From: Sasha Levin Date: Sun, 28 Mar 2021 03:51:22 +0000 (-0400) Subject: Fixes for 4.19 X-Git-Tag: v5.11.11~55 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3517a541b60a05560e8426f46a33c9dad962b81e;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/arm64-kdump-update-ppos-when-reading-elfcorehdr.patch b/queue-4.19/arm64-kdump-update-ppos-when-reading-elfcorehdr.patch new file mode 100644 index 00000000000..04ec79036dd --- /dev/null +++ b/queue-4.19/arm64-kdump-update-ppos-when-reading-elfcorehdr.patch @@ -0,0 +1,40 @@ +From c2930c4de6292e15eae3695ce9e6d70140449d3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 16:50:54 -0400 +Subject: arm64: kdump: update ppos when reading elfcorehdr + +From: Pavel Tatashin + +[ Upstream commit 141f8202cfa4192c3af79b6cbd68e7760bb01b5a ] + +The ppos points to a position in the old kernel memory (and in case of +arm64 in the crash kernel since elfcorehdr is passed as a segment). The +function should update the ppos by the amount that was read. This bug is +not exposed by accident, but other platforms update this value properly. +So, fix it in ARM64 version of elfcorehdr_read() as well. + +Signed-off-by: Pavel Tatashin +Fixes: e62aaeac426a ("arm64: kdump: provide /proc/vmcore file") +Reviewed-by: Tyler Hicks +Link: https://lore.kernel.org/r/20210319205054.743368-1-pasha.tatashin@soleen.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/crash_dump.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/kernel/crash_dump.c b/arch/arm64/kernel/crash_dump.c +index f46d57c31443..76905a258550 100644 +--- a/arch/arm64/kernel/crash_dump.c ++++ b/arch/arm64/kernel/crash_dump.c +@@ -67,5 +67,7 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf, + ssize_t elfcorehdr_read(char *buf, size_t count, u64 *ppos) + { + memcpy(buf, phys_to_virt((phys_addr_t)*ppos), count); ++ *ppos += count; ++ + return count; + } +-- +2.30.1 + diff --git a/queue-4.19/bpf-don-t-do-bpf_cgroup_storage_set-for-kuprobe-tp-p.patch b/queue-4.19/bpf-don-t-do-bpf_cgroup_storage_set-for-kuprobe-tp-p.patch new file mode 100644 index 00000000000..77fcd969c35 --- /dev/null +++ b/queue-4.19/bpf-don-t-do-bpf_cgroup_storage_set-for-kuprobe-tp-p.patch @@ -0,0 +1,87 @@ +From 803972c48211817c37c0887887d534f0c85f3662 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Mar 2021 18:27:53 -0400 +Subject: bpf: Don't do bpf_cgroup_storage_set() for kuprobe/tp programs + +[ Upstream commit 05a68ce5fa51a83c360381630f823545c5757aa2 ] + +For kuprobe and tracepoint bpf programs, kernel calls +trace_call_bpf() which calls BPF_PROG_RUN_ARRAY_CHECK() +to run the program array. Currently, BPF_PROG_RUN_ARRAY_CHECK() +also calls bpf_cgroup_storage_set() to set percpu +cgroup local storage with NULL value. This is +due to Commit 394e40a29788 ("bpf: extend bpf_prog_array to store +pointers to the cgroup storage") which modified +__BPF_PROG_RUN_ARRAY() to call bpf_cgroup_storage_set() +and this macro is also used by BPF_PROG_RUN_ARRAY_CHECK(). + +kuprobe and tracepoint programs are not allowed to call +bpf_get_local_storage() helper hence does not +access percpu cgroup local storage. Let us +change BPF_PROG_RUN_ARRAY_CHECK() not to +modify percpu cgroup local storage. + +The issue is observed when I tried to debug [1] where +percpu data is overwritten due to + preempt_disable -> migration_disable +change. This patch does not completely fix the above issue, +which will be addressed separately, e.g., multiple cgroup +prog runs may preempt each other. But it does fix +any potential issue caused by tracing program +overwriting percpu cgroup storage: + - in a busy system, a tracing program is to run between + bpf_cgroup_storage_set() and the cgroup prog run. + - a kprobe program is triggered by a helper in cgroup prog + before bpf_get_local_storage() is called. + + [1] https://lore.kernel.org/bpf/CAKH8qBuXCfUz=w8L+Fj74OaUpbosO29niYwTki7e3Ag044_aww@mail.gmail.com/T + +Fixes: 394e40a29788 ("bpf: extend bpf_prog_array to store pointers to the cgroup storage") +Signed-off-by: Yonghong Song +Signed-off-by: Alexei Starovoitov +Acked-by: Roman Gushchin +Link: https://lore.kernel.org/bpf/20210309185028.3763817-1-yhs@fb.com +Signed-off-by: Sasha Levin +--- + include/linux/bpf.h | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/include/linux/bpf.h b/include/linux/bpf.h +index 16f6beef5cad..3b3337333cfd 100644 +--- a/include/linux/bpf.h ++++ b/include/linux/bpf.h +@@ -382,7 +382,7 @@ int bpf_prog_array_copy(struct bpf_prog_array __rcu *old_array, + struct bpf_prog *include_prog, + struct bpf_prog_array **new_array); + +-#define __BPF_PROG_RUN_ARRAY(array, ctx, func, check_non_null) \ ++#define __BPF_PROG_RUN_ARRAY(array, ctx, func, check_non_null, set_cg_storage) \ + ({ \ + struct bpf_prog_array_item *_item; \ + struct bpf_prog *_prog; \ +@@ -395,7 +395,8 @@ int bpf_prog_array_copy(struct bpf_prog_array __rcu *old_array, + goto _out; \ + _item = &_array->items[0]; \ + while ((_prog = READ_ONCE(_item->prog))) { \ +- bpf_cgroup_storage_set(_item->cgroup_storage); \ ++ if (set_cg_storage) \ ++ bpf_cgroup_storage_set(_item->cgroup_storage); \ + _ret &= func(_prog, ctx); \ + _item++; \ + } \ +@@ -406,10 +407,10 @@ _out: \ + }) + + #define BPF_PROG_RUN_ARRAY(array, ctx, func) \ +- __BPF_PROG_RUN_ARRAY(array, ctx, func, false) ++ __BPF_PROG_RUN_ARRAY(array, ctx, func, false, true) + + #define BPF_PROG_RUN_ARRAY_CHECK(array, ctx, func) \ +- __BPF_PROG_RUN_ARRAY(array, ctx, func, true) ++ __BPF_PROG_RUN_ARRAY(array, ctx, func, true, false) + + #ifdef CONFIG_BPF_SYSCALL + DECLARE_PER_CPU(int, bpf_prog_active); +-- +2.30.1 + diff --git a/queue-4.19/bus-omap_l3_noc-mark-l3-irqs-as-irqf_no_thread.patch b/queue-4.19/bus-omap_l3_noc-mark-l3-irqs-as-irqf_no_thread.patch new file mode 100644 index 00000000000..6766ba2cc97 --- /dev/null +++ b/queue-4.19/bus-omap_l3_noc-mark-l3-irqs-as-irqf_no_thread.patch @@ -0,0 +1,51 @@ +From 1a86f39809cfa6a989590b942638f6c527d026b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Jan 2021 21:15:48 +0200 +Subject: bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD + +From: Grygorii Strashko + +[ Upstream commit 7d7275b3e866cf8092bd12553ec53ba26864f7bb ] + +The main purpose of l3 IRQs is to catch OCP bus access errors and identify +corresponding code places by showing call stack, so it's important to +handle L3 interconnect errors as fast as possible. On RT these IRQs will +became threaded and will be scheduled much more late from the moment actual +error occurred so showing completely useless information. + +Hence, mark l3 IRQs as IRQF_NO_THREAD so they will not be forced threaded +on RT or if force_irqthreads = true. + +Fixes: 0ee7261c9212 ("drivers: bus: Move the OMAP interconnect driver to drivers/bus/") +Signed-off-by: Grygorii Strashko +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + drivers/bus/omap_l3_noc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/bus/omap_l3_noc.c b/drivers/bus/omap_l3_noc.c +index b040447575ad..dcfb32ee5cb6 100644 +--- a/drivers/bus/omap_l3_noc.c ++++ b/drivers/bus/omap_l3_noc.c +@@ -285,7 +285,7 @@ static int omap_l3_probe(struct platform_device *pdev) + */ + l3->debug_irq = platform_get_irq(pdev, 0); + ret = devm_request_irq(l3->dev, l3->debug_irq, l3_interrupt_handler, +- 0x0, "l3-dbg-irq", l3); ++ IRQF_NO_THREAD, "l3-dbg-irq", l3); + if (ret) { + dev_err(l3->dev, "request_irq failed for %d\n", + l3->debug_irq); +@@ -294,7 +294,7 @@ static int omap_l3_probe(struct platform_device *pdev) + + l3->app_irq = platform_get_irq(pdev, 1); + ret = devm_request_irq(l3->dev, l3->app_irq, l3_interrupt_handler, +- 0x0, "l3-app-irq", l3); ++ IRQF_NO_THREAD, "l3-app-irq", l3); + if (ret) + dev_err(l3->dev, "request_irq failed for %d\n", l3->app_irq); + +-- +2.30.1 + diff --git a/queue-4.19/can-c_can-move-runtime-pm-enable-disable-to-c_can_pl.patch b/queue-4.19/can-c_can-move-runtime-pm-enable-disable-to-c_can_pl.patch new file mode 100644 index 00000000000..45330dbb529 --- /dev/null +++ b/queue-4.19/can-c_can-move-runtime-pm-enable-disable-to-c_can_pl.patch @@ -0,0 +1,136 @@ +From 8c84bb60572d538c6fa82f3781d6e97a3b268cbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Mar 2021 21:55:40 -0500 +Subject: can: c_can: move runtime PM enable/disable to c_can_platform +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tong Zhang + +[ Upstream commit 6e2fe01dd6f98da6cae8b07cd5cfa67abc70d97d ] + +Currently doing modprobe c_can_pci will make the kernel complain: + + Unbalanced pm_runtime_enable! + +this is caused by pm_runtime_enable() called before pm is initialized. + +This fix is similar to 227619c3ff7c, move those pm_enable/disable code +to c_can_platform. + +Fixes: 4cdd34b26826 ("can: c_can: Add runtime PM support to Bosch C_CAN/D_CAN controller") +Link: http://lore.kernel.org/r/20210302025542.987600-1-ztong0001@gmail.com +Signed-off-by: Tong Zhang +Tested-by: Uwe Kleine-König +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/c_can/c_can.c | 24 +----------------------- + drivers/net/can/c_can/c_can_platform.c | 6 +++++- + 2 files changed, 6 insertions(+), 24 deletions(-) + +diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c +index 24c6015f6c92..2278c5fff5c6 100644 +--- a/drivers/net/can/c_can/c_can.c ++++ b/drivers/net/can/c_can/c_can.c +@@ -212,18 +212,6 @@ static const struct can_bittiming_const c_can_bittiming_const = { + .brp_inc = 1, + }; + +-static inline void c_can_pm_runtime_enable(const struct c_can_priv *priv) +-{ +- if (priv->device) +- pm_runtime_enable(priv->device); +-} +- +-static inline void c_can_pm_runtime_disable(const struct c_can_priv *priv) +-{ +- if (priv->device) +- pm_runtime_disable(priv->device); +-} +- + static inline void c_can_pm_runtime_get_sync(const struct c_can_priv *priv) + { + if (priv->device) +@@ -1318,7 +1306,6 @@ static const struct net_device_ops c_can_netdev_ops = { + + int register_c_can_dev(struct net_device *dev) + { +- struct c_can_priv *priv = netdev_priv(dev); + int err; + + /* Deactivate pins to prevent DRA7 DCAN IP from being +@@ -1328,28 +1315,19 @@ int register_c_can_dev(struct net_device *dev) + */ + pinctrl_pm_select_sleep_state(dev->dev.parent); + +- c_can_pm_runtime_enable(priv); +- + dev->flags |= IFF_ECHO; /* we support local echo */ + dev->netdev_ops = &c_can_netdev_ops; + + err = register_candev(dev); +- if (err) +- c_can_pm_runtime_disable(priv); +- else ++ if (!err) + devm_can_led_init(dev); +- + return err; + } + EXPORT_SYMBOL_GPL(register_c_can_dev); + + void unregister_c_can_dev(struct net_device *dev) + { +- struct c_can_priv *priv = netdev_priv(dev); +- + unregister_candev(dev); +- +- c_can_pm_runtime_disable(priv); + } + EXPORT_SYMBOL_GPL(unregister_c_can_dev); + +diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c +index b5145a7f874c..f2b0408ce87d 100644 +--- a/drivers/net/can/c_can/c_can_platform.c ++++ b/drivers/net/can/c_can/c_can_platform.c +@@ -29,6 +29,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -385,6 +386,7 @@ static int c_can_plat_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, dev); + SET_NETDEV_DEV(dev, &pdev->dev); + ++ pm_runtime_enable(priv->device); + ret = register_c_can_dev(dev); + if (ret) { + dev_err(&pdev->dev, "registering %s failed (err=%d)\n", +@@ -397,6 +399,7 @@ static int c_can_plat_probe(struct platform_device *pdev) + return 0; + + exit_free_device: ++ pm_runtime_disable(priv->device); + free_c_can_dev(dev); + exit: + dev_err(&pdev->dev, "probe failed\n"); +@@ -407,9 +410,10 @@ exit: + static int c_can_plat_remove(struct platform_device *pdev) + { + struct net_device *dev = platform_get_drvdata(pdev); ++ struct c_can_priv *priv = netdev_priv(dev); + + unregister_c_can_dev(dev); +- ++ pm_runtime_disable(priv->device); + free_c_can_dev(dev); + + return 0; +-- +2.30.1 + diff --git a/queue-4.19/can-c_can_pci-c_can_pci_remove-fix-use-after-free.patch b/queue-4.19/can-c_can_pci-c_can_pci_remove-fix-use-after-free.patch new file mode 100644 index 00000000000..f3b43348101 --- /dev/null +++ b/queue-4.19/can-c_can_pci-c_can_pci_remove-fix-use-after-free.patch @@ -0,0 +1,44 @@ +From d8dddb47334034025b50ce1d9e2db9659b44d247 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Feb 2021 21:45:11 -0500 +Subject: can: c_can_pci: c_can_pci_remove(): fix use-after-free + +From: Tong Zhang + +[ Upstream commit 0429d6d89f97ebff4f17f13f5b5069c66bde8138 ] + +There is a UAF in c_can_pci_remove(). dev is released by +free_c_can_dev() and is used by pci_iounmap(pdev, priv->base) later. +To fix this issue, save the mmio address before releasing dev. + +Fixes: 5b92da0443c2 ("c_can_pci: generic module for C_CAN/D_CAN on PCI") +Link: https://lore.kernel.org/r/20210301024512.539039-1-ztong0001@gmail.com +Signed-off-by: Tong Zhang +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/c_can/c_can_pci.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/can/c_can/c_can_pci.c b/drivers/net/can/c_can/c_can_pci.c +index 406b4847e5dc..7efb60b50876 100644 +--- a/drivers/net/can/c_can/c_can_pci.c ++++ b/drivers/net/can/c_can/c_can_pci.c +@@ -239,12 +239,13 @@ static void c_can_pci_remove(struct pci_dev *pdev) + { + struct net_device *dev = pci_get_drvdata(pdev); + struct c_can_priv *priv = netdev_priv(dev); ++ void __iomem *addr = priv->base; + + unregister_c_can_dev(dev); + + free_c_can_dev(dev); + +- pci_iounmap(pdev, priv->base); ++ pci_iounmap(pdev, addr); + pci_disable_msi(pdev); + pci_clear_master(pdev); + pci_release_regions(pdev); +-- +2.30.1 + diff --git a/queue-4.19/can-flexcan-flexcan_chip_freeze-fix-chip-freeze-for-.patch b/queue-4.19/can-flexcan-flexcan_chip_freeze-fix-chip-freeze-for-.patch new file mode 100644 index 00000000000..f7e4aa2f251 --- /dev/null +++ b/queue-4.19/can-flexcan-flexcan_chip_freeze-fix-chip-freeze-for-.patch @@ -0,0 +1,55 @@ +From 111cf10e93d54e6450c4534618f7f193a275ef17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Mar 2021 00:15:10 +0100 +Subject: can: flexcan: flexcan_chip_freeze(): fix chip freeze for missing + bitrate + +From: Angelo Dureghello + +[ Upstream commit 47c5e474bc1e1061fb037d13b5000b38967eb070 ] + +For cases when flexcan is built-in, bitrate is still not set at +registering. So flexcan_chip_freeze() generates: + +[ 1.860000] *** ZERO DIVIDE *** FORMAT=4 +[ 1.860000] Current process id is 1 +[ 1.860000] BAD KERNEL TRAP: 00000000 +[ 1.860000] PC: [<402e70c8>] flexcan_chip_freeze+0x1a/0xa8 + +To allow chip freeze, using an hardcoded timeout when bitrate is still +not set. + +Fixes: ec15e27cc890 ("can: flexcan: enable RX FIFO after FRZ/HALT valid") +Link: https://lore.kernel.org/r/20210315231510.650593-1-angelo@kernel-space.org +Signed-off-by: Angelo Dureghello +[mkl: use if instead of ? operator] +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/flexcan.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c +index cb6bc2058542..d4dfa0247ebb 100644 +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -422,9 +422,15 @@ static int flexcan_chip_disable(struct flexcan_priv *priv) + static int flexcan_chip_freeze(struct flexcan_priv *priv) + { + struct flexcan_regs __iomem *regs = priv->regs; +- unsigned int timeout = 1000 * 1000 * 10 / priv->can.bittiming.bitrate; ++ unsigned int timeout; ++ u32 bitrate = priv->can.bittiming.bitrate; + u32 reg; + ++ if (bitrate) ++ timeout = 1000 * 1000 * 10 / bitrate; ++ else ++ timeout = FLEXCAN_TIMEOUT_US / 10; ++ + reg = priv->read(®s->mcr); + reg |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_HALT; + priv->write(reg, ®s->mcr); +-- +2.30.1 + diff --git a/queue-4.19/can-m_can-m_can_do_rx_poll-fix-extraneous-msg-loss-w.patch b/queue-4.19/can-m_can-m_can_do_rx_poll-fix-extraneous-msg-loss-w.patch new file mode 100644 index 00000000000..b1d948e2028 --- /dev/null +++ b/queue-4.19/can-m_can-m_can_do_rx_poll-fix-extraneous-msg-loss-w.patch @@ -0,0 +1,44 @@ +From a6cdeab49da4c4d25d6f1b01f36d68d3391cfb8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 10:31:52 +0000 +Subject: can: m_can: m_can_do_rx_poll(): fix extraneous msg loss warning + +From: Torin Cooper-Bennun + +[ Upstream commit c0e399f3baf42279f48991554240af8c457535d1 ] + +Message loss from RX FIFO 0 is already handled in +m_can_handle_lost_msg(), with netdev output included. + +Removing this warning also improves driver performance under heavy +load, where m_can_do_rx_poll() may be called many times before this +interrupt is cleared, causing this message to be output many +times (thanks Mariusz Madej for this report). + +Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support") +Link: https://lore.kernel.org/r/20210303103151.3760532-1-torin@maxiluxsystems.com +Reported-by: Mariusz Madej +Signed-off-by: Torin Cooper-Bennun +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index fbb970220c2d..e87c3bb82081 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -520,9 +520,6 @@ static int m_can_do_rx_poll(struct net_device *dev, int quota) + } + + while ((rxfs & RXFS_FFL_MASK) && (quota > 0)) { +- if (rxfs & RXFS_RFL) +- netdev_warn(dev, "Rx FIFO 0 Message Lost\n"); +- + m_can_read_fifo(dev, rxfs); + + quota--; +-- +2.30.1 + diff --git a/queue-4.19/can-peak_usb-add-forgotten-supported-devices.patch b/queue-4.19/can-peak_usb-add-forgotten-supported-devices.patch new file mode 100644 index 00000000000..3dee0d65f4b --- /dev/null +++ b/queue-4.19/can-peak_usb-add-forgotten-supported-devices.patch @@ -0,0 +1,39 @@ +From 004b5f19578b3b69ac08e87e48e5e41a4a8f6351 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Mar 2021 09:21:27 +0100 +Subject: can: peak_usb: add forgotten supported devices + +From: Stephane Grosjean + +[ Upstream commit 59ec7b89ed3e921cd0625a8c83f31a30d485fdf8 ] + +Since the peak_usb driver also supports the CAN-USB interfaces +"PCAN-USB X6" and "PCAN-Chip USB" from PEAK-System GmbH, this patch adds +their names to the list of explicitly supported devices. + +Fixes: ea8b65b596d7 ("can: usb: Add support of PCAN-Chip USB stamp module") +Fixes: f00b534ded60 ("can: peak: Add support for PCAN-USB X6 USB interface") +Link: https://lore.kernel.org/r/20210309082128.23125-3-s.grosjean@peak-system.com +Signed-off-by: Stephane Grosjean +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c +index 40ac37fe9dcd..1649687ab924 100644 +--- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c ++++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c +@@ -26,6 +26,8 @@ + + MODULE_SUPPORTED_DEVICE("PEAK-System PCAN-USB FD adapter"); + MODULE_SUPPORTED_DEVICE("PEAK-System PCAN-USB Pro FD adapter"); ++MODULE_SUPPORTED_DEVICE("PEAK-System PCAN-Chip USB"); ++MODULE_SUPPORTED_DEVICE("PEAK-System PCAN-USB X6 adapter"); + + #define PCAN_USBPROFD_CHANNEL_COUNT 2 + #define PCAN_USBFD_CHANNEL_COUNT 1 +-- +2.30.1 + diff --git a/queue-4.19/drm-msm-fix-shutdown-hook-in-case-gpu-components-fai.patch b/queue-4.19/drm-msm-fix-shutdown-hook-in-case-gpu-components-fai.patch new file mode 100644 index 00000000000..a697088440d --- /dev/null +++ b/queue-4.19/drm-msm-fix-shutdown-hook-in-case-gpu-components-fai.patch @@ -0,0 +1,95 @@ +From 9ff4a90f4c2694b8647559eec40924c1df497d69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Mar 2021 08:56:02 -0300 +Subject: drm/msm: fix shutdown hook in case GPU components failed to bind + +From: Dmitry Baryshkov + +[ Upstream commit 623f279c77811475ac8fd5635cc4e4451aa71291 ] + +If GPU components have failed to bind, shutdown callback would fail with +the following backtrace. Add safeguard check to stop that oops from +happening and allow the board to reboot. + +[ 66.617046] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 +[ 66.626066] Mem abort info: +[ 66.628939] ESR = 0x96000006 +[ 66.632088] EC = 0x25: DABT (current EL), IL = 32 bits +[ 66.637542] SET = 0, FnV = 0 +[ 66.640688] EA = 0, S1PTW = 0 +[ 66.643924] Data abort info: +[ 66.646889] ISV = 0, ISS = 0x00000006 +[ 66.650832] CM = 0, WnR = 0 +[ 66.653890] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000107f81000 +[ 66.660505] [0000000000000000] pgd=0000000100bb2003, p4d=0000000100bb2003, pud=0000000100897003, pmd=0000000000000000 +[ 66.671398] Internal error: Oops: 96000006 [#1] PREEMPT SMP +[ 66.677115] Modules linked in: +[ 66.680261] CPU: 6 PID: 352 Comm: reboot Not tainted 5.11.0-rc2-00309-g79e3faa756b2 #38 +[ 66.688473] Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) +[ 66.695347] pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--) +[ 66.701507] pc : msm_atomic_commit_tail+0x78/0x4e0 +[ 66.706437] lr : commit_tail+0xa4/0x184 +[ 66.710381] sp : ffff8000108f3af0 +[ 66.713791] x29: ffff8000108f3af0 x28: ffff418c44337000 +[ 66.719242] x27: 0000000000000000 x26: ffff418c40a24490 +[ 66.724693] x25: ffffd3a842a4f1a0 x24: 0000000000000008 +[ 66.730146] x23: ffffd3a84313f030 x22: ffff418c444ce000 +[ 66.735598] x21: ffff418c408a4980 x20: 0000000000000000 +[ 66.741049] x19: 0000000000000000 x18: ffff800010710fbc +[ 66.746500] x17: 000000000000000c x16: 0000000000000001 +[ 66.751954] x15: 0000000000010008 x14: 0000000000000068 +[ 66.757405] x13: 0000000000000001 x12: 0000000000000000 +[ 66.762855] x11: 0000000000000001 x10: 00000000000009b0 +[ 66.768306] x9 : ffffd3a843192000 x8 : ffff418c44337000 +[ 66.773757] x7 : 0000000000000000 x6 : 00000000a401b34e +[ 66.779210] x5 : 00ffffffffffffff x4 : 0000000000000000 +[ 66.784660] x3 : 0000000000000000 x2 : ffff418c444ce000 +[ 66.790111] x1 : ffffd3a841dce530 x0 : ffff418c444cf000 +[ 66.795563] Call trace: +[ 66.798075] msm_atomic_commit_tail+0x78/0x4e0 +[ 66.802633] commit_tail+0xa4/0x184 +[ 66.806217] drm_atomic_helper_commit+0x160/0x390 +[ 66.811051] drm_atomic_commit+0x4c/0x60 +[ 66.815082] drm_atomic_helper_disable_all+0x1f4/0x210 +[ 66.820355] drm_atomic_helper_shutdown+0x80/0x130 +[ 66.825276] msm_pdev_shutdown+0x14/0x20 +[ 66.829303] platform_shutdown+0x28/0x40 +[ 66.833330] device_shutdown+0x158/0x330 +[ 66.837357] kernel_restart+0x40/0xa0 +[ 66.841122] __do_sys_reboot+0x228/0x250 +[ 66.845148] __arm64_sys_reboot+0x28/0x34 +[ 66.849264] el0_svc_common.constprop.0+0x74/0x190 +[ 66.854187] do_el0_svc+0x24/0x90 +[ 66.857595] el0_svc+0x14/0x20 +[ 66.860739] el0_sync_handler+0x1a4/0x1b0 +[ 66.864858] el0_sync+0x174/0x180 +[ 66.868269] Code: 1ac020a0 2a000273 eb02007f 54ffff01 (f9400285) +[ 66.874525] ---[ end trace 20dedb2a3229fec8 ]--- + +Fixes: 9d5cbf5fe46e ("drm/msm: add shutdown support for display platform_driver") +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Fabio Estevam +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/msm_drv.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c +index 81de5e165955..08ff9d7645d7 100644 +--- a/drivers/gpu/drm/msm/msm_drv.c ++++ b/drivers/gpu/drm/msm/msm_drv.c +@@ -1363,6 +1363,10 @@ static int msm_pdev_remove(struct platform_device *pdev) + static void msm_pdev_shutdown(struct platform_device *pdev) + { + struct drm_device *drm = platform_get_drvdata(pdev); ++ struct msm_drm_private *priv = drm ? drm->dev_private : NULL; ++ ++ if (!priv || !priv->kms) ++ return; + + drm_atomic_helper_shutdown(drm); + } +-- +2.30.1 + diff --git a/queue-4.19/e1000e-add-rtnl_lock-to-e1000_reset_task.patch b/queue-4.19/e1000e-add-rtnl_lock-to-e1000_reset_task.patch new file mode 100644 index 00000000000..3d4532d5c2b --- /dev/null +++ b/queue-4.19/e1000e-add-rtnl_lock-to-e1000_reset_task.patch @@ -0,0 +1,54 @@ +From 8e3a3e737812f82f16e7bcc145837e655d318b31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Oct 2020 14:59:37 +0300 +Subject: e1000e: add rtnl_lock() to e1000_reset_task + +From: Vitaly Lifshits + +[ Upstream commit 21f857f0321d0d0ea9b1a758bd55dc63d1cb2437 ] + +A possible race condition was found in e1000_reset_task, +after discovering a similar issue in igb driver via +commit 024a8168b749 ("igb: reinit_locked() should be called +with rtnl_lock"). + +Added rtnl_lock() and rtnl_unlock() to avoid this. + +Fixes: bc7f75fa9788 ("[E1000E]: New pci-express e1000 driver (currently for ICH9 devices only)") +Suggested-by: Jakub Kicinski +Signed-off-by: Vitaly Lifshits +Tested-by: Dvora Fuxbrumer +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/e1000e/netdev.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c +index 7216825e049c..6bbe7afdf30c 100644 +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -5922,15 +5922,19 @@ static void e1000_reset_task(struct work_struct *work) + struct e1000_adapter *adapter; + adapter = container_of(work, struct e1000_adapter, reset_task); + ++ rtnl_lock(); + /* don't run the task if already down */ +- if (test_bit(__E1000_DOWN, &adapter->state)) ++ if (test_bit(__E1000_DOWN, &adapter->state)) { ++ rtnl_unlock(); + return; ++ } + + if (!(adapter->flags & FLAG_RESTART_NOW)) { + e1000e_dump(adapter); + e_err("Reset adapter unexpectedly\n"); + } + e1000e_reinit_locked(adapter); ++ rtnl_unlock(); + } + + /** +-- +2.30.1 + diff --git a/queue-4.19/e1000e-fix-error-handling-in-e1000_set_d0_lplu_state.patch b/queue-4.19/e1000e-fix-error-handling-in-e1000_set_d0_lplu_state.patch new file mode 100644 index 00000000000..a0e698dab6f --- /dev/null +++ b/queue-4.19/e1000e-fix-error-handling-in-e1000_set_d0_lplu_state.patch @@ -0,0 +1,40 @@ +From df45e34867d9e65ea3e1adcfe54a1d2f3c2bdc80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Feb 2021 17:44:23 +0800 +Subject: e1000e: Fix error handling in e1000_set_d0_lplu_state_82571 + +From: Dinghao Liu + +[ Upstream commit b52912b8293f2c496f42583e65599aee606a0c18 ] + +There is one e1e_wphy() call in e1000_set_d0_lplu_state_82571 +that we have caught its return value but lack further handling. +Check and terminate the execution flow just like other e1e_wphy() +in this function. + +Fixes: bc7f75fa9788 ("[E1000E]: New pci-express e1000 driver (currently for ICH9 devices only)") +Signed-off-by: Dinghao Liu +Acked-by: Sasha Neftin +Tested-by: Dvora Fuxbrumer +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/e1000e/82571.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/intel/e1000e/82571.c b/drivers/net/ethernet/intel/e1000e/82571.c +index b9309302c29e..16653e94009e 100644 +--- a/drivers/net/ethernet/intel/e1000e/82571.c ++++ b/drivers/net/ethernet/intel/e1000e/82571.c +@@ -899,6 +899,8 @@ static s32 e1000_set_d0_lplu_state_82571(struct e1000_hw *hw, bool active) + } else { + data &= ~IGP02E1000_PM_D0_LPLU; + ret_val = e1e_wphy(hw, IGP02E1000_PHY_POWER_MGMT, data); ++ if (ret_val) ++ return ret_val; + /* LPLU and SmartSpeed are mutually exclusive. LPLU is used + * during Dx states where the power conservation is most + * important. During driver activity we should enable +-- +2.30.1 + diff --git a/queue-4.19/ftgmac100-restart-mac-hw-once.patch b/queue-4.19/ftgmac100-restart-mac-hw-once.patch new file mode 100644 index 00000000000..edc8b456d43 --- /dev/null +++ b/queue-4.19/ftgmac100-restart-mac-hw-once.patch @@ -0,0 +1,38 @@ +From 35b3f325cd5b4b621b99d9b85a9a6b76eb1f93db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Mar 2021 11:04:05 +1030 +Subject: ftgmac100: Restart MAC HW once + +From: Dylan Hung + +[ Upstream commit 6897087323a2fde46df32917462750c069668b2f ] + +The interrupt handler may set the flag to reset the mac in the future, +but that flag is not cleared once the reset has occurred. + +Fixes: 10cbd6407609 ("ftgmac100: Rework NAPI & interrupts handling") +Signed-off-by: Dylan Hung +Acked-by: Benjamin Herrenschmidt +Reviewed-by: Joel Stanley +Signed-off-by: Joel Stanley +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/faraday/ftgmac100.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c +index acf27c395286..964407deca35 100644 +--- a/drivers/net/ethernet/faraday/ftgmac100.c ++++ b/drivers/net/ethernet/faraday/ftgmac100.c +@@ -1333,6 +1333,7 @@ static int ftgmac100_poll(struct napi_struct *napi, int budget) + */ + if (unlikely(priv->need_mac_restart)) { + ftgmac100_start_hw(priv); ++ priv->need_mac_restart = false; + + /* Re-enable "bad" interrupts */ + iowrite32(FTGMAC100_INT_BAD, +-- +2.30.1 + diff --git a/queue-4.19/libbpf-fix-install-flag-order.patch b/queue-4.19/libbpf-fix-install-flag-order.patch new file mode 100644 index 00000000000..3a0554ae88d --- /dev/null +++ b/queue-4.19/libbpf-fix-install-flag-order.patch @@ -0,0 +1,41 @@ +From bc688c568d35fd854c5272d47e541fa02287bb04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 10:30:38 -0800 +Subject: libbpf: Fix INSTALL flag order + +From: Georgi Valkov + +[ Upstream commit e7fb6465d4c8e767e39cbee72464e0060ab3d20c ] + +It was reported ([0]) that having optional -m flag between source and +destination arguments in install command breaks bpftools cross-build +on MacOS. Move -m to the front to fix this issue. + + [0] https://github.com/openwrt/openwrt/pull/3959 + +Fixes: 7110d80d53f4 ("libbpf: Makefile set specified permission mode") +Signed-off-by: Georgi Valkov +Signed-off-by: Andrii Nakryiko +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20210308183038.613432-1-andrii@kernel.org +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile +index 3624557550a1..6f57d38443c7 100644 +--- a/tools/lib/bpf/Makefile ++++ b/tools/lib/bpf/Makefile +@@ -179,7 +179,7 @@ define do_install + if [ ! -d '$(DESTDIR_SQ)$2' ]; then \ + $(INSTALL) -d -m 755 '$(DESTDIR_SQ)$2'; \ + fi; \ +- $(INSTALL) $1 $(if $3,-m $3,) '$(DESTDIR_SQ)$2' ++ $(INSTALL) $(if $3,-m $3,) $1 '$(DESTDIR_SQ)$2' + endef + + install_lib: all_cmd +-- +2.30.1 + diff --git a/queue-4.19/mac80211-fix-rate-mask-reset.patch b/queue-4.19/mac80211-fix-rate-mask-reset.patch new file mode 100644 index 00000000000..b4be98b5b78 --- /dev/null +++ b/queue-4.19/mac80211-fix-rate-mask-reset.patch @@ -0,0 +1,57 @@ +From 657eed1b6525cec5ceec95c2371ba3067649c9be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Feb 2021 11:22:14 +0100 +Subject: mac80211: fix rate mask reset + +From: Johannes Berg + +[ Upstream commit 1944015fe9c1d9fa5e9eb7ffbbb5ef8954d6753b ] + +Coverity reported the strange "if (~...)" condition that's +always true. It suggested that ! was intended instead of ~, +but upon further analysis I'm convinced that what really was +intended was a comparison to 0xff/0xffff (in HT/VHT cases +respectively), since this indicates that all of the rates +are enabled. + +Change the comparison accordingly. + +I'm guessing this never really mattered because a reset to +not having a rate mask is basically equivalent to having a +mask that enables all rates. + +Reported-by: Colin Ian King +Fixes: 2ffbe6d33366 ("mac80211: fix and optimize MCS mask handling") +Fixes: b119ad6e726c ("mac80211: add rate mask logic for vht rates") +Reviewed-by: Colin Ian King +Link: https://lore.kernel.org/r/20210212112213.36b38078f569.I8546a20c80bc1669058eb453e213630b846e107b@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/cfg.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index 9926455dd546..f484f9fc62ca 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -2777,14 +2777,14 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy, + continue; + + for (j = 0; j < IEEE80211_HT_MCS_MASK_LEN; j++) { +- if (~sdata->rc_rateidx_mcs_mask[i][j]) { ++ if (sdata->rc_rateidx_mcs_mask[i][j] != 0xff) { + sdata->rc_has_mcs_mask[i] = true; + break; + } + } + + for (j = 0; j < NL80211_VHT_NSS_MAX; j++) { +- if (~sdata->rc_rateidx_vht_mcs_mask[i][j]) { ++ if (sdata->rc_rateidx_vht_mcs_mask[i][j] != 0xffff) { + sdata->rc_has_vht_mcs_mask[i] = true; + break; + } +-- +2.30.1 + diff --git a/queue-4.19/macvlan-macvlan_count_rx-needs-to-be-aware-of-preemp.patch b/queue-4.19/macvlan-macvlan_count_rx-needs-to-be-aware-of-preemp.patch new file mode 100644 index 00000000000..d30ef7a8c3d --- /dev/null +++ b/queue-4.19/macvlan-macvlan_count_rx-needs-to-be-aware-of-preemp.patch @@ -0,0 +1,89 @@ +From b62df3230f2dbe9e0f35c81ea4e80de1c186d6c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 01:56:36 -0800 +Subject: macvlan: macvlan_count_rx() needs to be aware of preemption + +From: Eric Dumazet + +[ Upstream commit dd4fa1dae9f4847cc1fd78ca468ad69e16e5db3e ] + +macvlan_count_rx() can be called from process context, it is thus +necessary to disable preemption before calling u64_stats_update_begin() + +syzbot was able to spot this on 32bit arch: + +WARNING: CPU: 1 PID: 4632 at include/linux/seqlock.h:271 __seqprop_assert include/linux/seqlock.h:271 [inline] +WARNING: CPU: 1 PID: 4632 at include/linux/seqlock.h:271 __seqprop_assert.constprop.0+0xf0/0x11c include/linux/seqlock.h:269 +Modules linked in: +Kernel panic - not syncing: panic_on_warn set ... +CPU: 1 PID: 4632 Comm: kworker/1:3 Not tainted 5.12.0-rc2-syzkaller #0 +Hardware name: ARM-Versatile Express +Workqueue: events macvlan_process_broadcast +Backtrace: +[<82740468>] (dump_backtrace) from [<827406dc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:252) + r7:00000080 r6:60000093 r5:00000000 r4:8422a3c4 +[<827406c4>] (show_stack) from [<82751b58>] (__dump_stack lib/dump_stack.c:79 [inline]) +[<827406c4>] (show_stack) from [<82751b58>] (dump_stack+0xb8/0xe8 lib/dump_stack.c:120) +[<82751aa0>] (dump_stack) from [<82741270>] (panic+0x130/0x378 kernel/panic.c:231) + r7:830209b4 r6:84069ea4 r5:00000000 r4:844350d0 +[<82741140>] (panic) from [<80244924>] (__warn+0xb0/0x164 kernel/panic.c:605) + r3:8404ec8c r2:00000000 r1:00000000 r0:830209b4 + r7:0000010f +[<80244874>] (__warn) from [<82741520>] (warn_slowpath_fmt+0x68/0xd4 kernel/panic.c:628) + r7:81363f70 r6:0000010f r5:83018e50 r4:00000000 +[<827414bc>] (warn_slowpath_fmt) from [<81363f70>] (__seqprop_assert include/linux/seqlock.h:271 [inline]) +[<827414bc>] (warn_slowpath_fmt) from [<81363f70>] (__seqprop_assert.constprop.0+0xf0/0x11c include/linux/seqlock.h:269) + r8:5a109000 r7:0000000f r6:a568dac0 r5:89802300 r4:00000001 +[<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (u64_stats_update_begin include/linux/u64_stats_sync.h:128 [inline]) +[<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (macvlan_count_rx include/linux/if_macvlan.h:47 [inline]) +[<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (macvlan_broadcast+0x154/0x26c drivers/net/macvlan.c:291) + r5:89802300 r4:8a927740 +[<8136499c>] (macvlan_broadcast) from [<81365020>] (macvlan_process_broadcast+0x258/0x2d0 drivers/net/macvlan.c:317) + r10:81364f78 r9:8a86d000 r8:8a9c7e7c r7:8413aa5c r6:00000000 r5:00000000 + r4:89802840 +[<81364dc8>] (macvlan_process_broadcast) from [<802696a4>] (process_one_work+0x2d4/0x998 kernel/workqueue.c:2275) + r10:00000008 r9:8404ec98 r8:84367a02 r7:ddfe6400 r6:ddfe2d40 r5:898dac80 + r4:8a86d43c +[<802693d0>] (process_one_work) from [<80269dcc>] (worker_thread+0x64/0x54c kernel/workqueue.c:2421) + r10:00000008 r9:8a9c6000 r8:84006d00 r7:ddfe2d78 r6:898dac94 r5:ddfe2d40 + r4:898dac80 +[<80269d68>] (worker_thread) from [<80271f40>] (kthread+0x184/0x1a4 kernel/kthread.c:292) + r10:85247e64 r9:898dac80 r8:80269d68 r7:00000000 r6:8a9c6000 r5:89a2ee40 + r4:8a97bd00 +[<80271dbc>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:158) +Exception stack(0x8a9c7fb0 to 0x8a9c7ff8) + +Fixes: 412ca1550cbe ("macvlan: Move broadcasts into a work queue") +Signed-off-by: Eric Dumazet +Cc: Herbert Xu +Reported-by: syzbot +Acked-by: Herbert Xu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/linux/if_macvlan.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/linux/if_macvlan.h b/include/linux/if_macvlan.h +index 2e55e4cdbd8a..1261559d70b4 100644 +--- a/include/linux/if_macvlan.h ++++ b/include/linux/if_macvlan.h +@@ -43,13 +43,14 @@ static inline void macvlan_count_rx(const struct macvlan_dev *vlan, + if (likely(success)) { + struct vlan_pcpu_stats *pcpu_stats; + +- pcpu_stats = this_cpu_ptr(vlan->pcpu_stats); ++ pcpu_stats = get_cpu_ptr(vlan->pcpu_stats); + u64_stats_update_begin(&pcpu_stats->syncp); + pcpu_stats->rx_packets++; + pcpu_stats->rx_bytes += len; + if (multicast) + pcpu_stats->rx_multicast++; + u64_stats_update_end(&pcpu_stats->syncp); ++ put_cpu_ptr(vlan->pcpu_stats); + } else { + this_cpu_inc(vlan->pcpu_stats->rx_errors); + } +-- +2.30.1 + diff --git a/queue-4.19/net-cdc-phonet-fix-data-interface-release-on-probe-f.patch b/queue-4.19/net-cdc-phonet-fix-data-interface-release-on-probe-f.patch new file mode 100644 index 00000000000..2e8aa8d0b85 --- /dev/null +++ b/queue-4.19/net-cdc-phonet-fix-data-interface-release-on-probe-f.patch @@ -0,0 +1,37 @@ +From 54ec4ceccbfe8003e37073ca01ba928ff4cfa980 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Mar 2021 16:57:49 +0100 +Subject: net: cdc-phonet: fix data-interface release on probe failure + +From: Johan Hovold + +[ Upstream commit c79a707072fe3fea0e3c92edee6ca85c1e53c29f ] + +Set the disconnected flag before releasing the data interface in case +netdev registration fails to avoid having the disconnect callback try to +deregister the never registered netdev (and trigger a WARN_ON()). + +Fixes: 87cf65601e17 ("USB host CDC Phonet network interface driver") +Signed-off-by: Johan Hovold +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/cdc-phonet.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/usb/cdc-phonet.c b/drivers/net/usb/cdc-phonet.c +index 78b16eb9e58c..f448e484a341 100644 +--- a/drivers/net/usb/cdc-phonet.c ++++ b/drivers/net/usb/cdc-phonet.c +@@ -400,6 +400,8 @@ static int usbpn_probe(struct usb_interface *intf, const struct usb_device_id *i + + err = register_netdev(dev); + if (err) { ++ /* Set disconnected flag so that disconnect() returns early. */ ++ pnd->disconnected = 1; + usb_driver_release_interface(&usbpn_driver, data_intf); + goto out; + } +-- +2.30.1 + diff --git a/queue-4.19/net-dsa-bcm_sf2-qualify-phydev-dev_flags-based-on-po.patch b/queue-4.19/net-dsa-bcm_sf2-qualify-phydev-dev_flags-based-on-po.patch new file mode 100644 index 00000000000..bb069eff412 --- /dev/null +++ b/queue-4.19/net-dsa-bcm_sf2-qualify-phydev-dev_flags-based-on-po.patch @@ -0,0 +1,43 @@ +From 4c9e0d597d471af0f19cf8790798fb30442cee69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 14:17:58 -0800 +Subject: net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port + +From: Florian Fainelli + +[ Upstream commit 47142ed6c34d544ae9f0463e58d482289cbe0d46 ] + +Similar to commit 92696286f3bb37ba50e4bd8d1beb24afb759a799 ("net: +bcmgenet: Set phydev->dev_flags only for internal PHYs") we need to +qualify the phydev->dev_flags based on whether the port is connected to +an internal or external PHY otherwise we risk having a flags collision +with a completely different interpretation depending on the driver. + +Fixes: aa9aef77c761 ("net: dsa: bcm_sf2: communicate integrated PHY revision to PHY driver") +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/bcm_sf2.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c +index e9fe3897bd9c..3deda0321c00 100644 +--- a/drivers/net/dsa/bcm_sf2.c ++++ b/drivers/net/dsa/bcm_sf2.c +@@ -482,8 +482,10 @@ static u32 bcm_sf2_sw_get_phy_flags(struct dsa_switch *ds, int port) + * in bits 15:8 and the patch level in bits 7:0 which is exactly what + * the REG_PHY_REVISION register layout is. + */ +- +- return priv->hw_params.gphy_rev; ++ if (priv->int_phy_mask & BIT(port)) ++ return priv->hw_params.gphy_rev; ++ else ++ return 0; + } + + static void bcm_sf2_sw_validate(struct dsa_switch *ds, int port, +-- +2.30.1 + diff --git a/queue-4.19/net-mlx5e-fix-error-path-for-ethtool-set-priv-flag.patch b/queue-4.19/net-mlx5e-fix-error-path-for-ethtool-set-priv-flag.patch new file mode 100644 index 00000000000..6c797a70432 --- /dev/null +++ b/queue-4.19/net-mlx5e-fix-error-path-for-ethtool-set-priv-flag.patch @@ -0,0 +1,48 @@ +From 6262c35375890a7c0027bbbe4d6f093e402f6599 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Mar 2021 17:46:35 +0200 +Subject: net/mlx5e: Fix error path for ethtool set-priv-flag + +From: Aya Levin + +[ Upstream commit 4eacfe72e3e037e3fc019113df32c39a705148c2 ] + +Expose error value when failing to comply to command: +$ ethtool --set-priv-flags eth2 rx_cqe_compress [on/off] + +Fixes: be7e87f92b58 ("net/mlx5e: Fail safe cqe compressing/moderation mode setting") +Signed-off-by: Aya Levin +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +index a383276eb816..3d824c20d2a4 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +@@ -1460,6 +1460,7 @@ static int set_pflag_rx_cqe_compress(struct net_device *netdev, + { + struct mlx5e_priv *priv = netdev_priv(netdev); + struct mlx5_core_dev *mdev = priv->mdev; ++ int err; + + if (!MLX5_CAP_GEN(mdev, cqe_compression)) + return -EOPNOTSUPP; +@@ -1469,7 +1470,10 @@ static int set_pflag_rx_cqe_compress(struct net_device *netdev, + return -EINVAL; + } + +- mlx5e_modify_rx_cqe_compression_locked(priv, enable); ++ err = mlx5e_modify_rx_cqe_compression_locked(priv, enable); ++ if (err) ++ return err; ++ + priv->channels.params.rx_cqe_compress_def = enable; + + return 0; +-- +2.30.1 + diff --git a/queue-4.19/net-qlcnic-fix-a-use-after-free-in-qlcnic_83xx_get_m.patch b/queue-4.19/net-qlcnic-fix-a-use-after-free-in-qlcnic_83xx_get_m.patch new file mode 100644 index 00000000000..0ab1e8dd93f --- /dev/null +++ b/queue-4.19/net-qlcnic-fix-a-use-after-free-in-qlcnic_83xx_get_m.patch @@ -0,0 +1,44 @@ +From 636e22ecfbcb7c7d865755b9970e17309be9558d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 20:01:40 -0800 +Subject: net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template + +From: Lv Yunlong + +[ Upstream commit db74623a3850db99cb9692fda9e836a56b74198d ] + +In qlcnic_83xx_get_minidump_template, fw_dump->tmpl_hdr was freed by +vfree(). But unfortunately, it is used when extended is true. + +Fixes: 7061b2bdd620e ("qlogic: Deletion of unnecessary checks before two function calls") +Signed-off-by: Lv Yunlong +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c +index f34ae8c75bc5..61a39d167c8b 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c +@@ -1426,6 +1426,7 @@ void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter) + + if (fw_dump->tmpl_hdr == NULL || current_version > prev_version) { + vfree(fw_dump->tmpl_hdr); ++ fw_dump->tmpl_hdr = NULL; + + if (qlcnic_83xx_md_check_extended_dump_capability(adapter)) + extended = !qlcnic_83xx_extend_md_capab(adapter); +@@ -1444,6 +1445,8 @@ void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter) + struct qlcnic_83xx_dump_template_hdr *hdr; + + hdr = fw_dump->tmpl_hdr; ++ if (!hdr) ++ return; + hdr->drv_cap_mask = 0x1f; + fw_dump->cap_mask = 0x1f; + dev_info(&pdev->dev, +-- +2.30.1 + diff --git a/queue-4.19/net-stmmac-dwmac-sun8i-provide-tx-and-rx-fifo-sizes.patch b/queue-4.19/net-stmmac-dwmac-sun8i-provide-tx-and-rx-fifo-sizes.patch new file mode 100644 index 00000000000..599e5e0fb32 --- /dev/null +++ b/queue-4.19/net-stmmac-dwmac-sun8i-provide-tx-and-rx-fifo-sizes.patch @@ -0,0 +1,47 @@ +From 6ceb0e6da7979d6d72c696cb164be9a455ba5467 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 13:44:22 +0000 +Subject: net: stmmac: dwmac-sun8i: Provide TX and RX fifo sizes + +From: Corentin Labbe + +[ Upstream commit 014dfa26ce1c647af09bf506285ef67e0e3f0a6b ] + +MTU cannot be changed on dwmac-sun8i. (ip link set eth0 mtu xxx returning EINVAL) +This is due to tx_fifo_size being 0, since this value is used to compute valid +MTU range. +Like dwmac-sunxi (with commit 806fd188ce2a ("net: stmmac: dwmac-sunxi: Provide TX and RX fifo sizes")) +dwmac-sun8i need to have tx and rx fifo sizes set. +I have used values from datasheets. +After this patch, setting a non-default MTU (like 1000) value works and network is still useable. + +Tested-on: sun8i-h3-orangepi-pc +Tested-on: sun8i-r40-bananapi-m2-ultra +Tested-on: sun50i-a64-bananapi-m64 +Tested-on: sun50i-h5-nanopi-neo-plus2 +Tested-on: sun50i-h6-pine-h64 +Fixes: 9f93ac8d408 ("net-next: stmmac: Add dwmac-sun8i") +Reported-by: Belisko Marek +Signed-off-by: Corentin Labbe +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c +index 1e5e831718db..4382deaeb570 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c +@@ -1179,6 +1179,8 @@ static int sun8i_dwmac_probe(struct platform_device *pdev) + plat_dat->init = sun8i_dwmac_init; + plat_dat->exit = sun8i_dwmac_exit; + plat_dat->setup = sun8i_dwmac_setup; ++ plat_dat->tx_fifo_size = 4096; ++ plat_dat->rx_fifo_size = 16384; + + ret = sun8i_dwmac_init(pdev, plat_dat->bsp_priv); + if (ret) +-- +2.30.1 + diff --git a/queue-4.19/netfilter-ctnetlink-fix-dump-of-the-expect-mask-attr.patch b/queue-4.19/netfilter-ctnetlink-fix-dump-of-the-expect-mask-attr.patch new file mode 100644 index 00000000000..19ad818ef93 --- /dev/null +++ b/queue-4.19/netfilter-ctnetlink-fix-dump-of-the-expect-mask-attr.patch @@ -0,0 +1,41 @@ +From c866de5415614edcb10a50a8b37a94475aa9859a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Mar 2021 11:31:09 +0100 +Subject: netfilter: ctnetlink: fix dump of the expect mask attribute + +From: Florian Westphal + +[ Upstream commit b58f33d49e426dc66e98ed73afb5d97b15a25f2d ] + +Before this change, the mask is never included in the netlink message, so +"conntrack -E expect" always prints 0.0.0.0. + +In older kernels the l3num callback struct was passed as argument, based +on tuple->src.l3num. After the l3num indirection got removed, the call +chain is based on m.src.l3num, but this value is 0xffff. + +Init l3num to the correct value. + +Fixes: f957be9d349a3 ("netfilter: conntrack: remove ctnetlink callbacks from l3 protocol trackers") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_netlink.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index 0b89609a6e9d..15c9fbcd32f2 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -2656,6 +2656,7 @@ static int ctnetlink_exp_dump_mask(struct sk_buff *skb, + memset(&m, 0xFF, sizeof(m)); + memcpy(&m.src.u3, &mask->src.u3, sizeof(m.src.u3)); + m.src.u.all = mask->src.u.all; ++ m.src.l3num = tuple->src.l3num; + m.dst.protonum = tuple->dst.protonum; + + nest_parms = nla_nest_start(skb, CTA_EXPECT_MASK | NLA_F_NESTED); +-- +2.30.1 + diff --git a/queue-4.19/netfilter-x_tables-use-correct-memory-barriers.patch b/queue-4.19/netfilter-x_tables-use-correct-memory-barriers.patch new file mode 100644 index 00000000000..b9177bf7961 --- /dev/null +++ b/queue-4.19/netfilter-x_tables-use-correct-memory-barriers.patch @@ -0,0 +1,63 @@ +From 0cb6f06732aa79bdab810ef9fd648b4ac40e96df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 14:24:13 +1300 +Subject: netfilter: x_tables: Use correct memory barriers. + +From: Mark Tomlinson + +[ Upstream commit 175e476b8cdf2a4de7432583b49c871345e4f8a1 ] + +When a new table value was assigned, it was followed by a write memory +barrier. This ensured that all writes before this point would complete +before any writes after this point. However, to determine whether the +rules are unused, the sequence counter is read. To ensure that all +writes have been done before these reads, a full memory barrier is +needed, not just a write memory barrier. The same argument applies when +incrementing the counter, before the rules are read. + +Changing to using smp_mb() instead of smp_wmb() fixes the kernel panic +reported in cc00bcaa5899 (which is still present), while still +maintaining the same speed of replacing tables. + +The smb_mb() barriers potentially slow the packet path, however testing +has shown no measurable change in performance on a 4-core MIPS64 +platform. + +Fixes: 7f5c6d4f665b ("netfilter: get rid of atomic ops in fast path") +Signed-off-by: Mark Tomlinson +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/linux/netfilter/x_tables.h | 2 +- + net/netfilter/x_tables.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h +index 9077b3ebea08..0ade4d1e4dd9 100644 +--- a/include/linux/netfilter/x_tables.h ++++ b/include/linux/netfilter/x_tables.h +@@ -377,7 +377,7 @@ static inline unsigned int xt_write_recseq_begin(void) + * since addend is most likely 1 + */ + __this_cpu_add(xt_recseq.sequence, addend); +- smp_wmb(); ++ smp_mb(); + + return addend; + } +diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c +index 8b83806f4f8c..c9fe35118b33 100644 +--- a/net/netfilter/x_tables.c ++++ b/net/netfilter/x_tables.c +@@ -1394,7 +1394,7 @@ xt_replace_table(struct xt_table *table, + table->private = newinfo; + + /* make sure all cpus see new ->private value */ +- smp_wmb(); ++ smp_mb(); + + /* + * Even though table entries have now been swapped, other CPU's +-- +2.30.1 + diff --git a/queue-4.19/rdma-cxgb4-fix-adapter-le-hash-errors-while-destroyi.patch b/queue-4.19/rdma-cxgb4-fix-adapter-le-hash-errors-while-destroyi.patch new file mode 100644 index 00000000000..40c746303ff --- /dev/null +++ b/queue-4.19/rdma-cxgb4-fix-adapter-le-hash-errors-while-destroyi.patch @@ -0,0 +1,48 @@ +From b688d442b8649c4f1747df3f33af16aa49bbc6dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 00:34:53 +0530 +Subject: RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 + listening server + +From: Potnuri Bharat Teja + +[ Upstream commit 3408be145a5d6418ff955fe5badde652be90e700 ] + +Not setting the ipv6 bit while destroying ipv6 listening servers may +result in potential fatal adapter errors due to lookup engine memory hash +errors. Therefore always set ipv6 field while destroying ipv6 listening +servers. + +Fixes: 830662f6f032 ("RDMA/cxgb4: Add support for active and passive open connection with IPv6 address") +Link: https://lore.kernel.org/r/20210324190453.8171-1-bharat@chelsio.com +Signed-off-by: Potnuri Bharat Teja +Reviewed-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/cxgb4/cm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c +index 3fd3dfa3478b..b728a1bf916f 100644 +--- a/drivers/infiniband/hw/cxgb4/cm.c ++++ b/drivers/infiniband/hw/cxgb4/cm.c +@@ -3517,13 +3517,13 @@ int c4iw_destroy_listen(struct iw_cm_id *cm_id) + ep->com.local_addr.ss_family == AF_INET) { + err = cxgb4_remove_server_filter( + ep->com.dev->rdev.lldi.ports[0], ep->stid, +- ep->com.dev->rdev.lldi.rxq_ids[0], 0); ++ ep->com.dev->rdev.lldi.rxq_ids[0], false); + } else { + struct sockaddr_in6 *sin6; + c4iw_init_wr_wait(ep->com.wr_waitp); + err = cxgb4_remove_server( + ep->com.dev->rdev.lldi.ports[0], ep->stid, +- ep->com.dev->rdev.lldi.rxq_ids[0], 0); ++ ep->com.dev->rdev.lldi.rxq_ids[0], true); + if (err) + goto done; + err = c4iw_wait_for_reply(&ep->com.dev->rdev, ep->com.wr_waitp, +-- +2.30.1 + diff --git a/queue-4.19/revert-netfilter-x_tables-switch-synchronization-to-.patch b/queue-4.19/revert-netfilter-x_tables-switch-synchronization-to-.patch new file mode 100644 index 00000000000..70f22e81425 --- /dev/null +++ b/queue-4.19/revert-netfilter-x_tables-switch-synchronization-to-.patch @@ -0,0 +1,363 @@ +From 5869009c26abe7fb6611fec75eab85503f14775c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 14:24:12 +1300 +Subject: Revert "netfilter: x_tables: Switch synchronization to RCU" + +From: Mark Tomlinson + +[ Upstream commit d3d40f237480abf3268956daf18cdc56edd32834 ] + +This reverts commit cc00bcaa589914096edef7fb87ca5cee4a166b5c. + +This (and the preceding) patch basically re-implemented the RCU +mechanisms of patch 784544739a25. That patch was replaced because of the +performance problems that it created when replacing tables. Now, we have +the same issue: the call to synchronize_rcu() makes replacing tables +slower by as much as an order of magnitude. + +Prior to using RCU a script calling "iptables" approx. 200 times was +taking 1.16s. With RCU this increased to 11.59s. + +Revert these patches and fix the issue in a different way. + +Signed-off-by: Mark Tomlinson +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/linux/netfilter/x_tables.h | 5 +-- + net/ipv4/netfilter/arp_tables.c | 14 ++++----- + net/ipv4/netfilter/ip_tables.c | 14 ++++----- + net/ipv6/netfilter/ip6_tables.c | 14 ++++----- + net/netfilter/x_tables.c | 49 +++++++++++++++++++++--------- + 5 files changed, 56 insertions(+), 40 deletions(-) + +diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h +index 728d7716bf4f..9077b3ebea08 100644 +--- a/include/linux/netfilter/x_tables.h ++++ b/include/linux/netfilter/x_tables.h +@@ -227,7 +227,7 @@ struct xt_table { + unsigned int valid_hooks; + + /* Man behind the curtain... */ +- struct xt_table_info __rcu *private; ++ struct xt_table_info *private; + + /* Set this to THIS_MODULE if you are a module, otherwise NULL */ + struct module *me; +@@ -449,9 +449,6 @@ xt_get_per_cpu_counter(struct xt_counters *cnt, unsigned int cpu) + + struct nf_hook_ops *xt_hook_ops_alloc(const struct xt_table *, nf_hookfn *); + +-struct xt_table_info +-*xt_table_get_private_protected(const struct xt_table *table); +- + #ifdef CONFIG_COMPAT + #include + +diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c +index a2cae543a285..b1106d4507fd 100644 +--- a/net/ipv4/netfilter/arp_tables.c ++++ b/net/ipv4/netfilter/arp_tables.c +@@ -202,7 +202,7 @@ unsigned int arpt_do_table(struct sk_buff *skb, + + local_bh_disable(); + addend = xt_write_recseq_begin(); +- private = rcu_access_pointer(table->private); ++ private = READ_ONCE(table->private); /* Address dependency. */ + cpu = smp_processor_id(); + table_base = private->entries; + jumpstack = (struct arpt_entry **)private->jumpstack[cpu]; +@@ -648,7 +648,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table) + { + unsigned int countersize; + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + + /* We need atomic snapshot of counters: rest doesn't change + * (other than comefrom, which userspace doesn't care +@@ -672,7 +672,7 @@ static int copy_entries_to_user(unsigned int total_size, + unsigned int off, num; + const struct arpt_entry *e; + struct xt_counters *counters; +- struct xt_table_info *private = xt_table_get_private_protected(table); ++ struct xt_table_info *private = table->private; + int ret = 0; + void *loc_cpu_entry; + +@@ -807,7 +807,7 @@ static int get_info(struct net *net, void __user *user, + t = xt_request_find_table_lock(net, NFPROTO_ARP, name); + if (!IS_ERR(t)) { + struct arpt_getinfo info; +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + #ifdef CONFIG_COMPAT + struct xt_table_info tmp; + +@@ -860,7 +860,7 @@ static int get_entries(struct net *net, struct arpt_get_entries __user *uptr, + + t = xt_find_table_lock(net, NFPROTO_ARP, get.name); + if (!IS_ERR(t)) { +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + + if (get.size == private->size) + ret = copy_entries_to_user(private->size, +@@ -1019,7 +1019,7 @@ static int do_add_counters(struct net *net, const void __user *user, + } + + local_bh_disable(); +- private = xt_table_get_private_protected(t); ++ private = t->private; + if (private->number != tmp.num_counters) { + ret = -EINVAL; + goto unlock_up_free; +@@ -1356,7 +1356,7 @@ static int compat_copy_entries_to_user(unsigned int total_size, + void __user *userptr) + { + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + void __user *pos; + unsigned int size; + int ret = 0; +diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c +index 6672172a7512..2c1d66bef720 100644 +--- a/net/ipv4/netfilter/ip_tables.c ++++ b/net/ipv4/netfilter/ip_tables.c +@@ -261,7 +261,7 @@ ipt_do_table(struct sk_buff *skb, + WARN_ON(!(table->valid_hooks & (1 << hook))); + local_bh_disable(); + addend = xt_write_recseq_begin(); +- private = rcu_access_pointer(table->private); ++ private = READ_ONCE(table->private); /* Address dependency. */ + cpu = smp_processor_id(); + table_base = private->entries; + jumpstack = (struct ipt_entry **)private->jumpstack[cpu]; +@@ -794,7 +794,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table) + { + unsigned int countersize; + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + + /* We need atomic snapshot of counters: rest doesn't change + (other than comefrom, which userspace doesn't care +@@ -818,7 +818,7 @@ copy_entries_to_user(unsigned int total_size, + unsigned int off, num; + const struct ipt_entry *e; + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + int ret = 0; + const void *loc_cpu_entry; + +@@ -968,7 +968,7 @@ static int get_info(struct net *net, void __user *user, + t = xt_request_find_table_lock(net, AF_INET, name); + if (!IS_ERR(t)) { + struct ipt_getinfo info; +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + #ifdef CONFIG_COMPAT + struct xt_table_info tmp; + +@@ -1022,7 +1022,7 @@ get_entries(struct net *net, struct ipt_get_entries __user *uptr, + + t = xt_find_table_lock(net, AF_INET, get.name); + if (!IS_ERR(t)) { +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + if (get.size == private->size) + ret = copy_entries_to_user(private->size, + t, uptr->entrytable); +@@ -1178,7 +1178,7 @@ do_add_counters(struct net *net, const void __user *user, + } + + local_bh_disable(); +- private = xt_table_get_private_protected(t); ++ private = t->private; + if (private->number != tmp.num_counters) { + ret = -EINVAL; + goto unlock_up_free; +@@ -1573,7 +1573,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table, + void __user *userptr) + { + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + void __user *pos; + unsigned int size; + int ret = 0; +diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c +index 3b067d5a62ee..19eb40355dd1 100644 +--- a/net/ipv6/netfilter/ip6_tables.c ++++ b/net/ipv6/netfilter/ip6_tables.c +@@ -283,7 +283,7 @@ ip6t_do_table(struct sk_buff *skb, + + local_bh_disable(); + addend = xt_write_recseq_begin(); +- private = rcu_access_pointer(table->private); ++ private = READ_ONCE(table->private); /* Address dependency. */ + cpu = smp_processor_id(); + table_base = private->entries; + jumpstack = (struct ip6t_entry **)private->jumpstack[cpu]; +@@ -810,7 +810,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table) + { + unsigned int countersize; + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + + /* We need atomic snapshot of counters: rest doesn't change + (other than comefrom, which userspace doesn't care +@@ -834,7 +834,7 @@ copy_entries_to_user(unsigned int total_size, + unsigned int off, num; + const struct ip6t_entry *e; + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + int ret = 0; + const void *loc_cpu_entry; + +@@ -984,7 +984,7 @@ static int get_info(struct net *net, void __user *user, + t = xt_request_find_table_lock(net, AF_INET6, name); + if (!IS_ERR(t)) { + struct ip6t_getinfo info; +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + #ifdef CONFIG_COMPAT + struct xt_table_info tmp; + +@@ -1039,7 +1039,7 @@ get_entries(struct net *net, struct ip6t_get_entries __user *uptr, + + t = xt_find_table_lock(net, AF_INET6, get.name); + if (!IS_ERR(t)) { +- struct xt_table_info *private = xt_table_get_private_protected(t); ++ struct xt_table_info *private = t->private; + if (get.size == private->size) + ret = copy_entries_to_user(private->size, + t, uptr->entrytable); +@@ -1194,7 +1194,7 @@ do_add_counters(struct net *net, const void __user *user, unsigned int len, + } + + local_bh_disable(); +- private = xt_table_get_private_protected(t); ++ private = t->private; + if (private->number != tmp.num_counters) { + ret = -EINVAL; + goto unlock_up_free; +@@ -1582,7 +1582,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table, + void __user *userptr) + { + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + void __user *pos; + unsigned int size; + int ret = 0; +diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c +index 1314de5f317f..8b83806f4f8c 100644 +--- a/net/netfilter/x_tables.c ++++ b/net/netfilter/x_tables.c +@@ -1356,14 +1356,6 @@ struct xt_counters *xt_counters_alloc(unsigned int counters) + } + EXPORT_SYMBOL(xt_counters_alloc); + +-struct xt_table_info +-*xt_table_get_private_protected(const struct xt_table *table) +-{ +- return rcu_dereference_protected(table->private, +- mutex_is_locked(&xt[table->af].mutex)); +-} +-EXPORT_SYMBOL(xt_table_get_private_protected); +- + struct xt_table_info * + xt_replace_table(struct xt_table *table, + unsigned int num_counters, +@@ -1371,6 +1363,7 @@ xt_replace_table(struct xt_table *table, + int *error) + { + struct xt_table_info *private; ++ unsigned int cpu; + int ret; + + ret = xt_jumpstack_alloc(newinfo); +@@ -1380,20 +1373,47 @@ xt_replace_table(struct xt_table *table, + } + + /* Do the substitution. */ +- private = xt_table_get_private_protected(table); ++ local_bh_disable(); ++ private = table->private; + + /* Check inside lock: is the old number correct? */ + if (num_counters != private->number) { + pr_debug("num_counters != table->private->number (%u/%u)\n", + num_counters, private->number); ++ local_bh_enable(); + *error = -EAGAIN; + return NULL; + } + + newinfo->initial_entries = private->initial_entries; ++ /* ++ * Ensure contents of newinfo are visible before assigning to ++ * private. ++ */ ++ smp_wmb(); ++ table->private = newinfo; ++ ++ /* make sure all cpus see new ->private value */ ++ smp_wmb(); + +- rcu_assign_pointer(table->private, newinfo); +- synchronize_rcu(); ++ /* ++ * Even though table entries have now been swapped, other CPU's ++ * may still be using the old entries... ++ */ ++ local_bh_enable(); ++ ++ /* ... so wait for even xt_recseq on all cpus */ ++ for_each_possible_cpu(cpu) { ++ seqcount_t *s = &per_cpu(xt_recseq, cpu); ++ u32 seq = raw_read_seqcount(s); ++ ++ if (seq & 1) { ++ do { ++ cond_resched(); ++ cpu_relax(); ++ } while (seq == raw_read_seqcount(s)); ++ } ++ } + + #ifdef CONFIG_AUDIT + if (audit_enabled) { +@@ -1434,12 +1454,12 @@ struct xt_table *xt_register_table(struct net *net, + } + + /* Simplifies replace_table code. */ +- rcu_assign_pointer(table->private, bootstrap); ++ table->private = bootstrap; + + if (!xt_replace_table(table, 0, newinfo, &ret)) + goto unlock; + +- private = xt_table_get_private_protected(table); ++ private = table->private; + pr_debug("table->private->number = %u\n", private->number); + + /* save number of initial entries */ +@@ -1462,8 +1482,7 @@ void *xt_unregister_table(struct xt_table *table) + struct xt_table_info *private; + + mutex_lock(&xt[table->af].mutex); +- private = xt_table_get_private_protected(table); +- RCU_INIT_POINTER(table->private, NULL); ++ private = table->private; + list_del(&table->list); + mutex_unlock(&xt[table->af].mutex); + kfree(table); +-- +2.30.1 + diff --git a/queue-4.19/revert-netfilter-x_tables-update-remaining-dereferen.patch b/queue-4.19/revert-netfilter-x_tables-update-remaining-dereferen.patch new file mode 100644 index 00000000000..86075e6272f --- /dev/null +++ b/queue-4.19/revert-netfilter-x_tables-update-remaining-dereferen.patch @@ -0,0 +1,70 @@ +From f2c713d882d2cb26c3b24e63760db4e90eaf2da4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 14:24:11 +1300 +Subject: Revert "netfilter: x_tables: Update remaining dereference to RCU" + +From: Mark Tomlinson + +[ Upstream commit abe7034b9a8d57737e80cc16d60ed3666990bdbf ] + +This reverts commit 443d6e86f821a165fae3fc3fc13086d27ac140b1. + +This (and the following) patch basically re-implemented the RCU +mechanisms of patch 784544739a25. That patch was replaced because of the +performance problems that it created when replacing tables. Now, we have +the same issue: the call to synchronize_rcu() makes replacing tables +slower by as much as an order of magnitude. + +Revert these patches and fix the issue in a different way. + +Signed-off-by: Mark Tomlinson +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/ipv4/netfilter/arp_tables.c | 2 +- + net/ipv4/netfilter/ip_tables.c | 2 +- + net/ipv6/netfilter/ip6_tables.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c +index b1106d4507fd..10d8f95eb771 100644 +--- a/net/ipv4/netfilter/arp_tables.c ++++ b/net/ipv4/netfilter/arp_tables.c +@@ -1405,7 +1405,7 @@ static int compat_get_entries(struct net *net, + xt_compat_lock(NFPROTO_ARP); + t = xt_find_table_lock(net, NFPROTO_ARP, get.name); + if (!IS_ERR(t)) { +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + struct xt_table_info info; + + ret = compat_table_info(private, &info); +diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c +index 2c1d66bef720..e77872c93c20 100644 +--- a/net/ipv4/netfilter/ip_tables.c ++++ b/net/ipv4/netfilter/ip_tables.c +@@ -1619,7 +1619,7 @@ compat_get_entries(struct net *net, struct compat_ipt_get_entries __user *uptr, + xt_compat_lock(AF_INET); + t = xt_find_table_lock(net, AF_INET, get.name); + if (!IS_ERR(t)) { +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + struct xt_table_info info; + ret = compat_table_info(private, &info); + if (!ret && get.size == info.size) +diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c +index 19eb40355dd1..daf2e9e9193d 100644 +--- a/net/ipv6/netfilter/ip6_tables.c ++++ b/net/ipv6/netfilter/ip6_tables.c +@@ -1628,7 +1628,7 @@ compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr, + xt_compat_lock(AF_INET6); + t = xt_find_table_lock(net, AF_INET6, get.name); + if (!IS_ERR(t)) { +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + struct xt_table_info info; + ret = compat_table_info(private, &info); + if (!ret && get.size == info.size) +-- +2.30.1 + diff --git a/queue-4.19/series b/queue-4.19/series index 68ca02d16c9..2e938d6f7c3 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -30,3 +30,29 @@ arm64-dts-ls1012a-mark-crypto-engine-dma-coherent.patch arm64-dts-ls1043a-mark-crypto-engine-dma-coherent.patch arm-dts-at91-sama5d27_som1-fix-phy-address-to-7.patch dm-ioctl-fix-out-of-bounds-array-access-when-no-devices.patch +bus-omap_l3_noc-mark-l3-irqs-as-irqf_no_thread.patch +veth-store-queue_mapping-independently-of-xdp-prog-p.patch +libbpf-fix-install-flag-order.patch +macvlan-macvlan_count_rx-needs-to-be-aware-of-preemp.patch +net-dsa-bcm_sf2-qualify-phydev-dev_flags-based-on-po.patch +e1000e-add-rtnl_lock-to-e1000_reset_task.patch +e1000e-fix-error-handling-in-e1000_set_d0_lplu_state.patch +net-qlcnic-fix-a-use-after-free-in-qlcnic_83xx_get_m.patch +ftgmac100-restart-mac-hw-once.patch +netfilter-ctnetlink-fix-dump-of-the-expect-mask-attr.patch +can-peak_usb-add-forgotten-supported-devices.patch +can-flexcan-flexcan_chip_freeze-fix-chip-freeze-for-.patch +can-c_can_pci-c_can_pci_remove-fix-use-after-free.patch +can-c_can-move-runtime-pm-enable-disable-to-c_can_pl.patch +can-m_can-m_can_do_rx_poll-fix-extraneous-msg-loss-w.patch +mac80211-fix-rate-mask-reset.patch +net-cdc-phonet-fix-data-interface-release-on-probe-f.patch +net-stmmac-dwmac-sun8i-provide-tx-and-rx-fifo-sizes.patch +drm-msm-fix-shutdown-hook-in-case-gpu-components-fai.patch +arm64-kdump-update-ppos-when-reading-elfcorehdr.patch +net-mlx5e-fix-error-path-for-ethtool-set-priv-flag.patch +rdma-cxgb4-fix-adapter-le-hash-errors-while-destroyi.patch +bpf-don-t-do-bpf_cgroup_storage_set-for-kuprobe-tp-p.patch +revert-netfilter-x_tables-switch-synchronization-to-.patch +netfilter-x_tables-use-correct-memory-barriers.patch +revert-netfilter-x_tables-update-remaining-dereferen.patch diff --git a/queue-4.19/veth-store-queue_mapping-independently-of-xdp-prog-p.patch b/queue-4.19/veth-store-queue_mapping-independently-of-xdp-prog-p.patch new file mode 100644 index 00000000000..ed9b7d333f6 --- /dev/null +++ b/queue-4.19/veth-store-queue_mapping-independently-of-xdp-prog-p.patch @@ -0,0 +1,46 @@ +From 47e691bbdec9861654a6cf5081ae2f3e3caeed9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 16:29:03 +0100 +Subject: veth: Store queue_mapping independently of XDP prog presence + +From: Maciej Fijalkowski + +[ Upstream commit edbea922025169c0e5cdca5ebf7bf5374cc5566c ] + +Currently, veth_xmit() would call the skb_record_rx_queue() only when +there is XDP program loaded on peer interface in native mode. + +If peer has XDP prog in generic mode, then netif_receive_generic_xdp() +has a call to netif_get_rxqueue(skb), so for multi-queue veth it will +not be possible to grab a correct rxq. + +To fix that, store queue_mapping independently of XDP prog presence on +peer interface. + +Fixes: 638264dc9022 ("veth: Support per queue XDP ring") +Signed-off-by: Maciej Fijalkowski +Signed-off-by: Daniel Borkmann +Acked-by: Toshiaki Makita +Link: https://lore.kernel.org/bpf/20210303152903.11172-1-maciej.fijalkowski@intel.com +Signed-off-by: Sasha Levin +--- + drivers/net/veth.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/veth.c b/drivers/net/veth.c +index 2abbad1abaf2..fd1843fd256b 100644 +--- a/drivers/net/veth.c ++++ b/drivers/net/veth.c +@@ -197,8 +197,7 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev) + if (rxq < rcv->real_num_rx_queues) { + rq = &rcv_priv->rq[rxq]; + rcv_xdp = rcu_access_pointer(rq->xdp_prog); +- if (rcv_xdp) +- skb_record_rx_queue(skb, rxq); ++ skb_record_rx_queue(skb, rxq); + } + + if (likely(veth_forward_skb(rcv, skb, rq, rcv_xdp) == NET_RX_SUCCESS)) { +-- +2.30.1 +