--- /dev/null
+From 8b185c1c9ac5f96d6d611dca276412654a0b4987 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jul 2021 12:53:42 -0700
+Subject: drm/i915: Fix syncmap memory leak
+
+From: Matthew Brost <matthew.brost@intel.com>
+
+[ Upstream commit a63bcf08f0efb5348105bb8e0e1e8c6671077753 ]
+
+A small race exists between intel_gt_retire_requests_timeout and
+intel_timeline_exit which could result in the syncmap not getting
+free'd. Rather than work to hard to seal this race, simply cleanup the
+syncmap on fini.
+
+unreferenced object 0xffff88813bc53b18 (size 96):
+ comm "gem_close_race", pid 5410, jiffies 4294917818 (age 1105.600s)
+ hex dump (first 32 bytes):
+ 01 00 00 00 00 00 00 00 00 00 00 00 0a 00 00 00 ................
+ 00 00 00 00 00 00 00 00 6b 6b 6b 6b 06 00 00 00 ........kkkk....
+ backtrace:
+ [<00000000120b863a>] __sync_alloc_leaf+0x1e/0x40 [i915]
+ [<00000000042f6959>] __sync_set+0x1bb/0x240 [i915]
+ [<0000000090f0e90f>] i915_request_await_dma_fence+0x1c7/0x400 [i915]
+ [<0000000056a48219>] i915_request_await_object+0x222/0x360 [i915]
+ [<00000000aaac4ee3>] i915_gem_do_execbuffer+0x1bd0/0x2250 [i915]
+ [<000000003c9d830f>] i915_gem_execbuffer2_ioctl+0x405/0xce0 [i915]
+ [<00000000fd7a8e68>] drm_ioctl_kernel+0xb0/0xf0 [drm]
+ [<00000000e721ee87>] drm_ioctl+0x305/0x3c0 [drm]
+ [<000000008b0d8986>] __x64_sys_ioctl+0x71/0xb0
+ [<0000000076c362a4>] do_syscall_64+0x33/0x80
+ [<00000000eb7a4831>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Fixes: 531958f6f357 ("drm/i915/gt: Track timeline activeness in enter/exit")
+Cc: <stable@vger.kernel.org>
+Reviewed-by: John Harrison <John.C.Harrison@Intel.com>
+Signed-off-by: John Harrison <John.C.Harrison@Intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210730195342.110234-1-matthew.brost@intel.com
+(cherry picked from commit faf890985e30d5e88cc3a7c50c1bcad32f89ab7c)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/intel_timeline.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/gpu/drm/i915/gt/intel_timeline.c b/drivers/gpu/drm/i915/gt/intel_timeline.c
+index 9cb01d9828f1..c970e3deb008 100644
+--- a/drivers/gpu/drm/i915/gt/intel_timeline.c
++++ b/drivers/gpu/drm/i915/gt/intel_timeline.c
+@@ -289,6 +289,14 @@ void intel_timeline_fini(struct intel_timeline *timeline)
+ i915_gem_object_unpin_map(timeline->hwsp_ggtt->obj);
+
+ i915_vma_put(timeline->hwsp_ggtt);
++
++ /*
++ * A small race exists between intel_gt_retire_requests_timeout and
++ * intel_timeline_exit which could result in the syncmap not getting
++ * free'd. Rather than work to hard to seal this race, simply cleanup
++ * the syncmap on fini.
++ */
++ i915_syncmap_free(&timeline->sync);
+ }
+
+ struct intel_timeline *
+--
+2.30.2
+
--- /dev/null
+From 7b1c4dbf33974608a9d84e650dd8d4fc7d6b8fa2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jul 2021 10:11:41 +0300
+Subject: e1000e: Fix the max snoop/no-snoop latency for 10M
+
+From: Sasha Neftin <sasha.neftin@intel.com>
+
+[ Upstream commit 44a13a5d99c71bf9e1676d9e51679daf4d7b3d73 ]
+
+We should decode the latency and the max_latency before directly compare.
+The latency should be presented as lat_enc = scale x value:
+lat_enc_d = (lat_enc & 0x0x3ff) x (1U << (5*((max_ltr_enc & 0x1c00)
+>> 10)))
+
+Fixes: cf8fb73c23aa ("e1000e: add support for LTR on I217/I218")
+Suggested-by: Yee Li <seven.yi.lee@gmail.com>
+Signed-off-by: Sasha Neftin <sasha.neftin@intel.com>
+Tested-by: Dvora Fuxbrumer <dvorax.fuxbrumer@linux.intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/e1000e/ich8lan.c | 14 +++++++++++++-
+ drivers/net/ethernet/intel/e1000e/ich8lan.h | 3 +++
+ 2 files changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+index a1fab77b2096..58ff747a42ae 100644
+--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+@@ -995,6 +995,8 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link)
+ {
+ u32 reg = link << (E1000_LTRV_REQ_SHIFT + E1000_LTRV_NOSNOOP_SHIFT) |
+ link << E1000_LTRV_REQ_SHIFT | E1000_LTRV_SEND;
++ u16 max_ltr_enc_d = 0; /* maximum LTR decoded by platform */
++ u16 lat_enc_d = 0; /* latency decoded */
+ u16 lat_enc = 0; /* latency encoded */
+
+ if (link) {
+@@ -1048,7 +1050,17 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link)
+ E1000_PCI_LTR_CAP_LPT + 2, &max_nosnoop);
+ max_ltr_enc = max_t(u16, max_snoop, max_nosnoop);
+
+- if (lat_enc > max_ltr_enc)
++ lat_enc_d = (lat_enc & E1000_LTRV_VALUE_MASK) *
++ (1U << (E1000_LTRV_SCALE_FACTOR *
++ ((lat_enc & E1000_LTRV_SCALE_MASK)
++ >> E1000_LTRV_SCALE_SHIFT)));
++
++ max_ltr_enc_d = (max_ltr_enc & E1000_LTRV_VALUE_MASK) *
++ (1U << (E1000_LTRV_SCALE_FACTOR *
++ ((max_ltr_enc & E1000_LTRV_SCALE_MASK)
++ >> E1000_LTRV_SCALE_SHIFT)));
++
++ if (lat_enc_d > max_ltr_enc_d)
+ lat_enc = max_ltr_enc;
+ }
+
+diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h
+index 1502895eb45d..e757896287eb 100644
+--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h
++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h
+@@ -274,8 +274,11 @@
+
+ /* Latency Tolerance Reporting */
+ #define E1000_LTRV 0x000F8
++#define E1000_LTRV_VALUE_MASK 0x000003FF
+ #define E1000_LTRV_SCALE_MAX 5
+ #define E1000_LTRV_SCALE_FACTOR 5
++#define E1000_LTRV_SCALE_SHIFT 10
++#define E1000_LTRV_SCALE_MASK 0x00001C00
+ #define E1000_LTRV_REQ_SHIFT 15
+ #define E1000_LTRV_NOSNOOP_SHIFT 16
+ #define E1000_LTRV_SEND (1 << 30)
+--
+2.30.2
+
--- /dev/null
+From 2f6a9f8336ffbbfac18eb2ebe67914ccd3c32c8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Aug 2021 06:30:29 -0700
+Subject: IB/hfi1: Fix possible null-pointer dereference in
+ _extend_sdma_tx_descs()
+
+From: Tuo Li <islituo@gmail.com>
+
+[ Upstream commit cbe71c61992c38f72c2b625b2ef25916b9f0d060 ]
+
+kmalloc_array() is called to allocate memory for tx->descp. If it fails,
+the function __sdma_txclean() is called:
+ __sdma_txclean(dd, tx);
+
+However, in the function __sdma_txclean(), tx-descp is dereferenced if
+tx->num_desc is not zero:
+ sdma_unmap_desc(dd, &tx->descp[0]);
+
+To fix this possible null-pointer dereference, assign the return value of
+kmalloc_array() to a local variable descp, and then assign it to tx->descp
+if it is not NULL. Otherwise, go to enomem.
+
+Fixes: 7724105686e7 ("IB/hfi1: add driver files")
+Link: https://lore.kernel.org/r/20210806133029.194964-1-islituo@gmail.com
+Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
+Signed-off-by: Tuo Li <islituo@gmail.com>
+Tested-by: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
+Acked-by: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/sdma.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c
+index c61b6022575e..248be21acdbe 100644
+--- a/drivers/infiniband/hw/hfi1/sdma.c
++++ b/drivers/infiniband/hw/hfi1/sdma.c
+@@ -3056,6 +3056,7 @@ static void __sdma_process_event(struct sdma_engine *sde,
+ static int _extend_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx)
+ {
+ int i;
++ struct sdma_desc *descp;
+
+ /* Handle last descriptor */
+ if (unlikely((tx->num_desc == (MAX_DESC - 1)))) {
+@@ -3076,12 +3077,10 @@ static int _extend_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx)
+ if (unlikely(tx->num_desc == MAX_DESC))
+ goto enomem;
+
+- tx->descp = kmalloc_array(
+- MAX_DESC,
+- sizeof(struct sdma_desc),
+- GFP_ATOMIC);
+- if (!tx->descp)
++ descp = kmalloc_array(MAX_DESC, sizeof(struct sdma_desc), GFP_ATOMIC);
++ if (!descp)
+ goto enomem;
++ tx->descp = descp;
+
+ /* reserve last descriptor for coalescing */
+ tx->desc_limit = MAX_DESC - 1;
+--
+2.30.2
+
--- /dev/null
+From f2ce1a45700ef476a637dba6681cd0a21268ed66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Aug 2021 12:44:24 +0530
+Subject: ip_gre: add validation for csum_start
+
+From: Shreyansh Chouhan <chouhan.shreyansh630@gmail.com>
+
+[ Upstream commit 1d011c4803c72f3907eccfc1ec63caefb852fcbf ]
+
+Validate csum_start in gre_handle_offloads before we call _gre_xmit so
+that we do not crash later when the csum_start value is used in the
+lco_csum function call.
+
+This patch deals with ipv4 code.
+
+Fixes: c54419321455 ("GRE: Refactor GRE tunneling code.")
+Reported-by: syzbot+ff8e1b9f2f36481e2efc@syzkaller.appspotmail.com
+Signed-off-by: Shreyansh Chouhan <chouhan.shreyansh630@gmail.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_gre.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index fedad3a3e61b..fd8298b8b1c5 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -446,6 +446,8 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev,
+
+ static int gre_handle_offloads(struct sk_buff *skb, bool csum)
+ {
++ if (csum && skb_checksum_start(skb) < skb->data)
++ return -EINVAL;
+ return iptunnel_handle_offloads(skb, csum ? SKB_GSO_GRE_CSUM : SKB_GSO_GRE);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 9d79666334789797ac64c5b4cdf22e637ae6150c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Aug 2021 19:21:55 +0800
+Subject: net: hns3: clear hardware resource when loading driver
+
+From: Yufeng Mo <moyufeng@huawei.com>
+
+[ Upstream commit 1a6d281946c330cee2855f6d0cd796616e54601f ]
+
+If a PF is bonded to a virtual machine and the virtual machine exits
+unexpectedly, some hardware resource cannot be cleared. In this case,
+loading driver may cause exceptions. Therefore, the hardware resource
+needs to be cleared when the driver is loaded.
+
+Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support")
+Signed-off-by: Yufeng Mo <moyufeng@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../hisilicon/hns3/hns3pf/hclge_cmd.h | 3 +++
+ .../hisilicon/hns3/hns3pf/hclge_main.c | 26 +++++++++++++++++++
+ 2 files changed, 29 insertions(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+index e34e0854635c..d64cded30eeb 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+@@ -257,6 +257,9 @@ enum hclge_opcode_type {
+ /* Led command */
+ HCLGE_OPC_LED_STATUS_CFG = 0xB000,
+
++ /* clear hardware resource command */
++ HCLGE_OPC_CLEAR_HW_RESOURCE = 0x700B,
++
+ /* NCL config command */
+ HCLGE_OPC_QUERY_NCL_CONFIG = 0x7011,
+ /* M7 stats command */
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 93f3865b679b..28e260439196 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -9165,6 +9165,28 @@ static void hclge_clear_resetting_state(struct hclge_dev *hdev)
+ }
+ }
+
++static int hclge_clear_hw_resource(struct hclge_dev *hdev)
++{
++ struct hclge_desc desc;
++ int ret;
++
++ hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_CLEAR_HW_RESOURCE, false);
++
++ ret = hclge_cmd_send(&hdev->hw, &desc, 1);
++ /* This new command is only supported by new firmware, it will
++ * fail with older firmware. Error value -EOPNOSUPP can only be
++ * returned by older firmware running this command, to keep code
++ * backward compatible we will override this value and return
++ * success.
++ */
++ if (ret && ret != -EOPNOTSUPP) {
++ dev_err(&hdev->pdev->dev,
++ "failed to clear hw resource, ret = %d\n", ret);
++ return ret;
++ }
++ return 0;
++}
++
+ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)
+ {
+ struct pci_dev *pdev = ae_dev->pdev;
+@@ -9206,6 +9228,10 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)
+ if (ret)
+ goto err_cmd_uninit;
+
++ ret = hclge_clear_hw_resource(hdev);
++ if (ret)
++ goto err_cmd_uninit;
++
+ ret = hclge_get_cap(hdev);
+ if (ret) {
+ dev_err(&pdev->dev, "get hw capability error, ret = %d.\n",
+--
+2.30.2
+
--- /dev/null
+From 9e746a7fbab0546f824aacdce7bc42021157f265 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Aug 2021 19:21:58 +0800
+Subject: net: hns3: fix duplicate node in VLAN list
+
+From: Guojia Liao <liaoguojia@huawei.com>
+
+[ Upstream commit 94391fae82f71c98ecc7716a32611fcca73c74eb ]
+
+VLAN list should not be added duplicate VLAN node, otherwise it would
+cause "add failed" when restore VLAN from VLAN list, so this patch adds
+VLAN ID check before adding node into VLAN list.
+
+Fixes: c6075b193462 ("net: hns3: Record VF vlan tables")
+Signed-off-by: Guojia Liao <liaoguojia@huawei.com>
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 28e260439196..aa402e267121 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -8006,7 +8006,11 @@ static int hclge_init_vlan_config(struct hclge_dev *hdev)
+ static void hclge_add_vport_vlan_table(struct hclge_vport *vport, u16 vlan_id,
+ bool writen_to_tbl)
+ {
+- struct hclge_vport_vlan_cfg *vlan;
++ struct hclge_vport_vlan_cfg *vlan, *tmp;
++
++ list_for_each_entry_safe(vlan, tmp, &vport->vlan_list, node)
++ if (vlan->vlan_id == vlan_id)
++ return;
+
+ vlan = kzalloc(sizeof(*vlan), GFP_KERNEL);
+ if (!vlan)
+--
+2.30.2
+
--- /dev/null
+From 4b6d335fcee0fd8cf211d6b554b41701313416fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Aug 2021 19:22:01 +0800
+Subject: net: hns3: fix get wrong pfc_en when query PFC configuration
+
+From: Guangbin Huang <huangguangbin2@huawei.com>
+
+[ Upstream commit 8c1671e0d13d4a0ba4fb3a0da932bf3736d7ff73 ]
+
+Currently, when query PFC configuration by dcbtool, driver will return
+PFC enable status based on TC. As all priorities are mapped to TC0 by
+default, if TC0 is enabled, then all priorities mapped to TC0 will be
+shown as enabled status when query PFC setting, even though some
+priorities have never been set.
+
+for example:
+$ dcb pfc show dev eth0
+pfc-cap 4 macsec-bypass off delay 0
+prio-pfc 0:off 1:off 2:off 3:off 4:off 5:off 6:off 7:off
+$ dcb pfc set dev eth0 prio-pfc 0:on 1:on 2:on 3:on
+$ dcb pfc show dev eth0
+pfc-cap 4 macsec-bypass off delay 0
+prio-pfc 0:on 1:on 2:on 3:on 4:on 5:on 6:on 7:on
+
+To fix this problem, just returns user's PFC config parameter saved in
+driver.
+
+Fixes: cacde272dd00 ("net: hns3: Add hclge_dcb module for the support of DCB feature")
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c | 13 ++-----------
+ 1 file changed, 2 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
+index a1790af73096..d16488bab86f 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
+@@ -281,21 +281,12 @@ static int hclge_ieee_getpfc(struct hnae3_handle *h, struct ieee_pfc *pfc)
+ u64 requests[HNAE3_MAX_TC], indications[HNAE3_MAX_TC];
+ struct hclge_vport *vport = hclge_get_vport(h);
+ struct hclge_dev *hdev = vport->back;
+- u8 i, j, pfc_map, *prio_tc;
+ int ret;
++ u8 i;
+
+ memset(pfc, 0, sizeof(*pfc));
+ pfc->pfc_cap = hdev->pfc_max;
+- prio_tc = hdev->tm_info.prio_tc;
+- pfc_map = hdev->tm_info.hw_pfc_map;
+-
+- /* Pfc setting is based on TC */
+- for (i = 0; i < hdev->tm_info.num_tc; i++) {
+- for (j = 0; j < HNAE3_MAX_USER_PRIO; j++) {
+- if ((prio_tc[j] == i) && (pfc_map & BIT(i)))
+- pfc->pfc_en |= BIT(j);
+- }
+- }
++ pfc->pfc_en = hdev->tm_info.pfc_en;
+
+ ret = hclge_pfc_tx_stats_get(hdev, requests);
+ if (ret)
+--
+2.30.2
+
--- /dev/null
+From b301c97e027f04e306b79a4c38ce1b5d41581fbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Aug 2021 18:39:51 +0300
+Subject: net: marvell: fix MVNETA_TX_IN_PRGRS bit number
+
+From: Maxim Kiselev <bigunclemax@gmail.com>
+
+[ Upstream commit 359f4cdd7d78fdf8c098713b05fee950a730f131 ]
+
+According to Armada XP datasheet bit at 0 position is corresponding for
+TxInProg indication.
+
+Fixes: c5aff18204da ("net: mvneta: driver for Marvell Armada 370/XP network unit")
+Signed-off-by: Maxim Kiselev <bigunclemax@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/mvneta.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index 7b0543056b10..64aa5510e61a 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -101,7 +101,7 @@
+ #define MVNETA_DESC_SWAP BIT(6)
+ #define MVNETA_TX_BRST_SZ_MASK(burst) ((burst) << 22)
+ #define MVNETA_PORT_STATUS 0x2444
+-#define MVNETA_TX_IN_PRGRS BIT(1)
++#define MVNETA_TX_IN_PRGRS BIT(0)
+ #define MVNETA_TX_FIFO_EMPTY BIT(8)
+ #define MVNETA_RX_MIN_FRAME_SIZE 0x247c
+ /* Only exists on Armada XP and Armada 370 */
+--
+2.30.2
+
--- /dev/null
+From b560dabbe6399934562fb6f46f7f8dbb3e1eab4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 20:25:52 -0700
+Subject: RDMA/bnxt_re: Add missing spin lock initialization
+
+From: Naresh Kumar PBS <nareshkumar.pbs@broadcom.com>
+
+[ Upstream commit 17f2569dce1848080825b8336e6b7c6900193b44 ]
+
+Add the missing initialization of srq lock.
+
+Fixes: 37cb11acf1f7 ("RDMA/bnxt_re: Add SRQ support for Broadcom adapters")
+Link: https://lore.kernel.org/r/1629343553-5843-3-git-send-email-selvin.xavier@broadcom.com
+Signed-off-by: Naresh Kumar PBS <nareshkumar.pbs@broadcom.com>
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/ib_verbs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+index 58c021648b7c..a96f9142fe08 100644
+--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+@@ -1404,6 +1404,7 @@ int bnxt_re_create_srq(struct ib_srq *ib_srq,
+ if (nq)
+ nq->budget++;
+ atomic_inc(&rdev->srq_count);
++ spin_lock_init(&srq->lock);
+
+ return 0;
+
+--
+2.30.2
+
--- /dev/null
+From 21d51cf931c1d9a8020a6604c420b076ae12fdfe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Aug 2021 18:11:28 +0300
+Subject: RDMA/efa: Free IRQ vectors on error flow
+
+From: Gal Pressman <galpress@amazon.com>
+
+[ Upstream commit dbe986bdfd6dfe6ef24b833767fff4151e024357 ]
+
+Make sure to free the IRQ vectors in case the allocation doesn't return
+the expected number of IRQs.
+
+Fixes: b7f5e880f377 ("RDMA/efa: Add the efa module")
+Link: https://lore.kernel.org/r/20210811151131.39138-2-galpress@amazon.com
+Reviewed-by: Firas JahJah <firasj@amazon.com>
+Reviewed-by: Yossi Leybovich <sleybo@amazon.com>
+Signed-off-by: Gal Pressman <galpress@amazon.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/efa/efa_main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/hw/efa/efa_main.c b/drivers/infiniband/hw/efa/efa_main.c
+index 83858f7e83d0..75dfe9d1564c 100644
+--- a/drivers/infiniband/hw/efa/efa_main.c
++++ b/drivers/infiniband/hw/efa/efa_main.c
+@@ -340,6 +340,7 @@ static int efa_enable_msix(struct efa_dev *dev)
+ }
+
+ if (irq_num != msix_vecs) {
++ efa_disable_msix(dev);
+ dev_err(&dev->pdev->dev,
+ "Allocated %d MSI-X (out of %d requested)\n",
+ irq_num, msix_vecs);
+--
+2.30.2
+
--- /dev/null
+From 51c0214a88c75f5c7d3f0add8719f6a2f40fc0e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Aug 2021 17:25:40 -0700
+Subject: rtnetlink: Return correct error on changing device netns
+
+From: Andrey Ignatov <rdna@fb.com>
+
+[ Upstream commit 96a6b93b69880b2c978e1b2be9cae6970b605008 ]
+
+Currently when device is moved between network namespaces using
+RTM_NEWLINK message type and one of netns attributes (FLA_NET_NS_PID,
+IFLA_NET_NS_FD, IFLA_TARGET_NETNSID) but w/o specifying IFLA_IFNAME, and
+target namespace already has device with same name, userspace will get
+EINVAL what is confusing and makes debugging harder.
+
+Fix it so that userspace gets more appropriate EEXIST instead what makes
+debugging much easier.
+
+Before:
+
+ # ./ifname.sh
+ + ip netns add ns0
+ + ip netns exec ns0 ip link add l0 type dummy
+ + ip netns exec ns0 ip link show l0
+ 8: l0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
+ link/ether 66:90:b5:d5:78:69 brd ff:ff:ff:ff:ff:ff
+ + ip link add l0 type dummy
+ + ip link show l0
+ 10: l0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
+ link/ether 6e:c6:1f:15:20:8d brd ff:ff:ff:ff:ff:ff
+ + ip link set l0 netns ns0
+ RTNETLINK answers: Invalid argument
+
+After:
+
+ # ./ifname.sh
+ + ip netns add ns0
+ + ip netns exec ns0 ip link add l0 type dummy
+ + ip netns exec ns0 ip link show l0
+ 8: l0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
+ link/ether 1e:4a:72:e3:e3:8f brd ff:ff:ff:ff:ff:ff
+ + ip link add l0 type dummy
+ + ip link show l0
+ 10: l0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
+ link/ether f2:fc:fe:2b:7d:a6 brd ff:ff:ff:ff:ff:ff
+ + ip link set l0 netns ns0
+ RTNETLINK answers: File exists
+
+The problem is that do_setlink() passes its `char *ifname` argument,
+that it gets from a caller, to __dev_change_net_namespace() as is (as
+`const char *pat`), but semantics of ifname and pat can be different.
+
+For example, __rtnl_newlink() does this:
+
+net/core/rtnetlink.c
+ 3270 char ifname[IFNAMSIZ];
+ ...
+ 3286 if (tb[IFLA_IFNAME])
+ 3287 nla_strscpy(ifname, tb[IFLA_IFNAME], IFNAMSIZ);
+ 3288 else
+ 3289 ifname[0] = '\0';
+ ...
+ 3364 if (dev) {
+ ...
+ 3394 return do_setlink(skb, dev, ifm, extack, tb, ifname, status);
+ 3395 }
+
+, i.e. do_setlink() gets ifname pointer that is always valid no matter
+if user specified IFLA_IFNAME or not and then do_setlink() passes this
+ifname pointer as is to __dev_change_net_namespace() as pat argument.
+
+But the pat (pattern) in __dev_change_net_namespace() is used as:
+
+net/core/dev.c
+ 11198 err = -EEXIST;
+ 11199 if (__dev_get_by_name(net, dev->name)) {
+ 11200 /* We get here if we can't use the current device name */
+ 11201 if (!pat)
+ 11202 goto out;
+ 11203 err = dev_get_valid_name(net, dev, pat);
+ 11204 if (err < 0)
+ 11205 goto out;
+ 11206 }
+
+As the result the `goto out` path on line 11202 is neven taken and
+instead of returning EEXIST defined on line 11198,
+__dev_change_net_namespace() returns an error from dev_get_valid_name()
+and this, in turn, will be EINVAL for ifname[0] = '\0' set earlier.
+
+Fixes: d8a5ec672768 ("[NET]: netlink support for moving devices between network namespaces.")
+Signed-off-by: Andrey Ignatov <rdna@fb.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/rtnetlink.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 0bad5db23129..6fbc9cb09dc0 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -2414,6 +2414,7 @@ static int do_setlink(const struct sk_buff *skb,
+ return err;
+
+ if (tb[IFLA_NET_NS_PID] || tb[IFLA_NET_NS_FD] || tb[IFLA_TARGET_NETNSID]) {
++ const char *pat = ifname && ifname[0] ? ifname : NULL;
+ struct net *net = rtnl_link_get_net_capable(skb, dev_net(dev),
+ tb, CAP_NET_ADMIN);
+ if (IS_ERR(net)) {
+@@ -2421,7 +2422,7 @@ static int do_setlink(const struct sk_buff *skb,
+ goto errout;
+ }
+
+- err = dev_change_net_namespace(dev, net, ifname);
++ err = dev_change_net_namespace(dev, net, pat);
+ put_net(net);
+ if (err)
+ goto errout;
+--
+2.30.2
+
usb-dwc3-gadget-fix-dwc3_calc_trbs_left.patch
usb-dwc3-gadget-stop-ep0-transfers-during-pullup-disable.patch
scsi-core-fix-hang-of-freezing-queue-between-blocking-and-running-device.patch
+rdma-bnxt_re-add-missing-spin-lock-initialization.patch
+ib-hfi1-fix-possible-null-pointer-dereference-in-_ex.patch
+e1000e-fix-the-max-snoop-no-snoop-latency-for-10m.patch
+rdma-efa-free-irq-vectors-on-error-flow.patch
+ip_gre-add-validation-for-csum_start.patch
+xgene-v2-fix-a-resource-leak-in-the-error-handling-p.patch
+net-marvell-fix-mvneta_tx_in_prgrs-bit-number.patch
+rtnetlink-return-correct-error-on-changing-device-ne.patch
+net-hns3-clear-hardware-resource-when-loading-driver.patch
+net-hns3-fix-duplicate-node-in-vlan-list.patch
+net-hns3-fix-get-wrong-pfc_en-when-query-pfc-configu.patch
+drm-i915-fix-syncmap-memory-leak.patch
+usb-gadget-u_audio-fix-race-condition-on-endpoint-st.patch
--- /dev/null
+From b0391f93f02a09a41f775c58f1e91ea981578771 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Aug 2021 11:29:27 +0200
+Subject: usb: gadget: u_audio: fix race condition on endpoint stop
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 068fdad20454f815e61e6f6eb9f051a8b3120e88 ]
+
+If the endpoint completion callback is call right after the ep_enabled flag
+is cleared and before usb_ep_dequeue() is call, we could do a double free
+on the request and the associated buffer.
+
+Fix this by clearing ep_enabled after all the endpoint requests have been
+dequeued.
+
+Fixes: 7de8681be2cd ("usb: gadget: u_audio: Free requests only after callback")
+Cc: stable <stable@vger.kernel.org>
+Reported-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lore.kernel.org/r/20210827092927.366482-1-jbrunet@baylibre.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/u_audio.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
+index 223029fa8445..4e01ba0ab8ec 100644
+--- a/drivers/usb/gadget/function/u_audio.c
++++ b/drivers/usb/gadget/function/u_audio.c
+@@ -349,8 +349,6 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep)
+ if (!prm->ep_enabled)
+ return;
+
+- prm->ep_enabled = false;
+-
+ audio_dev = uac->audio_dev;
+ params = &audio_dev->params;
+
+@@ -368,11 +366,12 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep)
+ }
+ }
+
++ prm->ep_enabled = false;
++
+ if (usb_ep_disable(ep))
+ dev_err(uac->card->dev, "%s:%d Error!\n", __func__, __LINE__);
+ }
+
+-
+ int u_audio_start_capture(struct g_audio *audio_dev)
+ {
+ struct snd_uac_chip *uac = audio_dev->uac;
+--
+2.30.2
+
--- /dev/null
+From 711d918fab11cfe94253eb22916ac2467c8e77c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Aug 2021 09:35:23 +0200
+Subject: xgene-v2: Fix a resource leak in the error handling path of
+ 'xge_probe()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 5ed74b03eb4d08f5dd281dcb5f1c9bb92b363a8d ]
+
+A successful 'xge_mdio_config()' call should be balanced by a corresponding
+'xge_mdio_remove()' call in the error handling path of the probe, as
+already done in the remove function.
+
+Update the error handling path accordingly.
+
+Fixes: ea8ab16ab225 ("drivers: net: xgene-v2: Add MDIO support")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/apm/xgene-v2/main.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/apm/xgene-v2/main.c b/drivers/net/ethernet/apm/xgene-v2/main.c
+index 02b4f3af02b5..848be6bf2fd1 100644
+--- a/drivers/net/ethernet/apm/xgene-v2/main.c
++++ b/drivers/net/ethernet/apm/xgene-v2/main.c
+@@ -677,11 +677,13 @@ static int xge_probe(struct platform_device *pdev)
+ ret = register_netdev(ndev);
+ if (ret) {
+ netdev_err(ndev, "Failed to register netdev\n");
+- goto err;
++ goto err_mdio_remove;
+ }
+
+ return 0;
+
++err_mdio_remove:
++ xge_mdio_remove(ndev);
+ err:
+ free_netdev(ndev);
+
+--
+2.30.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
