From: Greg Kroah-Hartman Date: Mon, 24 Jan 2022 13:53:05 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v4.4.300~49 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3553299d286a9efdcbc3e344af315c2408ea9679;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: arm64-dts-qcom-msm8996-drop-not-documented-adreno-properties.patch bcmgenet-add-wol-irq-check.patch dmaengine-at_xdmac-don-t-start-transactions-at-tx_submit-level.patch dmaengine-at_xdmac-fix-at_xdmac_lld-struct-definition.patch dmaengine-at_xdmac-fix-concurrency-over-xfers_list.patch dmaengine-at_xdmac-fix-lld-view-setting.patch dmaengine-at_xdmac-print-debug-message-after-realeasing-the-lock.patch gre-don-t-accidentally-set-rto_onlink-in-gre_fill_metadata_dst.patch inet-frags-annotate-races-around-fqdir-dead-and-fqdir-high_thresh.patch libcxgb-don-t-accidentally-set-rto_onlink-in-cxgb_find_route.patch net-axienet-fix-number-of-tx-ring-slots-for-available-check.patch net-axienet-increase-default-tx-ring-size-to-128.patch net-axienet-limit-minimum-tx-ring-size.patch net-ethernet-mtk_eth_soc-fix-error-checking-in-mtk_mac_config.patch net_sched-restore-mpu-xxx-handling.patch netns-add-schedule-point-in-ops_exit_list.patch perf-script-fix-hex-dump-character-output.patch rtc-pxa-fix-null-pointer-dereference.patch xfrm-don-t-accidentally-set-rto_onlink-in-decode_session4.patch --- diff --git a/queue-5.4/arm64-dts-qcom-msm8996-drop-not-documented-adreno-properties.patch b/queue-5.4/arm64-dts-qcom-msm8996-drop-not-documented-adreno-properties.patch new file mode 100644 index 00000000000..a4a2fe4f48a --- /dev/null +++ b/queue-5.4/arm64-dts-qcom-msm8996-drop-not-documented-adreno-properties.patch @@ -0,0 +1,40 @@ +From c41910f257a22dc406c60d8826b4a3b5398003a3 Mon Sep 17 00:00:00 2001 +From: David Heidelberg +Date: Sat, 30 Oct 2021 12:04:12 +0200 +Subject: arm64: dts: qcom: msm8996: drop not documented adreno properties + +From: David Heidelberg + +commit c41910f257a22dc406c60d8826b4a3b5398003a3 upstream. + +These properties aren't documented nor implemented in the driver. +Drop them. + +Fixes warnings as: +$ make dtbs_check DT_SCHEMA_FILES=Documentation/devicetree/bindings/display/msm/gpu.yaml +... +arch/arm64/boot/dts/qcom/msm8996-mtp.dt.yaml: gpu@b00000: 'qcom,gpu-quirk-fault-detect-mask', 'qcom,gpu-quirk-two-pass-use-wfi' do not match any of the regexes: 'pinctrl-[0-9]+' + From schema: Documentation/devicetree/bindings/display/msm/gpu.yaml +... + +Fixes: 69cc3114ab0f ("arm64: dts: Add Adreno GPU definitions") +Signed-off-by: David Heidelberg +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20211030100413.28370-1-david@ixit.cz +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/qcom/msm8996.dtsi | 3 --- + 1 file changed, 3 deletions(-) + +--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi +@@ -2098,9 +2098,6 @@ + nvmem-cells = <&gpu_speed_bin>; + nvmem-cell-names = "speed_bin"; + +- qcom,gpu-quirk-two-pass-use-wfi; +- qcom,gpu-quirk-fault-detect-mask; +- + operating-points-v2 = <&gpu_opp_table>; + + gpu_opp_table: opp-table { diff --git a/queue-5.4/bcmgenet-add-wol-irq-check.patch b/queue-5.4/bcmgenet-add-wol-irq-check.patch new file mode 100644 index 00000000000..bb0334f12a1 --- /dev/null +++ b/queue-5.4/bcmgenet-add-wol-irq-check.patch @@ -0,0 +1,42 @@ +From 9deb48b53e7f4056c2eaa2dc2ee3338df619e4f6 Mon Sep 17 00:00:00 2001 +From: Sergey Shtylyov +Date: Thu, 13 Jan 2022 22:46:07 +0300 +Subject: bcmgenet: add WOL IRQ check + +From: Sergey Shtylyov + +commit 9deb48b53e7f4056c2eaa2dc2ee3338df619e4f6 upstream. + +The driver neglects to check the result of platform_get_irq_optional()'s +call and blithely passes the negative error codes to devm_request_irq() +(which takes *unsigned* IRQ #), causing it to fail with -EINVAL. +Stop calling devm_request_irq() with the invalid IRQ #s. + +Fixes: 8562056f267d ("net: bcmgenet: request Wake-on-LAN interrupt") +Signed-off-by: Sergey Shtylyov +Acked-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -3507,10 +3507,12 @@ static int bcmgenet_probe(struct platfor + + /* Request the WOL interrupt and advertise suspend if available */ + priv->wol_irq_disabled = true; +- err = devm_request_irq(&pdev->dev, priv->wol_irq, bcmgenet_wol_isr, 0, +- dev->name, priv); +- if (!err) +- device_set_wakeup_capable(&pdev->dev, 1); ++ if (priv->wol_irq > 0) { ++ err = devm_request_irq(&pdev->dev, priv->wol_irq, ++ bcmgenet_wol_isr, 0, dev->name, priv); ++ if (!err) ++ device_set_wakeup_capable(&pdev->dev, 1); ++ } + + /* Set the needed headroom to account for any possible + * features enabling/disabling at runtime diff --git a/queue-5.4/dmaengine-at_xdmac-don-t-start-transactions-at-tx_submit-level.patch b/queue-5.4/dmaengine-at_xdmac-don-t-start-transactions-at-tx_submit-level.patch new file mode 100644 index 00000000000..ba81d1c6759 --- /dev/null +++ b/queue-5.4/dmaengine-at_xdmac-don-t-start-transactions-at-tx_submit-level.patch @@ -0,0 +1,53 @@ +From bccfb96b59179d4f96cbbd1ddff8fac6d335eae4 Mon Sep 17 00:00:00 2001 +From: Tudor Ambarus +Date: Wed, 15 Dec 2021 13:01:04 +0200 +Subject: dmaengine: at_xdmac: Don't start transactions at tx_submit level + +From: Tudor Ambarus + +commit bccfb96b59179d4f96cbbd1ddff8fac6d335eae4 upstream. + +tx_submit is supposed to push the current transaction descriptor to a +pending queue, waiting for issue_pending() to be called. issue_pending() +must start the transfer, not tx_submit(), thus remove +at_xdmac_start_xfer() from at_xdmac_tx_submit(). Clients of at_xdmac that +assume that tx_submit() starts the transfer must be updated and call +dma_async_issue_pending() if they miss to call it (one example is +atmel_serial). + +As the at_xdmac_start_xfer() is now called only from +at_xdmac_advance_work() when !at_xdmac_chan_is_enabled(), the +at_xdmac_chan_is_enabled() check is no longer needed in +at_xdmac_start_xfer(), thus remove it. + +Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver") +Signed-off-by: Tudor Ambarus +Link: https://lore.kernel.org/r/20211215110115.191749-2-tudor.ambarus@microchip.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/at_xdmac.c | 6 ------ + 1 file changed, 6 deletions(-) + +--- a/drivers/dma/at_xdmac.c ++++ b/drivers/dma/at_xdmac.c +@@ -338,9 +338,6 @@ static void at_xdmac_start_xfer(struct a + + dev_vdbg(chan2dev(&atchan->chan), "%s: desc 0x%p\n", __func__, first); + +- if (at_xdmac_chan_is_enabled(atchan)) +- return; +- + /* Set transfer as active to not try to start it again. */ + first->active_xfer = true; + +@@ -430,9 +427,6 @@ static dma_cookie_t at_xdmac_tx_submit(s + dev_vdbg(chan2dev(tx->chan), "%s: atchan 0x%p, add desc 0x%p to xfers_list\n", + __func__, atchan, desc); + list_add_tail(&desc->xfer_node, &atchan->xfers_list); +- if (list_is_singular(&atchan->xfers_list)) +- at_xdmac_start_xfer(atchan, desc); +- + spin_unlock_irqrestore(&atchan->lock, irqflags); + return cookie; + } diff --git a/queue-5.4/dmaengine-at_xdmac-fix-at_xdmac_lld-struct-definition.patch b/queue-5.4/dmaengine-at_xdmac-fix-at_xdmac_lld-struct-definition.patch new file mode 100644 index 00000000000..fd545ccb747 --- /dev/null +++ b/queue-5.4/dmaengine-at_xdmac-fix-at_xdmac_lld-struct-definition.patch @@ -0,0 +1,50 @@ +From 912f7c6f7fac273f40e621447cf17d14b50d6e5b Mon Sep 17 00:00:00 2001 +From: Tudor Ambarus +Date: Wed, 15 Dec 2021 13:01:13 +0200 +Subject: dmaengine: at_xdmac: Fix at_xdmac_lld struct definition + +From: Tudor Ambarus + +commit 912f7c6f7fac273f40e621447cf17d14b50d6e5b upstream. + +The hardware channel next descriptor view structure contains just +fields of 32 bits, while dma_addr_t can be of type u64 or u32 +depending on CONFIG_ARCH_DMA_ADDR_T_64BIT. Force u32 to comply with +what the hardware expects. + +Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver") +Signed-off-by: Tudor Ambarus +Link: https://lore.kernel.org/r/20211215110115.191749-11-tudor.ambarus@microchip.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/at_xdmac.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +--- a/drivers/dma/at_xdmac.c ++++ b/drivers/dma/at_xdmac.c +@@ -221,15 +221,15 @@ struct at_xdmac { + + /* Linked List Descriptor */ + struct at_xdmac_lld { +- dma_addr_t mbr_nda; /* Next Descriptor Member */ +- u32 mbr_ubc; /* Microblock Control Member */ +- dma_addr_t mbr_sa; /* Source Address Member */ +- dma_addr_t mbr_da; /* Destination Address Member */ +- u32 mbr_cfg; /* Configuration Register */ +- u32 mbr_bc; /* Block Control Register */ +- u32 mbr_ds; /* Data Stride Register */ +- u32 mbr_sus; /* Source Microblock Stride Register */ +- u32 mbr_dus; /* Destination Microblock Stride Register */ ++ u32 mbr_nda; /* Next Descriptor Member */ ++ u32 mbr_ubc; /* Microblock Control Member */ ++ u32 mbr_sa; /* Source Address Member */ ++ u32 mbr_da; /* Destination Address Member */ ++ u32 mbr_cfg; /* Configuration Register */ ++ u32 mbr_bc; /* Block Control Register */ ++ u32 mbr_ds; /* Data Stride Register */ ++ u32 mbr_sus; /* Source Microblock Stride Register */ ++ u32 mbr_dus; /* Destination Microblock Stride Register */ + }; + + /* 64-bit alignment needed to update CNDA and CUBC registers in an atomic way. */ diff --git a/queue-5.4/dmaengine-at_xdmac-fix-concurrency-over-xfers_list.patch b/queue-5.4/dmaengine-at_xdmac-fix-concurrency-over-xfers_list.patch new file mode 100644 index 00000000000..e5a223e2951 --- /dev/null +++ b/queue-5.4/dmaengine-at_xdmac-fix-concurrency-over-xfers_list.patch @@ -0,0 +1,50 @@ +From 18deddea9184b62941395889ff7659529c877326 Mon Sep 17 00:00:00 2001 +From: Tudor Ambarus +Date: Wed, 15 Dec 2021 13:01:10 +0200 +Subject: dmaengine: at_xdmac: Fix concurrency over xfers_list + +From: Tudor Ambarus + +commit 18deddea9184b62941395889ff7659529c877326 upstream. + +Since tx_submit can be called from a hard IRQ, xfers_list must be +protected with a lock to avoid concurency on the list's elements. +Since at_xdmac_handle_cyclic() is called from a tasklet, spin_lock_irq +is enough to protect from a hard IRQ. + +Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver") +Signed-off-by: Tudor Ambarus +Link: https://lore.kernel.org/r/20211215110115.191749-8-tudor.ambarus@microchip.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/at_xdmac.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +--- a/drivers/dma/at_xdmac.c ++++ b/drivers/dma/at_xdmac.c +@@ -1564,14 +1564,17 @@ static void at_xdmac_handle_cyclic(struc + struct at_xdmac_desc *desc; + struct dma_async_tx_descriptor *txd; + +- if (!list_empty(&atchan->xfers_list)) { +- desc = list_first_entry(&atchan->xfers_list, +- struct at_xdmac_desc, xfer_node); +- txd = &desc->tx_dma_desc; +- +- if (txd->flags & DMA_PREP_INTERRUPT) +- dmaengine_desc_get_callback_invoke(txd, NULL); ++ spin_lock_irq(&atchan->lock); ++ if (list_empty(&atchan->xfers_list)) { ++ spin_unlock_irq(&atchan->lock); ++ return; + } ++ desc = list_first_entry(&atchan->xfers_list, struct at_xdmac_desc, ++ xfer_node); ++ spin_unlock_irq(&atchan->lock); ++ txd = &desc->tx_dma_desc; ++ if (txd->flags & DMA_PREP_INTERRUPT) ++ dmaengine_desc_get_callback_invoke(txd, NULL); + } + + static void at_xdmac_handle_error(struct at_xdmac_chan *atchan) diff --git a/queue-5.4/dmaengine-at_xdmac-fix-lld-view-setting.patch b/queue-5.4/dmaengine-at_xdmac-fix-lld-view-setting.patch new file mode 100644 index 00000000000..a461e95e0ce --- /dev/null +++ b/queue-5.4/dmaengine-at_xdmac-fix-lld-view-setting.patch @@ -0,0 +1,41 @@ +From 1385eb4d14d447cc5d744bc2ac34f43be66c9963 Mon Sep 17 00:00:00 2001 +From: Tudor Ambarus +Date: Wed, 15 Dec 2021 13:01:12 +0200 +Subject: dmaengine: at_xdmac: Fix lld view setting + +From: Tudor Ambarus + +commit 1385eb4d14d447cc5d744bc2ac34f43be66c9963 upstream. + +AT_XDMAC_CNDC_NDVIEW_NDV3 was set even for AT_XDMAC_MBR_UBC_NDV2, +because of the wrong bit handling. Fix it. + +Fixes: ee0fe35c8dcd ("dmaengine: xdmac: Handle descriptor's view 3 registers") +Signed-off-by: Tudor Ambarus +Link: https://lore.kernel.org/r/20211215110115.191749-10-tudor.ambarus@microchip.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/at_xdmac.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/dma/at_xdmac.c ++++ b/drivers/dma/at_xdmac.c +@@ -89,6 +89,7 @@ + #define AT_XDMAC_CNDC_NDE (0x1 << 0) /* Channel x Next Descriptor Enable */ + #define AT_XDMAC_CNDC_NDSUP (0x1 << 1) /* Channel x Next Descriptor Source Update */ + #define AT_XDMAC_CNDC_NDDUP (0x1 << 2) /* Channel x Next Descriptor Destination Update */ ++#define AT_XDMAC_CNDC_NDVIEW_MASK GENMASK(28, 27) + #define AT_XDMAC_CNDC_NDVIEW_NDV0 (0x0 << 3) /* Channel x Next Descriptor View 0 */ + #define AT_XDMAC_CNDC_NDVIEW_NDV1 (0x1 << 3) /* Channel x Next Descriptor View 1 */ + #define AT_XDMAC_CNDC_NDVIEW_NDV2 (0x2 << 3) /* Channel x Next Descriptor View 2 */ +@@ -353,7 +354,8 @@ static void at_xdmac_start_xfer(struct a + */ + if (at_xdmac_chan_is_cyclic(atchan)) + reg = AT_XDMAC_CNDC_NDVIEW_NDV1; +- else if (first->lld.mbr_ubc & AT_XDMAC_MBR_UBC_NDV3) ++ else if ((first->lld.mbr_ubc & ++ AT_XDMAC_CNDC_NDVIEW_MASK) == AT_XDMAC_MBR_UBC_NDV3) + reg = AT_XDMAC_CNDC_NDVIEW_NDV3; + else + reg = AT_XDMAC_CNDC_NDVIEW_NDV2; diff --git a/queue-5.4/dmaengine-at_xdmac-print-debug-message-after-realeasing-the-lock.patch b/queue-5.4/dmaengine-at_xdmac-print-debug-message-after-realeasing-the-lock.patch new file mode 100644 index 00000000000..b1bc78af2ee --- /dev/null +++ b/queue-5.4/dmaengine-at_xdmac-print-debug-message-after-realeasing-the-lock.patch @@ -0,0 +1,38 @@ +From 5edc24ac876a928f36f407a0fcdb33b94a3a210f Mon Sep 17 00:00:00 2001 +From: Tudor Ambarus +Date: Wed, 15 Dec 2021 13:01:06 +0200 +Subject: dmaengine: at_xdmac: Print debug message after realeasing the lock + +From: Tudor Ambarus + +commit 5edc24ac876a928f36f407a0fcdb33b94a3a210f upstream. + +It is desirable to do the prints without the lock held if possible, so +move the print after the lock is released. + +Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver") +Signed-off-by: Tudor Ambarus +Link: https://lore.kernel.org/r/20211215110115.191749-4-tudor.ambarus@microchip.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/at_xdmac.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/dma/at_xdmac.c ++++ b/drivers/dma/at_xdmac.c +@@ -424,10 +424,12 @@ static dma_cookie_t at_xdmac_tx_submit(s + spin_lock_irqsave(&atchan->lock, irqflags); + cookie = dma_cookie_assign(tx); + +- dev_vdbg(chan2dev(tx->chan), "%s: atchan 0x%p, add desc 0x%p to xfers_list\n", +- __func__, atchan, desc); + list_add_tail(&desc->xfer_node, &atchan->xfers_list); + spin_unlock_irqrestore(&atchan->lock, irqflags); ++ ++ dev_vdbg(chan2dev(tx->chan), "%s: atchan 0x%p, add desc 0x%p to xfers_list\n", ++ __func__, atchan, desc); ++ + return cookie; + } + diff --git a/queue-5.4/gre-don-t-accidentally-set-rto_onlink-in-gre_fill_metadata_dst.patch b/queue-5.4/gre-don-t-accidentally-set-rto_onlink-in-gre_fill_metadata_dst.patch new file mode 100644 index 00000000000..10ff586da9e --- /dev/null +++ b/queue-5.4/gre-don-t-accidentally-set-rto_onlink-in-gre_fill_metadata_dst.patch @@ -0,0 +1,38 @@ +From f7716b318568b22fbf0e3be99279a979e217cf71 Mon Sep 17 00:00:00 2001 +From: Guillaume Nault +Date: Mon, 10 Jan 2022 14:43:09 +0100 +Subject: gre: Don't accidentally set RTO_ONLINK in gre_fill_metadata_dst() + +From: Guillaume Nault + +commit f7716b318568b22fbf0e3be99279a979e217cf71 upstream. + +Mask the ECN bits before initialising ->flowi4_tos. The tunnel key may +have the last ECN bit set, which will interfere with the route lookup +process as ip_route_output_key_hash() interpretes this bit specially +(to restrict the route scope). + +Found by code inspection, compile tested only. + +Fixes: 962924fa2b7a ("ip_gre: Refactor collect metatdata mode tunnel xmit to ip_md_tunnel_xmit") +Signed-off-by: Guillaume Nault +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/ip_gre.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -577,8 +577,9 @@ static int gre_fill_metadata_dst(struct + + key = &info->key; + ip_tunnel_init_flow(&fl4, IPPROTO_GRE, key->u.ipv4.dst, key->u.ipv4.src, +- tunnel_id_to_key32(key->tun_id), key->tos, 0, +- skb->mark, skb_get_hash(skb)); ++ tunnel_id_to_key32(key->tun_id), ++ key->tos & ~INET_ECN_MASK, 0, skb->mark, ++ skb_get_hash(skb)); + rt = ip_route_output_key(dev_net(dev), &fl4); + if (IS_ERR(rt)) + return PTR_ERR(rt); diff --git a/queue-5.4/inet-frags-annotate-races-around-fqdir-dead-and-fqdir-high_thresh.patch b/queue-5.4/inet-frags-annotate-races-around-fqdir-dead-and-fqdir-high_thresh.patch new file mode 100644 index 00000000000..09e069ea45d --- /dev/null +++ b/queue-5.4/inet-frags-annotate-races-around-fqdir-dead-and-fqdir-high_thresh.patch @@ -0,0 +1,94 @@ +From 91341fa0003befd097e190ec2a4bf63ad957c49a Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Thu, 13 Jan 2022 01:22:29 -0800 +Subject: inet: frags: annotate races around fqdir->dead and fqdir->high_thresh + +From: Eric Dumazet + +commit 91341fa0003befd097e190ec2a4bf63ad957c49a upstream. + +Both fields can be read/written without synchronization, +add proper accessors and documentation. + +Fixes: d5dd88794a13 ("inet: fix various use-after-free in defrags units") +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/net/inet_frag.h | 11 +++++++++-- + include/net/ipv6_frag.h | 3 ++- + net/ipv4/inet_fragment.c | 8 +++++--- + net/ipv4/ip_fragment.c | 3 ++- + 4 files changed, 18 insertions(+), 7 deletions(-) + +--- a/include/net/inet_frag.h ++++ b/include/net/inet_frag.h +@@ -116,8 +116,15 @@ int fqdir_init(struct fqdir **fqdirp, st + + static inline void fqdir_pre_exit(struct fqdir *fqdir) + { +- fqdir->high_thresh = 0; /* prevent creation of new frags */ +- fqdir->dead = true; ++ /* Prevent creation of new frags. ++ * Pairs with READ_ONCE() in inet_frag_find(). ++ */ ++ WRITE_ONCE(fqdir->high_thresh, 0); ++ ++ /* Pairs with READ_ONCE() in inet_frag_kill(), ip_expire() ++ * and ip6frag_expire_frag_queue(). ++ */ ++ WRITE_ONCE(fqdir->dead, true); + } + void fqdir_exit(struct fqdir *fqdir); + +--- a/include/net/ipv6_frag.h ++++ b/include/net/ipv6_frag.h +@@ -67,7 +67,8 @@ ip6frag_expire_frag_queue(struct net *ne + struct sk_buff *head; + + rcu_read_lock(); +- if (fq->q.fqdir->dead) ++ /* Paired with the WRITE_ONCE() in fqdir_pre_exit(). */ ++ if (READ_ONCE(fq->q.fqdir->dead)) + goto out_rcu_unlock; + spin_lock(&fq->q.lock); + +--- a/net/ipv4/inet_fragment.c ++++ b/net/ipv4/inet_fragment.c +@@ -204,9 +204,9 @@ void inet_frag_kill(struct inet_frag_que + /* The RCU read lock provides a memory barrier + * guaranteeing that if fqdir->dead is false then + * the hash table destruction will not start until +- * after we unlock. Paired with inet_frags_exit_net(). ++ * after we unlock. Paired with fqdir_pre_exit(). + */ +- if (!fqdir->dead) { ++ if (!READ_ONCE(fqdir->dead)) { + rhashtable_remove_fast(&fqdir->rhashtable, &fq->node, + fqdir->f->rhash_params); + refcount_dec(&fq->refcnt); +@@ -321,9 +321,11 @@ static struct inet_frag_queue *inet_frag + /* TODO : call from rcu_read_lock() and no longer use refcount_inc_not_zero() */ + struct inet_frag_queue *inet_frag_find(struct fqdir *fqdir, void *key) + { ++ /* This pairs with WRITE_ONCE() in fqdir_pre_exit(). */ ++ long high_thresh = READ_ONCE(fqdir->high_thresh); + struct inet_frag_queue *fq = NULL, *prev; + +- if (!fqdir->high_thresh || frag_mem_limit(fqdir) > fqdir->high_thresh) ++ if (!high_thresh || frag_mem_limit(fqdir) > high_thresh) + return NULL; + + rcu_read_lock(); +--- a/net/ipv4/ip_fragment.c ++++ b/net/ipv4/ip_fragment.c +@@ -144,7 +144,8 @@ static void ip_expire(struct timer_list + + rcu_read_lock(); + +- if (qp->q.fqdir->dead) ++ /* Paired with WRITE_ONCE() in fqdir_pre_exit(). */ ++ if (READ_ONCE(qp->q.fqdir->dead)) + goto out_rcu_unlock; + + spin_lock(&qp->q.lock); diff --git a/queue-5.4/libcxgb-don-t-accidentally-set-rto_onlink-in-cxgb_find_route.patch b/queue-5.4/libcxgb-don-t-accidentally-set-rto_onlink-in-cxgb_find_route.patch new file mode 100644 index 00000000000..8da60fd020d --- /dev/null +++ b/queue-5.4/libcxgb-don-t-accidentally-set-rto_onlink-in-cxgb_find_route.patch @@ -0,0 +1,44 @@ +From a915deaa9abe4fb3a440312c954253a6a733608e Mon Sep 17 00:00:00 2001 +From: Guillaume Nault +Date: Mon, 10 Jan 2022 14:43:11 +0100 +Subject: libcxgb: Don't accidentally set RTO_ONLINK in cxgb_find_route() + +From: Guillaume Nault + +commit a915deaa9abe4fb3a440312c954253a6a733608e upstream. + +Mask the ECN bits before calling ip_route_output_ports(). The tos +variable might be passed directly from an IPv4 header, so it may have +the last ECN bit set. This interferes with the route lookup process as +ip_route_output_key_hash() interpretes this bit specially (to restrict +the route scope). + +Found by code inspection, compile tested only. + +Fixes: 804c2f3e36ef ("libcxgb,iw_cxgb4,cxgbit: add cxgb_find_route()") +Signed-off-by: Guillaume Nault +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c ++++ b/drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c +@@ -32,6 +32,7 @@ + + #include + #include ++#include + #include + #include + +@@ -99,7 +100,7 @@ cxgb_find_route(struct cxgb4_lld_info *l + + rt = ip_route_output_ports(&init_net, &fl4, NULL, peer_ip, local_ip, + peer_port, local_port, IPPROTO_TCP, +- tos, 0); ++ tos & ~INET_ECN_MASK, 0); + if (IS_ERR(rt)) + return NULL; + n = dst_neigh_lookup(&rt->dst, &peer_ip); diff --git a/queue-5.4/net-axienet-fix-number-of-tx-ring-slots-for-available-check.patch b/queue-5.4/net-axienet-fix-number-of-tx-ring-slots-for-available-check.patch new file mode 100644 index 00000000000..14d5dea432a --- /dev/null +++ b/queue-5.4/net-axienet-fix-number-of-tx-ring-slots-for-available-check.patch @@ -0,0 +1,41 @@ +From aba57a823d2985a2cc8c74a2535f3a88e68d9424 Mon Sep 17 00:00:00 2001 +From: Robert Hancock +Date: Tue, 18 Jan 2022 15:41:30 -0600 +Subject: net: axienet: fix number of TX ring slots for available check + +From: Robert Hancock + +commit aba57a823d2985a2cc8c74a2535f3a88e68d9424 upstream. + +The check for the number of available TX ring slots was off by 1 since a +slot is required for the skb header as well as each fragment. This could +result in overwriting a TX ring slot that was still in use. + +Fixes: 8a3b7a252dca9 ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethernet driver") +Signed-off-by: Robert Hancock +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c ++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +@@ -636,7 +636,7 @@ axienet_start_xmit(struct sk_buff *skb, + num_frag = skb_shinfo(skb)->nr_frags; + cur_p = &lp->tx_bd_v[lp->tx_bd_tail]; + +- if (axienet_check_tx_bd_space(lp, num_frag)) { ++ if (axienet_check_tx_bd_space(lp, num_frag + 1)) { + if (netif_queue_stopped(ndev)) + return NETDEV_TX_BUSY; + +@@ -646,7 +646,7 @@ axienet_start_xmit(struct sk_buff *skb, + smp_mb(); + + /* Space might have just been freed - check again */ +- if (axienet_check_tx_bd_space(lp, num_frag)) ++ if (axienet_check_tx_bd_space(lp, num_frag + 1)) + return NETDEV_TX_BUSY; + + netif_wake_queue(ndev); diff --git a/queue-5.4/net-axienet-increase-default-tx-ring-size-to-128.patch b/queue-5.4/net-axienet-increase-default-tx-ring-size-to-128.patch new file mode 100644 index 00000000000..bc1f0930a73 --- /dev/null +++ b/queue-5.4/net-axienet-increase-default-tx-ring-size-to-128.patch @@ -0,0 +1,35 @@ +From 2d19c3fd80178160dd505ccd7fed1643831227a5 Mon Sep 17 00:00:00 2001 +From: Robert Hancock +Date: Tue, 18 Jan 2022 15:41:32 -0600 +Subject: net: axienet: increase default TX ring size to 128 + +From: Robert Hancock + +commit 2d19c3fd80178160dd505ccd7fed1643831227a5 upstream. + +With previous changes to make the driver handle the TX ring size more +correctly, the default TX ring size of 64 appears to significantly +bottleneck TX performance to around 600 Mbps on a 1 Gbps link on ZynqMP. +Increasing this to 128 seems to bring performance up to near line rate and +shouldn't cause excess bufferbloat (this driver doesn't yet support modern +byte-based queue management). + +Fixes: 8a3b7a252dca9 ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethernet driver") +Signed-off-by: Robert Hancock +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c ++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +@@ -41,7 +41,7 @@ + #include "xilinx_axienet.h" + + /* Descriptors defines for Tx and Rx DMA */ +-#define TX_BD_NUM_DEFAULT 64 ++#define TX_BD_NUM_DEFAULT 128 + #define RX_BD_NUM_DEFAULT 1024 + #define TX_BD_NUM_MIN (MAX_SKB_FRAGS + 1) + #define TX_BD_NUM_MAX 4096 diff --git a/queue-5.4/net-axienet-limit-minimum-tx-ring-size.patch b/queue-5.4/net-axienet-limit-minimum-tx-ring-size.patch new file mode 100644 index 00000000000..251ac85f076 --- /dev/null +++ b/queue-5.4/net-axienet-limit-minimum-tx-ring-size.patch @@ -0,0 +1,42 @@ +From 70f5817deddbc6ef3faa35841cab83c280cc653a Mon Sep 17 00:00:00 2001 +From: Robert Hancock +Date: Tue, 18 Jan 2022 15:41:28 -0600 +Subject: net: axienet: limit minimum TX ring size + +From: Robert Hancock + +commit 70f5817deddbc6ef3faa35841cab83c280cc653a upstream. + +The driver will not work properly if the TX ring size is set to below +MAX_SKB_FRAGS + 1 since it needs to hold at least one full maximally +fragmented packet in the TX ring. Limit setting the ring size to below +this value. + +Fixes: 8b09ca823ffb4 ("net: axienet: Make RX/TX ring sizes configurable") +Signed-off-by: Robert Hancock +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c ++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +@@ -43,6 +43,7 @@ + /* Descriptors defines for Tx and Rx DMA */ + #define TX_BD_NUM_DEFAULT 64 + #define RX_BD_NUM_DEFAULT 1024 ++#define TX_BD_NUM_MIN (MAX_SKB_FRAGS + 1) + #define TX_BD_NUM_MAX 4096 + #define RX_BD_NUM_MAX 4096 + +@@ -1223,7 +1224,8 @@ static int axienet_ethtools_set_ringpara + if (ering->rx_pending > RX_BD_NUM_MAX || + ering->rx_mini_pending || + ering->rx_jumbo_pending || +- ering->rx_pending > TX_BD_NUM_MAX) ++ ering->tx_pending < TX_BD_NUM_MIN || ++ ering->tx_pending > TX_BD_NUM_MAX) + return -EINVAL; + + if (netif_running(ndev)) diff --git a/queue-5.4/net-ethernet-mtk_eth_soc-fix-error-checking-in-mtk_mac_config.patch b/queue-5.4/net-ethernet-mtk_eth_soc-fix-error-checking-in-mtk_mac_config.patch new file mode 100644 index 00000000000..96f47ac8631 --- /dev/null +++ b/queue-5.4/net-ethernet-mtk_eth_soc-fix-error-checking-in-mtk_mac_config.patch @@ -0,0 +1,37 @@ +From 214b3369ab9b0a6f28d6c970220c209417edbc65 Mon Sep 17 00:00:00 2001 +From: Tom Rix +Date: Sat, 15 Jan 2022 09:49:18 -0800 +Subject: net: ethernet: mtk_eth_soc: fix error checking in mtk_mac_config() + +From: Tom Rix + +commit 214b3369ab9b0a6f28d6c970220c209417edbc65 upstream. + +Clang static analysis reports this problem +mtk_eth_soc.c:394:7: warning: Branch condition evaluates + to a garbage value + if (err) + ^~~ + +err is not initialized and only conditionally set. +So intitialize err. + +Fixes: 7e538372694b ("net: ethernet: mediatek: Re-add support SGMII") +Signed-off-by: Tom Rix +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +@@ -215,7 +215,7 @@ static void mtk_mac_config(struct phylin + phylink_config); + struct mtk_eth *eth = mac->hw; + u32 mcr_cur, mcr_new, sid, i; +- int val, ge_mode, err; ++ int val, ge_mode, err = 0; + + /* MT76x8 has no hardware settings between for the MAC */ + if (!MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628) && diff --git a/queue-5.4/net_sched-restore-mpu-xxx-handling.patch b/queue-5.4/net_sched-restore-mpu-xxx-handling.patch new file mode 100644 index 00000000000..63f8e674008 --- /dev/null +++ b/queue-5.4/net_sched-restore-mpu-xxx-handling.patch @@ -0,0 +1,99 @@ +From fb80445c438c78b40b547d12b8d56596ce4ccfeb Mon Sep 17 00:00:00 2001 +From: Kevin Bracey +Date: Wed, 12 Jan 2022 19:02:10 +0200 +Subject: net_sched: restore "mpu xxx" handling + +From: Kevin Bracey + +commit fb80445c438c78b40b547d12b8d56596ce4ccfeb upstream. + +commit 56b765b79e9a ("htb: improved accuracy at high rates") broke +"overhead X", "linklayer atm" and "mpu X" attributes. + +"overhead X" and "linklayer atm" have already been fixed. This restores +the "mpu X" handling, as might be used by DOCSIS or Ethernet shaping: + + tc class add ... htb rate X overhead 4 mpu 64 + +The code being fixed is used by htb, tbf and act_police. Cake has its +own mpu handling. qdisc_calculate_pkt_len still uses the size table +containing values adjusted for mpu by user space. + +iproute2 tc has always passed mpu into the kernel via a tc_ratespec +structure, but the kernel never directly acted on it, merely stored it +so that it could be read back by `tc class show`. + +Rather, tc would generate length-to-time tables that included the mpu +(and linklayer) in their construction, and the kernel used those tables. + +Since v3.7, the tables were no longer used. Along with "mpu", this also +broke "overhead" and "linklayer" which were fixed in 01cb71d2d47b +("net_sched: restore "overhead xxx" handling", v3.10) and 8a8e3d84b171 +("net_sched: restore "linklayer atm" handling", v3.11). + +"overhead" was fixed by simply restoring use of tc_ratespec::overhead - +this had originally been used by the kernel but was initially omitted +from the new non-table-based calculations. + +"linklayer" had been handled in the table like "mpu", but the mode was +not originally passed in tc_ratespec. The new implementation was made to +handle it by getting new versions of tc to pass the mode in an extended +tc_ratespec, and for older versions of tc the table contents were analysed +at load time to deduce linklayer. + +As "mpu" has always been given to the kernel in tc_ratespec, +accompanying the mpu-based table, we can restore system functionality +with no userspace change by making the kernel act on the tc_ratespec +value. + +Fixes: 56b765b79e9a ("htb: improved accuracy at high rates") +Signed-off-by: Kevin Bracey +Cc: Eric Dumazet +Cc: Jiri Pirko +Cc: Vimalkumar +Link: https://lore.kernel.org/r/20220112170210.1014351-1-kevin@bracey.fi +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + include/net/sch_generic.h | 5 +++++ + net/sched/sch_generic.c | 1 + + 2 files changed, 6 insertions(+) + +--- a/include/net/sch_generic.h ++++ b/include/net/sch_generic.h +@@ -1264,6 +1264,7 @@ struct psched_ratecfg { + u64 rate_bytes_ps; /* bytes per second */ + u32 mult; + u16 overhead; ++ u16 mpu; + u8 linklayer; + u8 shift; + }; +@@ -1273,6 +1274,9 @@ static inline u64 psched_l2t_ns(const st + { + len += r->overhead; + ++ if (len < r->mpu) ++ len = r->mpu; ++ + if (unlikely(r->linklayer == TC_LINKLAYER_ATM)) + return ((u64)(DIV_ROUND_UP(len,48)*53) * r->mult) >> r->shift; + +@@ -1295,6 +1299,7 @@ static inline void psched_ratecfg_getrat + res->rate = min_t(u64, r->rate_bytes_ps, ~0U); + + res->overhead = r->overhead; ++ res->mpu = r->mpu; + res->linklayer = (r->linklayer & TC_LINKLAYER_MASK); + } + +--- a/net/sched/sch_generic.c ++++ b/net/sched/sch_generic.c +@@ -1396,6 +1396,7 @@ void psched_ratecfg_precompute(struct ps + { + memset(r, 0, sizeof(*r)); + r->overhead = conf->overhead; ++ r->mpu = conf->mpu; + r->rate_bytes_ps = max_t(u64, conf->rate, rate64); + r->linklayer = (conf->linklayer & TC_LINKLAYER_MASK); + r->mult = 1; diff --git a/queue-5.4/netns-add-schedule-point-in-ops_exit_list.patch b/queue-5.4/netns-add-schedule-point-in-ops_exit_list.patch new file mode 100644 index 00000000000..b904468482a --- /dev/null +++ b/queue-5.4/netns-add-schedule-point-in-ops_exit_list.patch @@ -0,0 +1,47 @@ +From 2836615aa22de55b8fca5e32fe1b27a67cda625e Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Tue, 18 Jan 2022 03:43:40 -0800 +Subject: netns: add schedule point in ops_exit_list() + +From: Eric Dumazet + +commit 2836615aa22de55b8fca5e32fe1b27a67cda625e upstream. + +When under stress, cleanup_net() can have to dismantle +netns in big numbers. ops_exit_list() currently calls +many helpers [1] that have no schedule point, and we can +end up with soft lockups, particularly on hosts +with many cpus. + +Even for moderate amount of netns processed by cleanup_net() +this patch avoids latency spikes. + +[1] Some of these helpers like fib_sync_up() and fib_sync_down_dev() +are very slow because net/ipv4/fib_semantics.c uses host-wide hash tables, +and ifindex is used as the only input of two hash functions. + ifindexes tend to be the same for all netns (lo.ifindex==1 per instance) + This will be fixed in a separate patch. + +Fixes: 72ad937abd0a ("net: Add support for batching network namespace cleanups") +Signed-off-by: Eric Dumazet +Cc: Eric W. Biederman +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/core/net_namespace.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/core/net_namespace.c ++++ b/net/core/net_namespace.c +@@ -168,8 +168,10 @@ static void ops_exit_list(const struct p + { + struct net *net; + if (ops->exit) { +- list_for_each_entry(net, net_exit_list, exit_list) ++ list_for_each_entry(net, net_exit_list, exit_list) { + ops->exit(net); ++ cond_resched(); ++ } + } + if (ops->exit_batch) + ops->exit_batch(net_exit_list); diff --git a/queue-5.4/perf-script-fix-hex-dump-character-output.patch b/queue-5.4/perf-script-fix-hex-dump-character-output.patch new file mode 100644 index 00000000000..d3927e6555b --- /dev/null +++ b/queue-5.4/perf-script-fix-hex-dump-character-output.patch @@ -0,0 +1,63 @@ +From 62942e9fda9fd1def10ffcbd5e1c025b3c9eec17 Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Wed, 12 Jan 2022 10:50:57 +0200 +Subject: perf script: Fix hex dump character output + +From: Adrian Hunter + +commit 62942e9fda9fd1def10ffcbd5e1c025b3c9eec17 upstream. + +Using grep -C with perf script -D can give erroneous results as grep loses +lines due to non-printable characters, for example, below the 0020, 0060 +and 0070 lines are missing: + + $ perf script -D | grep -C10 AUX | head + . 0010: 08 00 00 00 00 00 00 00 1f 00 00 00 00 00 00 00 ................ + . 0030: 01 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 ................ + . 0040: 00 08 00 00 00 00 00 00 02 00 00 00 00 00 00 00 ................ + . 0050: 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................ + . 0080: 02 00 00 00 00 00 00 00 1b 00 00 00 00 00 00 00 ................ + . 0090: 00 00 00 00 00 00 00 00 ........ + + 0 0 0x450 [0x98]: PERF_RECORD_AUXTRACE_INFO type: 1 + PMU Type 8 + Time Shift 31 + +perf's isprint() is a custom implementation from the kernel, but the +kernel's _ctype appears to include characters from Latin-1 Supplement which +is not compatible with, for example, UTF-8. Fix by checking also isascii(). + +After: + + $ tools/perf/perf script -D | grep -C10 AUX | head + . 0010: 08 00 00 00 00 00 00 00 1f 00 00 00 00 00 00 00 ................ + . 0020: 03 84 32 2f 00 00 00 00 63 7c 4f d2 fa ff ff ff ..2/....c|O..... + . 0030: 01 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 ................ + . 0040: 00 08 00 00 00 00 00 00 02 00 00 00 00 00 00 00 ................ + . 0050: 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................ + . 0060: 00 02 00 00 00 00 00 00 00 c0 03 00 00 00 00 00 ................ + . 0070: e2 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 ................ + . 0080: 02 00 00 00 00 00 00 00 1b 00 00 00 00 00 00 00 ................ + . 0090: 00 00 00 00 00 00 00 00 ........ + +Fixes: 3052ba56bcb58904 ("tools perf: Move from sane_ctype.h obtained from git to the Linux's original") +Signed-off-by: Adrian Hunter +Cc: Jiri Olsa +Link: http://lore.kernel.org/lkml/20220112085057.277205-1-adrian.hunter@intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/debug.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/perf/util/debug.c ++++ b/tools/perf/util/debug.c +@@ -143,7 +143,7 @@ static int trace_event_printer(enum bina + break; + case BINARY_PRINT_CHAR_DATA: + printed += color_fprintf(fp, color, "%c", +- isprint(ch) ? ch : '.'); ++ isprint(ch) && isascii(ch) ? ch : '.'); + break; + case BINARY_PRINT_CHAR_PAD: + printed += color_fprintf(fp, color, " "); diff --git a/queue-5.4/rtc-pxa-fix-null-pointer-dereference.patch b/queue-5.4/rtc-pxa-fix-null-pointer-dereference.patch new file mode 100644 index 00000000000..546a46e8863 --- /dev/null +++ b/queue-5.4/rtc-pxa-fix-null-pointer-dereference.patch @@ -0,0 +1,51 @@ +From 34127b3632b21e5c391756e724b1198eb9917981 Mon Sep 17 00:00:00 2001 +From: Laurence de Bruxelles +Date: Sat, 1 Jan 2022 15:41:49 +0000 +Subject: rtc: pxa: fix null pointer dereference + +From: Laurence de Bruxelles + +commit 34127b3632b21e5c391756e724b1198eb9917981 upstream. + +With the latest stable kernel versions the rtc on the PXA based +Zaurus does not work, when booting I see the following kernel messages: + +pxa-rtc pxa-rtc: failed to find rtc clock source +pxa-rtc pxa-rtc: Unable to init SA1100 RTC sub-device +pxa-rtc: probe of pxa-rtc failed with error -2 +hctosys: unable to open rtc device (rtc0) + +I think this is because commit f2997775b111 ("rtc: sa1100: fix possible +race condition") moved the allocation of the rtc_device struct out of +sa1100_rtc_init and into sa1100_rtc_probe. This means that pxa_rtc_probe +also needs to do allocation for the rtc_device struct, otherwise +sa1100_rtc_init will try to dereference a null pointer. This patch adds +that allocation by copying how sa1100_rtc_probe in +drivers/rtc/rtc-sa1100.c does it; after the IRQs are set up a managed +rtc_device is allocated. + +I've tested this patch with `qemu-system-arm -machine akita` and with a +real Zaurus SL-C1000 applied to 4.19, 5.4, and 5.10. + +Signed-off-by: Laurence de Bruxelles +Fixes: f2997775b111 ("rtc: sa1100: fix possible race condition") +Signed-off-by: Alexandre Belloni +Link: https://lore.kernel.org/r/20220101154149.12026-1-lfdebrux@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/rtc/rtc-pxa.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/rtc/rtc-pxa.c ++++ b/drivers/rtc/rtc-pxa.c +@@ -330,6 +330,10 @@ static int __init pxa_rtc_probe(struct p + if (sa1100_rtc->irq_alarm < 0) + return -ENXIO; + ++ sa1100_rtc->rtc = devm_rtc_allocate_device(&pdev->dev); ++ if (IS_ERR(sa1100_rtc->rtc)) ++ return PTR_ERR(sa1100_rtc->rtc); ++ + pxa_rtc->base = devm_ioremap(dev, pxa_rtc->ress->start, + resource_size(pxa_rtc->ress)); + if (!pxa_rtc->base) { diff --git a/queue-5.4/series b/queue-5.4/series index d88c8eca8d1..45f811ae8a4 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -293,3 +293,22 @@ parisc-pdc_stable-fix-memory-leak-in-pdcs_register_pathentries.patch f2fs-fix-to-reserve-space-for-io-align-feature.patch af_unix-annote-lockless-accesses-to-unix_tot_inflight-gc_in_progress.patch clk-si5341-fix-clock-hw-provider-cleanup.patch +net-axienet-limit-minimum-tx-ring-size.patch +net-axienet-fix-number-of-tx-ring-slots-for-available-check.patch +net-axienet-increase-default-tx-ring-size-to-128.patch +rtc-pxa-fix-null-pointer-dereference.patch +inet-frags-annotate-races-around-fqdir-dead-and-fqdir-high_thresh.patch +netns-add-schedule-point-in-ops_exit_list.patch +xfrm-don-t-accidentally-set-rto_onlink-in-decode_session4.patch +gre-don-t-accidentally-set-rto_onlink-in-gre_fill_metadata_dst.patch +libcxgb-don-t-accidentally-set-rto_onlink-in-cxgb_find_route.patch +perf-script-fix-hex-dump-character-output.patch +dmaengine-at_xdmac-don-t-start-transactions-at-tx_submit-level.patch +dmaengine-at_xdmac-print-debug-message-after-realeasing-the-lock.patch +dmaengine-at_xdmac-fix-concurrency-over-xfers_list.patch +dmaengine-at_xdmac-fix-lld-view-setting.patch +dmaengine-at_xdmac-fix-at_xdmac_lld-struct-definition.patch +arm64-dts-qcom-msm8996-drop-not-documented-adreno-properties.patch +net_sched-restore-mpu-xxx-handling.patch +bcmgenet-add-wol-irq-check.patch +net-ethernet-mtk_eth_soc-fix-error-checking-in-mtk_mac_config.patch diff --git a/queue-5.4/xfrm-don-t-accidentally-set-rto_onlink-in-decode_session4.patch b/queue-5.4/xfrm-don-t-accidentally-set-rto_onlink-in-decode_session4.patch new file mode 100644 index 00000000000..66b139a63d1 --- /dev/null +++ b/queue-5.4/xfrm-don-t-accidentally-set-rto_onlink-in-decode_session4.patch @@ -0,0 +1,47 @@ +From 23e7b1bfed61e301853b5e35472820d919498278 Mon Sep 17 00:00:00 2001 +From: Guillaume Nault +Date: Mon, 10 Jan 2022 14:43:06 +0100 +Subject: xfrm: Don't accidentally set RTO_ONLINK in decode_session4() + +From: Guillaume Nault + +commit 23e7b1bfed61e301853b5e35472820d919498278 upstream. + +Similar to commit 94e2238969e8 ("xfrm4: strip ECN bits from tos field"), +clear the ECN bits from iph->tos when setting ->flowi4_tos. +This ensures that the last bit of ->flowi4_tos is cleared, so +ip_route_output_key_hash() isn't going to restrict the scope of the +route lookup. + +Use ~INET_ECN_MASK instead of IPTOS_RT_MASK, because we have no reason +to clear the high order bits. + +Found by code inspection, compile tested only. + +Fixes: 4da3089f2b58 ("[IPSEC]: Use TOS when doing tunnel lookups") +Signed-off-by: Guillaume Nault +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/xfrm/xfrm_policy.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -31,6 +31,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -3282,7 +3283,7 @@ decode_session4(struct sk_buff *skb, str + fl4->flowi4_proto = iph->protocol; + fl4->daddr = reverse ? iph->saddr : iph->daddr; + fl4->saddr = reverse ? iph->daddr : iph->saddr; +- fl4->flowi4_tos = iph->tos; ++ fl4->flowi4_tos = iph->tos & ~INET_ECN_MASK; + + if (!ip_is_fragment(iph)) { + switch (iph->protocol) {