--- /dev/null
+From 15145c479a00f88324a41d6d989fe51a5d2e1c82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jul 2021 10:11:41 +0300
+Subject: e1000e: Fix the max snoop/no-snoop latency for 10M
+
+From: Sasha Neftin <sasha.neftin@intel.com>
+
+[ Upstream commit 44a13a5d99c71bf9e1676d9e51679daf4d7b3d73 ]
+
+We should decode the latency and the max_latency before directly compare.
+The latency should be presented as lat_enc = scale x value:
+lat_enc_d = (lat_enc & 0x0x3ff) x (1U << (5*((max_ltr_enc & 0x1c00)
+>> 10)))
+
+Fixes: cf8fb73c23aa ("e1000e: add support for LTR on I217/I218")
+Suggested-by: Yee Li <seven.yi.lee@gmail.com>
+Signed-off-by: Sasha Neftin <sasha.neftin@intel.com>
+Tested-by: Dvora Fuxbrumer <dvorax.fuxbrumer@linux.intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/e1000e/ich8lan.c | 14 +++++++++++++-
+ drivers/net/ethernet/intel/e1000e/ich8lan.h | 3 +++
+ 2 files changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+index 1e990f9dd379..9d5fe4ea9cee 100644
+--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+@@ -1013,6 +1013,8 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link)
+ {
+ u32 reg = link << (E1000_LTRV_REQ_SHIFT + E1000_LTRV_NOSNOOP_SHIFT) |
+ link << E1000_LTRV_REQ_SHIFT | E1000_LTRV_SEND;
++ u16 max_ltr_enc_d = 0; /* maximum LTR decoded by platform */
++ u16 lat_enc_d = 0; /* latency decoded */
+ u16 lat_enc = 0; /* latency encoded */
+
+ if (link) {
+@@ -1066,7 +1068,17 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link)
+ E1000_PCI_LTR_CAP_LPT + 2, &max_nosnoop);
+ max_ltr_enc = max_t(u16, max_snoop, max_nosnoop);
+
+- if (lat_enc > max_ltr_enc)
++ lat_enc_d = (lat_enc & E1000_LTRV_VALUE_MASK) *
++ (1U << (E1000_LTRV_SCALE_FACTOR *
++ ((lat_enc & E1000_LTRV_SCALE_MASK)
++ >> E1000_LTRV_SCALE_SHIFT)));
++
++ max_ltr_enc_d = (max_ltr_enc & E1000_LTRV_VALUE_MASK) *
++ (1U << (E1000_LTRV_SCALE_FACTOR *
++ ((max_ltr_enc & E1000_LTRV_SCALE_MASK)
++ >> E1000_LTRV_SCALE_SHIFT)));
++
++ if (lat_enc_d > max_ltr_enc_d)
+ lat_enc = max_ltr_enc;
+ }
+
+diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h
+index 88df80c0894b..e32012d39827 100644
+--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h
++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h
+@@ -292,8 +292,11 @@
+
+ /* Latency Tolerance Reporting */
+ #define E1000_LTRV 0x000F8
++#define E1000_LTRV_VALUE_MASK 0x000003FF
+ #define E1000_LTRV_SCALE_MAX 5
+ #define E1000_LTRV_SCALE_FACTOR 5
++#define E1000_LTRV_SCALE_SHIFT 10
++#define E1000_LTRV_SCALE_MASK 0x00001C00
+ #define E1000_LTRV_REQ_SHIFT 15
+ #define E1000_LTRV_NOSNOOP_SHIFT 16
+ #define E1000_LTRV_SEND (1 << 30)
+--
+2.30.2
+
--- /dev/null
+From 92865539997200faa466ce4058d7a16868662abf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Aug 2021 06:30:29 -0700
+Subject: IB/hfi1: Fix possible null-pointer dereference in
+ _extend_sdma_tx_descs()
+
+From: Tuo Li <islituo@gmail.com>
+
+[ Upstream commit cbe71c61992c38f72c2b625b2ef25916b9f0d060 ]
+
+kmalloc_array() is called to allocate memory for tx->descp. If it fails,
+the function __sdma_txclean() is called:
+ __sdma_txclean(dd, tx);
+
+However, in the function __sdma_txclean(), tx-descp is dereferenced if
+tx->num_desc is not zero:
+ sdma_unmap_desc(dd, &tx->descp[0]);
+
+To fix this possible null-pointer dereference, assign the return value of
+kmalloc_array() to a local variable descp, and then assign it to tx->descp
+if it is not NULL. Otherwise, go to enomem.
+
+Fixes: 7724105686e7 ("IB/hfi1: add driver files")
+Link: https://lore.kernel.org/r/20210806133029.194964-1-islituo@gmail.com
+Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
+Signed-off-by: Tuo Li <islituo@gmail.com>
+Tested-by: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
+Acked-by: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/sdma.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c
+index 741938409f8e..c1c6d2c570aa 100644
+--- a/drivers/infiniband/hw/hfi1/sdma.c
++++ b/drivers/infiniband/hw/hfi1/sdma.c
+@@ -3067,6 +3067,7 @@ static void __sdma_process_event(struct sdma_engine *sde,
+ static int _extend_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx)
+ {
+ int i;
++ struct sdma_desc *descp;
+
+ /* Handle last descriptor */
+ if (unlikely((tx->num_desc == (MAX_DESC - 1)))) {
+@@ -3087,12 +3088,10 @@ static int _extend_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx)
+ if (unlikely(tx->num_desc == MAX_DESC))
+ goto enomem;
+
+- tx->descp = kmalloc_array(
+- MAX_DESC,
+- sizeof(struct sdma_desc),
+- GFP_ATOMIC);
+- if (!tx->descp)
++ descp = kmalloc_array(MAX_DESC, sizeof(struct sdma_desc), GFP_ATOMIC);
++ if (!descp)
+ goto enomem;
++ tx->descp = descp;
+
+ /* reserve last descriptor for coalescing */
+ tx->desc_limit = MAX_DESC - 1;
+--
+2.30.2
+
--- /dev/null
+From df4780363e223926b09f4617f430872bf42b6964 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Aug 2021 12:44:24 +0530
+Subject: ip_gre: add validation for csum_start
+
+From: Shreyansh Chouhan <chouhan.shreyansh630@gmail.com>
+
+[ Upstream commit 1d011c4803c72f3907eccfc1ec63caefb852fcbf ]
+
+Validate csum_start in gre_handle_offloads before we call _gre_xmit so
+that we do not crash later when the csum_start value is used in the
+lco_csum function call.
+
+This patch deals with ipv4 code.
+
+Fixes: c54419321455 ("GRE: Refactor GRE tunneling code.")
+Reported-by: syzbot+ff8e1b9f2f36481e2efc@syzkaller.appspotmail.com
+Signed-off-by: Shreyansh Chouhan <chouhan.shreyansh630@gmail.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_gre.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index 9940a59306b5..1a4d89f8361c 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -443,6 +443,8 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev,
+
+ static int gre_handle_offloads(struct sk_buff *skb, bool csum)
+ {
++ if (csum && skb_checksum_start(skb) < skb->data)
++ return -EINVAL;
+ return iptunnel_handle_offloads(skb, csum ? SKB_GSO_GRE_CSUM : SKB_GSO_GRE);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 53b72e4a4e94cd099ae2679977b5cc4b015e018c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Aug 2021 18:39:51 +0300
+Subject: net: marvell: fix MVNETA_TX_IN_PRGRS bit number
+
+From: Maxim Kiselev <bigunclemax@gmail.com>
+
+[ Upstream commit 359f4cdd7d78fdf8c098713b05fee950a730f131 ]
+
+According to Armada XP datasheet bit at 0 position is corresponding for
+TxInProg indication.
+
+Fixes: c5aff18204da ("net: mvneta: driver for Marvell Armada 370/XP network unit")
+Signed-off-by: Maxim Kiselev <bigunclemax@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/mvneta.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index cc0414fd1355..8fde1515aec7 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -100,7 +100,7 @@
+ #define MVNETA_DESC_SWAP BIT(6)
+ #define MVNETA_TX_BRST_SZ_MASK(burst) ((burst) << 22)
+ #define MVNETA_PORT_STATUS 0x2444
+-#define MVNETA_TX_IN_PRGRS BIT(1)
++#define MVNETA_TX_IN_PRGRS BIT(0)
+ #define MVNETA_TX_FIFO_EMPTY BIT(8)
+ #define MVNETA_RX_MIN_FRAME_SIZE 0x247c
+ #define MVNETA_SERDES_CFG 0x24A0
+--
+2.30.2
+
usb-serial-option-add-new-vid-pid-to-support-fibocom-fg150.patch
usb-dwc3-gadget-fix-dwc3_calc_trbs_left.patch
usb-dwc3-gadget-stop-ep0-transfers-during-pullup-disable.patch
+ib-hfi1-fix-possible-null-pointer-dereference-in-_ex.patch
+e1000e-fix-the-max-snoop-no-snoop-latency-for-10m.patch
+ip_gre-add-validation-for-csum_start.patch
+xgene-v2-fix-a-resource-leak-in-the-error-handling-p.patch
+net-marvell-fix-mvneta_tx_in_prgrs-bit-number.patch
+usb-gadget-u_audio-fix-race-condition-on-endpoint-st.patch
--- /dev/null
+From 7e64bb9f1ab0ba5c02daee8a62ea2e8968d81fdc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Aug 2021 11:29:27 +0200
+Subject: usb: gadget: u_audio: fix race condition on endpoint stop
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 068fdad20454f815e61e6f6eb9f051a8b3120e88 ]
+
+If the endpoint completion callback is call right after the ep_enabled flag
+is cleared and before usb_ep_dequeue() is call, we could do a double free
+on the request and the associated buffer.
+
+Fix this by clearing ep_enabled after all the endpoint requests have been
+dequeued.
+
+Fixes: 7de8681be2cd ("usb: gadget: u_audio: Free requests only after callback")
+Cc: stable <stable@vger.kernel.org>
+Reported-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lore.kernel.org/r/20210827092927.366482-1-jbrunet@baylibre.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/u_audio.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
+index 0370a1314b88..af6339ff6d2f 100644
+--- a/drivers/usb/gadget/function/u_audio.c
++++ b/drivers/usb/gadget/function/u_audio.c
+@@ -358,8 +358,6 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep)
+ if (!prm->ep_enabled)
+ return;
+
+- prm->ep_enabled = false;
+-
+ audio_dev = uac->audio_dev;
+ params = &audio_dev->params;
+
+@@ -377,11 +375,12 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep)
+ }
+ }
+
++ prm->ep_enabled = false;
++
+ if (usb_ep_disable(ep))
+ dev_err(uac->card->dev, "%s:%d Error!\n", __func__, __LINE__);
+ }
+
+-
+ int u_audio_start_capture(struct g_audio *audio_dev)
+ {
+ struct snd_uac_chip *uac = audio_dev->uac;
+--
+2.30.2
+
--- /dev/null
+From 9299ed3a087a7ce0a8952eb30e9847e2671d3505 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Aug 2021 09:35:23 +0200
+Subject: xgene-v2: Fix a resource leak in the error handling path of
+ 'xge_probe()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 5ed74b03eb4d08f5dd281dcb5f1c9bb92b363a8d ]
+
+A successful 'xge_mdio_config()' call should be balanced by a corresponding
+'xge_mdio_remove()' call in the error handling path of the probe, as
+already done in the remove function.
+
+Update the error handling path accordingly.
+
+Fixes: ea8ab16ab225 ("drivers: net: xgene-v2: Add MDIO support")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/apm/xgene-v2/main.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/apm/xgene-v2/main.c b/drivers/net/ethernet/apm/xgene-v2/main.c
+index 0f2ad50f3bd7..7f37e7cb687e 100644
+--- a/drivers/net/ethernet/apm/xgene-v2/main.c
++++ b/drivers/net/ethernet/apm/xgene-v2/main.c
+@@ -691,11 +691,13 @@ static int xge_probe(struct platform_device *pdev)
+ ret = register_netdev(ndev);
+ if (ret) {
+ netdev_err(ndev, "Failed to register netdev\n");
+- goto err;
++ goto err_mdio_remove;
+ }
+
+ return 0;
+
++err_mdio_remove:
++ xge_mdio_remove(ndev);
+ err:
+ free_netdev(ndev);
+
+--
+2.30.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
