--- /dev/null
+From f610a5a29c3cfb7d37bdfa4ef52f72ea51f24a76 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Thu, 27 May 2021 11:24:33 +0100
+Subject: afs: Fix the nlink handling of dir-over-dir rename
+
+From: David Howells <dhowells@redhat.com>
+
+commit f610a5a29c3cfb7d37bdfa4ef52f72ea51f24a76 upstream.
+
+Fix rename of one directory over another such that the nlink on the deleted
+directory is cleared to 0 rather than being decremented to 1.
+
+This was causing the generic/035 xfstest to fail.
+
+Fixes: e49c7b2f6de7 ("afs: Build an abstraction around an "operation" concept")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Marc Dionne <marc.dionne@auristor.com>
+cc: linux-afs@lists.infradead.org
+Link: https://lore.kernel.org/r/162194384460.3999479.7605572278074191079.stgit@warthog.procyon.org.uk/ # v1
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/afs/dir.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/fs/afs/dir.c
++++ b/fs/afs/dir.c
+@@ -1842,7 +1842,9 @@ static void afs_rename_edit_dir(struct a
+ new_inode = d_inode(new_dentry);
+ if (new_inode) {
+ spin_lock(&new_inode->i_lock);
+- if (new_inode->i_nlink > 0)
++ if (S_ISDIR(new_inode->i_mode))
++ clear_nlink(new_inode);
++ else if (new_inode->i_nlink > 0)
+ drop_nlink(new_inode);
+ spin_unlock(&new_inode->i_lock);
+ }
--- /dev/null
+From e4d8716c3dcec47f1557024add24e1f3c09eb24b Mon Sep 17 00:00:00 2001
+From: Jean Delvare <jdelvare@suse.de>
+Date: Tue, 25 May 2021 17:03:36 +0200
+Subject: i2c: i801: Don't generate an interrupt on bus reset
+
+From: Jean Delvare <jdelvare@suse.de>
+
+commit e4d8716c3dcec47f1557024add24e1f3c09eb24b upstream.
+
+Now that the i2c-i801 driver supports interrupts, setting the KILL bit
+in a attempt to recover from a timed out transaction triggers an
+interrupt. Unfortunately, the interrupt handler (i801_isr) is not
+prepared for this situation and will try to process the interrupt as
+if it was signaling the end of a successful transaction. In the case
+of a block transaction, this can result in an out-of-range memory
+access.
+
+This condition was reproduced several times by syzbot:
+https://syzkaller.appspot.com/bug?extid=ed71512d469895b5b34e
+https://syzkaller.appspot.com/bug?extid=8c8dedc0ba9e03f6c79e
+https://syzkaller.appspot.com/bug?extid=c8ff0b6d6c73d81b610e
+https://syzkaller.appspot.com/bug?extid=33f6c360821c399d69eb
+https://syzkaller.appspot.com/bug?extid=be15dc0b1933f04b043a
+https://syzkaller.appspot.com/bug?extid=b4d3fd1dfd53e90afd79
+
+So disable interrupts while trying to reset the bus. Interrupts will
+be enabled again for the following transaction.
+
+Fixes: 636752bcb517 ("i2c-i801: Enable IRQ for SMBus transactions")
+Reported-by: syzbot+b4d3fd1dfd53e90afd79@syzkaller.appspotmail.com
+Signed-off-by: Jean Delvare <jdelvare@suse.de>
+Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Cc: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Tested-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-i801.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-i801.c
++++ b/drivers/i2c/busses/i2c-i801.c
+@@ -395,11 +395,9 @@ static int i801_check_post(struct i801_p
+ dev_err(&priv->pci_dev->dev, "Transaction timeout\n");
+ /* try to stop the current command */
+ dev_dbg(&priv->pci_dev->dev, "Terminating the current operation\n");
+- outb_p(inb_p(SMBHSTCNT(priv)) | SMBHSTCNT_KILL,
+- SMBHSTCNT(priv));
++ outb_p(SMBHSTCNT_KILL, SMBHSTCNT(priv));
+ usleep_range(1000, 2000);
+- outb_p(inb_p(SMBHSTCNT(priv)) & (~SMBHSTCNT_KILL),
+- SMBHSTCNT(priv));
++ outb_p(0, SMBHSTCNT(priv));
+
+ /* Check if it worked */
+ status = inb_p(SMBHSTSTS(priv));
--- /dev/null
+From fed1bd51a504eb96caa38b4f13ab138fc169ea75 Mon Sep 17 00:00:00 2001
+From: Qii Wang <qii.wang@mediatek.com>
+Date: Thu, 27 May 2021 20:04:04 +0800
+Subject: i2c: mediatek: Disable i2c start_en and clear intr_stat brfore reset
+
+From: Qii Wang <qii.wang@mediatek.com>
+
+commit fed1bd51a504eb96caa38b4f13ab138fc169ea75 upstream.
+
+The i2c controller driver do dma reset after transfer timeout,
+but sometimes dma reset will trigger an unexpected DMA_ERR irq.
+It will cause the i2c controller to continuously send interrupts
+to the system and cause soft lock-up. So we need to disable i2c
+start_en and clear intr_stat to stop i2c controller before dma
+reset when transfer timeout.
+
+Fixes: aafced673c06("i2c: mediatek: move dma reset before i2c reset")
+Signed-off-by: Qii Wang <qii.wang@mediatek.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -478,6 +478,11 @@ static void mtk_i2c_clock_disable(struct
+ static void mtk_i2c_init_hw(struct mtk_i2c *i2c)
+ {
+ u16 control_reg;
++ u16 intr_stat_reg;
++
++ mtk_i2c_writew(i2c, I2C_CHN_CLR_FLAG, OFFSET_START);
++ intr_stat_reg = mtk_i2c_readw(i2c, OFFSET_INTR_STAT);
++ mtk_i2c_writew(i2c, intr_stat_reg, OFFSET_INTR_STAT);
+
+ if (i2c->dev_comp->apdma_sync) {
+ writel(I2C_DMA_WARM_RST, i2c->pdmabase + OFFSET_RST);
--- /dev/null
+From 24990423267ec283b9d86f07f362b753eb9b0ed5 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Date: Wed, 26 May 2021 08:39:37 -0400
+Subject: i2c: s3c2410: fix possible NULL pointer deref on read message after write
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+
+commit 24990423267ec283b9d86f07f362b753eb9b0ed5 upstream.
+
+Interrupt handler processes multiple message write requests one after
+another, till the driver message queue is drained. However if driver
+encounters a read message without preceding START, it stops the I2C
+transfer as it is an invalid condition for the controller. At least the
+comment describes a requirement "the controller forces us to send a new
+START when we change direction". This stop results in clearing the
+message queue (i2c->msg = NULL).
+
+The code however immediately jumped back to label "retry_write" which
+dereferenced the "i2c->msg" making it a possible NULL pointer
+dereference.
+
+The Coverity analysis:
+1. Condition !is_msgend(i2c), taking false branch.
+ if (!is_msgend(i2c)) {
+
+2. Condition !is_lastmsg(i2c), taking true branch.
+ } else if (!is_lastmsg(i2c)) {
+
+3. Condition i2c->msg->flags & 1, taking true branch.
+ if (i2c->msg->flags & I2C_M_RD) {
+
+4. write_zero_model: Passing i2c to s3c24xx_i2c_stop, which sets i2c->msg to NULL.
+ s3c24xx_i2c_stop(i2c, -EINVAL);
+
+5. Jumping to label retry_write.
+ goto retry_write;
+
+6. var_deref_model: Passing i2c to is_msgend, which dereferences null i2c->msg.
+ if (!is_msgend(i2c)) {"
+
+All previous calls to s3c24xx_i2c_stop() in this interrupt service
+routine are followed by jumping to end of function (acknowledging
+the interrupt and returning). This seems a reasonable choice also here
+since message buffer was entirely emptied.
+
+Addresses-Coverity: Explicit null dereferenced
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-s3c2410.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-s3c2410.c
++++ b/drivers/i2c/busses/i2c-s3c2410.c
+@@ -483,7 +483,10 @@ static int i2c_s3c_irq_nextbyte(struct s
+ * forces us to send a new START
+ * when we change direction
+ */
++ dev_dbg(i2c->dev,
++ "missing START before write->read\n");
+ s3c24xx_i2c_stop(i2c, -EINVAL);
++ break;
+ }
+
+ goto retry_write;
--- /dev/null
+From c4740e293c93c747e65d53d9aacc2ba8521d1489 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Thu, 6 May 2021 13:15:40 +0200
+Subject: i2c: sh_mobile: Use new clock calculation formulas for RZ/G2E
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit c4740e293c93c747e65d53d9aacc2ba8521d1489 upstream.
+
+When switching the Gen3 SoCs to the new clock calculation formulas, the
+match entry for RZ/G2E added in commit 51243b73455f2d12 ("i2c:
+sh_mobile: Add support for r8a774c0 (RZ/G2E)") was forgotten.
+
+Fixes: e8a27567509b2439 ("i2c: sh_mobile: use new clock calculation formulas for Gen3")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Fabrizio Castro <fabrizio.castro.jz@renesas.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-sh_mobile.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-sh_mobile.c
++++ b/drivers/i2c/busses/i2c-sh_mobile.c
+@@ -807,7 +807,7 @@ static const struct sh_mobile_dt_config
+ static const struct of_device_id sh_mobile_i2c_dt_ids[] = {
+ { .compatible = "renesas,iic-r8a73a4", .data = &fast_clock_dt_config },
+ { .compatible = "renesas,iic-r8a7740", .data = &r8a7740_dt_config },
+- { .compatible = "renesas,iic-r8a774c0", .data = &fast_clock_dt_config },
++ { .compatible = "renesas,iic-r8a774c0", .data = &v2_freq_calc_dt_config },
+ { .compatible = "renesas,iic-r8a7790", .data = &v2_freq_calc_dt_config },
+ { .compatible = "renesas,iic-r8a7791", .data = &v2_freq_calc_dt_config },
+ { .compatible = "renesas,iic-r8a7792", .data = &v2_freq_calc_dt_config },
--- /dev/null
+From 3ed0a585bfadb6bd7080f11184adbc9edcce7dbc Mon Sep 17 00:00:00 2001
+From: Paolo Abeni <pabeni@redhat.com>
+Date: Tue, 25 May 2021 14:23:12 -0700
+Subject: mptcp: avoid error message on infinite mapping
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+commit 3ed0a585bfadb6bd7080f11184adbc9edcce7dbc upstream.
+
+Another left-over. Avoid flooding dmesg with useless text,
+we already have a MIB for that event.
+
+Fixes: 648ef4b88673 ("mptcp: Implement MPTCP receive path")
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/subflow.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/net/mptcp/subflow.c
++++ b/net/mptcp/subflow.c
+@@ -839,7 +839,6 @@ static enum mapping_status get_mapping_s
+
+ data_len = mpext->data_len;
+ if (data_len == 0) {
+- pr_err("Infinite mapping not handled");
+ MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_INFINITEMAPRX);
+ return MAPPING_INVALID;
+ }
--- /dev/null
+From 3812ce895047afdb78dc750a236515416e0ccded Mon Sep 17 00:00:00 2001
+From: Paolo Abeni <pabeni@redhat.com>
+Date: Tue, 25 May 2021 14:23:11 -0700
+Subject: mptcp: drop unconditional pr_warn on bad opt
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+commit 3812ce895047afdb78dc750a236515416e0ccded upstream.
+
+This is a left-over of early day. A malicious peer can flood
+the kernel logs with useless messages, just drop it.
+
+Fixes: f296234c98a8 ("mptcp: Add handling of incoming MP_JOIN requests")
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/options.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/net/mptcp/options.c
++++ b/net/mptcp/options.c
+@@ -127,7 +127,6 @@ static void mptcp_parse_option(const str
+ memcpy(mp_opt->hmac, ptr, MPTCPOPT_HMAC_LEN);
+ pr_debug("MP_JOIN hmac");
+ } else {
+- pr_warn("MP_JOIN bad option size");
+ mp_opt->mp_join = 0;
+ }
+ break;
--- /dev/null
+From 29249eac5225429b898f278230a6ca2baa1ae154 Mon Sep 17 00:00:00 2001
+From: Paolo Abeni <pabeni@redhat.com>
+Date: Tue, 11 May 2021 19:13:51 +0200
+Subject: mptcp: fix data stream corruption
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+commit 29249eac5225429b898f278230a6ca2baa1ae154 upstream.
+
+Maxim reported several issues when forcing a TCP transparent proxy
+to use the MPTCP protocol for the inbound connections. He also
+provided a clean reproducer.
+
+The problem boils down to 'mptcp_frag_can_collapse_to()' assuming
+that only MPTCP will use the given page_frag.
+
+If others - e.g. the plain TCP protocol - allocate page fragments,
+we can end-up re-using already allocated memory for mptcp_data_frag.
+
+Fix the issue ensuring that the to-be-expanded data fragment is
+located at the current page frag end.
+
+v1 -> v2:
+ - added missing fixes tag (Mat)
+
+Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/178
+Reported-and-tested-by: Maxim Galaganov <max@internet.ru>
+Fixes: 18b683bff89d ("mptcp: queue data for mptcp level retransmission")
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/protocol.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -869,12 +869,18 @@ static bool mptcp_skb_can_collapse_to(u6
+ !mpext->frozen;
+ }
+
++/* we can append data to the given data frag if:
++ * - there is space available in the backing page_frag
++ * - the data frag tail matches the current page_frag free offset
++ * - the data frag end sequence number matches the current write seq
++ */
+ static bool mptcp_frag_can_collapse_to(const struct mptcp_sock *msk,
+ const struct page_frag *pfrag,
+ const struct mptcp_data_frag *df)
+ {
+ return df && pfrag->page == df->page &&
+ pfrag->size - pfrag->offset > 0 &&
++ pfrag->offset == (df->offset + df->data_len) &&
+ df->data_seq + df->data_len == msk->write_seq;
+ }
+
--- /dev/null
+From fc516d3a6aa2c6ffe27d0da8818d13839e023e7e Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Fri, 21 May 2021 10:46:14 -0700
+Subject: net: dsa: bcm_sf2: Fix bcm_sf2_reg_rgmii_cntrl() call for non-RGMII port
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+commit fc516d3a6aa2c6ffe27d0da8818d13839e023e7e upstream.
+
+We cannot call bcm_sf2_reg_rgmii_cntrl() for a port that is not RGMII,
+yet we do that in bcm_sf2_sw_mac_link_up() irrespective of the port's
+interface. Move that read until we have properly qualified the PHY
+interface mode. This avoids triggering a warning on 7278 platforms that
+have GMII ports.
+
+Fixes: 55cfeb396965 ("net: dsa: bcm_sf2: add function finding RGMII register")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Acked-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/bcm_sf2.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -775,11 +775,9 @@ static void bcm_sf2_sw_mac_link_up(struc
+ bcm_sf2_sw_mac_link_set(ds, port, interface, true);
+
+ if (port != core_readl(priv, CORE_IMP0_PRT_ID)) {
+- u32 reg_rgmii_ctrl;
++ u32 reg_rgmii_ctrl = 0;
+ u32 reg, offset;
+
+- reg_rgmii_ctrl = bcm_sf2_reg_rgmii_cntrl(priv, port);
+-
+ if (priv->type == BCM4908_DEVICE_ID ||
+ priv->type == BCM7445_DEVICE_ID)
+ offset = CORE_STS_OVERRIDE_GMIIP_PORT(port);
+@@ -790,6 +788,7 @@ static void bcm_sf2_sw_mac_link_up(struc
+ interface == PHY_INTERFACE_MODE_RGMII_TXID ||
+ interface == PHY_INTERFACE_MODE_MII ||
+ interface == PHY_INTERFACE_MODE_REVMII) {
++ reg_rgmii_ctrl = bcm_sf2_reg_rgmii_cntrl(priv, port);
+ reg = reg_readl(priv, reg_rgmii_ctrl);
+ reg &= ~(RX_PAUSE_EN | TX_PAUSE_EN);
+
--- /dev/null
+From a269333fa5c0c8e53c92b5a28a6076a28cde3e83 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Sat, 8 May 2021 16:30:35 +0300
+Subject: net: dsa: fix a crash if ->get_sset_count() fails
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit a269333fa5c0c8e53c92b5a28a6076a28cde3e83 upstream.
+
+If ds->ops->get_sset_count() fails then it "count" is a negative error
+code such as -EOPNOTSUPP. Because "i" is an unsigned int, the negative
+error code is type promoted to a very high value and the loop will
+corrupt memory until the system crashes.
+
+Fix this by checking for error codes and changing the type of "i" to
+just int.
+
+Fixes: badf3ada60ab ("net: dsa: Provide CPU port statistics to master netdev")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/dsa/master.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/dsa/master.c
++++ b/net/dsa/master.c
+@@ -147,8 +147,7 @@ static void dsa_master_get_strings(struc
+ struct dsa_switch *ds = cpu_dp->ds;
+ int port = cpu_dp->index;
+ int len = ETH_GSTRING_LEN;
+- int mcount = 0, count;
+- unsigned int i;
++ int mcount = 0, count, i;
+ uint8_t pfx[4];
+ uint8_t *ndata;
+
+@@ -178,6 +177,8 @@ static void dsa_master_get_strings(struc
+ */
+ ds->ops->get_strings(ds, port, stringset, ndata);
+ count = ds->ops->get_sset_count(ds, port, stringset);
++ if (count < 0)
++ return;
+ for (i = 0; i < count; i++) {
+ memmove(ndata + (i * len + sizeof(pfx)),
+ ndata + i * len, len - sizeof(pfx));
--- /dev/null
+From 474a2ddaa192777522a7499784f1d60691cd831a Mon Sep 17 00:00:00 2001
+From: DENG Qingfang <dqfext@gmail.com>
+Date: Sun, 23 May 2021 22:51:54 +0800
+Subject: net: dsa: mt7530: fix VLAN traffic leaks
+
+From: DENG Qingfang <dqfext@gmail.com>
+
+commit 474a2ddaa192777522a7499784f1d60691cd831a upstream.
+
+PCR_MATRIX field was set to all 1's when VLAN filtering is enabled, but
+was not reset when it is disabled, which may cause traffic leaks:
+
+ ip link add br0 type bridge vlan_filtering 1
+ ip link add br1 type bridge vlan_filtering 1
+ ip link set swp0 master br0
+ ip link set swp1 master br1
+ ip link set br0 type bridge vlan_filtering 0
+ ip link set br1 type bridge vlan_filtering 0
+ # traffic in br0 and br1 will start leaking to each other
+
+As port_bridge_{add,del} have set up PCR_MATRIX properly, remove the
+PCR_MATRIX write from mt7530_port_set_vlan_aware.
+
+Fixes: 83163f7dca56 ("net: dsa: mediatek: add VLAN support for MT7530")
+Signed-off-by: DENG Qingfang <dqfext@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/mt7530.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -1214,14 +1214,6 @@ mt7530_port_set_vlan_aware(struct dsa_sw
+ {
+ struct mt7530_priv *priv = ds->priv;
+
+- /* The real fabric path would be decided on the membership in the
+- * entry of VLAN table. PCR_MATRIX set up here with ALL_MEMBERS
+- * means potential VLAN can be consisting of certain subset of all
+- * ports.
+- */
+- mt7530_rmw(priv, MT7530_PCR_P(port),
+- PCR_MATRIX_MASK, PCR_MATRIX(MT7530_ALL_MEMBERS));
+-
+ /* Trapped into security mode allows packet forwarding through VLAN
+ * table lookup. CPU port is set to fallback mode to let untagged
+ * frames pass through.
--- /dev/null
+From cec279a898a3b004411682f212215ccaea1cd0fb Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Mon, 24 May 2021 12:25:24 +0300
+Subject: net: dsa: sja1105: add error handling in sja1105_setup()
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+commit cec279a898a3b004411682f212215ccaea1cd0fb upstream.
+
+If any of sja1105_static_config_load(), sja1105_clocking_setup() or
+sja1105_devlink_setup() fails, we can't just return in the middle of
+sja1105_setup() or memory will leak. Add a cleanup path.
+
+Fixes: 0a7bdbc23d8a ("net: dsa: sja1105: move devlink param code to sja1105_devlink.c")
+Fixes: 8aa9ebccae87 ("net: dsa: Introduce driver for NXP SJA1105 5-port L2 switch")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/sja1105/sja1105_main.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/dsa/sja1105/sja1105_main.c
++++ b/drivers/net/dsa/sja1105/sja1105_main.c
+@@ -2986,13 +2986,13 @@ static int sja1105_setup(struct dsa_swit
+ rc = sja1105_static_config_load(priv, ports);
+ if (rc < 0) {
+ dev_err(ds->dev, "Failed to load static config: %d\n", rc);
+- return rc;
++ goto out_ptp_clock_unregister;
+ }
+ /* Configure the CGU (PHY link modes and speeds) */
+ rc = sja1105_clocking_setup(priv);
+ if (rc < 0) {
+ dev_err(ds->dev, "Failed to configure MII clocking: %d\n", rc);
+- return rc;
++ goto out_static_config_free;
+ }
+ /* On SJA1105, VLAN filtering per se is always enabled in hardware.
+ * The only thing we can do to disable it is lie about what the 802.1Q
+@@ -3013,7 +3013,7 @@ static int sja1105_setup(struct dsa_swit
+
+ rc = sja1105_devlink_setup(ds);
+ if (rc < 0)
+- return rc;
++ goto out_static_config_free;
+
+ /* The DSA/switchdev model brings up switch ports in standalone mode by
+ * default, and that means vlan_filtering is 0 since they're not under
+@@ -3022,6 +3022,17 @@ static int sja1105_setup(struct dsa_swit
+ rtnl_lock();
+ rc = sja1105_setup_8021q_tagging(ds, true);
+ rtnl_unlock();
++ if (rc)
++ goto out_devlink_teardown;
++
++ return 0;
++
++out_devlink_teardown:
++ sja1105_devlink_teardown(ds);
++out_ptp_clock_unregister:
++ sja1105_ptp_clock_unregister(ds);
++out_static_config_free:
++ sja1105_static_config_free(&priv->static_config);
+
+ return rc;
+ }
--- /dev/null
+From dc596e3fe63f88e3d1e509f64e7f761cd4135538 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Mon, 24 May 2021 12:25:23 +0300
+Subject: net: dsa: sja1105: call dsa_unregister_switch when allocating memory fails
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+commit dc596e3fe63f88e3d1e509f64e7f761cd4135538 upstream.
+
+Unlike other drivers which pretty much end their .probe() execution with
+dsa_register_switch(), the sja1105 does some extra stuff. When that
+fails with -ENOMEM, the driver is quick to return that, forgetting to
+call dsa_unregister_switch(). Not critical, but a bug nonetheless.
+
+Fixes: 4d7525085a9b ("net: dsa: sja1105: offload the Credit-Based Shaper qdisc")
+Fixes: a68578c20a96 ("net: dsa: Make deferred_xmit private to sja1105")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/sja1105/sja1105_main.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/dsa/sja1105/sja1105_main.c
++++ b/drivers/net/dsa/sja1105/sja1105_main.c
+@@ -3683,8 +3683,10 @@ static int sja1105_probe(struct spi_devi
+ priv->cbs = devm_kcalloc(dev, priv->info->num_cbs_shapers,
+ sizeof(struct sja1105_cbs_entry),
+ GFP_KERNEL);
+- if (!priv->cbs)
+- return -ENOMEM;
++ if (!priv->cbs) {
++ rc = -ENOMEM;
++ goto out_unregister_switch;
++ }
+ }
+
+ /* Connections between dsa_port and sja1105_port */
+@@ -3709,7 +3711,7 @@ static int sja1105_probe(struct spi_devi
+ dev_err(ds->dev,
+ "failed to create deferred xmit thread: %d\n",
+ rc);
+- goto out;
++ goto out_destroy_workers;
+ }
+ skb_queue_head_init(&sp->xmit_queue);
+ sp->xmit_tpid = ETH_P_SJA1105;
+@@ -3719,7 +3721,8 @@ static int sja1105_probe(struct spi_devi
+ }
+
+ return 0;
+-out:
++
++out_destroy_workers:
+ while (port-- > 0) {
+ struct sja1105_port *sp = &priv->ports[port];
+
+@@ -3728,6 +3731,10 @@ out:
+
+ kthread_destroy_worker(sp->xmit_worker);
+ }
++
++out_unregister_switch:
++ dsa_unregister_switch(ds);
++
+ return rc;
+ }
+
--- /dev/null
+From 6729188d2646709941903052e4b78e1d82c239b9 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Mon, 24 May 2021 12:25:25 +0300
+Subject: net: dsa: sja1105: error out on unsupported PHY mode
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+commit 6729188d2646709941903052e4b78e1d82c239b9 upstream.
+
+The driver continues probing when a port is configured for an
+unsupported PHY interface type, instead it should stop.
+
+Fixes: 8aa9ebccae87 ("net: dsa: Introduce driver for NXP SJA1105 5-port L2 switch")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/sja1105/sja1105_main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/dsa/sja1105/sja1105_main.c
++++ b/drivers/net/dsa/sja1105/sja1105_main.c
+@@ -208,6 +208,7 @@ static int sja1105_init_mii_settings(str
+ default:
+ dev_err(dev, "Unsupported PHY mode %s!\n",
+ phy_modes(ports[i].phy_mode));
++ return -EINVAL;
+ }
+
+ /* Even though the SerDes port is able to drive SGMII autoneg
--- /dev/null
+From ba61cf167cb77e54c1ec5adb7aa49a22ab3c9b28 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Mon, 24 May 2021 12:25:22 +0300
+Subject: net: dsa: sja1105: fix VL lookup command packing for P/Q/R/S
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+commit ba61cf167cb77e54c1ec5adb7aa49a22ab3c9b28 upstream.
+
+At the beginning of the sja1105_dynamic_config.c file there is a diagram
+of the dynamic config interface layout:
+
+ packed_buf
+
+ |
+ V
+ +-----------------------------------------+------------------+
+ | ENTRY BUFFER | COMMAND BUFFER |
+ +-----------------------------------------+------------------+
+
+ <----------------------- packed_size ------------------------>
+
+So in order to pack/unpack the command bits into the buffer,
+sja1105_vl_lookup_cmd_packing must first advance the buffer pointer by
+the length of the entry. This is similar to what the other *cmd_packing
+functions do.
+
+This bug exists because the command packing function for P/Q/R/S was
+copied from the E/T generation, and on E/T, the command was actually
+embedded within the entry buffer itself.
+
+Fixes: 94f94d4acfb2 ("net: dsa: sja1105: add static tables for virtual links")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/sja1105/sja1105_dynamic_config.c | 23 +++++++++++++++++++----
+ 1 file changed, 19 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/dsa/sja1105/sja1105_dynamic_config.c
++++ b/drivers/net/dsa/sja1105/sja1105_dynamic_config.c
+@@ -167,9 +167,10 @@ enum sja1105_hostcmd {
+ SJA1105_HOSTCMD_INVALIDATE = 4,
+ };
+
++/* Command and entry overlap */
+ static void
+-sja1105_vl_lookup_cmd_packing(void *buf, struct sja1105_dyn_cmd *cmd,
+- enum packing_op op)
++sja1105et_vl_lookup_cmd_packing(void *buf, struct sja1105_dyn_cmd *cmd,
++ enum packing_op op)
+ {
+ const int size = SJA1105_SIZE_DYN_CMD;
+
+@@ -179,6 +180,20 @@ sja1105_vl_lookup_cmd_packing(void *buf,
+ sja1105_packing(buf, &cmd->index, 9, 0, size, op);
+ }
+
++/* Command and entry are separate */
++static void
++sja1105pqrs_vl_lookup_cmd_packing(void *buf, struct sja1105_dyn_cmd *cmd,
++ enum packing_op op)
++{
++ u8 *p = buf + SJA1105_SIZE_VL_LOOKUP_ENTRY;
++ const int size = SJA1105_SIZE_DYN_CMD;
++
++ sja1105_packing(p, &cmd->valid, 31, 31, size, op);
++ sja1105_packing(p, &cmd->errors, 30, 30, size, op);
++ sja1105_packing(p, &cmd->rdwrset, 29, 29, size, op);
++ sja1105_packing(p, &cmd->index, 9, 0, size, op);
++}
++
+ static size_t sja1105et_vl_lookup_entry_packing(void *buf, void *entry_ptr,
+ enum packing_op op)
+ {
+@@ -641,7 +656,7 @@ static size_t sja1105pqrs_cbs_entry_pack
+ const struct sja1105_dynamic_table_ops sja1105et_dyn_ops[BLK_IDX_MAX_DYN] = {
+ [BLK_IDX_VL_LOOKUP] = {
+ .entry_packing = sja1105et_vl_lookup_entry_packing,
+- .cmd_packing = sja1105_vl_lookup_cmd_packing,
++ .cmd_packing = sja1105et_vl_lookup_cmd_packing,
+ .access = OP_WRITE,
+ .max_entry_count = SJA1105_MAX_VL_LOOKUP_COUNT,
+ .packed_size = SJA1105ET_SIZE_VL_LOOKUP_DYN_CMD,
+@@ -725,7 +740,7 @@ const struct sja1105_dynamic_table_ops s
+ const struct sja1105_dynamic_table_ops sja1105pqrs_dyn_ops[BLK_IDX_MAX_DYN] = {
+ [BLK_IDX_VL_LOOKUP] = {
+ .entry_packing = sja1105_vl_lookup_entry_packing,
+- .cmd_packing = sja1105_vl_lookup_cmd_packing,
++ .cmd_packing = sja1105pqrs_vl_lookup_cmd_packing,
+ .access = (OP_READ | OP_WRITE),
+ .max_entry_count = SJA1105_MAX_VL_LOOKUP_COUNT,
+ .packed_size = SJA1105PQRS_SIZE_VL_LOOKUP_DYN_CMD,
--- /dev/null
+From b38e659de966a122fe2cb178c1e39c9bea06bc62 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Mon, 24 May 2021 12:25:27 +0300
+Subject: net: dsa: sja1105: update existing VLANs from the bridge VLAN list
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+commit b38e659de966a122fe2cb178c1e39c9bea06bc62 upstream.
+
+When running this sequence of operations:
+
+ip link add br0 type bridge vlan_filtering 1
+ip link set swp4 master br0
+bridge vlan add dev swp4 vid 1
+
+We observe the traffic sent on swp4 is still untagged, even though the
+bridge has overwritten the existing VLAN entry:
+
+port vlan ids
+swp4 1 PVID
+
+br0 1 PVID Egress Untagged
+
+This happens because we didn't consider that the 'bridge vlan add'
+command just overwrites VLANs like it's nothing. We treat the 'vid 1
+pvid untagged' and the 'vid 1' as two separate VLANs, and the first
+still has precedence when calling sja1105_build_vlan_table. Obviously
+there is a disagreement regarding semantics, and we end up doing
+something unexpected from the PoV of the bridge.
+
+Let's actually consider an "existing VLAN" to be one which is on the
+same port, and has the same VLAN ID, as one we already have, and update
+it if it has different flags than we do.
+
+The first blamed commit is the one introducing the bug, the second one
+is the latest on top of which the bugfix still applies.
+
+Fixes: ec5ae61076d0 ("net: dsa: sja1105: save/restore VLANs using a delta commit method")
+Fixes: 5899ee367ab3 ("net: dsa: tag_8021q: add a context structure")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/sja1105/sja1105_main.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/dsa/sja1105/sja1105_main.c
++++ b/drivers/net/dsa/sja1105/sja1105_main.c
+@@ -2817,11 +2817,22 @@ static int sja1105_vlan_add_one(struct d
+ bool pvid = flags & BRIDGE_VLAN_INFO_PVID;
+ struct sja1105_bridge_vlan *v;
+
+- list_for_each_entry(v, vlan_list, list)
+- if (v->port == port && v->vid == vid &&
+- v->untagged == untagged && v->pvid == pvid)
++ list_for_each_entry(v, vlan_list, list) {
++ if (v->port == port && v->vid == vid) {
+ /* Already added */
+- return 0;
++ if (v->untagged == untagged && v->pvid == pvid)
++ /* Nothing changed */
++ return 0;
++
++ /* It's the same VLAN, but some of the flags changed
++ * and the user did not bother to delete it first.
++ * Update it and trigger sja1105_build_vlan_table.
++ */
++ v->untagged = untagged;
++ v->pvid = pvid;
++ return 1;
++ }
++ }
+
+ v = kzalloc(sizeof(*v), GFP_KERNEL);
+ if (!v) {
--- /dev/null
+From ed040abca4c1db72dfd3b8483b6ed6bfb7c2571e Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Mon, 24 May 2021 12:25:26 +0300
+Subject: net: dsa: sja1105: use 4095 as the private VLAN for untagged traffic
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+commit ed040abca4c1db72dfd3b8483b6ed6bfb7c2571e upstream.
+
+One thing became visible when writing the blamed commit, and that was
+that STP and PTP frames injected by net/dsa/tag_sja1105.c using the
+deferred xmit mechanism are always classified to the pvid of the CPU
+port, regardless of whatever VLAN there might be in these packets.
+
+So a decision needed to be taken regarding the mechanism through which
+we should ensure that delivery of STP and PTP traffic is possible when
+we are in a VLAN awareness mode that involves tag_8021q. This is because
+tag_8021q is not concerned with managing the pvid of the CPU port, since
+as far as tag_8021q is concerned, no traffic should be sent as untagged
+from the CPU port. So we end up not actually having a pvid on the CPU
+port if we only listen to tag_8021q, and unless we do something about it.
+
+The decision taken at the time was to keep VLAN 1 in the list of
+priv->dsa_8021q_vlans, and make it a pvid of the CPU port. This ensures
+that STP and PTP frames can always be sent to the outside world.
+
+However there is a problem. If we do the following while we are in
+the best_effort_vlan_filtering=true mode:
+
+ip link add br0 type bridge vlan_filtering 1
+ip link set swp2 master br0
+bridge vlan del dev swp2 vid 1
+
+Then untagged and pvid-tagged frames should be dropped. But we observe
+that they aren't, and this is because of the precaution we took that VID
+1 is always installed on all ports.
+
+So clearly VLAN 1 is not good for this purpose. What about VLAN 0?
+Well, VLAN 0 is managed by the 8021q module, and that module wants to
+ensure that 802.1p tagged frames are always received by a port, and are
+always transmitted as VLAN-tagged (with VLAN ID 0). Whereas we want our
+STP and PTP frames to be untagged if the stack sent them as untagged -
+we don't want the driver to just decide out of the blue that it adds
+VID 0 to some packets.
+
+So what to do?
+
+Well, there is one other VLAN that is reserved, and that is 4095:
+$ ip link add link swp2 name swp2.4095 type vlan id 4095
+Error: 8021q: Invalid VLAN id.
+$ bridge vlan add dev swp2 vid 4095
+Error: bridge: Vlan id is invalid.
+
+After we made this change, VLAN 1 is indeed forwarded and/or dropped
+according to the bridge VLAN table, there are no further alterations
+done by the sja1105 driver.
+
+Fixes: ec5ae61076d0 ("net: dsa: sja1105: save/restore VLANs using a delta commit method")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/sja1105/sja1105_main.c | 22 ++++++++++------------
+ 1 file changed, 10 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/dsa/sja1105/sja1105_main.c
++++ b/drivers/net/dsa/sja1105/sja1105_main.c
+@@ -26,6 +26,7 @@
+ #include "sja1105_tas.h"
+
+ #define SJA1105_UNKNOWN_MULTICAST 0x010000000000ull
++#define SJA1105_DEFAULT_VLAN (VLAN_N_VID - 1)
+
+ static const struct dsa_switch_ops sja1105_switch_ops;
+
+@@ -321,6 +322,13 @@ static int sja1105_init_l2_lookup_params
+ return 0;
+ }
+
++/* Set up a default VLAN for untagged traffic injected from the CPU
++ * using management routes (e.g. STP, PTP) as opposed to tag_8021q.
++ * All DT-defined ports are members of this VLAN, and there are no
++ * restrictions on forwarding (since the CPU selects the destination).
++ * Frames from this VLAN will always be transmitted as untagged, and
++ * neither the bridge nor the 8021q module cannot create this VLAN ID.
++ */
+ static int sja1105_init_static_vlan(struct sja1105_private *priv)
+ {
+ struct sja1105_table *table;
+@@ -330,17 +338,13 @@ static int sja1105_init_static_vlan(stru
+ .vmemb_port = 0,
+ .vlan_bc = 0,
+ .tag_port = 0,
+- .vlanid = 1,
++ .vlanid = SJA1105_DEFAULT_VLAN,
+ };
+ struct dsa_switch *ds = priv->ds;
+ int port;
+
+ table = &priv->static_config.tables[BLK_IDX_VLAN_LOOKUP];
+
+- /* The static VLAN table will only contain the initial pvid of 1.
+- * All other VLANs are to be configured through dynamic entries,
+- * and kept in the static configuration table as backing memory.
+- */
+ if (table->entry_count) {
+ kfree(table->entries);
+ table->entry_count = 0;
+@@ -353,9 +357,6 @@ static int sja1105_init_static_vlan(stru
+
+ table->entry_count = 1;
+
+- /* VLAN 1: all DT-defined ports are members; no restrictions on
+- * forwarding; always transmit as untagged.
+- */
+ for (port = 0; port < ds->num_ports; port++) {
+ struct sja1105_bridge_vlan *v;
+
+@@ -366,15 +367,12 @@ static int sja1105_init_static_vlan(stru
+ pvid.vlan_bc |= BIT(port);
+ pvid.tag_port &= ~BIT(port);
+
+- /* Let traffic that don't need dsa_8021q (e.g. STP, PTP) be
+- * transmitted as untagged.
+- */
+ v = kzalloc(sizeof(*v), GFP_KERNEL);
+ if (!v)
+ return -ENOMEM;
+
+ v->port = port;
+- v->vid = 1;
++ v->vid = SJA1105_DEFAULT_VLAN;
+ v->untagged = true;
+ if (dsa_is_cpu_port(ds, port))
+ v->pvid = true;
--- /dev/null
+From c07531c01d8284aedaf95708ea90e76d11af0e21 Mon Sep 17 00:00:00 2001
+From: Roi Dayan <roid@nvidia.com>
+Date: Mon, 10 May 2021 14:50:24 +0300
+Subject: netfilter: flowtable: Remove redundant hw refresh bit
+
+From: Roi Dayan <roid@nvidia.com>
+
+commit c07531c01d8284aedaf95708ea90e76d11af0e21 upstream.
+
+Offloading conns could fail for multiple reasons and a hw refresh bit is
+set to try to reoffload it in next sw packet.
+But it could be in some cases and future points that the hw refresh bit
+is not set but a refresh could succeed.
+Remove the hw refresh bit and do offload refresh if requested.
+There won't be a new work entry if a work is already pending
+anyway as there is the hw pending bit.
+
+Fixes: 8b3646d6e0c4 ("net/sched: act_ct: Support refreshing the flow table entries")
+Signed-off-by: Roi Dayan <roid@nvidia.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/netfilter/nf_flow_table.h | 1 -
+ net/netfilter/nf_flow_table_core.c | 3 +--
+ net/netfilter/nf_flow_table_offload.c | 7 ++++---
+ 3 files changed, 5 insertions(+), 6 deletions(-)
+
+--- a/include/net/netfilter/nf_flow_table.h
++++ b/include/net/netfilter/nf_flow_table.h
+@@ -130,7 +130,6 @@ enum nf_flow_flags {
+ NF_FLOW_HW,
+ NF_FLOW_HW_DYING,
+ NF_FLOW_HW_DEAD,
+- NF_FLOW_HW_REFRESH,
+ NF_FLOW_HW_PENDING,
+ };
+
+--- a/net/netfilter/nf_flow_table_core.c
++++ b/net/netfilter/nf_flow_table_core.c
+@@ -259,8 +259,7 @@ void flow_offload_refresh(struct nf_flow
+ {
+ flow->timeout = nf_flowtable_time_stamp + NF_FLOW_TIMEOUT;
+
+- if (likely(!nf_flowtable_hw_offload(flow_table) ||
+- !test_and_clear_bit(NF_FLOW_HW_REFRESH, &flow->flags)))
++ if (likely(!nf_flowtable_hw_offload(flow_table)))
+ return;
+
+ nf_flow_offload_add(flow_table, flow);
+--- a/net/netfilter/nf_flow_table_offload.c
++++ b/net/netfilter/nf_flow_table_offload.c
+@@ -753,10 +753,11 @@ static void flow_offload_work_add(struct
+
+ err = flow_offload_rule_add(offload, flow_rule);
+ if (err < 0)
+- set_bit(NF_FLOW_HW_REFRESH, &offload->flow->flags);
+- else
+- set_bit(IPS_HW_OFFLOAD_BIT, &offload->flow->ct->status);
++ goto out;
+
++ set_bit(IPS_HW_OFFLOAD_BIT, &offload->flow->ct->status);
++
++out:
+ nf_flow_offload_destroy(flow_rule);
+ }
+
--- /dev/null
+From 25df1acd2d36eb72b14c3d00f6b861b1e00b3aab Mon Sep 17 00:00:00 2001
+From: Hou Pu <houpu.main@gmail.com>
+Date: Thu, 20 May 2021 19:30:45 +0800
+Subject: nvmet-tcp: fix inline data size comparison in nvmet_tcp_queue_response
+
+From: Hou Pu <houpu.main@gmail.com>
+
+commit 25df1acd2d36eb72b14c3d00f6b861b1e00b3aab upstream.
+
+Using "<=" instead "<" to compare inline data size.
+
+Fixes: bdaf13279192 ("nvmet-tcp: fix a segmentation fault during io parsing error")
+Signed-off-by: Hou Pu <houpu.main@gmail.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/target/tcp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvme/target/tcp.c
++++ b/drivers/nvme/target/tcp.c
+@@ -538,7 +538,7 @@ static void nvmet_tcp_queue_response(str
+ * nvmet_req_init is completed.
+ */
+ if (queue->rcv_state == NVMET_TCP_RECV_PDU &&
+- len && len < cmd->req.port->inline_data_size &&
++ len && len <= cmd->req.port->inline_data_size &&
+ nvme_is_write(cmd->req.cmd))
+ return;
+ }
--- /dev/null
+From c59870e2110e1229a6e4b2457aece6ffe8d68d99 Mon Sep 17 00:00:00 2001
+From: Ian Rogers <irogers@google.com>
+Date: Wed, 19 May 2021 09:44:47 -0700
+Subject: perf debug: Move debug initialization earlier
+
+From: Ian Rogers <irogers@google.com>
+
+commit c59870e2110e1229a6e4b2457aece6ffe8d68d99 upstream.
+
+This avoids segfaults during option handlers that use pr_err. For
+example, "perf --debug nopager list" segfaults before this change.
+
+Fixes: 8abceacff87d (perf debug: Add debug_set_file function)
+Signed-off-by: Ian Rogers <irogers@google.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Link: http://lore.kernel.org/lkml/20210519164447.2672030-1-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/perf.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/tools/perf/perf.c
++++ b/tools/perf/perf.c
+@@ -443,6 +443,8 @@ int main(int argc, const char **argv)
+ const char *cmd;
+ char sbuf[STRERR_BUFSIZE];
+
++ perf_debug_setup();
++
+ /* libsubcmd init */
+ exec_cmd_init("perf", PREFIX, PERF_EXEC_PATH, EXEC_PATH_ENVIRONMENT);
+ pager_init(PERF_PAGER_ENVIRONMENT);
+@@ -531,8 +533,6 @@ int main(int argc, const char **argv)
+ */
+ pthread__block_sigwinch();
+
+- perf_debug_setup();
+-
+ while (1) {
+ static int done_help;
+
--- /dev/null
+From 75ea44e356b5de8c817f821c9dd68ae329e82add Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Tue, 25 May 2021 18:07:58 +0200
+Subject: perf jevents: Fix getting maximum number of fds
+
+From: Felix Fietkau <nbd@nbd.name>
+
+commit 75ea44e356b5de8c817f821c9dd68ae329e82add upstream.
+
+On some hosts, rlim.rlim_max can be returned as RLIM_INFINITY.
+By casting it to int, it is interpreted as -1, which will cause get_maxfds
+to return 0, causing "Invalid argument" errors in nftw() calls.
+Fix this by casting the second argument of min() to rlim_t instead.
+
+Fixes: 80eeb67fe577 ("perf jevents: Program to convert JSON file")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
+Link: http://lore.kernel.org/lkml/20210525160758.97829-1-nbd@nbd.name
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/pmu-events/jevents.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/perf/pmu-events/jevents.c
++++ b/tools/perf/pmu-events/jevents.c
+@@ -958,7 +958,7 @@ static int get_maxfds(void)
+ struct rlimit rlim;
+
+ if (getrlimit(RLIMIT_NOFILE, &rlim) == 0)
+- return min((int)rlim.rlim_max / 2, 512);
++ return min(rlim.rlim_max / 2, (rlim_t)512);
+
+ return 512;
+ }
--- /dev/null
+From 297739bd73f6e49d80bac4bfd27f3598b798c0d4 Mon Sep 17 00:00:00 2001
+From: Xin Long <lucien.xin@gmail.com>
+Date: Mon, 24 May 2021 22:49:24 -0400
+Subject: sctp: add the missing setting for asoc encap_port
+
+From: Xin Long <lucien.xin@gmail.com>
+
+commit 297739bd73f6e49d80bac4bfd27f3598b798c0d4 upstream.
+
+This patch is to add the missing setting back for asoc encap_port.
+
+Fixes: 8dba29603b5c ("sctp: add SCTP_REMOTE_UDP_ENCAPS_PORT sockopt")
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sctp/socket.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -4473,6 +4473,7 @@ static int sctp_setsockopt_encap_port(st
+ transports)
+ t->encap_port = encap_port;
+
++ asoc->encap_port = encap_port;
+ return 0;
+ }
+
--- /dev/null
+From b2540cdce6e22ecf3de54daf5129cc37951348cc Mon Sep 17 00:00:00 2001
+From: Xin Long <lucien.xin@gmail.com>
+Date: Mon, 24 May 2021 22:49:42 -0400
+Subject: sctp: fix the proc_handler for sysctl encap_port
+
+From: Xin Long <lucien.xin@gmail.com>
+
+commit b2540cdce6e22ecf3de54daf5129cc37951348cc upstream.
+
+proc_dointvec() cannot do min and max check for setting a value
+when extra1/extra2 is set, so change it to proc_dointvec_minmax()
+for sysctl encap_port.
+
+Fixes: e8a3001c2120 ("sctp: add encap_port for netns sock asoc and transport")
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sctp/sysctl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sctp/sysctl.c
++++ b/net/sctp/sysctl.c
+@@ -307,7 +307,7 @@ static struct ctl_table sctp_net_table[]
+ .data = &init_net.sctp.encap_port,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+- .proc_handler = proc_dointvec,
++ .proc_handler = proc_dointvec_minmax,
+ .extra1 = SYSCTL_ZERO,
+ .extra2 = &udp_port_max,
+ },
tipc-wait-and-exit-until-all-work-queues-are-done.patch
tipc-skb_linearize-the-head-skb-when-reassembling-msgs.patch
spi-spi-fsl-dspi-fix-a-resource-leak-in-an-error-handling-path.patch
+sctp-fix-the-proc_handler-for-sysctl-encap_port.patch
+sctp-add-the-missing-setting-for-asoc-encap_port.patch
+netfilter-flowtable-remove-redundant-hw-refresh-bit.patch
+net-dsa-mt7530-fix-vlan-traffic-leaks.patch
+net-dsa-bcm_sf2-fix-bcm_sf2_reg_rgmii_cntrl-call-for-non-rgmii-port.patch
+net-dsa-fix-a-crash-if-get_sset_count-fails.patch
+net-dsa-sja1105-update-existing-vlans-from-the-bridge-vlan-list.patch
+net-dsa-sja1105-use-4095-as-the-private-vlan-for-untagged-traffic.patch
+net-dsa-sja1105-error-out-on-unsupported-phy-mode.patch
+net-dsa-sja1105-add-error-handling-in-sja1105_setup.patch
+net-dsa-sja1105-call-dsa_unregister_switch-when-allocating-memory-fails.patch
+net-dsa-sja1105-fix-vl-lookup-command-packing-for-p-q-r-s.patch
+i2c-s3c2410-fix-possible-null-pointer-deref-on-read-message-after-write.patch
+i2c-mediatek-disable-i2c-start_en-and-clear-intr_stat-brfore-reset.patch
+i2c-i801-don-t-generate-an-interrupt-on-bus-reset.patch
+i2c-sh_mobile-use-new-clock-calculation-formulas-for-rz-g2e.patch
+afs-fix-the-nlink-handling-of-dir-over-dir-rename.patch
+perf-debug-move-debug-initialization-earlier.patch
+perf-jevents-fix-getting-maximum-number-of-fds.patch
+nvmet-tcp-fix-inline-data-size-comparison-in-nvmet_tcp_queue_response.patch
+mptcp-avoid-error-message-on-infinite-mapping.patch
+mptcp-fix-data-stream-corruption.patch
+mptcp-drop-unconditional-pr_warn-on-bad-opt.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
