Fixes for 4.9

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-4.9/bonding-fix-ad_actor_system-option-setting-to-defaul.patch b/queue-4.9/bonding-fix-ad_actor_system-option-setting-to-defaul.patch
new file mode 100644 (file)
index 0000000..5b1282b
--- /dev/null
+++ b/queue-4.9/bonding-fix-ad_actor_system-option-setting-to-defaul.patch
@@ -0,0 +1,65 @@
+From 2d2142471313e69e2ca78a067db18608af4ea13c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Dec 2021 12:13:45 +0100
+Subject: bonding: fix ad_actor_system option setting to default
+
+From: Fernando Fernandez Mancera <ffmancera@riseup.net>
+
+[ Upstream commit 1c15b05baea71a5ff98235783e3e4ad227760876 ]
+
+When 802.3ad bond mode is configured the ad_actor_system option is set to
+"00:00:00:00:00:00". But when trying to set the all-zeroes MAC as actors'
+system address it was failing with EINVAL.
+
+An all-zeroes ethernet address is valid, only multicast addresses are not
+valid values.
+
+Fixes: 171a42c38c6e ("bonding: add netlink support for sys prio, actor sys mac, and port key")
+Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net>
+Acked-by: Jay Vosburgh <jay.vosburgh@canonical.com>
+Link: https://lore.kernel.org/r/20211221111345.2462-1-ffmancera@riseup.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/networking/bonding.txt | 11 ++++++-----
+ drivers/net/bonding/bond_options.c   |  2 +-
+ 2 files changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/Documentation/networking/bonding.txt b/Documentation/networking/bonding.txt
+index 57f52cdce32e4..07b53b2b13df8 100644
+--- a/Documentation/networking/bonding.txt
++++ b/Documentation/networking/bonding.txt
+@@ -191,11 +191,12 @@ ad_actor_sys_prio
+ ad_actor_system
+ 
+       In an AD system, this specifies the mac-address for the actor in
+-      protocol packet exchanges (LACPDUs). The value cannot be NULL or
+-      multicast. It is preferred to have the local-admin bit set for this
+-      mac but driver does not enforce it. If the value is not given then
+-      system defaults to using the masters' mac address as actors' system
+-      address.
++      protocol packet exchanges (LACPDUs). The value cannot be a multicast
++      address. If the all-zeroes MAC is specified, bonding will internally
++      use the MAC of the bond itself. It is preferred to have the
++      local-admin bit set for this mac but driver does not enforce it. If
++      the value is not given then system defaults to using the masters'
++      mac address as actors' system address.
+ 
+       This parameter has effect only in 802.3ad mode and is available through
+       SysFs interface.
+diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
+index 258cb3999b0e3..5c6a962363096 100644
+--- a/drivers/net/bonding/bond_options.c
++++ b/drivers/net/bonding/bond_options.c
+@@ -1408,7 +1408,7 @@ static int bond_option_ad_actor_system_set(struct bonding *bond,
+               mac = (u8 *)&newval->value;
+       }
+ 
+-      if (!is_valid_ether_addr(mac))
++      if (is_multicast_ether_addr(mac))
+               goto err;
+ 
+       netdev_info(bond->dev, "Setting ad_actor_system to %pM\n", mac);
+-- 
+2.34.1
+

diff --git a/queue-4.9/drivers-net-smc911x-check-for-error-irq.patch b/queue-4.9/drivers-net-smc911x-check-for-error-irq.patch
new file mode 100644 (file)
index 0000000..457d6d9
--- /dev/null
+++ b/queue-4.9/drivers-net-smc911x-check-for-error-irq.patch
@@ -0,0 +1,40 @@
+From e8cb85376babbc56287d7f368d88b954428ce088 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Dec 2021 15:41:12 +0800
+Subject: drivers: net: smc911x: Check for error irq
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit cb93b3e11d405f20a405a07482d01147ef4934a3 ]
+
+Because platform_get_irq() could fail and return error irq.
+Therefore, it might be better to check it if order to avoid the use of
+error irq.
+
+Fixes: ae150435b59e ("smsc: Move the SMC (SMSC) drivers")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/smsc/smc911x.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/ethernet/smsc/smc911x.c b/drivers/net/ethernet/smsc/smc911x.c
+index d0cf971aa4ebe..4237bd311e0e6 100644
+--- a/drivers/net/ethernet/smsc/smc911x.c
++++ b/drivers/net/ethernet/smsc/smc911x.c
+@@ -2088,6 +2088,11 @@ static int smc911x_drv_probe(struct platform_device *pdev)
+ 
+       ndev->dma = (unsigned char)-1;
+       ndev->irq = platform_get_irq(pdev, 0);
++      if (ndev->irq < 0) {
++              ret = ndev->irq;
++              goto release_both;
++      }
++
+       lp = netdev_priv(ndev);
+       lp->netdev = ndev;
+ #ifdef SMC_DYNAMIC_BUS_CONFIG
+-- 
+2.34.1
+

diff --git a/queue-4.9/fjes-check-for-error-irq.patch b/queue-4.9/fjes-check-for-error-irq.patch
new file mode 100644 (file)
index 0000000..f0b4fbd
--- /dev/null
+++ b/queue-4.9/fjes-check-for-error-irq.patch
@@ -0,0 +1,41 @@
+From b0941b09115d590ecd130acb05f8956045f8b89d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Dec 2021 15:12:07 +0800
+Subject: fjes: Check for error irq
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit db6d6afe382de5a65d6ccf51253ab48b8e8336c3 ]
+
+I find that platform_get_irq() will not always succeed.
+It will return error irq in case of the failure.
+Therefore, it might be better to check it if order to avoid the use of
+error irq.
+
+Fixes: 658d439b2292 ("fjes: Introduce FUJITSU Extended Socket Network Device driver")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/fjes/fjes_main.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c
+index 440047a239f57..26bb43a675131 100644
+--- a/drivers/net/fjes/fjes_main.c
++++ b/drivers/net/fjes/fjes_main.c
+@@ -1219,6 +1219,11 @@ static int fjes_probe(struct platform_device *plat_dev)
+       hw->hw_res.start = res->start;
+       hw->hw_res.size = resource_size(res);
+       hw->hw_res.irq = platform_get_irq(plat_dev, 0);
++      if (hw->hw_res.irq < 0) {
++              err = hw->hw_res.irq;
++              goto err_free_control_wq;
++      }
++
+       err = fjes_hw_init(&adapter->hw);
+       if (err)
+               goto err_free_control_wq;
+-- 
+2.34.1
+

diff --git a/queue-4.9/ib-qib-fix-memory-leak-in-qib_user_sdma_queue_pkts.patch b/queue-4.9/ib-qib-fix-memory-leak-in-qib_user_sdma_queue_pkts.patch
new file mode 100644 (file)
index 0000000..64912aa
--- /dev/null
+++ b/queue-4.9/ib-qib-fix-memory-leak-in-qib_user_sdma_queue_pkts.patch
@@ -0,0 +1,42 @@
+From b3e4cb488e3002c4baa3d897f173041c0f902bca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Dec 2021 18:52:38 +0100
+Subject: IB/qib: Fix memory leak in qib_user_sdma_queue_pkts()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: José Expósito <jose.exposito89@gmail.com>
+
+[ Upstream commit bee90911e0138c76ee67458ac0d58b38a3190f65 ]
+
+The wrong goto label was used for the error case and missed cleanup of the
+pkt allocation.
+
+Fixes: d39bf40e55e6 ("IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields")
+Link: https://lore.kernel.org/r/20211208175238.29983-1-jose.exposito89@gmail.com
+Addresses-Coverity-ID: 1493352 ("Resource leak")
+Signed-off-by: José Expósito <jose.exposito89@gmail.com>
+Acked-by: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/qib/qib_user_sdma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/qib/qib_user_sdma.c b/drivers/infiniband/hw/qib/qib_user_sdma.c
+index 0dc15f95e7626..2d0b992579d6f 100644
+--- a/drivers/infiniband/hw/qib/qib_user_sdma.c
++++ b/drivers/infiniband/hw/qib/qib_user_sdma.c
+@@ -946,7 +946,7 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
+                                              &addrlimit) ||
+                           addrlimit > type_max(typeof(pkt->addrlimit))) {
+                               ret = -EINVAL;
+-                              goto free_pbc;
++                              goto free_pkt;
+                       }
+                       pkt->addrlimit = addrlimit;
+ 
+-- 
+2.34.1
+

diff --git a/queue-4.9/qlcnic-potential-dereference-null-pointer-of-rx_queu.patch b/queue-4.9/qlcnic-potential-dereference-null-pointer-of-rx_queu.patch
new file mode 100644 (file)
index 0000000..b003874
--- /dev/null
+++ b/queue-4.9/qlcnic-potential-dereference-null-pointer-of-rx_queu.patch
@@ -0,0 +1,103 @@
+From 9e666320f8a90b23c2ef3e3c26de6cf843f61532 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Dec 2021 17:39:11 +0800
+Subject: qlcnic: potential dereference null pointer of rx_queue->page_ring
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 60ec7fcfe76892a1479afab51ff17a4281923156 ]
+
+The return value of kcalloc() needs to be checked.
+To avoid dereference of null pointer in case of the failure of alloc.
+Therefore, it might be better to change the return type of
+qlcnic_sriov_alloc_vlans() and return -ENOMEM when alloc fails and
+return 0 the others.
+Also, qlcnic_sriov_set_guest_vlan_mode() and __qlcnic_pci_sriov_enable()
+should deal with the return value of qlcnic_sriov_alloc_vlans().
+
+Fixes: 154d0c810c53 ("qlcnic: VLAN enhancement for 84XX adapters")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h    |  2 +-
+ .../net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c | 12 +++++++++---
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c |  4 +++-
+ 3 files changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h
+index 5f327659efa7a..85b688f60b876 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h
+@@ -202,7 +202,7 @@ int qlcnic_sriov_get_vf_vport_info(struct qlcnic_adapter *,
+                                  struct qlcnic_info *, u16);
+ int qlcnic_sriov_cfg_vf_guest_vlan(struct qlcnic_adapter *, u16, u8);
+ void qlcnic_sriov_free_vlans(struct qlcnic_adapter *);
+-void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *);
++int qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *);
+ bool qlcnic_sriov_check_any_vlan(struct qlcnic_vf_info *);
+ void qlcnic_sriov_del_vlan_id(struct qlcnic_sriov *,
+                             struct qlcnic_vf_info *, u16);
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+index c58180f408448..44caa7c2077ec 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+@@ -433,7 +433,7 @@ static int qlcnic_sriov_set_guest_vlan_mode(struct qlcnic_adapter *adapter,
+                                           struct qlcnic_cmd_args *cmd)
+ {
+       struct qlcnic_sriov *sriov = adapter->ahw->sriov;
+-      int i, num_vlans;
++      int i, num_vlans, ret;
+       u16 *vlans;
+ 
+       if (sriov->allowed_vlans)
+@@ -444,7 +444,9 @@ static int qlcnic_sriov_set_guest_vlan_mode(struct qlcnic_adapter *adapter,
+       dev_info(&adapter->pdev->dev, "Number of allowed Guest VLANs = %d\n",
+                sriov->num_allowed_vlans);
+ 
+-      qlcnic_sriov_alloc_vlans(adapter);
++      ret = qlcnic_sriov_alloc_vlans(adapter);
++      if (ret)
++              return ret;
+ 
+       if (!sriov->any_vlan)
+               return 0;
+@@ -2164,7 +2166,7 @@ static int qlcnic_sriov_vf_resume(struct qlcnic_adapter *adapter)
+       return err;
+ }
+ 
+-void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter)
++int qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter)
+ {
+       struct qlcnic_sriov *sriov = adapter->ahw->sriov;
+       struct qlcnic_vf_info *vf;
+@@ -2174,7 +2176,11 @@ void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter)
+               vf = &sriov->vf_info[i];
+               vf->sriov_vlans = kcalloc(sriov->num_allowed_vlans,
+                                         sizeof(*vf->sriov_vlans), GFP_KERNEL);
++              if (!vf->sriov_vlans)
++                      return -ENOMEM;
+       }
++
++      return 0;
+ }
+ 
+ void qlcnic_sriov_free_vlans(struct qlcnic_adapter *adapter)
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
+index 50eaafa3eaba3..c9f2cd2462230 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
+@@ -598,7 +598,9 @@ static int __qlcnic_pci_sriov_enable(struct qlcnic_adapter *adapter,
+       if (err)
+               goto del_flr_queue;
+ 
+-      qlcnic_sriov_alloc_vlans(adapter);
++      err = qlcnic_sriov_alloc_vlans(adapter);
++      if (err)
++              goto del_flr_queue;
+ 
+       return err;
+ 
+-- 
+2.34.1
+

diff --git a/queue-4.9/series b/queue-4.9/series
index 9f87a9b2c38a6e4022ecdc6a0cf097d5e2abfc35..50807eeda22aa1f242f12f6d1290e6bb4a9596bf 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -1,3 +1,8 @@
 net-usb-lan78xx-add-allied-telesis-at29m2-af.patch
 can-kvaser_usb-get-can-clock-frequency-from-device.patch
 hid-holtek-fix-mouse-probing.patch
+ib-qib-fix-memory-leak-in-qib_user_sdma_queue_pkts.patch
+qlcnic-potential-dereference-null-pointer-of-rx_queu.patch
+bonding-fix-ad_actor_system-option-setting-to-defaul.patch
+fjes-check-for-error-irq.patch
+drivers-net-smc911x-check-for-error-irq.patch