]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
5.5-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 3 Mar 2020 10:00:19 +0000 (11:00 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 3 Mar 2020 10:00:19 +0000 (11:00 +0100)
added patches:
net-atlantic-better-loopback-mode-handling.patch
net-atlantic-checksum-compat-issue.patch
net-atlantic-fix-out-of-range-usage-of-active_vlans-array.patch
net-atlantic-fix-potential-error-handling.patch
net-atlantic-fix-use-after-free-kasan-warn.patch
net-atlantic-possible-fault-in-transition-to-hibernation.patch
net-netlink-cap-max-groups-which-will-be-considered-in-netlink_bind.patch
nvme-pci-hold-cq_poll_lock-while-completing-cqes.patch
s390-qeth-fix-off-by-one-in-rx-copybreak-check.patch
s390-qeth-vnicc-fix-eopnotsupp-precedence.patch

12 files changed:
queue-5.5/net-atlantic-better-loopback-mode-handling.patch [new file with mode: 0644]
queue-5.5/net-atlantic-checksum-compat-issue.patch [new file with mode: 0644]
queue-5.5/net-atlantic-fix-out-of-range-usage-of-active_vlans-array.patch [new file with mode: 0644]
queue-5.5/net-atlantic-fix-potential-error-handling.patch [new file with mode: 0644]
queue-5.5/net-atlantic-fix-use-after-free-kasan-warn.patch [new file with mode: 0644]
queue-5.5/net-atlantic-possible-fault-in-transition-to-hibernation.patch [new file with mode: 0644]
queue-5.5/net-netlink-cap-max-groups-which-will-be-considered-in-netlink_bind.patch [new file with mode: 0644]
queue-5.5/net-phy-restore-mdio-regs-in-the-iproc-mdio-driver.patch
queue-5.5/nvme-pci-hold-cq_poll_lock-while-completing-cqes.patch [new file with mode: 0644]
queue-5.5/s390-qeth-fix-off-by-one-in-rx-copybreak-check.patch [new file with mode: 0644]
queue-5.5/s390-qeth-vnicc-fix-eopnotsupp-precedence.patch [new file with mode: 0644]
queue-5.5/series

diff --git a/queue-5.5/net-atlantic-better-loopback-mode-handling.patch b/queue-5.5/net-atlantic-better-loopback-mode-handling.patch
new file mode 100644 (file)
index 0000000..32b6d2d
--- /dev/null
@@ -0,0 +1,63 @@
+From b42726fcf76e9367e524392e0ead7e672cc0791c Mon Sep 17 00:00:00 2001
+From: Nikita Danilov <ndanilov@marvell.com>
+Date: Fri, 14 Feb 2020 18:44:54 +0300
+Subject: net: atlantic: better loopback mode handling
+
+From: Nikita Danilov <ndanilov@marvell.com>
+
+commit b42726fcf76e9367e524392e0ead7e672cc0791c upstream.
+
+Add checks to not enable multiple loopback modes simultaneously,
+It was also discovered that for dma loopback to function correctly
+promisc mode should be enabled on device.
+
+Fixes: ea4b4d7fc106 ("net: atlantic: loopback tests via private flags")
+Signed-off-by: Nikita Danilov <ndanilov@marvell.com>
+Signed-off-by: Igor Russkikh <irusskikh@marvell.com>
+Signed-off-by: Dmitry Bogdanov <dbogdanov@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c       |    5 +++++
+ drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c |   13 ++++++++-----
+ 2 files changed, 13 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c
+@@ -722,6 +722,11 @@ static int aq_ethtool_set_priv_flags(str
+       if (flags & ~AQ_PRIV_FLAGS_MASK)
+               return -EOPNOTSUPP;
++      if (hweight32((flags | priv_flags) & AQ_HW_LOOPBACK_MASK) > 1) {
++              netdev_info(ndev, "Can't enable more than one loopback simultaneously\n");
++              return -EINVAL;
++      }
++
+       cfg->priv_flags = flags;
+       if ((priv_flags ^ flags) & BIT(AQ_HW_LOOPBACK_DMA_NET)) {
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+@@ -885,13 +885,16 @@ static int hw_atl_b0_hw_packet_filter_se
+ {
+       struct aq_nic_cfg_s *cfg = self->aq_nic_cfg;
+       unsigned int i = 0U;
++      u32 vlan_promisc;
++      u32 l2_promisc;
+-      hw_atl_rpfl2promiscuous_mode_en_set(self,
+-                                          IS_FILTER_ENABLED(IFF_PROMISC));
++      l2_promisc = IS_FILTER_ENABLED(IFF_PROMISC) ||
++                   !!(cfg->priv_flags & BIT(AQ_HW_LOOPBACK_DMA_NET));
++      vlan_promisc = l2_promisc || cfg->is_vlan_force_promisc;
+-      hw_atl_rpf_vlan_prom_mode_en_set(self,
+-                                   IS_FILTER_ENABLED(IFF_PROMISC) ||
+-                                   cfg->is_vlan_force_promisc);
++      hw_atl_rpfl2promiscuous_mode_en_set(self, l2_promisc);
++
++      hw_atl_rpf_vlan_prom_mode_en_set(self, vlan_promisc);
+       hw_atl_rpfl2multicast_flr_en_set(self,
+                                        IS_FILTER_ENABLED(IFF_ALLMULTI) &&
diff --git a/queue-5.5/net-atlantic-checksum-compat-issue.patch b/queue-5.5/net-atlantic-checksum-compat-issue.patch
new file mode 100644 (file)
index 0000000..4a6e774
--- /dev/null
@@ -0,0 +1,92 @@
+From 15beab0a9d797be1b7c67458da007a62269be29a Mon Sep 17 00:00:00 2001
+From: Dmitry Bezrukov <dbezrukov@marvell.com>
+Date: Fri, 14 Feb 2020 18:44:51 +0300
+Subject: net: atlantic: checksum compat issue
+
+From: Dmitry Bezrukov <dbezrukov@marvell.com>
+
+commit 15beab0a9d797be1b7c67458da007a62269be29a upstream.
+
+Yet another checksum offload compatibility issue was found.
+
+The known issue is that AQC HW marks tcp packets with 0xFFFF checksum
+as invalid (1). This is workarounded in driver, passing all the suspicious
+packets up to the stack for further csum validation.
+
+Another HW problem (2) is that it hides invalid csum of LRO aggregated
+packets inside of the individual descriptors. That was workarounded
+by forced scan of all LRO descriptors for checksum errors.
+
+However the scan logic was joint for both LRO and multi-descriptor
+packets (jumbos). And this causes the issue.
+
+We have to drop LRO packets with the detected bad checksum
+because of (2), but we have to pass jumbo packets to stack because of (1).
+
+When using windows tcp partner with jumbo frames but with LSO disabled
+driver discards such frames as bad checksummed. But only LRO frames
+should be dropped, not jumbos.
+
+On such a configurations tcp stream have a chance of drops and stucks.
+
+(1) 76f254d4afe2 ("net: aquantia: tcp checksum 0xffff being handled incorrectly")
+(2) d08b9a0a3ebd ("net: aquantia: do not pass lro session with invalid tcp checksum")
+
+Fixes: d08b9a0a3ebd ("net: aquantia: do not pass lro session with invalid tcp checksum")
+Signed-off-by: Dmitry Bezrukov <dbezrukov@marvell.com>
+Signed-off-by: Igor Russkikh <irusskikh@marvell.com>
+Signed-off-by: Dmitry Bogdanov <dbogdanov@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/aquantia/atlantic/aq_ring.c          |    3 ++-
+ drivers/net/ethernet/aquantia/atlantic/aq_ring.h          |    3 ++-
+ drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c |    5 +++--
+ 3 files changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+@@ -351,7 +351,8 @@ int aq_ring_rx_clean(struct aq_ring_s *s
+                               err = 0;
+                               goto err_exit;
+                       }
+-                      if (buff->is_error || buff->is_cso_err) {
++                      if (buff->is_error ||
++                          (buff->is_lro && buff->is_cso_err)) {
+                               buff_ = buff;
+                               do {
+                                       next_ = buff_->next,
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
+@@ -78,7 +78,8 @@ struct __packed aq_ring_buff_s {
+                       u32 is_cleaned:1;
+                       u32 is_error:1;
+                       u32 is_vlan:1;
+-                      u32 rsvd3:4;
++                      u32 is_lro:1;
++                      u32 rsvd3:3;
+                       u16 eop_index;
+                       u16 rsvd4;
+               };
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+@@ -823,6 +823,8 @@ static int hw_atl_b0_hw_ring_rx_receive(
+                       }
+               }
++              buff->is_lro = !!(HW_ATL_B0_RXD_WB_STAT2_RSCCNT &
++                                rxd_wb->status);
+               if (HW_ATL_B0_RXD_WB_STAT2_EOP & rxd_wb->status) {
+                       buff->len = rxd_wb->pkt_len %
+                               AQ_CFG_RX_FRAME_MAX;
+@@ -835,8 +837,7 @@ static int hw_atl_b0_hw_ring_rx_receive(
+                               rxd_wb->pkt_len > AQ_CFG_RX_FRAME_MAX ?
+                               AQ_CFG_RX_FRAME_MAX : rxd_wb->pkt_len;
+-                      if (HW_ATL_B0_RXD_WB_STAT2_RSCCNT &
+-                              rxd_wb->status) {
++                      if (buff->is_lro) {
+                               /* LRO */
+                               buff->next = rxd_wb->next_desc_ptr;
+                               ++ring->stats.rx.lro_packets;
diff --git a/queue-5.5/net-atlantic-fix-out-of-range-usage-of-active_vlans-array.patch b/queue-5.5/net-atlantic-fix-out-of-range-usage-of-active_vlans-array.patch
new file mode 100644 (file)
index 0000000..31eddbc
--- /dev/null
@@ -0,0 +1,34 @@
+From 5a292c89a84d49b598f8978f154bdda48b1072c0 Mon Sep 17 00:00:00 2001
+From: Dmitry Bogdanov <dbogdanov@marvell.com>
+Date: Fri, 14 Feb 2020 18:44:58 +0300
+Subject: net: atlantic: fix out of range usage of active_vlans array
+
+From: Dmitry Bogdanov <dbogdanov@marvell.com>
+
+commit 5a292c89a84d49b598f8978f154bdda48b1072c0 upstream.
+
+fix static checker warning:
+ drivers/net/ethernet/aquantia/atlantic/aq_filters.c:166 aq_check_approve_fvlan()
+ error: passing untrusted data to 'test_bit()'
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Fixes: 7975d2aff5af: ("net: aquantia: add support of rx-vlan-filter offload")
+Signed-off-by: Dmitry Bogdanov <dbogdanov@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/aquantia/atlantic/aq_filters.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_filters.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_filters.c
+@@ -163,7 +163,7 @@ aq_check_approve_fvlan(struct aq_nic_s *
+       }
+       if ((aq_nic->ndev->features & NETIF_F_HW_VLAN_CTAG_FILTER) &&
+-          (!test_bit(be16_to_cpu(fsp->h_ext.vlan_tci),
++          (!test_bit(be16_to_cpu(fsp->h_ext.vlan_tci) & VLAN_VID_MASK,
+                      aq_nic->active_vlans))) {
+               netdev_err(aq_nic->ndev,
+                          "ethtool: unknown vlan-id specified");
diff --git a/queue-5.5/net-atlantic-fix-potential-error-handling.patch b/queue-5.5/net-atlantic-fix-potential-error-handling.patch
new file mode 100644 (file)
index 0000000..c282359
--- /dev/null
@@ -0,0 +1,40 @@
+From 380ec5b9af7f0d57dbf6ac067fd9f33cff2fef71 Mon Sep 17 00:00:00 2001
+From: Pavel Belous <pbelous@marvell.com>
+Date: Fri, 14 Feb 2020 18:44:56 +0300
+Subject: net: atlantic: fix potential error handling
+
+From: Pavel Belous <pbelous@marvell.com>
+
+commit 380ec5b9af7f0d57dbf6ac067fd9f33cff2fef71 upstream.
+
+Code inspection found that in case of mapping error we do return current
+'ret' value. But beside error, it is used to count number of descriptors
+allocated for the packet. In that case map_skb function could return '1'.
+
+Changing it to return zero (number of mapped descriptors for skb)
+
+Fixes: 018423e90bee ("net: ethernet: aquantia: Add ring support code")
+Signed-off-by: Pavel Belous <pbelous@marvell.com>
+Signed-off-by: Igor Russkikh <irusskikh@marvell.com>
+Signed-off-by: Dmitry Bogdanov <dbogdanov@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/aquantia/atlantic/aq_nic.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+@@ -533,8 +533,10 @@ unsigned int aq_nic_map_skb(struct aq_ni
+                                    dx_buff->len,
+                                    DMA_TO_DEVICE);
+-      if (unlikely(dma_mapping_error(aq_nic_get_dev(self), dx_buff->pa)))
++      if (unlikely(dma_mapping_error(aq_nic_get_dev(self), dx_buff->pa))) {
++              ret = 0;
+               goto exit;
++      }
+       first = dx_buff;
+       dx_buff->len_pkt = skb->len;
diff --git a/queue-5.5/net-atlantic-fix-use-after-free-kasan-warn.patch b/queue-5.5/net-atlantic-fix-use-after-free-kasan-warn.patch
new file mode 100644 (file)
index 0000000..49c5d8e
--- /dev/null
@@ -0,0 +1,62 @@
+From a4980919ad6a7be548d499bc5338015e1a9191c6 Mon Sep 17 00:00:00 2001
+From: Pavel Belous <pbelous@marvell.com>
+Date: Fri, 14 Feb 2020 18:44:55 +0300
+Subject: net: atlantic: fix use after free kasan warn
+
+From: Pavel Belous <pbelous@marvell.com>
+
+commit a4980919ad6a7be548d499bc5338015e1a9191c6 upstream.
+
+skb->len is used to calculate statistics after xmit invocation.
+
+Under a stress load it may happen that skb will be xmited,
+rx interrupt will come and skb will be freed, all before xmit function
+is even returned.
+
+Eventually, skb->len will access unallocated area.
+
+Moving stats calculation into tx_clean routine.
+
+Fixes: 018423e90bee ("net: ethernet: aquantia: Add ring support code")
+Reported-by: Christophe Vu-Brugier <cvubrugier@fastmail.fm>
+Signed-off-by: Igor Russkikh <irusskikh@marvell.com>
+Signed-off-by: Pavel Belous <pbelous@marvell.com>
+Signed-off-by: Dmitry Bogdanov <dbogdanov@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/aquantia/atlantic/aq_nic.c  |    4 ----
+ drivers/net/ethernet/aquantia/atlantic/aq_ring.c |    7 +++++--
+ 2 files changed, 5 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+@@ -655,10 +655,6 @@ int aq_nic_xmit(struct aq_nic_s *self, s
+       if (likely(frags)) {
+               err = self->aq_hw_ops->hw_ring_tx_xmit(self->aq_hw,
+                                                      ring, frags);
+-              if (err >= 0) {
+-                      ++ring->stats.tx.packets;
+-                      ring->stats.tx.bytes += skb->len;
+-              }
+       } else {
+               err = NETDEV_TX_BUSY;
+       }
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+@@ -272,9 +272,12 @@ bool aq_ring_tx_clean(struct aq_ring_s *
+                       }
+               }
+-              if (unlikely(buff->is_eop))
+-                      dev_kfree_skb_any(buff->skb);
++              if (unlikely(buff->is_eop)) {
++                      ++self->stats.rx.packets;
++                      self->stats.tx.bytes += buff->skb->len;
++                      dev_kfree_skb_any(buff->skb);
++              }
+               buff->pa = 0U;
+               buff->eop_index = 0xffffU;
+               self->sw_head = aq_ring_next_dx(self, self->sw_head);
diff --git a/queue-5.5/net-atlantic-possible-fault-in-transition-to-hibernation.patch b/queue-5.5/net-atlantic-possible-fault-in-transition-to-hibernation.patch
new file mode 100644 (file)
index 0000000..8656393
--- /dev/null
@@ -0,0 +1,70 @@
+From 52a22f4d6ff95e8bdca557765c04893eb5dd83fd Mon Sep 17 00:00:00 2001
+From: Pavel Belous <pbelous@marvell.com>
+Date: Fri, 14 Feb 2020 18:44:57 +0300
+Subject: net: atlantic: possible fault in transition to hibernation
+
+From: Pavel Belous <pbelous@marvell.com>
+
+commit 52a22f4d6ff95e8bdca557765c04893eb5dd83fd upstream.
+
+during hibernation freeze, aq_nic_stop could be invoked
+on a stopped device. That may cause panic on access to
+not yet allocated vector/ring structures.
+
+Add a check to stop device if it is not yet stopped.
+
+Similiarly after freeze in hibernation thaw, aq_nic_start
+could be invoked on a not initialized net device.
+Result will be the same.
+
+Add a check to start device if it is initialized.
+In our case, this is the same as started.
+
+Fixes: 8aaa112a57c1 ("net: atlantic: refactoring pm logic")
+Signed-off-by: Pavel Belous <pbelous@marvell.com>
+Signed-off-by: Nikita Danilov <ndanilov@marvell.com>
+Signed-off-by: Igor Russkikh <irusskikh@marvell.com>
+Signed-off-by: Dmitry Bogdanov <dbogdanov@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c |   13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
+@@ -359,7 +359,8 @@ static int aq_suspend_common(struct devi
+       netif_device_detach(nic->ndev);
+       netif_tx_stop_all_queues(nic->ndev);
+-      aq_nic_stop(nic);
++      if (netif_running(nic->ndev))
++              aq_nic_stop(nic);
+       if (deep) {
+               aq_nic_deinit(nic, !nic->aq_hw->aq_nic_cfg->wol);
+@@ -375,7 +376,7 @@ static int atl_resume_common(struct devi
+ {
+       struct pci_dev *pdev = to_pci_dev(dev);
+       struct aq_nic_s *nic;
+-      int ret;
++      int ret = 0;
+       nic = pci_get_drvdata(pdev);
+@@ -390,9 +391,11 @@ static int atl_resume_common(struct devi
+                       goto err_exit;
+       }
+-      ret = aq_nic_start(nic);
+-      if (ret)
+-              goto err_exit;
++      if (netif_running(nic->ndev)) {
++              ret = aq_nic_start(nic);
++              if (ret)
++                      goto err_exit;
++      }
+       netif_device_attach(nic->ndev);
+       netif_tx_start_all_queues(nic->ndev);
diff --git a/queue-5.5/net-netlink-cap-max-groups-which-will-be-considered-in-netlink_bind.patch b/queue-5.5/net-netlink-cap-max-groups-which-will-be-considered-in-netlink_bind.patch
new file mode 100644 (file)
index 0000000..a56ae4c
--- /dev/null
@@ -0,0 +1,53 @@
+From 3a20773beeeeadec41477a5ba872175b778ff752 Mon Sep 17 00:00:00 2001
+From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
+Date: Thu, 20 Feb 2020 16:42:13 +0200
+Subject: net: netlink: cap max groups which will be considered in netlink_bind()
+
+From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
+
+commit 3a20773beeeeadec41477a5ba872175b778ff752 upstream.
+
+Since nl_groups is a u32 we can't bind more groups via ->bind
+(netlink_bind) call, but netlink has supported more groups via
+setsockopt() for a long time and thus nlk->ngroups could be over 32.
+Recently I added support for per-vlan notifications and increased the
+groups to 33 for NETLINK_ROUTE which exposed an old bug in the
+netlink_bind() code causing out-of-bounds access on archs where unsigned
+long is 32 bits via test_bit() on a local variable. Fix this by capping the
+maximum groups in netlink_bind() to BITS_PER_TYPE(u32), effectively
+capping them at 32 which is the minimum of allocated groups and the
+maximum groups which can be bound via netlink_bind().
+
+CC: Christophe Leroy <christophe.leroy@c-s.fr>
+CC: Richard Guy Briggs <rgb@redhat.com>
+Fixes: 4f520900522f ("netlink: have netlink per-protocol bind function return an error code.")
+Reported-by: Erhard F. <erhard_f@mailbox.org>
+Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/netlink/af_netlink.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -1014,7 +1014,8 @@ static int netlink_bind(struct socket *s
+       if (nlk->netlink_bind && groups) {
+               int group;
+-              for (group = 0; group < nlk->ngroups; group++) {
++              /* nl_groups is a u32, so cap the maximum groups we can bind */
++              for (group = 0; group < BITS_PER_TYPE(u32); group++) {
+                       if (!test_bit(group, &groups))
+                               continue;
+                       err = nlk->netlink_bind(net, group + 1);
+@@ -1033,7 +1034,7 @@ static int netlink_bind(struct socket *s
+                       netlink_insert(sk, nladdr->nl_pid) :
+                       netlink_autobind(sock);
+               if (err) {
+-                      netlink_undo_bind(nlk->ngroups, groups, sk);
++                      netlink_undo_bind(BITS_PER_TYPE(u32), groups, sk);
+                       goto unlock;
+               }
+       }
index f3af696590e4784e319613ffaa21c1dafff15f73..5348029f9ff13697fa4815d643f519e10369e8b0 100644 (file)
@@ -5,6 +5,8 @@ Subject: net: phy: restore mdio regs in the iproc mdio driver
 
 From: Arun Parameswaran <arun.parameswaran@broadcom.com>
 
+commit 6f08e98d62799e53c89dbf2c9a49d77e20ca648c upstream.
+
 The mii management register in iproc mdio block
 does not have a retention register so it is lost on suspend.
 Save and restore value of register while resuming from suspend.
diff --git a/queue-5.5/nvme-pci-hold-cq_poll_lock-while-completing-cqes.patch b/queue-5.5/nvme-pci-hold-cq_poll_lock-while-completing-cqes.patch
new file mode 100644 (file)
index 0000000..cfe3fb5
--- /dev/null
@@ -0,0 +1,38 @@
+From 9515743bfb39c61aaf3d4f3219a645c8d1fe9a0e Mon Sep 17 00:00:00 2001
+From: Bijan Mottahedeh <bijan.mottahedeh@oracle.com>
+Date: Wed, 26 Feb 2020 18:53:43 -0800
+Subject: nvme-pci: Hold cq_poll_lock while completing CQEs
+
+From: Bijan Mottahedeh <bijan.mottahedeh@oracle.com>
+
+commit 9515743bfb39c61aaf3d4f3219a645c8d1fe9a0e upstream.
+
+Completions need to consumed in the same order the controller submitted
+them, otherwise future completion entries may overwrite ones we haven't
+handled yet. Hold the nvme queue's poll lock while completing new CQEs to
+prevent another thread from freeing command tags for reuse out-of-order.
+
+Fixes: dabcefab45d3 ("nvme: provide optimized poll function for separate poll queues")
+Signed-off-by: Bijan Mottahedeh <bijan.mottahedeh@oracle.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/nvme/host/pci.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -1078,9 +1078,9 @@ static int nvme_poll(struct blk_mq_hw_ct
+       spin_lock(&nvmeq->cq_poll_lock);
+       found = nvme_process_cq(nvmeq, &start, &end, -1);
++      nvme_complete_cqes(nvmeq, start, end);
+       spin_unlock(&nvmeq->cq_poll_lock);
+-      nvme_complete_cqes(nvmeq, start, end);
+       return found;
+ }
diff --git a/queue-5.5/s390-qeth-fix-off-by-one-in-rx-copybreak-check.patch b/queue-5.5/s390-qeth-fix-off-by-one-in-rx-copybreak-check.patch
new file mode 100644 (file)
index 0000000..cbcec54
--- /dev/null
@@ -0,0 +1,32 @@
+From 54a61fbc020fd2e305680871c453abcf7fc0339b Mon Sep 17 00:00:00 2001
+From: Julian Wiedmann <jwi@linux.ibm.com>
+Date: Thu, 20 Feb 2020 15:54:56 +0100
+Subject: s390/qeth: fix off-by-one in RX copybreak check
+
+From: Julian Wiedmann <jwi@linux.ibm.com>
+
+commit 54a61fbc020fd2e305680871c453abcf7fc0339b upstream.
+
+The RX copybreak is intended as the _max_ value where the frame's data
+should be copied. So for frame_len == copybreak, don't build an SG skb.
+
+Fixes: 4a71df50047f ("qeth: new qeth device driver")
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/s390/net/qeth_core_main.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -5142,7 +5142,7 @@ next_packet:
+       }
+       use_rx_sg = (card->options.cq == QETH_CQ_ENABLED) ||
+-                  ((skb_len >= card->options.rx_sg_cb) &&
++                  (skb_len > card->options.rx_sg_cb &&
+                    !atomic_read(&card->force_alloc_skb) &&
+                    !IS_OSN(card));
diff --git a/queue-5.5/s390-qeth-vnicc-fix-eopnotsupp-precedence.patch b/queue-5.5/s390-qeth-vnicc-fix-eopnotsupp-precedence.patch
new file mode 100644 (file)
index 0000000..1f176e2
--- /dev/null
@@ -0,0 +1,106 @@
+From 6f3846f0955308b6d1b219419da42b8de2c08845 Mon Sep 17 00:00:00 2001
+From: Alexandra Winter <wintera@linux.ibm.com>
+Date: Thu, 20 Feb 2020 15:54:54 +0100
+Subject: s390/qeth: vnicc Fix EOPNOTSUPP precedence
+
+From: Alexandra Winter <wintera@linux.ibm.com>
+
+commit 6f3846f0955308b6d1b219419da42b8de2c08845 upstream.
+
+When getting or setting VNICC parameters, the error code EOPNOTSUPP
+should have precedence over EBUSY.
+
+EBUSY is used because vnicc feature and bridgeport feature are mutually
+exclusive, which is a temporary condition.
+Whereas EOPNOTSUPP indicates that the HW does not support all or parts of
+the vnicc feature.
+This issue causes the vnicc sysfs params to show 'blocked by bridgeport'
+for HW that does not support VNICC at all.
+
+Fixes: caa1f0b10d18 ("s390/qeth: add VNICC enable/disable support")
+Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/s390/net/qeth_l2_main.c |   29 +++++++++++++----------------
+ 1 file changed, 13 insertions(+), 16 deletions(-)
+
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -1815,15 +1815,14 @@ int qeth_l2_vnicc_set_state(struct qeth_
+       QETH_CARD_TEXT(card, 2, "vniccsch");
+-      /* do not change anything if BridgePort is enabled */
+-      if (qeth_bridgeport_is_in_use(card))
+-              return -EBUSY;
+-
+       /* check if characteristic and enable/disable are supported */
+       if (!(card->options.vnicc.sup_chars & vnicc) ||
+           !(card->options.vnicc.set_char_sup & vnicc))
+               return -EOPNOTSUPP;
++      if (qeth_bridgeport_is_in_use(card))
++              return -EBUSY;
++
+       /* set enable/disable command and store wanted characteristic */
+       if (state) {
+               cmd = IPA_VNICC_ENABLE;
+@@ -1869,14 +1868,13 @@ int qeth_l2_vnicc_get_state(struct qeth_
+       QETH_CARD_TEXT(card, 2, "vniccgch");
+-      /* do not get anything if BridgePort is enabled */
+-      if (qeth_bridgeport_is_in_use(card))
+-              return -EBUSY;
+-
+       /* check if characteristic is supported */
+       if (!(card->options.vnicc.sup_chars & vnicc))
+               return -EOPNOTSUPP;
++      if (qeth_bridgeport_is_in_use(card))
++              return -EBUSY;
++
+       /* if card is ready, query current VNICC state */
+       if (qeth_card_hw_is_reachable(card))
+               rc = qeth_l2_vnicc_query_chars(card);
+@@ -1894,15 +1892,14 @@ int qeth_l2_vnicc_set_timeout(struct qet
+       QETH_CARD_TEXT(card, 2, "vniccsto");
+-      /* do not change anything if BridgePort is enabled */
+-      if (qeth_bridgeport_is_in_use(card))
+-              return -EBUSY;
+-
+       /* check if characteristic and set_timeout are supported */
+       if (!(card->options.vnicc.sup_chars & QETH_VNICC_LEARNING) ||
+           !(card->options.vnicc.getset_timeout_sup & QETH_VNICC_LEARNING))
+               return -EOPNOTSUPP;
++      if (qeth_bridgeport_is_in_use(card))
++              return -EBUSY;
++
+       /* do we need to do anything? */
+       if (card->options.vnicc.learning_timeout == timeout)
+               return rc;
+@@ -1931,14 +1928,14 @@ int qeth_l2_vnicc_get_timeout(struct qet
+       QETH_CARD_TEXT(card, 2, "vniccgto");
+-      /* do not get anything if BridgePort is enabled */
+-      if (qeth_bridgeport_is_in_use(card))
+-              return -EBUSY;
+-
+       /* check if characteristic and get_timeout are supported */
+       if (!(card->options.vnicc.sup_chars & QETH_VNICC_LEARNING) ||
+           !(card->options.vnicc.getset_timeout_sup & QETH_VNICC_LEARNING))
+               return -EOPNOTSUPP;
++
++      if (qeth_bridgeport_is_in_use(card))
++              return -EBUSY;
++
+       /* if card is ready, get timeout. Otherwise, just return stored value */
+       *timeout = card->options.vnicc.learning_timeout;
+       if (qeth_card_hw_is_reachable(card))
index 0bfd97271417036a8c874a9bea552020827bfde1..58c8e9e6bb24a2d66d00d5cdd0f60aada5605cdd 100644 (file)
@@ -120,3 +120,13 @@ mac80211-remove-a-redundant-mutex-unlock.patch
 kbuild-fix-dt-binding-schema-rule-to-detect-command-line-changes.patch
 hv_netvsc-fix-unwanted-wakeup-in-netvsc_attach.patch
 usb-charger-assign-specific-number-for-enum-value.patch
+nvme-pci-hold-cq_poll_lock-while-completing-cqes.patch
+s390-qeth-vnicc-fix-eopnotsupp-precedence.patch
+s390-qeth-fix-off-by-one-in-rx-copybreak-check.patch
+net-netlink-cap-max-groups-which-will-be-considered-in-netlink_bind.patch
+net-atlantic-checksum-compat-issue.patch
+net-atlantic-better-loopback-mode-handling.patch
+net-atlantic-fix-use-after-free-kasan-warn.patch
+net-atlantic-fix-potential-error-handling.patch
+net-atlantic-possible-fault-in-transition-to-hibernation.patch
+net-atlantic-fix-out-of-range-usage-of-active_vlans-array.patch