From: Greg Kroah-Hartman Date: Sun, 30 May 2021 14:47:25 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v4.4.271~57 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0427ce4c9f22e8f8eca5ac8952a7e96bb08db77b;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: afs-fix-the-nlink-handling-of-dir-over-dir-rename.patch i2c-i801-don-t-generate-an-interrupt-on-bus-reset.patch i2c-mediatek-disable-i2c-start_en-and-clear-intr_stat-brfore-reset.patch i2c-s3c2410-fix-possible-null-pointer-deref-on-read-message-after-write.patch i2c-sh_mobile-use-new-clock-calculation-formulas-for-rz-g2e.patch mptcp-avoid-error-message-on-infinite-mapping.patch mptcp-drop-unconditional-pr_warn-on-bad-opt.patch mptcp-fix-data-stream-corruption.patch net-dsa-fix-a-crash-if-get_sset_count-fails.patch net-dsa-mt7530-fix-vlan-traffic-leaks.patch net-dsa-sja1105-add-error-handling-in-sja1105_setup.patch net-dsa-sja1105-call-dsa_unregister_switch-when-allocating-memory-fails.patch net-dsa-sja1105-error-out-on-unsupported-phy-mode.patch net-dsa-sja1105-fix-vl-lookup-command-packing-for-p-q-r-s.patch net-dsa-sja1105-update-existing-vlans-from-the-bridge-vlan-list.patch net-dsa-sja1105-use-4095-as-the-private-vlan-for-untagged-traffic.patch netfilter-flowtable-remove-redundant-hw-refresh-bit.patch nvmet-tcp-fix-inline-data-size-comparison-in-nvmet_tcp_queue_response.patch perf-jevents-fix-getting-maximum-number-of-fds.patch --- diff --git a/queue-5.10/afs-fix-the-nlink-handling-of-dir-over-dir-rename.patch b/queue-5.10/afs-fix-the-nlink-handling-of-dir-over-dir-rename.patch new file mode 100644 index 00000000000..685ee9b5dd2 --- /dev/null +++ b/queue-5.10/afs-fix-the-nlink-handling-of-dir-over-dir-rename.patch @@ -0,0 +1,38 @@ +From f610a5a29c3cfb7d37bdfa4ef52f72ea51f24a76 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Thu, 27 May 2021 11:24:33 +0100 +Subject: afs: Fix the nlink handling of dir-over-dir rename + +From: David Howells + +commit f610a5a29c3cfb7d37bdfa4ef52f72ea51f24a76 upstream. + +Fix rename of one directory over another such that the nlink on the deleted +directory is cleared to 0 rather than being decremented to 1. + +This was causing the generic/035 xfstest to fail. + +Fixes: e49c7b2f6de7 ("afs: Build an abstraction around an "operation" concept") +Signed-off-by: David Howells +Reviewed-by: Marc Dionne +cc: linux-afs@lists.infradead.org +Link: https://lore.kernel.org/r/162194384460.3999479.7605572278074191079.stgit@warthog.procyon.org.uk/ # v1 +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + fs/afs/dir.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/fs/afs/dir.c ++++ b/fs/afs/dir.c +@@ -1837,7 +1837,9 @@ static void afs_rename_edit_dir(struct a + new_inode = d_inode(new_dentry); + if (new_inode) { + spin_lock(&new_inode->i_lock); +- if (new_inode->i_nlink > 0) ++ if (S_ISDIR(new_inode->i_mode)) ++ clear_nlink(new_inode); ++ else if (new_inode->i_nlink > 0) + drop_nlink(new_inode); + spin_unlock(&new_inode->i_lock); + } diff --git a/queue-5.10/i2c-i801-don-t-generate-an-interrupt-on-bus-reset.patch b/queue-5.10/i2c-i801-don-t-generate-an-interrupt-on-bus-reset.patch new file mode 100644 index 00000000000..504e9f3d9f6 --- /dev/null +++ b/queue-5.10/i2c-i801-don-t-generate-an-interrupt-on-bus-reset.patch @@ -0,0 +1,56 @@ +From e4d8716c3dcec47f1557024add24e1f3c09eb24b Mon Sep 17 00:00:00 2001 +From: Jean Delvare +Date: Tue, 25 May 2021 17:03:36 +0200 +Subject: i2c: i801: Don't generate an interrupt on bus reset + +From: Jean Delvare + +commit e4d8716c3dcec47f1557024add24e1f3c09eb24b upstream. + +Now that the i2c-i801 driver supports interrupts, setting the KILL bit +in a attempt to recover from a timed out transaction triggers an +interrupt. Unfortunately, the interrupt handler (i801_isr) is not +prepared for this situation and will try to process the interrupt as +if it was signaling the end of a successful transaction. In the case +of a block transaction, this can result in an out-of-range memory +access. + +This condition was reproduced several times by syzbot: +https://syzkaller.appspot.com/bug?extid=ed71512d469895b5b34e +https://syzkaller.appspot.com/bug?extid=8c8dedc0ba9e03f6c79e +https://syzkaller.appspot.com/bug?extid=c8ff0b6d6c73d81b610e +https://syzkaller.appspot.com/bug?extid=33f6c360821c399d69eb +https://syzkaller.appspot.com/bug?extid=be15dc0b1933f04b043a +https://syzkaller.appspot.com/bug?extid=b4d3fd1dfd53e90afd79 + +So disable interrupts while trying to reset the bus. Interrupts will +be enabled again for the following transaction. + +Fixes: 636752bcb517 ("i2c-i801: Enable IRQ for SMBus transactions") +Reported-by: syzbot+b4d3fd1dfd53e90afd79@syzkaller.appspotmail.com +Signed-off-by: Jean Delvare +Acked-by: Andy Shevchenko +Cc: Jarkko Nikula +Tested-by: Jarkko Nikula +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-i801.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/i2c/busses/i2c-i801.c ++++ b/drivers/i2c/busses/i2c-i801.c +@@ -391,11 +391,9 @@ static int i801_check_post(struct i801_p + dev_err(&priv->pci_dev->dev, "Transaction timeout\n"); + /* try to stop the current command */ + dev_dbg(&priv->pci_dev->dev, "Terminating the current operation\n"); +- outb_p(inb_p(SMBHSTCNT(priv)) | SMBHSTCNT_KILL, +- SMBHSTCNT(priv)); ++ outb_p(SMBHSTCNT_KILL, SMBHSTCNT(priv)); + usleep_range(1000, 2000); +- outb_p(inb_p(SMBHSTCNT(priv)) & (~SMBHSTCNT_KILL), +- SMBHSTCNT(priv)); ++ outb_p(0, SMBHSTCNT(priv)); + + /* Check if it worked */ + status = inb_p(SMBHSTSTS(priv)); diff --git a/queue-5.10/i2c-mediatek-disable-i2c-start_en-and-clear-intr_stat-brfore-reset.patch b/queue-5.10/i2c-mediatek-disable-i2c-start_en-and-clear-intr_stat-brfore-reset.patch new file mode 100644 index 00000000000..e6ab545cdf1 --- /dev/null +++ b/queue-5.10/i2c-mediatek-disable-i2c-start_en-and-clear-intr_stat-brfore-reset.patch @@ -0,0 +1,38 @@ +From fed1bd51a504eb96caa38b4f13ab138fc169ea75 Mon Sep 17 00:00:00 2001 +From: Qii Wang +Date: Thu, 27 May 2021 20:04:04 +0800 +Subject: i2c: mediatek: Disable i2c start_en and clear intr_stat brfore reset + +From: Qii Wang + +commit fed1bd51a504eb96caa38b4f13ab138fc169ea75 upstream. + +The i2c controller driver do dma reset after transfer timeout, +but sometimes dma reset will trigger an unexpected DMA_ERR irq. +It will cause the i2c controller to continuously send interrupts +to the system and cause soft lock-up. So we need to disable i2c +start_en and clear intr_stat to stop i2c controller before dma +reset when transfer timeout. + +Fixes: aafced673c06("i2c: mediatek: move dma reset before i2c reset") +Signed-off-by: Qii Wang +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-mt65xx.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/i2c/busses/i2c-mt65xx.c ++++ b/drivers/i2c/busses/i2c-mt65xx.c +@@ -478,6 +478,11 @@ static void mtk_i2c_clock_disable(struct + static void mtk_i2c_init_hw(struct mtk_i2c *i2c) + { + u16 control_reg; ++ u16 intr_stat_reg; ++ ++ mtk_i2c_writew(i2c, I2C_CHN_CLR_FLAG, OFFSET_START); ++ intr_stat_reg = mtk_i2c_readw(i2c, OFFSET_INTR_STAT); ++ mtk_i2c_writew(i2c, intr_stat_reg, OFFSET_INTR_STAT); + + if (i2c->dev_comp->apdma_sync) { + writel(I2C_DMA_WARM_RST, i2c->pdmabase + OFFSET_RST); diff --git a/queue-5.10/i2c-s3c2410-fix-possible-null-pointer-deref-on-read-message-after-write.patch b/queue-5.10/i2c-s3c2410-fix-possible-null-pointer-deref-on-read-message-after-write.patch new file mode 100644 index 00000000000..ab056ba310f --- /dev/null +++ b/queue-5.10/i2c-s3c2410-fix-possible-null-pointer-deref-on-read-message-after-write.patch @@ -0,0 +1,67 @@ +From 24990423267ec283b9d86f07f362b753eb9b0ed5 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Wed, 26 May 2021 08:39:37 -0400 +Subject: i2c: s3c2410: fix possible NULL pointer deref on read message after write + +From: Krzysztof Kozlowski + +commit 24990423267ec283b9d86f07f362b753eb9b0ed5 upstream. + +Interrupt handler processes multiple message write requests one after +another, till the driver message queue is drained. However if driver +encounters a read message without preceding START, it stops the I2C +transfer as it is an invalid condition for the controller. At least the +comment describes a requirement "the controller forces us to send a new +START when we change direction". This stop results in clearing the +message queue (i2c->msg = NULL). + +The code however immediately jumped back to label "retry_write" which +dereferenced the "i2c->msg" making it a possible NULL pointer +dereference. + +The Coverity analysis: +1. Condition !is_msgend(i2c), taking false branch. + if (!is_msgend(i2c)) { + +2. Condition !is_lastmsg(i2c), taking true branch. + } else if (!is_lastmsg(i2c)) { + +3. Condition i2c->msg->flags & 1, taking true branch. + if (i2c->msg->flags & I2C_M_RD) { + +4. write_zero_model: Passing i2c to s3c24xx_i2c_stop, which sets i2c->msg to NULL. + s3c24xx_i2c_stop(i2c, -EINVAL); + +5. Jumping to label retry_write. + goto retry_write; + +6. var_deref_model: Passing i2c to is_msgend, which dereferences null i2c->msg. + if (!is_msgend(i2c)) {" + +All previous calls to s3c24xx_i2c_stop() in this interrupt service +routine are followed by jumping to end of function (acknowledging +the interrupt and returning). This seems a reasonable choice also here +since message buffer was entirely emptied. + +Addresses-Coverity: Explicit null dereferenced +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-s3c2410.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/i2c/busses/i2c-s3c2410.c ++++ b/drivers/i2c/busses/i2c-s3c2410.c +@@ -483,7 +483,10 @@ static int i2c_s3c_irq_nextbyte(struct s + * forces us to send a new START + * when we change direction + */ ++ dev_dbg(i2c->dev, ++ "missing START before write->read\n"); + s3c24xx_i2c_stop(i2c, -EINVAL); ++ break; + } + + goto retry_write; diff --git a/queue-5.10/i2c-sh_mobile-use-new-clock-calculation-formulas-for-rz-g2e.patch b/queue-5.10/i2c-sh_mobile-use-new-clock-calculation-formulas-for-rz-g2e.patch new file mode 100644 index 00000000000..4a2043bd5b3 --- /dev/null +++ b/queue-5.10/i2c-sh_mobile-use-new-clock-calculation-formulas-for-rz-g2e.patch @@ -0,0 +1,33 @@ +From c4740e293c93c747e65d53d9aacc2ba8521d1489 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Thu, 6 May 2021 13:15:40 +0200 +Subject: i2c: sh_mobile: Use new clock calculation formulas for RZ/G2E + +From: Geert Uytterhoeven + +commit c4740e293c93c747e65d53d9aacc2ba8521d1489 upstream. + +When switching the Gen3 SoCs to the new clock calculation formulas, the +match entry for RZ/G2E added in commit 51243b73455f2d12 ("i2c: +sh_mobile: Add support for r8a774c0 (RZ/G2E)") was forgotten. + +Fixes: e8a27567509b2439 ("i2c: sh_mobile: use new clock calculation formulas for Gen3") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Fabrizio Castro +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-sh_mobile.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/i2c/busses/i2c-sh_mobile.c ++++ b/drivers/i2c/busses/i2c-sh_mobile.c +@@ -807,7 +807,7 @@ static const struct sh_mobile_dt_config + static const struct of_device_id sh_mobile_i2c_dt_ids[] = { + { .compatible = "renesas,iic-r8a73a4", .data = &fast_clock_dt_config }, + { .compatible = "renesas,iic-r8a7740", .data = &r8a7740_dt_config }, +- { .compatible = "renesas,iic-r8a774c0", .data = &fast_clock_dt_config }, ++ { .compatible = "renesas,iic-r8a774c0", .data = &v2_freq_calc_dt_config }, + { .compatible = "renesas,iic-r8a7790", .data = &v2_freq_calc_dt_config }, + { .compatible = "renesas,iic-r8a7791", .data = &v2_freq_calc_dt_config }, + { .compatible = "renesas,iic-r8a7792", .data = &v2_freq_calc_dt_config }, diff --git a/queue-5.10/mptcp-avoid-error-message-on-infinite-mapping.patch b/queue-5.10/mptcp-avoid-error-message-on-infinite-mapping.patch new file mode 100644 index 00000000000..555f2fc9144 --- /dev/null +++ b/queue-5.10/mptcp-avoid-error-message-on-infinite-mapping.patch @@ -0,0 +1,31 @@ +From 3ed0a585bfadb6bd7080f11184adbc9edcce7dbc Mon Sep 17 00:00:00 2001 +From: Paolo Abeni +Date: Tue, 25 May 2021 14:23:12 -0700 +Subject: mptcp: avoid error message on infinite mapping + +From: Paolo Abeni + +commit 3ed0a585bfadb6bd7080f11184adbc9edcce7dbc upstream. + +Another left-over. Avoid flooding dmesg with useless text, +we already have a MIB for that event. + +Fixes: 648ef4b88673 ("mptcp: Implement MPTCP receive path") +Signed-off-by: Paolo Abeni +Signed-off-by: Mat Martineau +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/subflow.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/net/mptcp/subflow.c ++++ b/net/mptcp/subflow.c +@@ -740,7 +740,6 @@ static enum mapping_status get_mapping_s + + data_len = mpext->data_len; + if (data_len == 0) { +- pr_err("Infinite mapping not handled"); + MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_INFINITEMAPRX); + return MAPPING_INVALID; + } diff --git a/queue-5.10/mptcp-drop-unconditional-pr_warn-on-bad-opt.patch b/queue-5.10/mptcp-drop-unconditional-pr_warn-on-bad-opt.patch new file mode 100644 index 00000000000..d98e3a5e826 --- /dev/null +++ b/queue-5.10/mptcp-drop-unconditional-pr_warn-on-bad-opt.patch @@ -0,0 +1,31 @@ +From 3812ce895047afdb78dc750a236515416e0ccded Mon Sep 17 00:00:00 2001 +From: Paolo Abeni +Date: Tue, 25 May 2021 14:23:11 -0700 +Subject: mptcp: drop unconditional pr_warn on bad opt + +From: Paolo Abeni + +commit 3812ce895047afdb78dc750a236515416e0ccded upstream. + +This is a left-over of early day. A malicious peer can flood +the kernel logs with useless messages, just drop it. + +Fixes: f296234c98a8 ("mptcp: Add handling of incoming MP_JOIN requests") +Signed-off-by: Paolo Abeni +Signed-off-by: Mat Martineau +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/options.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/net/mptcp/options.c ++++ b/net/mptcp/options.c +@@ -127,7 +127,6 @@ static void mptcp_parse_option(const str + memcpy(mp_opt->hmac, ptr, MPTCPOPT_HMAC_LEN); + pr_debug("MP_JOIN hmac"); + } else { +- pr_warn("MP_JOIN bad option size"); + mp_opt->mp_join = 0; + } + break; diff --git a/queue-5.10/mptcp-fix-data-stream-corruption.patch b/queue-5.10/mptcp-fix-data-stream-corruption.patch new file mode 100644 index 00000000000..987d49ddc35 --- /dev/null +++ b/queue-5.10/mptcp-fix-data-stream-corruption.patch @@ -0,0 +1,55 @@ +From 29249eac5225429b898f278230a6ca2baa1ae154 Mon Sep 17 00:00:00 2001 +From: Paolo Abeni +Date: Tue, 11 May 2021 19:13:51 +0200 +Subject: mptcp: fix data stream corruption + +From: Paolo Abeni + +commit 29249eac5225429b898f278230a6ca2baa1ae154 upstream. + +Maxim reported several issues when forcing a TCP transparent proxy +to use the MPTCP protocol for the inbound connections. He also +provided a clean reproducer. + +The problem boils down to 'mptcp_frag_can_collapse_to()' assuming +that only MPTCP will use the given page_frag. + +If others - e.g. the plain TCP protocol - allocate page fragments, +we can end-up re-using already allocated memory for mptcp_data_frag. + +Fix the issue ensuring that the to-be-expanded data fragment is +located at the current page frag end. + +v1 -> v2: + - added missing fixes tag (Mat) + +Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/178 +Reported-and-tested-by: Maxim Galaganov +Fixes: 18b683bff89d ("mptcp: queue data for mptcp level retransmission") +Signed-off-by: Paolo Abeni +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/protocol.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -758,11 +758,17 @@ static bool mptcp_skb_can_collapse_to(u6 + return mpext && mpext->data_seq + mpext->data_len == write_seq; + } + ++/* we can append data to the given data frag if: ++ * - there is space available in the backing page_frag ++ * - the data frag tail matches the current page_frag free offset ++ * - the data frag end sequence number matches the current write seq ++ */ + static bool mptcp_frag_can_collapse_to(const struct mptcp_sock *msk, + const struct page_frag *pfrag, + const struct mptcp_data_frag *df) + { + return df && pfrag->page == df->page && ++ pfrag->offset == (df->offset + df->data_len) && + df->data_seq + df->data_len == msk->write_seq; + } + diff --git a/queue-5.10/net-dsa-fix-a-crash-if-get_sset_count-fails.patch b/queue-5.10/net-dsa-fix-a-crash-if-get_sset_count-fails.patch new file mode 100644 index 00000000000..2f0c2df787c --- /dev/null +++ b/queue-5.10/net-dsa-fix-a-crash-if-get_sset_count-fails.patch @@ -0,0 +1,49 @@ +From a269333fa5c0c8e53c92b5a28a6076a28cde3e83 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Sat, 8 May 2021 16:30:35 +0300 +Subject: net: dsa: fix a crash if ->get_sset_count() fails + +From: Dan Carpenter + +commit a269333fa5c0c8e53c92b5a28a6076a28cde3e83 upstream. + +If ds->ops->get_sset_count() fails then it "count" is a negative error +code such as -EOPNOTSUPP. Because "i" is an unsigned int, the negative +error code is type promoted to a very high value and the loop will +corrupt memory until the system crashes. + +Fix this by checking for error codes and changing the type of "i" to +just int. + +Fixes: badf3ada60ab ("net: dsa: Provide CPU port statistics to master netdev") +Signed-off-by: Dan Carpenter +Reviewed-by: Andrew Lunn +Reviewed-by: Florian Fainelli +Reviewed-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/dsa/master.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/net/dsa/master.c ++++ b/net/dsa/master.c +@@ -147,8 +147,7 @@ static void dsa_master_get_strings(struc + struct dsa_switch *ds = cpu_dp->ds; + int port = cpu_dp->index; + int len = ETH_GSTRING_LEN; +- int mcount = 0, count; +- unsigned int i; ++ int mcount = 0, count, i; + uint8_t pfx[4]; + uint8_t *ndata; + +@@ -178,6 +177,8 @@ static void dsa_master_get_strings(struc + */ + ds->ops->get_strings(ds, port, stringset, ndata); + count = ds->ops->get_sset_count(ds, port, stringset); ++ if (count < 0) ++ return; + for (i = 0; i < count; i++) { + memmove(ndata + (i * len + sizeof(pfx)), + ndata + i * len, len - sizeof(pfx)); diff --git a/queue-5.10/net-dsa-mt7530-fix-vlan-traffic-leaks.patch b/queue-5.10/net-dsa-mt7530-fix-vlan-traffic-leaks.patch new file mode 100644 index 00000000000..6c1fd24e51c --- /dev/null +++ b/queue-5.10/net-dsa-mt7530-fix-vlan-traffic-leaks.patch @@ -0,0 +1,49 @@ +From 474a2ddaa192777522a7499784f1d60691cd831a Mon Sep 17 00:00:00 2001 +From: DENG Qingfang +Date: Sun, 23 May 2021 22:51:54 +0800 +Subject: net: dsa: mt7530: fix VLAN traffic leaks + +From: DENG Qingfang + +commit 474a2ddaa192777522a7499784f1d60691cd831a upstream. + +PCR_MATRIX field was set to all 1's when VLAN filtering is enabled, but +was not reset when it is disabled, which may cause traffic leaks: + + ip link add br0 type bridge vlan_filtering 1 + ip link add br1 type bridge vlan_filtering 1 + ip link set swp0 master br0 + ip link set swp1 master br1 + ip link set br0 type bridge vlan_filtering 0 + ip link set br1 type bridge vlan_filtering 0 + # traffic in br0 and br1 will start leaking to each other + +As port_bridge_{add,del} have set up PCR_MATRIX properly, remove the +PCR_MATRIX write from mt7530_port_set_vlan_aware. + +Fixes: 83163f7dca56 ("net: dsa: mediatek: add VLAN support for MT7530") +Signed-off-by: DENG Qingfang +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/mt7530.c | 8 -------- + 1 file changed, 8 deletions(-) + +--- a/drivers/net/dsa/mt7530.c ++++ b/drivers/net/dsa/mt7530.c +@@ -1128,14 +1128,6 @@ mt7530_port_set_vlan_aware(struct dsa_sw + { + struct mt7530_priv *priv = ds->priv; + +- /* The real fabric path would be decided on the membership in the +- * entry of VLAN table. PCR_MATRIX set up here with ALL_MEMBERS +- * means potential VLAN can be consisting of certain subset of all +- * ports. +- */ +- mt7530_rmw(priv, MT7530_PCR_P(port), +- PCR_MATRIX_MASK, PCR_MATRIX(MT7530_ALL_MEMBERS)); +- + /* Trapped into security mode allows packet forwarding through VLAN + * table lookup. CPU port is set to fallback mode to let untagged + * frames pass through. diff --git a/queue-5.10/net-dsa-sja1105-add-error-handling-in-sja1105_setup.patch b/queue-5.10/net-dsa-sja1105-add-error-handling-in-sja1105_setup.patch new file mode 100644 index 00000000000..6acb398fef8 --- /dev/null +++ b/queue-5.10/net-dsa-sja1105-add-error-handling-in-sja1105_setup.patch @@ -0,0 +1,67 @@ +From cec279a898a3b004411682f212215ccaea1cd0fb Mon Sep 17 00:00:00 2001 +From: Vladimir Oltean +Date: Mon, 24 May 2021 12:25:24 +0300 +Subject: net: dsa: sja1105: add error handling in sja1105_setup() + +From: Vladimir Oltean + +commit cec279a898a3b004411682f212215ccaea1cd0fb upstream. + +If any of sja1105_static_config_load(), sja1105_clocking_setup() or +sja1105_devlink_setup() fails, we can't just return in the middle of +sja1105_setup() or memory will leak. Add a cleanup path. + +Fixes: 0a7bdbc23d8a ("net: dsa: sja1105: move devlink param code to sja1105_devlink.c") +Fixes: 8aa9ebccae87 ("net: dsa: Introduce driver for NXP SJA1105 5-port L2 switch") +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/sja1105/sja1105_main.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +--- a/drivers/net/dsa/sja1105/sja1105_main.c ++++ b/drivers/net/dsa/sja1105/sja1105_main.c +@@ -2922,13 +2922,13 @@ static int sja1105_setup(struct dsa_swit + rc = sja1105_static_config_load(priv, ports); + if (rc < 0) { + dev_err(ds->dev, "Failed to load static config: %d\n", rc); +- return rc; ++ goto out_ptp_clock_unregister; + } + /* Configure the CGU (PHY link modes and speeds) */ + rc = sja1105_clocking_setup(priv); + if (rc < 0) { + dev_err(ds->dev, "Failed to configure MII clocking: %d\n", rc); +- return rc; ++ goto out_static_config_free; + } + /* On SJA1105, VLAN filtering per se is always enabled in hardware. + * The only thing we can do to disable it is lie about what the 802.1Q +@@ -2949,7 +2949,7 @@ static int sja1105_setup(struct dsa_swit + + rc = sja1105_devlink_setup(ds); + if (rc < 0) +- return rc; ++ goto out_static_config_free; + + /* The DSA/switchdev model brings up switch ports in standalone mode by + * default, and that means vlan_filtering is 0 since they're not under +@@ -2958,6 +2958,17 @@ static int sja1105_setup(struct dsa_swit + rtnl_lock(); + rc = sja1105_setup_8021q_tagging(ds, true); + rtnl_unlock(); ++ if (rc) ++ goto out_devlink_teardown; ++ ++ return 0; ++ ++out_devlink_teardown: ++ sja1105_devlink_teardown(ds); ++out_ptp_clock_unregister: ++ sja1105_ptp_clock_unregister(ds); ++out_static_config_free: ++ sja1105_static_config_free(&priv->static_config); + + return rc; + } diff --git a/queue-5.10/net-dsa-sja1105-call-dsa_unregister_switch-when-allocating-memory-fails.patch b/queue-5.10/net-dsa-sja1105-call-dsa_unregister_switch-when-allocating-memory-fails.patch new file mode 100644 index 00000000000..a2cfc91c0bd --- /dev/null +++ b/queue-5.10/net-dsa-sja1105-call-dsa_unregister_switch-when-allocating-memory-fails.patch @@ -0,0 +1,68 @@ +From dc596e3fe63f88e3d1e509f64e7f761cd4135538 Mon Sep 17 00:00:00 2001 +From: Vladimir Oltean +Date: Mon, 24 May 2021 12:25:23 +0300 +Subject: net: dsa: sja1105: call dsa_unregister_switch when allocating memory fails + +From: Vladimir Oltean + +commit dc596e3fe63f88e3d1e509f64e7f761cd4135538 upstream. + +Unlike other drivers which pretty much end their .probe() execution with +dsa_register_switch(), the sja1105 does some extra stuff. When that +fails with -ENOMEM, the driver is quick to return that, forgetting to +call dsa_unregister_switch(). Not critical, but a bug nonetheless. + +Fixes: 4d7525085a9b ("net: dsa: sja1105: offload the Credit-Based Shaper qdisc") +Fixes: a68578c20a96 ("net: dsa: Make deferred_xmit private to sja1105") +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/sja1105/sja1105_main.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +--- a/drivers/net/dsa/sja1105/sja1105_main.c ++++ b/drivers/net/dsa/sja1105/sja1105_main.c +@@ -3483,8 +3483,10 @@ static int sja1105_probe(struct spi_devi + priv->cbs = devm_kcalloc(dev, priv->info->num_cbs_shapers, + sizeof(struct sja1105_cbs_entry), + GFP_KERNEL); +- if (!priv->cbs) +- return -ENOMEM; ++ if (!priv->cbs) { ++ rc = -ENOMEM; ++ goto out_unregister_switch; ++ } + } + + /* Connections between dsa_port and sja1105_port */ +@@ -3509,7 +3511,7 @@ static int sja1105_probe(struct spi_devi + dev_err(ds->dev, + "failed to create deferred xmit thread: %d\n", + rc); +- goto out; ++ goto out_destroy_workers; + } + skb_queue_head_init(&sp->xmit_queue); + sp->xmit_tpid = ETH_P_SJA1105; +@@ -3519,7 +3521,8 @@ static int sja1105_probe(struct spi_devi + } + + return 0; +-out: ++ ++out_destroy_workers: + while (port-- > 0) { + struct sja1105_port *sp = &priv->ports[port]; + +@@ -3528,6 +3531,10 @@ out: + + kthread_destroy_worker(sp->xmit_worker); + } ++ ++out_unregister_switch: ++ dsa_unregister_switch(ds); ++ + return rc; + } + diff --git a/queue-5.10/net-dsa-sja1105-error-out-on-unsupported-phy-mode.patch b/queue-5.10/net-dsa-sja1105-error-out-on-unsupported-phy-mode.patch new file mode 100644 index 00000000000..823873fd27d --- /dev/null +++ b/queue-5.10/net-dsa-sja1105-error-out-on-unsupported-phy-mode.patch @@ -0,0 +1,30 @@ +From 6729188d2646709941903052e4b78e1d82c239b9 Mon Sep 17 00:00:00 2001 +From: Vladimir Oltean +Date: Mon, 24 May 2021 12:25:25 +0300 +Subject: net: dsa: sja1105: error out on unsupported PHY mode + +From: Vladimir Oltean + +commit 6729188d2646709941903052e4b78e1d82c239b9 upstream. + +The driver continues probing when a port is configured for an +unsupported PHY interface type, instead it should stop. + +Fixes: 8aa9ebccae87 ("net: dsa: Introduce driver for NXP SJA1105 5-port L2 switch") +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/sja1105/sja1105_main.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/dsa/sja1105/sja1105_main.c ++++ b/drivers/net/dsa/sja1105/sja1105_main.c +@@ -206,6 +206,7 @@ static int sja1105_init_mii_settings(str + default: + dev_err(dev, "Unsupported PHY mode %s!\n", + phy_modes(ports[i].phy_mode)); ++ return -EINVAL; + } + + /* Even though the SerDes port is able to drive SGMII autoneg diff --git a/queue-5.10/net-dsa-sja1105-fix-vl-lookup-command-packing-for-p-q-r-s.patch b/queue-5.10/net-dsa-sja1105-fix-vl-lookup-command-packing-for-p-q-r-s.patch new file mode 100644 index 00000000000..52734882e47 --- /dev/null +++ b/queue-5.10/net-dsa-sja1105-fix-vl-lookup-command-packing-for-p-q-r-s.patch @@ -0,0 +1,93 @@ +From ba61cf167cb77e54c1ec5adb7aa49a22ab3c9b28 Mon Sep 17 00:00:00 2001 +From: Vladimir Oltean +Date: Mon, 24 May 2021 12:25:22 +0300 +Subject: net: dsa: sja1105: fix VL lookup command packing for P/Q/R/S + +From: Vladimir Oltean + +commit ba61cf167cb77e54c1ec5adb7aa49a22ab3c9b28 upstream. + +At the beginning of the sja1105_dynamic_config.c file there is a diagram +of the dynamic config interface layout: + + packed_buf + + | + V + +-----------------------------------------+------------------+ + | ENTRY BUFFER | COMMAND BUFFER | + +-----------------------------------------+------------------+ + + <----------------------- packed_size ------------------------> + +So in order to pack/unpack the command bits into the buffer, +sja1105_vl_lookup_cmd_packing must first advance the buffer pointer by +the length of the entry. This is similar to what the other *cmd_packing +functions do. + +This bug exists because the command packing function for P/Q/R/S was +copied from the E/T generation, and on E/T, the command was actually +embedded within the entry buffer itself. + +Fixes: 94f94d4acfb2 ("net: dsa: sja1105: add static tables for virtual links") +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/sja1105/sja1105_dynamic_config.c | 23 +++++++++++++++++++---- + 1 file changed, 19 insertions(+), 4 deletions(-) + +--- a/drivers/net/dsa/sja1105/sja1105_dynamic_config.c ++++ b/drivers/net/dsa/sja1105/sja1105_dynamic_config.c +@@ -167,9 +167,10 @@ enum sja1105_hostcmd { + SJA1105_HOSTCMD_INVALIDATE = 4, + }; + ++/* Command and entry overlap */ + static void +-sja1105_vl_lookup_cmd_packing(void *buf, struct sja1105_dyn_cmd *cmd, +- enum packing_op op) ++sja1105et_vl_lookup_cmd_packing(void *buf, struct sja1105_dyn_cmd *cmd, ++ enum packing_op op) + { + const int size = SJA1105_SIZE_DYN_CMD; + +@@ -179,6 +180,20 @@ sja1105_vl_lookup_cmd_packing(void *buf, + sja1105_packing(buf, &cmd->index, 9, 0, size, op); + } + ++/* Command and entry are separate */ ++static void ++sja1105pqrs_vl_lookup_cmd_packing(void *buf, struct sja1105_dyn_cmd *cmd, ++ enum packing_op op) ++{ ++ u8 *p = buf + SJA1105_SIZE_VL_LOOKUP_ENTRY; ++ const int size = SJA1105_SIZE_DYN_CMD; ++ ++ sja1105_packing(p, &cmd->valid, 31, 31, size, op); ++ sja1105_packing(p, &cmd->errors, 30, 30, size, op); ++ sja1105_packing(p, &cmd->rdwrset, 29, 29, size, op); ++ sja1105_packing(p, &cmd->index, 9, 0, size, op); ++} ++ + static size_t sja1105et_vl_lookup_entry_packing(void *buf, void *entry_ptr, + enum packing_op op) + { +@@ -641,7 +656,7 @@ static size_t sja1105pqrs_cbs_entry_pack + const struct sja1105_dynamic_table_ops sja1105et_dyn_ops[BLK_IDX_MAX_DYN] = { + [BLK_IDX_VL_LOOKUP] = { + .entry_packing = sja1105et_vl_lookup_entry_packing, +- .cmd_packing = sja1105_vl_lookup_cmd_packing, ++ .cmd_packing = sja1105et_vl_lookup_cmd_packing, + .access = OP_WRITE, + .max_entry_count = SJA1105_MAX_VL_LOOKUP_COUNT, + .packed_size = SJA1105ET_SIZE_VL_LOOKUP_DYN_CMD, +@@ -725,7 +740,7 @@ const struct sja1105_dynamic_table_ops s + const struct sja1105_dynamic_table_ops sja1105pqrs_dyn_ops[BLK_IDX_MAX_DYN] = { + [BLK_IDX_VL_LOOKUP] = { + .entry_packing = sja1105_vl_lookup_entry_packing, +- .cmd_packing = sja1105_vl_lookup_cmd_packing, ++ .cmd_packing = sja1105pqrs_vl_lookup_cmd_packing, + .access = (OP_READ | OP_WRITE), + .max_entry_count = SJA1105_MAX_VL_LOOKUP_COUNT, + .packed_size = SJA1105PQRS_SIZE_VL_LOOKUP_DYN_CMD, diff --git a/queue-5.10/net-dsa-sja1105-update-existing-vlans-from-the-bridge-vlan-list.patch b/queue-5.10/net-dsa-sja1105-update-existing-vlans-from-the-bridge-vlan-list.patch new file mode 100644 index 00000000000..b31748815f0 --- /dev/null +++ b/queue-5.10/net-dsa-sja1105-update-existing-vlans-from-the-bridge-vlan-list.patch @@ -0,0 +1,75 @@ +From b38e659de966a122fe2cb178c1e39c9bea06bc62 Mon Sep 17 00:00:00 2001 +From: Vladimir Oltean +Date: Mon, 24 May 2021 12:25:27 +0300 +Subject: net: dsa: sja1105: update existing VLANs from the bridge VLAN list + +From: Vladimir Oltean + +commit b38e659de966a122fe2cb178c1e39c9bea06bc62 upstream. + +When running this sequence of operations: + +ip link add br0 type bridge vlan_filtering 1 +ip link set swp4 master br0 +bridge vlan add dev swp4 vid 1 + +We observe the traffic sent on swp4 is still untagged, even though the +bridge has overwritten the existing VLAN entry: + +port vlan ids +swp4 1 PVID + +br0 1 PVID Egress Untagged + +This happens because we didn't consider that the 'bridge vlan add' +command just overwrites VLANs like it's nothing. We treat the 'vid 1 +pvid untagged' and the 'vid 1' as two separate VLANs, and the first +still has precedence when calling sja1105_build_vlan_table. Obviously +there is a disagreement regarding semantics, and we end up doing +something unexpected from the PoV of the bridge. + +Let's actually consider an "existing VLAN" to be one which is on the +same port, and has the same VLAN ID, as one we already have, and update +it if it has different flags than we do. + +The first blamed commit is the one introducing the bug, the second one +is the latest on top of which the bugfix still applies. + +Fixes: ec5ae61076d0 ("net: dsa: sja1105: save/restore VLANs using a delta commit method") +Fixes: 5899ee367ab3 ("net: dsa: tag_8021q: add a context structure") +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/sja1105/sja1105_main.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +--- a/drivers/net/dsa/sja1105/sja1105_main.c ++++ b/drivers/net/dsa/sja1105/sja1105_main.c +@@ -2756,11 +2756,22 @@ static int sja1105_vlan_add_one(struct d + bool pvid = flags & BRIDGE_VLAN_INFO_PVID; + struct sja1105_bridge_vlan *v; + +- list_for_each_entry(v, vlan_list, list) +- if (v->port == port && v->vid == vid && +- v->untagged == untagged && v->pvid == pvid) ++ list_for_each_entry(v, vlan_list, list) { ++ if (v->port == port && v->vid == vid) { + /* Already added */ +- return 0; ++ if (v->untagged == untagged && v->pvid == pvid) ++ /* Nothing changed */ ++ return 0; ++ ++ /* It's the same VLAN, but some of the flags changed ++ * and the user did not bother to delete it first. ++ * Update it and trigger sja1105_build_vlan_table. ++ */ ++ v->untagged = untagged; ++ v->pvid = pvid; ++ return 1; ++ } ++ } + + v = kzalloc(sizeof(*v), GFP_KERNEL); + if (!v) { diff --git a/queue-5.10/net-dsa-sja1105-use-4095-as-the-private-vlan-for-untagged-traffic.patch b/queue-5.10/net-dsa-sja1105-use-4095-as-the-private-vlan-for-untagged-traffic.patch new file mode 100644 index 00000000000..178f6aaf9b3 --- /dev/null +++ b/queue-5.10/net-dsa-sja1105-use-4095-as-the-private-vlan-for-untagged-traffic.patch @@ -0,0 +1,136 @@ +From ed040abca4c1db72dfd3b8483b6ed6bfb7c2571e Mon Sep 17 00:00:00 2001 +From: Vladimir Oltean +Date: Mon, 24 May 2021 12:25:26 +0300 +Subject: net: dsa: sja1105: use 4095 as the private VLAN for untagged traffic + +From: Vladimir Oltean + +commit ed040abca4c1db72dfd3b8483b6ed6bfb7c2571e upstream. + +One thing became visible when writing the blamed commit, and that was +that STP and PTP frames injected by net/dsa/tag_sja1105.c using the +deferred xmit mechanism are always classified to the pvid of the CPU +port, regardless of whatever VLAN there might be in these packets. + +So a decision needed to be taken regarding the mechanism through which +we should ensure that delivery of STP and PTP traffic is possible when +we are in a VLAN awareness mode that involves tag_8021q. This is because +tag_8021q is not concerned with managing the pvid of the CPU port, since +as far as tag_8021q is concerned, no traffic should be sent as untagged +from the CPU port. So we end up not actually having a pvid on the CPU +port if we only listen to tag_8021q, and unless we do something about it. + +The decision taken at the time was to keep VLAN 1 in the list of +priv->dsa_8021q_vlans, and make it a pvid of the CPU port. This ensures +that STP and PTP frames can always be sent to the outside world. + +However there is a problem. If we do the following while we are in +the best_effort_vlan_filtering=true mode: + +ip link add br0 type bridge vlan_filtering 1 +ip link set swp2 master br0 +bridge vlan del dev swp2 vid 1 + +Then untagged and pvid-tagged frames should be dropped. But we observe +that they aren't, and this is because of the precaution we took that VID +1 is always installed on all ports. + +So clearly VLAN 1 is not good for this purpose. What about VLAN 0? +Well, VLAN 0 is managed by the 8021q module, and that module wants to +ensure that 802.1p tagged frames are always received by a port, and are +always transmitted as VLAN-tagged (with VLAN ID 0). Whereas we want our +STP and PTP frames to be untagged if the stack sent them as untagged - +we don't want the driver to just decide out of the blue that it adds +VID 0 to some packets. + +So what to do? + +Well, there is one other VLAN that is reserved, and that is 4095: +$ ip link add link swp2 name swp2.4095 type vlan id 4095 +Error: 8021q: Invalid VLAN id. +$ bridge vlan add dev swp2 vid 4095 +Error: bridge: Vlan id is invalid. + +After we made this change, VLAN 1 is indeed forwarded and/or dropped +according to the bridge VLAN table, there are no further alterations +done by the sja1105 driver. + +Fixes: ec5ae61076d0 ("net: dsa: sja1105: save/restore VLANs using a delta commit method") +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/sja1105/sja1105_main.c | 23 +++++++++++------------ + 1 file changed, 11 insertions(+), 12 deletions(-) + +--- a/drivers/net/dsa/sja1105/sja1105_main.c ++++ b/drivers/net/dsa/sja1105/sja1105_main.c +@@ -25,6 +25,8 @@ + #include "sja1105_sgmii.h" + #include "sja1105_tas.h" + ++#define SJA1105_DEFAULT_VLAN (VLAN_N_VID - 1) ++ + static const struct dsa_switch_ops sja1105_switch_ops; + + static void sja1105_hw_reset(struct gpio_desc *gpio, unsigned int pulse_len, +@@ -292,6 +294,13 @@ static int sja1105_init_l2_lookup_params + return 0; + } + ++/* Set up a default VLAN for untagged traffic injected from the CPU ++ * using management routes (e.g. STP, PTP) as opposed to tag_8021q. ++ * All DT-defined ports are members of this VLAN, and there are no ++ * restrictions on forwarding (since the CPU selects the destination). ++ * Frames from this VLAN will always be transmitted as untagged, and ++ * neither the bridge nor the 8021q module cannot create this VLAN ID. ++ */ + static int sja1105_init_static_vlan(struct sja1105_private *priv) + { + struct sja1105_table *table; +@@ -301,17 +310,13 @@ static int sja1105_init_static_vlan(stru + .vmemb_port = 0, + .vlan_bc = 0, + .tag_port = 0, +- .vlanid = 1, ++ .vlanid = SJA1105_DEFAULT_VLAN, + }; + struct dsa_switch *ds = priv->ds; + int port; + + table = &priv->static_config.tables[BLK_IDX_VLAN_LOOKUP]; + +- /* The static VLAN table will only contain the initial pvid of 1. +- * All other VLANs are to be configured through dynamic entries, +- * and kept in the static configuration table as backing memory. +- */ + if (table->entry_count) { + kfree(table->entries); + table->entry_count = 0; +@@ -324,9 +329,6 @@ static int sja1105_init_static_vlan(stru + + table->entry_count = 1; + +- /* VLAN 1: all DT-defined ports are members; no restrictions on +- * forwarding; always transmit as untagged. +- */ + for (port = 0; port < ds->num_ports; port++) { + struct sja1105_bridge_vlan *v; + +@@ -337,15 +339,12 @@ static int sja1105_init_static_vlan(stru + pvid.vlan_bc |= BIT(port); + pvid.tag_port &= ~BIT(port); + +- /* Let traffic that don't need dsa_8021q (e.g. STP, PTP) be +- * transmitted as untagged. +- */ + v = kzalloc(sizeof(*v), GFP_KERNEL); + if (!v) + return -ENOMEM; + + v->port = port; +- v->vid = 1; ++ v->vid = SJA1105_DEFAULT_VLAN; + v->untagged = true; + if (dsa_is_cpu_port(ds, port)) + v->pvid = true; diff --git a/queue-5.10/netfilter-flowtable-remove-redundant-hw-refresh-bit.patch b/queue-5.10/netfilter-flowtable-remove-redundant-hw-refresh-bit.patch new file mode 100644 index 00000000000..0594a3ac5cf --- /dev/null +++ b/queue-5.10/netfilter-flowtable-remove-redundant-hw-refresh-bit.patch @@ -0,0 +1,66 @@ +From c07531c01d8284aedaf95708ea90e76d11af0e21 Mon Sep 17 00:00:00 2001 +From: Roi Dayan +Date: Mon, 10 May 2021 14:50:24 +0300 +Subject: netfilter: flowtable: Remove redundant hw refresh bit + +From: Roi Dayan + +commit c07531c01d8284aedaf95708ea90e76d11af0e21 upstream. + +Offloading conns could fail for multiple reasons and a hw refresh bit is +set to try to reoffload it in next sw packet. +But it could be in some cases and future points that the hw refresh bit +is not set but a refresh could succeed. +Remove the hw refresh bit and do offload refresh if requested. +There won't be a new work entry if a work is already pending +anyway as there is the hw pending bit. + +Fixes: 8b3646d6e0c4 ("net/sched: act_ct: Support refreshing the flow table entries") +Signed-off-by: Roi Dayan +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + include/net/netfilter/nf_flow_table.h | 1 - + net/netfilter/nf_flow_table_core.c | 3 +-- + net/netfilter/nf_flow_table_offload.c | 7 ++++--- + 3 files changed, 5 insertions(+), 6 deletions(-) + +--- a/include/net/netfilter/nf_flow_table.h ++++ b/include/net/netfilter/nf_flow_table.h +@@ -126,7 +126,6 @@ enum nf_flow_flags { + NF_FLOW_HW, + NF_FLOW_HW_DYING, + NF_FLOW_HW_DEAD, +- NF_FLOW_HW_REFRESH, + NF_FLOW_HW_PENDING, + }; + +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -259,8 +259,7 @@ void flow_offload_refresh(struct nf_flow + { + flow->timeout = nf_flowtable_time_stamp + NF_FLOW_TIMEOUT; + +- if (likely(!nf_flowtable_hw_offload(flow_table) || +- !test_and_clear_bit(NF_FLOW_HW_REFRESH, &flow->flags))) ++ if (likely(!nf_flowtable_hw_offload(flow_table))) + return; + + nf_flow_offload_add(flow_table, flow); +--- a/net/netfilter/nf_flow_table_offload.c ++++ b/net/netfilter/nf_flow_table_offload.c +@@ -753,10 +753,11 @@ static void flow_offload_work_add(struct + + err = flow_offload_rule_add(offload, flow_rule); + if (err < 0) +- set_bit(NF_FLOW_HW_REFRESH, &offload->flow->flags); +- else +- set_bit(IPS_HW_OFFLOAD_BIT, &offload->flow->ct->status); ++ goto out; + ++ set_bit(IPS_HW_OFFLOAD_BIT, &offload->flow->ct->status); ++ ++out: + nf_flow_offload_destroy(flow_rule); + } + diff --git a/queue-5.10/nvmet-tcp-fix-inline-data-size-comparison-in-nvmet_tcp_queue_response.patch b/queue-5.10/nvmet-tcp-fix-inline-data-size-comparison-in-nvmet_tcp_queue_response.patch new file mode 100644 index 00000000000..0216562086b --- /dev/null +++ b/queue-5.10/nvmet-tcp-fix-inline-data-size-comparison-in-nvmet_tcp_queue_response.patch @@ -0,0 +1,31 @@ +From 25df1acd2d36eb72b14c3d00f6b861b1e00b3aab Mon Sep 17 00:00:00 2001 +From: Hou Pu +Date: Thu, 20 May 2021 19:30:45 +0800 +Subject: nvmet-tcp: fix inline data size comparison in nvmet_tcp_queue_response + +From: Hou Pu + +commit 25df1acd2d36eb72b14c3d00f6b861b1e00b3aab upstream. + +Using "<=" instead "<" to compare inline data size. + +Fixes: bdaf13279192 ("nvmet-tcp: fix a segmentation fault during io parsing error") +Signed-off-by: Hou Pu +Reviewed-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/target/tcp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/nvme/target/tcp.c ++++ b/drivers/nvme/target/tcp.c +@@ -538,7 +538,7 @@ static void nvmet_tcp_queue_response(str + * nvmet_req_init is completed. + */ + if (queue->rcv_state == NVMET_TCP_RECV_PDU && +- len && len < cmd->req.port->inline_data_size && ++ len && len <= cmd->req.port->inline_data_size && + nvme_is_write(cmd->req.cmd)) + return; + } diff --git a/queue-5.10/perf-jevents-fix-getting-maximum-number-of-fds.patch b/queue-5.10/perf-jevents-fix-getting-maximum-number-of-fds.patch new file mode 100644 index 00000000000..077b9b110af --- /dev/null +++ b/queue-5.10/perf-jevents-fix-getting-maximum-number-of-fds.patch @@ -0,0 +1,41 @@ +From 75ea44e356b5de8c817f821c9dd68ae329e82add Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Tue, 25 May 2021 18:07:58 +0200 +Subject: perf jevents: Fix getting maximum number of fds + +From: Felix Fietkau + +commit 75ea44e356b5de8c817f821c9dd68ae329e82add upstream. + +On some hosts, rlim.rlim_max can be returned as RLIM_INFINITY. +By casting it to int, it is interpreted as -1, which will cause get_maxfds +to return 0, causing "Invalid argument" errors in nftw() calls. +Fix this by casting the second argument of min() to rlim_t instead. + +Fixes: 80eeb67fe577 ("perf jevents: Program to convert JSON file") +Signed-off-by: Felix Fietkau +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Sukadev Bhattiprolu +Link: http://lore.kernel.org/lkml/20210525160758.97829-1-nbd@nbd.name +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/pmu-events/jevents.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/perf/pmu-events/jevents.c ++++ b/tools/perf/pmu-events/jevents.c +@@ -894,7 +894,7 @@ static int get_maxfds(void) + struct rlimit rlim; + + if (getrlimit(RLIMIT_NOFILE, &rlim) == 0) +- return min((int)rlim.rlim_max / 2, 512); ++ return min(rlim.rlim_max / 2, (rlim_t)512); + + return 512; + } diff --git a/queue-5.10/series b/queue-5.10/series index d05db1bbfea..80d3ee47bb2 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -108,3 +108,22 @@ revert-net-tipc-fix-a-double-free-in-tipc_sk_mcast_rcv.patch tipc-wait-and-exit-until-all-work-queues-are-done.patch tipc-skb_linearize-the-head-skb-when-reassembling-msgs.patch spi-spi-fsl-dspi-fix-a-resource-leak-in-an-error-handling-path.patch +netfilter-flowtable-remove-redundant-hw-refresh-bit.patch +net-dsa-mt7530-fix-vlan-traffic-leaks.patch +net-dsa-fix-a-crash-if-get_sset_count-fails.patch +net-dsa-sja1105-update-existing-vlans-from-the-bridge-vlan-list.patch +net-dsa-sja1105-use-4095-as-the-private-vlan-for-untagged-traffic.patch +net-dsa-sja1105-error-out-on-unsupported-phy-mode.patch +net-dsa-sja1105-add-error-handling-in-sja1105_setup.patch +net-dsa-sja1105-call-dsa_unregister_switch-when-allocating-memory-fails.patch +net-dsa-sja1105-fix-vl-lookup-command-packing-for-p-q-r-s.patch +i2c-s3c2410-fix-possible-null-pointer-deref-on-read-message-after-write.patch +i2c-mediatek-disable-i2c-start_en-and-clear-intr_stat-brfore-reset.patch +i2c-i801-don-t-generate-an-interrupt-on-bus-reset.patch +i2c-sh_mobile-use-new-clock-calculation-formulas-for-rz-g2e.patch +afs-fix-the-nlink-handling-of-dir-over-dir-rename.patch +perf-jevents-fix-getting-maximum-number-of-fds.patch +nvmet-tcp-fix-inline-data-size-comparison-in-nvmet_tcp_queue_response.patch +mptcp-avoid-error-message-on-infinite-mapping.patch +mptcp-drop-unconditional-pr_warn-on-bad-opt.patch +mptcp-fix-data-stream-corruption.patch