--- /dev/null
+From foo@baz Fri Mar 8 07:37:28 CET 2019
+From: Ido Schimmel <idosch@mellanox.com>
+Date: Sun, 3 Mar 2019 07:34:57 +0000
+Subject: ip6mr: Do not call __IP6_INC_STATS() from preemptible context
+
+From: Ido Schimmel <idosch@mellanox.com>
+
+[ Upstream commit 87c11f1ddbbad38ad8bad47af133a8208985fbdf ]
+
+Similar to commit 44f49dd8b5a6 ("ipmr: fix possible race resulting from
+improper usage of IP_INC_STATS_BH() in preemptible context."), we cannot
+assume preemption is disabled when incrementing the counter and
+accessing a per-CPU variable.
+
+Preemption can be enabled when we add a route in process context that
+corresponds to packets stored in the unresolved queue, which are then
+forwarded using this route [1].
+
+Fix this by using IP6_INC_STATS() which takes care of disabling
+preemption on architectures where it is needed.
+
+[1]
+[ 157.451447] BUG: using __this_cpu_add() in preemptible [00000000] code: smcrouted/2314
+[ 157.460409] caller is ip6mr_forward2+0x73e/0x10e0
+[ 157.460434] CPU: 3 PID: 2314 Comm: smcrouted Not tainted 5.0.0-rc7-custom-03635-g22f2712113f1 #1336
+[ 157.460449] Hardware name: Mellanox Technologies Ltd. MSN2100-CB2FO/SA001017, BIOS 5.6.5 06/07/2016
+[ 157.460461] Call Trace:
+[ 157.460486] dump_stack+0xf9/0x1be
+[ 157.460553] check_preemption_disabled+0x1d6/0x200
+[ 157.460576] ip6mr_forward2+0x73e/0x10e0
+[ 157.460705] ip6_mr_forward+0x9a0/0x1510
+[ 157.460771] ip6mr_mfc_add+0x16b3/0x1e00
+[ 157.461155] ip6_mroute_setsockopt+0x3cb/0x13c0
+[ 157.461384] do_ipv6_setsockopt.isra.8+0x348/0x4060
+[ 157.462013] ipv6_setsockopt+0x90/0x110
+[ 157.462036] rawv6_setsockopt+0x4a/0x120
+[ 157.462058] __sys_setsockopt+0x16b/0x340
+[ 157.462198] __x64_sys_setsockopt+0xbf/0x160
+[ 157.462220] do_syscall_64+0x14d/0x610
+[ 157.462349] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+Fixes: 0912ea38de61 ("[IPV6] MROUTE: Add stats in multicast routing module method ip6_mr_forward().")
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Reported-by: Amit Cohen <amitc@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/ip6mr.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/net/ipv6/ip6mr.c
++++ b/net/ipv6/ip6mr.c
+@@ -1964,10 +1964,10 @@ int ip6mr_compat_ioctl(struct sock *sk,
+
+ static inline int ip6mr_forward2_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
+ {
+- __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
+- IPSTATS_MIB_OUTFORWDATAGRAMS);
+- __IP6_ADD_STATS(net, ip6_dst_idev(skb_dst(skb)),
+- IPSTATS_MIB_OUTOCTETS, skb->len);
++ IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
++ IPSTATS_MIB_OUTFORWDATAGRAMS);
++ IP6_ADD_STATS(net, ip6_dst_idev(skb_dst(skb)),
++ IPSTATS_MIB_OUTOCTETS, skb->len);
+ return dst_output(net, sk, skb);
+ }
+
--- /dev/null
+From foo@baz Fri Mar 8 07:37:28 CET 2019
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Mon, 4 Mar 2019 19:39:03 +0100
+Subject: net: dsa: mv88e6xxx: add call to mv88e6xxx_ports_cmode_init to probe for new DSA framework
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit 3acca1dd17060332cfab15693733cdaf9fba1c90 ]
+
+In the original patch I missed to add mv88e6xxx_ports_cmode_init()
+to the second probe function, the one for the new DSA framework.
+
+Fixes: ed8fe20205ac ("net: dsa: mv88e6xxx: prevent interrupt storm caused by mv88e6390x_port_set_cmode")
+Reported-by: Shaokun Zhang <zhangshaokun@hisilicon.com>
+Suggested-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/mv88e6xxx/chip.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -4847,6 +4847,7 @@ static int mv88e6xxx_probe(struct mdio_d
+ if (err)
+ goto out;
+
++ mv88e6xxx_ports_cmode_init(chip);
+ mv88e6xxx_phy_init(chip);
+
+ if (chip->info->ops->get_eeprom) {
--- /dev/null
+From foo@baz Fri Mar 8 07:37:28 CET 2019
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Fri, 1 Mar 2019 19:53:57 +0100
+Subject: net: dsa: mv88e6xxx: handle unknown duplex modes gracefully in mv88e6xxx_port_set_duplex
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit c6195a8bdfc62a7cecf7df685e64847a4b700275 ]
+
+When testing another issue I faced the problem that
+mv88e6xxx_port_setup_mac() failed due to DUPLEX_UNKNOWN being passed
+as argument to mv88e6xxx_port_set_duplex(). We should handle this case
+gracefully and return -EOPNOTSUPP, like e.g. mv88e6xxx_port_set_speed()
+is doing it.
+
+Fixes: 7f1ae07b51e8 ("net: dsa: mv88e6xxx: add port duplex setter")
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/mv88e6xxx/port.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/dsa/mv88e6xxx/port.c
++++ b/drivers/net/dsa/mv88e6xxx/port.c
+@@ -190,7 +190,7 @@ int mv88e6xxx_port_set_duplex(struct mv8
+ /* normal duplex detection */
+ break;
+ default:
+- return -EINVAL;
++ return -EOPNOTSUPP;
+ }
+
+ err = mv88e6xxx_port_write(chip, port, MV88E6XXX_PORT_MAC_CTL, reg);
--- /dev/null
+From foo@baz Fri Mar 8 07:37:28 CET 2019
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Sat, 2 Mar 2019 10:06:05 +0100
+Subject: net: dsa: mv8e6xxx: fix number of internal PHYs for 88E6x90 family
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit 95150f29ae480276e76368cdf8a9524b5a96c0ca ]
+
+Ports 9 and 10 don't have internal PHY's but are (dependent on the
+version) SERDES/SGMII/XAUI/RXAUI ports.
+
+v2:
+- fix it for all 88E6x90 family members
+
+Fixes: bc3931557d1d ("net: dsa: mv88e6xxx: Add number of internal PHYs")
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/mv88e6xxx/chip.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -4222,7 +4222,7 @@ static const struct mv88e6xxx_info mv88e
+ .name = "Marvell 88E6190",
+ .num_databases = 4096,
+ .num_ports = 11, /* 10 + Z80 */
+- .num_internal_phys = 11,
++ .num_internal_phys = 9,
+ .num_gpio = 16,
+ .max_vid = 8191,
+ .port_base_addr = 0x0,
+@@ -4245,7 +4245,7 @@ static const struct mv88e6xxx_info mv88e
+ .name = "Marvell 88E6190X",
+ .num_databases = 4096,
+ .num_ports = 11, /* 10 + Z80 */
+- .num_internal_phys = 11,
++ .num_internal_phys = 9,
+ .num_gpio = 16,
+ .max_vid = 8191,
+ .port_base_addr = 0x0,
+@@ -4268,7 +4268,7 @@ static const struct mv88e6xxx_info mv88e
+ .name = "Marvell 88E6191",
+ .num_databases = 4096,
+ .num_ports = 11, /* 10 + Z80 */
+- .num_internal_phys = 11,
++ .num_internal_phys = 9,
+ .max_vid = 8191,
+ .port_base_addr = 0x0,
+ .phy_base_addr = 0x0,
+@@ -4315,7 +4315,7 @@ static const struct mv88e6xxx_info mv88e
+ .name = "Marvell 88E6290",
+ .num_databases = 4096,
+ .num_ports = 11, /* 10 + Z80 */
+- .num_internal_phys = 11,
++ .num_internal_phys = 9,
+ .num_gpio = 16,
+ .max_vid = 8191,
+ .port_base_addr = 0x0,
+@@ -4477,7 +4477,7 @@ static const struct mv88e6xxx_info mv88e
+ .name = "Marvell 88E6390",
+ .num_databases = 4096,
+ .num_ports = 11, /* 10 + Z80 */
+- .num_internal_phys = 11,
++ .num_internal_phys = 9,
+ .num_gpio = 16,
+ .max_vid = 8191,
+ .port_base_addr = 0x0,
+@@ -4500,7 +4500,7 @@ static const struct mv88e6xxx_info mv88e
+ .name = "Marvell 88E6390X",
+ .num_databases = 4096,
+ .num_ports = 11, /* 10 + Z80 */
+- .num_internal_phys = 11,
++ .num_internal_phys = 9,
+ .num_gpio = 16,
+ .max_vid = 8191,
+ .port_base_addr = 0x0,
--- /dev/null
+From foo@baz Fri Mar 8 07:37:28 CET 2019
+From: Kavya Sree Kotagiri <kavyasree.kotagiri@microchip.com>
+Date: Thu, 28 Feb 2019 07:32:22 +0000
+Subject: net: mscc: Enable all ports in QSGMII
+
+From: Kavya Sree Kotagiri <kavyasree.kotagiri@microchip.com>
+
+[ Upstream commit 084e5bb16bd7dc2b551bbd9fb358bf73e03ee8d8 ]
+
+When Ocelot phy-mode is QSGMII, all 4 ports involved in
+QSGMII shall be kept out of reset and
+Tx lanes shall be enabled to pass the data.
+
+Fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support")
+Signed-off-by: Kavya Sree Kotagiri <kavyasree.kotagiri@microchip.com>
+Signed-off-by: Steen Hegelund <Steen.Hegelund@microchip.com>
+Co-developed-by: Steen Hegelund <Steen.Hegelund@microchip.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mscc/ocelot_board.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/mscc/ocelot_board.c
++++ b/drivers/net/ethernet/mscc/ocelot_board.c
+@@ -267,6 +267,7 @@ static int mscc_ocelot_probe(struct plat
+ struct phy *serdes;
+ void __iomem *regs;
+ char res_name[8];
++ int phy_mode;
+ u32 port;
+
+ if (of_property_read_u32(portnp, "reg", &port))
+@@ -292,11 +293,11 @@ static int mscc_ocelot_probe(struct plat
+ if (err)
+ return err;
+
+- err = of_get_phy_mode(portnp);
+- if (err < 0)
++ phy_mode = of_get_phy_mode(portnp);
++ if (phy_mode < 0)
+ ocelot->ports[port]->phy_mode = PHY_INTERFACE_MODE_NA;
+ else
+- ocelot->ports[port]->phy_mode = err;
++ ocelot->ports[port]->phy_mode = phy_mode;
+
+ switch (ocelot->ports[port]->phy_mode) {
+ case PHY_INTERFACE_MODE_NA:
+@@ -304,6 +305,13 @@ static int mscc_ocelot_probe(struct plat
+ case PHY_INTERFACE_MODE_SGMII:
+ break;
+ case PHY_INTERFACE_MODE_QSGMII:
++ /* Ensure clock signals and speed is set on all
++ * QSGMII links
++ */
++ ocelot_port_writel(ocelot->ports[port],
++ DEV_CLOCK_CFG_LINK_SPEED
++ (OCELOT_SPEED_1000),
++ DEV_CLOCK_CFG);
+ break;
+ default:
+ dev_err(ocelot->dev,
--- /dev/null
+From foo@baz Fri Mar 8 07:37:28 CET 2019
+From: Eric Dumazet <edumazet@google.com>
+Date: Thu, 28 Feb 2019 12:55:43 -0800
+Subject: net: sched: put back q.qlen into a single location
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 46b1c18f9deb326a7e18348e668e4c7ab7c7458b ]
+
+In the series fc8b81a5981f ("Merge branch 'lockless-qdisc-series'")
+John made the assumption that the data path had no need to read
+the qdisc qlen (number of packets in the qdisc).
+
+It is true when pfifo_fast is used as the root qdisc, or as direct MQ/MQPRIO
+children.
+
+But pfifo_fast can be used as leaf in class full qdiscs, and existing
+logic needs to access the child qlen in an efficient way.
+
+HTB breaks badly, since it uses cl->leaf.q->q.qlen in :
+ htb_activate() -> WARN_ON()
+ htb_dequeue_tree() to decide if a class can be htb_deactivated
+ when it has no more packets.
+
+HFSC, DRR, CBQ, QFQ have similar issues, and some calls to
+qdisc_tree_reduce_backlog() also read q.qlen directly.
+
+Using qdisc_qlen_sum() (which iterates over all possible cpus)
+in the data path is a non starter.
+
+It seems we have to put back qlen in a central location,
+at least for stable kernels.
+
+For all qdisc but pfifo_fast, qlen is guarded by the qdisc lock,
+so the existing q.qlen{++|--} are correct.
+
+For 'lockless' qdisc (pfifo_fast so far), we need to use atomic_{inc|dec}()
+because the spinlock might be not held (for example from
+pfifo_fast_enqueue() and pfifo_fast_dequeue())
+
+This patch adds atomic_qlen (in the same location than qlen)
+and renames the following helpers, since we want to express
+they can be used without qdisc lock, and that qlen is no longer percpu.
+
+- qdisc_qstats_cpu_qlen_dec -> qdisc_qstats_atomic_qlen_dec()
+- qdisc_qstats_cpu_qlen_inc -> qdisc_qstats_atomic_qlen_inc()
+
+Later (net-next) we might revert this patch by tracking all these
+qlen uses and replace them by a more efficient method (not having
+to access a precise qlen, but an empty/non_empty status that might
+be less expensive to maintain/track).
+
+Another possibility is to have a legacy pfifo_fast version that would
+be used when used a a child qdisc, since the parent qdisc needs
+a spinlock anyway. But then, future lockless qdiscs would also
+have the same problem.
+
+Fixes: 7e66016f2c65 ("net: sched: helpers to sum qlen and qlen for per cpu logic")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: John Fastabend <john.fastabend@gmail.com>
+Cc: Jamal Hadi Salim <jhs@mojatatu.com>
+Cc: Cong Wang <xiyou.wangcong@gmail.com>
+Cc: Jiri Pirko <jiri@resnulli.us>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/sch_generic.h | 31 +++++++++++++------------------
+ net/core/gen_stats.c | 2 --
+ net/sched/sch_generic.c | 13 ++++++-------
+ 3 files changed, 19 insertions(+), 27 deletions(-)
+
+--- a/include/net/sch_generic.h
++++ b/include/net/sch_generic.h
+@@ -51,7 +51,10 @@ struct qdisc_size_table {
+ struct qdisc_skb_head {
+ struct sk_buff *head;
+ struct sk_buff *tail;
+- __u32 qlen;
++ union {
++ u32 qlen;
++ atomic_t atomic_qlen;
++ };
+ spinlock_t lock;
+ };
+
+@@ -408,27 +411,19 @@ static inline void qdisc_cb_private_vali
+ BUILD_BUG_ON(sizeof(qcb->data) < sz);
+ }
+
+-static inline int qdisc_qlen_cpu(const struct Qdisc *q)
+-{
+- return this_cpu_ptr(q->cpu_qstats)->qlen;
+-}
+-
+ static inline int qdisc_qlen(const struct Qdisc *q)
+ {
+ return q->q.qlen;
+ }
+
+-static inline int qdisc_qlen_sum(const struct Qdisc *q)
++static inline u32 qdisc_qlen_sum(const struct Qdisc *q)
+ {
+- __u32 qlen = q->qstats.qlen;
+- int i;
++ u32 qlen = q->qstats.qlen;
+
+- if (q->flags & TCQ_F_NOLOCK) {
+- for_each_possible_cpu(i)
+- qlen += per_cpu_ptr(q->cpu_qstats, i)->qlen;
+- } else {
++ if (q->flags & TCQ_F_NOLOCK)
++ qlen += atomic_read(&q->q.atomic_qlen);
++ else
+ qlen += q->q.qlen;
+- }
+
+ return qlen;
+ }
+@@ -825,14 +820,14 @@ static inline void qdisc_qstats_cpu_back
+ this_cpu_add(sch->cpu_qstats->backlog, qdisc_pkt_len(skb));
+ }
+
+-static inline void qdisc_qstats_cpu_qlen_inc(struct Qdisc *sch)
++static inline void qdisc_qstats_atomic_qlen_inc(struct Qdisc *sch)
+ {
+- this_cpu_inc(sch->cpu_qstats->qlen);
++ atomic_inc(&sch->q.atomic_qlen);
+ }
+
+-static inline void qdisc_qstats_cpu_qlen_dec(struct Qdisc *sch)
++static inline void qdisc_qstats_atomic_qlen_dec(struct Qdisc *sch)
+ {
+- this_cpu_dec(sch->cpu_qstats->qlen);
++ atomic_dec(&sch->q.atomic_qlen);
+ }
+
+ static inline void qdisc_qstats_cpu_requeues_inc(struct Qdisc *sch)
+--- a/net/core/gen_stats.c
++++ b/net/core/gen_stats.c
+@@ -291,7 +291,6 @@ __gnet_stats_copy_queue_cpu(struct gnet_
+ for_each_possible_cpu(i) {
+ const struct gnet_stats_queue *qcpu = per_cpu_ptr(q, i);
+
+- qstats->qlen = 0;
+ qstats->backlog += qcpu->backlog;
+ qstats->drops += qcpu->drops;
+ qstats->requeues += qcpu->requeues;
+@@ -307,7 +306,6 @@ void __gnet_stats_copy_queue(struct gnet
+ if (cpu) {
+ __gnet_stats_copy_queue_cpu(qstats, cpu);
+ } else {
+- qstats->qlen = q->qlen;
+ qstats->backlog = q->backlog;
+ qstats->drops = q->drops;
+ qstats->requeues = q->requeues;
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -68,7 +68,7 @@ static inline struct sk_buff *__skb_dequ
+ skb = __skb_dequeue(&q->skb_bad_txq);
+ if (qdisc_is_percpu_stats(q)) {
+ qdisc_qstats_cpu_backlog_dec(q, skb);
+- qdisc_qstats_cpu_qlen_dec(q);
++ qdisc_qstats_atomic_qlen_dec(q);
+ } else {
+ qdisc_qstats_backlog_dec(q, skb);
+ q->q.qlen--;
+@@ -108,7 +108,7 @@ static inline void qdisc_enqueue_skb_bad
+
+ if (qdisc_is_percpu_stats(q)) {
+ qdisc_qstats_cpu_backlog_inc(q, skb);
+- qdisc_qstats_cpu_qlen_inc(q);
++ qdisc_qstats_atomic_qlen_inc(q);
+ } else {
+ qdisc_qstats_backlog_inc(q, skb);
+ q->q.qlen++;
+@@ -147,7 +147,7 @@ static inline int dev_requeue_skb_locked
+
+ qdisc_qstats_cpu_requeues_inc(q);
+ qdisc_qstats_cpu_backlog_inc(q, skb);
+- qdisc_qstats_cpu_qlen_inc(q);
++ qdisc_qstats_atomic_qlen_inc(q);
+
+ skb = next;
+ }
+@@ -252,7 +252,7 @@ static struct sk_buff *dequeue_skb(struc
+ skb = __skb_dequeue(&q->gso_skb);
+ if (qdisc_is_percpu_stats(q)) {
+ qdisc_qstats_cpu_backlog_dec(q, skb);
+- qdisc_qstats_cpu_qlen_dec(q);
++ qdisc_qstats_atomic_qlen_dec(q);
+ } else {
+ qdisc_qstats_backlog_dec(q, skb);
+ q->q.qlen--;
+@@ -645,7 +645,7 @@ static int pfifo_fast_enqueue(struct sk_
+ if (unlikely(err))
+ return qdisc_drop_cpu(skb, qdisc, to_free);
+
+- qdisc_qstats_cpu_qlen_inc(qdisc);
++ qdisc_qstats_atomic_qlen_inc(qdisc);
+ /* Note: skb can not be used after skb_array_produce(),
+ * so we better not use qdisc_qstats_cpu_backlog_inc()
+ */
+@@ -670,7 +670,7 @@ static struct sk_buff *pfifo_fast_dequeu
+ if (likely(skb)) {
+ qdisc_qstats_cpu_backlog_dec(qdisc, skb);
+ qdisc_bstats_cpu_update(qdisc, skb);
+- qdisc_qstats_cpu_qlen_dec(qdisc);
++ qdisc_qstats_atomic_qlen_dec(qdisc);
+ }
+
+ return skb;
+@@ -714,7 +714,6 @@ static void pfifo_fast_reset(struct Qdis
+ struct gnet_stats_queue *q = per_cpu_ptr(qdisc->cpu_qstats, i);
+
+ q->backlog = 0;
+- q->qlen = 0;
+ }
+ }
+
--- /dev/null
+From foo@baz Fri Mar 8 07:37:28 CET 2019
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Sat, 2 Mar 2019 10:34:55 +0800
+Subject: net-sysfs: Fix mem leak in netdev_register_kobject
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 895a5e96dbd6386c8e78e5b78e067dcc67b7f0ab ]
+
+syzkaller report this:
+BUG: memory leak
+unreferenced object 0xffff88837a71a500 (size 256):
+ comm "syz-executor.2", pid 9770, jiffies 4297825125 (age 17.843s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........
+ ff ff ff ff ff ff ff ff 20 c0 ef 86 ff ff ff ff ........ .......
+ backtrace:
+ [<00000000db12624b>] netdev_register_kobject+0x124/0x2e0 net/core/net-sysfs.c:1751
+ [<00000000dc49a994>] register_netdevice+0xcc1/0x1270 net/core/dev.c:8516
+ [<00000000e5f3fea0>] tun_set_iff drivers/net/tun.c:2649 [inline]
+ [<00000000e5f3fea0>] __tun_chr_ioctl+0x2218/0x3d20 drivers/net/tun.c:2883
+ [<000000001b8ac127>] vfs_ioctl fs/ioctl.c:46 [inline]
+ [<000000001b8ac127>] do_vfs_ioctl+0x1a5/0x10e0 fs/ioctl.c:690
+ [<0000000079b269f8>] ksys_ioctl+0x89/0xa0 fs/ioctl.c:705
+ [<00000000de649beb>] __do_sys_ioctl fs/ioctl.c:712 [inline]
+ [<00000000de649beb>] __se_sys_ioctl fs/ioctl.c:710 [inline]
+ [<00000000de649beb>] __x64_sys_ioctl+0x74/0xb0 fs/ioctl.c:710
+ [<000000007ebded1e>] do_syscall_64+0xc8/0x580 arch/x86/entry/common.c:290
+ [<00000000db315d36>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+ [<00000000115be9bb>] 0xffffffffffffffff
+
+It should call kset_unregister to free 'dev->queues_kset'
+in error path of register_queue_kobjects, otherwise will cause a mem leak.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: 1d24eb4815d1 ("xps: Transmit Packet Steering")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/net-sysfs.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/core/net-sysfs.c
++++ b/net/core/net-sysfs.c
+@@ -1547,6 +1547,9 @@ static int register_queue_kobjects(struc
+ error:
+ netdev_queue_update_kobjects(dev, txq, 0);
+ net_rx_queue_update_kobjects(dev, rxq, 0);
++#ifdef CONFIG_SYSFS
++ kset_unregister(dev->queues_kset);
++#endif
+ return error;
+ }
+
--- /dev/null
+From foo@baz Fri Mar 8 07:37:28 CET 2019
+From: Kristian Evensen <kristian.evensen@gmail.com>
+Date: Sat, 2 Mar 2019 13:32:26 +0100
+Subject: qmi_wwan: Add support for Quectel EG12/EM12
+
+From: Kristian Evensen <kristian.evensen@gmail.com>
+
+[ Upstream commit 822e44b45eb991c63487c5e2ce7d636411870a8d ]
+
+Quectel EG12 (module)/EM12 (M.2 card) is a Cat. 12 LTE modem. The modem
+behaves in the same way as the EP06, so the "set DTR"-quirk must be
+applied and the diagnostic-interface check performed. Since the
+diagnostic-check now applies to more modems, I have renamed the function
+from quectel_ep06_diag_detected() to quectel_diag_detected().
+
+Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>
+Acked-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/qmi_wwan.c | 26 ++++++++++++++++++--------
+ 1 file changed, 18 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -976,6 +976,13 @@ static const struct usb_device_id produc
+ 0xff),
+ .driver_info = (unsigned long)&qmi_wwan_info_quirk_dtr,
+ },
++ { /* Quectel EG12/EM12 */
++ USB_DEVICE_AND_INTERFACE_INFO(0x2c7c, 0x0512,
++ USB_CLASS_VENDOR_SPEC,
++ USB_SUBCLASS_VENDOR_SPEC,
++ 0xff),
++ .driver_info = (unsigned long)&qmi_wwan_info_quirk_dtr,
++ },
+
+ /* 3. Combined interface devices matching on interface number */
+ {QMI_FIXED_INTF(0x0408, 0xea42, 4)}, /* Yota / Megafon M100-1 */
+@@ -1343,17 +1350,20 @@ static bool quectel_ec20_detected(struct
+ return false;
+ }
+
+-static bool quectel_ep06_diag_detected(struct usb_interface *intf)
++static bool quectel_diag_detected(struct usb_interface *intf)
+ {
+ struct usb_device *dev = interface_to_usbdev(intf);
+ struct usb_interface_descriptor intf_desc = intf->cur_altsetting->desc;
++ u16 id_vendor = le16_to_cpu(dev->descriptor.idVendor);
++ u16 id_product = le16_to_cpu(dev->descriptor.idProduct);
+
+- if (le16_to_cpu(dev->descriptor.idVendor) == 0x2c7c &&
+- le16_to_cpu(dev->descriptor.idProduct) == 0x0306 &&
+- intf_desc.bNumEndpoints == 2)
+- return true;
++ if (id_vendor != 0x2c7c || intf_desc.bNumEndpoints != 2)
++ return false;
+
+- return false;
++ if (id_product == 0x0306 || id_product == 0x0512)
++ return true;
++ else
++ return false;
+ }
+
+ static int qmi_wwan_probe(struct usb_interface *intf,
+@@ -1390,13 +1400,13 @@ static int qmi_wwan_probe(struct usb_int
+ return -ENODEV;
+ }
+
+- /* Quectel EP06/EM06/EG06 supports dynamic interface configuration, so
++ /* Several Quectel modems supports dynamic interface configuration, so
+ * we need to match on class/subclass/protocol. These values are
+ * identical for the diagnostic- and QMI-interface, but bNumEndpoints is
+ * different. Ignore the current interface if the number of endpoints
+ * the number for the diag interface (two).
+ */
+- if (quectel_ep06_diag_detected(intf))
++ if (quectel_diag_detected(intf))
+ return -ENODEV;
+
+ return usbnet_probe(intf, id);
--- /dev/null
+From foo@baz Fri Mar 8 07:37:28 CET 2019
+From: Xin Long <lucien.xin@gmail.com>
+Date: Sun, 3 Mar 2019 16:50:26 +0800
+Subject: sctp: call iov_iter_revert() after sending ABORT
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit 901efe12318b1ea8d3e2c88a7b75ed6e6d5d7245 ]
+
+The user msg is also copied to the abort packet when doing SCTP_ABORT in
+sctp_sendmsg_check_sflags(). When SCTP_SENDALL is set, iov_iter_revert()
+should have been called for sending abort on the next asoc with copying
+this msg. Otherwise, memcpy_from_msg() in sctp_make_abort_user() will
+fail and return error.
+
+Fixes: 4910280503f3 ("sctp: add support for snd flag SCTP_SENDALL process in sendmsg")
+Reported-by: Ying Xu <yinxu@redhat.com>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: Neil Horman <nhorman@tuxdriver.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sctp/socket.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -1866,6 +1866,7 @@ static int sctp_sendmsg_check_sflags(str
+
+ pr_debug("%s: aborting association:%p\n", __func__, asoc);
+ sctp_primitive_ABORT(net, asoc, chunk);
++ iov_iter_revert(&msg->msg_iter, msg_len);
+
+ return 0;
+ }
staging-android-ion-fix-sys-heap-pool-s-gfp_flags.patch
staging-android-ashmem-don-t-call-fallocate-with-ashmem_mutex-held.patch
staging-android-ashmem-avoid-range_alloc-allocation-with-ashmem_mutex-held.patch
+ip6mr-do-not-call-__ip6_inc_stats-from-preemptible-context.patch
+net-dsa-mv88e6xxx-add-call-to-mv88e6xxx_ports_cmode_init-to-probe-for-new-dsa-framework.patch
+net-dsa-mv88e6xxx-handle-unknown-duplex-modes-gracefully-in-mv88e6xxx_port_set_duplex.patch
+net-dsa-mv8e6xxx-fix-number-of-internal-phys-for-88e6x90-family.patch
+net-mscc-enable-all-ports-in-qsgmii.patch
+net-sched-put-back-q.qlen-into-a-single-location.patch
+net-sysfs-fix-mem-leak-in-netdev_register_kobject.patch
+qmi_wwan-add-support-for-quectel-eg12-em12.patch
+sctp-call-iov_iter_revert-after-sending-abort.patch
+sky2-disable-msi-on-dell-inspiron-1545-and-gateway-p-79.patch
+team-free-bpf-filter-when-unregistering-netdev.patch
+tipc-fix-rdm-dgram-connect-regression.patch
--- /dev/null
+From foo@baz Fri Mar 8 07:37:28 CET 2019
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Mon, 4 Mar 2019 15:00:03 +0800
+Subject: sky2: Disable MSI on Dell Inspiron 1545 and Gateway P-79
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+[ Upstream commit b33b7cd6fd86478dd2890a9abeb6f036aa01fdf7 ]
+
+Some sky2 chips fire IRQ after S3, before the driver is fully resumed:
+[ 686.804877] do_IRQ: 1.37 No irq handler for vector
+
+This is likely a platform bug that device isn't fully quiesced during
+S3. Use MSI-X, maskable MSI or INTx can prevent this issue from
+happening.
+
+Since MSI-X and maskable MSI are not supported by this device, fallback
+to use INTx on affected platforms.
+
+BugLink: https://bugs.launchpad.net/bugs/1807259
+BugLink: https://bugs.launchpad.net/bugs/1809843
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/marvell/sky2.c | 24 +++++++++++++++++++++++-
+ 1 file changed, 23 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/marvell/sky2.c
++++ b/drivers/net/ethernet/marvell/sky2.c
+@@ -46,6 +46,7 @@
+ #include <linux/mii.h>
+ #include <linux/of_device.h>
+ #include <linux/of_net.h>
++#include <linux/dmi.h>
+
+ #include <asm/irq.h>
+
+@@ -93,7 +94,7 @@ static int copybreak __read_mostly = 128
+ module_param(copybreak, int, 0);
+ MODULE_PARM_DESC(copybreak, "Receive copy threshold");
+
+-static int disable_msi = 0;
++static int disable_msi = -1;
+ module_param(disable_msi, int, 0);
+ MODULE_PARM_DESC(disable_msi, "Disable Message Signaled Interrupt (MSI)");
+
+@@ -4917,6 +4918,24 @@ static const char *sky2_name(u8 chipid,
+ return buf;
+ }
+
++static const struct dmi_system_id msi_blacklist[] = {
++ {
++ .ident = "Dell Inspiron 1545",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 1545"),
++ },
++ },
++ {
++ .ident = "Gateway P-79",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Gateway"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "P-79"),
++ },
++ },
++ {}
++};
++
+ static int sky2_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ {
+ struct net_device *dev, *dev1;
+@@ -5028,6 +5047,9 @@ static int sky2_probe(struct pci_dev *pd
+ goto err_out_free_pci;
+ }
+
++ if (disable_msi == -1)
++ disable_msi = !!dmi_check_system(msi_blacklist);
++
+ if (!disable_msi && pci_enable_msi(pdev) == 0) {
+ err = sky2_test_msi(hw);
+ if (err) {
--- /dev/null
+From foo@baz Fri Mar 8 07:37:28 CET 2019
+From: Ido Schimmel <idosch@mellanox.com>
+Date: Sun, 3 Mar 2019 07:35:51 +0000
+Subject: team: Free BPF filter when unregistering netdev
+
+From: Ido Schimmel <idosch@mellanox.com>
+
+[ Upstream commit 692c31bd4054212312396b1d303bffab2c5b93a7 ]
+
+When team is used in loadbalance mode a BPF filter can be used to
+provide a hash which will determine the Tx port.
+
+When the netdev is later unregistered the filter is not freed which
+results in memory leaks [1].
+
+Fix by freeing the program and the corresponding filter when
+unregistering the netdev.
+
+[1]
+unreferenced object 0xffff8881dbc47cc8 (size 16):
+ comm "teamd", pid 3068, jiffies 4294997779 (age 438.247s)
+ hex dump (first 16 bytes):
+ a3 00 6b 6b 6b 6b 6b 6b 88 a5 82 e1 81 88 ff ff ..kkkkkk........
+ backtrace:
+ [<000000008a3b47e3>] team_nl_cmd_options_set+0x88f/0x11b0
+ [<00000000c4f4f27e>] genl_family_rcv_msg+0x78f/0x1080
+ [<00000000610ef838>] genl_rcv_msg+0xca/0x170
+ [<00000000a281df93>] netlink_rcv_skb+0x132/0x380
+ [<000000004d9448a2>] genl_rcv+0x29/0x40
+ [<000000000321b2f4>] netlink_unicast+0x4c0/0x690
+ [<000000008c25dffb>] netlink_sendmsg+0x929/0xe10
+ [<00000000068298c5>] sock_sendmsg+0xc8/0x110
+ [<0000000082a61ff0>] ___sys_sendmsg+0x77a/0x8f0
+ [<00000000663ae29d>] __sys_sendmsg+0xf7/0x250
+ [<0000000027c5f11a>] do_syscall_64+0x14d/0x610
+ [<000000006cfbc8d3>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+ [<00000000e23197e2>] 0xffffffffffffffff
+unreferenced object 0xffff8881e182a588 (size 2048):
+ comm "teamd", pid 3068, jiffies 4294997780 (age 438.247s)
+ hex dump (first 32 bytes):
+ 20 00 00 00 02 00 00 00 30 00 00 00 28 f0 ff ff .......0...(...
+ 07 00 00 00 00 00 00 00 28 00 00 00 00 00 00 00 ........(.......
+ backtrace:
+ [<000000002daf01fb>] lb_bpf_func_set+0x45c/0x6d0
+ [<000000008a3b47e3>] team_nl_cmd_options_set+0x88f/0x11b0
+ [<00000000c4f4f27e>] genl_family_rcv_msg+0x78f/0x1080
+ [<00000000610ef838>] genl_rcv_msg+0xca/0x170
+ [<00000000a281df93>] netlink_rcv_skb+0x132/0x380
+ [<000000004d9448a2>] genl_rcv+0x29/0x40
+ [<000000000321b2f4>] netlink_unicast+0x4c0/0x690
+ [<000000008c25dffb>] netlink_sendmsg+0x929/0xe10
+ [<00000000068298c5>] sock_sendmsg+0xc8/0x110
+ [<0000000082a61ff0>] ___sys_sendmsg+0x77a/0x8f0
+ [<00000000663ae29d>] __sys_sendmsg+0xf7/0x250
+ [<0000000027c5f11a>] do_syscall_64+0x14d/0x610
+ [<000000006cfbc8d3>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+ [<00000000e23197e2>] 0xffffffffffffffff
+
+Fixes: 01d7f30a9f96 ("team: add loadbalance mode")
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Reported-by: Amit Cohen <amitc@mellanox.com>
+Acked-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/team/team_mode_loadbalance.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+--- a/drivers/net/team/team_mode_loadbalance.c
++++ b/drivers/net/team/team_mode_loadbalance.c
+@@ -325,6 +325,20 @@ static int lb_bpf_func_set(struct team *
+ return 0;
+ }
+
++static void lb_bpf_func_free(struct team *team)
++{
++ struct lb_priv *lb_priv = get_lb_priv(team);
++ struct bpf_prog *fp;
++
++ if (!lb_priv->ex->orig_fprog)
++ return;
++
++ __fprog_destroy(lb_priv->ex->orig_fprog);
++ fp = rcu_dereference_protected(lb_priv->fp,
++ lockdep_is_held(&team->lock));
++ bpf_prog_destroy(fp);
++}
++
+ static int lb_tx_method_get(struct team *team, struct team_gsetter_ctx *ctx)
+ {
+ struct lb_priv *lb_priv = get_lb_priv(team);
+@@ -639,6 +653,7 @@ static void lb_exit(struct team *team)
+
+ team_options_unregister(team, lb_options,
+ ARRAY_SIZE(lb_options));
++ lb_bpf_func_free(team);
+ cancel_delayed_work_sync(&lb_priv->ex->stats.refresh_dw);
+ free_percpu(lb_priv->pcpu_stats);
+ kfree(lb_priv->ex);
--- /dev/null
+From foo@baz Fri Mar 8 07:37:28 CET 2019
+From: Erik Hugne <erik.hugne@gmail.com>
+Date: Mon, 4 Mar 2019 23:26:10 +0100
+Subject: tipc: fix RDM/DGRAM connect() regression
+
+From: Erik Hugne <erik.hugne@gmail.com>
+
+[ Upstream commit 0e63208915a8d7590d0a6218dadb2a6a00ac705a ]
+
+Fix regression bug introduced in
+commit 365ad353c256 ("tipc: reduce risk of user starvation during link
+congestion")
+
+Only signal -EDESTADDRREQ for RDM/DGRAM if we don't have a cached
+sockaddr.
+
+Fixes: 365ad353c256 ("tipc: reduce risk of user starvation during link congestion")
+Signed-off-by: Erik Hugne <erik.hugne@gmail.com>
+Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/tipc/socket.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -1333,7 +1333,7 @@ static int __tipc_sendmsg(struct socket
+
+ if (unlikely(!dest)) {
+ dest = &tsk->peer;
+- if (!syn || dest->family != AF_TIPC)
++ if (!syn && dest->family != AF_TIPC)
+ return -EDESTADDRREQ;
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
