--- /dev/null
+From 9b65aaa01f8698cac7b9a7a5bbbe9859d1187e6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Oct 2021 10:32:54 +0800
+Subject: ALSA: intel-dsp-config: add quirk for JSL devices based on ES8336
+ codec
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit fa9730b4f28b7bd183d28a0bf636ab7108de35d7 ]
+
+These devices are based on an I2C/I2S device, we need to force the use
+of the SOF driver otherwise the legacy HDaudio driver will be loaded -
+only HDMI will be supported.
+
+We previously added support for other Intel platforms but missed
+JasperLake.
+
+BugLink: https://github.com/thesofproject/linux/issues/3210
+Fixes: 9d36ceab9415 ('ALSA: intel-dsp-config: add quirk for APL/GLK/TGL devices based on ES8336 codec')
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@intel.com>
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://lore.kernel.org/r/20211027023254.24955-1-yung-chuan.liao@linux.intel.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/intel-dsp-config.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/sound/hda/intel-dsp-config.c b/sound/hda/intel-dsp-config.c
+index 6cdb3db7507b1..fc61571a3ac73 100644
+--- a/sound/hda/intel-dsp-config.c
++++ b/sound/hda/intel-dsp-config.c
+@@ -298,6 +298,15 @@ static const struct config_entry config_table[] = {
+ },
+ #endif
+
++/* JasperLake */
++#if IS_ENABLED(CONFIG_SND_SOC_SOF_JASPERLAKE)
++ {
++ .flags = FLAG_SOF,
++ .device = 0x4dc8,
++ .codec_hid = "ESSX8336",
++ },
++#endif
++
+ /* Tigerlake */
+ #if IS_ENABLED(CONFIG_SND_SOC_SOF_TIGERLAKE)
+ {
+--
+2.33.0
+
--- /dev/null
+From 3afe2c501d88122221ab85a01f6313d7eb512487 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Oct 2021 14:09:26 -0700
+Subject: ARM: dts: bcm2711: Fix PCIe interrupts
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 98481f3d72fb88cb5b973153434061015f094925 ]
+
+The PCIe host bridge has two interrupt lines, one that goes towards it
+PCIE_INTR2 second level interrupt controller and one for its MSI second
+level interrupt controller. The first interrupt line is not currently
+managed by the driver, which is why it was not a functional problem.
+
+The interrupt-map property was also only listing the PCI_INTA interrupts
+when there are also the INTB, C and D.
+
+Reported-by: Jim Quinlan <jim2101024@gmail.com>
+Fixes: d5c8dc0d4c88 ("ARM: dts: bcm2711: Enable PCIe controller")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm2711.dtsi | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/bcm2711.dtsi b/arch/arm/boot/dts/bcm2711.dtsi
+index 398ecd7b9b68b..4ade854bdcdaf 100644
+--- a/arch/arm/boot/dts/bcm2711.dtsi
++++ b/arch/arm/boot/dts/bcm2711.dtsi
+@@ -480,11 +480,17 @@ pcie0: pcie@7d500000 {
+ #address-cells = <3>;
+ #interrupt-cells = <1>;
+ #size-cells = <2>;
+- interrupts = <GIC_SPI 148 IRQ_TYPE_LEVEL_HIGH>,
++ interrupts = <GIC_SPI 147 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 148 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "pcie", "msi";
+ interrupt-map-mask = <0x0 0x0 0x0 0x7>;
+ interrupt-map = <0 0 0 1 &gicv2 GIC_SPI 143
++ IRQ_TYPE_LEVEL_HIGH>,
++ <0 0 0 2 &gicv2 GIC_SPI 144
++ IRQ_TYPE_LEVEL_HIGH>,
++ <0 0 0 3 &gicv2 GIC_SPI 145
++ IRQ_TYPE_LEVEL_HIGH>,
++ <0 0 0 4 &gicv2 GIC_SPI 146
+ IRQ_TYPE_LEVEL_HIGH>;
+ msi-controller;
+ msi-parent = <&pcie0>;
+--
+2.33.0
+
--- /dev/null
+From cf030f04d883fc7ac039fe9b46cec81d9c0ba5ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Oct 2021 09:46:53 -0700
+Subject: ARM: dts: BCM5301X: Add interrupt properties to GPIO node
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 40f7342f0587639e5ad625adaa15efdd3cffb18f ]
+
+The GPIO controller is also an interrupt controller provider and is
+currently missing the appropriate 'interrupt-controller' and
+'#interrupt-cells' properties to denote that.
+
+Fixes: fb026d3de33b ("ARM: BCM5301X: Add Broadcom's bus-axi to the DTS file")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm5301x.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi
+index e97a9c0904a98..9fdad20c40d17 100644
+--- a/arch/arm/boot/dts/bcm5301x.dtsi
++++ b/arch/arm/boot/dts/bcm5301x.dtsi
+@@ -242,6 +242,8 @@ chipcommon: chipcommon@0 {
+
+ gpio-controller;
+ #gpio-cells = <2>;
++ interrupt-controller;
++ #interrupt-cells = <2>;
+ };
+
+ pcie0: pcie@12000 {
+--
+2.33.0
+
--- /dev/null
+From 550d0a0bb5cc0b0ca2927bc78b7dff62aab46c56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Oct 2021 12:37:29 -0700
+Subject: ARM: dts: BCM5301X: Fix I2C controller interrupt
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 754c4050a00e802e122690112fc2c3a6abafa7e2 ]
+
+The I2C interrupt controller line is off by 32 because the datasheet
+describes interrupt inputs into the GIC which are for Shared Peripheral
+Interrupts and are starting at offset 32. The ARM GIC binding expects
+the SPI interrupts to be numbered from 0 relative to the SPI base.
+
+Fixes: bb097e3e0045 ("ARM: dts: BCM5301X: Add I2C support to the DT")
+Tested-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm5301x.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi
+index 72b0df6910bd5..e97a9c0904a98 100644
+--- a/arch/arm/boot/dts/bcm5301x.dtsi
++++ b/arch/arm/boot/dts/bcm5301x.dtsi
+@@ -408,7 +408,7 @@ uart2: serial@18008000 {
+ i2c0: i2c@18009000 {
+ compatible = "brcm,iproc-i2c";
+ reg = <0x18009000 0x50>;
+- interrupts = <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_SPI 89 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+ clock-frequency = <100000>;
+--
+2.33.0
+
--- /dev/null
+From 02fd17338dcb148dddd0a48764e26c2c379f709e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Nov 2021 15:25:08 +0100
+Subject: ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 187bea472600dcc8d2eb714335053264dd437172 ]
+
+When CONFIG_FORTIFY_SOURCE is set, memcpy() checks the potential
+buffer overflow and panics. The code in sofcpga bootstrapping
+contains the memcpy() calls are mistakenly translated as the shorter
+size, hence it triggers a panic as if it were overflowing.
+
+This patch changes the secondary_trampoline and *_end definitions
+to arrays for avoiding the false-positive crash above.
+
+Fixes: 9c4566a117a6 ("ARM: socfpga: Enable SMP for socfpga")
+Suggested-by: Kees Cook <keescook@chromium.org>
+Buglink: https://bugzilla.suse.com/show_bug.cgi?id=1192473
+Link: https://lore.kernel.org/r/20211117193244.31162-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-socfpga/core.h | 2 +-
+ arch/arm/mach-socfpga/platsmp.c | 8 ++++----
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/mach-socfpga/core.h b/arch/arm/mach-socfpga/core.h
+index fc2608b18a0d0..18f01190dcfd4 100644
+--- a/arch/arm/mach-socfpga/core.h
++++ b/arch/arm/mach-socfpga/core.h
+@@ -33,7 +33,7 @@ extern void __iomem *sdr_ctl_base_addr;
+ u32 socfpga_sdram_self_refresh(u32 sdr_base);
+ extern unsigned int socfpga_sdram_self_refresh_sz;
+
+-extern char secondary_trampoline, secondary_trampoline_end;
++extern char secondary_trampoline[], secondary_trampoline_end[];
+
+ extern unsigned long socfpga_cpu1start_addr;
+
+diff --git a/arch/arm/mach-socfpga/platsmp.c b/arch/arm/mach-socfpga/platsmp.c
+index fbb80b883e5dd..201191cf68f32 100644
+--- a/arch/arm/mach-socfpga/platsmp.c
++++ b/arch/arm/mach-socfpga/platsmp.c
+@@ -20,14 +20,14 @@
+
+ static int socfpga_boot_secondary(unsigned int cpu, struct task_struct *idle)
+ {
+- int trampoline_size = &secondary_trampoline_end - &secondary_trampoline;
++ int trampoline_size = secondary_trampoline_end - secondary_trampoline;
+
+ if (socfpga_cpu1start_addr) {
+ /* This will put CPU #1 into reset. */
+ writel(RSTMGR_MPUMODRST_CPU1,
+ rst_manager_base_addr + SOCFPGA_RSTMGR_MODMPURST);
+
+- memcpy(phys_to_virt(0), &secondary_trampoline, trampoline_size);
++ memcpy(phys_to_virt(0), secondary_trampoline, trampoline_size);
+
+ writel(__pa_symbol(secondary_startup),
+ sys_manager_base_addr + (socfpga_cpu1start_addr & 0x000000ff));
+@@ -45,12 +45,12 @@ static int socfpga_boot_secondary(unsigned int cpu, struct task_struct *idle)
+
+ static int socfpga_a10_boot_secondary(unsigned int cpu, struct task_struct *idle)
+ {
+- int trampoline_size = &secondary_trampoline_end - &secondary_trampoline;
++ int trampoline_size = secondary_trampoline_end - secondary_trampoline;
+
+ if (socfpga_cpu1start_addr) {
+ writel(RSTMGR_MPUMODRST_CPU1, rst_manager_base_addr +
+ SOCFPGA_A10_RSTMGR_MODMPURST);
+- memcpy(phys_to_virt(0), &secondary_trampoline, trampoline_size);
++ memcpy(phys_to_virt(0), secondary_trampoline, trampoline_size);
+
+ writel(__pa_symbol(secondary_startup),
+ sys_manager_base_addr + (socfpga_cpu1start_addr & 0x00000fff));
+--
+2.33.0
+
--- /dev/null
+From aff29cdd7192dd64942b847f00c15215ee042510 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Nov 2021 11:46:22 +0000
+Subject: ASoC: codecs: wcd934x: return error code correctly from hw_params
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit 006ea27c4e7037369085755c7b5389effa508c04 ]
+
+Error returned from wcd934x_slim_set_hw_params() are not passed to upper layer,
+this could be misleading to the user which can start sending stream leading
+to unnecessary errors.
+
+Fix this by properly returning the errors.
+
+Fixes: a61f3b4f476e ("ASoC: wcd934x: add support to wcd9340/wcd9341 codec")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20211116114623.11891-3-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wcd934x.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/wcd934x.c b/sound/soc/codecs/wcd934x.c
+index d18ae5e3ee809..699b59cd389c0 100644
+--- a/sound/soc/codecs/wcd934x.c
++++ b/sound/soc/codecs/wcd934x.c
+@@ -1812,9 +1812,8 @@ static int wcd934x_hw_params(struct snd_pcm_substream *substream,
+ }
+
+ wcd->dai[dai->id].sconfig.rate = params_rate(params);
+- wcd934x_slim_set_hw_params(wcd, &wcd->dai[dai->id], substream->stream);
+
+- return 0;
++ return wcd934x_slim_set_hw_params(wcd, &wcd->dai[dai->id], substream->stream);
+ }
+
+ static int wcd934x_hw_free(struct snd_pcm_substream *substream,
+--
+2.33.0
+
--- /dev/null
+From 2e0a7219361a97c34199ae8ca985f6c834b2eda8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Nov 2021 11:47:19 +0000
+Subject: ASoC: qdsp6: q6asm: fix q6asm_dai_prepare error handling
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit 721a94b4352dc8e47bff90b549a0118c39776756 ]
+
+Error handling in q6asm_dai_prepare() seems to be completely broken,
+Fix this by handling it properly.
+
+Fixes: 2a9e92d371db ("ASoC: qdsp6: q6asm: Add q6asm dai driver")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20211116114721.12517-4-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/qdsp6/q6asm-dai.c | 19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/qcom/qdsp6/q6asm-dai.c b/sound/soc/qcom/qdsp6/q6asm-dai.c
+index 9766725c29166..84cf190aa01a6 100644
+--- a/sound/soc/qcom/qdsp6/q6asm-dai.c
++++ b/sound/soc/qcom/qdsp6/q6asm-dai.c
+@@ -269,9 +269,7 @@ static int q6asm_dai_prepare(struct snd_soc_component *component,
+
+ if (ret < 0) {
+ dev_err(dev, "%s: q6asm_open_write failed\n", __func__);
+- q6asm_audio_client_free(prtd->audio_client);
+- prtd->audio_client = NULL;
+- return -ENOMEM;
++ goto open_err;
+ }
+
+ prtd->session_id = q6asm_get_session_id(prtd->audio_client);
+@@ -279,7 +277,7 @@ static int q6asm_dai_prepare(struct snd_soc_component *component,
+ prtd->session_id, substream->stream);
+ if (ret) {
+ dev_err(dev, "%s: stream reg failed ret:%d\n", __func__, ret);
+- return ret;
++ goto routing_err;
+ }
+
+ if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
+@@ -301,10 +299,19 @@ static int q6asm_dai_prepare(struct snd_soc_component *component,
+ }
+ if (ret < 0)
+ dev_info(dev, "%s: CMD Format block failed\n", __func__);
++ else
++ prtd->state = Q6ASM_STREAM_RUNNING;
+
+- prtd->state = Q6ASM_STREAM_RUNNING;
++ return ret;
+
+- return 0;
++routing_err:
++ q6asm_cmd(prtd->audio_client, prtd->stream_id, CMD_CLOSE);
++open_err:
++ q6asm_unmap_memory_regions(substream->stream, prtd->audio_client);
++ q6asm_audio_client_free(prtd->audio_client);
++ prtd->audio_client = NULL;
++
++ return ret;
+ }
+
+ static int q6asm_dai_trigger(struct snd_soc_component *component,
+--
+2.33.0
+
--- /dev/null
+From 7a5f572b2a69e6b28d77854d358a6e7e713589a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Nov 2021 11:47:18 +0000
+Subject: ASoC: qdsp6: q6routing: Conditionally reset FrontEnd Mixer
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit 861afeac7990587588d057b2c0b3222331c3da29 ]
+
+Stream IDs are reused across multiple BackEnd mixers, do not reset the
+stream mixers if they are not already set for that particular FrontEnd.
+
+Ex:
+amixer cset iface=MIXER,name='SLIMBUS_0_RX Audio Mixer MultiMedia1' 1
+
+would set the MultiMedia1 steam for SLIMBUS_0_RX, however doing below
+command will reset previously setup MultiMedia1 stream, because both of them
+are using MultiMedia1 PCM stream.
+
+amixer cset iface=MIXER,name='SLIMBUS_2_RX Audio Mixer MultiMedia1' 0
+
+reset the FrontEnd Mixers conditionally to fix this issue.
+
+This is more noticeable in desktop setup, where in alsactl tries to restore
+the alsa state and overwriting the previous mixer settings.
+
+Fixes: e3a33673e845 ("ASoC: qdsp6: q6routing: Add q6routing driver")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20211116114721.12517-3-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/qdsp6/q6routing.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/qcom/qdsp6/q6routing.c b/sound/soc/qcom/qdsp6/q6routing.c
+index 0a6b9433f6acf..934b3f282bccd 100644
+--- a/sound/soc/qcom/qdsp6/q6routing.c
++++ b/sound/soc/qcom/qdsp6/q6routing.c
+@@ -491,7 +491,11 @@ static int msm_routing_put_audio_mixer(struct snd_kcontrol *kcontrol,
+ session->port_id = be_id;
+ snd_soc_dapm_mixer_update_power(dapm, kcontrol, 1, update);
+ } else {
+- session->port_id = -1;
++ if (session->port_id == be_id) {
++ session->port_id = -1;
++ return 0;
++ }
++
+ snd_soc_dapm_mixer_update_power(dapm, kcontrol, 0, update);
+ }
+
+--
+2.33.0
+
--- /dev/null
+From c232d3fce5c2c6626b30526365b8a6f2b41f0c1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Nov 2021 08:18:12 +0100
+Subject: ASoC: topology: Add missing rwsem around snd_ctl_remove() calls
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 7e567b5ae06315ef2d70666b149962e2bb4b97af ]
+
+snd_ctl_remove() has to be called with card->controls_rwsem held (when
+called after the card instantiation). This patch add the missing
+rwsem calls around it.
+
+Fixes: 8a9782346dcc ("ASoC: topology: Add topology core")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://lore.kernel.org/r/20211116071812.18109-1-tiwai@suse.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-topology.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
+index 1030e11017b27..4d24ac255d253 100644
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -2873,6 +2873,7 @@ EXPORT_SYMBOL_GPL(snd_soc_tplg_widget_remove_all);
+ /* remove dynamic controls from the component driver */
+ int snd_soc_tplg_component_remove(struct snd_soc_component *comp, u32 index)
+ {
++ struct snd_card *card = comp->card->snd_card;
+ struct snd_soc_dobj *dobj, *next_dobj;
+ int pass = SOC_TPLG_PASS_END;
+
+@@ -2880,6 +2881,7 @@ int snd_soc_tplg_component_remove(struct snd_soc_component *comp, u32 index)
+ while (pass >= SOC_TPLG_PASS_START) {
+
+ /* remove mixer controls */
++ down_write(&card->controls_rwsem);
+ list_for_each_entry_safe(dobj, next_dobj, &comp->dobj_list,
+ list) {
+
+@@ -2923,6 +2925,7 @@ int snd_soc_tplg_component_remove(struct snd_soc_component *comp, u32 index)
+ break;
+ }
+ }
++ up_write(&card->controls_rwsem);
+ pass--;
+ }
+
+--
+2.33.0
+
--- /dev/null
+From fb5b815a668ed909f8d65e33ce6bc436488948d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Nov 2021 11:24:10 -0500
+Subject: drm/amd/display: Set plane update flags for all planes in reset
+
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+
+[ Upstream commit 21431f70f6014f81b0d118ff4fcee12b00b9dd70 ]
+
+[Why]
+We're only setting the flags on stream[0]'s planes so this logic fails
+if we have more than one stream in the state.
+
+This can cause a page flip timeout with multiple displays in the
+configuration.
+
+[How]
+Index into the stream_status array using the stream index - it's a 1:1
+mapping.
+
+Fixes: cdaae8371aa9 ("drm/amd/display: Handle GPU reset for DC block")
+
+Reviewed-by: Harry Wentland <Harry.Wentland@amd.com>
+Acked-by: Qingqing Zhuo <qingqing.zhuo@amd.com>
+Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index d9525fbedad2d..a5b6f36fe1d72 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -1963,8 +1963,8 @@ static int dm_resume(void *handle)
+
+ for (i = 0; i < dc_state->stream_count; i++) {
+ dc_state->streams[i]->mode_changed = true;
+- for (j = 0; j < dc_state->stream_status->plane_count; j++) {
+- dc_state->stream_status->plane_states[j]->update_flags.raw
++ for (j = 0; j < dc_state->stream_status[i].plane_count; j++) {
++ dc_state->stream_status[i].plane_states[j]->update_flags.raw
+ = 0xffffffff;
+ }
+ }
+--
+2.33.0
+
--- /dev/null
+From f968343e89673e54bc00f0c866d01708c74cdefd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Nov 2021 14:13:14 +0300
+Subject: drm/nouveau/acr: fix a couple NULL vs IS_ERR() checks
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit b371fd131fcec59f6165c80778bdc2cd1abd616b ]
+
+The nvkm_acr_lsfw_add() function never returns NULL. It returns error
+pointers on error.
+
+Fixes: 22dcda45a3d1 ("drm/nouveau/acr: implement new subdev to replace "secure boot"")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Karol Herbst <kherbst@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20211118111314.GB1147@kili
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/subdev/acr/gm200.c | 6 ++++--
+ drivers/gpu/drm/nouveau/nvkm/subdev/acr/gp102.c | 6 ++++--
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/acr/gm200.c b/drivers/gpu/drm/nouveau/nvkm/subdev/acr/gm200.c
+index cd41b2e6cc879..18502fd6ebaa0 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/acr/gm200.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/acr/gm200.c
+@@ -207,11 +207,13 @@ int
+ gm200_acr_wpr_parse(struct nvkm_acr *acr)
+ {
+ const struct wpr_header *hdr = (void *)acr->wpr_fw->data;
++ struct nvkm_acr_lsfw *lsfw;
+
+ while (hdr->falcon_id != WPR_HEADER_V0_FALCON_ID_INVALID) {
+ wpr_header_dump(&acr->subdev, hdr);
+- if (!nvkm_acr_lsfw_add(NULL, acr, NULL, (hdr++)->falcon_id))
+- return -ENOMEM;
++ lsfw = nvkm_acr_lsfw_add(NULL, acr, NULL, (hdr++)->falcon_id);
++ if (IS_ERR(lsfw))
++ return PTR_ERR(lsfw);
+ }
+
+ return 0;
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/acr/gp102.c b/drivers/gpu/drm/nouveau/nvkm/subdev/acr/gp102.c
+index 80eb9d8dbc803..e5c8303a5b7b7 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/acr/gp102.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/acr/gp102.c
+@@ -161,11 +161,13 @@ int
+ gp102_acr_wpr_parse(struct nvkm_acr *acr)
+ {
+ const struct wpr_header_v1 *hdr = (void *)acr->wpr_fw->data;
++ struct nvkm_acr_lsfw *lsfw;
+
+ while (hdr->falcon_id != WPR_HEADER_V1_FALCON_ID_INVALID) {
+ wpr_header_v1_dump(&acr->subdev, hdr);
+- if (!nvkm_acr_lsfw_add(NULL, acr, NULL, (hdr++)->falcon_id))
+- return -ENOMEM;
++ lsfw = nvkm_acr_lsfw_add(NULL, acr, NULL, (hdr++)->falcon_id);
++ if (IS_ERR(lsfw))
++ return PTR_ERR(lsfw);
+ }
+
+ return 0;
+--
+2.33.0
+
--- /dev/null
+From b06754c7ebf40f295c8e124493bad81adcfdd0be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Nov 2021 14:14:16 +0300
+Subject: drm/vc4: fix error code in vc4_create_object()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 96c5f82ef0a145d3e56e5b26f2bf6dcd2ffeae1c ]
+
+The ->gem_create_object() functions are supposed to return NULL if there
+is an error. None of the callers expect error pointers so returing one
+will lead to an Oops. See drm_gem_vram_create(), for example.
+
+Fixes: c826a6e10644 ("drm/vc4: Add a BO cache.")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20211118111416.GC1147@kili
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_bo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c
+index cc74a3f3a07af..9006b9861c90c 100644
+--- a/drivers/gpu/drm/vc4/vc4_bo.c
++++ b/drivers/gpu/drm/vc4/vc4_bo.c
+@@ -389,7 +389,7 @@ struct drm_gem_object *vc4_create_object(struct drm_device *dev, size_t size)
+
+ bo = kzalloc(sizeof(*bo), GFP_KERNEL);
+ if (!bo)
+- return ERR_PTR(-ENOMEM);
++ return NULL;
+
+ bo->madv = VC4_MADV_WILLNEED;
+ refcount_set(&bo->usecnt, 0);
+--
+2.33.0
+
--- /dev/null
+From 93b37cb0a3fab40a0144aa198e9fe609282720cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Nov 2021 21:58:44 +0800
+Subject: erofs: fix deadlock when shrink erofs slab
+
+From: Huang Jianan <huangjianan@oppo.com>
+
+[ Upstream commit 57bbeacdbee72a54eb97d56b876cf9c94059fc34 ]
+
+We observed the following deadlock in the stress test under low
+memory scenario:
+
+Thread A Thread B
+- erofs_shrink_scan
+ - erofs_try_to_release_workgroup
+ - erofs_workgroup_try_to_freeze -- A
+ - z_erofs_do_read_page
+ - z_erofs_collection_begin
+ - z_erofs_register_collection
+ - erofs_insert_workgroup
+ - xa_lock(&sbi->managed_pslots) -- B
+ - erofs_workgroup_get
+ - erofs_wait_on_workgroup_freezed -- A
+ - xa_erase
+ - xa_lock(&sbi->managed_pslots) -- B
+
+To fix this, it needs to hold xa_lock before freezing the workgroup
+since xarray will be touched then. So let's hold the lock before
+accessing each workgroup, just like what we did with the radix tree
+before.
+
+[ Gao Xiang: Jianhua Hao also reports this issue at
+ https://lore.kernel.org/r/b10b85df30694bac8aadfe43537c897a@xiaomi.com ]
+
+Link: https://lore.kernel.org/r/20211118135844.3559-1-huangjianan@oppo.com
+Fixes: 64094a04414f ("erofs: convert workstn to XArray")
+Reviewed-by: Chao Yu <chao@kernel.org>
+Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Signed-off-by: Huang Jianan <huangjianan@oppo.com>
+Reported-by: Jianhua Hao <haojianhua1@xiaomi.com>
+Signed-off-by: Gao Xiang <xiang@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/utils.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/fs/erofs/utils.c b/fs/erofs/utils.c
+index de9986d2f82fd..5c11199d753a6 100644
+--- a/fs/erofs/utils.c
++++ b/fs/erofs/utils.c
+@@ -154,7 +154,7 @@ static bool erofs_try_to_release_workgroup(struct erofs_sb_info *sbi,
+ * however in order to avoid some race conditions, add a
+ * DBG_BUGON to observe this in advance.
+ */
+- DBG_BUGON(xa_erase(&sbi->managed_pslots, grp->index) != grp);
++ DBG_BUGON(__xa_erase(&sbi->managed_pslots, grp->index) != grp);
+
+ /* last refcount should be connected with its managed pslot. */
+ erofs_workgroup_unfreeze(grp, 0);
+@@ -169,15 +169,19 @@ static unsigned long erofs_shrink_workstation(struct erofs_sb_info *sbi,
+ unsigned int freed = 0;
+ unsigned long index;
+
++ xa_lock(&sbi->managed_pslots);
+ xa_for_each(&sbi->managed_pslots, index, grp) {
+ /* try to shrink each valid workgroup */
+ if (!erofs_try_to_release_workgroup(sbi, grp))
+ continue;
++ xa_unlock(&sbi->managed_pslots);
+
+ ++freed;
+ if (!--nr_shrink)
+- break;
++ return freed;
++ xa_lock(&sbi->managed_pslots);
+ }
++ xa_unlock(&sbi->managed_pslots);
+ return freed;
+ }
+
+--
+2.33.0
+
--- /dev/null
+From 7ae6564a29d7eaa7d10a64839a8aa499e71d474b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Nov 2021 14:42:27 +0800
+Subject: firmware: arm_scmi: pm: Propagate return value to caller
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit 1446fc6c678e8d8b31606a4b877abe205f344b38 ]
+
+of_genpd_add_provider_onecell may return error, so let's propagate
+its return value to caller
+
+Link: https://lore.kernel.org/r/20211116064227.20571-1-peng.fan@oss.nxp.com
+Fixes: 898216c97ed2 ("firmware: arm_scmi: add device power domain support using genpd")
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_scmi/scmi_pm_domain.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/firmware/arm_scmi/scmi_pm_domain.c b/drivers/firmware/arm_scmi/scmi_pm_domain.c
+index 9e44479f02842..a4e4aa9a35426 100644
+--- a/drivers/firmware/arm_scmi/scmi_pm_domain.c
++++ b/drivers/firmware/arm_scmi/scmi_pm_domain.c
+@@ -106,9 +106,7 @@ static int scmi_pm_domain_probe(struct scmi_device *sdev)
+ scmi_pd_data->domains = domains;
+ scmi_pd_data->num_domains = num_domains;
+
+- of_genpd_add_provider_onecell(np, scmi_pd_data);
+-
+- return 0;
++ return of_genpd_add_provider_onecell(np, scmi_pd_data);
+ }
+
+ static const struct scmi_device_id scmi_id_table[] = {
+--
+2.33.0
+
--- /dev/null
+From d7b46eb7f73642ee95df86ea79fb02f8d6f505b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Nov 2021 15:39:01 -0800
+Subject: firmware: smccc: Fix check for ARCH_SOC_ID not implemented
+
+From: Michael Kelley <mikelley@microsoft.com>
+
+[ Upstream commit e95d8eaee21cd0d117d34125d4cdc97489c1ab82 ]
+
+The ARCH_FEATURES function ID is a 32-bit SMC call, which returns
+a 32-bit result per the SMCCC spec. Current code is doing a 64-bit
+comparison against -1 (SMCCC_RET_NOT_SUPPORTED) to detect that the
+feature is unimplemented. That check doesn't work in a Hyper-V VM,
+where the upper 32-bits are zero as allowed by the spec.
+
+Cast the result as an 'int' so the comparison works. The change also
+makes the code consistent with other similar checks in this file.
+
+Fixes: 821b67fa4639 ("firmware: smccc: Add ARCH_SOC_ID support")
+Signed-off-by: Michael Kelley <mikelley@microsoft.com>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/smccc/soc_id.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/firmware/smccc/soc_id.c b/drivers/firmware/smccc/soc_id.c
+index 581aa5e9b0778..dd7c3d5e8b0bb 100644
+--- a/drivers/firmware/smccc/soc_id.c
++++ b/drivers/firmware/smccc/soc_id.c
+@@ -50,7 +50,7 @@ static int __init smccc_soc_init(void)
+ arm_smccc_1_1_invoke(ARM_SMCCC_ARCH_FEATURES_FUNC_ID,
+ ARM_SMCCC_ARCH_SOC_ID, &res);
+
+- if (res.a0 == SMCCC_RET_NOT_SUPPORTED) {
++ if ((int)res.a0 == SMCCC_RET_NOT_SUPPORTED) {
+ pr_info("ARCH_SOC_ID not implemented, skipping ....\n");
+ return 0;
+ }
+--
+2.33.0
+
--- /dev/null
+From 9e7953c68306b834ec68eae102370b86016bd8b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Jun 2021 09:53:31 -0700
+Subject: iavf: Prevent changing static ITR values if adaptive moderation is on
+
+From: Nitesh B Venkatesh <nitesh.b.venkatesh@intel.com>
+
+[ Upstream commit e792779e6b639c182df91b46ac1e5803460b0b15 ]
+
+Resolve being able to change static values on VF when adaptive interrupt
+moderation is enabled.
+
+This problem is fixed by checking the interrupt settings is not
+a combination of change of static value while adaptive interrupt
+moderation is turned on.
+
+Without this fix, the user would be able to change static values
+on VF with adaptive moderation enabled.
+
+Fixes: 65e87c0398f5 ("i40evf: support queue-specific settings for interrupt moderation")
+Signed-off-by: Nitesh B Venkatesh <nitesh.b.venkatesh@intel.com>
+Tested-by: George Kuruvinakunnel <george.kuruvinakunnel@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/intel/iavf/iavf_ethtool.c | 30 ++++++++++++++++---
+ 1 file changed, 26 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c
+index ea85b06857fa2..90f5ec982d513 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c
++++ b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c
+@@ -719,12 +719,31 @@ static int iavf_get_per_queue_coalesce(struct net_device *netdev, u32 queue,
+ *
+ * Change the ITR settings for a specific queue.
+ **/
+-static void iavf_set_itr_per_queue(struct iavf_adapter *adapter,
+- struct ethtool_coalesce *ec, int queue)
++static int iavf_set_itr_per_queue(struct iavf_adapter *adapter,
++ struct ethtool_coalesce *ec, int queue)
+ {
+ struct iavf_ring *rx_ring = &adapter->rx_rings[queue];
+ struct iavf_ring *tx_ring = &adapter->tx_rings[queue];
+ struct iavf_q_vector *q_vector;
++ u16 itr_setting;
++
++ itr_setting = rx_ring->itr_setting & ~IAVF_ITR_DYNAMIC;
++
++ if (ec->rx_coalesce_usecs != itr_setting &&
++ ec->use_adaptive_rx_coalesce) {
++ netif_info(adapter, drv, adapter->netdev,
++ "Rx interrupt throttling cannot be changed if adaptive-rx is enabled\n");
++ return -EINVAL;
++ }
++
++ itr_setting = tx_ring->itr_setting & ~IAVF_ITR_DYNAMIC;
++
++ if (ec->tx_coalesce_usecs != itr_setting &&
++ ec->use_adaptive_tx_coalesce) {
++ netif_info(adapter, drv, adapter->netdev,
++ "Tx interrupt throttling cannot be changed if adaptive-tx is enabled\n");
++ return -EINVAL;
++ }
+
+ rx_ring->itr_setting = ITR_REG_ALIGN(ec->rx_coalesce_usecs);
+ tx_ring->itr_setting = ITR_REG_ALIGN(ec->tx_coalesce_usecs);
+@@ -747,6 +766,7 @@ static void iavf_set_itr_per_queue(struct iavf_adapter *adapter,
+ * the Tx and Rx ITR values based on the values we have entered
+ * into the q_vector, no need to write the values now.
+ */
++ return 0;
+ }
+
+ /**
+@@ -788,9 +808,11 @@ static int __iavf_set_coalesce(struct net_device *netdev,
+ */
+ if (queue < 0) {
+ for (i = 0; i < adapter->num_active_queues; i++)
+- iavf_set_itr_per_queue(adapter, ec, i);
++ if (iavf_set_itr_per_queue(adapter, ec, i))
++ return -EINVAL;
+ } else if (queue < adapter->num_active_queues) {
+- iavf_set_itr_per_queue(adapter, ec, queue);
++ if (iavf_set_itr_per_queue(adapter, ec, queue))
++ return -EINVAL;
+ } else {
+ netif_info(adapter, drv, netdev, "Invalid queue value, queue range is 0 - %d\n",
+ adapter->num_active_queues - 1);
+--
+2.33.0
+
--- /dev/null
+From e1a8eca144f2f5bf9837d8a842b188cd642cbff5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Oct 2021 18:47:19 +0200
+Subject: ice: avoid bpf_prog refcount underflow
+
+From: Marta Plantykow <marta.a.plantykow@intel.com>
+
+[ Upstream commit f65ee535df775a13a1046c0a0b2d72db342f8a5b ]
+
+Ice driver has the routines for managing XDP resources that are shared
+between ndo_bpf op and VSI rebuild flow. The latter takes place for
+example when user changes queue count on an interface via ethtool's
+set_channels().
+
+There is an issue around the bpf_prog refcounting when VSI is being
+rebuilt - since ice_prepare_xdp_rings() is called with vsi->xdp_prog as
+an argument that is used later on by ice_vsi_assign_bpf_prog(), same
+bpf_prog pointers are swapped with each other. Then it is also
+interpreted as an 'old_prog' which in turn causes us to call
+bpf_prog_put on it that will decrement its refcount.
+
+Below splat can be interpreted in a way that due to zero refcount of a
+bpf_prog it is wiped out from the system while kernel still tries to
+refer to it:
+
+[ 481.069429] BUG: unable to handle page fault for address: ffffc9000640f038
+[ 481.077390] #PF: supervisor read access in kernel mode
+[ 481.083335] #PF: error_code(0x0000) - not-present page
+[ 481.089276] PGD 100000067 P4D 100000067 PUD 1001cb067 PMD 106d2b067 PTE 0
+[ 481.097141] Oops: 0000 [#1] PREEMPT SMP PTI
+[ 481.101980] CPU: 12 PID: 3339 Comm: sudo Tainted: G OE 5.15.0-rc5+ #1
+[ 481.110840] Hardware name: Intel Corp. GRANTLEY/GRANTLEY, BIOS GRRFCRB1.86B.0276.D07.1605190235 05/19/2016
+[ 481.122021] RIP: 0010:dev_xdp_prog_id+0x25/0x40
+[ 481.127265] Code: 80 00 00 00 00 0f 1f 44 00 00 89 f6 48 c1 e6 04 48 01 fe 48 8b 86 98 08 00 00 48 85 c0 74 13 48 8b 50 18 31 c0 48 85 d2 74 07 <48> 8b 42 38 8b 40 20 c3 48 8b 96 90 08 00 00 eb e8 66 2e 0f 1f 84
+[ 481.148991] RSP: 0018:ffffc90007b63868 EFLAGS: 00010286
+[ 481.155034] RAX: 0000000000000000 RBX: ffff889080824000 RCX: 0000000000000000
+[ 481.163278] RDX: ffffc9000640f000 RSI: ffff889080824010 RDI: ffff889080824000
+[ 481.171527] RBP: ffff888107af7d00 R08: 0000000000000000 R09: ffff88810db5f6e0
+[ 481.179776] R10: 0000000000000000 R11: ffff8890885b9988 R12: ffff88810db5f4bc
+[ 481.188026] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
+[ 481.196276] FS: 00007f5466d5bec0(0000) GS:ffff88903fb00000(0000) knlGS:0000000000000000
+[ 481.205633] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 481.212279] CR2: ffffc9000640f038 CR3: 000000014429c006 CR4: 00000000003706e0
+[ 481.220530] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 481.228771] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 481.237029] Call Trace:
+[ 481.239856] rtnl_fill_ifinfo+0x768/0x12e0
+[ 481.244602] rtnl_dump_ifinfo+0x525/0x650
+[ 481.249246] ? __alloc_skb+0xa5/0x280
+[ 481.253484] netlink_dump+0x168/0x3c0
+[ 481.257725] netlink_recvmsg+0x21e/0x3e0
+[ 481.262263] ____sys_recvmsg+0x87/0x170
+[ 481.266707] ? __might_fault+0x20/0x30
+[ 481.271046] ? _copy_from_user+0x66/0xa0
+[ 481.275591] ? iovec_from_user+0xf6/0x1c0
+[ 481.280226] ___sys_recvmsg+0x82/0x100
+[ 481.284566] ? sock_sendmsg+0x5e/0x60
+[ 481.288791] ? __sys_sendto+0xee/0x150
+[ 481.293129] __sys_recvmsg+0x56/0xa0
+[ 481.297267] do_syscall_64+0x3b/0xc0
+[ 481.301395] entry_SYSCALL_64_after_hwframe+0x44/0xae
+[ 481.307238] RIP: 0033:0x7f5466f39617
+[ 481.311373] Code: 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb bd 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2f 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
+[ 481.342944] RSP: 002b:00007ffedc7f4308 EFLAGS: 00000246 ORIG_RAX: 000000000000002f
+[ 481.361783] RAX: ffffffffffffffda RBX: 00007ffedc7f5460 RCX: 00007f5466f39617
+[ 481.380278] RDX: 0000000000000000 RSI: 00007ffedc7f5360 RDI: 0000000000000003
+[ 481.398500] RBP: 00007ffedc7f53f0 R08: 0000000000000000 R09: 000055d556f04d50
+[ 481.416463] R10: 0000000000000077 R11: 0000000000000246 R12: 00007ffedc7f5360
+[ 481.434131] R13: 00007ffedc7f5350 R14: 00007ffedc7f5344 R15: 0000000000000e98
+[ 481.451520] Modules linked in: ice(OE) af_packet binfmt_misc nls_iso8859_1 ipmi_ssif intel_rapl_msr intel_rapl_common x86_pkg_temp_thermal intel_powerclamp mxm_wmi mei_me coretemp mei ipmi_si ipmi_msghandler wmi acpi_pad acpi_power_meter ip_tables x_tables autofs4 crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel ahci crypto_simd cryptd libahci lpc_ich [last unloaded: ice]
+[ 481.528558] CR2: ffffc9000640f038
+[ 481.542041] ---[ end trace d1f24c9ecf5b61c1 ]---
+
+Fix this by only calling ice_vsi_assign_bpf_prog() inside
+ice_prepare_xdp_rings() when current vsi->xdp_prog pointer is NULL.
+This way set_channels() flow will not attempt to swap the vsi->xdp_prog
+pointers with itself.
+
+Also, sprinkle around some comments that provide a reasoning about
+correlation between driver and kernel in terms of bpf_prog refcount.
+
+Fixes: efc2214b6047 ("ice: Add support for XDP")
+Reviewed-by: Alexander Lobakin <alexandr.lobakin@intel.com>
+Signed-off-by: Marta Plantykow <marta.a.plantykow@intel.com>
+Co-developed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Tested-by: Kiran Bhandare <kiranx.bhandare@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_main.c | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index 5b67d24b2b5ed..746a5bd178d3b 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -2397,7 +2397,18 @@ int ice_prepare_xdp_rings(struct ice_vsi *vsi, struct bpf_prog *prog)
+ ice_stat_str(status));
+ goto clear_xdp_rings;
+ }
+- ice_vsi_assign_bpf_prog(vsi, prog);
++
++ /* assign the prog only when it's not already present on VSI;
++ * this flow is a subject of both ethtool -L and ndo_bpf flows;
++ * VSI rebuild that happens under ethtool -L can expose us to
++ * the bpf_prog refcount issues as we would be swapping same
++ * bpf_prog pointers from vsi->xdp_prog and calling bpf_prog_put
++ * on it as it would be treated as an 'old_prog'; for ndo_bpf
++ * this is not harmful as dev_xdp_install bumps the refcount
++ * before calling the op exposed by the driver;
++ */
++ if (!ice_is_xdp_ena_vsi(vsi))
++ ice_vsi_assign_bpf_prog(vsi, prog);
+
+ return 0;
+ clear_xdp_rings:
+@@ -2527,6 +2538,11 @@ ice_xdp_setup_prog(struct ice_vsi *vsi, struct bpf_prog *prog,
+ if (xdp_ring_err)
+ NL_SET_ERR_MSG_MOD(extack, "Freeing XDP Tx resources failed");
+ } else {
++ /* safe to call even when prog == vsi->xdp_prog as
++ * dev_xdp_install in net/core/dev.c incremented prog's
++ * refcount so corresponding bpf_prog_put won't cause
++ * underflow
++ */
+ ice_vsi_assign_bpf_prog(vsi, prog);
+ }
+
+--
+2.33.0
+
--- /dev/null
+From 913324ccb14f1d370b96ed3b251d400ba133b054 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Oct 2021 18:47:18 +0200
+Subject: ice: fix vsi->txq_map sizing
+
+From: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+
+[ Upstream commit 792b2086584f25d84081a526beee80d103c2a913 ]
+
+The approach of having XDP queue per CPU regardless of user's setting
+exposed a hidden bug that could occur in case when Rx queue count differ
+from Tx queue count. Currently vsi->txq_map's size is equal to the
+doubled vsi->alloc_txq, which is not correct due to the fact that XDP
+rings were previously based on the Rx queue count. Below splat can be
+seen when ethtool -L is used and XDP rings are configured:
+
+[ 682.875339] BUG: kernel NULL pointer dereference, address: 000000000000000f
+[ 682.883403] #PF: supervisor read access in kernel mode
+[ 682.889345] #PF: error_code(0x0000) - not-present page
+[ 682.895289] PGD 0 P4D 0
+[ 682.898218] Oops: 0000 [#1] PREEMPT SMP PTI
+[ 682.903055] CPU: 42 PID: 2878 Comm: ethtool Tainted: G OE 5.15.0-rc5+ #1
+[ 682.912214] Hardware name: Intel Corp. GRANTLEY/GRANTLEY, BIOS GRRFCRB1.86B.0276.D07.1605190235 05/19/2016
+[ 682.923380] RIP: 0010:devres_remove+0x44/0x130
+[ 682.928527] Code: 49 89 f4 55 48 89 fd 4c 89 ff 53 48 83 ec 10 e8 92 b9 49 00 48 8b 9d a8 02 00 00 48 8d 8d a0 02 00 00 49 89 c2 48 39 cb 74 0f <4c> 3b 63 10 74 25 48 8b 5b 08 48 39 cb 75 f1 4c 89 ff 4c 89 d6 e8
+[ 682.950237] RSP: 0018:ffffc90006a679f0 EFLAGS: 00010002
+[ 682.956285] RAX: 0000000000000286 RBX: ffffffffffffffff RCX: ffff88908343a370
+[ 682.964538] RDX: 0000000000000001 RSI: ffffffff81690d60 RDI: 0000000000000000
+[ 682.972789] RBP: ffff88908343a0d0 R08: 0000000000000000 R09: 0000000000000000
+[ 682.981040] R10: 0000000000000286 R11: 3fffffffffffffff R12: ffffffff81690d60
+[ 682.989282] R13: ffffffff81690a00 R14: ffff8890819807a8 R15: ffff88908343a36c
+[ 682.997535] FS: 00007f08c7bfa740(0000) GS:ffff88a03fd00000(0000) knlGS:0000000000000000
+[ 683.006910] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 683.013557] CR2: 000000000000000f CR3: 0000001080a66003 CR4: 00000000003706e0
+[ 683.021819] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 683.030075] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 683.038336] Call Trace:
+[ 683.041167] devm_kfree+0x33/0x50
+[ 683.045004] ice_vsi_free_arrays+0x5e/0xc0 [ice]
+[ 683.050380] ice_vsi_rebuild+0x4c8/0x750 [ice]
+[ 683.055543] ice_vsi_recfg_qs+0x9a/0x110 [ice]
+[ 683.060697] ice_set_channels+0x14f/0x290 [ice]
+[ 683.065962] ethnl_set_channels+0x333/0x3f0
+[ 683.070807] genl_family_rcv_msg_doit+0xea/0x150
+[ 683.076152] genl_rcv_msg+0xde/0x1d0
+[ 683.080289] ? channels_prepare_data+0x60/0x60
+[ 683.085432] ? genl_get_cmd+0xd0/0xd0
+[ 683.089667] netlink_rcv_skb+0x50/0xf0
+[ 683.094006] genl_rcv+0x24/0x40
+[ 683.097638] netlink_unicast+0x239/0x340
+[ 683.102177] netlink_sendmsg+0x22e/0x470
+[ 683.106717] sock_sendmsg+0x5e/0x60
+[ 683.110756] __sys_sendto+0xee/0x150
+[ 683.114894] ? handle_mm_fault+0xd0/0x2a0
+[ 683.119535] ? do_user_addr_fault+0x1f3/0x690
+[ 683.134173] __x64_sys_sendto+0x25/0x30
+[ 683.148231] do_syscall_64+0x3b/0xc0
+[ 683.161992] entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+Fix this by taking into account the value that num_possible_cpus()
+yields in addition to vsi->alloc_txq instead of doubling the latter.
+
+Fixes: efc2214b6047 ("ice: Add support for XDP")
+Fixes: 22bf877e528f ("ice: introduce XDP_TX fallback path")
+Reviewed-by: Alexander Lobakin <alexandr.lobakin@intel.com>
+Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Tested-by: Kiran Bhandare <kiranx.bhandare@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_lib.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c
+index dc944d605a741..52ac6cc08e83e 100644
+--- a/drivers/net/ethernet/intel/ice/ice_lib.c
++++ b/drivers/net/ethernet/intel/ice/ice_lib.c
+@@ -83,8 +83,13 @@ static int ice_vsi_alloc_arrays(struct ice_vsi *vsi)
+ if (!vsi->rx_rings)
+ goto err_rings;
+
+- /* XDP will have vsi->alloc_txq Tx queues as well, so double the size */
+- vsi->txq_map = devm_kcalloc(dev, (2 * vsi->alloc_txq),
++ /* txq_map needs to have enough space to track both Tx (stack) rings
++ * and XDP rings; at this point vsi->num_xdp_txq might not be set,
++ * so use num_possible_cpus() as we want to always provide XDP ring
++ * per CPU, regardless of queue count settings from user that might
++ * have come from ethtool's set_channels() callback;
++ */
++ vsi->txq_map = devm_kcalloc(dev, (vsi->alloc_txq + num_possible_cpus()),
+ sizeof(*vsi->txq_map), GFP_KERNEL);
+
+ if (!vsi->txq_map)
+--
+2.33.0
+
--- /dev/null
+From 299729c76726dc1e1f31de89aa22bb66273289c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Nov 2021 12:40:00 -0800
+Subject: igb: fix netpoll exit with traffic
+
+From: Jesse Brandeburg <jesse.brandeburg@intel.com>
+
+[ Upstream commit eaeace60778e524a2820d0c0ad60bf80289e292c ]
+
+Oleksandr brought a bug report where netpoll causes trace
+messages in the log on igb.
+
+Danielle brought this back up as still occurring, so we'll try
+again.
+
+[22038.710800] ------------[ cut here ]------------
+[22038.710801] igb_poll+0x0/0x1440 [igb] exceeded budget in poll
+[22038.710802] WARNING: CPU: 12 PID: 40362 at net/core/netpoll.c:155 netpoll_poll_dev+0x18a/0x1a0
+
+As Alex suggested, change the driver to return work_done at the
+exit of napi_poll, which should be safe to do in this driver
+because it is not polling multiple queues in this single napi
+context (multiple queues attached to one MSI-X vector). Several
+other drivers contain the same simple sequence, so I hope
+this will not create new problems.
+
+Fixes: 16eb8815c235 ("igb: Refactor clean_rx_irq to reduce overhead and improve performance")
+Reported-by: Oleksandr Natalenko <oleksandr@natalenko.name>
+Reported-by: Danielle Ratson <danieller@nvidia.com>
+Suggested-by: Alexander Duyck <alexander.duyck@gmail.com>
+Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Tested-by: Oleksandr Natalenko <oleksandr@natalenko.name>
+Tested-by: Danielle Ratson <danieller@nvidia.com>
+Link: https://lore.kernel.org/r/20211123204000.1597971-1-jesse.brandeburg@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igb/igb_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index e24fb122c03a2..d5432d1448c05 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -8032,7 +8032,7 @@ static int igb_poll(struct napi_struct *napi, int budget)
+ if (likely(napi_complete_done(napi, work_done)))
+ igb_ring_irq_enable(q_vector);
+
+- return min(work_done, budget - 1);
++ return work_done;
+ }
+
+ /**
+--
+2.33.0
+
--- /dev/null
+From 723b4eca94a36c7a505eb526f9c09a90f572a48a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Nov 2021 17:37:58 -0800
+Subject: ipv6: fix typos in __ip6_finish_output()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 19d36c5f294879949c9d6f57cb61d39cc4c48553 ]
+
+We deal with IPv6 packets, so we need to use IP6CB(skb)->flags and
+IP6SKB_REROUTED, instead of IPCB(skb)->flags and IPSKB_REROUTED
+
+Found by code inspection, please double check that fixing this bug
+does not surface other bugs.
+
+Fixes: 09ee9dba9611 ("ipv6: Reinject IPv6 packets if IPsec policy matches after SNAT")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Tobias Brunner <tobias@strongswan.org>
+Cc: Steffen Klassert <steffen.klassert@secunet.com>
+Cc: David Ahern <dsahern@kernel.org>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Tested-by: Tobias Brunner <tobias@strongswan.org>
+Acked-by: Tobias Brunner <tobias@strongswan.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/ip6_output.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index c2f8e69d7d7a0..54cabf1c2ae15 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -193,7 +193,7 @@ static int __ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff
+ #if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM)
+ /* Policy lookup after SNAT yielded a new policy */
+ if (skb_dst(skb)->xfrm) {
+- IPCB(skb)->flags |= IPSKB_REROUTED;
++ IP6CB(skb)->flags |= IP6SKB_REROUTED;
+ return dst_output(net, sk, skb);
+ }
+ #endif
+--
+2.33.0
+
--- /dev/null
+From 65fae475ec26f9671b470349d49b622a819bb8f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Nov 2021 08:16:25 +0100
+Subject: lan743x: fix deadlock in lan743x_phy_link_status_change()
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit ddb826c2c92d461f290a7bab89e7c28696191875 ]
+
+Usage of phy_ethtool_get_link_ksettings() in the link status change
+handler isn't needed, and in combination with the referenced change
+it results in a deadlock. Simply remove the call and replace it with
+direct access to phydev->speed. The duplex argument of
+lan743x_phy_update_flowcontrol() isn't used and can be removed.
+
+Fixes: c10a485c3de5 ("phy: phy_ethtool_ksettings_get: Lock the phy for consistency")
+Reported-by: Alessandro B Maurici <abmaurici@gmail.com>
+Tested-by: Alessandro B Maurici <abmaurici@gmail.com>
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lore.kernel.org/r/40e27f76-0ba3-dcef-ee32-a78b9df38b0f@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/microchip/lan743x_main.c | 12 +++---------
+ 1 file changed, 3 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
+index 3eea8cf076c48..481f89d193f77 100644
+--- a/drivers/net/ethernet/microchip/lan743x_main.c
++++ b/drivers/net/ethernet/microchip/lan743x_main.c
+@@ -922,8 +922,7 @@ static int lan743x_phy_reset(struct lan743x_adapter *adapter)
+ }
+
+ static void lan743x_phy_update_flowcontrol(struct lan743x_adapter *adapter,
+- u8 duplex, u16 local_adv,
+- u16 remote_adv)
++ u16 local_adv, u16 remote_adv)
+ {
+ struct lan743x_phy *phy = &adapter->phy;
+ u8 cap;
+@@ -951,7 +950,6 @@ static void lan743x_phy_link_status_change(struct net_device *netdev)
+
+ phy_print_status(phydev);
+ if (phydev->state == PHY_RUNNING) {
+- struct ethtool_link_ksettings ksettings;
+ int remote_advertisement = 0;
+ int local_advertisement = 0;
+
+@@ -988,18 +986,14 @@ static void lan743x_phy_link_status_change(struct net_device *netdev)
+ }
+ lan743x_csr_write(adapter, MAC_CR, data);
+
+- memset(&ksettings, 0, sizeof(ksettings));
+- phy_ethtool_get_link_ksettings(netdev, &ksettings);
+ local_advertisement =
+ linkmode_adv_to_mii_adv_t(phydev->advertising);
+ remote_advertisement =
+ linkmode_adv_to_mii_adv_t(phydev->lp_advertising);
+
+- lan743x_phy_update_flowcontrol(adapter,
+- ksettings.base.duplex,
+- local_advertisement,
++ lan743x_phy_update_flowcontrol(adapter, local_advertisement,
+ remote_advertisement);
+- lan743x_ptp_update_latency(adapter, ksettings.base.speed);
++ lan743x_ptp_update_latency(adapter, phydev->speed);
+ }
+ }
+
+--
+2.33.0
+
--- /dev/null
+From c9231fdff765f611ad6de185fda0a361e67684ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Nov 2021 18:59:49 +0800
+Subject: MIPS: loongson64: fix FTLB configuration
+
+From: Huang Pei <huangpei@loongson.cn>
+
+[ Upstream commit 7db5e9e9e5e6c10d7d26f8df7f8fd8841cb15ee7 ]
+
+It turns out that 'decode_configs' -> 'set_ftlb_enable' is called under
+c->cputype unset, which leaves FTLB disabled on BOTH 3A2000 and 3A3000
+
+Fix it by calling "decode_configs" after c->cputype is initialized
+
+Fixes: da1bd29742b1 ("MIPS: Loongson64: Probe CPU features via CPUCFG")
+Signed-off-by: Huang Pei <huangpei@loongson.cn>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/kernel/cpu-probe.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c
+index 067cb3eb16141..d120201910acf 100644
+--- a/arch/mips/kernel/cpu-probe.c
++++ b/arch/mips/kernel/cpu-probe.c
+@@ -1721,8 +1721,6 @@ static inline void decode_cpucfg(struct cpuinfo_mips *c)
+
+ static inline void cpu_probe_loongson(struct cpuinfo_mips *c, unsigned int cpu)
+ {
+- decode_configs(c);
+-
+ /* All Loongson processors covered here define ExcCode 16 as GSExc. */
+ c->options |= MIPS_CPU_GSEXCEX;
+
+@@ -1783,6 +1781,8 @@ static inline void cpu_probe_loongson(struct cpuinfo_mips *c, unsigned int cpu)
+ panic("Unknown Loongson Processor ID!");
+ break;
+ }
++
++ decode_configs(c);
+ }
+ #else
+ static inline void cpu_probe_loongson(struct cpuinfo_mips *c, unsigned int cpu) { }
+--
+2.33.0
+
--- /dev/null
+From 91eb1a5b0615a0220a671c64f0f98b8548750109 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Nov 2021 18:59:48 +0800
+Subject: MIPS: use 3-level pgtable for 64KB page size on MIPS_VA_BITS_48
+
+From: Huang Pei <huangpei@loongson.cn>
+
+[ Upstream commit 41ce097f714401e6ad8f3f5eb30d7f91b0b5e495 ]
+
+It hangup when booting Loongson 3A1000 with BOTH
+CONFIG_PAGE_SIZE_64KB and CONFIG_MIPS_VA_BITS_48, that it turn
+out to use 2-level pgtable instead of 3-level. 64KB page size
+with 2-level pgtable only cover 42 bits VA, use 3-level pgtable
+to cover all 48 bits VA(55 bits)
+
+Fixes: 1e321fa917fb ("MIPS64: Support of at least 48 bits of SEGBITS)
+Signed-off-by: Huang Pei <huangpei@loongson.cn>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
+index 94a748e95231b..23d756fe0fd6c 100644
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -3189,7 +3189,7 @@ config STACKTRACE_SUPPORT
+ config PGTABLE_LEVELS
+ int
+ default 4 if PAGE_SIZE_4KB && MIPS_VA_BITS_48
+- default 3 if 64BIT && !PAGE_SIZE_64KB
++ default 3 if 64BIT && (!PAGE_SIZE_64KB || MIPS_VA_BITS_48)
+ default 2
+
+ config MIPS_AUTO_PFN_OFFSET
+--
+2.33.0
+
--- /dev/null
+From 0bf24a0cd9d42c232e58f495f06c7fd7c97cfe25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Nov 2021 09:52:56 +0200
+Subject: mlxsw: spectrum: Protect driver from buggy firmware
+
+From: Amit Cohen <amcohen@nvidia.com>
+
+[ Upstream commit 63b08b1f6834bbb0b4f7783bf63b80c8c8e9a047 ]
+
+When processing port up/down events generated by the device's firmware,
+the driver protects itself from events reported for non-existent local
+ports, but not the CPU port (local port 0), which exists, but lacks a
+netdev.
+
+This can result in a NULL pointer dereference when calling
+netif_carrier_{on,off}().
+
+Fix this by bailing early when processing an event reported for the CPU
+port. Problem was only observed when running on top of a buggy emulator.
+
+Fixes: 28b1987ef506 ("mlxsw: spectrum: Register CPU port with devlink")
+Signed-off-by: Amit Cohen <amcohen@nvidia.com>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+index 1a9978f501ba9..4110e15c22c79 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -2058,7 +2058,7 @@ static void mlxsw_sp_pude_event_func(const struct mlxsw_reg_info *reg,
+ max_ports = mlxsw_core_max_ports(mlxsw_sp->core);
+ local_port = mlxsw_reg_pude_local_port_get(pude_pl);
+
+- if (WARN_ON_ONCE(local_port >= max_ports))
++ if (WARN_ON_ONCE(!local_port || local_port >= max_ports))
+ return;
+ mlxsw_sp_port = mlxsw_sp->ports[local_port];
+ if (!mlxsw_sp_port)
+--
+2.33.0
+
--- /dev/null
+From 6f84db0a73adca066685bb13a77acdb0a68502f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 May 2021 20:03:57 +0300
+Subject: mlxsw: Verify the accessed index doesn't exceed the array length
+
+From: Danielle Ratson <danieller@nvidia.com>
+
+[ Upstream commit 837ec05cfea08284c575e8e834777b107da5ff9d ]
+
+There are few cases in which an array index queried from a fw register,
+is accessed without any validation that it doesn't exceed the array
+length.
+
+Add a proper length validation, so accessing memory past the end of an
+array will be forbidden.
+
+Signed-off-by: Danielle Ratson <danieller@nvidia.com>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/minimal.c | 4 ++++
+ drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 5 +++++
+ drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c | 3 +++
+ drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 3 +++
+ drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 4 ++++
+ 5 files changed, 19 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/minimal.c b/drivers/net/ethernet/mellanox/mlxsw/minimal.c
+index c010db2c9dba9..443dc44452ef8 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/minimal.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/minimal.c
+@@ -234,6 +234,7 @@ static void mlxsw_m_port_remove(struct mlxsw_m *mlxsw_m, u8 local_port)
+ static int mlxsw_m_port_module_map(struct mlxsw_m *mlxsw_m, u8 local_port,
+ u8 *last_module)
+ {
++ unsigned int max_ports = mlxsw_core_max_ports(mlxsw_m->core);
+ u8 module, width;
+ int err;
+
+@@ -249,6 +250,9 @@ static int mlxsw_m_port_module_map(struct mlxsw_m *mlxsw_m, u8 local_port,
+ if (module == *last_module)
+ return 0;
+ *last_module = module;
++
++ if (WARN_ON_ONCE(module >= max_ports))
++ return -EINVAL;
+ mlxsw_m->module_to_port[module] = ++mlxsw_m->max_ports;
+
+ return 0;
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+index b08853f71b2be..1a9978f501ba9 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -2052,9 +2052,14 @@ static void mlxsw_sp_pude_event_func(const struct mlxsw_reg_info *reg,
+ struct mlxsw_sp *mlxsw_sp = priv;
+ struct mlxsw_sp_port *mlxsw_sp_port;
+ enum mlxsw_reg_pude_oper_status status;
++ unsigned int max_ports;
+ u8 local_port;
+
++ max_ports = mlxsw_core_max_ports(mlxsw_sp->core);
+ local_port = mlxsw_reg_pude_local_port_get(pude_pl);
++
++ if (WARN_ON_ONCE(local_port >= max_ports))
++ return;
+ mlxsw_sp_port = mlxsw_sp->ports[local_port];
+ if (!mlxsw_sp_port)
+ return;
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c
+index ca8090a28dec6..50eca2daad843 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c
+@@ -568,10 +568,13 @@ void mlxsw_sp1_ptp_got_timestamp(struct mlxsw_sp *mlxsw_sp, bool ingress,
+ u8 domain_number, u16 sequence_id,
+ u64 timestamp)
+ {
++ unsigned int max_ports = mlxsw_core_max_ports(mlxsw_sp->core);
+ struct mlxsw_sp_port *mlxsw_sp_port;
+ struct mlxsw_sp1_ptp_key key;
+ u8 types;
+
++ if (WARN_ON_ONCE(local_port >= max_ports))
++ return;
+ mlxsw_sp_port = mlxsw_sp->ports[local_port];
+ if (!mlxsw_sp_port)
+ return;
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+index 4381f8c6c3fb7..53128382fc2e0 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+@@ -2177,6 +2177,7 @@ static void mlxsw_sp_router_neigh_ent_ipv4_process(struct mlxsw_sp *mlxsw_sp,
+ char *rauhtd_pl,
+ int ent_index)
+ {
++ u64 max_rifs = MLXSW_CORE_RES_GET(mlxsw_sp->core, MAX_RIFS);
+ struct net_device *dev;
+ struct neighbour *n;
+ __be32 dipn;
+@@ -2185,6 +2186,8 @@ static void mlxsw_sp_router_neigh_ent_ipv4_process(struct mlxsw_sp *mlxsw_sp,
+
+ mlxsw_reg_rauhtd_ent_ipv4_unpack(rauhtd_pl, ent_index, &rif, &dip);
+
++ if (WARN_ON_ONCE(rif >= max_rifs))
++ return;
+ if (!mlxsw_sp->router->rifs[rif]) {
+ dev_err_ratelimited(mlxsw_sp->bus_info->dev, "Incorrect RIF in neighbour entry\n");
+ return;
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+index 6501ce94ace58..368fa0e5ad315 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+@@ -2410,6 +2410,7 @@ static void mlxsw_sp_fdb_notify_mac_process(struct mlxsw_sp *mlxsw_sp,
+ char *sfn_pl, int rec_index,
+ bool adding)
+ {
++ unsigned int max_ports = mlxsw_core_max_ports(mlxsw_sp->core);
+ struct mlxsw_sp_port_vlan *mlxsw_sp_port_vlan;
+ struct mlxsw_sp_bridge_device *bridge_device;
+ struct mlxsw_sp_bridge_port *bridge_port;
+@@ -2422,6 +2423,9 @@ static void mlxsw_sp_fdb_notify_mac_process(struct mlxsw_sp *mlxsw_sp,
+ int err;
+
+ mlxsw_reg_sfn_mac_unpack(sfn_pl, rec_index, mac, &fid, &local_port);
++
++ if (WARN_ON_ONCE(local_port >= max_ports))
++ return;
+ mlxsw_sp_port = mlxsw_sp->ports[local_port];
+ if (!mlxsw_sp_port) {
+ dev_err_ratelimited(mlxsw_sp->bus_info->dev, "Incorrect local port in FDB notification\n");
+--
+2.33.0
+
--- /dev/null
+From f446af9a3adc01a861fdf11f11ed1d38cce97862 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Nov 2021 15:27:54 +0100
+Subject: mptcp: fix delack timer
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit ee50e67ba0e17b1a1a8d76691d02eadf9e0f392c ]
+
+To compute the rtx timeout schedule_3rdack_retransmission() does multiple
+things in the wrong way: srtt_us is measured in usec/8 and the timeout
+itself is an absolute value.
+
+Fixes: ec3edaa7ca6ce02f ("mptcp: Add handling of outgoing MP_JOIN requests")
+Acked-by: Paolo Abeni <pabeni@redhat.com>
+Reviewed-by: Mat Martineau <mathew.j.martineau>@linux.intel.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mptcp/options.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/mptcp/options.c b/net/mptcp/options.c
+index ac0233c9cd349..64afe71e2129a 100644
+--- a/net/mptcp/options.c
++++ b/net/mptcp/options.c
+@@ -368,9 +368,10 @@ static void schedule_3rdack_retransmission(struct sock *sk)
+
+ /* reschedule with a timeout above RTT, as we must look only for drop */
+ if (tp->srtt_us)
+- timeout = tp->srtt_us << 1;
++ timeout = usecs_to_jiffies(tp->srtt_us >> (3 - 1));
+ else
+ timeout = TCP_TIMEOUT_INIT;
++ timeout += jiffies;
+
+ WARN_ON_ONCE(icsk->icsk_ack.pending & ICSK_ACK_TIMER);
+ icsk->icsk_ack.pending |= ICSK_ACK_SCHED | ICSK_ACK_TIMER;
+--
+2.33.0
+
--- /dev/null
+From f5b945cb38c44b0eb6f7d4f381528fd1684ad6d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Nov 2021 20:03:15 +0800
+Subject: net: hns3: fix VF RSS failed problem after PF enable multi-TCs
+
+From: Guangbin Huang <huangguangbin2@huawei.com>
+
+[ Upstream commit 8d2ad993aa05c0768f00c886c9d369cd97a337ac ]
+
+When PF is set to multi-TCs and configured mapping relationship between
+priorities and TCs, the hardware will active these settings for this PF
+and its VFs.
+
+In this case when VF just uses one TC and its rx packets contain priority,
+and if the priority is not mapped to TC0, as other TCs of VF is not valid,
+hardware always put this kind of packets to the queue 0. It cause this kind
+of packets of VF can not be used RSS function.
+
+To fix this problem, set tc mode of all unused TCs of VF to the setting of
+TC0, then rx packet with priority which map to unused TC will be direct to
+TC0.
+
+Fixes: e2cb1dec9779 ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support")
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+index e27af38f6b161..6e7da1dc2e8c3 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -679,9 +679,9 @@ static int hclgevf_set_rss_tc_mode(struct hclgevf_dev *hdev, u16 rss_size)
+ roundup_size = ilog2(roundup_size);
+
+ for (i = 0; i < HCLGEVF_MAX_TC_NUM; i++) {
+- tc_valid[i] = !!(hdev->hw_tc_map & BIT(i));
++ tc_valid[i] = 1;
+ tc_size[i] = roundup_size;
+- tc_offset[i] = rss_size * i;
++ tc_offset[i] = (hdev->hw_tc_map & BIT(i)) ? rss_size * i : 0;
+ }
+
+ hclgevf_cmd_setup_basic_desc(&desc, HCLGEVF_OPC_RSS_TC_MODE, false);
+--
+2.33.0
+
--- /dev/null
+From 9461ea6b6222c2729e398129e3282dd8aa40d3de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Nov 2021 22:09:16 -0500
+Subject: net: ieee802154: handle iftypes as u32
+
+From: Alexander Aring <aahringo@redhat.com>
+
+[ Upstream commit 451dc48c806a7ce9fbec5e7a24ccf4b2c936e834 ]
+
+This patch fixes an issue that an u32 netlink value is handled as a
+signed enum value which doesn't fit into the range of u32 netlink type.
+If it's handled as -1 value some BIT() evaluation ends in a
+shift-out-of-bounds issue. To solve the issue we set the to u32 max which
+is s32 "-1" value to keep backwards compatibility and let the followed enum
+values start counting at 0. This brings the compiler to never handle the
+enum as signed and a check if the value is above NL802154_IFTYPE_MAX should
+filter -1 out.
+
+Fixes: f3ea5e44231a ("ieee802154: add new interface command")
+Signed-off-by: Alexander Aring <aahringo@redhat.com>
+Link: https://lore.kernel.org/r/20211112030916.685793-1-aahringo@redhat.com
+Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/nl802154.h | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/include/net/nl802154.h b/include/net/nl802154.h
+index ddcee128f5d9a..145acb8f25095 100644
+--- a/include/net/nl802154.h
++++ b/include/net/nl802154.h
+@@ -19,6 +19,8 @@
+ *
+ */
+
++#include <linux/types.h>
++
+ #define NL802154_GENL_NAME "nl802154"
+
+ enum nl802154_commands {
+@@ -150,10 +152,9 @@ enum nl802154_attrs {
+ };
+
+ enum nl802154_iftype {
+- /* for backwards compatibility TODO */
+- NL802154_IFTYPE_UNSPEC = -1,
++ NL802154_IFTYPE_UNSPEC = (~(__u32)0),
+
+- NL802154_IFTYPE_NODE,
++ NL802154_IFTYPE_NODE = 0,
+ NL802154_IFTYPE_MONITOR,
+ NL802154_IFTYPE_COORD,
+
+--
+2.33.0
+
--- /dev/null
+From 4994a9f288ce6aec23c1246921f337605a7193fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Nov 2021 17:15:12 +0200
+Subject: net: ipv6: add fib6_nh_release_dsts stub
+
+From: Nikolay Aleksandrov <nikolay@nvidia.com>
+
+[ Upstream commit 8837cbbf854246f5f4d565f21e6baa945d37aded ]
+
+We need a way to release a fib6_nh's per-cpu dsts when replacing
+nexthops otherwise we can end up with stale per-cpu dsts which hold net
+device references, so add a new IPv6 stub called fib6_nh_release_dsts.
+It must be used after an RCU grace period, so no new dsts can be created
+through a group's nexthop entry.
+Similar to fib6_nh_release it shouldn't be used if fib6_nh_init has failed
+so it doesn't need a dummy stub when IPv6 is not enabled.
+
+Fixes: 7bf4796dd099 ("nexthops: add support for replace")
+Signed-off-by: Nikolay Aleksandrov <nikolay@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/ip6_fib.h | 1 +
+ include/net/ipv6_stubs.h | 1 +
+ net/ipv6/af_inet6.c | 1 +
+ net/ipv6/route.c | 19 +++++++++++++++++++
+ 4 files changed, 22 insertions(+)
+
+diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
+index ac5ff3c3afb14..88bc66b8d02b0 100644
+--- a/include/net/ip6_fib.h
++++ b/include/net/ip6_fib.h
+@@ -491,6 +491,7 @@ int fib6_nh_init(struct net *net, struct fib6_nh *fib6_nh,
+ struct fib6_config *cfg, gfp_t gfp_flags,
+ struct netlink_ext_ack *extack);
+ void fib6_nh_release(struct fib6_nh *fib6_nh);
++void fib6_nh_release_dsts(struct fib6_nh *fib6_nh);
+
+ int call_fib6_entry_notifiers(struct net *net,
+ enum fib_event_type event_type,
+diff --git a/include/net/ipv6_stubs.h b/include/net/ipv6_stubs.h
+index 8fce558b5fea3..14a43111ffc6a 100644
+--- a/include/net/ipv6_stubs.h
++++ b/include/net/ipv6_stubs.h
+@@ -47,6 +47,7 @@ struct ipv6_stub {
+ struct fib6_config *cfg, gfp_t gfp_flags,
+ struct netlink_ext_ack *extack);
+ void (*fib6_nh_release)(struct fib6_nh *fib6_nh);
++ void (*fib6_nh_release_dsts)(struct fib6_nh *fib6_nh);
+ void (*fib6_update_sernum)(struct net *net, struct fib6_info *rt);
+ int (*ip6_del_rt)(struct net *net, struct fib6_info *rt, bool skip_notify);
+ void (*fib6_rt_update)(struct net *net, struct fib6_info *rt,
+diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
+index e648fbebb1670..090575346daf6 100644
+--- a/net/ipv6/af_inet6.c
++++ b/net/ipv6/af_inet6.c
+@@ -1016,6 +1016,7 @@ static const struct ipv6_stub ipv6_stub_impl = {
+ .ip6_mtu_from_fib6 = ip6_mtu_from_fib6,
+ .fib6_nh_init = fib6_nh_init,
+ .fib6_nh_release = fib6_nh_release,
++ .fib6_nh_release_dsts = fib6_nh_release_dsts,
+ .fib6_update_sernum = fib6_update_sernum_stub,
+ .fib6_rt_update = fib6_rt_update,
+ .ip6_del_rt = ip6_del_rt,
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index a68a7d7c07280..6fef0d7586bf6 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -3570,6 +3570,25 @@ void fib6_nh_release(struct fib6_nh *fib6_nh)
+ fib_nh_common_release(&fib6_nh->nh_common);
+ }
+
++void fib6_nh_release_dsts(struct fib6_nh *fib6_nh)
++{
++ int cpu;
++
++ if (!fib6_nh->rt6i_pcpu)
++ return;
++
++ for_each_possible_cpu(cpu) {
++ struct rt6_info *pcpu_rt, **ppcpu_rt;
++
++ ppcpu_rt = per_cpu_ptr(fib6_nh->rt6i_pcpu, cpu);
++ pcpu_rt = xchg(ppcpu_rt, NULL);
++ if (pcpu_rt) {
++ dst_dev_put(&pcpu_rt->dst);
++ dst_release(&pcpu_rt->dst);
++ }
++ }
++}
++
+ static struct fib6_info *ip6_route_info_create(struct fib6_config *cfg,
+ gfp_t gfp_flags,
+ struct netlink_ext_ack *extack)
+--
+2.33.0
+
--- /dev/null
+From 2cbd213b0e730e53a149d5865ea06d5050aadf4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Nov 2021 21:08:34 +0100
+Subject: net: marvell: mvpp2: increase MTU limit when XDP enabled
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Behún <kabel@kernel.org>
+
+[ Upstream commit 7b1b62bc1e6a7b2fd5ee7a4296268eb291d23aeb ]
+
+Currently mvpp2_xdp_setup won't allow attaching XDP program if
+ mtu > ETH_DATA_LEN (1500).
+
+The mvpp2_change_mtu on the other hand checks whether
+ MVPP2_RX_PKT_SIZE(mtu) > MVPP2_BM_LONG_PKT_SIZE.
+
+These two checks are semantically different.
+
+Moreover this limit can be increased to MVPP2_MAX_RX_BUF_SIZE, since in
+mvpp2_rx we have
+ xdp.data = data + MVPP2_MH_SIZE + MVPP2_SKB_HEADROOM;
+ xdp.frame_sz = PAGE_SIZE;
+
+Change the checks to check whether
+ mtu > MVPP2_MAX_RX_BUF_SIZE
+
+Fixes: 07dd0a7aae7f ("mvpp2: add basic XDP support")
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index ec9b6c564300e..e220d44df2e65 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -4652,11 +4652,13 @@ static int mvpp2_change_mtu(struct net_device *dev, int mtu)
+ mtu = ALIGN(MVPP2_RX_PKT_SIZE(mtu), 8);
+ }
+
++ if (port->xdp_prog && mtu > MVPP2_MAX_RX_BUF_SIZE) {
++ netdev_err(dev, "Illegal MTU value %d (> %d) for XDP mode\n",
++ mtu, (int)MVPP2_MAX_RX_BUF_SIZE);
++ return -EINVAL;
++ }
++
+ if (MVPP2_RX_PKT_SIZE(mtu) > MVPP2_BM_LONG_PKT_SIZE) {
+- if (port->xdp_prog) {
+- netdev_err(dev, "Jumbo frames are not supported with XDP\n");
+- return -EINVAL;
+- }
+ if (priv->percpu_pools) {
+ netdev_warn(dev, "mtu %d too high, switching to shared buffers", mtu);
+ mvpp2_bm_switch_buffers(priv, false);
+@@ -4942,8 +4944,8 @@ static int mvpp2_xdp_setup(struct mvpp2_port *port, struct netdev_bpf *bpf)
+ bool running = netif_running(port->dev);
+ bool reset = !prog != !port->xdp_prog;
+
+- if (port->dev->mtu > ETH_DATA_LEN) {
+- NL_SET_ERR_MSG_MOD(bpf->extack, "XDP is not supported with jumbo frames enabled");
++ if (port->dev->mtu > MVPP2_MAX_RX_BUF_SIZE) {
++ NL_SET_ERR_MSG_MOD(bpf->extack, "MTU too large for XDP");
+ return -EOPNOTSUPP;
+ }
+
+--
+2.33.0
+
--- /dev/null
+From 6d9001304f0ec8e2753cc72c5e2498c6b637a622 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Nov 2021 21:51:40 +0200
+Subject: net: marvell: prestera: fix double free issue on err path
+
+From: Volodymyr Mytnyk <vmytnyk@marvell.com>
+
+[ Upstream commit e8d032507cb7912baf1d3e0af54516f823befefd ]
+
+fix error path handling in prestera_bridge_port_join() that
+cases prestera driver to crash (see below).
+
+ Trace:
+ Internal error: Oops: 96000044 [#1] SMP
+ Modules linked in: prestera_pci prestera uio_pdrv_genirq
+ CPU: 1 PID: 881 Comm: ip Not tainted 5.15.0 #1
+ pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+ pc : prestera_bridge_destroy+0x2c/0xb0 [prestera]
+ lr : prestera_bridge_port_join+0x2cc/0x350 [prestera]
+ sp : ffff800011a1b0f0
+ ...
+ x2 : ffff000109ca6c80 x1 : dead000000000100 x0 : dead000000000122
+ Call trace:
+ prestera_bridge_destroy+0x2c/0xb0 [prestera]
+ prestera_bridge_port_join+0x2cc/0x350 [prestera]
+ prestera_netdev_port_event.constprop.0+0x3c4/0x450 [prestera]
+ prestera_netdev_event_handler+0xf4/0x110 [prestera]
+ raw_notifier_call_chain+0x54/0x80
+ call_netdevice_notifiers_info+0x54/0xa0
+ __netdev_upper_dev_link+0x19c/0x380
+
+Fixes: e1189d9a5fbe ("net: marvell: prestera: Add Switchdev driver implementation")
+Signed-off-by: Volodymyr Mytnyk <vmytnyk@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/prestera/prestera_switchdev.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/prestera/prestera_switchdev.c b/drivers/net/ethernet/marvell/prestera/prestera_switchdev.c
+index 7d83e1f91ef17..9101d00e96b9d 100644
+--- a/drivers/net/ethernet/marvell/prestera/prestera_switchdev.c
++++ b/drivers/net/ethernet/marvell/prestera/prestera_switchdev.c
+@@ -439,8 +439,8 @@ static int prestera_port_bridge_join(struct prestera_port *port,
+
+ br_port = prestera_bridge_port_add(bridge, port->dev);
+ if (IS_ERR(br_port)) {
+- err = PTR_ERR(br_port);
+- goto err_brport_create;
++ prestera_bridge_put(bridge);
++ return PTR_ERR(br_port);
+ }
+
+ if (bridge->vlan_enabled)
+@@ -454,8 +454,6 @@ static int prestera_port_bridge_join(struct prestera_port *port,
+
+ err_port_join:
+ prestera_bridge_port_put(br_port);
+-err_brport_create:
+- prestera_bridge_put(bridge);
+ return err;
+ }
+
+--
+2.33.0
+
--- /dev/null
+From 6502dfb317247afe1c03cac480bdc74c400c2f06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Nov 2021 19:28:45 +0200
+Subject: net: mscc: ocelot: correctly report the timestamping RX filters in
+ ethtool
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit c49a35eedfef08bffd46b53c25dbf9d6016a86ff ]
+
+The driver doesn't support RX timestamping for non-PTP packets, but it
+declares that it does. Restrict the reported RX filters to PTP v2 over
+L2 and over L4.
+
+Fixes: 4e3b0468e6d7 ("net: mscc: PTP Hardware Clock (PHC) support")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mscc/ocelot.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
+index 154d67066d012..52401915828a1 100644
+--- a/drivers/net/ethernet/mscc/ocelot.c
++++ b/drivers/net/ethernet/mscc/ocelot.c
+@@ -929,7 +929,10 @@ int ocelot_get_ts_info(struct ocelot *ocelot, int port,
+ SOF_TIMESTAMPING_RAW_HARDWARE;
+ info->tx_types = BIT(HWTSTAMP_TX_OFF) | BIT(HWTSTAMP_TX_ON) |
+ BIT(HWTSTAMP_TX_ONESTEP_SYNC);
+- info->rx_filters = BIT(HWTSTAMP_FILTER_NONE) | BIT(HWTSTAMP_FILTER_ALL);
++ info->rx_filters = BIT(HWTSTAMP_FILTER_NONE) |
++ BIT(HWTSTAMP_FILTER_PTP_V2_EVENT) |
++ BIT(HWTSTAMP_FILTER_PTP_V2_L2_EVENT) |
++ BIT(HWTSTAMP_FILTER_PTP_V2_L4_EVENT);
+
+ return 0;
+ }
+--
+2.33.0
+
--- /dev/null
+From c5ba381e2c2c9b75db337b78e65125ffb03dac5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Nov 2021 19:28:41 +0200
+Subject: net: mscc: ocelot: don't downgrade timestamping RX filters in
+ SIOCSHWTSTAMP
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 8a075464d1e9317ffae0973dfe538a7511291a06 ]
+
+The ocelot driver, when asked to timestamp all receiving packets, 1588
+v1 or NTP, says "nah, here's 1588 v2 for you".
+
+According to this discussion:
+https://patchwork.kernel.org/project/netdevbpf/patch/20211104133204.19757-8-martin.kaistra@linutronix.de/#24577647
+drivers that downgrade from a wider request to a narrower response (or
+even a response where the intersection with the request is empty) are
+buggy, and should return -ERANGE instead. This patch fixes that.
+
+Fixes: 4e3b0468e6d7 ("net: mscc: PTP Hardware Clock (PHC) support")
+Suggested-by: Richard Cochran <richardcochran@gmail.com>
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Acked-by: Richard Cochran <richardcochran@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mscc/ocelot.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
+index 8c45b236649a9..154d67066d012 100644
+--- a/drivers/net/ethernet/mscc/ocelot.c
++++ b/drivers/net/ethernet/mscc/ocelot.c
+@@ -811,12 +811,6 @@ int ocelot_hwstamp_set(struct ocelot *ocelot, int port, struct ifreq *ifr)
+ switch (cfg.rx_filter) {
+ case HWTSTAMP_FILTER_NONE:
+ break;
+- case HWTSTAMP_FILTER_ALL:
+- case HWTSTAMP_FILTER_SOME:
+- case HWTSTAMP_FILTER_PTP_V1_L4_EVENT:
+- case HWTSTAMP_FILTER_PTP_V1_L4_SYNC:
+- case HWTSTAMP_FILTER_PTP_V1_L4_DELAY_REQ:
+- case HWTSTAMP_FILTER_NTP_ALL:
+ case HWTSTAMP_FILTER_PTP_V2_L4_EVENT:
+ case HWTSTAMP_FILTER_PTP_V2_L4_SYNC:
+ case HWTSTAMP_FILTER_PTP_V2_L4_DELAY_REQ:
+--
+2.33.0
+
--- /dev/null
+From 7ad1629584ab02746ca0a3348c13857103f4deb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Nov 2021 22:08:18 +0530
+Subject: net/ncsi : Add payload to be 32-bit aligned to fix dropped packets
+
+From: Kumar Thangavel <kumarthangavel.hcl@gmail.com>
+
+[ Upstream commit ac132852147ad303a938dda318970dd1bbdfda4e ]
+
+Update NC-SI command handler (both standard and OEM) to take into
+account of payload paddings in allocating skb (in case of payload
+size is not 32-bit aligned).
+
+The checksum field follows payload field, without taking payload
+padding into account can cause checksum being truncated, leading to
+dropped packets.
+
+Fixes: fb4ee67529ff ("net/ncsi: Add NCSI OEM command support")
+Signed-off-by: Kumar Thangavel <thangavel.k@hcl.com>
+Acked-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ncsi/ncsi-cmd.c | 24 ++++++++++++++++--------
+ 1 file changed, 16 insertions(+), 8 deletions(-)
+
+diff --git a/net/ncsi/ncsi-cmd.c b/net/ncsi/ncsi-cmd.c
+index ba9ae482141b0..dda8b76b77988 100644
+--- a/net/ncsi/ncsi-cmd.c
++++ b/net/ncsi/ncsi-cmd.c
+@@ -18,6 +18,8 @@
+ #include "internal.h"
+ #include "ncsi-pkt.h"
+
++static const int padding_bytes = 26;
++
+ u32 ncsi_calculate_checksum(unsigned char *data, int len)
+ {
+ u32 checksum = 0;
+@@ -213,12 +215,17 @@ static int ncsi_cmd_handler_oem(struct sk_buff *skb,
+ {
+ struct ncsi_cmd_oem_pkt *cmd;
+ unsigned int len;
++ int payload;
++ /* NC-SI spec DSP_0222_1.2.0, section 8.2.2.2
++ * requires payload to be padded with 0 to
++ * 32-bit boundary before the checksum field.
++ * Ensure the padding bytes are accounted for in
++ * skb allocation
++ */
+
++ payload = ALIGN(nca->payload, 4);
+ len = sizeof(struct ncsi_cmd_pkt_hdr) + 4;
+- if (nca->payload < 26)
+- len += 26;
+- else
+- len += nca->payload;
++ len += max(payload, padding_bytes);
+
+ cmd = skb_put_zero(skb, len);
+ memcpy(&cmd->mfr_id, nca->data, nca->payload);
+@@ -272,6 +279,7 @@ static struct ncsi_request *ncsi_alloc_command(struct ncsi_cmd_arg *nca)
+ struct net_device *dev = nd->dev;
+ int hlen = LL_RESERVED_SPACE(dev);
+ int tlen = dev->needed_tailroom;
++ int payload;
+ int len = hlen + tlen;
+ struct sk_buff *skb;
+ struct ncsi_request *nr;
+@@ -281,14 +289,14 @@ static struct ncsi_request *ncsi_alloc_command(struct ncsi_cmd_arg *nca)
+ return NULL;
+
+ /* NCSI command packet has 16-bytes header, payload, 4 bytes checksum.
++ * Payload needs padding so that the checksum field following payload is
++ * aligned to 32-bit boundary.
+ * The packet needs padding if its payload is less than 26 bytes to
+ * meet 64 bytes minimal ethernet frame length.
+ */
+ len += sizeof(struct ncsi_cmd_pkt_hdr) + 4;
+- if (nca->payload < 26)
+- len += 26;
+- else
+- len += nca->payload;
++ payload = ALIGN(nca->payload, 4);
++ len += max(payload, padding_bytes);
+
+ /* Allocate skb */
+ skb = alloc_skb(len, GFP_ATOMIC);
+--
+2.33.0
+
--- /dev/null
+From 1d887b3a914437b24d343c638032df8a4269e7b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Nov 2021 17:15:13 +0200
+Subject: net: nexthop: release IPv6 per-cpu dsts when replacing a nexthop
+ group
+
+From: Nikolay Aleksandrov <nikolay@nvidia.com>
+
+[ Upstream commit 1005f19b9357b81aa64e1decd08d6e332caaa284 ]
+
+When replacing a nexthop group, we must release the IPv6 per-cpu dsts of
+the removed nexthop entries after an RCU grace period because they
+contain references to the nexthop's net device and to the fib6 info.
+With specific series of events[1] we can reach net device refcount
+imbalance which is unrecoverable. IPv4 is not affected because dsts
+don't take a refcount on the route.
+
+[1]
+ $ ip nexthop list
+ id 200 via 2002:db8::2 dev bridge.10 scope link onlink
+ id 201 via 2002:db8::3 dev bridge scope link onlink
+ id 203 group 201/200
+ $ ip -6 route
+ 2001:db8::10 nhid 203 metric 1024 pref medium
+ nexthop via 2002:db8::3 dev bridge weight 1 onlink
+ nexthop via 2002:db8::2 dev bridge.10 weight 1 onlink
+
+Create rt6_info through one of the multipath legs, e.g.:
+ $ taskset -a -c 1 ./pkt_inj 24 bridge.10 2001:db8::10
+ (pkt_inj is just a custom packet generator, nothing special)
+
+Then remove that leg from the group by replace (let's assume it is id
+200 in this case):
+ $ ip nexthop replace id 203 group 201
+
+Now remove the IPv6 route:
+ $ ip -6 route del 2001:db8::10/128
+
+The route won't be really deleted due to the stale rt6_info holding 1
+refcnt in nexthop id 200.
+At this point we have the following reference count dependency:
+ (deleted) IPv6 route holds 1 reference over nhid 203
+ nh 203 holds 1 ref over id 201
+ nh 200 holds 1 ref over the net device and the route due to the stale
+ rt6_info
+
+Now to create circular dependency between nh 200 and the IPv6 route, and
+also to get a reference over nh 200, restore nhid 200 in the group:
+ $ ip nexthop replace id 203 group 201/200
+
+And now we have a permanent circular dependncy because nhid 203 holds a
+reference over nh 200 and 201, but the route holds a ref over nh 203 and
+is deleted.
+
+To trigger the bug just delete the group (nhid 203):
+ $ ip nexthop del id 203
+
+It won't really be deleted due to the IPv6 route dependency, and now we
+have 2 unlinked and deleted objects that reference each other: the group
+and the IPv6 route. Since the group drops the reference it holds over its
+entries at free time (i.e. its own refcount needs to drop to 0) that will
+never happen and we get a permanent ref on them, since one of the entries
+holds a reference over the IPv6 route it will also never be released.
+
+At this point the dependencies are:
+ (deleted, only unlinked) IPv6 route holds reference over group nh 203
+ (deleted, only unlinked) group nh 203 holds reference over nh 201 and 200
+ nh 200 holds 1 ref over the net device and the route due to the stale
+ rt6_info
+
+This is the last point where it can be fixed by running traffic through
+nh 200, and specifically through the same CPU so the rt6_info (dst) will
+get released due to the IPv6 genid, that in turn will free the IPv6
+route, which in turn will free the ref count over the group nh 203.
+
+If nh 200 is deleted at this point, it will never be released due to the
+ref from the unlinked group 203, it will only be unlinked:
+ $ ip nexthop del id 200
+ $ ip nexthop
+ $
+
+Now we can never release that stale rt6_info, we have IPv6 route with ref
+over group nh 203, group nh 203 with ref over nh 200 and 201, nh 200 with
+rt6_info (dst) with ref over the net device and the IPv6 route. All of
+these objects are only unlinked, and cannot be released, thus they can't
+release their ref counts.
+
+ Message from syslogd@dev at Nov 19 14:04:10 ...
+ kernel:[73501.828730] unregister_netdevice: waiting for bridge.10 to become free. Usage count = 3
+ Message from syslogd@dev at Nov 19 14:04:20 ...
+ kernel:[73512.068811] unregister_netdevice: waiting for bridge.10 to become free. Usage count = 3
+
+Fixes: 7bf4796dd099 ("nexthops: add support for replace")
+Signed-off-by: Nikolay Aleksandrov <nikolay@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/nexthop.c | 25 +++++++++++++++++++++++--
+ 1 file changed, 23 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c
+index 4dbc628f8c386..8bd3f5e3c0e7a 100644
+--- a/net/ipv4/nexthop.c
++++ b/net/ipv4/nexthop.c
+@@ -924,15 +924,36 @@ static void remove_nexthop(struct net *net, struct nexthop *nh,
+ /* if any FIB entries reference this nexthop, any dst entries
+ * need to be regenerated
+ */
+-static void nh_rt_cache_flush(struct net *net, struct nexthop *nh)
++static void nh_rt_cache_flush(struct net *net, struct nexthop *nh,
++ struct nexthop *replaced_nh)
+ {
+ struct fib6_info *f6i;
++ struct nh_group *nhg;
++ int i;
+
+ if (!list_empty(&nh->fi_list))
+ rt_cache_flush(net);
+
+ list_for_each_entry(f6i, &nh->f6i_list, nh_list)
+ ipv6_stub->fib6_update_sernum(net, f6i);
++
++ /* if an IPv6 group was replaced, we have to release all old
++ * dsts to make sure all refcounts are released
++ */
++ if (!replaced_nh->is_group)
++ return;
++
++ /* new dsts must use only the new nexthop group */
++ synchronize_net();
++
++ nhg = rtnl_dereference(replaced_nh->nh_grp);
++ for (i = 0; i < nhg->num_nh; i++) {
++ struct nh_grp_entry *nhge = &nhg->nh_entries[i];
++ struct nh_info *nhi = rtnl_dereference(nhge->nh->nh_info);
++
++ if (nhi->family == AF_INET6)
++ ipv6_stub->fib6_nh_release_dsts(&nhi->fib6_nh);
++ }
+ }
+
+ static int replace_nexthop_grp(struct net *net, struct nexthop *old,
+@@ -1111,7 +1132,7 @@ static int replace_nexthop(struct net *net, struct nexthop *old,
+ err = replace_nexthop_single(net, old, new, extack);
+
+ if (!err) {
+- nh_rt_cache_flush(net, old);
++ nh_rt_cache_flush(net, old, new);
+
+ __remove_nexthop(net, new, NULL);
+ nexthop_put(new);
+--
+2.33.0
+
--- /dev/null
+From a4ca11b9b19c0784982296e8869294d0fe940d3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Nov 2021 16:44:02 +0100
+Subject: net: phylink: Force link down and retrigger resolve on interface
+ change
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 80662f4fd4771bc9c7cc4abdfbe866ebd1179621 ]
+
+On PHY state change the phylink_resolve() function can read stale
+information from the MAC and report incorrect link speed and duplex to
+the kernel message log.
+
+Example with a Marvell 88X3310 PHY connected to a SerDes port on Marvell
+88E6393X switch:
+- PHY driver triggers state change due to PHY interface mode being
+ changed from 10gbase-r to 2500base-x due to copper change in speed
+ from 10Gbps to 2.5Gbps, but the PHY itself either hasn't yet changed
+ its interface to the host, or the interrupt about loss of SerDes link
+ hadn't arrived yet (there can be a delay of several milliseconds for
+ this), so we still think that the 10gbase-r mode is up
+- phylink_resolve()
+ - phylink_mac_pcs_get_state()
+ - this fills in speed=10g link=up
+ - interface mode is updated to 2500base-x but speed is left at 10Gbps
+ - phylink_major_config()
+ - interface is changed to 2500base-x
+ - phylink_link_up()
+ - mv88e6xxx_mac_link_up()
+ - .port_set_speed_duplex()
+ - speed is set to 10Gbps
+ - reports "Link is Up - 10Gbps/Full" to dmesg
+
+Afterwards when the interrupt finally arrives for mv88e6xxx, another
+resolve is forced in which we get the correct speed from
+phylink_mac_pcs_get_state(), but since the interface is not being
+changed anymore, we don't call phylink_major_config() but only
+phylink_mac_config(), which does not set speed/duplex anymore.
+
+To fix this, we need to force the link down and trigger another resolve
+on PHY interface change event.
+
+Fixes: 9525ae83959b ("phylink: add phylink infrastructure")
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/phylink.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
+index 899496f089d2e..8279e08dad9db 100644
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -644,6 +644,7 @@ static void phylink_resolve(struct work_struct *w)
+ struct phylink_link_state link_state;
+ struct net_device *ndev = pl->netdev;
+ bool mac_config = false;
++ bool retrigger = false;
+ bool cur_link_state;
+
+ mutex_lock(&pl->state_mutex);
+@@ -657,6 +658,7 @@ static void phylink_resolve(struct work_struct *w)
+ link_state.link = false;
+ } else if (pl->mac_link_dropped) {
+ link_state.link = false;
++ retrigger = true;
+ } else {
+ switch (pl->cur_link_an_mode) {
+ case MLO_AN_PHY:
+@@ -680,6 +682,15 @@ static void phylink_resolve(struct work_struct *w)
+
+ /* Only update if the PHY link is up */
+ if (pl->phydev && pl->phy_state.link) {
++ /* If the interface has changed, force a
++ * link down event if the link isn't already
++ * down, and re-resolve.
++ */
++ if (link_state.interface !=
++ pl->phy_state.interface) {
++ retrigger = true;
++ link_state.link = false;
++ }
+ link_state.interface = pl->phy_state.interface;
+
+ /* If we have a PHY, we need to update with
+@@ -721,7 +732,7 @@ static void phylink_resolve(struct work_struct *w)
+ else
+ phylink_link_up(pl, link_state);
+ }
+- if (!link_state.link && pl->mac_link_dropped) {
++ if (!link_state.link && retrigger) {
+ pl->mac_link_dropped = false;
+ queue_work(system_power_efficient_wq, &pl->resolve);
+ }
+--
+2.33.0
+
--- /dev/null
+From 82a1ffd9d9053c9fde1e845da3d7aba382d89bf6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Nov 2021 16:44:03 +0100
+Subject: net: phylink: Force retrigger in case of latched link-fail indicator
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit dbae3388ea9ca33bd1d5eabc3b0ef17e69c74677 ]
+
+On mv88e6xxx 1G/2.5G PCS, the SerDes register 4.2001.2 has the following
+description:
+ This register bit indicates when link was lost since the last
+ read. For the current link status, read this register
+ back-to-back.
+
+Thus to get current link state, we need to read the register twice.
+
+But doing that in the link change interrupt handler would lead to
+potentially ignoring link down events, which we really want to avoid.
+
+Thus this needs to be solved in phylink's resolve, by retriggering
+another resolve in the event when PCS reports link down and previous
+link was up, and by re-reading PCS state if the previous link was down.
+
+The wrong value is read when phylink requests change from sgmii to
+2500base-x mode, and link won't come up. This fixes the bug.
+
+Fixes: 9525ae83959b ("phylink: add phylink infrastructure")
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/phylink.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
+index 8279e08dad9db..57b1b138522e0 100644
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -675,6 +675,19 @@ static void phylink_resolve(struct work_struct *w)
+ case MLO_AN_INBAND:
+ phylink_mac_pcs_get_state(pl, &link_state);
+
++ /* The PCS may have a latching link-fail indicator.
++ * If the link was up, bring the link down and
++ * re-trigger the resolve. Otherwise, re-read the
++ * PCS state to get the current status of the link.
++ */
++ if (!link_state.link) {
++ if (cur_link_state)
++ retrigger = true;
++ else
++ phylink_mac_pcs_get_state(pl,
++ &link_state);
++ }
++
+ /* If we have a phy, the "up" state is the union of
+ * both the PHY and the MAC */
+ if (pl->phydev)
+--
+2.33.0
+
--- /dev/null
+From 193e65928641d48c8c89ee8c70e9a464dfd66a16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Nov 2021 17:14:40 +0100
+Subject: net/sched: sch_ets: don't peek at classes beyond 'nbands'
+
+From: Davide Caratti <dcaratti@redhat.com>
+
+[ Upstream commit de6d25924c2a8c2988c6a385990cafbe742061bf ]
+
+when the number of DRR classes decreases, the round-robin active list can
+contain elements that have already been freed in ets_qdisc_change(). As a
+consequence, it's possible to see a NULL dereference crash, caused by the
+attempt to call cl->qdisc->ops->peek(cl->qdisc) when cl->qdisc is NULL:
+
+ BUG: kernel NULL pointer dereference, address: 0000000000000018
+ #PF: supervisor read access in kernel mode
+ #PF: error_code(0x0000) - not-present page
+ PGD 0 P4D 0
+ Oops: 0000 [#1] PREEMPT SMP NOPTI
+ CPU: 1 PID: 910 Comm: mausezahn Not tainted 5.16.0-rc1+ #475
+ Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014
+ RIP: 0010:ets_qdisc_dequeue+0x129/0x2c0 [sch_ets]
+ Code: c5 01 41 39 ad e4 02 00 00 0f 87 18 ff ff ff 49 8b 85 c0 02 00 00 49 39 c4 0f 84 ba 00 00 00 49 8b ad c0 02 00 00 48 8b 7d 10 <48> 8b 47 18 48 8b 40 38 0f ae e8 ff d0 48 89 c3 48 85 c0 0f 84 9d
+ RSP: 0000:ffffbb36c0b5fdd8 EFLAGS: 00010287
+ RAX: ffff956678efed30 RBX: 0000000000000000 RCX: 0000000000000000
+ RDX: 0000000000000002 RSI: ffffffff9b938dc9 RDI: 0000000000000000
+ RBP: ffff956678efed30 R08: e2f3207fe360129c R09: 0000000000000000
+ R10: 0000000000000001 R11: 0000000000000001 R12: ffff956678efeac0
+ R13: ffff956678efe800 R14: ffff956611545000 R15: ffff95667ac8f100
+ FS: 00007f2aa9120740(0000) GS:ffff95667b800000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000000000000018 CR3: 000000011070c000 CR4: 0000000000350ee0
+ Call Trace:
+ <TASK>
+ qdisc_peek_dequeued+0x29/0x70 [sch_ets]
+ tbf_dequeue+0x22/0x260 [sch_tbf]
+ __qdisc_run+0x7f/0x630
+ net_tx_action+0x290/0x4c0
+ __do_softirq+0xee/0x4f8
+ irq_exit_rcu+0xf4/0x130
+ sysvec_apic_timer_interrupt+0x52/0xc0
+ asm_sysvec_apic_timer_interrupt+0x12/0x20
+ RIP: 0033:0x7f2aa7fc9ad4
+ Code: b9 ff ff 48 8b 54 24 18 48 83 c4 08 48 89 ee 48 89 df 5b 5d e9 ed fc ff ff 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa <53> 48 83 ec 10 48 8b 05 10 64 33 00 48 8b 00 48 85 c0 0f 85 84 00
+ RSP: 002b:00007ffe5d33fab8 EFLAGS: 00000202
+ RAX: 0000000000000002 RBX: 0000561f72c31460 RCX: 0000561f72c31720
+ RDX: 0000000000000002 RSI: 0000561f72c31722 RDI: 0000561f72c31720
+ RBP: 000000000000002a R08: 00007ffe5d33fa40 R09: 0000000000000014
+ R10: 0000000000000000 R11: 0000000000000246 R12: 0000561f7187e380
+ R13: 0000000000000000 R14: 0000000000000000 R15: 0000561f72c31460
+ </TASK>
+ Modules linked in: sch_ets sch_tbf dummy rfkill iTCO_wdt intel_rapl_msr iTCO_vendor_support intel_rapl_common joydev virtio_balloon lpc_ich i2c_i801 i2c_smbus pcspkr ip_tables xfs libcrc32c crct10dif_pclmul crc32_pclmul crc32c_intel ahci libahci ghash_clmulni_intel serio_raw libata virtio_blk virtio_console virtio_net net_failover failover sunrpc dm_mirror dm_region_hash dm_log dm_mod
+ CR2: 0000000000000018
+
+Ensuring that 'alist' was never zeroed [1] was not sufficient, we need to
+remove from the active list those elements that are no more SP nor DRR.
+
+[1] https://lore.kernel.org/netdev/60d274838bf09777f0371253416e8af71360bc08.1633609148.git.dcaratti@redhat.com/
+
+v3: fix race between ets_qdisc_change() and ets_qdisc_dequeue() delisting
+ DRR classes beyond 'nbands' in ets_qdisc_change() with the qdisc lock
+ acquired, thanks to Cong Wang.
+
+v2: when a NULL qdisc is found in the DRR active list, try to dequeue skb
+ from the next list item.
+
+Reported-by: Hangbin Liu <liuhangbin@gmail.com>
+Fixes: dcc68b4d8084 ("net: sch_ets: Add a new Qdisc")
+Signed-off-by: Davide Caratti <dcaratti@redhat.com>
+Link: https://lore.kernel.org/r/7a5c496eed2d62241620bdbb83eb03fb9d571c99.1637762721.git.dcaratti@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_ets.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/net/sched/sch_ets.c b/net/sched/sch_ets.c
+index c76701ac35abf..c34cb6e81d855 100644
+--- a/net/sched/sch_ets.c
++++ b/net/sched/sch_ets.c
+@@ -667,12 +667,14 @@ static int ets_qdisc_change(struct Qdisc *sch, struct nlattr *opt,
+ q->classes[i].deficit = quanta[i];
+ }
+ }
++ for (i = q->nbands; i < oldbands; i++) {
++ qdisc_tree_flush_backlog(q->classes[i].qdisc);
++ if (i >= q->nstrict)
++ list_del(&q->classes[i].alist);
++ }
+ q->nstrict = nstrict;
+ memcpy(q->prio2band, priomap, sizeof(priomap));
+
+- for (i = q->nbands; i < oldbands; i++)
+- qdisc_tree_flush_backlog(q->classes[i].qdisc);
+-
+ for (i = 0; i < q->nbands; i++)
+ q->classes[i].quantum = quanta[i];
+
+--
+2.33.0
+
--- /dev/null
+From feb2d0ba5b32faf3d0492662b168bf94974cc9ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Nov 2021 10:41:35 +0800
+Subject: net/smc: Don't call clcsock shutdown twice when smc shutdown
+
+From: Tony Lu <tonylu@linux.alibaba.com>
+
+[ Upstream commit bacb6c1e47691cda4a95056c21b5487fb7199fcc ]
+
+When applications call shutdown() with SHUT_RDWR in userspace,
+smc_close_active() calls kernel_sock_shutdown(), and it is called
+twice in smc_shutdown().
+
+This fixes this by checking sk_state before do clcsock shutdown, and
+avoids missing the application's call of smc_shutdown().
+
+Link: https://lore.kernel.org/linux-s390/1f67548e-cbf6-0dce-82b5-10288a4583bd@linux.ibm.com/
+Fixes: 606a63c9783a ("net/smc: Ensure the active closing peer first closes clcsock")
+Signed-off-by: Tony Lu <tonylu@linux.alibaba.com>
+Reviewed-by: Wen Gu <guwen@linux.alibaba.com>
+Acked-by: Karsten Graul <kgraul@linux.ibm.com>
+Link: https://lore.kernel.org/r/20211126024134.45693-1-tonylu@linux.alibaba.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/af_smc.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
+index a0d3f4e07b067..ac8265e35b2d2 100644
+--- a/net/smc/af_smc.c
++++ b/net/smc/af_smc.c
+@@ -2098,8 +2098,10 @@ static __poll_t smc_poll(struct file *file, struct socket *sock,
+ static int smc_shutdown(struct socket *sock, int how)
+ {
+ struct sock *sk = sock->sk;
++ bool do_shutdown = true;
+ struct smc_sock *smc;
+ int rc = -EINVAL;
++ int old_state;
+ int rc1 = 0;
+
+ smc = smc_sk(sk);
+@@ -2126,7 +2128,11 @@ static int smc_shutdown(struct socket *sock, int how)
+ }
+ switch (how) {
+ case SHUT_RDWR: /* shutdown in both directions */
++ old_state = sk->sk_state;
+ rc = smc_close_active(smc);
++ if (old_state == SMC_ACTIVE &&
++ sk->sk_state == SMC_PEERCLOSEWAIT1)
++ do_shutdown = false;
+ break;
+ case SHUT_WR:
+ rc = smc_close_shutdown_write(smc);
+@@ -2136,7 +2142,7 @@ static int smc_shutdown(struct socket *sock, int how)
+ /* nothing more to do because peer is not involved */
+ break;
+ }
+- if (smc->clcsock)
++ if (do_shutdown && smc->clcsock)
+ rc1 = kernel_sock_shutdown(smc->clcsock, how);
+ /* map sock_shutdown_cmd constants to sk_shutdown value range */
+ sk->sk_shutdown |= how + 1;
+--
+2.33.0
+
--- /dev/null
+From cc7074aa215fa9f9b97e1684ea0fb566440282fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Nov 2021 16:25:18 +0800
+Subject: net/smc: Ensure the active closing peer first closes clcsock
+
+From: Tony Lu <tonylu@linux.alibaba.com>
+
+[ Upstream commit 606a63c9783a32a45bd2ef0eee393711d75b3284 ]
+
+The side that actively closed socket, it's clcsock doesn't enter
+TIME_WAIT state, but the passive side does it. It should show the same
+behavior as TCP sockets.
+
+Consider this, when client actively closes the socket, the clcsock in
+server enters TIME_WAIT state, which means the address is occupied and
+won't be reused before TIME_WAIT dismissing. If we restarted server, the
+service would be unavailable for a long time.
+
+To solve this issue, shutdown the clcsock in [A], perform the TCP active
+close progress first, before the passive closed side closing it. So that
+the actively closed side enters TIME_WAIT, not the passive one.
+
+Client | Server
+close() // client actively close |
+ smc_release() |
+ smc_close_active() // PEERCLOSEWAIT1 |
+ smc_close_final() // abort or closed = 1|
+ smc_cdc_get_slot_and_msg_send() |
+ [A] |
+ |smc_cdc_msg_recv_action() // ACTIVE
+ | queue_work(smc_close_wq, &conn->close_work)
+ | smc_close_passive_work() // PROCESSABORT or APPCLOSEWAIT1
+ | smc_close_passive_abort_received() // only in abort
+ |
+ |close() // server recv zero, close
+ | smc_release() // PROCESSABORT or APPCLOSEWAIT1
+ | smc_close_active()
+ | smc_close_abort() or smc_close_final() // CLOSED
+ | smc_cdc_get_slot_and_msg_send() // abort or closed = 1
+smc_cdc_msg_recv_action() | smc_clcsock_release()
+ queue_work(smc_close_wq, &conn->close_work) | sock_release(tcp) // actively close clc, enter TIME_WAIT
+ smc_close_passive_work() // PEERCLOSEWAIT1 | smc_conn_free()
+ smc_close_passive_abort_received() // CLOSED|
+ smc_conn_free() |
+ smc_clcsock_release() |
+ sock_release(tcp) // passive close clc |
+
+Link: https://www.spinics.net/lists/netdev/msg780407.html
+Fixes: b38d732477e4 ("smc: socket closing and linkgroup cleanup")
+Signed-off-by: Tony Lu <tonylu@linux.alibaba.com>
+Reviewed-by: Wen Gu <guwen@linux.alibaba.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/smc_close.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/net/smc/smc_close.c b/net/smc/smc_close.c
+index 0f9ffba07d268..04620b53b74a7 100644
+--- a/net/smc/smc_close.c
++++ b/net/smc/smc_close.c
+@@ -228,6 +228,12 @@ int smc_close_active(struct smc_sock *smc)
+ /* send close request */
+ rc = smc_close_final(conn);
+ sk->sk_state = SMC_PEERCLOSEWAIT1;
++
++ /* actively shutdown clcsock before peer close it,
++ * prevent peer from entering TIME_WAIT state.
++ */
++ if (smc->clcsock && smc->clcsock->sk)
++ rc = kernel_sock_shutdown(smc->clcsock, SHUT_RDWR);
+ } else {
+ /* peer event has changed the state */
+ goto again;
+--
+2.33.0
+
--- /dev/null
+From eb04e8adc605e3bbb62a5bcda98dfcddacd3ba0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Nov 2021 13:32:38 +0100
+Subject: net/smc: Fix loop in smc_listen
+
+From: Guo DaXing <guodaxing@huawei.com>
+
+[ Upstream commit 9ebb0c4b27a6158303b791b5b91e66d7665ee30e ]
+
+The kernel_listen function in smc_listen will fail when all the available
+ports are occupied. At this point smc->clcsock->sk->sk_data_ready has
+been changed to smc_clcsock_data_ready. When we call smc_listen again,
+now both smc->clcsock->sk->sk_data_ready and smc->clcsk_data_ready point
+to the smc_clcsock_data_ready function.
+
+The smc_clcsock_data_ready() function calls lsmc->clcsk_data_ready which
+now points to itself resulting in an infinite loop.
+
+This patch restores smc->clcsock->sk->sk_data_ready with the old value.
+
+Fixes: a60a2b1e0af1 ("net/smc: reduce active tcp_listen workers")
+Signed-off-by: Guo DaXing <guodaxing@huawei.com>
+Acked-by: Tony Lu <tonylu@linux.alibaba.com>
+Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/af_smc.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
+index cfb5b9be0569d..a0d3f4e07b067 100644
+--- a/net/smc/af_smc.c
++++ b/net/smc/af_smc.c
+@@ -1864,8 +1864,10 @@ static int smc_listen(struct socket *sock, int backlog)
+ smc->clcsock->sk->sk_user_data =
+ (void *)((uintptr_t)smc | SK_USER_DATA_NOCOPY);
+ rc = kernel_listen(smc->clcsock, backlog);
+- if (rc)
++ if (rc) {
++ smc->clcsock->sk->sk_data_ready = smc->clcsk_data_ready;
+ goto out;
++ }
+ sk->sk_max_ack_backlog = backlog;
+ sk->sk_ack_backlog = 0;
+ sk->sk_state = SMC_LISTEN;
+--
+2.33.0
+
--- /dev/null
+From 498f8967b4772daa7d19aaba93a705269da56750 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Nov 2021 13:32:37 +0100
+Subject: net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk()
+
+From: Karsten Graul <kgraul@linux.ibm.com>
+
+[ Upstream commit 587acad41f1bc48e16f42bb2aca63bf323380be8 ]
+
+Coverity reports a possible NULL dereferencing problem:
+
+in smc_vlan_by_tcpsk():
+6. returned_null: netdev_lower_get_next returns NULL (checked 29 out of 30 times).
+7. var_assigned: Assigning: ndev = NULL return value from netdev_lower_get_next.
+1623 ndev = (struct net_device *)netdev_lower_get_next(ndev, &lower);
+CID 1468509 (#1 of 1): Dereference null return value (NULL_RETURNS)
+8. dereference: Dereferencing a pointer that might be NULL ndev when calling is_vlan_dev.
+1624 if (is_vlan_dev(ndev)) {
+
+Remove the manual implementation and use netdev_walk_all_lower_dev() to
+iterate over the lower devices. While on it remove an obsolete function
+parameter comment.
+
+Fixes: cb9d43f67754 ("net/smc: determine vlan_id of stacked net_device")
+Suggested-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/smc_core.c | 35 ++++++++++++++++++-----------------
+ 1 file changed, 18 insertions(+), 17 deletions(-)
+
+diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
+index 109d790eaebe2..cd625b672429f 100644
+--- a/net/smc/smc_core.c
++++ b/net/smc/smc_core.c
+@@ -1209,14 +1209,26 @@ static void smc_link_down_work(struct work_struct *work)
+ mutex_unlock(&lgr->llc_conf_mutex);
+ }
+
+-/* Determine vlan of internal TCP socket.
+- * @vlan_id: address to store the determined vlan id into
+- */
++static int smc_vlan_by_tcpsk_walk(struct net_device *lower_dev,
++ struct netdev_nested_priv *priv)
++{
++ unsigned short *vlan_id = (unsigned short *)priv->data;
++
++ if (is_vlan_dev(lower_dev)) {
++ *vlan_id = vlan_dev_vlan_id(lower_dev);
++ return 1;
++ }
++
++ return 0;
++}
++
++/* Determine vlan of internal TCP socket. */
+ int smc_vlan_by_tcpsk(struct socket *clcsock, struct smc_init_info *ini)
+ {
+ struct dst_entry *dst = sk_dst_get(clcsock->sk);
++ struct netdev_nested_priv priv;
+ struct net_device *ndev;
+- int i, nest_lvl, rc = 0;
++ int rc = 0;
+
+ ini->vlan_id = 0;
+ if (!dst) {
+@@ -1234,20 +1246,9 @@ int smc_vlan_by_tcpsk(struct socket *clcsock, struct smc_init_info *ini)
+ goto out_rel;
+ }
+
++ priv.data = (void *)&ini->vlan_id;
+ rtnl_lock();
+- nest_lvl = ndev->lower_level;
+- for (i = 0; i < nest_lvl; i++) {
+- struct list_head *lower = &ndev->adj_list.lower;
+-
+- if (list_empty(lower))
+- break;
+- lower = lower->next;
+- ndev = (struct net_device *)netdev_lower_get_next(ndev, &lower);
+- if (is_vlan_dev(ndev)) {
+- ini->vlan_id = vlan_dev_vlan_id(ndev);
+- break;
+- }
+- }
++ netdev_walk_all_lower_dev(ndev, smc_vlan_by_tcpsk_walk, &priv);
+ rtnl_unlock();
+
+ out_rel:
+--
+2.33.0
+
--- /dev/null
+From b14d79398c691ecd96936069230eb526cb6d5ac0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Sep 2021 15:43:35 +0800
+Subject: net: stmmac: fix system hang caused by eee_ctrl_timer during
+ suspend/resume
+
+From: Joakim Zhang <qiangqing.zhang@nxp.com>
+
+[ Upstream commit 276aae377206d60b9b7b7df4586cd9f2a813f5d0 ]
+
+commit 5f58591323bf ("net: stmmac: delete the eee_ctrl_timer after
+napi disabled"), this patch tries to fix system hang caused by eee_ctrl_timer,
+unfortunately, it only can resolve it for system reboot stress test. System
+hang also can be reproduced easily during system suspend/resume stess test
+when mount NFS on i.MX8MP EVK board.
+
+In stmmac driver, eee feature is combined to phylink framework. When do
+system suspend, phylink_stop() would queue delayed work, it invokes
+stmmac_mac_link_down(), where to deactivate eee_ctrl_timer synchronizly.
+In above commit, try to fix issue by deactivating eee_ctrl_timer obviously,
+but it is not enough. Looking into eee_ctrl_timer expire callback
+stmmac_eee_ctrl_timer(), it could enable hareware eee mode again. What is
+unexpected is that LPI interrupt (MAC_Interrupt_Enable.LPIEN bit) is always
+asserted. This interrupt has chance to be issued when LPI state entry/exit
+from the MAC, and at that time, clock could have been already disabled.
+The result is that system hang when driver try to touch register from
+interrupt handler.
+
+The reason why above commit can fix system hang issue in stmmac_release()
+is that, deactivate eee_ctrl_timer not just after napi disabled, further
+after irq freed.
+
+In conclusion, hardware would generate LPI interrupt when clock has been
+disabled during suspend or resume, since hardware is in eee mode and LPI
+interrupt enabled.
+
+Interrupts from MAC, MTL and DMA level are enabled and never been disabled
+when system suspend, so postpone clocks management from suspend stage to
+noirq suspend stage should be more safe.
+
+Fixes: 5f58591323bf ("net: stmmac: delete the eee_ctrl_timer after napi disabled")
+Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/stmicro/stmmac/stmmac_main.c | 14 ------
+ .../ethernet/stmicro/stmmac/stmmac_platform.c | 44 +++++++++++++++++++
+ 2 files changed, 44 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 4a75e73f06bbd..b6a2bc020026a 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -5238,7 +5238,6 @@ int stmmac_suspend(struct device *dev)
+ struct net_device *ndev = dev_get_drvdata(dev);
+ struct stmmac_priv *priv = netdev_priv(ndev);
+ u32 chan;
+- int ret;
+
+ if (!ndev || !netif_running(ndev))
+ return 0;
+@@ -5280,13 +5279,6 @@ int stmmac_suspend(struct device *dev)
+
+ stmmac_mac_set(priv, priv->ioaddr, false);
+ pinctrl_pm_select_sleep_state(priv->device);
+- /* Disable clock in case of PWM is off */
+- clk_disable_unprepare(priv->plat->clk_ptp_ref);
+- ret = pm_runtime_force_suspend(dev);
+- if (ret) {
+- mutex_unlock(&priv->lock);
+- return ret;
+- }
+ }
+ mutex_unlock(&priv->lock);
+
+@@ -5351,12 +5343,6 @@ int stmmac_resume(struct device *dev)
+ priv->irq_wake = 0;
+ } else {
+ pinctrl_pm_select_default_state(priv->device);
+- /* enable the clk previously disabled */
+- ret = pm_runtime_force_resume(dev);
+- if (ret)
+- return ret;
+- if (priv->plat->clk_ptp_ref)
+- clk_prepare_enable(priv->plat->clk_ptp_ref);
+ /* reset the phy so that it's ready */
+ if (priv->mii)
+ stmmac_mdio_reset(priv->mii);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+index 035f9aef4308f..5c9d29c42bac8 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+@@ -9,6 +9,7 @@
+ *******************************************************************************/
+
+ #include <linux/platform_device.h>
++#include <linux/pm_runtime.h>
+ #include <linux/module.h>
+ #include <linux/io.h>
+ #include <linux/of.h>
+@@ -778,9 +779,52 @@ static int __maybe_unused stmmac_runtime_resume(struct device *dev)
+ return stmmac_bus_clks_config(priv, true);
+ }
+
++static int stmmac_pltfr_noirq_suspend(struct device *dev)
++{
++ struct net_device *ndev = dev_get_drvdata(dev);
++ struct stmmac_priv *priv = netdev_priv(ndev);
++ int ret;
++
++ if (!netif_running(ndev))
++ return 0;
++
++ if (!device_may_wakeup(priv->device) || !priv->plat->pmt) {
++ /* Disable clock in case of PWM is off */
++ clk_disable_unprepare(priv->plat->clk_ptp_ref);
++
++ ret = pm_runtime_force_suspend(dev);
++ if (ret)
++ return ret;
++ }
++
++ return 0;
++}
++
++static int stmmac_pltfr_noirq_resume(struct device *dev)
++{
++ struct net_device *ndev = dev_get_drvdata(dev);
++ struct stmmac_priv *priv = netdev_priv(ndev);
++ int ret;
++
++ if (!netif_running(ndev))
++ return 0;
++
++ if (!device_may_wakeup(priv->device) || !priv->plat->pmt) {
++ /* enable the clk previously disabled */
++ ret = pm_runtime_force_resume(dev);
++ if (ret)
++ return ret;
++
++ clk_prepare_enable(priv->plat->clk_ptp_ref);
++ }
++
++ return 0;
++}
++
+ const struct dev_pm_ops stmmac_pltfr_pm_ops = {
+ SET_SYSTEM_SLEEP_PM_OPS(stmmac_pltfr_suspend, stmmac_pltfr_resume)
+ SET_RUNTIME_PM_OPS(stmmac_runtime_suspend, stmmac_runtime_resume, NULL)
++ SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(stmmac_pltfr_noirq_suspend, stmmac_pltfr_noirq_resume)
+ };
+ EXPORT_SYMBOL_GPL(stmmac_pltfr_pm_ops);
+
+--
+2.33.0
+
--- /dev/null
+From c9ba863192529bb6658a089e7c7e1a5ea70b2b83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Nov 2021 19:57:04 +0200
+Subject: net: stmmac: retain PTP clock time during SIOCSHWTSTAMP ioctls
+
+From: Holger Assmann <h.assmann@pengutronix.de>
+
+[ Upstream commit a6da2bbb0005e6b4909472962c9d0af29e75dd06 ]
+
+Currently, when user space emits SIOCSHWTSTAMP ioctl calls such as
+enabling/disabling timestamping or changing filter settings, the driver
+reads the current CLOCK_REALTIME value and programming this into the
+NIC's hardware clock. This might be necessary during system
+initialization, but at runtime, when the PTP clock has already been
+synchronized to a grandmaster, a reset of the timestamp settings might
+result in a clock jump. Furthermore, if the clock is also controlled by
+phc2sys in automatic mode (where the UTC offset is queried from ptp4l),
+that UTC-to-TAI offset (currently 37 seconds in 2021) would be
+temporarily reset to 0, and it would take a long time for phc2sys to
+readjust so that CLOCK_REALTIME and the PHC are apart by 37 seconds
+again.
+
+To address the issue, we introduce a new function called
+stmmac_init_tstamp_counter(), which gets called during ndo_open().
+It contains the code snippet moved from stmmac_hwtstamp_set() that
+manages the time synchronization. Besides, the sub second increment
+configuration is also moved here since the related values are hardware
+dependent and runtime invariant.
+
+Furthermore, the hardware clock must be kept running even when no time
+stamping mode is selected in order to retain the synchronized time base.
+That way, timestamping can be enabled again at any time only with the
+need to compensate the clock's natural drifting.
+
+As a side effect, this patch fixes the issue that ptp_clock_info::enable
+can be called before SIOCSHWTSTAMP and the driver (which looks at
+priv->systime_flags) was not prepared to handle that ordering.
+
+Fixes: 92ba6888510c ("stmmac: add the support for PTP hw clock driver")
+Reported-by: Michael Olbrich <m.olbrich@pengutronix.de>
+Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Signed-off-by: Holger Assmann <h.assmann@pengutronix.de>
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac.h | 1 +
+ .../net/ethernet/stmicro/stmmac/stmmac_main.c | 125 +++++++++++-------
+ .../ethernet/stmicro/stmmac/stmmac_platform.c | 2 +-
+ 3 files changed, 81 insertions(+), 47 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+index a4ca283e02284..617c960cfb5a5 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+@@ -258,6 +258,7 @@ int stmmac_mdio_register(struct net_device *ndev);
+ int stmmac_mdio_reset(struct mii_bus *mii);
+ void stmmac_set_ethtool_ops(struct net_device *netdev);
+
++int stmmac_init_tstamp_counter(struct stmmac_priv *priv, u32 systime_flags);
+ void stmmac_ptp_register(struct stmmac_priv *priv);
+ void stmmac_ptp_unregister(struct stmmac_priv *priv);
+ int stmmac_resume(struct device *dev);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index b6a2bc020026a..a8c5492cb39be 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -47,6 +47,13 @@
+ #include "dwxgmac2.h"
+ #include "hwif.h"
+
++/* As long as the interface is active, we keep the timestamping counter enabled
++ * with fine resolution and binary rollover. This avoid non-monotonic behavior
++ * (clock jumps) when changing timestamping settings at runtime.
++ */
++#define STMMAC_HWTS_ACTIVE (PTP_TCR_TSENA | PTP_TCR_TSCFUPDT | \
++ PTP_TCR_TSCTRLSSR)
++
+ #define STMMAC_ALIGN(x) ALIGN(ALIGN(x, SMP_CACHE_BYTES), 16)
+ #define TSO_MAX_BUFF_SIZE (SZ_16K - 1)
+
+@@ -508,8 +515,6 @@ static int stmmac_hwtstamp_set(struct net_device *dev, struct ifreq *ifr)
+ {
+ struct stmmac_priv *priv = netdev_priv(dev);
+ struct hwtstamp_config config;
+- struct timespec64 now;
+- u64 temp = 0;
+ u32 ptp_v2 = 0;
+ u32 tstamp_all = 0;
+ u32 ptp_over_ipv4_udp = 0;
+@@ -518,11 +523,6 @@ static int stmmac_hwtstamp_set(struct net_device *dev, struct ifreq *ifr)
+ u32 snap_type_sel = 0;
+ u32 ts_master_en = 0;
+ u32 ts_event_en = 0;
+- u32 sec_inc = 0;
+- u32 value = 0;
+- bool xmac;
+-
+- xmac = priv->plat->has_gmac4 || priv->plat->has_xgmac;
+
+ if (!(priv->dma_cap.time_stamp || priv->adv_ts)) {
+ netdev_alert(priv->dev, "No support for HW time stamping\n");
+@@ -684,42 +684,17 @@ static int stmmac_hwtstamp_set(struct net_device *dev, struct ifreq *ifr)
+ priv->hwts_rx_en = ((config.rx_filter == HWTSTAMP_FILTER_NONE) ? 0 : 1);
+ priv->hwts_tx_en = config.tx_type == HWTSTAMP_TX_ON;
+
+- if (!priv->hwts_tx_en && !priv->hwts_rx_en)
+- stmmac_config_hw_tstamping(priv, priv->ptpaddr, 0);
+- else {
+- value = (PTP_TCR_TSENA | PTP_TCR_TSCFUPDT | PTP_TCR_TSCTRLSSR |
+- tstamp_all | ptp_v2 | ptp_over_ethernet |
+- ptp_over_ipv6_udp | ptp_over_ipv4_udp | ts_event_en |
+- ts_master_en | snap_type_sel);
+- stmmac_config_hw_tstamping(priv, priv->ptpaddr, value);
+-
+- /* program Sub Second Increment reg */
+- stmmac_config_sub_second_increment(priv,
+- priv->ptpaddr, priv->plat->clk_ptp_rate,
+- xmac, &sec_inc);
+- temp = div_u64(1000000000ULL, sec_inc);
+-
+- /* Store sub second increment and flags for later use */
+- priv->sub_second_inc = sec_inc;
+- priv->systime_flags = value;
+-
+- /* calculate default added value:
+- * formula is :
+- * addend = (2^32)/freq_div_ratio;
+- * where, freq_div_ratio = 1e9ns/sec_inc
+- */
+- temp = (u64)(temp << 32);
+- priv->default_addend = div_u64(temp, priv->plat->clk_ptp_rate);
+- stmmac_config_addend(priv, priv->ptpaddr, priv->default_addend);
+-
+- /* initialize system time */
+- ktime_get_real_ts64(&now);
++ priv->systime_flags = STMMAC_HWTS_ACTIVE;
+
+- /* lower 32 bits of tv_sec are safe until y2106 */
+- stmmac_init_systime(priv, priv->ptpaddr,
+- (u32)now.tv_sec, now.tv_nsec);
++ if (priv->hwts_tx_en || priv->hwts_rx_en) {
++ priv->systime_flags |= tstamp_all | ptp_v2 |
++ ptp_over_ethernet | ptp_over_ipv6_udp |
++ ptp_over_ipv4_udp | ts_event_en |
++ ts_master_en | snap_type_sel;
+ }
+
++ stmmac_config_hw_tstamping(priv, priv->ptpaddr, priv->systime_flags);
++
+ memcpy(&priv->tstamp_config, &config, sizeof(config));
+
+ return copy_to_user(ifr->ifr_data, &config,
+@@ -747,6 +722,66 @@ static int stmmac_hwtstamp_get(struct net_device *dev, struct ifreq *ifr)
+ sizeof(*config)) ? -EFAULT : 0;
+ }
+
++/**
++ * stmmac_init_tstamp_counter - init hardware timestamping counter
++ * @priv: driver private structure
++ * @systime_flags: timestamping flags
++ * Description:
++ * Initialize hardware counter for packet timestamping.
++ * This is valid as long as the interface is open and not suspended.
++ * Will be rerun after resuming from suspend, case in which the timestamping
++ * flags updated by stmmac_hwtstamp_set() also need to be restored.
++ */
++int stmmac_init_tstamp_counter(struct stmmac_priv *priv, u32 systime_flags)
++{
++ bool xmac = priv->plat->has_gmac4 || priv->plat->has_xgmac;
++ struct timespec64 now;
++ u32 sec_inc = 0;
++ u64 temp = 0;
++ int ret;
++
++ if (!(priv->dma_cap.time_stamp || priv->dma_cap.atime_stamp))
++ return -EOPNOTSUPP;
++
++ ret = clk_prepare_enable(priv->plat->clk_ptp_ref);
++ if (ret < 0) {
++ netdev_warn(priv->dev,
++ "failed to enable PTP reference clock: %pe\n",
++ ERR_PTR(ret));
++ return ret;
++ }
++
++ stmmac_config_hw_tstamping(priv, priv->ptpaddr, systime_flags);
++ priv->systime_flags = systime_flags;
++
++ /* program Sub Second Increment reg */
++ stmmac_config_sub_second_increment(priv, priv->ptpaddr,
++ priv->plat->clk_ptp_rate,
++ xmac, &sec_inc);
++ temp = div_u64(1000000000ULL, sec_inc);
++
++ /* Store sub second increment for later use */
++ priv->sub_second_inc = sec_inc;
++
++ /* calculate default added value:
++ * formula is :
++ * addend = (2^32)/freq_div_ratio;
++ * where, freq_div_ratio = 1e9ns/sec_inc
++ */
++ temp = (u64)(temp << 32);
++ priv->default_addend = div_u64(temp, priv->plat->clk_ptp_rate);
++ stmmac_config_addend(priv, priv->ptpaddr, priv->default_addend);
++
++ /* initialize system time */
++ ktime_get_real_ts64(&now);
++
++ /* lower 32 bits of tv_sec are safe until y2106 */
++ stmmac_init_systime(priv, priv->ptpaddr, (u32)now.tv_sec, now.tv_nsec);
++
++ return 0;
++}
++EXPORT_SYMBOL_GPL(stmmac_init_tstamp_counter);
++
+ /**
+ * stmmac_init_ptp - init PTP
+ * @priv: driver private structure
+@@ -757,9 +792,11 @@ static int stmmac_hwtstamp_get(struct net_device *dev, struct ifreq *ifr)
+ static int stmmac_init_ptp(struct stmmac_priv *priv)
+ {
+ bool xmac = priv->plat->has_gmac4 || priv->plat->has_xgmac;
++ int ret;
+
+- if (!(priv->dma_cap.time_stamp || priv->dma_cap.atime_stamp))
+- return -EOPNOTSUPP;
++ ret = stmmac_init_tstamp_counter(priv, STMMAC_HWTS_ACTIVE);
++ if (ret)
++ return ret;
+
+ priv->adv_ts = 0;
+ /* Check if adv_ts can be enabled for dwmac 4.x / xgmac core */
+@@ -2721,10 +2758,6 @@ static int stmmac_hw_setup(struct net_device *dev, bool init_ptp)
+ stmmac_mmc_setup(priv);
+
+ if (init_ptp) {
+- ret = clk_prepare_enable(priv->plat->clk_ptp_ref);
+- if (ret < 0)
+- netdev_warn(priv->dev, "failed to enable PTP reference clock: %d\n", ret);
+-
+ ret = stmmac_init_ptp(priv);
+ if (ret == -EOPNOTSUPP)
+ netdev_warn(priv->dev, "PTP not supported by HW\n");
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+index 5c9d29c42bac8..4387752b26d95 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+@@ -815,7 +815,7 @@ static int stmmac_pltfr_noirq_resume(struct device *dev)
+ if (ret)
+ return ret;
+
+- clk_prepare_enable(priv->plat->clk_ptp_ref);
++ stmmac_init_tstamp_counter(priv, priv->systime_flags);
+ }
+
+ return 0;
+--
+2.33.0
+
--- /dev/null
+From 682ca560fcf34921a453347a0c4f07ea6a81399f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Nov 2021 09:59:42 +0800
+Subject: net: vlan: fix underflow for the real_dev refcnt
+
+From: Ziyang Xuan <william.xuanziyang@huawei.com>
+
+[ Upstream commit 01d9cc2dea3fde3bad6d27f464eff463496e2b00 ]
+
+Inject error before dev_hold(real_dev) in register_vlan_dev(),
+and execute the following testcase:
+
+ip link add dev dummy1 type dummy
+ip link add name dummy1.100 link dummy1 type vlan id 100
+ip link del dev dummy1
+
+When the dummy netdevice is removed, we will get a WARNING as following:
+
+=======================================================================
+refcount_t: decrement hit 0; leaking memory.
+WARNING: CPU: 2 PID: 0 at lib/refcount.c:31 refcount_warn_saturate+0xbf/0x1e0
+
+and an endless loop of:
+
+=======================================================================
+unregister_netdevice: waiting for dummy1 to become free. Usage count = -1073741824
+
+That is because dev_put(real_dev) in vlan_dev_free() be called without
+dev_hold(real_dev) in register_vlan_dev(). It makes the refcnt of real_dev
+underflow.
+
+Move the dev_hold(real_dev) to vlan_dev_init() which is the call-back of
+ndo_init(). That makes dev_hold() and dev_put() for vlan's real_dev
+symmetrical.
+
+Fixes: 563bcbae3ba2 ("net: vlan: fix a UAF in vlan_dev_real_dev()")
+Reported-by: Petr Machata <petrm@nvidia.com>
+Suggested-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
+Link: https://lore.kernel.org/r/20211126015942.2918542-1-william.xuanziyang@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/8021q/vlan.c | 3 ---
+ net/8021q/vlan_dev.c | 3 +++
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
+index ad3780067a7d8..d12c9a8a9953e 100644
+--- a/net/8021q/vlan.c
++++ b/net/8021q/vlan.c
+@@ -181,9 +181,6 @@ int register_vlan_dev(struct net_device *dev, struct netlink_ext_ack *extack)
+ if (err)
+ goto out_unregister_netdev;
+
+- /* Account for reference in struct vlan_dev_priv */
+- dev_hold(real_dev);
+-
+ vlan_stacked_transfer_operstate(real_dev, dev, vlan);
+ linkwatch_fire_event(dev); /* _MUST_ call rfc2863_policy() */
+
+diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
+index c7eba7dab0938..86a1c99025ea0 100644
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -606,6 +606,9 @@ static int vlan_dev_init(struct net_device *dev)
+ if (!vlan->vlan_pcpu_stats)
+ return -ENOMEM;
+
++ /* Get vlan's reference to real_dev */
++ dev_hold(real_dev);
++
+ return 0;
+ }
+
+--
+2.33.0
+
--- /dev/null
+From f4455299f04a8f3b1f76a50448e3042354c91e69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Nov 2021 23:21:55 +0100
+Subject: netfilter: ctnetlink: do not erase error code with EINVAL
+
+From: Florent Fourcot <florent.fourcot@wifirst.fr>
+
+[ Upstream commit 77522ff02f333434612bd72df9b376f8d3836e4d ]
+
+And be consistent in error management for both orig/reply filtering
+
+Fixes: cb8aa9a3affb ("netfilter: ctnetlink: add kernel side filtering for dump")
+Signed-off-by: Florent Fourcot <florent.fourcot@wifirst.fr>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_netlink.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index 39e0ff41688a7..60a1a666e797a 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -974,10 +974,8 @@ ctnetlink_alloc_filter(const struct nlattr * const cda[], u8 family)
+ filter->family,
+ &filter->zone,
+ filter->reply_flags);
+- if (err < 0) {
+- err = -EINVAL;
++ if (err < 0)
+ goto err_filter;
+- }
+ }
+
+ return filter;
+--
+2.33.0
+
--- /dev/null
+From 8a7f3000d203c5fafb37804f1de722b2d8081441 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Nov 2021 23:21:54 +0100
+Subject: netfilter: ctnetlink: fix filtering with CTA_TUPLE_REPLY
+
+From: Florent Fourcot <florent.fourcot@wifirst.fr>
+
+[ Upstream commit ad81d4daf6a3f4769a346e635d5e1e967ca455d9 ]
+
+filter->orig_flags was used for a reply context.
+
+Fixes: cb8aa9a3affb ("netfilter: ctnetlink: add kernel side filtering for dump")
+Signed-off-by: Florent Fourcot <florent.fourcot@wifirst.fr>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_netlink.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index cb4cfa4f61a8d..39e0ff41688a7 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -973,7 +973,7 @@ ctnetlink_alloc_filter(const struct nlattr * const cda[], u8 family)
+ CTA_TUPLE_REPLY,
+ filter->family,
+ &filter->zone,
+- filter->orig_flags);
++ filter->reply_flags);
+ if (err < 0) {
+ err = -EINVAL;
+ goto err_filter;
+--
+2.33.0
+
--- /dev/null
+From 6264268b6148959778188ebfa70114e08231d5b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Nov 2021 18:28:21 -0700
+Subject: netfilter: flowtable: fix IPv6 tunnel addr match
+
+From: Will Mortensen <willmo@gmail.com>
+
+[ Upstream commit 39f6eed4cb209643f3f8633291854ed7375d7264 ]
+
+Previously the IPv6 addresses in the key were clobbered and the mask was
+left unset.
+
+I haven't tested this; I noticed it while skimming the code to
+understand an unrelated issue.
+
+Fixes: cfab6dbd0ecf ("netfilter: flowtable: add tunnel match offload support")
+Cc: wenxu <wenxu@ucloud.cn>
+Signed-off-by: Will Mortensen <willmo@gmail.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_flow_table_offload.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
+index a6b654b028dd4..d1862782be450 100644
+--- a/net/netfilter/nf_flow_table_offload.c
++++ b/net/netfilter/nf_flow_table_offload.c
+@@ -63,11 +63,11 @@ static void nf_flow_rule_lwt_match(struct nf_flow_match *match,
+ sizeof(struct in6_addr));
+ if (memcmp(&key->enc_ipv6.src, &in6addr_any,
+ sizeof(struct in6_addr)))
+- memset(&key->enc_ipv6.src, 0xff,
++ memset(&mask->enc_ipv6.src, 0xff,
+ sizeof(struct in6_addr));
+ if (memcmp(&key->enc_ipv6.dst, &in6addr_any,
+ sizeof(struct in6_addr)))
+- memset(&key->enc_ipv6.dst, 0xff,
++ memset(&mask->enc_ipv6.dst, 0xff,
+ sizeof(struct in6_addr));
+ enc_keys |= BIT(FLOW_DISSECTOR_KEY_ENC_IPV6_ADDRS);
+ key->enc_control.addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
+--
+2.33.0
+
--- /dev/null
+From 18fed3cf5a6f28a2baba84d4fbae1f3df13743ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Nov 2021 03:10:29 +0100
+Subject: netfilter: ipvs: Fix reuse connection if RS weight is 0
+
+From: yangxingwu <xingwu.yang@gmail.com>
+
+[ Upstream commit c95c07836fa4c1767ed11d8eca0769c652760e32 ]
+
+We are changing expire_nodest_conn to work even for reused connections when
+conn_reuse_mode=0, just as what was done with commit dc7b3eb900aa ("ipvs:
+Fix reuse connection if real server is dead").
+
+For controlled and persistent connections, the new connection will get the
+needed real server depending on the rules in ip_vs_check_template().
+
+Fixes: d752c3645717 ("ipvs: allow rescheduling of new connections when port reuse is detected")
+Co-developed-by: Chuanqi Liu <legend050709@qq.com>
+Signed-off-by: Chuanqi Liu <legend050709@qq.com>
+Signed-off-by: yangxingwu <xingwu.yang@gmail.com>
+Acked-by: Simon Horman <horms@verge.net.au>
+Acked-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/networking/ipvs-sysctl.rst | 3 +--
+ net/netfilter/ipvs/ip_vs_core.c | 8 ++++----
+ 2 files changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/Documentation/networking/ipvs-sysctl.rst b/Documentation/networking/ipvs-sysctl.rst
+index 2afccc63856ee..1cfbf1add2fc9 100644
+--- a/Documentation/networking/ipvs-sysctl.rst
++++ b/Documentation/networking/ipvs-sysctl.rst
+@@ -37,8 +37,7 @@ conn_reuse_mode - INTEGER
+
+ 0: disable any special handling on port reuse. The new
+ connection will be delivered to the same real server that was
+- servicing the previous connection. This will effectively
+- disable expire_nodest_conn.
++ servicing the previous connection.
+
+ bit 1: enable rescheduling of new connections when it is safe.
+ That is, whenever expire_nodest_conn and for TCP sockets, when
+diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
+index c0b8215ab3d47..3a76da58d88bb 100644
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -1976,7 +1976,6 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int
+ struct ip_vs_proto_data *pd;
+ struct ip_vs_conn *cp;
+ int ret, pkts;
+- int conn_reuse_mode;
+ struct sock *sk;
+
+ /* Already marked as IPVS request or reply? */
+@@ -2053,15 +2052,16 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int
+ cp = INDIRECT_CALL_1(pp->conn_in_get, ip_vs_conn_in_get_proto,
+ ipvs, af, skb, &iph);
+
+- conn_reuse_mode = sysctl_conn_reuse_mode(ipvs);
+- if (conn_reuse_mode && !iph.fragoffs && is_new_conn(skb, &iph) && cp) {
++ if (!iph.fragoffs && is_new_conn(skb, &iph) && cp) {
++ int conn_reuse_mode = sysctl_conn_reuse_mode(ipvs);
+ bool old_ct = false, resched = false;
+
+ if (unlikely(sysctl_expire_nodest_conn(ipvs)) && cp->dest &&
+ unlikely(!atomic_read(&cp->dest->weight))) {
+ resched = true;
+ old_ct = ip_vs_conn_uses_old_conntrack(cp, skb);
+- } else if (is_new_conn_expected(cp, conn_reuse_mode)) {
++ } else if (conn_reuse_mode &&
++ is_new_conn_expected(cp, conn_reuse_mode)) {
+ old_ct = ip_vs_conn_uses_old_conntrack(cp, skb);
+ if (!atomic_read(&cp->n_control)) {
+ resched = true;
+--
+2.33.0
+
--- /dev/null
+From 5e1e4314fef50de75d88ece44cf9716ff357275b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Nov 2021 14:38:03 +0100
+Subject: nfp: checking parameter process for rx-usecs/tx-usecs is invalid
+
+From: Diana Wang <na.wang@corigine.com>
+
+[ Upstream commit 3bd6b2a838ba6a3b86d41b077f570b1b61174def ]
+
+Use nn->tlv_caps.me_freq_mhz instead of nn->me_freq_mhz to check whether
+rx-usecs/tx-usecs is valid.
+
+This is because nn->tlv_caps.me_freq_mhz represents the clock_freq (MHz) of
+the flow processing cores (FPC) on the NIC. While nn->me_freq_mhz is not
+be set.
+
+Fixes: ce991ab6662a ("nfp: read ME frequency from vNIC ctrl memory")
+Signed-off-by: Diana Wang <na.wang@corigine.com>
+Signed-off-by: Simon Horman <simon.horman@corigine.com>
+Reviewed-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/netronome/nfp/nfp_net.h | 3 ---
+ drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +-
+ 2 files changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net.h b/drivers/net/ethernet/netronome/nfp/nfp_net.h
+index df5b748be068c..cc2ce452000a3 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net.h
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net.h
+@@ -557,7 +557,6 @@ struct nfp_net_dp {
+ * @exn_name: Name for Exception interrupt
+ * @shared_handler: Handler for shared interrupts
+ * @shared_name: Name for shared interrupt
+- * @me_freq_mhz: ME clock_freq (MHz)
+ * @reconfig_lock: Protects @reconfig_posted, @reconfig_timer_active,
+ * @reconfig_sync_present and HW reconfiguration request
+ * regs/machinery from async requests (sync must take
+@@ -640,8 +639,6 @@ struct nfp_net {
+ irq_handler_t shared_handler;
+ char shared_name[IFNAMSIZ + 8];
+
+- u32 me_freq_mhz;
+-
+ bool link_up;
+ spinlock_t link_status_lock;
+
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+index c036a1d0f8de6..cd0c9623f7dd2 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+@@ -1347,7 +1347,7 @@ static int nfp_net_set_coalesce(struct net_device *netdev,
+ * ME timestamp ticks. There are 16 ME clock cycles for each timestamp
+ * count.
+ */
+- factor = nn->me_freq_mhz / 16;
++ factor = nn->tlv_caps.me_freq_mhz / 16;
+
+ /* Each pair of (usecs, max_frames) fields specifies that interrupts
+ * should be coalesced until
+--
+2.33.0
+
--- /dev/null
+From aee36319a2cf5f2cf8faa584289693178f1b4197 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Nov 2021 09:55:01 -0500
+Subject: NFSv42: Don't fail clone() unless the OP_CLONE operation failed
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit d3c45824ad65aebf765fcf51366d317a29538820 ]
+
+The failure to retrieve post-op attributes has no bearing on whether or
+not the clone operation itself was successful. We must therefore ignore
+the return value of decode_getfattr() when looking at the success or
+failure of nfs4_xdr_dec_clone().
+
+Fixes: 36022770de6c ("nfs42: add CLONE xdr functions")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs42xdr.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/nfs/nfs42xdr.c b/fs/nfs/nfs42xdr.c
+index c078f88552695..f2248d9d4db51 100644
+--- a/fs/nfs/nfs42xdr.c
++++ b/fs/nfs/nfs42xdr.c
+@@ -1396,8 +1396,7 @@ static int nfs4_xdr_dec_clone(struct rpc_rqst *rqstp,
+ status = decode_clone(xdr);
+ if (status)
+ goto out;
+- status = decode_getfattr(xdr, res->dst_fattr, res->server);
+-
++ decode_getfattr(xdr, res->dst_fattr, res->server);
+ out:
+ res->rpc_status = status;
+ return status;
+--
+2.33.0
+
--- /dev/null
+From 4ed72372357156a7094c4d2cc71c6b7f7944df3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Nov 2021 15:38:41 +0530
+Subject: nvmet-tcp: fix incomplete data digest send
+
+From: Varun Prakash <varun@chelsio.com>
+
+[ Upstream commit 102110efdff6beedece6ab9b51664c32ac01e2db ]
+
+Current nvmet_try_send_ddgst() code does not check whether
+all data digest bytes are transmitted, fix this by returning
+-EAGAIN if all data digest bytes are not transmitted.
+
+Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver")
+Signed-off-by: Varun Prakash <varun@chelsio.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/tcp.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
+index 1251fd6e92780..96b67a70cbbbd 100644
+--- a/drivers/nvme/target/tcp.c
++++ b/drivers/nvme/target/tcp.c
+@@ -688,10 +688,11 @@ static int nvmet_try_send_r2t(struct nvmet_tcp_cmd *cmd, bool last_in_batch)
+ static int nvmet_try_send_ddgst(struct nvmet_tcp_cmd *cmd, bool last_in_batch)
+ {
+ struct nvmet_tcp_queue *queue = cmd->queue;
++ int left = NVME_TCP_DIGEST_LENGTH - cmd->offset;
+ struct msghdr msg = { .msg_flags = MSG_DONTWAIT };
+ struct kvec iov = {
+ .iov_base = (u8 *)&cmd->exp_ddgst + cmd->offset,
+- .iov_len = NVME_TCP_DIGEST_LENGTH - cmd->offset
++ .iov_len = left
+ };
+ int ret;
+
+@@ -705,6 +706,10 @@ static int nvmet_try_send_ddgst(struct nvmet_tcp_cmd *cmd, bool last_in_batch)
+ return ret;
+
+ cmd->offset += ret;
++ left -= ret;
++
++ if (left)
++ return -EAGAIN;
+
+ if (queue->nvme_sq.sqhd_disabled) {
+ cmd->queue->snd_cmd = NULL;
+--
+2.33.0
+
--- /dev/null
+From 4fb51dd1c88b452068de06b0d930997383567e4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Nov 2021 11:08:27 +0100
+Subject: nvmet: use IOCB_NOWAIT only if the filesystem supports it
+
+From: Maurizio Lombardi <mlombard@redhat.com>
+
+[ Upstream commit c024b226a417c4eb9353ff500b1c823165d4d508 ]
+
+Submit I/O requests with the IOCB_NOWAIT flag set only if
+the underlying filesystem supports it.
+
+Fixes: 50a909db36f2 ("nvmet: use IOCB_NOWAIT for file-ns buffered I/O")
+Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/io-cmd-file.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/target/io-cmd-file.c b/drivers/nvme/target/io-cmd-file.c
+index b575997244482..c81690b2a681b 100644
+--- a/drivers/nvme/target/io-cmd-file.c
++++ b/drivers/nvme/target/io-cmd-file.c
+@@ -8,6 +8,7 @@
+ #include <linux/uio.h>
+ #include <linux/falloc.h>
+ #include <linux/file.h>
++#include <linux/fs.h>
+ #include "nvmet.h"
+
+ #define NVMET_MAX_MPOOL_BVEC 16
+@@ -266,7 +267,8 @@ static void nvmet_file_execute_rw(struct nvmet_req *req)
+
+ if (req->ns->buffered_io) {
+ if (likely(!req->f.mpool_alloc) &&
+- nvmet_file_execute_io(req, IOCB_NOWAIT))
++ (req->ns->file->f_mode & FMODE_NOWAIT) &&
++ nvmet_file_execute_io(req, IOCB_NOWAIT))
+ return;
+ nvmet_file_submit_buffered_io(req);
+ } else
+--
+2.33.0
+
--- /dev/null
+From 3b44cdd0a249894c11aed28fd8db65975b893966 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Nov 2021 20:18:43 +0100
+Subject: PM: hibernate: use correct mode for swsusp_close()
+
+From: Thomas Zeitlhofer <thomas.zeitlhofer+lkml@ze-it.at>
+
+[ Upstream commit cefcf24b4d351daf70ecd945324e200d3736821e ]
+
+Commit 39fbef4b0f77 ("PM: hibernate: Get block device exclusively in
+swsusp_check()") changed the opening mode of the block device to
+(FMODE_READ | FMODE_EXCL).
+
+In the corresponding calls to swsusp_close(), the mode is still just
+FMODE_READ which triggers the warning in blkdev_flush_mapping() on
+resume from hibernate.
+
+So, use the mode (FMODE_READ | FMODE_EXCL) also when closing the
+device.
+
+Fixes: 39fbef4b0f77 ("PM: hibernate: Get block device exclusively in swsusp_check()")
+Signed-off-by: Thomas Zeitlhofer <thomas.zeitlhofer+lkml@ze-it.at>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/power/hibernate.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
+index 2fc7d509a34fc..bf640fd6142a0 100644
+--- a/kernel/power/hibernate.c
++++ b/kernel/power/hibernate.c
+@@ -688,7 +688,7 @@ static int load_image_and_restore(void)
+ goto Unlock;
+
+ error = swsusp_read(&flags);
+- swsusp_close(FMODE_READ);
++ swsusp_close(FMODE_READ | FMODE_EXCL);
+ if (!error)
+ error = hibernation_restore(flags & SF_PLATFORM_MODE);
+
+@@ -978,7 +978,7 @@ static int software_resume(void)
+ /* The snapshot device should not be opened while we're running */
+ if (!hibernate_acquire()) {
+ error = -EBUSY;
+- swsusp_close(FMODE_READ);
++ swsusp_close(FMODE_READ | FMODE_EXCL);
+ goto Unlock;
+ }
+
+@@ -1013,7 +1013,7 @@ static int software_resume(void)
+ pm_pr_dbg("Hibernation image not present or could not be loaded.\n");
+ return error;
+ Close_Finish:
+- swsusp_close(FMODE_READ);
++ swsusp_close(FMODE_READ | FMODE_EXCL);
+ goto Finish;
+ }
+
+--
+2.33.0
+
--- /dev/null
+From 0937c6ed8c02c5dc2956221a50a7a6979e9b8d76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Nov 2021 10:49:17 -0600
+Subject: scsi: core: sysfs: Fix setting device state to SDEV_RUNNING
+
+From: Mike Christie <michael.christie@oracle.com>
+
+[ Upstream commit eb97545d6264b341b06ba7603f52ff6c0b2af6ea ]
+
+This fixes an issue added in commit 4edd8cd4e86d ("scsi: core: sysfs: Fix
+hang when device state is set via sysfs") where if userspace is requesting
+to set the device state to SDEV_RUNNING when the state is already
+SDEV_RUNNING, we return -EINVAL instead of count. The commmit above set ret
+to count for this case, when it should have set it to 0.
+
+Link: https://lore.kernel.org/r/20211120164917.4924-1-michael.christie@oracle.com
+Fixes: 4edd8cd4e86d ("scsi: core: sysfs: Fix hang when device state is set via sysfs")
+Reviewed-by: Lee Duncan <lduncan@suse.com>
+Signed-off-by: Mike Christie <michael.christie@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_sysfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
+index 8de67679a8782..42db9c52208e6 100644
+--- a/drivers/scsi/scsi_sysfs.c
++++ b/drivers/scsi/scsi_sysfs.c
+@@ -816,7 +816,7 @@ store_state_field(struct device *dev, struct device_attribute *attr,
+
+ mutex_lock(&sdev->state_mutex);
+ if (sdev->sdev_state == SDEV_RUNNING && state == SDEV_RUNNING) {
+- ret = count;
++ ret = 0;
+ } else {
+ ret = scsi_device_set_state(sdev, state);
+ if (ret == 0 && state == SDEV_RUNNING)
+--
+2.33.0
+
--- /dev/null
+From 165d3f6e710b7fb5185ca4d56f86c59434dc8b84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Nov 2021 16:19:09 +0530
+Subject: scsi: mpt3sas: Fix kernel panic during drive powercycle test
+
+From: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+
+[ Upstream commit 0ee4ba13e09c9d9c1cb6abb59da8295d9952328b ]
+
+While looping over shost's sdev list it is possible that one
+of the drives is getting removed and its sas_target object is
+freed but its sdev object remains intact.
+
+Consequently, a kernel panic can occur while the driver is trying to access
+the sas_address field of sas_target object without also checking the
+sas_target object for NULL.
+
+Link: https://lore.kernel.org/r/20211117104909.2069-1-sreekanth.reddy@broadcom.com
+Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS")
+Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+index 31c384108bc9c..8418b59b3743b 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -3675,7 +3675,7 @@ _scsih_ublock_io_device(struct MPT3SAS_ADAPTER *ioc, u64 sas_address)
+
+ shost_for_each_device(sdev, ioc->shost) {
+ sas_device_priv_data = sdev->hostdata;
+- if (!sas_device_priv_data)
++ if (!sas_device_priv_data || !sas_device_priv_data->sas_target)
+ continue;
+ if (sas_device_priv_data->sas_target->sas_address
+ != sas_address)
+--
+2.33.0
+
--- /dev/null
+From d094da7150dd83c72796427e7d62550aaabb16aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Nov 2021 15:12:23 +0900
+Subject: scsi: scsi_debug: Zero clear zones at reset write pointer
+
+From: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+
+[ Upstream commit 2d62253eb1b60f4ce8b39125eee282739b519297 ]
+
+When a reset is requested the position of the write pointer is updated but
+the data in the corresponding zone is not cleared. Instead scsi_debug
+returns any data written before the write pointer was reset. This is an
+error and prevents using scsi_debug for stale page cache testing of the
+BLKRESETZONE ioctl.
+
+Zero written data in the zone when resetting the write pointer.
+
+Link: https://lore.kernel.org/r/20211122061223.298890-1-shinichiro.kawasaki@wdc.com
+Fixes: f0d1cf9378bd ("scsi: scsi_debug: Add ZBC zone commands")
+Reviewed-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Acked-by: Douglas Gilbert <dgilbert@interlog.com>
+Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_debug.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
+index 3fc7c2a31c191..1a3f5adc68849 100644
+--- a/drivers/scsi/scsi_debug.c
++++ b/drivers/scsi/scsi_debug.c
+@@ -4628,6 +4628,7 @@ static void zbc_rwp_zone(struct sdebug_dev_info *devip,
+ struct sdeb_zone_state *zsp)
+ {
+ enum sdebug_z_cond zc;
++ struct sdeb_store_info *sip = devip2sip(devip, false);
+
+ if (zbc_zone_is_conv(zsp))
+ return;
+@@ -4639,6 +4640,10 @@ static void zbc_rwp_zone(struct sdebug_dev_info *devip,
+ if (zsp->z_cond == ZC4_CLOSED)
+ devip->nr_closed--;
+
++ if (zsp->z_wp > zsp->z_start)
++ memset(sip->storep + zsp->z_start * sdebug_sector_size, 0,
++ (zsp->z_wp - zsp->z_start) * sdebug_sector_size);
++
+ zsp->z_non_seq_resource = false;
+ zsp->z_wp = zsp->z_start;
+ zsp->z_cond = ZC1_EMPTY;
+--
+2.33.0
+
pci-aardvark-simplify-initialization-of-rootcap-on-virtual-bridge.patch
pci-aardvark-fix-link-training.patch
proc-vmcore-fix-clearing-user-buffer-by-properly-using-clear_user.patch
+netfilter-ctnetlink-fix-filtering-with-cta_tuple_rep.patch
+netfilter-ctnetlink-do-not-erase-error-code-with-ein.patch
+netfilter-ipvs-fix-reuse-connection-if-rs-weight-is-.patch
+netfilter-flowtable-fix-ipv6-tunnel-addr-match.patch
+arm-dts-bcm5301x-fix-i2c-controller-interrupt.patch
+arm-dts-bcm5301x-add-interrupt-properties-to-gpio-no.patch
+arm-dts-bcm2711-fix-pcie-interrupts.patch
+asoc-qdsp6-q6routing-conditionally-reset-frontend-mi.patch
+asoc-qdsp6-q6asm-fix-q6asm_dai_prepare-error-handlin.patch
+asoc-topology-add-missing-rwsem-around-snd_ctl_remov.patch
+asoc-codecs-wcd934x-return-error-code-correctly-from.patch
+net-ieee802154-handle-iftypes-as-u32.patch
+firmware-arm_scmi-pm-propagate-return-value-to-calle.patch
+nfsv42-don-t-fail-clone-unless-the-op_clone-operatio.patch
+arm-socfpga-fix-crash-with-config_fortiry_source.patch
+drm-nouveau-acr-fix-a-couple-null-vs-is_err-checks.patch
+scsi-mpt3sas-fix-kernel-panic-during-drive-powercycl.patch
+drm-vc4-fix-error-code-in-vc4_create_object.patch
+net-marvell-prestera-fix-double-free-issue-on-err-pa.patch
+iavf-prevent-changing-static-itr-values-if-adaptive-.patch
+alsa-intel-dsp-config-add-quirk-for-jsl-devices-base.patch
+mptcp-fix-delack-timer.patch
+firmware-smccc-fix-check-for-arch_soc_id-not-impleme.patch
+ipv6-fix-typos-in-__ip6_finish_output.patch
+nfp-checking-parameter-process-for-rx-usecs-tx-usecs.patch
+net-stmmac-fix-system-hang-caused-by-eee_ctrl_timer-.patch
+net-stmmac-retain-ptp-clock-time-during-siocshwtstam.patch
+net-ipv6-add-fib6_nh_release_dsts-stub.patch
+net-nexthop-release-ipv6-per-cpu-dsts-when-replacing.patch
+ice-fix-vsi-txq_map-sizing.patch
+ice-avoid-bpf_prog-refcount-underflow.patch
+scsi-core-sysfs-fix-setting-device-state-to-sdev_run.patch
+scsi-scsi_debug-zero-clear-zones-at-reset-write-poin.patch
+erofs-fix-deadlock-when-shrink-erofs-slab.patch
+net-smc-ensure-the-active-closing-peer-first-closes-.patch
+mlxsw-verify-the-accessed-index-doesn-t-exceed-the-a.patch
+mlxsw-spectrum-protect-driver-from-buggy-firmware.patch
+net-marvell-mvpp2-increase-mtu-limit-when-xdp-enable.patch
+nvmet-tcp-fix-incomplete-data-digest-send.patch
+net-ncsi-add-payload-to-be-32-bit-aligned-to-fix-dro.patch
+pm-hibernate-use-correct-mode-for-swsusp_close.patch
+drm-amd-display-set-plane-update-flags-for-all-plane.patch
+tcp_cubic-fix-spurious-hystart-ack-train-detections-.patch
+lan743x-fix-deadlock-in-lan743x_phy_link_status_chan.patch
+net-phylink-force-link-down-and-retrigger-resolve-on.patch
+net-phylink-force-retrigger-in-case-of-latched-link-.patch
+net-smc-fix-null-pointer-dereferencing-in-smc_vlan_b.patch
+net-smc-fix-loop-in-smc_listen.patch
+nvmet-use-iocb_nowait-only-if-the-filesystem-support.patch
+igb-fix-netpoll-exit-with-traffic.patch
+mips-loongson64-fix-ftlb-configuration.patch
+mips-use-3-level-pgtable-for-64kb-page-size-on-mips_.patch
+tls-splice_read-fix-record-type-check.patch
+tls-fix-replacing-proto_ops.patch
+net-sched-sch_ets-don-t-peek-at-classes-beyond-nband.patch
+net-vlan-fix-underflow-for-the-real_dev-refcnt.patch
+net-smc-don-t-call-clcsock-shutdown-twice-when-smc-s.patch
+net-hns3-fix-vf-rss-failed-problem-after-pf-enable-m.patch
+net-mscc-ocelot-don-t-downgrade-timestamping-rx-filt.patch
+net-mscc-ocelot-correctly-report-the-timestamping-rx.patch
+tcp-correctly-handle-increased-zerocopy-args-struct-.patch
--- /dev/null
+From 8d216c01c038722d7175cfa55fe1adc4f7782591 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 11:16:03 -0800
+Subject: tcp: correctly handle increased zerocopy args struct size
+
+From: Arjun Roy <arjunroy@google.com>
+
+[ Upstream commit e0fecb289ad3fd2245cdc50bf450b97fcca39884 ]
+
+A prior patch increased the size of struct tcp_zerocopy_receive
+but did not update do_tcp_getsockopt() handling to properly account
+for this.
+
+This patch simply reintroduces content erroneously cut from the
+referenced prior patch that handles the new struct size.
+
+Fixes: 18fb76ed5386 ("net-zerocopy: Copy straggler unaligned data for TCP Rx. zerocopy.")
+Signed-off-by: Arjun Roy <arjunroy@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Soheil Hassas Yeganeh <soheil@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index bb16c88f58a3c..63c81af41b43e 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -3931,7 +3931,7 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
+ }
+ #ifdef CONFIG_MMU
+ case TCP_ZEROCOPY_RECEIVE: {
+- struct tcp_zerocopy_receive zc;
++ struct tcp_zerocopy_receive zc = {};
+ int err;
+
+ if (get_user(len, optlen))
+@@ -3949,7 +3949,7 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
+ lock_sock(sk);
+ err = tcp_zerocopy_receive(sk, &zc);
+ release_sock(sk);
+- if (len == sizeof(zc))
++ if (len >= offsetofend(struct tcp_zerocopy_receive, err))
+ goto zerocopy_rcv_sk_err;
+ switch (len) {
+ case offsetofend(struct tcp_zerocopy_receive, err):
+--
+2.33.0
+
--- /dev/null
+From f570b3189c61b128383c5dda007cece674082bbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Nov 2021 12:25:35 -0800
+Subject: tcp_cubic: fix spurious Hystart ACK train detections for
+ not-cwnd-limited flows
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 4e1fddc98d2585ddd4792b5e44433dcee7ece001 ]
+
+While testing BIG TCP patch series, I was expecting that TCP_RR workloads
+with 80KB requests/answers would send one 80KB TSO packet,
+then being received as a single GRO packet.
+
+It turns out this was not happening, and the root cause was that
+cubic Hystart ACK train was triggering after a few (2 or 3) rounds of RPC.
+
+Hystart was wrongly setting CWND/SSTHRESH to 30, while my RPC
+needed a budget of ~20 segments.
+
+Ideally these TCP_RR flows should not exit slow start.
+
+Cubic Hystart should reset itself at each round, instead of assuming
+every TCP flow is a bulk one.
+
+Note that even after this patch, Hystart can still trigger, depending
+on scheduling artifacts, but at a higher CWND/SSTHRESH threshold,
+keeping optimal TSO packet sizes.
+
+Tested:
+
+ip link set dev eth0 gro_ipv6_max_size 131072 gso_ipv6_max_size 131072
+nstat -n; netperf -H ... -t TCP_RR -l 5 -- -r 80000,80000 -K cubic; nstat|egrep "Ip6InReceives|Hystart|Ip6OutRequests"
+
+Before:
+
+ 8605
+Ip6InReceives 87541 0.0
+Ip6OutRequests 129496 0.0
+TcpExtTCPHystartTrainDetect 1 0.0
+TcpExtTCPHystartTrainCwnd 30 0.0
+
+After:
+
+ 8760
+Ip6InReceives 88514 0.0
+Ip6OutRequests 87975 0.0
+
+Fixes: ae27e98a5152 ("[TCP] CUBIC v2.3")
+Co-developed-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Stephen Hemminger <stephen@networkplumber.org>
+Cc: Yuchung Cheng <ycheng@google.com>
+Cc: Soheil Hassas Yeganeh <soheil@google.com>
+Link: https://lore.kernel.org/r/20211123202535.1843771-1-eric.dumazet@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_cubic.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
+index c7bf5b26bf0c2..fffa011a007d4 100644
+--- a/net/ipv4/tcp_cubic.c
++++ b/net/ipv4/tcp_cubic.c
+@@ -337,8 +337,6 @@ static void bictcp_cong_avoid(struct sock *sk, u32 ack, u32 acked)
+ return;
+
+ if (tcp_in_slow_start(tp)) {
+- if (hystart && after(ack, ca->end_seq))
+- bictcp_hystart_reset(sk);
+ acked = tcp_slow_start(tp, acked);
+ if (!acked)
+ return;
+@@ -398,6 +396,9 @@ static void hystart_update(struct sock *sk, u32 delay)
+ struct bictcp *ca = inet_csk_ca(sk);
+ u32 threshold;
+
++ if (after(tp->snd_una, ca->end_seq))
++ bictcp_hystart_reset(sk);
++
+ if (hystart_detect & HYSTART_ACK_TRAIN) {
+ u32 now = bictcp_clock_us(sk);
+
+--
+2.33.0
+
--- /dev/null
+From f7e66b03ea39f33ec32ef01b3ed0cefb52445750 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Nov 2021 15:25:56 -0800
+Subject: tls: fix replacing proto_ops
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit f3911f73f51d1534f4db70b516cc1fcb6be05bae ]
+
+We replace proto_ops whenever TLS is configured for RX. But our
+replacement also overrides sendpage_locked, which will crash
+unless TX is also configured. Similarly we plug both of those
+in for TLS_HW (NIC crypto offload) even tho TLS_HW has a completely
+different implementation for TX.
+
+Last but not least we always plug in something based on inet_stream_ops
+even though a few of the callbacks differ for IPv6 (getname, release,
+bind).
+
+Use a callback building method similar to what we do for struct proto.
+
+Fixes: c46234ebb4d1 ("tls: RX path for ktls")
+Fixes: d4ffb02dee2f ("net/tls: enable sk_msg redirect to tls socket egress")
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_main.c | 47 +++++++++++++++++++++++++++++++++++++++-------
+ 1 file changed, 40 insertions(+), 7 deletions(-)
+
+diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
+index 32a51b20509c9..58d22d6b86ae6 100644
+--- a/net/tls/tls_main.c
++++ b/net/tls/tls_main.c
+@@ -61,7 +61,7 @@ static DEFINE_MUTEX(tcpv6_prot_mutex);
+ static const struct proto *saved_tcpv4_prot;
+ static DEFINE_MUTEX(tcpv4_prot_mutex);
+ static struct proto tls_prots[TLS_NUM_PROTS][TLS_NUM_CONFIG][TLS_NUM_CONFIG];
+-static struct proto_ops tls_sw_proto_ops;
++static struct proto_ops tls_proto_ops[TLS_NUM_PROTS][TLS_NUM_CONFIG][TLS_NUM_CONFIG];
+ static void build_protos(struct proto prot[TLS_NUM_CONFIG][TLS_NUM_CONFIG],
+ const struct proto *base);
+
+@@ -71,6 +71,8 @@ void update_sk_prot(struct sock *sk, struct tls_context *ctx)
+
+ WRITE_ONCE(sk->sk_prot,
+ &tls_prots[ip_ver][ctx->tx_conf][ctx->rx_conf]);
++ WRITE_ONCE(sk->sk_socket->ops,
++ &tls_proto_ops[ip_ver][ctx->tx_conf][ctx->rx_conf]);
+ }
+
+ int wait_on_pending_writer(struct sock *sk, long *timeo)
+@@ -578,8 +580,6 @@ static int do_tls_setsockopt_conf(struct sock *sk, sockptr_t optval,
+ if (tx) {
+ ctx->sk_write_space = sk->sk_write_space;
+ sk->sk_write_space = tls_write_space;
+- } else {
+- sk->sk_socket->ops = &tls_sw_proto_ops;
+ }
+ goto out;
+
+@@ -637,6 +637,39 @@ struct tls_context *tls_ctx_create(struct sock *sk)
+ return ctx;
+ }
+
++static void build_proto_ops(struct proto_ops ops[TLS_NUM_CONFIG][TLS_NUM_CONFIG],
++ const struct proto_ops *base)
++{
++ ops[TLS_BASE][TLS_BASE] = *base;
++
++ ops[TLS_SW ][TLS_BASE] = ops[TLS_BASE][TLS_BASE];
++ ops[TLS_SW ][TLS_BASE].sendpage_locked = tls_sw_sendpage_locked;
++
++ ops[TLS_BASE][TLS_SW ] = ops[TLS_BASE][TLS_BASE];
++ ops[TLS_BASE][TLS_SW ].splice_read = tls_sw_splice_read;
++
++ ops[TLS_SW ][TLS_SW ] = ops[TLS_SW ][TLS_BASE];
++ ops[TLS_SW ][TLS_SW ].splice_read = tls_sw_splice_read;
++
++#ifdef CONFIG_TLS_DEVICE
++ ops[TLS_HW ][TLS_BASE] = ops[TLS_BASE][TLS_BASE];
++ ops[TLS_HW ][TLS_BASE].sendpage_locked = NULL;
++
++ ops[TLS_HW ][TLS_SW ] = ops[TLS_BASE][TLS_SW ];
++ ops[TLS_HW ][TLS_SW ].sendpage_locked = NULL;
++
++ ops[TLS_BASE][TLS_HW ] = ops[TLS_BASE][TLS_SW ];
++
++ ops[TLS_SW ][TLS_HW ] = ops[TLS_SW ][TLS_SW ];
++
++ ops[TLS_HW ][TLS_HW ] = ops[TLS_HW ][TLS_SW ];
++ ops[TLS_HW ][TLS_HW ].sendpage_locked = NULL;
++#endif
++#ifdef CONFIG_TLS_TOE
++ ops[TLS_HW_RECORD][TLS_HW_RECORD] = *base;
++#endif
++}
++
+ static void tls_build_proto(struct sock *sk)
+ {
+ int ip_ver = sk->sk_family == AF_INET6 ? TLSV6 : TLSV4;
+@@ -648,6 +681,8 @@ static void tls_build_proto(struct sock *sk)
+ mutex_lock(&tcpv6_prot_mutex);
+ if (likely(prot != saved_tcpv6_prot)) {
+ build_protos(tls_prots[TLSV6], prot);
++ build_proto_ops(tls_proto_ops[TLSV6],
++ sk->sk_socket->ops);
+ smp_store_release(&saved_tcpv6_prot, prot);
+ }
+ mutex_unlock(&tcpv6_prot_mutex);
+@@ -658,6 +693,8 @@ static void tls_build_proto(struct sock *sk)
+ mutex_lock(&tcpv4_prot_mutex);
+ if (likely(prot != saved_tcpv4_prot)) {
+ build_protos(tls_prots[TLSV4], prot);
++ build_proto_ops(tls_proto_ops[TLSV4],
++ sk->sk_socket->ops);
+ smp_store_release(&saved_tcpv4_prot, prot);
+ }
+ mutex_unlock(&tcpv4_prot_mutex);
+@@ -868,10 +905,6 @@ static int __init tls_register(void)
+ if (err)
+ return err;
+
+- tls_sw_proto_ops = inet_stream_ops;
+- tls_sw_proto_ops.splice_read = tls_sw_splice_read;
+- tls_sw_proto_ops.sendpage_locked = tls_sw_sendpage_locked;
+-
+ tls_device_init();
+ tcp_register_ulp(&tcp_tls_ulp_ops);
+
+--
+2.33.0
+
--- /dev/null
+From e1daaf15e6b17de413030ca0aeefab746a41ba82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Nov 2021 15:25:52 -0800
+Subject: tls: splice_read: fix record type check
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 520493f66f6822551aef2879cd40207074fe6980 ]
+
+We don't support splicing control records. TLS 1.3 changes moved
+the record type check into the decrypt if(). The skb may already
+be decrypted and still be an alert.
+
+Note that decrypt_skb_update() is idempotent and updates ctx->decrypted
+so the if() is pointless.
+
+Reorder the check for decryption errors with the content type check
+while touching them. This part is not really a bug, because if
+decryption failed in TLS 1.3 content type will be DATA, and for
+TLS 1.2 it will be correct. Nevertheless its strange to touch output
+before checking if the function has failed.
+
+Fixes: fedf201e1296 ("net: tls: Refactor control message handling on recv")
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 23 ++++++++++-------------
+ 1 file changed, 10 insertions(+), 13 deletions(-)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index 14cce61160a58..122d5daed8b61 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -2007,21 +2007,18 @@ ssize_t tls_sw_splice_read(struct socket *sock, loff_t *ppos,
+ if (!skb)
+ goto splice_read_end;
+
+- if (!ctx->decrypted) {
+- err = decrypt_skb_update(sk, skb, NULL, &chunk, &zc, false);
+-
+- /* splice does not support reading control messages */
+- if (ctx->control != TLS_RECORD_TYPE_DATA) {
+- err = -EINVAL;
+- goto splice_read_end;
+- }
++ err = decrypt_skb_update(sk, skb, NULL, &chunk, &zc, false);
++ if (err < 0) {
++ tls_err_abort(sk, -EBADMSG);
++ goto splice_read_end;
++ }
+
+- if (err < 0) {
+- tls_err_abort(sk, -EBADMSG);
+- goto splice_read_end;
+- }
+- ctx->decrypted = 1;
++ /* splice does not support reading control messages */
++ if (ctx->control != TLS_RECORD_TYPE_DATA) {
++ err = -EINVAL;
++ goto splice_read_end;
+ }
++
+ rxm = strp_msg(skb);
+
+ chunk = min_t(unsigned int, rxm->full_len, len);
+--
+2.33.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
