update the error handling path accordingly.
+
+Fixes: ea8ab16ab225 ("drivers: net: xgene-v2: Add MDIO support")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/apm/xgene-v2/main.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/apm/xgene-v2/main.c b/drivers/net/ethernet/apm/xgene-v2/main.c
+index 860c18fb7aae..80399c8980bd 100644
+--- a/drivers/net/ethernet/apm/xgene-v2/main.c
++++ b/drivers/net/ethernet/apm/xgene-v2/main.c
+@@ -677,11 +677,13 @@ static int xge_probe(struct platform_device *pdev)
+ ret = register_netdev(ndev);
+ if (ret) {
+ netdev_err(ndev, "Failed to register netdev\n");
+- goto err;
++ goto err_mdio_remove;
+ }
+
+ return 0;
+
++err_mdio_remove:
++ xge_mdio_remove(ndev);
+ err:
+ free_netdev(ndev);
+
+--
+2.30.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
