--- /dev/null
+From foo@baz Sat 28 Dec 2019 05:57:33 AM EST
+From: Mao Wenan <maowenan@huawei.com>
+Date: Mon, 9 Dec 2019 21:31:25 +0800
+Subject: af_packet: set defaule value for tmo
+
+From: Mao Wenan <maowenan@huawei.com>
+
+[ Upstream commit b43d1f9f7067c6759b1051e8ecb84e82cef569fe ]
+
+There is softlockup when using TPACKET_V3:
+...
+NMI watchdog: BUG: soft lockup - CPU#2 stuck for 60010ms!
+(__irq_svc) from [<c0558a0c>] (_raw_spin_unlock_irqrestore+0x44/0x54)
+(_raw_spin_unlock_irqrestore) from [<c027b7e8>] (mod_timer+0x210/0x25c)
+(mod_timer) from [<c0549c30>]
+(prb_retire_rx_blk_timer_expired+0x68/0x11c)
+(prb_retire_rx_blk_timer_expired) from [<c027a7ac>]
+(call_timer_fn+0x90/0x17c)
+(call_timer_fn) from [<c027ab6c>] (run_timer_softirq+0x2d4/0x2fc)
+(run_timer_softirq) from [<c021eaf4>] (__do_softirq+0x218/0x318)
+(__do_softirq) from [<c021eea0>] (irq_exit+0x88/0xac)
+(irq_exit) from [<c0240130>] (msa_irq_exit+0x11c/0x1d4)
+(msa_irq_exit) from [<c0209cf0>] (handle_IPI+0x650/0x7f4)
+(handle_IPI) from [<c02015bc>] (gic_handle_irq+0x108/0x118)
+(gic_handle_irq) from [<c0558ee4>] (__irq_usr+0x44/0x5c)
+...
+
+If __ethtool_get_link_ksettings() is failed in
+prb_calc_retire_blk_tmo(), msec and tmo will be zero, so tov_in_jiffies
+is zero and the timer expire for retire_blk_timer is turn to
+mod_timer(&pkc->retire_blk_timer, jiffies + 0),
+which will trigger cpu usage of softirq is 100%.
+
+Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.")
+Tested-by: Xiao Jiangfeng <xiaojiangfeng@huawei.com>
+Signed-off-by: Mao Wenan <maowenan@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/packet/af_packet.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -544,7 +544,8 @@ static int prb_calc_retire_blk_tmo(struc
+ msec = 1;
+ div = ecmd.base.speed / 1000;
+ }
+- }
++ } else
++ return DEFAULT_PRB_RETIRE_TOV;
+
+ mbits = (blk_size_in_bytes * 8) / (1024 * 1024);
+
--- /dev/null
+From foo@baz Sat 28 Dec 2019 05:57:33 AM EST
+From: Eric Dumazet <edumazet@google.com>
+Date: Sat, 7 Dec 2019 14:10:34 -0800
+Subject: bonding: fix bond_neigh_init()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 9e99bfefdbce2e23ef37487a3bcb4adf90a791d1 ]
+
+1) syzbot reported an uninit-value in bond_neigh_setup() [1]
+
+ bond_neigh_setup() uses a temporary on-stack 'struct neigh_parms parms',
+ but only clears parms.neigh_setup field.
+
+ A stacked bonding device would then enter bond_neigh_setup()
+ and read garbage from parms->dev.
+
+ If we get really unlucky and garbage is matching @dev, then we
+ could recurse and eventually crash.
+
+ Let's make sure the whole structure is cleared to avoid surprises.
+
+2) bond_neigh_setup() can be called while another cpu manipulates
+ the master device, removing or adding a slave.
+ We need at least rcu protection to prevent use-after-free.
+
+Note: Prior code does not support a stack of bonding devices,
+ this patch does not attempt to fix this, and leave a comment instead.
+
+[1]
+
+BUG: KMSAN: uninit-value in bond_neigh_setup+0xa4/0x110 drivers/net/bonding/bond_main.c:3655
+CPU: 0 PID: 11256 Comm: syz-executor.0 Not tainted 5.4.0-rc8-syzkaller #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+Call Trace:
+ <IRQ>
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0x1c9/0x220 lib/dump_stack.c:118
+ kmsan_report+0x128/0x220 mm/kmsan/kmsan_report.c:108
+ __msan_warning+0x57/0xa0 mm/kmsan/kmsan_instr.c:245
+ bond_neigh_setup+0xa4/0x110 drivers/net/bonding/bond_main.c:3655
+ bond_neigh_init+0x216/0x4b0 drivers/net/bonding/bond_main.c:3626
+ ___neigh_create+0x169e/0x2c40 net/core/neighbour.c:613
+ __neigh_create+0xbd/0xd0 net/core/neighbour.c:674
+ ip6_finish_output2+0x149a/0x2670 net/ipv6/ip6_output.c:113
+ __ip6_finish_output+0x83d/0x8f0 net/ipv6/ip6_output.c:142
+ ip6_finish_output+0x2db/0x420 net/ipv6/ip6_output.c:152
+ NF_HOOK_COND include/linux/netfilter.h:294 [inline]
+ ip6_output+0x5d3/0x720 net/ipv6/ip6_output.c:175
+ dst_output include/net/dst.h:436 [inline]
+ NF_HOOK include/linux/netfilter.h:305 [inline]
+ mld_sendpack+0xebd/0x13d0 net/ipv6/mcast.c:1682
+ mld_send_cr net/ipv6/mcast.c:1978 [inline]
+ mld_ifc_timer_expire+0x116b/0x1680 net/ipv6/mcast.c:2477
+ call_timer_fn+0x232/0x530 kernel/time/timer.c:1404
+ expire_timers kernel/time/timer.c:1449 [inline]
+ __run_timers+0xd60/0x1270 kernel/time/timer.c:1773
+ run_timer_softirq+0x2d/0x50 kernel/time/timer.c:1786
+ __do_softirq+0x4a1/0x83a kernel/softirq.c:293
+ invoke_softirq kernel/softirq.c:375 [inline]
+ irq_exit+0x230/0x280 kernel/softirq.c:416
+ exiting_irq+0xe/0x10 arch/x86/include/asm/apic.h:536
+ smp_apic_timer_interrupt+0x48/0x70 arch/x86/kernel/apic/apic.c:1138
+ apic_timer_interrupt+0x2e/0x40 arch/x86/entry/entry_64.S:835
+ </IRQ>
+RIP: 0010:kmsan_free_page+0x18d/0x1c0 mm/kmsan/kmsan_shadow.c:439
+Code: 4c 89 ff 44 89 f6 e8 82 0d ee ff 65 ff 0d 9f 26 3b 60 65 8b 05 98 26 3b 60 85 c0 75 24 e8 5b f6 35 ff 4c 89 6d d0 ff 75 d0 9d <48> 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 0b 0f 0b 0f 0b 0f
+RSP: 0018:ffffb328034af818 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
+RAX: 0000000000000000 RBX: ffffe2d7471f8360 RCX: 0000000000000000
+RDX: ffffffffadea7000 RSI: 0000000000000004 RDI: ffff93496fcda104
+RBP: ffffb328034af850 R08: ffff934a47e86d00 R09: ffff93496fc41900
+R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
+R13: 0000000000000246 R14: 0000000000000000 R15: ffffe2d7472225c0
+ free_pages_prepare mm/page_alloc.c:1138 [inline]
+ free_pcp_prepare mm/page_alloc.c:1230 [inline]
+ free_unref_page_prepare+0x1d9/0x770 mm/page_alloc.c:3025
+ free_unref_page mm/page_alloc.c:3074 [inline]
+ free_the_page mm/page_alloc.c:4832 [inline]
+ __free_pages+0x154/0x230 mm/page_alloc.c:4840
+ __vunmap+0xdac/0xf20 mm/vmalloc.c:2277
+ __vfree mm/vmalloc.c:2325 [inline]
+ vfree+0x7c/0x170 mm/vmalloc.c:2355
+ copy_entries_to_user net/ipv6/netfilter/ip6_tables.c:883 [inline]
+ get_entries net/ipv6/netfilter/ip6_tables.c:1041 [inline]
+ do_ip6t_get_ctl+0xfa4/0x1030 net/ipv6/netfilter/ip6_tables.c:1709
+ nf_sockopt net/netfilter/nf_sockopt.c:104 [inline]
+ nf_getsockopt+0x481/0x4e0 net/netfilter/nf_sockopt.c:122
+ ipv6_getsockopt+0x264/0x510 net/ipv6/ipv6_sockglue.c:1400
+ tcp_getsockopt+0x1c6/0x1f0 net/ipv4/tcp.c:3688
+ sock_common_getsockopt+0x13f/0x180 net/core/sock.c:3110
+ __sys_getsockopt+0x533/0x7b0 net/socket.c:2129
+ __do_sys_getsockopt net/socket.c:2144 [inline]
+ __se_sys_getsockopt+0xe1/0x100 net/socket.c:2141
+ __x64_sys_getsockopt+0x62/0x80 net/socket.c:2141
+ do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:291
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+RIP: 0033:0x45d20a
+Code: b8 34 01 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 8d 8b fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 37 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 6a 8b fb ff c3 66 0f 1f 84 00 00 00 00 00
+RSP: 002b:0000000000a6f618 EFLAGS: 00000212 ORIG_RAX: 0000000000000037
+RAX: ffffffffffffffda RBX: 0000000000a6f640 RCX: 000000000045d20a
+RDX: 0000000000000041 RSI: 0000000000000029 RDI: 0000000000000003
+RBP: 0000000000717cc0 R08: 0000000000a6f63c R09: 0000000000004000
+R10: 0000000000a6f740 R11: 0000000000000212 R12: 0000000000000003
+R13: 0000000000000000 R14: 0000000000000029 R15: 0000000000715b00
+
+Local variable description: ----parms@bond_neigh_init
+Variable was created at:
+ bond_neigh_init+0x8c/0x4b0 drivers/net/bonding/bond_main.c:3617
+ bond_neigh_init+0x8c/0x4b0 drivers/net/bonding/bond_main.c:3617
+
+Fixes: 9918d5bf329d ("bonding: modify only neigh_parms owned by us")
+Fixes: 234bcf8a499e ("net/bonding: correctly proxy slave neigh param setup ndo function")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Cc: Jay Vosburgh <j.vosburgh@gmail.com>
+Cc: Veaceslav Falico <vfalico@gmail.com>
+Cc: Andy Gospodarek <andy@greyhouse.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/bonding/bond_main.c | 31 +++++++++++++++++++++----------
+ 1 file changed, 21 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -3612,24 +3612,35 @@ static int bond_neigh_init(struct neighb
+ const struct net_device_ops *slave_ops;
+ struct neigh_parms parms;
+ struct slave *slave;
+- int ret;
++ int ret = 0;
+
+- slave = bond_first_slave(bond);
++ rcu_read_lock();
++ slave = bond_first_slave_rcu(bond);
+ if (!slave)
+- return 0;
++ goto out;
+ slave_ops = slave->dev->netdev_ops;
+ if (!slave_ops->ndo_neigh_setup)
+- return 0;
++ goto out;
+
+- parms.neigh_setup = NULL;
++ /* TODO: find another way [1] to implement this.
++ * Passing a zeroed structure is fragile,
++ * but at least we do not pass garbage.
++ *
++ * [1] One way would be that ndo_neigh_setup() never touch
++ * struct neigh_parms, but propagate the new neigh_setup()
++ * back to ___neigh_create() / neigh_parms_alloc()
++ */
++ memset(&parms, 0, sizeof(parms));
+ ret = slave_ops->ndo_neigh_setup(slave->dev, &parms);
+- if (ret)
+- return ret;
+
+- if (!parms.neigh_setup)
+- return 0;
++ if (ret)
++ goto out;
+
+- return parms.neigh_setup(n);
++ if (parms.neigh_setup)
++ ret = parms.neigh_setup(n);
++out:
++ rcu_read_unlock();
++ return ret;
+ }
+
+ /* The bonding ndo_neigh_setup is called at init time beofre any
--- /dev/null
+From foo@baz Sat 28 Dec 2019 05:57:33 AM EST
+From: Ioana Ciornei <ioana.ciornei@nxp.com>
+Date: Mon, 16 Dec 2019 17:32:30 +0200
+Subject: dpaa2-ptp: fix double free of the ptp_qoriq IRQ
+
+From: Ioana Ciornei <ioana.ciornei@nxp.com>
+
+[ Upstream commit daa6eb5a149519583c8a8cb31945f06417d21902 ]
+
+Upon reusing the ptp_qoriq driver, the ptp_qoriq_free() function was
+used on the remove path to free any allocated resources.
+The ptp_qoriq IRQ is among these resources that are freed in
+ptp_qoriq_free() even though it is also a managed one (allocated using
+devm_request_threaded_irq).
+
+Drop the resource managed version of requesting the IRQ in order to not
+trigger a double free of the interrupt as below:
+
+[ 226.731005] Trying to free already-free IRQ 126
+[ 226.735533] WARNING: CPU: 6 PID: 749 at kernel/irq/manage.c:1707
+__free_irq+0x9c/0x2b8
+[ 226.743435] Modules linked in:
+[ 226.746480] CPU: 6 PID: 749 Comm: bash Tainted: G W
+5.4.0-03629-gfd7102c32b2c-dirty #912
+[ 226.755857] Hardware name: NXP Layerscape LX2160ARDB (DT)
+[ 226.761244] pstate: 40000085 (nZcv daIf -PAN -UAO)
+[ 226.766022] pc : __free_irq+0x9c/0x2b8
+[ 226.769758] lr : __free_irq+0x9c/0x2b8
+[ 226.773493] sp : ffff8000125039f0
+(...)
+[ 226.856275] Call trace:
+[ 226.858710] __free_irq+0x9c/0x2b8
+[ 226.862098] free_irq+0x30/0x70
+[ 226.865229] devm_irq_release+0x14/0x20
+[ 226.869054] release_nodes+0x1b0/0x220
+[ 226.872790] devres_release_all+0x34/0x50
+[ 226.876790] device_release_driver_internal+0x100/0x1c0
+
+Fixes: d346c9e86d86 ("dpaa2-ptp: reuse ptp_qoriq driver")
+Cc: Yangbo Lu <yangbo.lu@nxp.com>
+Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Reviewed-by: Yangbo Lu <yangbo.lu@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c
+@@ -160,10 +160,10 @@ static int dpaa2_ptp_probe(struct fsl_mc
+ irq = mc_dev->irqs[0];
+ ptp_qoriq->irq = irq->msi_desc->irq;
+
+- err = devm_request_threaded_irq(dev, ptp_qoriq->irq, NULL,
+- dpaa2_ptp_irq_handler_thread,
+- IRQF_NO_SUSPEND | IRQF_ONESHOT,
+- dev_name(dev), ptp_qoriq);
++ err = request_threaded_irq(ptp_qoriq->irq, NULL,
++ dpaa2_ptp_irq_handler_thread,
++ IRQF_NO_SUSPEND | IRQF_ONESHOT,
++ dev_name(dev), ptp_qoriq);
+ if (err < 0) {
+ dev_err(dev, "devm_request_threaded_irq(): %d\n", err);
+ goto err_free_mc_irq;
+@@ -173,18 +173,20 @@ static int dpaa2_ptp_probe(struct fsl_mc
+ DPRTC_IRQ_INDEX, 1);
+ if (err < 0) {
+ dev_err(dev, "dprtc_set_irq_enable(): %d\n", err);
+- goto err_free_mc_irq;
++ goto err_free_threaded_irq;
+ }
+
+ err = ptp_qoriq_init(ptp_qoriq, base, &dpaa2_ptp_caps);
+ if (err)
+- goto err_free_mc_irq;
++ goto err_free_threaded_irq;
+
+ dpaa2_phc_index = ptp_qoriq->phc_index;
+ dev_set_drvdata(dev, ptp_qoriq);
+
+ return 0;
+
++err_free_threaded_irq:
++ free_irq(ptp_qoriq->irq, ptp_qoriq);
+ err_free_mc_irq:
+ fsl_mc_free_irqs(mc_dev);
+ err_unmap:
--- /dev/null
+From foo@baz Sat 28 Dec 2019 05:57:33 AM EST
+From: Chuhong Yuan <hslester96@gmail.com>
+Date: Tue, 10 Dec 2019 00:22:07 +0800
+Subject: fjes: fix missed check in fjes_acpi_add
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit a288f105a03a7e0e629a8da2b31f34ebf0343ee2 ]
+
+fjes_acpi_add() misses a check for platform_device_register_simple().
+Add a check to fix it.
+
+Fixes: 658d439b2292 ("fjes: Introduce FUJITSU Extended Socket Network Device driver")
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/fjes/fjes_main.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/fjes/fjes_main.c
++++ b/drivers/net/fjes/fjes_main.c
+@@ -166,6 +166,9 @@ static int fjes_acpi_add(struct acpi_dev
+ /* create platform_device */
+ plat_dev = platform_device_register_simple(DRV_NAME, 0, fjes_resource,
+ ARRAY_SIZE(fjes_resource));
++ if (IS_ERR(plat_dev))
++ return PTR_ERR(plat_dev);
++
+ device->driver_data = plat_dev;
+
+ return 0;
--- /dev/null
+From foo@baz Sat 28 Dec 2019 05:57:33 AM EST
+From: Ido Schimmel <idosch@mellanox.com>
+Date: Mon, 9 Dec 2019 08:55:20 +0200
+Subject: mlxsw: spectrum_router: Remove unlikely user-triggerable warning
+
+From: Ido Schimmel <idosch@mellanox.com>
+
+[ Upstream commit 62201c00c4679ad8f0730d6d925a5d23651dfad2 ]
+
+In case the driver vetoes the addition of an IPv6 multipath route, the
+IPv6 stack will emit delete notifications for the sibling routes that
+were already added to the FIB trie. Since these siblings are not present
+in hardware, a warning will be generated.
+
+Have the driver ignore notifications for routes it does not have.
+
+Fixes: ebee3cad835f ("ipv6: Add IPv6 multipath notifications for add / replace")
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Acked-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+@@ -5637,8 +5637,13 @@ static void mlxsw_sp_router_fib6_del(str
+ if (mlxsw_sp_fib6_rt_should_ignore(rt))
+ return;
+
++ /* Multipath routes are first added to the FIB trie and only then
++ * notified. If we vetoed the addition, we will get a delete
++ * notification for a route we do not have. Therefore, do not warn if
++ * route was not found.
++ */
+ fib6_entry = mlxsw_sp_fib6_entry_lookup(mlxsw_sp, rt);
+- if (WARN_ON(!fib6_entry))
++ if (!fib6_entry)
+ return;
+
+ /* If not all the nexthops are deleted, then only reduce the nexthop
--- /dev/null
+From foo@baz Sat 28 Dec 2019 05:57:33 AM EST
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Thu, 19 Dec 2019 23:24:47 +0000
+Subject: mod_devicetable: fix PHY module format
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit d2ed49cf6c13e379c5819aa5ac20e1f9674ebc89 ]
+
+When a PHY is probed, if the top bit is set, we end up requesting a
+module with the string "mdio:-10101110000000100101000101010001" -
+the top bit is printed to a signed -1 value. This leads to the module
+not being loaded.
+
+Fix the module format string and the macro generating the values for
+it to ensure that we only print unsigned types and the top bit is
+always 0/1. We correctly end up with
+"mdio:10101110000000100101000101010001".
+
+Fixes: 8626d3b43280 ("phylib: Support phy module autoloading")
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/mod_devicetable.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/linux/mod_devicetable.h
++++ b/include/linux/mod_devicetable.h
+@@ -587,9 +587,9 @@ struct platform_device_id {
+ #define MDIO_NAME_SIZE 32
+ #define MDIO_MODULE_PREFIX "mdio:"
+
+-#define MDIO_ID_FMT "%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d"
++#define MDIO_ID_FMT "%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u"
+ #define MDIO_ID_ARGS(_id) \
+- (_id)>>31, ((_id)>>30) & 1, ((_id)>>29) & 1, ((_id)>>28) & 1, \
++ ((_id)>>31) & 1, ((_id)>>30) & 1, ((_id)>>29) & 1, ((_id)>>28) & 1, \
+ ((_id)>>27) & 1, ((_id)>>26) & 1, ((_id)>>25) & 1, ((_id)>>24) & 1, \
+ ((_id)>>23) & 1, ((_id)>>22) & 1, ((_id)>>21) & 1, ((_id)>>20) & 1, \
+ ((_id)>>19) & 1, ((_id)>>18) & 1, ((_id)>>17) & 1, ((_id)>>16) & 1, \
--- /dev/null
+From foo@baz Sat 28 Dec 2019 05:57:33 AM EST
+From: Eric Dumazet <edumazet@google.com>
+Date: Sat, 7 Dec 2019 12:23:21 -0800
+Subject: neighbour: remove neigh_cleanup() method
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit f394722fb0d0f701119368959d7cd0ecbc46363a ]
+
+neigh_cleanup() has not been used for seven years, and was a wrong design.
+
+Messing with shared pointer in bond_neigh_init() without proper
+memory barriers would at least trigger syzbot complains eventually.
+
+It is time to remove this stuff.
+
+Fixes: b63b70d87741 ("IPoIB: Use a private hash table for path lookup in xmit path")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/bonding/bond_main.c | 8 --------
+ include/net/neighbour.h | 1 -
+ net/core/neighbour.c | 3 ---
+ 3 files changed, 12 deletions(-)
+
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -3622,18 +3622,10 @@ static int bond_neigh_init(struct neighb
+ return 0;
+
+ parms.neigh_setup = NULL;
+- parms.neigh_cleanup = NULL;
+ ret = slave_ops->ndo_neigh_setup(slave->dev, &parms);
+ if (ret)
+ return ret;
+
+- /* Assign slave's neigh_cleanup to neighbour in case cleanup is called
+- * after the last slave has been detached. Assumes that all slaves
+- * utilize the same neigh_cleanup (true at this writing as only user
+- * is ipoib).
+- */
+- n->parms->neigh_cleanup = parms.neigh_cleanup;
+-
+ if (!parms.neigh_setup)
+ return 0;
+
+--- a/include/net/neighbour.h
++++ b/include/net/neighbour.h
+@@ -72,7 +72,6 @@ struct neigh_parms {
+ struct net_device *dev;
+ struct list_head list;
+ int (*neigh_setup)(struct neighbour *);
+- void (*neigh_cleanup)(struct neighbour *);
+ struct neigh_table *tbl;
+
+ void *sysctl_table;
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -98,9 +98,6 @@ static int neigh_blackhole(struct neighb
+
+ static void neigh_cleanup_and_release(struct neighbour *neigh)
+ {
+- if (neigh->parms->neigh_cleanup)
+- neigh->parms->neigh_cleanup(neigh);
+-
+ trace_neigh_cleanup_and_release(neigh, 0);
+ __neigh_notify(neigh, RTM_DELNEIGH, 0, 0);
+ call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
--- /dev/null
+From foo@baz Sat 28 Dec 2019 05:57:33 AM EST
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Fri, 13 Dec 2019 12:00:27 -0800
+Subject: net: dsa: b53: Fix egress flooding settings
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 63cc54a6f0736a432b04308a74677ab0ba8a58ee ]
+
+There were several issues with 53568438e381 ("net: dsa: b53: Add support for port_egress_floods callback") that resulted in breaking connectivity for standalone ports:
+
+- both user and CPU ports must allow unicast and multicast forwarding by
+ default otherwise this just flat out breaks connectivity for
+ standalone DSA ports
+- IP multicast is treated similarly as multicast, but has separate
+ control registers
+- the UC, MC and IPMC lookup failure register offsets were wrong, and
+ instead used bit values that are meaningful for the
+ B53_IP_MULTICAST_CTRL register
+
+Fixes: 53568438e381 ("net: dsa: b53: Add support for port_egress_floods callback")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Vivien Didelot <vivien.didelot@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/b53/b53_common.c | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -347,7 +347,7 @@ static void b53_set_forwarding(struct b5
+ * frames should be flooded or not.
+ */
+ b53_read8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, &mgmt);
+- mgmt |= B53_UC_FWD_EN | B53_MC_FWD_EN;
++ mgmt |= B53_UC_FWD_EN | B53_MC_FWD_EN | B53_IPMC_FWD_EN;
+ b53_write8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, mgmt);
+ }
+
+@@ -526,6 +526,8 @@ int b53_enable_port(struct dsa_switch *d
+
+ cpu_port = ds->ports[port].cpu_dp->index;
+
++ b53_br_egress_floods(ds, port, true, true);
++
+ if (dev->ops->irq_enable)
+ ret = dev->ops->irq_enable(dev, port);
+ if (ret)
+@@ -641,6 +643,8 @@ static void b53_enable_cpu_port(struct b
+ b53_write8(dev, B53_CTRL_PAGE, B53_PORT_CTRL(port), port_ctrl);
+
+ b53_brcm_hdr_setup(dev->ds, port);
++
++ b53_br_egress_floods(dev->ds, port, true, true);
+ }
+
+ static void b53_enable_mib(struct b53_device *dev)
+@@ -1766,19 +1770,26 @@ int b53_br_egress_floods(struct dsa_swit
+ struct b53_device *dev = ds->priv;
+ u16 uc, mc;
+
+- b53_read16(dev, B53_CTRL_PAGE, B53_UC_FWD_EN, &uc);
++ b53_read16(dev, B53_CTRL_PAGE, B53_UC_FLOOD_MASK, &uc);
+ if (unicast)
+ uc |= BIT(port);
+ else
+ uc &= ~BIT(port);
+- b53_write16(dev, B53_CTRL_PAGE, B53_UC_FWD_EN, uc);
++ b53_write16(dev, B53_CTRL_PAGE, B53_UC_FLOOD_MASK, uc);
++
++ b53_read16(dev, B53_CTRL_PAGE, B53_MC_FLOOD_MASK, &mc);
++ if (multicast)
++ mc |= BIT(port);
++ else
++ mc &= ~BIT(port);
++ b53_write16(dev, B53_CTRL_PAGE, B53_MC_FLOOD_MASK, mc);
+
+- b53_read16(dev, B53_CTRL_PAGE, B53_MC_FWD_EN, &mc);
++ b53_read16(dev, B53_CTRL_PAGE, B53_IPMC_FLOOD_MASK, &mc);
+ if (multicast)
+ mc |= BIT(port);
+ else
+ mc &= ~BIT(port);
+- b53_write16(dev, B53_CTRL_PAGE, B53_MC_FWD_EN, mc);
++ b53_write16(dev, B53_CTRL_PAGE, B53_IPMC_FLOOD_MASK, mc);
+
+ return 0;
+
--- /dev/null
+From foo@baz Sat 28 Dec 2019 05:57:33 AM EST
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+Date: Fri, 20 Dec 2019 14:31:40 +0100
+Subject: net: dst: Force 4-byte alignment of dst_metrics
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+[ Upstream commit 258a980d1ec23e2c786e9536a7dd260bea74bae6 ]
+
+When storing a pointer to a dst_metrics structure in dst_entry._metrics,
+two flags are added in the least significant bits of the pointer value.
+Hence this assumes all pointers to dst_metrics structures have at least
+4-byte alignment.
+
+However, on m68k, the minimum alignment of 32-bit values is 2 bytes, not
+4 bytes. Hence in some kernel builds, dst_default_metrics may be only
+2-byte aligned, leading to obscure boot warnings like:
+
+ WARNING: CPU: 0 PID: 7 at lib/refcount.c:28 refcount_warn_saturate+0x44/0x9a
+ refcount_t: underflow; use-after-free.
+ Modules linked in:
+ CPU: 0 PID: 7 Comm: ksoftirqd/0 Tainted: G W 5.5.0-rc2-atari-01448-g114a1a1038af891d-dirty #261
+ Stack from 10835e6c:
+ 10835e6c 0038134f 00023fa6 00394b0f 0000001c 00000009 00321560 00023fea
+ 00394b0f 0000001c 001a70f8 00000009 00000000 10835eb4 00000001 00000000
+ 04208040 0000000a 00394b4a 10835ed4 00043aa8 001a70f8 00394b0f 0000001c
+ 00000009 00394b4a 0026aba8 003215a4 00000003 00000000 0026d5a8 00000001
+ 003215a4 003a4361 003238d6 000001f0 00000000 003215a4 10aa3b00 00025e84
+ 003ddb00 10834000 002416a8 10aa3b00 00000000 00000080 000aa038 0004854a
+ Call Trace: [<00023fa6>] __warn+0xb2/0xb4
+ [<00023fea>] warn_slowpath_fmt+0x42/0x64
+ [<001a70f8>] refcount_warn_saturate+0x44/0x9a
+ [<00043aa8>] printk+0x0/0x18
+ [<001a70f8>] refcount_warn_saturate+0x44/0x9a
+ [<0026aba8>] refcount_sub_and_test.constprop.73+0x38/0x3e
+ [<0026d5a8>] ipv4_dst_destroy+0x5e/0x7e
+ [<00025e84>] __local_bh_enable_ip+0x0/0x8e
+ [<002416a8>] dst_destroy+0x40/0xae
+
+Fix this by forcing 4-byte alignment of all dst_metrics structures.
+
+Fixes: e5fd387ad5b30ca3 ("ipv6: do not overwrite inetpeer metrics prematurely")
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/dst.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/net/dst.h
++++ b/include/net/dst.h
+@@ -82,7 +82,7 @@ struct dst_entry {
+ struct dst_metrics {
+ u32 metrics[RTAX_MAX];
+ refcount_t refcnt;
+-};
++} __aligned(4); /* Low pointer bits contain DST_METRICS_FLAGS */
+ extern const struct dst_metrics dst_default_metrics;
+
+ u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old);
--- /dev/null
+From foo@baz Sat 28 Dec 2019 05:57:33 AM EST
+From: Arthur Kiyanovski <akiyano@amazon.com>
+Date: Thu, 19 Dec 2019 17:40:55 +0200
+Subject: net: ena: fix default tx interrupt moderation interval
+
+From: Arthur Kiyanovski <akiyano@amazon.com>
+
+[ Upstream commit 05785adf6e570a068adf0502b61fe2b521d7f0ca ]
+
+Current default non-adaptive tx interrupt moderation interval is 196 us.
+This value is too high and might cause the tx queue to fill up.
+
+In this commit we set the default non-adaptive tx interrupt moderation
+interval to 64 us in order to:
+1. Reduce the probability of the queue filling-up (when compared to the
+ current default value of 196 us).
+2. Reduce unnecessary tx interrupt overhead (which happens if we set the
+ default tx interval to 0).
+ We determined experimentally that 64 us is an optimal value that
+ reduces interrupt rate by more than 20% without affecting performance.
+
+Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
+Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_com.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_com.h
++++ b/drivers/net/ethernet/amazon/ena/ena_com.h
+@@ -72,7 +72,7 @@
+ /*****************************************************************************/
+ /* ENA adaptive interrupt moderation settings */
+
+-#define ENA_INTR_INITIAL_TX_INTERVAL_USECS 196
++#define ENA_INTR_INITIAL_TX_INTERVAL_USECS 64
+ #define ENA_INTR_INITIAL_RX_INTERVAL_USECS 0
+ #define ENA_DEFAULT_INTR_DELAY_RESOLUTION 1
+
--- /dev/null
+From foo@baz Sat 28 Dec 2019 05:57:33 AM EST
+From: Arthur Kiyanovski <akiyano@amazon.com>
+Date: Thu, 19 Dec 2019 17:40:56 +0200
+Subject: net: ena: fix issues in setting interrupt moderation params in ethtool
+
+From: Arthur Kiyanovski <akiyano@amazon.com>
+
+[ Upstream commit 41c53caa5a61ebc9221b71cc37f4a90549f1121d ]
+
+Issue 1:
+--------
+Reproduction steps:
+1. sudo ethtool -C eth0 rx-usecs 128
+2. sudo ethtool -C eth0 adaptive-rx on
+3. sudo ethtool -C eth0 adaptive-rx off
+4. ethtool -c eth0
+
+expected output: rx-usecs 128
+actual output: rx-usecs 0
+
+Reason for issue:
+In stage 3, ethtool userspace calls first the ena_get_coalesce() handler
+to get the current value of all properties, and then the ena_set_coalesce()
+handler. When ena_get_coalesce() is called the adaptive interrupt
+moderation is still on. There is an if in the code that returns the
+rx_coalesce_usecs only if the adaptive interrupt moderation is off.
+And since it is still on, rx_coalesce_usecs is not set, meaning it
+stays 0.
+
+Solution to issue:
+Remove this if static interrupt moderation intervals have nothing to do
+with dynamic ones.
+
+Issue 2:
+--------
+Reproduction steps:
+1. sudo ethtool -C eth0 adaptive-rx on
+2. sudo ethtool -C eth0 rx-usecs 128
+3. ethtool -c eth0
+
+expected output: rx-usecs 128
+actual output: rx-usecs 0
+
+Reason for issue:
+In stage 2, when ena_set_coalesce() is called, the handler tests if
+rx adaptive interrupt moderation is on, and if it is, it returns before
+getting to the part in the function that sets the rx non-adaptive
+interrupt moderation interval.
+
+Solution to issue:
+Remove the return from the function when rx adaptive interrupt moderation
+is on.
+
+Also cleaned up the fixed code in ena_set_coalesce by grouping together
+adaptive interrupt moderation toggling, and using && instead of nested
+ifs.
+
+Fixes: b3db86dc4b82 ("net: ena: reimplement set/get_coalesce()")
+Fixes: 0eda847953d8 ("net: ena: fix retrieval of nonadaptive interrupt moderation intervals")
+Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
+Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_ethtool.c | 24 ++++++++++--------------
+ 1 file changed, 10 insertions(+), 14 deletions(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+@@ -315,10 +315,9 @@ static int ena_get_coalesce(struct net_d
+ ena_com_get_nonadaptive_moderation_interval_tx(ena_dev) *
+ ena_dev->intr_delay_resolution;
+
+- if (!ena_com_get_adaptive_moderation_enabled(ena_dev))
+- coalesce->rx_coalesce_usecs =
+- ena_com_get_nonadaptive_moderation_interval_rx(ena_dev)
+- * ena_dev->intr_delay_resolution;
++ coalesce->rx_coalesce_usecs =
++ ena_com_get_nonadaptive_moderation_interval_rx(ena_dev)
++ * ena_dev->intr_delay_resolution;
+
+ coalesce->use_adaptive_rx_coalesce =
+ ena_com_get_adaptive_moderation_enabled(ena_dev);
+@@ -367,12 +366,6 @@ static int ena_set_coalesce(struct net_d
+
+ ena_update_tx_rings_intr_moderation(adapter);
+
+- if (coalesce->use_adaptive_rx_coalesce) {
+- if (!ena_com_get_adaptive_moderation_enabled(ena_dev))
+- ena_com_enable_adaptive_moderation(ena_dev);
+- return 0;
+- }
+-
+ rc = ena_com_update_nonadaptive_moderation_interval_rx(ena_dev,
+ coalesce->rx_coalesce_usecs);
+ if (rc)
+@@ -380,10 +373,13 @@ static int ena_set_coalesce(struct net_d
+
+ ena_update_rx_rings_intr_moderation(adapter);
+
+- if (!coalesce->use_adaptive_rx_coalesce) {
+- if (ena_com_get_adaptive_moderation_enabled(ena_dev))
+- ena_com_disable_adaptive_moderation(ena_dev);
+- }
++ if (coalesce->use_adaptive_rx_coalesce &&
++ !ena_com_get_adaptive_moderation_enabled(ena_dev))
++ ena_com_enable_adaptive_moderation(ena_dev);
++
++ if (!coalesce->use_adaptive_rx_coalesce &&
++ ena_com_get_adaptive_moderation_enabled(ena_dev))
++ ena_com_disable_adaptive_moderation(ena_dev);
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Sat 28 Dec 2019 05:57:33 AM EST
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+Date: Mon, 9 Dec 2019 13:19:24 +0200
+Subject: net: ethernet: ti: davinci_cpdma: fix warning "device driver frees DMA memory with different size"
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+[ Upstream commit 8a2b22203f8596729c54eba221b4044351bfe167 ]
+
+The TI CPSW(s) driver produces warning with DMA API debug options enabled:
+
+WARNING: CPU: 0 PID: 1033 at kernel/dma/debug.c:1025 check_unmap+0x4a8/0x968
+DMA-API: cpsw 48484000.ethernet: device driver frees DMA memory with different size
+ [device address=0x00000000abc6aa02] [map size=64 bytes] [unmap size=42 bytes]
+CPU: 0 PID: 1033 Comm: ping Not tainted 5.3.0-dirty #41
+Hardware name: Generic DRA72X (Flattened Device Tree)
+[<c0112c60>] (unwind_backtrace) from [<c010d270>] (show_stack+0x10/0x14)
+[<c010d270>] (show_stack) from [<c09bc564>] (dump_stack+0xd8/0x110)
+[<c09bc564>] (dump_stack) from [<c013b93c>] (__warn+0xe0/0x10c)
+[<c013b93c>] (__warn) from [<c013b9ac>] (warn_slowpath_fmt+0x44/0x6c)
+[<c013b9ac>] (warn_slowpath_fmt) from [<c01e0368>] (check_unmap+0x4a8/0x968)
+[<c01e0368>] (check_unmap) from [<c01e08a8>] (debug_dma_unmap_page+0x80/0x90)
+[<c01e08a8>] (debug_dma_unmap_page) from [<c0752414>] (__cpdma_chan_free+0x114/0x16c)
+[<c0752414>] (__cpdma_chan_free) from [<c07525c4>] (__cpdma_chan_process+0x158/0x17c)
+[<c07525c4>] (__cpdma_chan_process) from [<c0753690>] (cpdma_chan_process+0x3c/0x5c)
+[<c0753690>] (cpdma_chan_process) from [<c0758660>] (cpsw_tx_mq_poll+0x48/0x94)
+[<c0758660>] (cpsw_tx_mq_poll) from [<c0803018>] (net_rx_action+0x108/0x4e4)
+[<c0803018>] (net_rx_action) from [<c010230c>] (__do_softirq+0xec/0x598)
+[<c010230c>] (__do_softirq) from [<c0143914>] (do_softirq.part.4+0x68/0x74)
+[<c0143914>] (do_softirq.part.4) from [<c0143a44>] (__local_bh_enable_ip+0x124/0x17c)
+[<c0143a44>] (__local_bh_enable_ip) from [<c0871590>] (ip_finish_output2+0x294/0xb7c)
+[<c0871590>] (ip_finish_output2) from [<c0875440>] (ip_output+0x210/0x364)
+[<c0875440>] (ip_output) from [<c0875e2c>] (ip_send_skb+0x1c/0xf8)
+[<c0875e2c>] (ip_send_skb) from [<c08a7fd4>] (raw_sendmsg+0x9a8/0xc74)
+[<c08a7fd4>] (raw_sendmsg) from [<c07d6b90>] (sock_sendmsg+0x14/0x24)
+[<c07d6b90>] (sock_sendmsg) from [<c07d8260>] (__sys_sendto+0xbc/0x100)
+[<c07d8260>] (__sys_sendto) from [<c01011ac>] (__sys_trace_return+0x0/0x14)
+Exception stack(0xea9a7fa8 to 0xea9a7ff0)
+...
+
+The reason is that cpdma_chan_submit_si() now stores original buffer length
+(sw_len) in CPDMA descriptor instead of adjusted buffer length (hw_len)
+used to map the buffer.
+
+Hence, fix an issue by passing correct buffer length in CPDMA descriptor.
+
+Cc: Ivan Khoronzhuk <ivan.khoronzhuk@linaro.org>
+Fixes: 6670acacd59e ("net: ethernet: ti: davinci_cpdma: add dma mapped submit")
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Reviewed-by: Ivan Khoronzhuk <ivan.khoronzhuk@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ti/davinci_cpdma.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/ti/davinci_cpdma.c
++++ b/drivers/net/ethernet/ti/davinci_cpdma.c
+@@ -1018,7 +1018,6 @@ static int cpdma_chan_submit_si(struct s
+ struct cpdma_chan *chan = si->chan;
+ struct cpdma_ctlr *ctlr = chan->ctlr;
+ int len = si->len;
+- int swlen = len;
+ struct cpdma_desc __iomem *desc;
+ dma_addr_t buffer;
+ u32 mode;
+@@ -1046,7 +1045,6 @@ static int cpdma_chan_submit_si(struct s
+ if (si->data_dma) {
+ buffer = si->data_dma;
+ dma_sync_single_for_device(ctlr->dev, buffer, len, chan->dir);
+- swlen |= CPDMA_DMA_EXT_MAP;
+ } else {
+ buffer = dma_map_single(ctlr->dev, si->data_virt, len, chan->dir);
+ ret = dma_mapping_error(ctlr->dev, buffer);
+@@ -1065,7 +1063,8 @@ static int cpdma_chan_submit_si(struct s
+ writel_relaxed(mode | len, &desc->hw_mode);
+ writel_relaxed((uintptr_t)si->token, &desc->sw_token);
+ writel_relaxed(buffer, &desc->sw_buffer);
+- writel_relaxed(swlen, &desc->sw_len);
++ writel_relaxed(si->data_dma ? len | CPDMA_DMA_EXT_MAP : len,
++ &desc->sw_len);
+ desc_read(desc, sw_len);
+
+ __cpdma_chan_submit(chan, desc);
--- /dev/null
+From foo@baz Sat 28 Dec 2019 05:57:33 AM EST
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+Date: Sat, 14 Dec 2019 19:10:44 -0600
+Subject: net: gemini: Fix memory leak in gmac_setup_txqs
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit f37f710353677639bc5d37ee785335994adf2529 ]
+
+In the implementation of gmac_setup_txqs() the allocated desc_ring is
+leaked if TX queue base is not aligned. Release it via
+dma_free_coherent.
+
+Fixes: 4d5ae32f5e1e ("net: ethernet: Add a driver for Gemini gigabit ethernet")
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/cortina/gemini.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/ethernet/cortina/gemini.c
++++ b/drivers/net/ethernet/cortina/gemini.c
+@@ -576,6 +576,8 @@ static int gmac_setup_txqs(struct net_de
+
+ if (port->txq_dma_base & ~DMA_Q_BASE_MASK) {
+ dev_warn(geth->dev, "TX queue base is not aligned\n");
++ dma_free_coherent(geth->dev, len * sizeof(*desc_ring),
++ desc_ring, port->txq_dma_base);
+ kfree(skb_tab);
+ return -ENOMEM;
+ }
--- /dev/null
+From foo@baz Sat 28 Dec 2019 05:57:33 AM EST
+From: Jiangfeng Xiao <xiaojiangfeng@huawei.com>
+Date: Thu, 19 Dec 2019 10:08:07 +0800
+Subject: net: hisilicon: Fix a BUG trigered by wrong bytes_compl
+
+From: Jiangfeng Xiao <xiaojiangfeng@huawei.com>
+
+[ Upstream commit 90b3b339364c76baa2436445401ea9ade040c216 ]
+
+When doing stress test, we get the following trace:
+kernel BUG at lib/dynamic_queue_limits.c:26!
+Internal error: Oops - BUG: 0 [#1] SMP ARM
+Modules linked in: hip04_eth
+CPU: 0 PID: 2003 Comm: tDblStackPcap0 Tainted: G O L 4.4.197 #1
+Hardware name: Hisilicon A15
+task: c3637668 task.stack: de3bc000
+PC is at dql_completed+0x18/0x154
+LR is at hip04_tx_reclaim+0x110/0x174 [hip04_eth]
+pc : [<c041abfc>] lr : [<bf0003a8>] psr: 800f0313
+sp : de3bdc2c ip : 00000000 fp : c020fb10
+r10: 00000000 r9 : c39b4224 r8 : 00000001
+r7 : 00000046 r6 : c39b4000 r5 : 0078f392 r4 : 0078f392
+r3 : 00000047 r2 : 00000000 r1 : 00000046 r0 : df5d5c80
+Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
+Control: 32c5387d Table: 1e189b80 DAC: 55555555
+Process tDblStackPcap0 (pid: 2003, stack limit = 0xde3bc190)
+Stack: (0xde3bdc2c to 0xde3be000)
+[<c041abfc>] (dql_completed) from [<bf0003a8>] (hip04_tx_reclaim+0x110/0x174 [hip04_eth])
+[<bf0003a8>] (hip04_tx_reclaim [hip04_eth]) from [<bf0012c0>] (hip04_rx_poll+0x20/0x388 [hip04_eth])
+[<bf0012c0>] (hip04_rx_poll [hip04_eth]) from [<c04c8d9c>] (net_rx_action+0x120/0x374)
+[<c04c8d9c>] (net_rx_action) from [<c021eaf4>] (__do_softirq+0x218/0x318)
+[<c021eaf4>] (__do_softirq) from [<c021eea0>] (irq_exit+0x88/0xac)
+[<c021eea0>] (irq_exit) from [<c0240130>] (msa_irq_exit+0x11c/0x1d4)
+[<c0240130>] (msa_irq_exit) from [<c0267ba8>] (__handle_domain_irq+0x110/0x148)
+[<c0267ba8>] (__handle_domain_irq) from [<c0201588>] (gic_handle_irq+0xd4/0x118)
+[<c0201588>] (gic_handle_irq) from [<c0558360>] (__irq_svc+0x40/0x58)
+Exception stack(0xde3bdde0 to 0xde3bde28)
+dde0: 00000000 00008001 c3637668 00000000 00000000 a00f0213 dd3627a0 c0af6380
+de00: c086d380 a00f0213 c0a22a50 de3bde6c 00000002 de3bde30 c0558138 c055813c
+de20: 600f0213 ffffffff
+[<c0558360>] (__irq_svc) from [<c055813c>] (_raw_spin_unlock_irqrestore+0x44/0x54)
+Kernel panic - not syncing: Fatal exception in interrupt
+
+Pre-modification code:
+int hip04_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+{
+[...]
+[1] priv->tx_head = TX_NEXT(tx_head);
+[2] count++;
+[3] netdev_sent_queue(ndev, skb->len);
+[...]
+}
+An rx interrupt occurs if hip04_mac_start_xmit just executes to the line 2,
+tx_head has been updated, but corresponding 'skb->len' has not been
+added to dql_queue.
+
+And then
+hip04_mac_interrupt->__napi_schedule->hip04_rx_poll->hip04_tx_reclaim
+
+In hip04_tx_reclaim, because tx_head has been updated,
+bytes_compl will plus an additional "skb-> len"
+which has not been added to dql_queue. And then
+trigger the BUG_ON(bytes_compl > num_queued - dql->num_completed).
+
+To solve the problem described above, we put
+"netdev_sent_queue(ndev, skb->len);"
+before
+"priv->tx_head = TX_NEXT(tx_head);"
+
+Fixes: a41ea46a9a12 ("net: hisilicon: new hip04 ethernet driver")
+Signed-off-by: Jiangfeng Xiao <xiaojiangfeng@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hip04_eth.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/hisilicon/hip04_eth.c
++++ b/drivers/net/ethernet/hisilicon/hip04_eth.c
+@@ -543,9 +543,9 @@ hip04_mac_start_xmit(struct sk_buff *skb
+ skb_tx_timestamp(skb);
+
+ hip04_set_xmit_desc(priv, phys);
+- priv->tx_head = TX_NEXT(tx_head);
+ count++;
+ netdev_sent_queue(ndev, skb->len);
++ priv->tx_head = TX_NEXT(tx_head);
+
+ stats->tx_bytes += skb->len;
+ stats->tx_packets++;
--- /dev/null
+From foo@baz Sat 28 Dec 2019 05:57:33 AM EST
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+Date: Wed, 18 Dec 2019 17:21:55 +0800
+Subject: net: nfc: nci: fix a possible sleep-in-atomic-context bug in nci_uart_tty_receive()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit b7ac893652cafadcf669f78452329727e4e255cc ]
+
+The kernel may sleep while holding a spinlock.
+The function call path (from bottom to top) in Linux 4.19 is:
+
+net/nfc/nci/uart.c, 349:
+ nci_skb_alloc in nci_uart_default_recv_buf
+net/nfc/nci/uart.c, 255:
+ (FUNC_PTR)nci_uart_default_recv_buf in nci_uart_tty_receive
+net/nfc/nci/uart.c, 254:
+ spin_lock in nci_uart_tty_receive
+
+nci_skb_alloc(GFP_KERNEL) can sleep at runtime.
+(FUNC_PTR) means a function pointer is called.
+
+To fix this bug, GFP_KERNEL is replaced with GFP_ATOMIC for
+nci_skb_alloc().
+
+This bug is found by a static analysis tool STCheck written by myself.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/nfc/nci/uart.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/nfc/nci/uart.c
++++ b/net/nfc/nci/uart.c
+@@ -346,7 +346,7 @@ static int nci_uart_default_recv_buf(str
+ nu->rx_packet_len = -1;
+ nu->rx_skb = nci_skb_alloc(nu->ndev,
+ NCI_MAX_PACKET_SIZE,
+- GFP_KERNEL);
++ GFP_ATOMIC);
+ if (!nu->rx_skb)
+ return -ENOMEM;
+ }
--- /dev/null
+From foo@baz Sat 28 Dec 2019 05:57:33 AM EST
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Thu, 19 Dec 2019 23:24:52 +0000
+Subject: net: phy: ensure that phy IDs are correctly typed
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 7d49a32a66d2215c5b3bf9bc67c9036ea9904111 ]
+
+PHY IDs are 32-bit unsigned quantities. Ensure that they are always
+treated as such, and not passed around as "int"s.
+
+Fixes: 13d0ab6750b2 ("net: phy: check return code when requesting PHY driver module")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/phy_device.c | 8 ++++----
+ include/linux/phy.h | 2 +-
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -552,7 +552,7 @@ static const struct device_type mdio_bus
+ .pm = MDIO_BUS_PHY_PM_OPS,
+ };
+
+-static int phy_request_driver_module(struct phy_device *dev, int phy_id)
++static int phy_request_driver_module(struct phy_device *dev, u32 phy_id)
+ {
+ int ret;
+
+@@ -564,15 +564,15 @@ static int phy_request_driver_module(str
+ * then modprobe isn't available.
+ */
+ if (IS_ENABLED(CONFIG_MODULES) && ret < 0 && ret != -ENOENT) {
+- phydev_err(dev, "error %d loading PHY driver module for ID 0x%08x\n",
+- ret, phy_id);
++ phydev_err(dev, "error %d loading PHY driver module for ID 0x%08lx\n",
++ ret, (unsigned long)phy_id);
+ return ret;
+ }
+
+ return 0;
+ }
+
+-struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id,
++struct phy_device *phy_device_create(struct mii_bus *bus, int addr, u32 phy_id,
+ bool is_c45,
+ struct phy_c45_device_ids *c45_ids)
+ {
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -993,7 +993,7 @@ int phy_modify_paged_changed(struct phy_
+ int phy_modify_paged(struct phy_device *phydev, int page, u32 regnum,
+ u16 mask, u16 set);
+
+-struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id,
++struct phy_device *phy_device_create(struct mii_bus *bus, int addr, u32 phy_id,
+ bool is_c45,
+ struct phy_c45_device_ids *c45_ids);
+ #if IS_ENABLED(CONFIG_PHYLIB)
--- /dev/null
+From foo@baz Sat 28 Dec 2019 05:57:33 AM EST
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Tue, 17 Dec 2019 01:57:40 +0000
+Subject: net: qlogic: Fix error paths in ql_alloc_large_buffers()
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+[ Upstream commit cad46039e4c99812db067c8ac22a864960e7acc4 ]
+
+ql_alloc_large_buffers() has the usual RX buffer allocation
+loop where it allocates skbs and maps them for DMA. It also
+treats failure as a fatal error.
+
+There are (at least) three bugs in the error paths:
+
+1. ql_free_large_buffers() assumes that the lrg_buf[] entry for the
+first buffer that couldn't be allocated will have .skb == NULL.
+But the qla_buf[] array is not zero-initialised.
+
+2. ql_free_large_buffers() DMA-unmaps all skbs in lrg_buf[]. This is
+incorrect for the last allocated skb, if DMA mapping failed.
+
+3. Commit 1acb8f2a7a9f ("net: qlogic: Fix memory leak in
+ql_alloc_large_buffers") added a direct call to dev_kfree_skb_any()
+after the skb is recorded in lrg_buf[], so ql_free_large_buffers()
+will double-free it.
+
+The bugs are somewhat inter-twined, so fix them all at once:
+
+* Clear each entry in qla_buf[] before attempting to allocate
+ an skb for it. This goes half-way to fixing bug 1.
+* Set the .skb field only after the skb is DMA-mapped. This
+ fixes the rest.
+
+Fixes: 1357bfcf7106 ("qla3xxx: Dynamically size the rx buffer queue ...")
+Fixes: 0f8ab89e825f ("qla3xxx: Check return code from pci_map_single() ...")
+Fixes: 1acb8f2a7a9f ("net: qlogic: Fix memory leak in ql_alloc_large_buffers")
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qla3xxx.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qla3xxx.c
++++ b/drivers/net/ethernet/qlogic/qla3xxx.c
+@@ -2756,6 +2756,9 @@ static int ql_alloc_large_buffers(struct
+ int err;
+
+ for (i = 0; i < qdev->num_large_buffers; i++) {
++ lrg_buf_cb = &qdev->lrg_buf[i];
++ memset(lrg_buf_cb, 0, sizeof(struct ql_rcv_buf_cb));
++
+ skb = netdev_alloc_skb(qdev->ndev,
+ qdev->lrg_buffer_len);
+ if (unlikely(!skb)) {
+@@ -2766,11 +2769,7 @@ static int ql_alloc_large_buffers(struct
+ ql_free_large_buffers(qdev);
+ return -ENOMEM;
+ } else {
+-
+- lrg_buf_cb = &qdev->lrg_buf[i];
+- memset(lrg_buf_cb, 0, sizeof(struct ql_rcv_buf_cb));
+ lrg_buf_cb->index = i;
+- lrg_buf_cb->skb = skb;
+ /*
+ * We save some space to copy the ethhdr from first
+ * buffer
+@@ -2792,6 +2791,7 @@ static int ql_alloc_large_buffers(struct
+ return -ENOMEM;
+ }
+
++ lrg_buf_cb->skb = skb;
+ dma_unmap_addr_set(lrg_buf_cb, mapaddr, map);
+ dma_unmap_len_set(lrg_buf_cb, maplen,
+ qdev->lrg_buffer_len -
--- /dev/null
+From foo@baz Sat 28 Dec 2019 05:57:33 AM EST
+From: Padmanabhan Rajanbabu <p.rajanbabu@samsung.com>
+Date: Thu, 19 Dec 2019 15:47:01 +0530
+Subject: net: stmmac: platform: Fix MDIO init for platforms without PHY
+
+From: Padmanabhan Rajanbabu <p.rajanbabu@samsung.com>
+
+[ Upstream commit d3e014ec7d5ebe9644b5486bc530b91e62bbf624 ]
+
+The current implementation of "stmmac_dt_phy" function initializes
+the MDIO platform bus data, even in the absence of PHY. This fix
+will skip MDIO initialization if there is no PHY present.
+
+Fixes: 7437127 ("net: stmmac: Convert to phylink and remove phylib logic")
+Acked-by: Jayati Sahu <jayati.sahu@samsung.com>
+Signed-off-by: Sriram Dash <sriram.dash@samsung.com>
+Signed-off-by: Padmanabhan Rajanbabu <p.rajanbabu@samsung.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+@@ -320,7 +320,7 @@ out:
+ static int stmmac_dt_phy(struct plat_stmmacenet_data *plat,
+ struct device_node *np, struct device *dev)
+ {
+- bool mdio = true;
++ bool mdio = false;
+ static const struct of_device_id need_mdio_ids[] = {
+ { .compatible = "snps,dwc-qos-ethernet-4.10" },
+ {},
--- /dev/null
+From foo@baz Sat 28 Dec 2019 05:57:33 AM EST
+From: Jouni Hogander <jouni.hogander@unikie.com>
+Date: Tue, 17 Dec 2019 13:46:34 +0200
+Subject: net-sysfs: Call dev_hold always in rx_queue_add_kobject
+
+From: Jouni Hogander <jouni.hogander@unikie.com>
+
+[ Upstream commit ddd9b5e3e765d8ed5a35786a6cb00111713fe161 ]
+
+Dev_hold has to be called always in rx_queue_add_kobject.
+Otherwise usage count drops below 0 in case of failure in
+kobject_init_and_add.
+
+Fixes: b8eb718348b8 ("net-sysfs: Fix reference count leak in rx|netdev_queue_add_kobject")
+Reported-by: syzbot <syzbot+30209ea299c09d8785c9@syzkaller.appspotmail.com>
+Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Cc: David Miller <davem@davemloft.net>
+Cc: Lukas Bulwahn <lukas.bulwahn@gmail.com>
+Signed-off-by: Jouni Hogander <jouni.hogander@unikie.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/net-sysfs.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/net/core/net-sysfs.c
++++ b/net/core/net-sysfs.c
+@@ -919,14 +919,17 @@ static int rx_queue_add_kobject(struct n
+ struct kobject *kobj = &queue->kobj;
+ int error = 0;
+
++ /* Kobject_put later will trigger rx_queue_release call which
++ * decreases dev refcount: Take that reference here
++ */
++ dev_hold(queue->dev);
++
+ kobj->kset = dev->queues_kset;
+ error = kobject_init_and_add(kobj, &rx_queue_ktype, NULL,
+ "rx-%u", index);
+ if (error)
+ goto err;
+
+- dev_hold(queue->dev);
+-
+ if (dev->sysfs_rx_queue_group) {
+ error = sysfs_create_group(kobj, dev->sysfs_rx_queue_group);
+ if (error)
--- /dev/null
+From foo@baz Sat 28 Dec 2019 05:57:33 AM EST
+From: Cristian Birsan <cristian.birsan@microchip.com>
+Date: Thu, 12 Dec 2019 13:52:47 +0200
+Subject: net: usb: lan78xx: Fix suspend/resume PHY register access error
+
+From: Cristian Birsan <cristian.birsan@microchip.com>
+
+[ Upstream commit 20032b63586ac6c28c936dff696981159913a13f ]
+
+Lan78xx driver accesses the PHY registers through MDIO bus over USB
+connection. When performing a suspend/resume, the PHY registers can be
+accessed before the USB connection is resumed. This will generate an
+error and will prevent the device to resume correctly.
+This patch adds the dependency between the MDIO bus and USB device to
+allow correct handling of suspend/resume.
+
+Fixes: ce85e13ad6ef ("lan78xx: Update to use phylib instead of mii_if_info.")
+Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/lan78xx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -1808,6 +1808,7 @@ static int lan78xx_mdio_init(struct lan7
+ dev->mdiobus->read = lan78xx_mdiobus_read;
+ dev->mdiobus->write = lan78xx_mdiobus_write;
+ dev->mdiobus->name = "lan78xx-mdiobus";
++ dev->mdiobus->parent = &dev->udev->dev;
+
+ snprintf(dev->mdiobus->id, MII_BUS_ID_SIZE, "usb-%03d:%03d",
+ dev->udev->bus->busnum, dev->udev->devnum);
--- /dev/null
+From foo@baz Sat 28 Dec 2019 05:57:33 AM EST
+From: Stephan Gerhold <stephan@gerhold.net>
+Date: Mon, 9 Dec 2019 19:53:43 +0100
+Subject: NFC: nxp-nci: Fix probing without ACPI
+
+From: Stephan Gerhold <stephan@gerhold.net>
+
+[ Upstream commit 868afbaca1e2a7923e48b5e8c07be34660525db5 ]
+
+devm_acpi_dev_add_driver_gpios() returns -ENXIO if CONFIG_ACPI
+is disabled (e.g. on device tree platforms).
+In this case, nxp-nci will silently fail to probe.
+
+The other NFC drivers only log a debug message if
+devm_acpi_dev_add_driver_gpios() fails.
+Do the same in nxp-nci to fix this problem.
+
+Fixes: ad0acfd69add ("NFC: nxp-nci: Get rid of code duplication in ->probe()")
+Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Acked-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nfc/nxp-nci/i2c.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nfc/nxp-nci/i2c.c
++++ b/drivers/nfc/nxp-nci/i2c.c
+@@ -278,7 +278,7 @@ static int nxp_nci_i2c_probe(struct i2c_
+
+ r = devm_acpi_dev_add_driver_gpios(dev, acpi_nxp_nci_gpios);
+ if (r)
+- return r;
++ dev_dbg(dev, "Unable to add GPIO mapping table\n");
+
+ phy->gpiod_en = devm_gpiod_get(dev, "enable", GPIOD_OUT_LOW);
+ if (IS_ERR(phy->gpiod_en)) {
--- /dev/null
+From foo@baz Sat 28 Dec 2019 05:57:33 AM EST
+From: John Hurley <john.hurley@netronome.com>
+Date: Tue, 17 Dec 2019 11:28:56 +0000
+Subject: nfp: flower: fix stats id allocation
+
+From: John Hurley <john.hurley@netronome.com>
+
+[ Upstream commit 39f14c00b13c47186739a4cbc7a16e04d7fdbb60 ]
+
+As flower rules are added, they are given a stats ID based on the number
+of rules that can be supported in firmware. Only after the initial
+allocation of all available IDs does the driver begin to reuse those that
+have been released.
+
+The initial allocation of IDs was modified to account for multiple memory
+units on the offloaded device. However, this introduced a bug whereby the
+counter that controls the IDs could be decremented before the ID was
+assigned (where it is further decremented). This means that the stats ID
+could be assigned as -1/0xfffffff which is out of range.
+
+Fix this by only decrementing the main counter after the current ID has
+been assigned.
+
+Fixes: 467322e2627f ("nfp: flower: support multiple memory units for filter offloads")
+Signed-off-by: John Hurley <john.hurley@netronome.com>
+Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/netronome/nfp/flower/metadata.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/netronome/nfp/flower/metadata.c
++++ b/drivers/net/ethernet/netronome/nfp/flower/metadata.c
+@@ -65,17 +65,17 @@ static int nfp_get_stats_entry(struct nf
+ freed_stats_id = priv->stats_ring_size;
+ /* Check for unallocated entries first. */
+ if (priv->stats_ids.init_unalloc > 0) {
+- if (priv->active_mem_unit == priv->total_mem_units) {
+- priv->stats_ids.init_unalloc--;
+- priv->active_mem_unit = 0;
+- }
+-
+ *stats_context_id =
+ FIELD_PREP(NFP_FL_STAT_ID_STAT,
+ priv->stats_ids.init_unalloc - 1) |
+ FIELD_PREP(NFP_FL_STAT_ID_MU_NUM,
+ priv->active_mem_unit);
+- priv->active_mem_unit++;
++
++ if (++priv->active_mem_unit == priv->total_mem_units) {
++ priv->stats_ids.init_unalloc--;
++ priv->active_mem_unit = 0;
++ }
++
+ return 0;
+ }
+
--- /dev/null
+From foo@baz Sat 28 Dec 2019 05:57:33 AM EST
+From: Manish Chopra <manishc@marvell.com>
+Date: Thu, 19 Dec 2019 10:35:16 -0800
+Subject: qede: Disable hardware gro when xdp prog is installed
+
+From: Manish Chopra <manishc@marvell.com>
+
+[ Upstream commit 4c8dc00503db24deaf0b89dddfa84b7cba7cd4ce ]
+
+commit 18c602dee472 ("qede: Use NETIF_F_GRO_HW.") introduced
+a regression in driver that when xdp program is installed on
+qede device, device's aggregation feature (hardware GRO) is not
+getting disabled, which is unexpected with xdp.
+
+Fixes: 18c602dee472 ("qede: Use NETIF_F_GRO_HW.")
+Signed-off-by: Manish Chopra <manishc@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Reviewed-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qede/qede_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
+@@ -1406,6 +1406,7 @@ static int qede_alloc_mem_rxq(struct qed
+ rxq->rx_buf_seg_size = roundup_pow_of_two(size);
+ } else {
+ rxq->rx_buf_seg_size = PAGE_SIZE;
++ edev->ndev->features &= ~NETIF_F_GRO_HW;
+ }
+
+ /* Allocate the parallel driver ring for Rx buffers */
+@@ -1450,6 +1451,7 @@ static int qede_alloc_mem_rxq(struct qed
+ }
+ }
+
++ edev->gro_disable = !(edev->ndev->features & NETIF_F_GRO_HW);
+ if (!edev->gro_disable)
+ qede_set_tpa_param(rxq);
+ err:
+@@ -1702,8 +1704,6 @@ static void qede_init_fp(struct qede_dev
+ snprintf(fp->name, sizeof(fp->name), "%s-fp-%d",
+ edev->ndev->name, queue_id);
+ }
+-
+- edev->gro_disable = !(edev->ndev->features & NETIF_F_GRO_HW);
+ }
+
+ static int qede_set_real_num_queues(struct qede_dev *edev)
--- /dev/null
+From foo@baz Sat 28 Dec 2019 05:57:33 AM EST
+From: Manish Chopra <manishc@marvell.com>
+Date: Thu, 12 Dec 2019 06:49:28 -0800
+Subject: qede: Fix multicast mac configuration
+
+From: Manish Chopra <manishc@marvell.com>
+
+[ Upstream commit 0af67e49b018e7280a4227bfe7b6005bc9d3e442 ]
+
+Driver doesn't accommodate the configuration for max number
+of multicast mac addresses, in such particular case it leaves
+the device with improper/invalid multicast configuration state,
+causing connectivity issues (in lacp bonding like scenarios).
+
+Signed-off-by: Manish Chopra <manishc@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qede/qede_filter.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/qlogic/qede/qede_filter.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_filter.c
+@@ -1230,7 +1230,7 @@ qede_configure_mcast_filtering(struct ne
+ netif_addr_lock_bh(ndev);
+
+ mc_count = netdev_mc_count(ndev);
+- if (mc_count < 64) {
++ if (mc_count <= 64) {
+ netdev_for_each_mc_addr(ha, ndev) {
+ ether_addr_copy(temp, ha->addr);
+ temp += ETH_ALEN;
--- /dev/null
+From foo@baz Sat 28 Dec 2019 05:57:33 AM EST
+From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Date: Mon, 16 Dec 2019 22:01:16 -0300
+Subject: sctp: fix memleak on err handling of stream initialization
+
+From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+
+[ Upstream commit 951c6db954a1adefab492f6da805decacabbd1a7 ]
+
+syzbot reported a memory leak when an allocation fails within
+genradix_prealloc() for output streams. That's because
+genradix_prealloc() leaves initialized members initialized when the
+issue happens and SCTP stack will abort the current initialization but
+without cleaning up such members.
+
+The fix here is to always call genradix_free() when genradix_prealloc()
+fails, for output and also input streams, as it suffers from the same
+issue.
+
+Reported-by: syzbot+772d9e36c490b18d51d1@syzkaller.appspotmail.com
+Fixes: 2075e50caf5e ("sctp: convert to genradix")
+Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Tested-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sctp/stream.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/net/sctp/stream.c
++++ b/net/sctp/stream.c
+@@ -84,8 +84,10 @@ static int sctp_stream_alloc_out(struct
+ return 0;
+
+ ret = genradix_prealloc(&stream->out, outcnt, gfp);
+- if (ret)
++ if (ret) {
++ genradix_free(&stream->out);
+ return ret;
++ }
+
+ stream->outcnt = outcnt;
+ return 0;
+@@ -100,8 +102,10 @@ static int sctp_stream_alloc_in(struct s
+ return 0;
+
+ ret = genradix_prealloc(&stream->in, incnt, gfp);
+- if (ret)
++ if (ret) {
++ genradix_free(&stream->in);
+ return ret;
++ }
+
+ stream->incnt = incnt;
+ return 0;
--- /dev/null
+From foo@baz Sat 28 Dec 2019 05:57:33 AM EST
+From: Xin Long <lucien.xin@gmail.com>
+Date: Mon, 9 Dec 2019 13:45:54 +0800
+Subject: sctp: fully initialize v4 addr in some functions
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit b6f3320b1d5267e7b583a6d0c88dda518101740c ]
+
+Syzbot found a crash:
+
+ BUG: KMSAN: uninit-value in crc32_body lib/crc32.c:112 [inline]
+ BUG: KMSAN: uninit-value in crc32_le_generic lib/crc32.c:179 [inline]
+ BUG: KMSAN: uninit-value in __crc32c_le_base+0x4fa/0xd30 lib/crc32.c:202
+ Call Trace:
+ crc32_body lib/crc32.c:112 [inline]
+ crc32_le_generic lib/crc32.c:179 [inline]
+ __crc32c_le_base+0x4fa/0xd30 lib/crc32.c:202
+ chksum_update+0xb2/0x110 crypto/crc32c_generic.c:90
+ crypto_shash_update+0x4c5/0x530 crypto/shash.c:107
+ crc32c+0x150/0x220 lib/libcrc32c.c:47
+ sctp_csum_update+0x89/0xa0 include/net/sctp/checksum.h:36
+ __skb_checksum+0x1297/0x12a0 net/core/skbuff.c:2640
+ sctp_compute_cksum include/net/sctp/checksum.h:59 [inline]
+ sctp_packet_pack net/sctp/output.c:528 [inline]
+ sctp_packet_transmit+0x40fb/0x4250 net/sctp/output.c:597
+ sctp_outq_flush_transports net/sctp/outqueue.c:1146 [inline]
+ sctp_outq_flush+0x1823/0x5d80 net/sctp/outqueue.c:1194
+ sctp_outq_uncork+0xd0/0xf0 net/sctp/outqueue.c:757
+ sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1781 [inline]
+ sctp_side_effects net/sctp/sm_sideeffect.c:1184 [inline]
+ sctp_do_sm+0x8fe1/0x9720 net/sctp/sm_sideeffect.c:1155
+ sctp_primitive_REQUESTHEARTBEAT+0x175/0x1a0 net/sctp/primitive.c:185
+ sctp_apply_peer_addr_params+0x212/0x1d40 net/sctp/socket.c:2433
+ sctp_setsockopt_peer_addr_params net/sctp/socket.c:2686 [inline]
+ sctp_setsockopt+0x189bb/0x19090 net/sctp/socket.c:4672
+
+The issue was caused by transport->ipaddr set with uninit addr param, which
+was passed by:
+
+ sctp_transport_init net/sctp/transport.c:47 [inline]
+ sctp_transport_new+0x248/0xa00 net/sctp/transport.c:100
+ sctp_assoc_add_peer+0x5ba/0x2030 net/sctp/associola.c:611
+ sctp_process_param net/sctp/sm_make_chunk.c:2524 [inline]
+
+where 'addr' is set by sctp_v4_from_addr_param(), and it doesn't initialize
+the padding of addr->v4.
+
+Later when calling sctp_make_heartbeat(), hbinfo.daddr(=transport->ipaddr)
+will become the part of skb, and the issue occurs.
+
+This patch is to fix it by initializing the padding of addr->v4 in
+sctp_v4_from_addr_param(), as well as other functions that do the similar
+thing, and these functions shouldn't trust that the caller initializes the
+memory, as Marcelo suggested.
+
+Reported-by: syzbot+6dcbfea81cd3d4dd0b02@syzkaller.appspotmail.com
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: Neil Horman <nhorman@tuxdriver.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sctp/protocol.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/net/sctp/protocol.c
++++ b/net/sctp/protocol.c
+@@ -227,6 +227,7 @@ static void sctp_v4_from_skb(union sctp_
+ sa->sin_port = sh->dest;
+ sa->sin_addr.s_addr = ip_hdr(skb)->daddr;
+ }
++ memset(sa->sin_zero, 0, sizeof(sa->sin_zero));
+ }
+
+ /* Initialize an sctp_addr from a socket. */
+@@ -235,6 +236,7 @@ static void sctp_v4_from_sk(union sctp_a
+ addr->v4.sin_family = AF_INET;
+ addr->v4.sin_port = 0;
+ addr->v4.sin_addr.s_addr = inet_sk(sk)->inet_rcv_saddr;
++ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero));
+ }
+
+ /* Initialize sk->sk_rcv_saddr from sctp_addr. */
+@@ -257,6 +259,7 @@ static void sctp_v4_from_addr_param(unio
+ addr->v4.sin_family = AF_INET;
+ addr->v4.sin_port = port;
+ addr->v4.sin_addr.s_addr = param->v4.addr.s_addr;
++ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero));
+ }
+
+ /* Initialize an address parameter from a sctp_addr and return the length
+@@ -281,6 +284,7 @@ static void sctp_v4_dst_saddr(union sctp
+ saddr->v4.sin_family = AF_INET;
+ saddr->v4.sin_port = port;
+ saddr->v4.sin_addr.s_addr = fl4->saddr;
++ memset(saddr->v4.sin_zero, 0, sizeof(saddr->v4.sin_zero));
+ }
+
+ /* Compare two addresses exactly. */
+@@ -303,6 +307,7 @@ static void sctp_v4_inaddr_any(union sct
+ addr->v4.sin_family = AF_INET;
+ addr->v4.sin_addr.s_addr = htonl(INADDR_ANY);
+ addr->v4.sin_port = port;
++ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero));
+ }
+
+ /* Is this a wildcard address? */
--- /dev/null
+From foo@baz Sat 28 Dec 2019 05:57:33 AM EST
+From: Ido Schimmel <idosch@mellanox.com>
+Date: Mon, 9 Dec 2019 08:56:34 +0200
+Subject: selftests: forwarding: Delete IPv6 address at the end
+
+From: Ido Schimmel <idosch@mellanox.com>
+
+[ Upstream commit 65cb13986229cec02635a1ecbcd1e2dd18353201 ]
+
+When creating the second host in h2_create(), two addresses are assigned
+to the interface, but only one is deleted. When running the test twice
+in a row the following error is observed:
+
+$ ./router_bridge_vlan.sh
+TEST: ping [ OK ]
+TEST: ping6 [ OK ]
+TEST: vlan [ OK ]
+$ ./router_bridge_vlan.sh
+RTNETLINK answers: File exists
+TEST: ping [ OK ]
+TEST: ping6 [ OK ]
+TEST: vlan [ OK ]
+
+Fix this by deleting the address during cleanup.
+
+Fixes: 5b1e7f9ebd56 ("selftests: forwarding: Test routed bridge interface")
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/forwarding/router_bridge_vlan.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/testing/selftests/net/forwarding/router_bridge_vlan.sh
++++ b/tools/testing/selftests/net/forwarding/router_bridge_vlan.sh
+@@ -36,7 +36,7 @@ h2_destroy()
+ {
+ ip -6 route del 2001:db8:1::/64 vrf v$h2
+ ip -4 route del 192.0.2.0/28 vrf v$h2
+- simple_if_fini $h2 192.0.2.130/28
++ simple_if_fini $h2 192.0.2.130/28 2001:db8:2::2/64
+ }
+
+ router_create()
+af_packet-set-defaule-value-for-tmo.patch
+fjes-fix-missed-check-in-fjes_acpi_add.patch
+mod_devicetable-fix-phy-module-format.patch
+net-dst-force-4-byte-alignment-of-dst_metrics.patch
+net-gemini-fix-memory-leak-in-gmac_setup_txqs.patch
+net-hisilicon-fix-a-bug-trigered-by-wrong-bytes_compl.patch
+net-nfc-nci-fix-a-possible-sleep-in-atomic-context-bug-in-nci_uart_tty_receive.patch
+net-phy-ensure-that-phy-ids-are-correctly-typed.patch
+net-qlogic-fix-error-paths-in-ql_alloc_large_buffers.patch
+net-sysfs-call-dev_hold-always-in-rx_queue_add_kobject.patch
+net-usb-lan78xx-fix-suspend-resume-phy-register-access-error.patch
+nfp-flower-fix-stats-id-allocation.patch
+qede-disable-hardware-gro-when-xdp-prog-is-installed.patch
+qede-fix-multicast-mac-configuration.patch
+sctp-fix-memleak-on-err-handling-of-stream-initialization.patch
+sctp-fully-initialize-v4-addr-in-some-functions.patch
+selftests-forwarding-delete-ipv6-address-at-the-end.patch
+neighbour-remove-neigh_cleanup-method.patch
+bonding-fix-bond_neigh_init.patch
+net-ena-fix-default-tx-interrupt-moderation-interval.patch
+net-ena-fix-issues-in-setting-interrupt-moderation-params-in-ethtool.patch
+dpaa2-ptp-fix-double-free-of-the-ptp_qoriq-irq.patch
+mlxsw-spectrum_router-remove-unlikely-user-triggerable-warning.patch
+net-ethernet-ti-davinci_cpdma-fix-warning-device-driver-frees-dma-memory-with-different-size.patch
+net-stmmac-platform-fix-mdio-init-for-platforms-without-phy.patch
+net-dsa-b53-fix-egress-flooding-settings.patch
+nfc-nxp-nci-fix-probing-without-acpi.patch
btrfs-don-t-double-lock-the-subvol_sem-for-rename-exchange.patch
btrfs-do-not-call-synchronize_srcu-in-inode_tree_del.patch
btrfs-make-tree-checker-detect-checksum-items-with-overlapping-ranges.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
