From: Sasha Levin Date: Mon, 15 Feb 2021 04:28:15 +0000 (-0500) Subject: Fixes for 5.4 X-Git-Tag: v5.4.99~29 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1cebda9890888a5062ce4bfbf0072c0cee1f1864;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/bpf-check-for-integer-overflow-when-using-roundup_po.patch b/queue-5.4/bpf-check-for-integer-overflow-when-using-roundup_po.patch new file mode 100644 index 00000000000..453045024e7 --- /dev/null +++ b/queue-5.4/bpf-check-for-integer-overflow-when-using-roundup_po.patch @@ -0,0 +1,37 @@ +From b3da9a4f301f9a7ed426799a4c16bcdf0d19c677 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Jan 2021 06:36:53 +0000 +Subject: bpf: Check for integer overflow when using roundup_pow_of_two() + +From: Bui Quang Minh + +[ Upstream commit 6183f4d3a0a2ad230511987c6c362ca43ec0055f ] + +On 32-bit architecture, roundup_pow_of_two() can return 0 when the argument +has upper most bit set due to resulting 1UL << 32. Add a check for this case. + +Fixes: d5a3b1f69186 ("bpf: introduce BPF_MAP_TYPE_STACK_TRACE") +Signed-off-by: Bui Quang Minh +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20210127063653.3576-1-minhquangbui99@gmail.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/stackmap.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c +index 173e983619d77..fba2ade28fb3a 100644 +--- a/kernel/bpf/stackmap.c ++++ b/kernel/bpf/stackmap.c +@@ -112,6 +112,8 @@ static struct bpf_map *stack_map_alloc(union bpf_attr *attr) + + /* hash table size must be power of 2 */ + n_buckets = roundup_pow_of_two(attr->max_entries); ++ if (!n_buckets) ++ return ERR_PTR(-E2BIG); + + cost = n_buckets * sizeof(struct stack_map_bucket *) + sizeof(*smap); + cost += n_buckets * (value_size + sizeof(struct stack_map_bucket)); +-- +2.27.0 + diff --git a/queue-5.4/cgroup-v1-add-disabled-controller-check-in-cgroup1_p.patch b/queue-5.4/cgroup-v1-add-disabled-controller-check-in-cgroup1_p.patch new file mode 100644 index 00000000000..01255e025bd --- /dev/null +++ b/queue-5.4/cgroup-v1-add-disabled-controller-check-in-cgroup1_p.patch @@ -0,0 +1,50 @@ +From 85fb22459cd84a3cee1a1d36a32ba119f7b1c5e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jan 2021 17:37:17 +0800 +Subject: cgroup-v1: add disabled controller check in cgroup1_parse_param() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chen Zhou + +[ Upstream commit 61e960b07b637f0295308ad91268501d744c21b5 ] + +When mounting a cgroup hierarchy with disabled controller in cgroup v1, +all available controllers will be attached. +For example, boot with cgroup_no_v1=cpu or cgroup_disable=cpu, and then +mount with "mount -t cgroup -ocpu cpu /sys/fs/cgroup/cpu", then all +enabled controllers will be attached except cpu. + +Fix this by adding disabled controller check in cgroup1_parse_param(). +If the specified controller is disabled, just return error with information +"Disabled controller xx" rather than attaching all the other enabled +controllers. + +Fixes: f5dfb5315d34 ("cgroup: take options parsing into ->parse_monolithic()") +Signed-off-by: Chen Zhou +Reviewed-by: Zefan Li +Reviewed-by: Michal Koutný +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/cgroup/cgroup-v1.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c +index 79682c23407c9..ebe541f46fe95 100644 +--- a/kernel/cgroup/cgroup-v1.c ++++ b/kernel/cgroup/cgroup-v1.c +@@ -923,6 +923,9 @@ int cgroup1_parse_param(struct fs_context *fc, struct fs_parameter *param) + for_each_subsys(ss, i) { + if (strcmp(param->key, ss->legacy_name)) + continue; ++ if (!cgroup_ssid_enabled(i) || cgroup1_ssid_disabled(i)) ++ return invalfc(fc, "Disabled controller '%s'", ++ param->key); + ctx->subsys_mask |= (1 << i); + return 0; + } +-- +2.27.0 + diff --git a/queue-5.4/clk-sunxi-ng-mp-fix-parent-rate-change-flag-check.patch b/queue-5.4/clk-sunxi-ng-mp-fix-parent-rate-change-flag-check.patch new file mode 100644 index 00000000000..f761a421dad --- /dev/null +++ b/queue-5.4/clk-sunxi-ng-mp-fix-parent-rate-change-flag-check.patch @@ -0,0 +1,40 @@ +From 3126e6c769af1867f75706d5c969b909b12daa76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Feb 2021 18:58:56 +0100 +Subject: clk: sunxi-ng: mp: fix parent rate change flag check + +From: Jernej Skrabec + +[ Upstream commit 245090ab2636c0869527ce563afbfb8aff29e825 ] + +CLK_SET_RATE_PARENT flag is checked on parent clock instead of current +one. Fix that. + +Fixes: 3f790433c3cb ("clk: sunxi-ng: Adjust MP clock parent rate when allowed") +Reviewed-by: Chen-Yu Tsai +Tested-by: Andre Heider +Signed-off-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20210209175900.7092-2-jernej.skrabec@siol.net +Acked-by: Maxime Ripard +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/sunxi-ng/ccu_mp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/sunxi-ng/ccu_mp.c b/drivers/clk/sunxi-ng/ccu_mp.c +index fa4ecb9155909..9d3a76604d94c 100644 +--- a/drivers/clk/sunxi-ng/ccu_mp.c ++++ b/drivers/clk/sunxi-ng/ccu_mp.c +@@ -108,7 +108,7 @@ static unsigned long ccu_mp_round_rate(struct ccu_mux_internal *mux, + max_m = cmp->m.max ?: 1 << cmp->m.width; + max_p = cmp->p.max ?: 1 << ((1 << cmp->p.width) - 1); + +- if (!(clk_hw_get_flags(hw) & CLK_SET_RATE_PARENT)) { ++ if (!clk_hw_can_set_rate_parent(&cmp->common.hw)) { + ccu_mp_find_best(*parent_rate, rate, max_m, max_p, &m, &p); + rate = *parent_rate / p / m; + } else { +-- +2.27.0 + diff --git a/queue-5.4/drm-sun4i-dw-hdmi-fix-max.-frequency-for-h6.patch b/queue-5.4/drm-sun4i-dw-hdmi-fix-max.-frequency-for-h6.patch new file mode 100644 index 00000000000..af0e3c9ad83 --- /dev/null +++ b/queue-5.4/drm-sun4i-dw-hdmi-fix-max.-frequency-for-h6.patch @@ -0,0 +1,48 @@ +From 146a46e2e5a1fca73684059606b5967a14fcc6b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Feb 2021 18:59:00 +0100 +Subject: drm/sun4i: dw-hdmi: Fix max. frequency for H6 + +From: Jernej Skrabec + +[ Upstream commit 1926a0508d8947cf081280d85ff035300dc71da7 ] + +It turns out that reasoning for lowering max. supported frequency is +wrong. Scrambling works just fine. Several now fixed bugs prevented +proper functioning, even with rates lower than 340 MHz. Issues were just +more pronounced with higher frequencies. + +Fix that by allowing max. supported frequency in HW and fix the comment. + +Fixes: cd9063757a22 ("drm/sun4i: DW HDMI: Lower max. supported rate for H6") +Reviewed-by: Chen-Yu Tsai +Tested-by: Andre Heider +Signed-off-by: Jernej Skrabec +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20210209175900.7092-6-jernej.skrabec@siol.net +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c +index 12fe241956213..8f721be26477b 100644 +--- a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c ++++ b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c +@@ -49,11 +49,9 @@ sun8i_dw_hdmi_mode_valid_h6(struct drm_connector *connector, + { + /* + * Controller support maximum of 594 MHz, which correlates to +- * 4K@60Hz 4:4:4 or RGB. However, for frequencies greater than +- * 340 MHz scrambling has to be enabled. Because scrambling is +- * not yet implemented, just limit to 340 MHz for now. ++ * 4K@60Hz 4:4:4 or RGB. + */ +- if (mode->clock > 340000) ++ if (mode->clock > 594000) + return MODE_CLOCK_HIGH; + + return MODE_OK; +-- +2.27.0 + diff --git a/queue-5.4/drm-sun4i-fix-h6-hdmi-phy-configuration.patch b/queue-5.4/drm-sun4i-fix-h6-hdmi-phy-configuration.patch new file mode 100644 index 00000000000..02cbb61bda8 --- /dev/null +++ b/queue-5.4/drm-sun4i-fix-h6-hdmi-phy-configuration.patch @@ -0,0 +1,79 @@ +From 1b6ecca60cbf12646e7abd0fe51baf0ce3ce698a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Feb 2021 18:58:59 +0100 +Subject: drm/sun4i: Fix H6 HDMI PHY configuration + +From: Jernej Skrabec + +[ Upstream commit 6a155216c48f2f65c8dcb02c4c27549c170d24a9 ] + +As it turns out, vendor HDMI PHY driver for H6 has a pretty big table +of predefined values for various pixel clocks. However, most of them are +not useful/tested because they come from reference driver code. Vendor +PHY driver is concerned with only few of those, namely 27 MHz, 74.25 +MHz, 148.5 MHz, 297 MHz and 594 MHz. These are all frequencies for +standard CEA modes. + +Fix sun50i_h6_cur_ctr and sun50i_h6_phy_config with the values only for +aforementioned frequencies. + +Table sun50i_h6_mpll_cfg doesn't need to be changed because values are +actually frequency dependent and not so much SoC dependent. See i.MX6 +documentation for explanation of those values for similar PHY. + +Fixes: c71c9b2fee17 ("drm/sun4i: Add support for Synopsys HDMI PHY") +Tested-by: Andre Heider +Signed-off-by: Jernej Skrabec +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20210209175900.7092-5-jernej.skrabec@siol.net +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c | 26 +++++++++----------------- + 1 file changed, 9 insertions(+), 17 deletions(-) + +diff --git a/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c b/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c +index 43643ad317306..a4012ec13d4b3 100644 +--- a/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c ++++ b/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c +@@ -104,29 +104,21 @@ static const struct dw_hdmi_mpll_config sun50i_h6_mpll_cfg[] = { + + static const struct dw_hdmi_curr_ctrl sun50i_h6_cur_ctr[] = { + /* pixelclk bpp8 bpp10 bpp12 */ +- { 25175000, { 0x0000, 0x0000, 0x0000 }, }, + { 27000000, { 0x0012, 0x0000, 0x0000 }, }, +- { 59400000, { 0x0008, 0x0008, 0x0008 }, }, +- { 72000000, { 0x0008, 0x0008, 0x001b }, }, +- { 74250000, { 0x0013, 0x0013, 0x0013 }, }, +- { 90000000, { 0x0008, 0x001a, 0x001b }, }, +- { 118800000, { 0x001b, 0x001a, 0x001b }, }, +- { 144000000, { 0x001b, 0x001a, 0x0034 }, }, +- { 180000000, { 0x001b, 0x0033, 0x0034 }, }, +- { 216000000, { 0x0036, 0x0033, 0x0034 }, }, +- { 237600000, { 0x0036, 0x0033, 0x001b }, }, +- { 288000000, { 0x0036, 0x001b, 0x001b }, }, +- { 297000000, { 0x0019, 0x001b, 0x0019 }, }, +- { 330000000, { 0x0036, 0x001b, 0x001b }, }, +- { 594000000, { 0x003f, 0x001b, 0x001b }, }, ++ { 74250000, { 0x0013, 0x001a, 0x001b }, }, ++ { 148500000, { 0x0019, 0x0033, 0x0034 }, }, ++ { 297000000, { 0x0019, 0x001b, 0x001b }, }, ++ { 594000000, { 0x0010, 0x001b, 0x001b }, }, + { ~0UL, { 0x0000, 0x0000, 0x0000 }, } + }; + + static const struct dw_hdmi_phy_config sun50i_h6_phy_config[] = { + /*pixelclk symbol term vlev*/ +- { 74250000, 0x8009, 0x0004, 0x0232}, +- { 148500000, 0x8029, 0x0004, 0x0273}, +- { 594000000, 0x8039, 0x0004, 0x014a}, ++ { 27000000, 0x8009, 0x0007, 0x02b0 }, ++ { 74250000, 0x8009, 0x0006, 0x022d }, ++ { 148500000, 0x8029, 0x0006, 0x0270 }, ++ { 297000000, 0x8039, 0x0005, 0x01ab }, ++ { 594000000, 0x8029, 0x0000, 0x008a }, + { ~0UL, 0x0000, 0x0000, 0x0000} + }; + +-- +2.27.0 + diff --git a/queue-5.4/drm-sun4i-tcon-set-sync-polarity-for-tcon1-channel.patch b/queue-5.4/drm-sun4i-tcon-set-sync-polarity-for-tcon1-channel.patch new file mode 100644 index 00000000000..74fc789db6b --- /dev/null +++ b/queue-5.4/drm-sun4i-tcon-set-sync-polarity-for-tcon1-channel.patch @@ -0,0 +1,102 @@ +From 403f81cada6b60ebc97cfea79ad7c7eade006272 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Feb 2021 18:58:57 +0100 +Subject: drm/sun4i: tcon: set sync polarity for tcon1 channel + +From: Jernej Skrabec + +[ Upstream commit 50791f5d7b6a14b388f46c8885f71d1b98216d1d ] + +Channel 1 has polarity bits for vsync and hsync signals but driver never +sets them. It turns out that with pre-HDMI2 controllers seemingly there +is no issue if polarity is not set. However, with HDMI2 controllers +(H6) there often comes to de-synchronization due to phase shift. This +causes flickering screen. It's safe to assume that similar issues might +happen also with pre-HDMI2 controllers. + +Solve issue with setting vsync and hsync polarity. Note that display +stacks with tcon top have polarity bits actually in tcon0 polarity +register. + +Fixes: 9026e0d122ac ("drm: Add Allwinner A10 Display Engine support") +Reviewed-by: Chen-Yu Tsai +Tested-by: Andre Heider +Signed-off-by: Jernej Skrabec +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20210209175900.7092-3-jernej.skrabec@siol.net +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sun4i/sun4i_tcon.c | 25 +++++++++++++++++++++++++ + drivers/gpu/drm/sun4i/sun4i_tcon.h | 6 ++++++ + 2 files changed, 31 insertions(+) + +diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c +index ae7ae432aa4ab..6bf1425e8b0ca 100644 +--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c ++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c +@@ -665,6 +665,30 @@ static void sun4i_tcon1_mode_set(struct sun4i_tcon *tcon, + SUN4I_TCON1_BASIC5_V_SYNC(vsync) | + SUN4I_TCON1_BASIC5_H_SYNC(hsync)); + ++ /* Setup the polarity of multiple signals */ ++ if (tcon->quirks->polarity_in_ch0) { ++ val = 0; ++ ++ if (mode->flags & DRM_MODE_FLAG_PHSYNC) ++ val |= SUN4I_TCON0_IO_POL_HSYNC_POSITIVE; ++ ++ if (mode->flags & DRM_MODE_FLAG_PVSYNC) ++ val |= SUN4I_TCON0_IO_POL_VSYNC_POSITIVE; ++ ++ regmap_write(tcon->regs, SUN4I_TCON0_IO_POL_REG, val); ++ } else { ++ /* according to vendor driver, this bit must be always set */ ++ val = SUN4I_TCON1_IO_POL_UNKNOWN; ++ ++ if (mode->flags & DRM_MODE_FLAG_PHSYNC) ++ val |= SUN4I_TCON1_IO_POL_HSYNC_POSITIVE; ++ ++ if (mode->flags & DRM_MODE_FLAG_PVSYNC) ++ val |= SUN4I_TCON1_IO_POL_VSYNC_POSITIVE; ++ ++ regmap_write(tcon->regs, SUN4I_TCON1_IO_POL_REG, val); ++ } ++ + /* Map output pins to channel 1 */ + regmap_update_bits(tcon->regs, SUN4I_TCON_GCTL_REG, + SUN4I_TCON_GCTL_IOMAP_MASK, +@@ -1482,6 +1506,7 @@ static const struct sun4i_tcon_quirks sun8i_a83t_tv_quirks = { + + static const struct sun4i_tcon_quirks sun8i_r40_tv_quirks = { + .has_channel_1 = true, ++ .polarity_in_ch0 = true, + .set_mux = sun8i_r40_tcon_tv_set_mux, + }; + +diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.h b/drivers/gpu/drm/sun4i/sun4i_tcon.h +index a62ec826ae71e..5bdbaf0847824 100644 +--- a/drivers/gpu/drm/sun4i/sun4i_tcon.h ++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.h +@@ -153,6 +153,11 @@ + #define SUN4I_TCON1_BASIC5_V_SYNC(height) (((height) - 1) & 0x3ff) + + #define SUN4I_TCON1_IO_POL_REG 0xf0 ++/* there is no documentation about this bit */ ++#define SUN4I_TCON1_IO_POL_UNKNOWN BIT(26) ++#define SUN4I_TCON1_IO_POL_HSYNC_POSITIVE BIT(25) ++#define SUN4I_TCON1_IO_POL_VSYNC_POSITIVE BIT(24) ++ + #define SUN4I_TCON1_IO_TRI_REG 0xf4 + + #define SUN4I_TCON_ECC_FIFO_REG 0xf8 +@@ -224,6 +229,7 @@ struct sun4i_tcon_quirks { + bool needs_de_be_mux; /* sun6i needs mux to select backend */ + bool needs_edp_reset; /* a80 edp reset needed for tcon0 access */ + bool supports_lvds; /* Does the TCON support an LVDS output? */ ++ bool polarity_in_ch0; /* some tcon1 channels have polarity bits in tcon0 pol register */ + u8 dclk_min_div; /* minimum divider for TCON0 DCLK */ + + /* callback to handle tcon muxing options */ +-- +2.27.0 + diff --git a/queue-5.4/drm-vc4-hvs-fix-buffer-overflow-with-the-dlist-handl.patch b/queue-5.4/drm-vc4-hvs-fix-buffer-overflow-with-the-dlist-handl.patch new file mode 100644 index 00000000000..ec79d34415b --- /dev/null +++ b/queue-5.4/drm-vc4-hvs-fix-buffer-overflow-with-the-dlist-handl.patch @@ -0,0 +1,81 @@ +From 90361b637019650a394f057901d7e9f54f2a6801 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Jan 2021 17:06:47 +0100 +Subject: drm/vc4: hvs: Fix buffer overflow with the dlist handling + +From: Maxime Ripard + +[ Upstream commit facd93f4285c405f9a91b05166147cb39e860666 ] + +Commit 0a038c1c29a7 ("drm/vc4: Move LBM creation out of +vc4_plane_mode_set()") changed the LBM allocation logic from first +allocating the LBM memory for the plane to running mode_set, +adding a gap in the LBM, and then running the dlist allocation filling +that gap. + +The gap was introduced by incrementing the dlist array index, but was +never checking whether or not we were over the array length, leading +eventually to memory corruptions if we ever crossed this limit. + +vc4_dlist_write had that logic though, and was reallocating a larger +dlist array when reaching the end of the buffer. Let's share the logic +between both functions. + +Cc: Boris Brezillon +Cc: Eric Anholt +Fixes: 0a038c1c29a7 ("drm/vc4: Move LBM creation out of vc4_plane_mode_set()") +Signed-off-by: Maxime Ripard +Acked-by: Thomas Zimmermann +Reviewed-by: Dave Stevenson +Link: https://patchwork.freedesktop.org/patch/msgid/20210129160647.128373-1-maxime@cerno.tech +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_plane.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c +index 5e5f90810acaf..363f456ea7134 100644 +--- a/drivers/gpu/drm/vc4/vc4_plane.c ++++ b/drivers/gpu/drm/vc4/vc4_plane.c +@@ -205,7 +205,7 @@ static void vc4_plane_reset(struct drm_plane *plane) + __drm_atomic_helper_plane_reset(plane, &vc4_state->base); + } + +-static void vc4_dlist_write(struct vc4_plane_state *vc4_state, u32 val) ++static void vc4_dlist_counter_increment(struct vc4_plane_state *vc4_state) + { + if (vc4_state->dlist_count == vc4_state->dlist_size) { + u32 new_size = max(4u, vc4_state->dlist_count * 2); +@@ -220,7 +220,15 @@ static void vc4_dlist_write(struct vc4_plane_state *vc4_state, u32 val) + vc4_state->dlist_size = new_size; + } + +- vc4_state->dlist[vc4_state->dlist_count++] = val; ++ vc4_state->dlist_count++; ++} ++ ++static void vc4_dlist_write(struct vc4_plane_state *vc4_state, u32 val) ++{ ++ unsigned int idx = vc4_state->dlist_count; ++ ++ vc4_dlist_counter_increment(vc4_state); ++ vc4_state->dlist[idx] = val; + } + + /* Returns the scl0/scl1 field based on whether the dimensions need to +@@ -871,8 +879,10 @@ static int vc4_plane_mode_set(struct drm_plane *plane, + * be set when calling vc4_plane_allocate_lbm(). + */ + if (vc4_state->y_scaling[0] != VC4_SCALING_NONE || +- vc4_state->y_scaling[1] != VC4_SCALING_NONE) +- vc4_state->lbm_offset = vc4_state->dlist_count++; ++ vc4_state->y_scaling[1] != VC4_SCALING_NONE) { ++ vc4_state->lbm_offset = vc4_state->dlist_count; ++ vc4_dlist_counter_increment(vc4_state); ++ } + + if (num_planes > 1) { + /* Emit Cb/Cr as channel 0 and Y as channel +-- +2.27.0 + diff --git a/queue-5.4/firmware_loader-align-.builtin_fw-to-8.patch b/queue-5.4/firmware_loader-align-.builtin_fw-to-8.patch new file mode 100644 index 00000000000..7de5ac71638 --- /dev/null +++ b/queue-5.4/firmware_loader-align-.builtin_fw-to-8.patch @@ -0,0 +1,54 @@ +From f672e65d207c4790020fd696f27823886789a41c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Feb 2021 13:42:07 -0800 +Subject: firmware_loader: align .builtin_fw to 8 + +From: Fangrui Song + +[ Upstream commit 793f49a87aae24e5bcf92ad98d764153fc936570 ] + +arm64 references the start address of .builtin_fw (__start_builtin_fw) +with a pair of R_AARCH64_ADR_PREL_PG_HI21/R_AARCH64_LDST64_ABS_LO12_NC +relocations. The compiler is allowed to emit the +R_AARCH64_LDST64_ABS_LO12_NC relocation because struct builtin_fw in +include/linux/firmware.h is 8-byte aligned. + +The R_AARCH64_LDST64_ABS_LO12_NC relocation requires the address to be a +multiple of 8, which may not be the case if .builtin_fw is empty. +Unconditionally align .builtin_fw to fix the linker error. 32-bit +architectures could use ALIGN(4) but that would add unnecessary +complexity, so just use ALIGN(8). + +Link: https://lkml.kernel.org/r/20201208054646.2913063-1-maskray@google.com +Link: https://github.com/ClangBuiltLinux/linux/issues/1204 +Fixes: 5658c76 ("firmware: allow firmware files to be built into kernel image") +Signed-off-by: Fangrui Song +Reported-by: kernel test robot +Acked-by: Arnd Bergmann +Reviewed-by: Nick Desaulniers +Tested-by: Nick Desaulniers +Tested-by: Douglas Anderson +Acked-by: Nathan Chancellor +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + include/asm-generic/vmlinux.lds.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h +index 9a4a5a43e8867..2267b7c763c64 100644 +--- a/include/asm-generic/vmlinux.lds.h ++++ b/include/asm-generic/vmlinux.lds.h +@@ -396,7 +396,7 @@ + } \ + \ + /* Built-in firmware blobs */ \ +- .builtin_fw : AT(ADDR(.builtin_fw) - LOAD_OFFSET) { \ ++ .builtin_fw : AT(ADDR(.builtin_fw) - LOAD_OFFSET) ALIGN(8) { \ + __start_builtin_fw = .; \ + KEEP(*(.builtin_fw)) \ + __end_builtin_fw = .; \ +-- +2.27.0 + diff --git a/queue-5.4/h8300-fix-preemption-build-ti_pre_count-undefined.patch b/queue-5.4/h8300-fix-preemption-build-ti_pre_count-undefined.patch new file mode 100644 index 00000000000..7c24cc8609f --- /dev/null +++ b/queue-5.4/h8300-fix-preemption-build-ti_pre_count-undefined.patch @@ -0,0 +1,44 @@ +From 72cf0d8c01acc7aa359dae193ac04980479036f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Feb 2021 20:52:54 -0800 +Subject: h8300: fix PREEMPTION build, TI_PRE_COUNT undefined + +From: Randy Dunlap + +[ Upstream commit ade9679c159d5bbe14fb7e59e97daf6062872e2b ] + +Fix a build error for undefined 'TI_PRE_COUNT' by adding it to +asm-offsets.c. + + h8300-linux-ld: arch/h8300/kernel/entry.o: in function `resume_kernel': (.text+0x29a): undefined reference to `TI_PRE_COUNT' + +Link: https://lkml.kernel.org/r/20210212021650.22740-1-rdunlap@infradead.org +Fixes: df2078b8daa7 ("h8300: Low level entry") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Cc: Yoshinori Sato +Cc: Thomas Gleixner +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + arch/h8300/kernel/asm-offsets.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/h8300/kernel/asm-offsets.c b/arch/h8300/kernel/asm-offsets.c +index 85e60509f0a83..d4b53af657c84 100644 +--- a/arch/h8300/kernel/asm-offsets.c ++++ b/arch/h8300/kernel/asm-offsets.c +@@ -63,6 +63,9 @@ int main(void) + OFFSET(TI_FLAGS, thread_info, flags); + OFFSET(TI_CPU, thread_info, cpu); + OFFSET(TI_PRE, thread_info, preempt_count); ++#ifdef CONFIG_PREEMPTION ++ DEFINE(TI_PRE_COUNT, offsetof(struct thread_info, preempt_count)); ++#endif + + return 0; + } +-- +2.27.0 + diff --git a/queue-5.4/i2c-stm32f7-fix-configuration-of-the-digital-filter.patch b/queue-5.4/i2c-stm32f7-fix-configuration-of-the-digital-filter.patch new file mode 100644 index 00000000000..eaa99830af6 --- /dev/null +++ b/queue-5.4/i2c-stm32f7-fix-configuration-of-the-digital-filter.patch @@ -0,0 +1,62 @@ +From a31be2b529e266ed0c5f8b4a93cc836f1cd93ff9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Feb 2021 09:51:40 +0100 +Subject: i2c: stm32f7: fix configuration of the digital filter + +From: Alain Volmat + +[ Upstream commit 3d6a3d3a2a7a3a60a824e7c04e95fd50dec57812 ] + +The digital filter related computation are present in the driver +however the programming of the filter within the IP is missing. +The maximum value for the DNF is wrong and should be 15 instead of 16. + +Fixes: aeb068c57214 ("i2c: i2c-stm32f7: add driver") + +Signed-off-by: Alain Volmat +Signed-off-by: Pierre-Yves MORDRET +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-stm32f7.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c +index b2634afe066d3..a7977eef2ead5 100644 +--- a/drivers/i2c/busses/i2c-stm32f7.c ++++ b/drivers/i2c/busses/i2c-stm32f7.c +@@ -53,6 +53,8 @@ + #define STM32F7_I2C_CR1_RXDMAEN BIT(15) + #define STM32F7_I2C_CR1_TXDMAEN BIT(14) + #define STM32F7_I2C_CR1_ANFOFF BIT(12) ++#define STM32F7_I2C_CR1_DNF_MASK GENMASK(11, 8) ++#define STM32F7_I2C_CR1_DNF(n) (((n) & 0xf) << 8) + #define STM32F7_I2C_CR1_ERRIE BIT(7) + #define STM32F7_I2C_CR1_TCIE BIT(6) + #define STM32F7_I2C_CR1_STOPIE BIT(5) +@@ -151,7 +153,7 @@ + #define STM32F7_I2C_MAX_SLAVE 0x2 + + #define STM32F7_I2C_DNF_DEFAULT 0 +-#define STM32F7_I2C_DNF_MAX 16 ++#define STM32F7_I2C_DNF_MAX 15 + + #define STM32F7_I2C_ANALOG_FILTER_ENABLE 1 + #define STM32F7_I2C_ANALOG_FILTER_DELAY_MIN 50 /* ns */ +@@ -657,6 +659,13 @@ static void stm32f7_i2c_hw_config(struct stm32f7_i2c_dev *i2c_dev) + else + stm32f7_i2c_set_bits(i2c_dev->base + STM32F7_I2C_CR1, + STM32F7_I2C_CR1_ANFOFF); ++ ++ /* Program the Digital Filter */ ++ stm32f7_i2c_clr_bits(i2c_dev->base + STM32F7_I2C_CR1, ++ STM32F7_I2C_CR1_DNF_MASK); ++ stm32f7_i2c_set_bits(i2c_dev->base + STM32F7_I2C_CR1, ++ STM32F7_I2C_CR1_DNF(i2c_dev->setup.dnf)); ++ + stm32f7_i2c_set_bits(i2c_dev->base + STM32F7_I2C_CR1, + STM32F7_I2C_CR1_PE); + } +-- +2.27.0 + diff --git a/queue-5.4/ibmvnic-clear-failover_pending-if-unable-to-schedule.patch b/queue-5.4/ibmvnic-clear-failover_pending-if-unable-to-schedule.patch new file mode 100644 index 00000000000..3eda31799d3 --- /dev/null +++ b/queue-5.4/ibmvnic-clear-failover_pending-if-unable-to-schedule.patch @@ -0,0 +1,57 @@ +From 60562e04528b6585a266b81d0743e9a8dbce3ff9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Feb 2021 21:08:02 -0800 +Subject: ibmvnic: Clear failover_pending if unable to schedule + +From: Sukadev Bhattiprolu + +[ Upstream commit ef66a1eace968ff22a35f45e6e8ec36b668b6116 ] + +Normally we clear the failover_pending flag when processing the reset. +But if we are unable to schedule a failover reset we must clear the +flag ourselves. We could fail to schedule the reset if we are in PROBING +state (eg: when booting via kexec) or because we could not allocate memory. + +Thanks to Cris Forno for helping isolate the problem and for testing. + +Fixes: 1d8504937478 ("powerpc/vnic: Extend "failover pending" window") +Signed-off-by: Sukadev Bhattiprolu +Tested-by: Cristobal Forno +Link: https://lore.kernel.org/r/20210203050802.680772-1-sukadev@linux.ibm.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index c3079f436f6d7..0f35eec967ae8 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -4595,7 +4595,22 @@ static void ibmvnic_handle_crq(union ibmvnic_crq *crq, + complete(&adapter->init_done); + adapter->init_done_rc = -EIO; + } +- ibmvnic_reset(adapter, VNIC_RESET_FAILOVER); ++ rc = ibmvnic_reset(adapter, VNIC_RESET_FAILOVER); ++ if (rc && rc != -EBUSY) { ++ /* We were unable to schedule the failover ++ * reset either because the adapter was still ++ * probing (eg: during kexec) or we could not ++ * allocate memory. Clear the failover_pending ++ * flag since no one else will. We ignore ++ * EBUSY because it means either FAILOVER reset ++ * is already scheduled or the adapter is ++ * being removed. ++ */ ++ netdev_err(netdev, ++ "Error %ld scheduling failover reset\n", ++ rc); ++ adapter->failover_pending = false; ++ } + break; + case IBMVNIC_CRQ_INIT_COMPLETE: + dev_info(dev, "Partner initialization complete\n"); +-- +2.27.0 + diff --git a/queue-5.4/mt76-dma-fix-a-possible-memory-leak-in-mt76_add_frag.patch b/queue-5.4/mt76-dma-fix-a-possible-memory-leak-in-mt76_add_frag.patch new file mode 100644 index 00000000000..354a950aa43 --- /dev/null +++ b/queue-5.4/mt76-dma-fix-a-possible-memory-leak-in-mt76_add_frag.patch @@ -0,0 +1,51 @@ +From dc9c03690122553217879d16ba56934e392b5df5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Jan 2021 12:02:13 +0100 +Subject: mt76: dma: fix a possible memory leak in mt76_add_fragment() + +From: Lorenzo Bianconi + +[ Upstream commit 93a1d4791c10d443bc67044def7efee2991d48b7 ] + +Fix a memory leak in mt76_add_fragment routine returning the buffer +to the page_frag_cache when we receive a new fragment and the +skb_shared_info frag array is full. + +Fixes: b102f0c522cf6 ("mt76: fix array overflow on receiving too many fragments for a packet") +Signed-off-by: Lorenzo Bianconi +Acked-by: Felix Fietkau +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/4f9dd73407da88b2a552517ce8db242d86bf4d5c.1611616130.git.lorenzo@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/dma.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c +index 026d996612fbe..781952b686ed2 100644 +--- a/drivers/net/wireless/mediatek/mt76/dma.c ++++ b/drivers/net/wireless/mediatek/mt76/dma.c +@@ -452,15 +452,17 @@ static void + mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data, + int len, bool more) + { +- struct page *page = virt_to_head_page(data); +- int offset = data - page_address(page); + struct sk_buff *skb = q->rx_head; + struct skb_shared_info *shinfo = skb_shinfo(skb); + + if (shinfo->nr_frags < ARRAY_SIZE(shinfo->frags)) { +- offset += q->buf_offset; ++ struct page *page = virt_to_head_page(data); ++ int offset = data - page_address(page) + q->buf_offset; ++ + skb_add_rx_frag(skb, shinfo->nr_frags, page, offset, len, + q->buf_size); ++ } else { ++ skb_free_frag(data); + } + + if (more) +-- +2.27.0 + diff --git a/queue-5.4/net-enetc-initialize-the-rfs-and-rss-memories.patch b/queue-5.4/net-enetc-initialize-the-rfs-and-rss-memories.patch new file mode 100644 index 00000000000..d59d55050e8 --- /dev/null +++ b/queue-5.4/net-enetc-initialize-the-rfs-and-rss-memories.patch @@ -0,0 +1,162 @@ +From a94a9f7ac90d7c37c99635fc366db67419fb440b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Feb 2021 15:45:11 +0200 +Subject: net: enetc: initialize the RFS and RSS memories + +From: Vladimir Oltean + +[ Upstream commit 07bf34a50e327975b21a9dee64d220c3dcb72ee9 ] + +Michael tried to enable Advanced Error Reporting through the ENETC's +Root Complex Event Collector, and the system started spitting out single +bit correctable ECC errors coming from the ENETC interfaces: + +pcieport 0000:00:1f.0: AER: Multiple Corrected error received: 0000:00:00.0 +fsl_enetc 0000:00:00.0: PCIe Bus Error: severity=Corrected, type=Transaction Layer, (Receiver ID) +fsl_enetc 0000:00:00.0: device [1957:e100] error status/mask=00004000/00000000 +fsl_enetc 0000:00:00.0: [14] CorrIntErr +fsl_enetc 0000:00:00.1: PCIe Bus Error: severity=Corrected, type=Transaction Layer, (Receiver ID) +fsl_enetc 0000:00:00.1: device [1957:e100] error status/mask=00004000/00000000 +fsl_enetc 0000:00:00.1: [14] CorrIntErr + +Further investigating the port correctable memory error detect register +(PCMEDR) shows that these AER errors have an associated SOURCE_ID of 6 +(RFS/RSS): + +$ devmem 0x1f8010e10 32 +0xC0000006 +$ devmem 0x1f8050e10 32 +0xC0000006 + +Discussion with the hardware design engineers reveals that on LS1028A, +the hardware does not do initialization of that RFS/RSS memory, and that +software should clear/initialize the entire table before starting to +operate. That comes as a bit of a surprise, since the driver does not do +initialization of the RFS memory. Also, the initialization of the +Receive Side Scaling is done only partially. + +Even though the entire ENETC IP has a single shared flow steering +memory, the flow steering service should returns matches only for TCAM +entries that are within the range of the Station Interface that is doing +the search. Therefore, it should be sufficient for a Station Interface +to initialize all of its own entries in order to avoid any ECC errors, +and only the Station Interfaces in use should need initialization. + +There are Physical Station Interfaces associated with PCIe PFs and +Virtual Station Interfaces associated with PCIe VFs. We let the PF +driver initialize the entire port's memory, which includes the RFS +entries which are going to be used by the VF. + +Reported-by: Michael Walle +Fixes: d4fd0404c1c9 ("enetc: Introduce basic PF and VF ENETC ethernet drivers") +Signed-off-by: Vladimir Oltean +Tested-by: Michael Walle +Reviewed-by: Jesse Brandeburg +Link: https://lore.kernel.org/r/20210204134511.2640309-1-vladimir.oltean@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/freescale/enetc/enetc_hw.h | 2 + + .../net/ethernet/freescale/enetc/enetc_pf.c | 59 +++++++++++++++++++ + 2 files changed, 61 insertions(+) + +diff --git a/drivers/net/ethernet/freescale/enetc/enetc_hw.h b/drivers/net/ethernet/freescale/enetc/enetc_hw.h +index 7428f62408a20..fac80831d5327 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc_hw.h ++++ b/drivers/net/ethernet/freescale/enetc/enetc_hw.h +@@ -181,6 +181,8 @@ enum enetc_bdr_type {TX, RX}; + #define ENETC_PTCCBSR0(n) (0x1110 + (n) * 8) /* n = 0 to 7*/ + #define ENETC_PTCCBSR1(n) (0x1114 + (n) * 8) /* n = 0 to 7*/ + #define ENETC_RSSHASH_KEY_SIZE 40 ++#define ENETC_PRSSCAPR 0x1404 ++#define ENETC_PRSSCAPR_GET_NUM_RSS(val) (BIT((val) & 0xf) * 32) + #define ENETC_PRSSK(n) (0x1410 + (n) * 4) /* n = [0..9] */ + #define ENETC_PSIVLANFMR 0x1700 + #define ENETC_PSIVLANFMR_VS BIT(0) +diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c +index 74847aa644f12..22f70638a4055 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c +@@ -809,6 +809,51 @@ static void enetc_of_put_phy(struct enetc_ndev_priv *priv) + of_node_put(priv->phy_node); + } + ++/* Initialize the entire shared memory for the flow steering entries ++ * of this port (PF + VFs) ++ */ ++static int enetc_init_port_rfs_memory(struct enetc_si *si) ++{ ++ struct enetc_cmd_rfse rfse = {0}; ++ struct enetc_hw *hw = &si->hw; ++ int num_rfs, i, err = 0; ++ u32 val; ++ ++ val = enetc_port_rd(hw, ENETC_PRFSCAPR); ++ num_rfs = ENETC_PRFSCAPR_GET_NUM_RFS(val); ++ ++ for (i = 0; i < num_rfs; i++) { ++ err = enetc_set_fs_entry(si, &rfse, i); ++ if (err) ++ break; ++ } ++ ++ return err; ++} ++ ++static int enetc_init_port_rss_memory(struct enetc_si *si) ++{ ++ struct enetc_hw *hw = &si->hw; ++ int num_rss, err; ++ int *rss_table; ++ u32 val; ++ ++ val = enetc_port_rd(hw, ENETC_PRSSCAPR); ++ num_rss = ENETC_PRSSCAPR_GET_NUM_RSS(val); ++ if (!num_rss) ++ return 0; ++ ++ rss_table = kcalloc(num_rss, sizeof(*rss_table), GFP_KERNEL); ++ if (!rss_table) ++ return -ENOMEM; ++ ++ err = enetc_set_rss_table(si, rss_table, num_rss); ++ ++ kfree(rss_table); ++ ++ return err; ++} ++ + static int enetc_pf_probe(struct pci_dev *pdev, + const struct pci_device_id *ent) + { +@@ -863,6 +908,18 @@ static int enetc_pf_probe(struct pci_dev *pdev, + goto err_alloc_si_res; + } + ++ err = enetc_init_port_rfs_memory(si); ++ if (err) { ++ dev_err(&pdev->dev, "Failed to initialize RFS memory\n"); ++ goto err_init_port_rfs; ++ } ++ ++ err = enetc_init_port_rss_memory(si); ++ if (err) { ++ dev_err(&pdev->dev, "Failed to initialize RSS memory\n"); ++ goto err_init_port_rss; ++ } ++ + err = enetc_alloc_msix(priv); + if (err) { + dev_err(&pdev->dev, "MSIX alloc failed\n"); +@@ -888,6 +945,8 @@ err_reg_netdev: + enetc_mdio_remove(pf); + enetc_of_put_phy(priv); + enetc_free_msix(priv); ++err_init_port_rss: ++err_init_port_rfs: + err_alloc_msix: + enetc_free_si_resources(priv); + err_alloc_si_res: +-- +2.27.0 + diff --git a/queue-5.4/net-hns3-add-a-check-for-queue_id-in-hclge_reset_vf_.patch b/queue-5.4/net-hns3-add-a-check-for-queue_id-in-hclge_reset_vf_.patch new file mode 100644 index 00000000000..a9e3ce532c3 --- /dev/null +++ b/queue-5.4/net-hns3-add-a-check-for-queue_id-in-hclge_reset_vf_.patch @@ -0,0 +1,49 @@ +From edba6f7dd462d4900262910bdb3bc01aa404316d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Feb 2021 17:03:05 +0800 +Subject: net: hns3: add a check for queue_id in hclge_reset_vf_queue() + +From: Yufeng Mo + +[ Upstream commit 67a69f84cab60484f02eb8cbc7a76edffbb28a25 ] + +The queue_id is received from vf, if use it directly, +an out-of-bound issue may be caused, so add a check for +this queue_id before using it in hclge_reset_vf_queue(). + +Fixes: 1a426f8b40fc ("net: hns3: fix the VF queue reset flow error") +Signed-off-by: Yufeng Mo +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index 6887b7fda6e07..08040cafc06bc 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -8563,12 +8563,19 @@ int hclge_reset_tqp(struct hnae3_handle *handle, u16 queue_id) + + void hclge_reset_vf_queue(struct hclge_vport *vport, u16 queue_id) + { ++ struct hnae3_handle *handle = &vport->nic; + struct hclge_dev *hdev = vport->back; + int reset_try_times = 0; + int reset_status; + u16 queue_gid; + int ret; + ++ if (queue_id >= handle->kinfo.num_tqps) { ++ dev_warn(&hdev->pdev->dev, "Invalid vf queue id(%u)\n", ++ queue_id); ++ return; ++ } ++ + queue_gid = hclge_covert_handle_qid_global(&vport->nic, queue_id); + + ret = hclge_send_reset_tqp_cmd(hdev, queue_gid, true); +-- +2.27.0 + diff --git a/queue-5.4/net-stmmac-set-txq-mode-back-to-dcb-after-disabling-.patch b/queue-5.4/net-stmmac-set-txq-mode-back-to-dcb-after-disabling-.patch new file mode 100644 index 00000000000..86a195bb589 --- /dev/null +++ b/queue-5.4/net-stmmac-set-txq-mode-back-to-dcb-after-disabling-.patch @@ -0,0 +1,52 @@ +From 05e542c854b6845988865fc9b593f039b43af175 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Feb 2021 22:03:16 +0800 +Subject: net: stmmac: set TxQ mode back to DCB after disabling CBS + +From: Mohammad Athari Bin Ismail + +[ Upstream commit f317e2ea8c88737aa36228167b2292baef3f0430 ] + +When disable CBS, mode_to_use parameter is not updated even the operation +mode of Tx Queue is changed to Data Centre Bridging (DCB). Therefore, +when tc_setup_cbs() function is called to re-enable CBS, the operation +mode of Tx Queue remains at DCB, which causing CBS fails to work. + +This patch updates the value of mode_to_use parameter to MTL_QUEUE_DCB +after operation mode of Tx Queue is changed to DCB in stmmac_dma_qmode() +callback function. + +Fixes: 1f705bc61aee ("net: stmmac: Add support for CBS QDISC") +Suggested-by: Vinicius Costa Gomes +Signed-off-by: Mohammad Athari Bin Ismail +Signed-off-by: Song, Yoong Siang +Reviewed-by: Jesse Brandeburg +Acked-by: Vinicius Costa Gomes +Link: https://lore.kernel.org/r/1612447396-20351-1-git-send-email-yoong.siang.song@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c +index 1d135b02ea021..52b453b605979 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c +@@ -332,7 +332,12 @@ static int tc_setup_cbs(struct stmmac_priv *priv, + + priv->plat->tx_queues_cfg[queue].mode_to_use = MTL_QUEUE_AVB; + } else if (!qopt->enable) { +- return stmmac_dma_qmode(priv, priv->ioaddr, queue, MTL_QUEUE_DCB); ++ ret = stmmac_dma_qmode(priv, priv->ioaddr, queue, ++ MTL_QUEUE_DCB); ++ if (ret) ++ return ret; ++ ++ priv->plat->tx_queues_cfg[queue].mode_to_use = MTL_QUEUE_DCB; + } + + /* Port Transmit Rate and Speed Divider */ +-- +2.27.0 + diff --git a/queue-5.4/netfilter-conntrack-skip-identical-origin-tuple-in-s.patch b/queue-5.4/netfilter-conntrack-skip-identical-origin-tuple-in-s.patch new file mode 100644 index 00000000000..4cf9453164f --- /dev/null +++ b/queue-5.4/netfilter-conntrack-skip-identical-origin-tuple-in-s.patch @@ -0,0 +1,43 @@ +From 12dc3f653ece848d684afcee7177c3616e460e57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Feb 2021 12:56:43 +0100 +Subject: netfilter: conntrack: skip identical origin tuple in same zone only + +From: Florian Westphal + +[ Upstream commit 07998281c268592963e1cd623fe6ab0270b65ae4 ] + +The origin skip check needs to re-test the zone. Else, we might skip +a colliding tuple in the reply direction. + +This only occurs when using 'directional zones' where origin tuples +reside in different zones but the reply tuples share the same zone. + +This causes the new conntrack entry to be dropped at confirmation time +because NAT clash resolution was elided. + +Fixes: 4e35c1cb9460240 ("netfilter: nf_nat: skip nat clash resolution for same-origin entries") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c +index 200cdad3ff3ab..9a40312b1f161 100644 +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -1091,7 +1091,8 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple, + * Let nf_ct_resolve_clash() deal with this later. + */ + if (nf_ct_tuple_equal(&ignored_conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple, +- &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple)) ++ &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple) && ++ nf_ct_zone_equal(ct, zone, IP_CT_DIR_ORIGINAL)) + continue; + + NF_CT_STAT_INC_ATOMIC(net, found); +-- +2.27.0 + diff --git a/queue-5.4/netfilter-flowtable-fix-tcp-and-udp-header-checksum-.patch b/queue-5.4/netfilter-flowtable-fix-tcp-and-udp-header-checksum-.patch new file mode 100644 index 00000000000..0d8376c2fef --- /dev/null +++ b/queue-5.4/netfilter-flowtable-fix-tcp-and-udp-header-checksum-.patch @@ -0,0 +1,54 @@ +From 18ddabbe52e56d5371ad5e880a34053b84d34b94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Feb 2021 18:01:16 +0100 +Subject: netfilter: flowtable: fix tcp and udp header checksum update + +From: Sven Auhagen + +[ Upstream commit 8d6bca156e47d68551750a384b3ff49384c67be3 ] + +When updating the tcp or udp header checksum on port nat the function +inet_proto_csum_replace2 with the last parameter pseudohdr as true. +This leads to an error in the case that GRO is used and packets are +split up in GSO. The tcp or udp checksum of all packets is incorrect. + +The error is probably masked due to the fact the most network driver +implement tcp/udp checksum offloading. It also only happens when GRO is +applied and not on single packets. + +The error is most visible when using a pppoe connection which is not +triggering the tcp/udp checksum offload. + +Fixes: ac2a66665e23 ("netfilter: add generic flow table infrastructure") +Signed-off-by: Sven Auhagen +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_flow_table_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c +index 128245efe84ab..e05e5df803d68 100644 +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -354,7 +354,7 @@ static int nf_flow_nat_port_tcp(struct sk_buff *skb, unsigned int thoff, + return -1; + + tcph = (void *)(skb_network_header(skb) + thoff); +- inet_proto_csum_replace2(&tcph->check, skb, port, new_port, true); ++ inet_proto_csum_replace2(&tcph->check, skb, port, new_port, false); + + return 0; + } +@@ -371,7 +371,7 @@ static int nf_flow_nat_port_udp(struct sk_buff *skb, unsigned int thoff, + udph = (void *)(skb_network_header(skb) + thoff); + if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) { + inet_proto_csum_replace2(&udph->check, skb, port, +- new_port, true); ++ new_port, false); + if (!udph->check) + udph->check = CSUM_MANGLED_0; + } +-- +2.27.0 + diff --git a/queue-5.4/netfilter-nftables-fix-possible-uaf-over-chains-from.patch b/queue-5.4/netfilter-nftables-fix-possible-uaf-over-chains-from.patch new file mode 100644 index 00000000000..7712aa6fd00 --- /dev/null +++ b/queue-5.4/netfilter-nftables-fix-possible-uaf-over-chains-from.patch @@ -0,0 +1,88 @@ +From cabae139e8ddcab6990bac5a67bda554170882f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Feb 2021 16:07:37 +0100 +Subject: netfilter: nftables: fix possible UAF over chains from packet path in + netns + +From: Pablo Neira Ayuso + +[ Upstream commit 767d1216bff82507c945e92fe719dff2083bb2f4 ] + +Although hooks are released via call_rcu(), chain and rule objects are +immediately released while packets are still walking over these bits. + +This patch adds the .pre_exit callback which is invoked before +synchronize_rcu() in the netns framework to stay safe. + +Remove a comment which is not valid anymore since the core does not use +synchronize_net() anymore since 8c873e219970 ("netfilter: core: free +hooks with call_rcu"). + +Suggested-by: Florian Westphal +Fixes: df05ef874b28 ("netfilter: nf_tables: release objects on netns destruction") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 25 +++++++++++++++++++------ + 1 file changed, 19 insertions(+), 6 deletions(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 40216c2a7dd72..373ea0e49f12d 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -7696,6 +7696,17 @@ int __nft_release_basechain(struct nft_ctx *ctx) + } + EXPORT_SYMBOL_GPL(__nft_release_basechain); + ++static void __nft_release_hooks(struct net *net) ++{ ++ struct nft_table *table; ++ struct nft_chain *chain; ++ ++ list_for_each_entry(table, &net->nft.tables, list) { ++ list_for_each_entry(chain, &table->chains, list) ++ nf_tables_unregister_hook(net, table, chain); ++ } ++} ++ + static void __nft_release_tables(struct net *net) + { + struct nft_flowtable *flowtable, *nf; +@@ -7711,10 +7722,6 @@ static void __nft_release_tables(struct net *net) + + list_for_each_entry_safe(table, nt, &net->nft.tables, list) { + ctx.family = table->family; +- +- list_for_each_entry(chain, &table->chains, list) +- nf_tables_unregister_hook(net, table, chain); +- /* No packets are walking on these chains anymore. */ + ctx.table = table; + list_for_each_entry(chain, &table->chains, list) { + ctx.chain = chain; +@@ -7762,6 +7769,11 @@ static int __net_init nf_tables_init_net(struct net *net) + return 0; + } + ++static void __net_exit nf_tables_pre_exit_net(struct net *net) ++{ ++ __nft_release_hooks(net); ++} ++ + static void __net_exit nf_tables_exit_net(struct net *net) + { + mutex_lock(&net->nft.commit_mutex); +@@ -7774,8 +7786,9 @@ static void __net_exit nf_tables_exit_net(struct net *net) + } + + static struct pernet_operations nf_tables_net_ops = { +- .init = nf_tables_init_net, +- .exit = nf_tables_exit_net, ++ .init = nf_tables_init_net, ++ .pre_exit = nf_tables_pre_exit_net, ++ .exit = nf_tables_exit_net, + }; + + static int __init nf_tables_module_init(void) +-- +2.27.0 + diff --git a/queue-5.4/netfilter-xt_recent-fix-attempt-to-update-deleted-en.patch b/queue-5.4/netfilter-xt_recent-fix-attempt-to-update-deleted-en.patch new file mode 100644 index 00000000000..113327fd805 --- /dev/null +++ b/queue-5.4/netfilter-xt_recent-fix-attempt-to-update-deleted-en.patch @@ -0,0 +1,66 @@ +From 515dedf6ce8007ecd23c173f50be2a63679b37f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Jan 2021 20:57:43 +0100 +Subject: netfilter: xt_recent: Fix attempt to update deleted entry + +From: Jozsef Kadlecsik + +[ Upstream commit b1bdde33b72366da20d10770ab7a49fe87b5e190 ] + +When both --reap and --update flag are specified, there's a code +path at which the entry to be updated is reaped beforehand, +which then leads to kernel crash. Reap only entries which won't be +updated. + +Fixes kernel bugzilla #207773. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=207773 +Reported-by: Reindl Harald +Fixes: 0079c5aee348 ("netfilter: xt_recent: add an entry reaper") +Signed-off-by: Jozsef Kadlecsik +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/xt_recent.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c +index 6c2582a197667..3469b60736103 100644 +--- a/net/netfilter/xt_recent.c ++++ b/net/netfilter/xt_recent.c +@@ -152,7 +152,8 @@ static void recent_entry_remove(struct recent_table *t, struct recent_entry *e) + /* + * Drop entries with timestamps older then 'time'. + */ +-static void recent_entry_reap(struct recent_table *t, unsigned long time) ++static void recent_entry_reap(struct recent_table *t, unsigned long time, ++ struct recent_entry *working, bool update) + { + struct recent_entry *e; + +@@ -161,6 +162,12 @@ static void recent_entry_reap(struct recent_table *t, unsigned long time) + */ + e = list_entry(t->lru_list.next, struct recent_entry, lru_list); + ++ /* ++ * Do not reap the entry which are going to be updated. ++ */ ++ if (e == working && update) ++ return; ++ + /* + * The last time stamp is the most recent. + */ +@@ -303,7 +310,8 @@ recent_mt(const struct sk_buff *skb, struct xt_action_param *par) + + /* info->seconds must be non-zero */ + if (info->check_set & XT_RECENT_REAP) +- recent_entry_reap(t, time); ++ recent_entry_reap(t, time, e, ++ info->check_set & XT_RECENT_UPDATE && ret); + } + + if (info->check_set & XT_RECENT_SET || +-- +2.27.0 + diff --git a/queue-5.4/selftests-txtimestamp-fix-compilation-issue.patch b/queue-5.4/selftests-txtimestamp-fix-compilation-issue.patch new file mode 100644 index 00000000000..8b7a86eae74 --- /dev/null +++ b/queue-5.4/selftests-txtimestamp-fix-compilation-issue.patch @@ -0,0 +1,64 @@ +From 2cfea6f022e54e5eb404c635ee946fd47121327a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Feb 2021 20:50:34 +0300 +Subject: selftests: txtimestamp: fix compilation issue + +From: Vadim Fedorenko + +[ Upstream commit 647b8dd5184665432cc8a2b5bca46a201f690c37 ] + +PACKET_TX_TIMESTAMP is defined in if_packet.h but it is not included in +test. Include it instead of otherwise the error of +redefinition arrives. +Also fix the compiler warning about ambiguous control flow by adding +explicit braces. + +Fixes: 8fe2f761cae9 ("net-timestamp: expand documentation") +Suggested-by: Willem de Bruijn +Signed-off-by: Vadim Fedorenko +Acked-by: Willem de Bruijn +Link: https://lore.kernel.org/r/1612461034-24524-1-git-send-email-vfedorenko@novek.ru +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../testing/selftests/networking/timestamping/txtimestamp.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/networking/timestamping/txtimestamp.c b/tools/testing/selftests/networking/timestamping/txtimestamp.c +index 7e386be471201..2fce2e8f47f55 100644 +--- a/tools/testing/selftests/networking/timestamping/txtimestamp.c ++++ b/tools/testing/selftests/networking/timestamping/txtimestamp.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -34,7 +35,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -396,12 +396,12 @@ static void do_test(int family, unsigned int report_opt) + total_len = cfg_payload_len; + if (cfg_use_pf_packet || cfg_proto == SOCK_RAW) { + total_len += sizeof(struct udphdr); +- if (cfg_use_pf_packet || cfg_ipproto == IPPROTO_RAW) ++ if (cfg_use_pf_packet || cfg_ipproto == IPPROTO_RAW) { + if (family == PF_INET) + total_len += sizeof(struct iphdr); + else + total_len += sizeof(struct ipv6hdr); +- ++ } + /* special case, only rawv6_sendmsg: + * pass proto in sin6_port if not connected + * also see ANK comment in net/ipv4/raw.c +-- +2.27.0 + diff --git a/queue-5.4/series b/queue-5.4/series index 7140f7eb343..10e64d33a74 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -23,3 +23,25 @@ arm-ensure-the-signal-page-contains-defined-contents.patch arm-kexec-fix-oops-after-tlb-are-invalidated.patch vmlinux.lds.h-create-section-for-protection-against-.patch lkdtm-don-t-move-ctors-to-.rodata.patch +cgroup-v1-add-disabled-controller-check-in-cgroup1_p.patch +mt76-dma-fix-a-possible-memory-leak-in-mt76_add_frag.patch +drm-vc4-hvs-fix-buffer-overflow-with-the-dlist-handl.patch +bpf-check-for-integer-overflow-when-using-roundup_po.patch +netfilter-xt_recent-fix-attempt-to-update-deleted-en.patch +netfilter-nftables-fix-possible-uaf-over-chains-from.patch +netfilter-flowtable-fix-tcp-and-udp-header-checksum-.patch +xen-netback-avoid-race-in-xenvif_rx_ring_slots_avail.patch +net-enetc-initialize-the-rfs-and-rss-memories.patch +selftests-txtimestamp-fix-compilation-issue.patch +net-stmmac-set-txq-mode-back-to-dcb-after-disabling-.patch +ibmvnic-clear-failover_pending-if-unable-to-schedule.patch +netfilter-conntrack-skip-identical-origin-tuple-in-s.patch +x86-build-disable-cet-instrumentation-in-the-kernel-.patch +net-hns3-add-a-check-for-queue_id-in-hclge_reset_vf_.patch +firmware_loader-align-.builtin_fw-to-8.patch +drm-sun4i-tcon-set-sync-polarity-for-tcon1-channel.patch +drm-sun4i-fix-h6-hdmi-phy-configuration.patch +drm-sun4i-dw-hdmi-fix-max.-frequency-for-h6.patch +clk-sunxi-ng-mp-fix-parent-rate-change-flag-check.patch +i2c-stm32f7-fix-configuration-of-the-digital-filter.patch +h8300-fix-preemption-build-ti_pre_count-undefined.patch diff --git a/queue-5.4/x86-build-disable-cet-instrumentation-in-the-kernel-.patch b/queue-5.4/x86-build-disable-cet-instrumentation-in-the-kernel-.patch new file mode 100644 index 00000000000..25acc3f162c --- /dev/null +++ b/queue-5.4/x86-build-disable-cet-instrumentation-in-the-kernel-.patch @@ -0,0 +1,56 @@ +From e578a500b345d8643d0f31cd03e57b19a1dd6f3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Feb 2021 16:43:30 +0100 +Subject: x86/build: Disable CET instrumentation in the kernel for 32-bit too + +From: Borislav Petkov + +[ Upstream commit 256b92af784d5043eeb7d559b6d5963dcc2ecb10 ] + +Commit + + 20bf2b378729 ("x86/build: Disable CET instrumentation in the kernel") + +disabled CET instrumentation which gets added by default by the Ubuntu +gcc9 and 10 by default, but did that only for 64-bit builds. It would +still fail when building a 32-bit target. So disable CET for all x86 +builds. + +Fixes: 20bf2b378729 ("x86/build: Disable CET instrumentation in the kernel") +Reported-by: AC +Signed-off-by: Borislav Petkov +Acked-by: Josh Poimboeuf +Tested-by: AC +Link: https://lkml.kernel.org/r/YCCIgMHkzh/xT4ex@arch-chirva.localdomain +Signed-off-by: Sasha Levin +--- + arch/x86/Makefile | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/Makefile b/arch/x86/Makefile +index b5e3bfd4facea..8ca3cf7c5ec97 100644 +--- a/arch/x86/Makefile ++++ b/arch/x86/Makefile +@@ -61,6 +61,9 @@ endif + KBUILD_CFLAGS += -mno-sse -mno-mmx -mno-sse2 -mno-3dnow + KBUILD_CFLAGS += $(call cc-option,-mno-avx,) + ++# Intel CET isn't enabled in the kernel ++KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none) ++ + ifeq ($(CONFIG_X86_32),y) + BITS := 32 + UTS_MACHINE := i386 +@@ -131,9 +134,6 @@ else + + KBUILD_CFLAGS += -mno-red-zone + KBUILD_CFLAGS += -mcmodel=kernel +- +- # Intel CET isn't enabled in the kernel +- KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none) + endif + + ifdef CONFIG_X86_X32 +-- +2.27.0 + diff --git a/queue-5.4/xen-netback-avoid-race-in-xenvif_rx_ring_slots_avail.patch b/queue-5.4/xen-netback-avoid-race-in-xenvif_rx_ring_slots_avail.patch new file mode 100644 index 00000000000..656f93dc3a5 --- /dev/null +++ b/queue-5.4/xen-netback-avoid-race-in-xenvif_rx_ring_slots_avail.patch @@ -0,0 +1,58 @@ +From fd21f43d70d5336aa59774b2df23b743dd8b7a1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Feb 2021 08:09:38 +0100 +Subject: xen/netback: avoid race in xenvif_rx_ring_slots_available() + +From: Juergen Gross + +[ Upstream commit ec7d8e7dd3a59528e305a18e93f1cb98f7faf83b ] + +Since commit 23025393dbeb3b8b3 ("xen/netback: use lateeoi irq binding") +xenvif_rx_ring_slots_available() is no longer called only from the rx +queue kernel thread, so it needs to access the rx queue with the +associated queue held. + +Reported-by: Igor Druzhinin +Fixes: 23025393dbeb3b8b3 ("xen/netback: use lateeoi irq binding") +Signed-off-by: Juergen Gross +Acked-by: Wei Liu +Link: https://lore.kernel.org/r/20210202070938.7863-1-jgross@suse.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/xen-netback/rx.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/xen-netback/rx.c b/drivers/net/xen-netback/rx.c +index 9b62f65b630e4..48e2006f96ce6 100644 +--- a/drivers/net/xen-netback/rx.c ++++ b/drivers/net/xen-netback/rx.c +@@ -38,10 +38,15 @@ static bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue) + RING_IDX prod, cons; + struct sk_buff *skb; + int needed; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&queue->rx_queue.lock, flags); + + skb = skb_peek(&queue->rx_queue); +- if (!skb) ++ if (!skb) { ++ spin_unlock_irqrestore(&queue->rx_queue.lock, flags); + return false; ++ } + + needed = DIV_ROUND_UP(skb->len, XEN_PAGE_SIZE); + if (skb_is_gso(skb)) +@@ -49,6 +54,8 @@ static bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue) + if (skb->sw_hash) + needed++; + ++ spin_unlock_irqrestore(&queue->rx_queue.lock, flags); ++ + do { + prod = queue->rx.sring->req_prod; + cons = queue->rx.req_cons; +-- +2.27.0 +