Fixes for 4.9

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-4.9/e1000e-fix-the-max-snoop-no-snoop-latency-for-10m.patch b/queue-4.9/e1000e-fix-the-max-snoop-no-snoop-latency-for-10m.patch
new file mode 100644 (file)
index 0000000..914b22c
--- /dev/null
+++ b/queue-4.9/e1000e-fix-the-max-snoop-no-snoop-latency-for-10m.patch
@@ -0,0 +1,76 @@
+From a833c9ac8bca938dfe27c0d1b083a4ebdca35362 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jul 2021 10:11:41 +0300
+Subject: e1000e: Fix the max snoop/no-snoop latency for 10M
+
+From: Sasha Neftin <sasha.neftin@intel.com>
+
+[ Upstream commit 44a13a5d99c71bf9e1676d9e51679daf4d7b3d73 ]
+
+We should decode the latency and the max_latency before directly compare.
+The latency should be presented as lat_enc = scale x value:
+lat_enc_d = (lat_enc & 0x0x3ff) x (1U << (5*((max_ltr_enc & 0x1c00)
+>> 10)))
+
+Fixes: cf8fb73c23aa ("e1000e: add support for LTR on I217/I218")
+Suggested-by: Yee Li <seven.yi.lee@gmail.com>
+Signed-off-by: Sasha Neftin <sasha.neftin@intel.com>
+Tested-by: Dvora Fuxbrumer <dvorax.fuxbrumer@linux.intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/e1000e/ich8lan.c | 14 +++++++++++++-
+ drivers/net/ethernet/intel/e1000e/ich8lan.h |  3 +++
+ 2 files changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+index 625008e8cb0d..500016209ae0 100644
+--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+@@ -1010,6 +1010,8 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link)
+ {
+       u32 reg = link << (E1000_LTRV_REQ_SHIFT + E1000_LTRV_NOSNOOP_SHIFT) |
+           link << E1000_LTRV_REQ_SHIFT | E1000_LTRV_SEND;
++      u16 max_ltr_enc_d = 0;  /* maximum LTR decoded by platform */
++      u16 lat_enc_d = 0;      /* latency decoded */
+       u16 lat_enc = 0;        /* latency encoded */
+ 
+       if (link) {
+@@ -1063,7 +1065,17 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link)
+                                    E1000_PCI_LTR_CAP_LPT + 2, &max_nosnoop);
+               max_ltr_enc = max_t(u16, max_snoop, max_nosnoop);
+ 
+-              if (lat_enc > max_ltr_enc)
++              lat_enc_d = (lat_enc & E1000_LTRV_VALUE_MASK) *
++                           (1U << (E1000_LTRV_SCALE_FACTOR *
++                           ((lat_enc & E1000_LTRV_SCALE_MASK)
++                           >> E1000_LTRV_SCALE_SHIFT)));
++
++              max_ltr_enc_d = (max_ltr_enc & E1000_LTRV_VALUE_MASK) *
++                               (1U << (E1000_LTRV_SCALE_FACTOR *
++                               ((max_ltr_enc & E1000_LTRV_SCALE_MASK)
++                               >> E1000_LTRV_SCALE_SHIFT)));
++
++              if (lat_enc_d > max_ltr_enc_d)
+                       lat_enc = max_ltr_enc;
+       }
+ 
+diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h
+index 6374c8fc76a8..9957a4ffdc6d 100644
+--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h
++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h
+@@ -291,8 +291,11 @@
+ 
+ /* Latency Tolerance Reporting */
+ #define E1000_LTRV                    0x000F8
++#define E1000_LTRV_VALUE_MASK         0x000003FF
+ #define E1000_LTRV_SCALE_MAX          5
+ #define E1000_LTRV_SCALE_FACTOR               5
++#define E1000_LTRV_SCALE_SHIFT                10
++#define E1000_LTRV_SCALE_MASK         0x00001C00
+ #define E1000_LTRV_REQ_SHIFT          15
+ #define E1000_LTRV_NOSNOOP_SHIFT      16
+ #define E1000_LTRV_SEND                       (1 << 30)
+-- 
+2.30.2
+

diff --git a/queue-4.9/ib-hfi1-fix-possible-null-pointer-dereference-in-_ex.patch b/queue-4.9/ib-hfi1-fix-possible-null-pointer-dereference-in-_ex.patch
new file mode 100644 (file)
index 0000000..9b45d43
--- /dev/null
+++ b/queue-4.9/ib-hfi1-fix-possible-null-pointer-dereference-in-_ex.patch
@@ -0,0 +1,65 @@
+From c4e78c53b0468cbdd450a02fb92204a55d78a0b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Aug 2021 06:30:29 -0700
+Subject: IB/hfi1: Fix possible null-pointer dereference in
+ _extend_sdma_tx_descs()
+
+From: Tuo Li <islituo@gmail.com>
+
+[ Upstream commit cbe71c61992c38f72c2b625b2ef25916b9f0d060 ]
+
+kmalloc_array() is called to allocate memory for tx->descp. If it fails,
+the function __sdma_txclean() is called:
+  __sdma_txclean(dd, tx);
+
+However, in the function __sdma_txclean(), tx-descp is dereferenced if
+tx->num_desc is not zero:
+  sdma_unmap_desc(dd, &tx->descp[0]);
+
+To fix this possible null-pointer dereference, assign the return value of
+kmalloc_array() to a local variable descp, and then assign it to tx->descp
+if it is not NULL. Otherwise, go to enomem.
+
+Fixes: 7724105686e7 ("IB/hfi1: add driver files")
+Link: https://lore.kernel.org/r/20210806133029.194964-1-islituo@gmail.com
+Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
+Signed-off-by: Tuo Li <islituo@gmail.com>
+Tested-by: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
+Acked-by: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/sdma.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c
+index 76e63c88a87a..e9313e6f4b0e 100644
+--- a/drivers/infiniband/hw/hfi1/sdma.c
++++ b/drivers/infiniband/hw/hfi1/sdma.c
+@@ -3028,6 +3028,7 @@ static void __sdma_process_event(struct sdma_engine *sde,
+ static int _extend_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx)
+ {
+       int i;
++      struct sdma_desc *descp;
+ 
+       /* Handle last descriptor */
+       if (unlikely((tx->num_desc == (MAX_DESC - 1)))) {
+@@ -3048,12 +3049,10 @@ static int _extend_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx)
+       if (unlikely(tx->num_desc == MAX_DESC))
+               goto enomem;
+ 
+-      tx->descp = kmalloc_array(
+-                      MAX_DESC,
+-                      sizeof(struct sdma_desc),
+-                      GFP_ATOMIC);
+-      if (!tx->descp)
++      descp = kmalloc_array(MAX_DESC, sizeof(struct sdma_desc), GFP_ATOMIC);
++      if (!descp)
+               goto enomem;
++      tx->descp = descp;
+ 
+       /* reserve last descriptor for coalescing */
+       tx->desc_limit = MAX_DESC - 1;
+-- 
+2.30.2
+

diff --git a/queue-4.9/ip_gre-add-validation-for-csum_start.patch b/queue-4.9/ip_gre-add-validation-for-csum_start.patch
new file mode 100644 (file)
index 0000000..20c956e
--- /dev/null
+++ b/queue-4.9/ip_gre-add-validation-for-csum_start.patch
@@ -0,0 +1,41 @@
+From f28bcc4ae00c90caf3d0060719386610025206b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Aug 2021 12:44:24 +0530
+Subject: ip_gre: add validation for csum_start
+
+From: Shreyansh Chouhan <chouhan.shreyansh630@gmail.com>
+
+[ Upstream commit 1d011c4803c72f3907eccfc1ec63caefb852fcbf ]
+
+Validate csum_start in gre_handle_offloads before we call _gre_xmit so
+that we do not crash later when the csum_start value is used in the
+lco_csum function call.
+
+This patch deals with ipv4 code.
+
+Fixes: c54419321455 ("GRE: Refactor GRE tunneling code.")
+Reported-by: syzbot+ff8e1b9f2f36481e2efc@syzkaller.appspotmail.com
+Signed-off-by: Shreyansh Chouhan <chouhan.shreyansh630@gmail.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_gre.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index 9609ad71dd26..fe1801d9f059 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -353,6 +353,8 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev,
+ 
+ static int gre_handle_offloads(struct sk_buff *skb, bool csum)
+ {
++      if (csum && skb_checksum_start(skb) < skb->data)
++              return -EINVAL;
+       return iptunnel_handle_offloads(skb, csum ? SKB_GSO_GRE_CSUM : SKB_GSO_GRE);
+ }
+ 
+-- 
+2.30.2
+

diff --git a/queue-4.9/net-marvell-fix-mvneta_tx_in_prgrs-bit-number.patch b/queue-4.9/net-marvell-fix-mvneta_tx_in_prgrs-bit-number.patch
new file mode 100644 (file)
index 0000000..2aa5c0b
--- /dev/null
+++ b/queue-4.9/net-marvell-fix-mvneta_tx_in_prgrs-bit-number.patch
@@ -0,0 +1,36 @@
+From 7567f925aa2b2a290cf46d7bed8db6ed293327d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Aug 2021 18:39:51 +0300
+Subject: net: marvell: fix MVNETA_TX_IN_PRGRS bit number
+
+From: Maxim Kiselev <bigunclemax@gmail.com>
+
+[ Upstream commit 359f4cdd7d78fdf8c098713b05fee950a730f131 ]
+
+According to Armada XP datasheet bit at 0 position is corresponding for
+TxInProg indication.
+
+Fixes: c5aff18204da ("net: mvneta: driver for Marvell Armada 370/XP network unit")
+Signed-off-by: Maxim Kiselev <bigunclemax@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/mvneta.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index bb6bc84995a2..ccacdcfb5932 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -100,7 +100,7 @@
+ #define      MVNETA_DESC_SWAP                    BIT(6)
+ #define      MVNETA_TX_BRST_SZ_MASK(burst)       ((burst) << 22)
+ #define MVNETA_PORT_STATUS                       0x2444
+-#define      MVNETA_TX_IN_PRGRS                  BIT(1)
++#define      MVNETA_TX_IN_PRGRS                  BIT(0)
+ #define      MVNETA_TX_FIFO_EMPTY                BIT(8)
+ #define MVNETA_RX_MIN_FRAME_SIZE                 0x247c
+ #define MVNETA_SERDES_CFG                      0x24A0
+-- 
+2.30.2
+

diff --git a/queue-4.9/series b/queue-4.9/series
index 423993a87b3f9c8d39b4d8e5227bc7664e1a8fea..d37f872ba7ef3d6643cd4d198817adcdeb6a5812 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -3,3 +3,7 @@ can-usb-esd_usb2-esd_usb2_rx_event-fix-the-interchange-of-the-can-rx-and-tx-erro
 revert-usb-serial-ch341-fix-character-loss-at-high-transfer-rates.patch
 usb-serial-option-add-new-vid-pid-to-support-fibocom-fg150.patch
 usb-dwc3-gadget-fix-dwc3_calc_trbs_left.patch
+ib-hfi1-fix-possible-null-pointer-dereference-in-_ex.patch
+e1000e-fix-the-max-snoop-no-snoop-latency-for-10m.patch
+ip_gre-add-validation-for-csum_start.patch
+net-marvell-fix-mvneta_tx_in_prgrs-bit-number.patch