From: Greg Kroah-Hartman Date: Mon, 22 Aug 2022 13:13:54 +0000 (+0200) Subject: 5.19-stable patches X-Git-Tag: v4.9.326~33 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3681b76b6680c5c41c24ee1e0235efd3b4332cb8;p=thirdparty%2Fkernel%2Fstable-queue.git 5.19-stable patches added patches: blk-mq-run-queue-no-matter-whether-the-request-is-the-last-request.patch dt-bindings-display-sun4i-add-d1-tcons-to-conditionals.patch fec-fix-timer-capture-timing-in-fec_ptp_enable_pps.patch gcc-plugins-undefine-latent_entropy_plugin-when-plugin-disabled-for-a-file.patch i2c-imx-make-sure-to-unregister-adapter-on-remove.patch i40e-fix-to-stop-tx_timeout-recovery-if-globr-fails.patch i40e-fix-tunnel-checksum-offload-with-fragmented-traffic.patch ice-fix-call-trace-with-null-vsi-during-vf-reset.patch ice-fix-clearing-of-promisc-mode-with-bridge-over-bond.patch ice-fix-double-vlan-error-when-entering-promisc-mode.patch ice-fix-vf-not-able-to-send-tagged-traffic-with-no-vlan-filters.patch ice-fix-vsi-rebuild-warn_on-check-for-vf.patch ice-ignore-eexist-when-setting-promisc-mode.patch ice-ignore-error-message-when-setting-same-promiscuous-mode.patch igb-add-lock-to-avoid-data-race.patch kbuild-fix-the-modules-order-between-drivers-and-libs.patch mlxsw-spectrum-clear-ptp-configuration-after-unregistering-the-netdevice.patch modpost-fix-module-versioning-when-a-symbol-lacks-valid-crc.patch net-dsa-don-t-warn-in-dsa_port_set_state_now-when-driver-doesn-t-support-it.patch net-dsa-felix-fix-ethtool-256-511-and-512-1023-tx-packet-counters.patch net-dsa-microchip-ksz9477-fix-fdb_dump-last-invalid-entry.patch net-dsa-mv88e6060-prevent-crash-on-an-unused-port.patch net-dsa-sja1105-fix-buffer-overflow-in-sja1105_setup_devlink_regions.patch net-fix-potential-refcount-leak-in-ndisc_router_discovery.patch net-genl-fix-error-path-memory-leak-in-policy-dumping.patch net-moxa-pass-pdev-instead-of-ndev-to-dma-functions.patch net-mscc-ocelot-fix-address-of-sys_count_tx_aging-counter.patch net-mscc-ocelot-fix-incorrect-ndo_get_stats64-packet-counters.patch net-qrtr-start-mhi-channel-after-endpoit-creation.patch net-rtnetlink-fix-module-reference-count-leak-issue-in-rtnetlink_rcv_msg.patch net-sched-fix-misuse-of-qcpu-backlog-in-gnet_stats_add_queue_cpu.patch net-sunrpc-fix-potential-memory-leaks-in-rpc_sysfs_xprt_state_change.patch netfilter-nf_ct_ftp-prefer-skb_linearize.patch netfilter-nf_ct_h323-cap-packet-size-at-64k.patch netfilter-nf_ct_irc-cap-packet-search-space-to-4k.patch netfilter-nf_ct_sane-remove-pseudo-skb-linearization.patch netfilter-nf_tables-check-nft_set_concat-flag-if-field_count-is-specified.patch netfilter-nf_tables-disallow-nft_set_elem_catchall-and-nft_set_elem_interval_end.patch netfilter-nf_tables-disallow-nfta_set_elem_key_end-with-nft_set_elem_interval_end-flag.patch netfilter-nf_tables-fix-scheduling-while-atomic-splat.patch netfilter-nf_tables-nfta_set_elem_key_end-requires-concat-and-interval-flags.patch netfilter-nf_tables-possible-module-reference-underflow-in-error-path.patch netfilter-nf_tables-really-skip-inactive-sets-when-allocating-name.patch netfilter-nf_tables-validate-nfta_set_elem_objref-based-on-nft_set_object-flag.patch powerpc-pci-fix-get_phb_number-locking.patch regulator-pca9450-remove-restrictions-for-regulator-name.patch spi-meson-spicc-add-local-pow2-clock-ops-to-preserve-rate-between-messages.patch stmmac-intel-add-a-missing-clk_disable_unprepare-call-in-intel_eth_pci_remove.patch tools-rtla-fix-command-symlinks.patch virtio_net-fix-endian-ness-for-rss.patch --- diff --git a/queue-5.19/blk-mq-run-queue-no-matter-whether-the-request-is-the-last-request.patch b/queue-5.19/blk-mq-run-queue-no-matter-whether-the-request-is-the-last-request.patch new file mode 100644 index 00000000000..b20eb704298 --- /dev/null +++ b/queue-5.19/blk-mq-run-queue-no-matter-whether-the-request-is-the-last-request.patch @@ -0,0 +1,63 @@ +From d3b38596875dbc709b4e721a5873f4663d8a9ea2 Mon Sep 17 00:00:00 2001 +From: Yufen Yu +Date: Wed, 3 Aug 2022 10:33:55 +0800 +Subject: blk-mq: run queue no matter whether the request is the last request + +From: Yufen Yu + +commit d3b38596875dbc709b4e721a5873f4663d8a9ea2 upstream. + +We do test on a virtio scsi device (/dev/sda) and the default mq +scheduler is 'none'. We found a IO hung as following: + +blk_finish_plug + blk_mq_plug_issue_direct + scsi_mq_get_budget + //get budget_token fail and sdev->restarts=1 + + scsi_end_request + scsi_run_queue_async + //sdev->restart=0 and run queue + + blk_mq_request_bypass_insert + //add request to hctx->dispatch list + + //continue to dispath plug list + blk_mq_dispatch_plug_list + blk_mq_try_issue_list_directly + //success issue all requests from plug list + +After .get_budget fail, scsi_mq_get_budget will increase 'restarts'. +Normally, it will run hw queue when io complete and set 'restarts' +as 0. But if we run queue before adding request to the dispatch list +and blk_mq_dispatch_plug_list also success issue all requests, then +on one will run queue, and the request will be stall in the dispatch +list and cannot complete forever. + +It is wrong to use last request of plug list to decide if run queue is +needed since all the remained requests in plug list may be from other +hctxs. To fix the bug, pass run_queue as true always to +blk_mq_request_bypass_insert(). + +Fix-suggested-by: Ming Lei +Signed-off-by: Yufen Yu +Reviewed-by: Ming Lei +Fixes: dc5fc361d891 ("block: attempt direct issue of plug list") +Link: https://lore.kernel.org/r/20220803023355.3687360-1-yuyufen@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + block/blk-mq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -2568,7 +2568,7 @@ static void blk_mq_plug_issue_direct(str + break; + case BLK_STS_RESOURCE: + case BLK_STS_DEV_RESOURCE: +- blk_mq_request_bypass_insert(rq, false, last); ++ blk_mq_request_bypass_insert(rq, false, true); + blk_mq_commit_rqs(hctx, &queued, from_schedule); + return; + default: diff --git a/queue-5.19/dt-bindings-display-sun4i-add-d1-tcons-to-conditionals.patch b/queue-5.19/dt-bindings-display-sun4i-add-d1-tcons-to-conditionals.patch new file mode 100644 index 00000000000..be1fcf70628 --- /dev/null +++ b/queue-5.19/dt-bindings-display-sun4i-add-d1-tcons-to-conditionals.patch @@ -0,0 +1,62 @@ +From 2a29f80e155a9cf40ca8b6648bcdc8422db4c4e4 Mon Sep 17 00:00:00 2001 +From: Samuel Holland +Date: Fri, 12 Aug 2022 02:37:02 -0500 +Subject: dt-bindings: display: sun4i: Add D1 TCONs to conditionals + +From: Samuel Holland + +commit 2a29f80e155a9cf40ca8b6648bcdc8422db4c4e4 upstream. + +When adding the D1 TCON bindings, I missed the conditional blocks that +restrict the binding for TCON LCD vs TCON TV hardware. Add the D1 TCON +variants to the appropriate blocks for DE2 TCON LCDs and TCON TVs. + +Fixes: ae5a5d26c15c ("dt-bindings: display: Add D1 display engine compatibles") +Signed-off-by: Samuel Holland +Acked-by: Krzysztof Kozlowski +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20220812073702.57618-1-samuel@sholland.org +Signed-off-by: Greg Kroah-Hartman +--- + .../devicetree/bindings/display/allwinner,sun4i-a10-tcon.yaml | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/Documentation/devicetree/bindings/display/allwinner,sun4i-a10-tcon.yaml b/Documentation/devicetree/bindings/display/allwinner,sun4i-a10-tcon.yaml +index 4a92a4c7dcd7..f8168986a0a9 100644 +--- a/Documentation/devicetree/bindings/display/allwinner,sun4i-a10-tcon.yaml ++++ b/Documentation/devicetree/bindings/display/allwinner,sun4i-a10-tcon.yaml +@@ -233,6 +233,7 @@ allOf: + - allwinner,sun8i-a83t-tcon-lcd + - allwinner,sun8i-v3s-tcon + - allwinner,sun9i-a80-tcon-lcd ++ - allwinner,sun20i-d1-tcon-lcd + + then: + properties: +@@ -252,6 +253,7 @@ allOf: + - allwinner,sun8i-a83t-tcon-tv + - allwinner,sun8i-r40-tcon-tv + - allwinner,sun9i-a80-tcon-tv ++ - allwinner,sun20i-d1-tcon-tv + + then: + properties: +@@ -278,6 +280,7 @@ allOf: + - allwinner,sun9i-a80-tcon-lcd + - allwinner,sun4i-a10-tcon + - allwinner,sun8i-a83t-tcon-lcd ++ - allwinner,sun20i-d1-tcon-lcd + + then: + required: +@@ -294,6 +297,7 @@ allOf: + - allwinner,sun8i-a23-tcon + - allwinner,sun8i-a33-tcon + - allwinner,sun8i-a83t-tcon-lcd ++ - allwinner,sun20i-d1-tcon-lcd + + then: + properties: +-- +2.37.2 + diff --git a/queue-5.19/fec-fix-timer-capture-timing-in-fec_ptp_enable_pps.patch b/queue-5.19/fec-fix-timer-capture-timing-in-fec_ptp_enable_pps.patch new file mode 100644 index 00000000000..07f4f910b7b --- /dev/null +++ b/queue-5.19/fec-fix-timer-capture-timing-in-fec_ptp_enable_pps.patch @@ -0,0 +1,39 @@ +From 61d5e2a251fb20c2c5e998c3f1d52ed6d5360319 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Cs=C3=B3k=C3=A1s=20Bence?= +Date: Thu, 11 Aug 2022 12:13:49 +0200 +Subject: fec: Fix timer capture timing in `fec_ptp_enable_pps()` +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Csókás Bence + +commit 61d5e2a251fb20c2c5e998c3f1d52ed6d5360319 upstream. + +Code reimplements functionality already in `fec_ptp_read()`, +but misses check for FEC_QUIRK_BUG_CAPTURE. Replace with function call. + +Fixes: 28b5f058cf1d ("net: fec: ptp: fix convergence issue to support LinuxPTP stack") +Signed-off-by: Csókás Bence +Link: https://lore.kernel.org/r/20220811101348.13755-1-csokas.bence@prolan.hu +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/fec_ptp.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +--- a/drivers/net/ethernet/freescale/fec_ptp.c ++++ b/drivers/net/ethernet/freescale/fec_ptp.c +@@ -135,11 +135,7 @@ static int fec_ptp_enable_pps(struct fec + * NSEC_PER_SEC - ts.tv_nsec. Add the remaining nanoseconds + * to current timer would be next second. + */ +- tempval = readl(fep->hwp + FEC_ATIME_CTRL); +- tempval |= FEC_T_CTRL_CAPTURE; +- writel(tempval, fep->hwp + FEC_ATIME_CTRL); +- +- tempval = readl(fep->hwp + FEC_ATIME); ++ tempval = fep->cc.read(&fep->cc); + /* Convert the ptp local counter to 1588 timestamp */ + ns = timecounter_cyc2time(&fep->tc, tempval); + ts = ns_to_timespec64(ns); diff --git a/queue-5.19/gcc-plugins-undefine-latent_entropy_plugin-when-plugin-disabled-for-a-file.patch b/queue-5.19/gcc-plugins-undefine-latent_entropy_plugin-when-plugin-disabled-for-a-file.patch new file mode 100644 index 00000000000..cc32e53e683 --- /dev/null +++ b/queue-5.19/gcc-plugins-undefine-latent_entropy_plugin-when-plugin-disabled-for-a-file.patch @@ -0,0 +1,73 @@ +From 012e8d2034f1bda8863435cd589636e618d6a659 Mon Sep 17 00:00:00 2001 +From: Andrew Donnellan +Date: Tue, 16 Aug 2022 15:17:20 +1000 +Subject: gcc-plugins: Undefine LATENT_ENTROPY_PLUGIN when plugin disabled for a file + +From: Andrew Donnellan + +commit 012e8d2034f1bda8863435cd589636e618d6a659 upstream. + +Commit 36d4b36b6959 ("lib/nodemask: inline next_node_in() and +node_random()") refactored some code by moving node_random() from +lib/nodemask.c to include/linux/nodemask.h, thus requiring nodemask.h to +include random.h, which conditionally defines add_latent_entropy() +depending on whether the macro LATENT_ENTROPY_PLUGIN is defined. + +This broke the build on powerpc, where nodemask.h is indirectly included +in arch/powerpc/kernel/prom_init.c, part of the early boot machinery that +is excluded from the latent entropy plugin using +DISABLE_LATENT_ENTROPY_PLUGIN. It turns out that while we add a gcc flag +to disable the actual plugin, we don't undefine LATENT_ENTROPY_PLUGIN. + +This leads to the following: + + CC arch/powerpc/kernel/prom_init.o + In file included from ./include/linux/nodemask.h:97, + from ./include/linux/mmzone.h:17, + from ./include/linux/gfp.h:7, + from ./include/linux/xarray.h:15, + from ./include/linux/radix-tree.h:21, + from ./include/linux/idr.h:15, + from ./include/linux/kernfs.h:12, + from ./include/linux/sysfs.h:16, + from ./include/linux/kobject.h:20, + from ./include/linux/pci.h:35, + from arch/powerpc/kernel/prom_init.c:24: + ./include/linux/random.h: In function 'add_latent_entropy': + ./include/linux/random.h:25:46: error: 'latent_entropy' undeclared (first use in this function); did you mean 'add_latent_entropy'? + 25 | add_device_randomness((const void *)&latent_entropy, sizeof(latent_entropy)); + | ^~~~~~~~~~~~~~ + | add_latent_entropy + ./include/linux/random.h:25:46: note: each undeclared identifier is reported only once for each function it appears in + make[2]: *** [scripts/Makefile.build:249: arch/powerpc/kernel/prom_init.o] Fehler 1 + make[1]: *** [scripts/Makefile.build:465: arch/powerpc/kernel] Fehler 2 + make: *** [Makefile:1855: arch/powerpc] Error 2 + +Change the DISABLE_LATENT_ENTROPY_PLUGIN flags to undefine +LATENT_ENTROPY_PLUGIN for files where the plugin is disabled. + +Cc: Yury Norov +Fixes: 38addce8b600 ("gcc-plugins: Add latent_entropy plugin") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216367 +Link: https://lore.kernel.org/linuxppc-dev/alpine.DEB.2.22.394.2208152006320.289321@ramsan.of.borg/ +Reported-by: Erhard Furtner +Signed-off-by: Andrew Donnellan +Reviewed-by: Yury Norov +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20220816051720.44108-1-ajd@linux.ibm.com +Signed-off-by: Greg Kroah-Hartman +--- + scripts/Makefile.gcc-plugins | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/scripts/Makefile.gcc-plugins ++++ b/scripts/Makefile.gcc-plugins +@@ -4,7 +4,7 @@ gcc-plugin-$(CONFIG_GCC_PLUGIN_LATENT_EN + gcc-plugin-cflags-$(CONFIG_GCC_PLUGIN_LATENT_ENTROPY) \ + += -DLATENT_ENTROPY_PLUGIN + ifdef CONFIG_GCC_PLUGIN_LATENT_ENTROPY +- DISABLE_LATENT_ENTROPY_PLUGIN += -fplugin-arg-latent_entropy_plugin-disable ++ DISABLE_LATENT_ENTROPY_PLUGIN += -fplugin-arg-latent_entropy_plugin-disable -ULATENT_ENTROPY_PLUGIN + endif + export DISABLE_LATENT_ENTROPY_PLUGIN + diff --git a/queue-5.19/i2c-imx-make-sure-to-unregister-adapter-on-remove.patch b/queue-5.19/i2c-imx-make-sure-to-unregister-adapter-on-remove.patch new file mode 100644 index 00000000000..9a057d132c3 --- /dev/null +++ b/queue-5.19/i2c-imx-make-sure-to-unregister-adapter-on-remove.patch @@ -0,0 +1,71 @@ +From d98bdd3a5b50446d8e010be5b04ce81c4eabf728 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= +Date: Wed, 20 Jul 2022 17:09:33 +0200 +Subject: i2c: imx: Make sure to unregister adapter on remove() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +commit d98bdd3a5b50446d8e010be5b04ce81c4eabf728 upstream. + +If for whatever reasons pm_runtime_resume_and_get() fails and .remove() is +exited early, the i2c adapter stays around and the irq still calls its +handler, while the driver data and the register mapping go away. So if +later the i2c adapter is accessed or the irq triggers this results in +havoc accessing freed memory and unmapped registers. + +So unregister the software resources even if resume failed, and only skip +the hardware access in that case. + +Fixes: 588eb93ea49f ("i2c: imx: add runtime pm support to improve the performance") +Signed-off-by: Uwe Kleine-König +Acked-by: Oleksij Rempel +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-imx.c | 20 +++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +--- a/drivers/i2c/busses/i2c-imx.c ++++ b/drivers/i2c/busses/i2c-imx.c +@@ -1572,9 +1572,7 @@ static int i2c_imx_remove(struct platfor + struct imx_i2c_struct *i2c_imx = platform_get_drvdata(pdev); + int irq, ret; + +- ret = pm_runtime_resume_and_get(&pdev->dev); +- if (ret < 0) +- return ret; ++ ret = pm_runtime_get_sync(&pdev->dev); + + hrtimer_cancel(&i2c_imx->slave_timer); + +@@ -1585,17 +1583,21 @@ static int i2c_imx_remove(struct platfor + if (i2c_imx->dma) + i2c_imx_dma_free(i2c_imx); + +- /* setup chip registers to defaults */ +- imx_i2c_write_reg(0, i2c_imx, IMX_I2C_IADR); +- imx_i2c_write_reg(0, i2c_imx, IMX_I2C_IFDR); +- imx_i2c_write_reg(0, i2c_imx, IMX_I2C_I2CR); +- imx_i2c_write_reg(0, i2c_imx, IMX_I2C_I2SR); ++ if (ret == 0) { ++ /* setup chip registers to defaults */ ++ imx_i2c_write_reg(0, i2c_imx, IMX_I2C_IADR); ++ imx_i2c_write_reg(0, i2c_imx, IMX_I2C_IFDR); ++ imx_i2c_write_reg(0, i2c_imx, IMX_I2C_I2CR); ++ imx_i2c_write_reg(0, i2c_imx, IMX_I2C_I2SR); ++ clk_disable(i2c_imx->clk); ++ } + + clk_notifier_unregister(i2c_imx->clk, &i2c_imx->clk_change_nb); + irq = platform_get_irq(pdev, 0); + if (irq >= 0) + free_irq(irq, i2c_imx); +- clk_disable_unprepare(i2c_imx->clk); ++ ++ clk_unprepare(i2c_imx->clk); + + pm_runtime_put_noidle(&pdev->dev); + pm_runtime_disable(&pdev->dev); diff --git a/queue-5.19/i40e-fix-to-stop-tx_timeout-recovery-if-globr-fails.patch b/queue-5.19/i40e-fix-to-stop-tx_timeout-recovery-if-globr-fails.patch new file mode 100644 index 00000000000..40c5f491715 --- /dev/null +++ b/queue-5.19/i40e-fix-to-stop-tx_timeout-recovery-if-globr-fails.patch @@ -0,0 +1,42 @@ +From 57c942bc3bef0970f0b21f8e0998e76a900ea80d Mon Sep 17 00:00:00 2001 +From: Alan Brady +Date: Tue, 2 Aug 2022 10:19:17 +0200 +Subject: i40e: Fix to stop tx_timeout recovery if GLOBR fails + +From: Alan Brady + +commit 57c942bc3bef0970f0b21f8e0998e76a900ea80d upstream. + +When a tx_timeout fires, the PF attempts to recover by incrementally +resetting. First we try a PFR, then CORER and finally a GLOBR. If the +GLOBR fails, then we keep hitting the tx_timeout and incrementing the +recovery level and issuing dmesgs, which is both annoying to the user +and accomplishes nothing. + +If the GLOBR fails, then we're pretty much totally hosed, and there's +not much else we can do to recover, so this makes it such that we just +kill the VSI and stop hitting the tx_timeout in such a case. + +Fixes: 41c445ff0f48 ("i40e: main driver core") +Signed-off-by: Alan Brady +Signed-off-by: Mateusz Palczewski +Tested-by: Gurucharan (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -384,7 +384,9 @@ static void i40e_tx_timeout(struct net_d + set_bit(__I40E_GLOBAL_RESET_REQUESTED, pf->state); + break; + default: +- netdev_err(netdev, "tx_timeout recovery unsuccessful\n"); ++ netdev_err(netdev, "tx_timeout recovery unsuccessful, device is in non-recoverable state.\n"); ++ set_bit(__I40E_DOWN_REQUESTED, pf->state); ++ set_bit(__I40E_VSI_DOWN_REQUESTED, vsi->state); + break; + } + diff --git a/queue-5.19/i40e-fix-tunnel-checksum-offload-with-fragmented-traffic.patch b/queue-5.19/i40e-fix-tunnel-checksum-offload-with-fragmented-traffic.patch new file mode 100644 index 00000000000..e9e47919b21 --- /dev/null +++ b/queue-5.19/i40e-fix-tunnel-checksum-offload-with-fragmented-traffic.patch @@ -0,0 +1,59 @@ +From 2c6482091f01ba104cf8ee549aa5c717e80d43ea Mon Sep 17 00:00:00 2001 +From: Przemyslaw Patynowski +Date: Wed, 27 Jul 2022 11:19:40 +0200 +Subject: i40e: Fix tunnel checksum offload with fragmented traffic + +From: Przemyslaw Patynowski + +commit 2c6482091f01ba104cf8ee549aa5c717e80d43ea upstream. + +Fix checksum offload on VXLAN tunnels. +In case, when mpls protocol is not used, set l4 header to transport +header of skb. This fixes case, when user tries to offload checksums +of VXLAN tunneled traffic. + +Steps for reproduction (requires link partner with tunnels): +ip l s enp130s0f0 up +ip a f enp130s0f0 +ip a a 10.10.110.2/24 dev enp130s0f0 +ip l s enp130s0f0 mtu 1600 +ip link add vxlan12_sut type vxlan id 12 group 238.168.100.100 dev \ +enp130s0f0 dstport 4789 +ip l s vxlan12_sut up +ip a a 20.10.110.2/24 dev vxlan12_sut +iperf3 -c 20.10.110.1 #should connect + +Without this patch, TX descriptor was using wrong data, due to +l4 header pointing wrong address. NIC would then drop those packets +internally, due to incorrect TX descriptor data, which increased +GLV_TEPC register. + +Fixes: b4fb2d33514a ("i40e: Add support for MPLS + TSO") +Signed-off-by: Przemyslaw Patynowski +Signed-off-by: Mateusz Palczewski +Tested-by: Marek Szlosek +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/i40e/i40e_txrx.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +@@ -3204,11 +3204,13 @@ static int i40e_tx_enable_csum(struct sk + + protocol = vlan_get_protocol(skb); + +- if (eth_p_mpls(protocol)) ++ if (eth_p_mpls(protocol)) { + ip.hdr = skb_inner_network_header(skb); +- else ++ l4.hdr = skb_checksum_start(skb); ++ } else { + ip.hdr = skb_network_header(skb); +- l4.hdr = skb_checksum_start(skb); ++ l4.hdr = skb_transport_header(skb); ++ } + + /* set the tx_flags to indicate the IP protocol type. this is + * required so that checksum header computation below is accurate. diff --git a/queue-5.19/ice-fix-call-trace-with-null-vsi-during-vf-reset.patch b/queue-5.19/ice-fix-call-trace-with-null-vsi-during-vf-reset.patch new file mode 100644 index 00000000000..1bde404b2c0 --- /dev/null +++ b/queue-5.19/ice-fix-call-trace-with-null-vsi-during-vf-reset.patch @@ -0,0 +1,82 @@ +From cf90b74341eecc32ceef0c136954a1668e43b1e7 Mon Sep 17 00:00:00 2001 +From: Michal Jaron +Date: Mon, 25 Jul 2022 10:32:43 +0200 +Subject: ice: Fix call trace with null VSI during VF reset + +From: Michal Jaron + +commit cf90b74341eecc32ceef0c136954a1668e43b1e7 upstream. + +During stress test with attaching and detaching VF from KVM and +simultaneously changing VFs spoofcheck and trust there was a +call trace in ice_reset_vf that VF's VSI is null. + +[145237.352797] WARNING: CPU: 46 PID: 840629 at drivers/net/ethernet/intel/ice/ice_vf_lib.c:508 ice_reset_vf+0x3d6/0x410 [ice] +[145237.352851] Modules linked in: ice(E) vfio_pci vfio_pci_core vfio_virqfd vfio_iommu_type1 vfio iavf dm_mod xt_CHECKSUM xt_MASQUERADE +xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink tun + bridge stp llc sunrpc intel_rapl_msr intel_rapl_common sb_edac x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm iTCO_wdt iTC +O_vendor_support irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel rapl ipmi_si intel_cstate ipmi_devintf joydev intel_uncore m +ei_me ipmi_msghandler i2c_i801 pcspkr mei lpc_ich ioatdma i2c_smbus acpi_pad acpi_power_meter ip_tables xfs libcrc32c i2c_algo_bit drm_sh +mem_helper drm_kms_helper sd_mod t10_pi crc64_rocksoft syscopyarea crc64 sysfillrect sg sysimgblt fb_sys_fops drm i40e ixgbe ahci libahci + libata crc32c_intel mdio dca wmi fuse [last unloaded: ice] +[145237.352917] CPU: 46 PID: 840629 Comm: kworker/46:2 Tainted: G S W I E 5.19.0-rc6+ #24 +[145237.352921] Hardware name: Intel Corporation S2600WTT/S2600WTT, BIOS SE5C610.86B.01.01.0008.021120151325 02/11/2015 +[145237.352923] Workqueue: ice ice_service_task [ice] +[145237.352948] RIP: 0010:ice_reset_vf+0x3d6/0x410 [ice] +[145237.352984] Code: 30 ec f3 cc e9 28 fd ff ff 0f b7 4b 50 48 c7 c2 48 19 9c c0 4c 89 ee 48 c7 c7 30 fe 9e c0 e8 d1 21 9d cc 31 c0 e9 a +9 fe ff ff <0f> 0b b8 ea ff ff ff e9 c1 fc ff ff 0f 0b b8 fb ff ff ff e9 91 fe +[145237.352987] RSP: 0018:ffffb453e257fdb8 EFLAGS: 00010246 +[145237.352990] RAX: ffff8bd0040181c0 RBX: ffff8be68db8f800 RCX: 0000000000000000 +[145237.352991] RDX: 000000000000ffff RSI: 0000000000000000 RDI: ffff8be68db8f800 +[145237.352993] RBP: ffff8bd0040181c0 R08: 0000000000001000 R09: ffff8bcfd520e000 +[145237.352995] R10: 0000000000000000 R11: 00008417b5ab0bc0 R12: 0000000000000005 +[145237.352996] R13: ffff8bcee061c0d0 R14: ffff8bd004019640 R15: 0000000000000000 +[145237.352998] FS: 0000000000000000(0000) GS:ffff8be5dfb00000(0000) knlGS:0000000000000000 +[145237.353000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[145237.353002] CR2: 00007fd81f651d68 CR3: 0000001a0fe10001 CR4: 00000000001726e0 +[145237.353003] Call Trace: +[145237.353008] +[145237.353011] ice_process_vflr_event+0x8d/0xb0 [ice] +[145237.353049] ice_service_task+0x79f/0xef0 [ice] +[145237.353074] process_one_work+0x1c8/0x390 +[145237.353081] ? process_one_work+0x390/0x390 +[145237.353084] worker_thread+0x30/0x360 +[145237.353087] ? process_one_work+0x390/0x390 +[145237.353090] kthread+0xe8/0x110 +[145237.353094] ? kthread_complete_and_exit+0x20/0x20 +[145237.353097] ret_from_fork+0x22/0x30 +[145237.353103] + +Remove WARN_ON() from check if VSI is null in ice_reset_vf. +Add "VF is already removed\n" in dev_dbg(). + +This WARN_ON() is unnecessary and causes call trace, despite that +call trace, driver still works. There is no need for this warn +because this piece of code is responsible for disabling VF's Tx/Rx +queues when VF is disabled, but when VF is already removed there +is no need to do reset or disable queues. + +Fixes: efe41860008e ("ice: Fix memory corruption in VF driver") +Signed-off-by: Michal Jaron +Signed-off-by: Jedrzej Jagielski +Tested-by: Marek Szlosek +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ice/ice_vf_lib.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/ice/ice_vf_lib.c ++++ b/drivers/net/ethernet/intel/ice/ice_vf_lib.c +@@ -505,8 +505,10 @@ int ice_reset_vf(struct ice_vf *vf, u32 + + if (ice_is_vf_disabled(vf)) { + vsi = ice_get_vf_vsi(vf); +- if (WARN_ON(!vsi)) ++ if (!vsi) { ++ dev_dbg(dev, "VF is already removed\n"); + return -EINVAL; ++ } + ice_vsi_stop_lan_tx_rings(vsi, ICE_NO_RESET, vf->vf_id); + ice_vsi_stop_all_rx_rings(vsi); + dev_dbg(dev, "VF is already disabled, there is no need for resetting it, telling VM, all is fine %d\n", diff --git a/queue-5.19/ice-fix-clearing-of-promisc-mode-with-bridge-over-bond.patch b/queue-5.19/ice-fix-clearing-of-promisc-mode-with-bridge-over-bond.patch new file mode 100644 index 00000000000..c21bf2dd443 --- /dev/null +++ b/queue-5.19/ice-fix-clearing-of-promisc-mode-with-bridge-over-bond.patch @@ -0,0 +1,84 @@ +From abddafd4585cc825d454da3cf308ad1226f6c554 Mon Sep 17 00:00:00 2001 +From: Grzegorz Siwik +Date: Fri, 12 Aug 2022 15:25:49 +0200 +Subject: ice: Fix clearing of promisc mode with bridge over bond + +From: Grzegorz Siwik + +commit abddafd4585cc825d454da3cf308ad1226f6c554 upstream. + +When at least two interfaces are bonded and a bridge is enabled on the +bond, an error can occur when the bridge is removed and re-added. The +reason for the error is because promiscuous mode was not fully cleared from +the VLAN VSI in the hardware. With this change, promiscuous mode is +properly removed when the bridge disconnects from bonding. + +[ 1033.676359] bond1: link status definitely down for interface enp95s0f0, disabling it +[ 1033.676366] bond1: making interface enp175s0f0 the new active one +[ 1033.676369] device enp95s0f0 left promiscuous mode +[ 1033.676522] device enp175s0f0 entered promiscuous mode +[ 1033.676901] ice 0000:af:00.0 enp175s0f0: Error setting Multicast promiscuous mode on VSI 6 +[ 1041.795662] ice 0000:af:00.0 enp175s0f0: Error setting Multicast promiscuous mode on VSI 6 +[ 1041.944826] bond1: link status definitely down for interface enp175s0f0, disabling it +[ 1041.944874] device enp175s0f0 left promiscuous mode +[ 1041.944918] bond1: now running without any active interface! + +Fixes: c31af68a1b94 ("ice: Add outer_vlan_ops and VSI specific VLAN ops implementations") +Co-developed-by: Jesse Brandeburg +Signed-off-by: Jesse Brandeburg +Signed-off-by: Grzegorz Siwik +Link: https://lore.kernel.org/all/CAK8fFZ7m-KR57M_rYX6xZN39K89O=LGooYkKsu6HKt0Bs+x6xQ@mail.gmail.com/ +Tested-by: Jaroslav Pulchart +Tested-by: Igor Raits +Tested-by: Gurucharan (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ice/ice_lib.c | 6 +++++- + drivers/net/ethernet/intel/ice/ice_main.c | 12 +++++++++++- + 2 files changed, 16 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/intel/ice/ice_lib.c ++++ b/drivers/net/ethernet/intel/ice/ice_lib.c +@@ -4048,7 +4048,11 @@ int ice_vsi_add_vlan_zero(struct ice_vsi + if (err && err != -EEXIST) + return err; + +- return 0; ++ /* when deleting the last VLAN filter, make sure to disable the VLAN ++ * promisc mode so the filter isn't left by accident ++ */ ++ return ice_clear_vsi_promisc(&vsi->back->hw, vsi->idx, ++ ICE_MCAST_VLAN_PROMISC_BITS, 0); + } + + /** +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -267,8 +267,10 @@ static int ice_set_promisc(struct ice_vs + status = ice_fltr_set_vsi_promisc(&vsi->back->hw, vsi->idx, + promisc_m, 0); + } ++ if (status && status != -EEXIST) ++ return status; + +- return status; ++ return 0; + } + + /** +@@ -3572,6 +3574,14 @@ ice_vlan_rx_kill_vid(struct net_device * + while (test_and_set_bit(ICE_CFG_BUSY, vsi->state)) + usleep_range(1000, 2000); + ++ ret = ice_clear_vsi_promisc(&vsi->back->hw, vsi->idx, ++ ICE_MCAST_VLAN_PROMISC_BITS, vid); ++ if (ret) { ++ netdev_err(netdev, "Error clearing multicast promiscuous mode on VSI %i\n", ++ vsi->vsi_num); ++ vsi->current_netdev_flags |= IFF_ALLMULTI; ++ } ++ + vlan_ops = ice_get_compat_vsi_vlan_ops(vsi); + + /* Make sure VLAN delete is successful before updating VLAN diff --git a/queue-5.19/ice-fix-double-vlan-error-when-entering-promisc-mode.patch b/queue-5.19/ice-fix-double-vlan-error-when-entering-promisc-mode.patch new file mode 100644 index 00000000000..fbc38a9704b --- /dev/null +++ b/queue-5.19/ice-fix-double-vlan-error-when-entering-promisc-mode.patch @@ -0,0 +1,47 @@ +From ffa9ed86522f1c08d4face4e0a4ebf366037bf19 Mon Sep 17 00:00:00 2001 +From: Grzegorz Siwik +Date: Fri, 12 Aug 2022 15:25:47 +0200 +Subject: ice: Fix double VLAN error when entering promisc mode + +From: Grzegorz Siwik + +commit ffa9ed86522f1c08d4face4e0a4ebf366037bf19 upstream. + +Avoid enabling or disabling VLAN 0 when trying to set promiscuous +VLAN mode if double VLAN mode is enabled. This fix is needed +because the driver tries to add the VLAN 0 filter twice (once for +inner and once for outer) when double VLAN mode is enabled. The +filter program is rejected by the firmware when double VLAN is +enabled, because the promiscuous filter only needs to be set once. + +This issue was missed in the initial implementation of double VLAN +mode. + +Fixes: 5eda8afd6bcc ("ice: Add support for PF/VF promiscuous mode") +Signed-off-by: Grzegorz Siwik +Link: https://lore.kernel.org/all/CAK8fFZ7m-KR57M_rYX6xZN39K89O=LGooYkKsu6HKt0Bs+x6xQ@mail.gmail.com/ +Tested-by: Jaroslav Pulchart +Tested-by: Igor Raits +Tested-by: Gurucharan (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ice/ice_switch.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/net/ethernet/intel/ice/ice_switch.c ++++ b/drivers/net/ethernet/intel/ice/ice_switch.c +@@ -4414,6 +4414,13 @@ ice_set_vlan_vsi_promisc(struct ice_hw * + goto free_fltr_list; + + list_for_each_entry(list_itr, &vsi_list_head, list_entry) { ++ /* Avoid enabling or disabling VLAN zero twice when in double ++ * VLAN mode ++ */ ++ if (ice_is_dvm_ena(hw) && ++ list_itr->fltr_info.l_data.vlan.tpid == 0) ++ continue; ++ + vlan_id = list_itr->fltr_info.l_data.vlan.vlan_id; + if (rm_vlan_promisc) + status = ice_clear_vsi_promisc(hw, vsi_handle, diff --git a/queue-5.19/ice-fix-vf-not-able-to-send-tagged-traffic-with-no-vlan-filters.patch b/queue-5.19/ice-fix-vf-not-able-to-send-tagged-traffic-with-no-vlan-filters.patch new file mode 100644 index 00000000000..8517ab5c691 --- /dev/null +++ b/queue-5.19/ice-fix-vf-not-able-to-send-tagged-traffic-with-no-vlan-filters.patch @@ -0,0 +1,161 @@ +From 664d4646184ed986f8195df684cc4660563fb02a Mon Sep 17 00:00:00 2001 +From: Sylwester Dziedziuch +Date: Wed, 3 Aug 2022 10:42:46 +0200 +Subject: ice: Fix VF not able to send tagged traffic with no VLAN filters + +From: Sylwester Dziedziuch + +commit 664d4646184ed986f8195df684cc4660563fb02a upstream. + +VF was not able to send tagged traffic when it didn't +have any VLAN interfaces and VLAN anti-spoofing was enabled. +Fix this by allowing VFs with no VLAN filters to send tagged +traffic. After VF adds a VLAN interface it will be able to +send tagged traffic matching VLAN filters only. + +Testing hints: +1. Spawn VF +2. Send tagged packet from a VF +3. The packet should be sent out and not dropped +4. Add a VLAN interface on VF +5. Send tagged packet on that VLAN interface +6. Packet should be sent out and not dropped +7. Send tagged packet with id different than VLAN interface +8. Packet should be dropped + +Fixes: daf4dd16438b ("ice: Refactor spoofcheck configuration functions") +Signed-off-by: Sylwester Dziedziuch +Signed-off-by: Mateusz Palczewski +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ice/ice_vf_lib.c | 11 +++-- + drivers/net/ethernet/intel/ice/ice_virtchnl.c | 57 ++++++++++++++++++++++---- + 2 files changed, 57 insertions(+), 11 deletions(-) + +--- a/drivers/net/ethernet/intel/ice/ice_vf_lib.c ++++ b/drivers/net/ethernet/intel/ice/ice_vf_lib.c +@@ -707,13 +707,16 @@ static int ice_cfg_mac_antispoof(struct + static int ice_vsi_ena_spoofchk(struct ice_vsi *vsi) + { + struct ice_vsi_vlan_ops *vlan_ops; +- int err; ++ int err = 0; + + vlan_ops = ice_get_compat_vsi_vlan_ops(vsi); + +- err = vlan_ops->ena_tx_filtering(vsi); +- if (err) +- return err; ++ /* Allow VF with VLAN 0 only to send all tagged traffic */ ++ if (vsi->type != ICE_VSI_VF || ice_vsi_has_non_zero_vlans(vsi)) { ++ err = vlan_ops->ena_tx_filtering(vsi); ++ if (err) ++ return err; ++ } + + return ice_cfg_mac_antispoof(vsi, true); + } +--- a/drivers/net/ethernet/intel/ice/ice_virtchnl.c ++++ b/drivers/net/ethernet/intel/ice/ice_virtchnl.c +@@ -2264,6 +2264,15 @@ static int ice_vc_process_vlan_msg(struc + + /* Enable VLAN filtering on first non-zero VLAN */ + if (!vlan_promisc && vid && !ice_is_dvm_ena(&pf->hw)) { ++ if (vf->spoofchk) { ++ status = vsi->inner_vlan_ops.ena_tx_filtering(vsi); ++ if (status) { ++ v_ret = VIRTCHNL_STATUS_ERR_PARAM; ++ dev_err(dev, "Enable VLAN anti-spoofing on VLAN ID: %d failed error-%d\n", ++ vid, status); ++ goto error_param; ++ } ++ } + if (vsi->inner_vlan_ops.ena_rx_filtering(vsi)) { + v_ret = VIRTCHNL_STATUS_ERR_PARAM; + dev_err(dev, "Enable VLAN pruning on VLAN ID: %d failed error-%d\n", +@@ -2309,8 +2318,10 @@ static int ice_vc_process_vlan_msg(struc + } + + /* Disable VLAN filtering when only VLAN 0 is left */ +- if (!ice_vsi_has_non_zero_vlans(vsi)) ++ if (!ice_vsi_has_non_zero_vlans(vsi)) { ++ vsi->inner_vlan_ops.dis_tx_filtering(vsi); + vsi->inner_vlan_ops.dis_rx_filtering(vsi); ++ } + + if (vlan_promisc) + ice_vf_dis_vlan_promisc(vsi, &vlan); +@@ -2814,6 +2825,13 @@ ice_vc_del_vlans(struct ice_vf *vf, stru + + if (vlan_promisc) + ice_vf_dis_vlan_promisc(vsi, &vlan); ++ ++ /* Disable VLAN filtering when only VLAN 0 is left */ ++ if (!ice_vsi_has_non_zero_vlans(vsi) && ice_is_dvm_ena(&vsi->back->hw)) { ++ err = vsi->outer_vlan_ops.dis_tx_filtering(vsi); ++ if (err) ++ return err; ++ } + } + + vc_vlan = &vlan_fltr->inner; +@@ -2829,8 +2847,17 @@ ice_vc_del_vlans(struct ice_vf *vf, stru + /* no support for VLAN promiscuous on inner VLAN unless + * we are in Single VLAN Mode (SVM) + */ +- if (!ice_is_dvm_ena(&vsi->back->hw) && vlan_promisc) +- ice_vf_dis_vlan_promisc(vsi, &vlan); ++ if (!ice_is_dvm_ena(&vsi->back->hw)) { ++ if (vlan_promisc) ++ ice_vf_dis_vlan_promisc(vsi, &vlan); ++ ++ /* Disable VLAN filtering when only VLAN 0 is left */ ++ if (!ice_vsi_has_non_zero_vlans(vsi)) { ++ err = vsi->inner_vlan_ops.dis_tx_filtering(vsi); ++ if (err) ++ return err; ++ } ++ } + } + } + +@@ -2907,6 +2934,13 @@ ice_vc_add_vlans(struct ice_vf *vf, stru + if (err) + return err; + } ++ ++ /* Enable VLAN filtering on first non-zero VLAN */ ++ if (vf->spoofchk && vlan.vid && ice_is_dvm_ena(&vsi->back->hw)) { ++ err = vsi->outer_vlan_ops.ena_tx_filtering(vsi); ++ if (err) ++ return err; ++ } + } + + vc_vlan = &vlan_fltr->inner; +@@ -2922,10 +2956,19 @@ ice_vc_add_vlans(struct ice_vf *vf, stru + /* no support for VLAN promiscuous on inner VLAN unless + * we are in Single VLAN Mode (SVM) + */ +- if (!ice_is_dvm_ena(&vsi->back->hw) && vlan_promisc) { +- err = ice_vf_ena_vlan_promisc(vsi, &vlan); +- if (err) +- return err; ++ if (!ice_is_dvm_ena(&vsi->back->hw)) { ++ if (vlan_promisc) { ++ err = ice_vf_ena_vlan_promisc(vsi, &vlan); ++ if (err) ++ return err; ++ } ++ ++ /* Enable VLAN filtering on first non-zero VLAN */ ++ if (vf->spoofchk && vlan.vid) { ++ err = vsi->inner_vlan_ops.ena_tx_filtering(vsi); ++ if (err) ++ return err; ++ } + } + } + } diff --git a/queue-5.19/ice-fix-vsi-rebuild-warn_on-check-for-vf.patch b/queue-5.19/ice-fix-vsi-rebuild-warn_on-check-for-vf.patch new file mode 100644 index 00000000000..b6a0b324e0a --- /dev/null +++ b/queue-5.19/ice-fix-vsi-rebuild-warn_on-check-for-vf.patch @@ -0,0 +1,36 @@ +From 7fe05e125d5f730bd2d0fc53985bee77b6c762f0 Mon Sep 17 00:00:00 2001 +From: Benjamin Mikailenko +Date: Fri, 15 Jul 2022 18:27:07 -0400 +Subject: ice: Fix VSI rebuild WARN_ON check for VF + +From: Benjamin Mikailenko + +commit 7fe05e125d5f730bd2d0fc53985bee77b6c762f0 upstream. + +In commit b03d519d3460 ("ice: store VF pointer instead of VF ID") +WARN_ON checks were added to validate the vsi->vf pointer and +catch programming errors. However, one check to vsi->vf was missed. +This caused a call trace when resetting VFs. + +Fix ice_vsi_rebuild by encompassing VF pointer in WARN_ON check. + +Fixes: b03d519d3460 ("ice: store VF pointer instead of VF ID") +Signed-off-by: Benjamin Mikailenko +Tested-by: Marek Szlosek +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ice/ice_lib.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/ice/ice_lib.c ++++ b/drivers/net/ethernet/intel/ice/ice_lib.c +@@ -3178,7 +3178,7 @@ int ice_vsi_rebuild(struct ice_vsi *vsi, + + pf = vsi->back; + vtype = vsi->type; +- if (WARN_ON(vtype == ICE_VSI_VF) && !vsi->vf) ++ if (WARN_ON(vtype == ICE_VSI_VF && !vsi->vf)) + return -EINVAL; + + ice_vsi_init_vlan_ops(vsi); diff --git a/queue-5.19/ice-ignore-eexist-when-setting-promisc-mode.patch b/queue-5.19/ice-ignore-eexist-when-setting-promisc-mode.patch new file mode 100644 index 00000000000..a6573663096 --- /dev/null +++ b/queue-5.19/ice-ignore-eexist-when-setting-promisc-mode.patch @@ -0,0 +1,38 @@ +From 11e551a2efa4481bd4f616ab75374a2710b480e9 Mon Sep 17 00:00:00 2001 +From: Grzegorz Siwik +Date: Fri, 12 Aug 2022 15:25:48 +0200 +Subject: ice: Ignore EEXIST when setting promisc mode + +From: Grzegorz Siwik + +commit 11e551a2efa4481bd4f616ab75374a2710b480e9 upstream. + +Ignore EEXIST error when setting promiscuous mode. +This fix is needed because the driver could set promiscuous mode +when it still has not cleared properly. +Promiscuous mode could be set only once, so setting it second +time will be rejected. + +Fixes: 5eda8afd6bcc ("ice: Add support for PF/VF promiscuous mode") +Signed-off-by: Grzegorz Siwik +Link: https://lore.kernel.org/all/CAK8fFZ7m-KR57M_rYX6xZN39K89O=LGooYkKsu6HKt0Bs+x6xQ@mail.gmail.com/ +Tested-by: Jaroslav Pulchart +Tested-by: Igor Raits +Tested-by: Gurucharan (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ice/ice_switch.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/ice/ice_switch.c ++++ b/drivers/net/ethernet/intel/ice/ice_switch.c +@@ -4428,7 +4428,7 @@ ice_set_vlan_vsi_promisc(struct ice_hw * + else + status = ice_set_vsi_promisc(hw, vsi_handle, + promisc_mask, vlan_id); +- if (status) ++ if (status && status != -EEXIST) + break; + } + diff --git a/queue-5.19/ice-ignore-error-message-when-setting-same-promiscuous-mode.patch b/queue-5.19/ice-ignore-error-message-when-setting-same-promiscuous-mode.patch new file mode 100644 index 00000000000..b1955f110dc --- /dev/null +++ b/queue-5.19/ice-ignore-error-message-when-setting-same-promiscuous-mode.patch @@ -0,0 +1,70 @@ +From 79956b83ed4281c35561c39254558092d96a9ed1 Mon Sep 17 00:00:00 2001 +From: Benjamin Mikailenko +Date: Fri, 12 Aug 2022 15:25:50 +0200 +Subject: ice: Ignore error message when setting same promiscuous mode + +From: Benjamin Mikailenko + +commit 79956b83ed4281c35561c39254558092d96a9ed1 upstream. + +Commit 1273f89578f2 ("ice: Fix broken IFF_ALLMULTI handling") +introduced new checks when setting/clearing promiscuous mode. But if the +requested promiscuous mode setting already exists, an -EEXIST error +message would be printed. This is incorrect because promiscuous mode is +either on/off and shouldn't print an error when the requested +configuration is already set. + +This can happen when removing a bridge with two bonded interfaces and +promiscuous most isn't fully cleared from VLAN VSI in hardware. + +Fix this by ignoring cases where requested promiscuous mode exists. + +Fixes: 1273f89578f2 ("ice: Fix broken IFF_ALLMULTI handling") +Signed-off-by: Benjamin Mikailenko +Signed-off-by: Grzegorz Siwik +Link: https://lore.kernel.org/all/CAK8fFZ7m-KR57M_rYX6xZN39K89O=LGooYkKsu6HKt0Bs+x6xQ@mail.gmail.com/ +Tested-by: Gurucharan (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ice/ice_fltr.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/net/ethernet/intel/ice/ice_fltr.c ++++ b/drivers/net/ethernet/intel/ice/ice_fltr.c +@@ -62,7 +62,7 @@ ice_fltr_set_vlan_vsi_promisc(struct ice + int result; + + result = ice_set_vlan_vsi_promisc(hw, vsi->idx, promisc_mask, false); +- if (result) ++ if (result && result != -EEXIST) + dev_err(ice_pf_to_dev(pf), + "Error setting promisc mode on VSI %i (rc=%d)\n", + vsi->vsi_num, result); +@@ -86,7 +86,7 @@ ice_fltr_clear_vlan_vsi_promisc(struct i + int result; + + result = ice_set_vlan_vsi_promisc(hw, vsi->idx, promisc_mask, true); +- if (result) ++ if (result && result != -EEXIST) + dev_err(ice_pf_to_dev(pf), + "Error clearing promisc mode on VSI %i (rc=%d)\n", + vsi->vsi_num, result); +@@ -109,7 +109,7 @@ ice_fltr_clear_vsi_promisc(struct ice_hw + int result; + + result = ice_clear_vsi_promisc(hw, vsi_handle, promisc_mask, vid); +- if (result) ++ if (result && result != -EEXIST) + dev_err(ice_pf_to_dev(pf), + "Error clearing promisc mode on VSI %i for VID %u (rc=%d)\n", + ice_get_hw_vsi_num(hw, vsi_handle), vid, result); +@@ -132,7 +132,7 @@ ice_fltr_set_vsi_promisc(struct ice_hw * + int result; + + result = ice_set_vsi_promisc(hw, vsi_handle, promisc_mask, vid); +- if (result) ++ if (result && result != -EEXIST) + dev_err(ice_pf_to_dev(pf), + "Error setting promisc mode on VSI %i for VID %u (rc=%d)\n", + ice_get_hw_vsi_num(hw, vsi_handle), vid, result); diff --git a/queue-5.19/igb-add-lock-to-avoid-data-race.patch b/queue-5.19/igb-add-lock-to-avoid-data-race.patch new file mode 100644 index 00000000000..8a4336a0a25 --- /dev/null +++ b/queue-5.19/igb-add-lock-to-avoid-data-race.patch @@ -0,0 +1,126 @@ +From 6faee3d4ee8be0f0367d0c3d826afb3571b7a5e0 Mon Sep 17 00:00:00 2001 +From: Lin Ma +Date: Wed, 17 Aug 2022 11:49:21 -0700 +Subject: igb: Add lock to avoid data race + +From: Lin Ma + +commit 6faee3d4ee8be0f0367d0c3d826afb3571b7a5e0 upstream. + +The commit c23d92b80e0b ("igb: Teardown SR-IOV before +unregister_netdev()") places the unregister_netdev() call after the +igb_disable_sriov() call to avoid functionality issue. + +However, it introduces several race conditions when detaching a device. +For example, when .remove() is called, the below interleaving leads to +use-after-free. + + (FREE from device detaching) | (USE from netdev core) +igb_remove | igb_ndo_get_vf_config + igb_disable_sriov | vf >= adapter->vfs_allocated_count? + kfree(adapter->vf_data) | + adapter->vfs_allocated_count = 0 | + | memcpy(... adapter->vf_data[vf] + +Moreover, the igb_disable_sriov() also suffers from data race with the +requests from VF driver. + + (FREE from device detaching) | (USE from requests) +igb_remove | igb_msix_other + igb_disable_sriov | igb_msg_task + kfree(adapter->vf_data) | vf < adapter->vfs_allocated_count + adapter->vfs_allocated_count = 0 | + +To this end, this commit first eliminates the data races from netdev +core by using rtnl_lock (similar to commit 719479230893 ("dpaa2-eth: add +MAC/PHY support through phylink")). And then adds a spinlock to +eliminate races from driver requests. (similar to commit 1e53834ce541 +("ixgbe: Add locking to prevent panic when setting sriov_numvfs to zero") + +Fixes: c23d92b80e0b ("igb: Teardown SR-IOV before unregister_netdev()") +Signed-off-by: Lin Ma +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Link: https://lore.kernel.org/r/20220817184921.735244-1-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/igb/igb.h | 2 ++ + drivers/net/ethernet/intel/igb/igb_main.c | 12 +++++++++++- + 2 files changed, 13 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/igb/igb.h ++++ b/drivers/net/ethernet/intel/igb/igb.h +@@ -664,6 +664,8 @@ struct igb_adapter { + struct igb_mac_addr *mac_table; + struct vf_mac_filter vf_macs; + struct vf_mac_filter *vf_mac_list; ++ /* lock for VF resources */ ++ spinlock_t vfs_lock; + }; + + /* flags controlling PTP/1588 function */ +--- a/drivers/net/ethernet/intel/igb/igb_main.c ++++ b/drivers/net/ethernet/intel/igb/igb_main.c +@@ -3637,6 +3637,7 @@ static int igb_disable_sriov(struct pci_ + struct net_device *netdev = pci_get_drvdata(pdev); + struct igb_adapter *adapter = netdev_priv(netdev); + struct e1000_hw *hw = &adapter->hw; ++ unsigned long flags; + + /* reclaim resources allocated to VFs */ + if (adapter->vf_data) { +@@ -3649,12 +3650,13 @@ static int igb_disable_sriov(struct pci_ + pci_disable_sriov(pdev); + msleep(500); + } +- ++ spin_lock_irqsave(&adapter->vfs_lock, flags); + kfree(adapter->vf_mac_list); + adapter->vf_mac_list = NULL; + kfree(adapter->vf_data); + adapter->vf_data = NULL; + adapter->vfs_allocated_count = 0; ++ spin_unlock_irqrestore(&adapter->vfs_lock, flags); + wr32(E1000_IOVCTL, E1000_IOVCTL_REUSE_VFQ); + wrfl(); + msleep(100); +@@ -3814,7 +3816,9 @@ static void igb_remove(struct pci_dev *p + igb_release_hw_control(adapter); + + #ifdef CONFIG_PCI_IOV ++ rtnl_lock(); + igb_disable_sriov(pdev); ++ rtnl_unlock(); + #endif + + unregister_netdev(netdev); +@@ -3974,6 +3978,9 @@ static int igb_sw_init(struct igb_adapte + + spin_lock_init(&adapter->nfc_lock); + spin_lock_init(&adapter->stats64_lock); ++ ++ /* init spinlock to avoid concurrency of VF resources */ ++ spin_lock_init(&adapter->vfs_lock); + #ifdef CONFIG_PCI_IOV + switch (hw->mac.type) { + case e1000_82576: +@@ -7924,8 +7931,10 @@ unlock: + static void igb_msg_task(struct igb_adapter *adapter) + { + struct e1000_hw *hw = &adapter->hw; ++ unsigned long flags; + u32 vf; + ++ spin_lock_irqsave(&adapter->vfs_lock, flags); + for (vf = 0; vf < adapter->vfs_allocated_count; vf++) { + /* process any reset requests */ + if (!igb_check_for_rst(hw, vf)) +@@ -7939,6 +7948,7 @@ static void igb_msg_task(struct igb_adap + if (!igb_check_for_ack(hw, vf)) + igb_rcv_ack_from_vf(adapter, vf); + } ++ spin_unlock_irqrestore(&adapter->vfs_lock, flags); + } + + /** diff --git a/queue-5.19/kbuild-fix-the-modules-order-between-drivers-and-libs.patch b/queue-5.19/kbuild-fix-the-modules-order-between-drivers-and-libs.patch new file mode 100644 index 00000000000..e6514df3e21 --- /dev/null +++ b/queue-5.19/kbuild-fix-the-modules-order-between-drivers-and-libs.patch @@ -0,0 +1,48 @@ +From 113147510b48e764e624e3d0e6707a1e48bc05a9 Mon Sep 17 00:00:00 2001 +From: Masahiro Yamada +Date: Sun, 14 Aug 2022 08:09:28 +0900 +Subject: kbuild: fix the modules order between drivers and libs + +From: Masahiro Yamada + +commit 113147510b48e764e624e3d0e6707a1e48bc05a9 upstream. + +Commit b2c885549122 ("kbuild: update modules.order only when contained +modules are updated") accidentally changed the modules order. + +Prior to that commit, the modules order was determined based on +vmlinux-dirs, which lists core-y/m, drivers-y/m, libs-y/m, in this order. + +Now, subdir-modorder lists them in a different order: core-y/m, libs-y/m, +drivers-y/m. + +Presumably, there was no practical issue because the modules in drivers +and libs are orthogonal, but there is no reason to have this distortion. + +Get back to the original order. + +Fixes: b2c885549122 ("kbuild: update modules.order only when contained modules are updated") +Signed-off-by: Masahiro Yamada +Signed-off-by: Greg Kroah-Hartman +--- + Makefile | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/Makefile ++++ b/Makefile +@@ -1112,13 +1112,11 @@ vmlinux-alldirs := $(sort $(vmlinux-dirs + $(patsubst %/,%,$(filter %/, $(core-) \ + $(drivers-) $(libs-)))) + +-subdir-modorder := $(addsuffix modules.order,$(filter %/, \ +- $(core-y) $(core-m) $(libs-y) $(libs-m) \ +- $(drivers-y) $(drivers-m))) +- + build-dirs := $(vmlinux-dirs) + clean-dirs := $(vmlinux-alldirs) + ++subdir-modorder := $(addsuffix /modules.order, $(build-dirs)) ++ + # Externally visible symbols (used by link-vmlinux.sh) + KBUILD_VMLINUX_OBJS := $(head-y) $(patsubst %/,%/built-in.a, $(core-y)) + KBUILD_VMLINUX_OBJS += $(addsuffix built-in.a, $(filter %/, $(libs-y))) diff --git a/queue-5.19/mlxsw-spectrum-clear-ptp-configuration-after-unregistering-the-netdevice.patch b/queue-5.19/mlxsw-spectrum-clear-ptp-configuration-after-unregistering-the-netdevice.patch new file mode 100644 index 00000000000..bd36ced61c3 --- /dev/null +++ b/queue-5.19/mlxsw-spectrum-clear-ptp-configuration-after-unregistering-the-netdevice.patch @@ -0,0 +1,41 @@ +From a159e986ad26d3f35c0157ac92760ba5e44e6785 Mon Sep 17 00:00:00 2001 +From: Amit Cohen +Date: Fri, 12 Aug 2022 17:32:01 +0200 +Subject: mlxsw: spectrum: Clear PTP configuration after unregistering the netdevice + +From: Amit Cohen + +commit a159e986ad26d3f35c0157ac92760ba5e44e6785 upstream. + +Currently as part of removing port, PTP API is called to clear the +existing configuration and set the 'rx_filter' and 'tx_type' to zero. +The clearing is done before unregistering the netdevice, which means that +there is a window of time in which the user can reconfigure PTP in the +port, and this configuration will not be cleared. + +Reorder the operations, clear PTP configuration after unregistering the +netdevice. + +Fixes: 8748642751ede ("mlxsw: spectrum: PTP: Support SIOCGHWTSTAMP, SIOCSHWTSTAMP ioctls") +Signed-off-by: Amit Cohen +Signed-off-by: Ido Schimmel +Signed-off-by: Petr Machata +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +@@ -1822,9 +1822,9 @@ static void mlxsw_sp_port_remove(struct + + cancel_delayed_work_sync(&mlxsw_sp_port->periodic_hw_stats.update_dw); + cancel_delayed_work_sync(&mlxsw_sp_port->ptp.shaper_dw); +- mlxsw_sp_port_ptp_clear(mlxsw_sp_port); + mlxsw_core_port_clear(mlxsw_sp->core, local_port, mlxsw_sp); + unregister_netdev(mlxsw_sp_port->dev); /* This calls ndo_stop */ ++ mlxsw_sp_port_ptp_clear(mlxsw_sp_port); + mlxsw_sp_port_vlan_classification_set(mlxsw_sp_port, true, true); + mlxsw_sp->ports[local_port] = NULL; + mlxsw_sp_port_vlan_flush(mlxsw_sp_port, true); diff --git a/queue-5.19/modpost-fix-module-versioning-when-a-symbol-lacks-valid-crc.patch b/queue-5.19/modpost-fix-module-versioning-when-a-symbol-lacks-valid-crc.patch new file mode 100644 index 00000000000..914d033fea2 --- /dev/null +++ b/queue-5.19/modpost-fix-module-versioning-when-a-symbol-lacks-valid-crc.patch @@ -0,0 +1,80 @@ +From 5b8a9a8fd1f0c3d55d407cf759d54ca68798d9ad Mon Sep 17 00:00:00 2001 +From: Masahiro Yamada +Date: Tue, 9 Aug 2022 23:11:17 +0900 +Subject: modpost: fix module versioning when a symbol lacks valid CRC + +From: Masahiro Yamada + +commit 5b8a9a8fd1f0c3d55d407cf759d54ca68798d9ad upstream. + +Since commit 7b4537199a4a ("kbuild: link symbol CRCs at final link, +removing CONFIG_MODULE_REL_CRCS"), module versioning is broken on +some architectures. Loading a module fails with "disagrees about +version of symbol module_layout". + +On such architectures (e.g. ARCH=sparc build with sparc64_defconfig), +modpost shows a warning, like follows: + + WARNING: modpost: EXPORT symbol "_mcount" [vmlinux] version generation failed, symbol will not be versioned. + Is "_mcount" prototyped in ? + +Previously, it was a harmless warning (CRC check was just skipped), +but now wrong CRCs are used for comparison because invalid CRCs are +just skipped. + + $ sparc64-linux-gnu-nm -n vmlinux + [snip] + 0000000000c2cea0 r __ksymtab__kstrtol + 0000000000c2ceb8 r __ksymtab__kstrtoul + 0000000000c2ced0 r __ksymtab__local_bh_enable + 0000000000c2cee8 r __ksymtab__mcount + 0000000000c2cf00 r __ksymtab__printk + 0000000000c2cf18 r __ksymtab__raw_read_lock + 0000000000c2cf30 r __ksymtab__raw_read_lock_bh + [snip] + 0000000000c53b34 D __crc__kstrtol + 0000000000c53b38 D __crc__kstrtoul + 0000000000c53b3c D __crc__local_bh_enable + 0000000000c53b40 D __crc__printk + 0000000000c53b44 D __crc__raw_read_lock + 0000000000c53b48 D __crc__raw_read_lock_bh + +Please notice __crc__mcount is missing here. + +When the module subsystem looks up a CRC that comes after, it results +in reading out a wrong address. For example, when __crc__printk is +needed, the module subsystem reads 0xc53b44 instead of 0xc53b40. + +All CRC entries must be output for correct index accessing. Invalid +CRCs will be unused, but are needed to keep the one-to-one mapping +between __ksymtab_* and __crc_*. + +The best is to fix all modpost warnings, but several warnings are still +remaining on less popular architectures. + +Fixes: 7b4537199a4a ("kbuild: link symbol CRCs at final link, removing CONFIG_MODULE_REL_CRCS") +Reported-by: matoro +Signed-off-by: Masahiro Yamada +Tested-by: matoro +Signed-off-by: Greg Kroah-Hartman +--- + scripts/mod/modpost.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -2203,13 +2203,11 @@ static void add_exported_symbols(struct + /* record CRCs for exported symbols */ + buf_printf(buf, "\n"); + list_for_each_entry(sym, &mod->exported_symbols, list) { +- if (!sym->crc_valid) { ++ if (!sym->crc_valid) + warn("EXPORT symbol \"%s\" [%s%s] version generation failed, symbol will not be versioned.\n" + "Is \"%s\" prototyped in ?\n", + sym->name, mod->name, mod->is_vmlinux ? "" : ".ko", + sym->name); +- continue; +- } + + buf_printf(buf, "SYMBOL_CRC(%s, 0x%08x, \"%s\");\n", + sym->name, sym->crc, sym->is_gpl_only ? "_gpl" : ""); diff --git a/queue-5.19/net-dsa-don-t-warn-in-dsa_port_set_state_now-when-driver-doesn-t-support-it.patch b/queue-5.19/net-dsa-don-t-warn-in-dsa_port_set_state_now-when-driver-doesn-t-support-it.patch new file mode 100644 index 00000000000..a4507481a2f --- /dev/null +++ b/queue-5.19/net-dsa-don-t-warn-in-dsa_port_set_state_now-when-driver-doesn-t-support-it.patch @@ -0,0 +1,48 @@ +From 211987f3ac734000ea1548784b2a4539a974fbc8 Mon Sep 17 00:00:00 2001 +From: Vladimir Oltean +Date: Tue, 16 Aug 2022 23:14:45 +0300 +Subject: net: dsa: don't warn in dsa_port_set_state_now() when driver doesn't support it + +From: Vladimir Oltean + +commit 211987f3ac734000ea1548784b2a4539a974fbc8 upstream. + +ds->ops->port_stp_state_set() is, like most DSA methods, optional, and +if absent, the port is supposed to remain in the forwarding state (as +standalone). Such is the case with the mv88e6060 driver, which does not +offload the bridge layer. DSA warns that the STP state can't be changed +to FORWARDING as part of dsa_port_enable_rt(), when in fact it should not. + +The error message is also not up to modern standards, so take the +opportunity to make it more descriptive. + +Fixes: fd3645413197 ("net: dsa: change scope of STP state setter") +Reported-by: Sergei Antonov +Signed-off-by: Vladimir Oltean +Reviewed-by: Sergei Antonov +Link: https://lore.kernel.org/r/20220816201445.1809483-1-vladimir.oltean@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/dsa/port.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/net/dsa/port.c ++++ b/net/dsa/port.c +@@ -145,11 +145,14 @@ int dsa_port_set_state(struct dsa_port * + static void dsa_port_set_state_now(struct dsa_port *dp, u8 state, + bool do_fast_age) + { ++ struct dsa_switch *ds = dp->ds; + int err; + + err = dsa_port_set_state(dp, state, do_fast_age); +- if (err) +- pr_err("DSA: failed to set STP state %u (%d)\n", state, err); ++ if (err && err != -EOPNOTSUPP) { ++ dev_err(ds->dev, "port %d failed to set STP state %u: %pe\n", ++ dp->index, state, ERR_PTR(err)); ++ } + } + + int dsa_port_set_mst_state(struct dsa_port *dp, diff --git a/queue-5.19/net-dsa-felix-fix-ethtool-256-511-and-512-1023-tx-packet-counters.patch b/queue-5.19/net-dsa-felix-fix-ethtool-256-511-and-512-1023-tx-packet-counters.patch new file mode 100644 index 00000000000..56cfc211a17 --- /dev/null +++ b/queue-5.19/net-dsa-felix-fix-ethtool-256-511-and-512-1023-tx-packet-counters.patch @@ -0,0 +1,32 @@ +From 40d21c4565bce064c73a03b79a157a3493c518b9 Mon Sep 17 00:00:00 2001 +From: Vladimir Oltean +Date: Tue, 16 Aug 2022 16:53:45 +0300 +Subject: net: dsa: felix: fix ethtool 256-511 and 512-1023 TX packet counters + +From: Vladimir Oltean + +commit 40d21c4565bce064c73a03b79a157a3493c518b9 upstream. + +What the driver actually reports as 256-511 is in fact 512-1023, and the +TX packets in the 256-511 bucket are not reported. Fix that. + +Fixes: 56051948773e ("net: dsa: ocelot: add driver for Felix switch family") +Signed-off-by: Vladimir Oltean +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/ocelot/felix_vsc9959.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/dsa/ocelot/felix_vsc9959.c ++++ b/drivers/net/dsa/ocelot/felix_vsc9959.c +@@ -601,7 +601,8 @@ static const struct ocelot_stat_layout v + { .offset = 0x87, .name = "tx_frames_below_65_octets", }, + { .offset = 0x88, .name = "tx_frames_65_to_127_octets", }, + { .offset = 0x89, .name = "tx_frames_128_255_octets", }, +- { .offset = 0x8B, .name = "tx_frames_256_511_octets", }, ++ { .offset = 0x8A, .name = "tx_frames_256_511_octets", }, ++ { .offset = 0x8B, .name = "tx_frames_512_1023_octets", }, + { .offset = 0x8C, .name = "tx_frames_1024_1526_octets", }, + { .offset = 0x8D, .name = "tx_frames_over_1526_octets", }, + { .offset = 0x8E, .name = "tx_yellow_prio_0", }, diff --git a/queue-5.19/net-dsa-microchip-ksz9477-fix-fdb_dump-last-invalid-entry.patch b/queue-5.19/net-dsa-microchip-ksz9477-fix-fdb_dump-last-invalid-entry.patch new file mode 100644 index 00000000000..13be55ca0b7 --- /dev/null +++ b/queue-5.19/net-dsa-microchip-ksz9477-fix-fdb_dump-last-invalid-entry.patch @@ -0,0 +1,41 @@ +From 36c0d935015766bf20d621c18313f17691bda5e3 Mon Sep 17 00:00:00 2001 +From: Arun Ramadoss +Date: Tue, 16 Aug 2022 16:25:16 +0530 +Subject: net: dsa: microchip: ksz9477: fix fdb_dump last invalid entry + +From: Arun Ramadoss + +commit 36c0d935015766bf20d621c18313f17691bda5e3 upstream. + +In the ksz9477_fdb_dump function it reads the ALU control register and +exit from the timeout loop if there is valid entry or search is +complete. After exiting the loop, it reads the alu entry and report to +the user space irrespective of entry is valid. It works till the valid +entry. If the loop exited when search is complete, it reads the alu +table. The table returns all ones and it is reported to user space. So +bridge fdb show gives ff:ff:ff:ff:ff:ff as last entry for every port. +To fix it, after exiting the loop the entry is reported only if it is +valid one. + +Fixes: b987e98e50ab ("dsa: add DSA switch driver for Microchip KSZ9477") +Signed-off-by: Arun Ramadoss +Reviewed-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20220816105516.18350-1-arun.ramadoss@microchip.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/microchip/ksz9477.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/dsa/microchip/ksz9477.c ++++ b/drivers/net/dsa/microchip/ksz9477.c +@@ -658,6 +658,9 @@ static int ksz9477_port_fdb_dump(struct + goto exit; + } + ++ if (!(ksz_data & ALU_VALID)) ++ continue; ++ + /* read ALU table */ + ksz9477_read_table(dev, alu_table); + diff --git a/queue-5.19/net-dsa-mv88e6060-prevent-crash-on-an-unused-port.patch b/queue-5.19/net-dsa-mv88e6060-prevent-crash-on-an-unused-port.patch new file mode 100644 index 00000000000..e0cda12acf2 --- /dev/null +++ b/queue-5.19/net-dsa-mv88e6060-prevent-crash-on-an-unused-port.patch @@ -0,0 +1,53 @@ +From 246bbf2f977ea36aaf41f5d24370fef433250728 Mon Sep 17 00:00:00 2001 +From: Sergei Antonov +Date: Thu, 11 Aug 2022 10:09:39 +0300 +Subject: net: dsa: mv88e6060: prevent crash on an unused port + +From: Sergei Antonov + +commit 246bbf2f977ea36aaf41f5d24370fef433250728 upstream. + +If the port isn't a CPU port nor a user port, 'cpu_dp' +is a null pointer and a crash happened on dereferencing +it in mv88e6060_setup_port(): + +[ 9.575872] Unable to handle kernel NULL pointer dereference at virtual address 00000014 +... +[ 9.942216] mv88e6060_setup from dsa_register_switch+0x814/0xe84 +[ 9.948616] dsa_register_switch from mdio_probe+0x2c/0x54 +[ 9.954433] mdio_probe from really_probe.part.0+0x98/0x2a0 +[ 9.960375] really_probe.part.0 from driver_probe_device+0x30/0x10c +[ 9.967029] driver_probe_device from __device_attach_driver+0xb8/0x13c +[ 9.973946] __device_attach_driver from bus_for_each_drv+0x90/0xe0 +[ 9.980509] bus_for_each_drv from __device_attach+0x110/0x184 +[ 9.986632] __device_attach from bus_probe_device+0x8c/0x94 +[ 9.992577] bus_probe_device from deferred_probe_work_func+0x78/0xa8 +[ 9.999311] deferred_probe_work_func from process_one_work+0x290/0x73c +[ 10.006292] process_one_work from worker_thread+0x30/0x4b8 +[ 10.012155] worker_thread from kthread+0xd4/0x10c +[ 10.017238] kthread from ret_from_fork+0x14/0x3c + +Fixes: 0abfd494deef ("net: dsa: use dedicated CPU port") +CC: Vivien Didelot +CC: Florian Fainelli +Signed-off-by: Sergei Antonov +Signed-off-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20220811070939.1717146-1-saproj@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/mv88e6060.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/dsa/mv88e6060.c ++++ b/drivers/net/dsa/mv88e6060.c +@@ -118,6 +118,9 @@ static int mv88e6060_setup_port(struct m + int addr = REG_PORT(p); + int ret; + ++ if (dsa_is_unused_port(priv->ds, p)) ++ return 0; ++ + /* Do not force flow control, disable Ingress and Egress + * Header tagging, disable VLAN tunneling, and set the port + * state to Forwarding. Additionally, if this is the CPU diff --git a/queue-5.19/net-dsa-sja1105-fix-buffer-overflow-in-sja1105_setup_devlink_regions.patch b/queue-5.19/net-dsa-sja1105-fix-buffer-overflow-in-sja1105_setup_devlink_regions.patch new file mode 100644 index 00000000000..5be9063f5ce --- /dev/null +++ b/queue-5.19/net-dsa-sja1105-fix-buffer-overflow-in-sja1105_setup_devlink_regions.patch @@ -0,0 +1,34 @@ +From fd8e899cdb5ecaf8e8ee73854a99e10807eef1de Mon Sep 17 00:00:00 2001 +From: Rustam Subkhankulov +Date: Wed, 17 Aug 2022 03:38:45 +0300 +Subject: net: dsa: sja1105: fix buffer overflow in sja1105_setup_devlink_regions() + +From: Rustam Subkhankulov + +commit fd8e899cdb5ecaf8e8ee73854a99e10807eef1de upstream. + +If an error occurs in dsa_devlink_region_create(), then 'priv->regions' +array will be accessed by negative index '-1'. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Signed-off-by: Rustam Subkhankulov +Fixes: bf425b82059e ("net: dsa: sja1105: expose static config as devlink region") +Link: https://lore.kernel.org/r/20220817003845.389644-1-subkhankulov@ispras.ru +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/sja1105/sja1105_devlink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/dsa/sja1105/sja1105_devlink.c ++++ b/drivers/net/dsa/sja1105/sja1105_devlink.c +@@ -93,7 +93,7 @@ static int sja1105_setup_devlink_regions + + region = dsa_devlink_region_create(ds, ops, 1, size); + if (IS_ERR(region)) { +- while (i-- >= 0) ++ while (--i >= 0) + dsa_devlink_region_destroy(priv->regions[i]); + return PTR_ERR(region); + } diff --git a/queue-5.19/net-fix-potential-refcount-leak-in-ndisc_router_discovery.patch b/queue-5.19/net-fix-potential-refcount-leak-in-ndisc_router_discovery.patch new file mode 100644 index 00000000000..05777ffabb6 --- /dev/null +++ b/queue-5.19/net-fix-potential-refcount-leak-in-ndisc_router_discovery.patch @@ -0,0 +1,40 @@ +From 7396ba87f1edf549284869451665c7c4e74ecd4f Mon Sep 17 00:00:00 2001 +From: Xin Xiong +Date: Sat, 13 Aug 2022 20:49:08 +0800 +Subject: net: fix potential refcount leak in ndisc_router_discovery() + +From: Xin Xiong + +commit 7396ba87f1edf549284869451665c7c4e74ecd4f upstream. + +The issue happens on specific paths in the function. After both the +object `rt` and `neigh` are grabbed successfully, when `lifetime` is +nonzero but the metric needs change, the function just deletes the +route and set `rt` to NULL. Then, it may try grabbing `rt` and `neigh` +again if above conditions hold. The function simply overwrite `neigh` +if succeeds or returns if fails, without decreasing the reference +count of previous `neigh`. This may result in memory leaks. + +Fix it by decrementing the reference count of `neigh` in place. + +Fixes: 6b2e04bc240f ("net: allow user to set metric on default route learned via Router Advertisement") +Signed-off-by: Xin Xiong +Signed-off-by: Xin Tan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ndisc.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/ipv6/ndisc.c ++++ b/net/ipv6/ndisc.c +@@ -1358,6 +1358,9 @@ static void ndisc_router_discovery(struc + if (!rt && lifetime) { + ND_PRINTK(3, info, "RA: adding default router\n"); + ++ if (neigh) ++ neigh_release(neigh); ++ + rt = rt6_add_dflt_router(net, &ipv6_hdr(skb)->saddr, + skb->dev, pref, defrtr_usr_metric); + if (!rt) { diff --git a/queue-5.19/net-genl-fix-error-path-memory-leak-in-policy-dumping.patch b/queue-5.19/net-genl-fix-error-path-memory-leak-in-policy-dumping.patch new file mode 100644 index 00000000000..fc0f8348485 --- /dev/null +++ b/queue-5.19/net-genl-fix-error-path-memory-leak-in-policy-dumping.patch @@ -0,0 +1,84 @@ +From 249801360db3dec4f73768c502192020bfddeacc Mon Sep 17 00:00:00 2001 +From: Jakub Kicinski +Date: Tue, 16 Aug 2022 09:19:39 -0700 +Subject: net: genl: fix error path memory leak in policy dumping + +From: Jakub Kicinski + +commit 249801360db3dec4f73768c502192020bfddeacc upstream. + +If construction of the array of policies fails when recording +non-first policy we need to unwind. + +netlink_policy_dump_add_policy() itself also needs fixing as +it currently gives up on error without recording the allocated +pointer in the pstate pointer. + +Reported-by: syzbot+dc54d9ba8153b216cae0@syzkaller.appspotmail.com +Fixes: 50a896cf2d6f ("genetlink: properly support per-op policy dumping") +Link: https://lore.kernel.org/r/20220816161939.577583-1-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/netlink/genetlink.c | 6 +++++- + net/netlink/policy.c | 14 ++++++++++++-- + 2 files changed, 17 insertions(+), 3 deletions(-) + +--- a/net/netlink/genetlink.c ++++ b/net/netlink/genetlink.c +@@ -1174,13 +1174,17 @@ static int ctrl_dumppolicy_start(struct + op.policy, + op.maxattr); + if (err) +- return err; ++ goto err_free_state; + } + } + + if (!ctx->state) + return -ENODATA; + return 0; ++ ++err_free_state: ++ netlink_policy_dump_free(ctx->state); ++ return err; + } + + static void *ctrl_dumppolicy_prep(struct sk_buff *skb, +--- a/net/netlink/policy.c ++++ b/net/netlink/policy.c +@@ -144,7 +144,7 @@ int netlink_policy_dump_add_policy(struc + + err = add_policy(&state, policy, maxtype); + if (err) +- return err; ++ goto err_try_undo; + + for (policy_idx = 0; + policy_idx < state->n_alloc && state->policies[policy_idx].policy; +@@ -164,7 +164,7 @@ int netlink_policy_dump_add_policy(struc + policy[type].nested_policy, + policy[type].len); + if (err) +- return err; ++ goto err_try_undo; + break; + default: + break; +@@ -174,6 +174,16 @@ int netlink_policy_dump_add_policy(struc + + *pstate = state; + return 0; ++ ++err_try_undo: ++ /* Try to preserve reasonable unwind semantics - if we're starting from ++ * scratch clean up fully, otherwise record what we got and caller will. ++ */ ++ if (!*pstate) ++ netlink_policy_dump_free(state); ++ else ++ *pstate = state; ++ return err; + } + + static bool diff --git a/queue-5.19/net-moxa-pass-pdev-instead-of-ndev-to-dma-functions.patch b/queue-5.19/net-moxa-pass-pdev-instead-of-ndev-to-dma-functions.patch new file mode 100644 index 00000000000..cb5812b3ec3 --- /dev/null +++ b/queue-5.19/net-moxa-pass-pdev-instead-of-ndev-to-dma-functions.patch @@ -0,0 +1,111 @@ +From 3a12df22a8f68954a4ba48435c06b3d1791c87c4 Mon Sep 17 00:00:00 2001 +From: Sergei Antonov +Date: Fri, 12 Aug 2022 20:13:39 +0300 +Subject: net: moxa: pass pdev instead of ndev to DMA functions + +From: Sergei Antonov + +commit 3a12df22a8f68954a4ba48435c06b3d1791c87c4 upstream. + +dma_map_single() calls fail in moxart_mac_setup_desc_ring() and +moxart_mac_start_xmit() which leads to an incessant output of this: + +[ 16.043925] moxart-ethernet 92000000.mac eth0: DMA mapping error +[ 16.050957] moxart-ethernet 92000000.mac eth0: DMA mapping error +[ 16.058229] moxart-ethernet 92000000.mac eth0: DMA mapping error + +Passing pdev to DMA is a common approach among net drivers. + +Fixes: 6c821bd9edc9 ("net: Add MOXA ART SoCs ethernet driver") +Signed-off-by: Sergei Antonov +Suggested-by: Andrew Lunn +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20220812171339.2271788-1-saproj@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/moxa/moxart_ether.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +--- a/drivers/net/ethernet/moxa/moxart_ether.c ++++ b/drivers/net/ethernet/moxa/moxart_ether.c +@@ -77,7 +77,7 @@ static void moxart_mac_free_memory(struc + int i; + + for (i = 0; i < RX_DESC_NUM; i++) +- dma_unmap_single(&ndev->dev, priv->rx_mapping[i], ++ dma_unmap_single(&priv->pdev->dev, priv->rx_mapping[i], + priv->rx_buf_size, DMA_FROM_DEVICE); + + if (priv->tx_desc_base) +@@ -147,11 +147,11 @@ static void moxart_mac_setup_desc_ring(s + desc + RX_REG_OFFSET_DESC1); + + priv->rx_buf[i] = priv->rx_buf_base + priv->rx_buf_size * i; +- priv->rx_mapping[i] = dma_map_single(&ndev->dev, ++ priv->rx_mapping[i] = dma_map_single(&priv->pdev->dev, + priv->rx_buf[i], + priv->rx_buf_size, + DMA_FROM_DEVICE); +- if (dma_mapping_error(&ndev->dev, priv->rx_mapping[i])) ++ if (dma_mapping_error(&priv->pdev->dev, priv->rx_mapping[i])) + netdev_err(ndev, "DMA mapping error\n"); + + moxart_desc_write(priv->rx_mapping[i], +@@ -240,7 +240,7 @@ static int moxart_rx_poll(struct napi_st + if (len > RX_BUF_SIZE) + len = RX_BUF_SIZE; + +- dma_sync_single_for_cpu(&ndev->dev, ++ dma_sync_single_for_cpu(&priv->pdev->dev, + priv->rx_mapping[rx_head], + priv->rx_buf_size, DMA_FROM_DEVICE); + skb = netdev_alloc_skb_ip_align(ndev, len); +@@ -294,7 +294,7 @@ static void moxart_tx_finished(struct ne + unsigned int tx_tail = priv->tx_tail; + + while (tx_tail != tx_head) { +- dma_unmap_single(&ndev->dev, priv->tx_mapping[tx_tail], ++ dma_unmap_single(&priv->pdev->dev, priv->tx_mapping[tx_tail], + priv->tx_len[tx_tail], DMA_TO_DEVICE); + + ndev->stats.tx_packets++; +@@ -358,9 +358,9 @@ static netdev_tx_t moxart_mac_start_xmit + + len = skb->len > TX_BUF_SIZE ? TX_BUF_SIZE : skb->len; + +- priv->tx_mapping[tx_head] = dma_map_single(&ndev->dev, skb->data, ++ priv->tx_mapping[tx_head] = dma_map_single(&priv->pdev->dev, skb->data, + len, DMA_TO_DEVICE); +- if (dma_mapping_error(&ndev->dev, priv->tx_mapping[tx_head])) { ++ if (dma_mapping_error(&priv->pdev->dev, priv->tx_mapping[tx_head])) { + netdev_err(ndev, "DMA mapping error\n"); + goto out_unlock; + } +@@ -379,7 +379,7 @@ static netdev_tx_t moxart_mac_start_xmit + len = ETH_ZLEN; + } + +- dma_sync_single_for_device(&ndev->dev, priv->tx_mapping[tx_head], ++ dma_sync_single_for_device(&priv->pdev->dev, priv->tx_mapping[tx_head], + priv->tx_buf_size, DMA_TO_DEVICE); + + txdes1 = TX_DESC1_LTS | TX_DESC1_FTS | (len & TX_DESC1_BUF_SIZE_MASK); +@@ -493,7 +493,7 @@ static int moxart_mac_probe(struct platf + priv->tx_buf_size = TX_BUF_SIZE; + priv->rx_buf_size = RX_BUF_SIZE; + +- priv->tx_desc_base = dma_alloc_coherent(&pdev->dev, TX_REG_DESC_SIZE * ++ priv->tx_desc_base = dma_alloc_coherent(p_dev, TX_REG_DESC_SIZE * + TX_DESC_NUM, &priv->tx_base, + GFP_DMA | GFP_KERNEL); + if (!priv->tx_desc_base) { +@@ -501,7 +501,7 @@ static int moxart_mac_probe(struct platf + goto init_fail; + } + +- priv->rx_desc_base = dma_alloc_coherent(&pdev->dev, RX_REG_DESC_SIZE * ++ priv->rx_desc_base = dma_alloc_coherent(p_dev, RX_REG_DESC_SIZE * + RX_DESC_NUM, &priv->rx_base, + GFP_DMA | GFP_KERNEL); + if (!priv->rx_desc_base) { diff --git a/queue-5.19/net-mscc-ocelot-fix-address-of-sys_count_tx_aging-counter.patch b/queue-5.19/net-mscc-ocelot-fix-address-of-sys_count_tx_aging-counter.patch new file mode 100644 index 00000000000..03b00fbbd91 --- /dev/null +++ b/queue-5.19/net-mscc-ocelot-fix-address-of-sys_count_tx_aging-counter.patch @@ -0,0 +1,32 @@ +From 173ca86618d751bd183456c9cdbb69952ba283c8 Mon Sep 17 00:00:00 2001 +From: Vladimir Oltean +Date: Tue, 16 Aug 2022 16:53:47 +0300 +Subject: net: mscc: ocelot: fix address of SYS_COUNT_TX_AGING counter + +From: Vladimir Oltean + +commit 173ca86618d751bd183456c9cdbb69952ba283c8 upstream. + +This register, used as part of stats->tx_dropped in +ocelot_get_stats64(), has a wrong address. At the address currently +given, there is actually the c_tx_green_prio_6 counter. + +Fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support") +Signed-off-by: Vladimir Oltean +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mscc/vsc7514_regs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mscc/vsc7514_regs.c ++++ b/drivers/net/ethernet/mscc/vsc7514_regs.c +@@ -202,7 +202,7 @@ const u32 vsc7514_sys_regmap[] = { + REG(SYS_COUNT_TX_512_1023, 0x00012c), + REG(SYS_COUNT_TX_1024_1526, 0x000130), + REG(SYS_COUNT_TX_1527_MAX, 0x000134), +- REG(SYS_COUNT_TX_AGING, 0x000170), ++ REG(SYS_COUNT_TX_AGING, 0x000178), + REG(SYS_RESET_CFG, 0x000508), + REG(SYS_CMID, 0x00050c), + REG(SYS_VLAN_ETYPE_CFG, 0x000510), diff --git a/queue-5.19/net-mscc-ocelot-fix-incorrect-ndo_get_stats64-packet-counters.patch b/queue-5.19/net-mscc-ocelot-fix-incorrect-ndo_get_stats64-packet-counters.patch new file mode 100644 index 00000000000..dc9418ca20f --- /dev/null +++ b/queue-5.19/net-mscc-ocelot-fix-incorrect-ndo_get_stats64-packet-counters.patch @@ -0,0 +1,192 @@ +From 5152de7b79ab0be150f5966481b0c8f996192531 Mon Sep 17 00:00:00 2001 +From: Vladimir Oltean +Date: Tue, 16 Aug 2022 16:53:46 +0300 +Subject: net: mscc: ocelot: fix incorrect ndo_get_stats64 packet counters + +From: Vladimir Oltean + +commit 5152de7b79ab0be150f5966481b0c8f996192531 upstream. + +Reading stats using the SYS_COUNT_* register definitions is only used by +ocelot_get_stats64() from the ocelot switchdev driver, however, +currently the bucket definitions are incorrect. + +Separately, on both RX and TX, we have the following problems: +- a 256-1023 bucket which actually tracks the 256-511 packets +- the 1024-1526 bucket actually tracks the 512-1023 packets +- the 1527-max bucket actually tracks the 1024-1526 packets + +=> nobody tracks the packets from the real 1527-max bucket + +Additionally, the RX_PAUSE, RX_CONTROL, RX_LONGS and RX_CLASSIFIED_DROPS +all track the wrong thing. However this doesn't seem to have any +consequence, since ocelot_get_stats64() doesn't use these. + +Even though this problem only manifests itself for the switchdev driver, +we cannot split the fix for ocelot and for DSA, since it requires fixing +the bucket definitions from enum ocelot_reg, which makes us necessarily +adapt the structures from felix and seville as well. + +Fixes: 84705fc16552 ("net: dsa: felix: introduce support for Seville VSC9953 switch") +Fixes: 56051948773e ("net: dsa: ocelot: add driver for Felix switch family") +Fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support") +Signed-off-by: Vladimir Oltean +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/ocelot/felix_vsc9959.c | 20 ++++++++++++-------- + drivers/net/dsa/ocelot/seville_vsc9953.c | 16 +++++++++------- + drivers/net/ethernet/mscc/ocelot_net.c | 6 ++++-- + drivers/net/ethernet/mscc/vsc7514_regs.c | 24 +++++++++++++----------- + include/soc/mscc/ocelot.h | 6 ++++-- + 5 files changed, 42 insertions(+), 30 deletions(-) + +--- a/drivers/net/dsa/ocelot/felix_vsc9959.c ++++ b/drivers/net/dsa/ocelot/felix_vsc9959.c +@@ -280,19 +280,23 @@ static const u32 vsc9959_sys_regmap[] = + REG(SYS_COUNT_RX_64, 0x000024), + REG(SYS_COUNT_RX_65_127, 0x000028), + REG(SYS_COUNT_RX_128_255, 0x00002c), +- REG(SYS_COUNT_RX_256_1023, 0x000030), +- REG(SYS_COUNT_RX_1024_1526, 0x000034), +- REG(SYS_COUNT_RX_1527_MAX, 0x000038), +- REG(SYS_COUNT_RX_LONGS, 0x000044), ++ REG(SYS_COUNT_RX_256_511, 0x000030), ++ REG(SYS_COUNT_RX_512_1023, 0x000034), ++ REG(SYS_COUNT_RX_1024_1526, 0x000038), ++ REG(SYS_COUNT_RX_1527_MAX, 0x00003c), ++ REG(SYS_COUNT_RX_PAUSE, 0x000040), ++ REG(SYS_COUNT_RX_CONTROL, 0x000044), ++ REG(SYS_COUNT_RX_LONGS, 0x000048), + REG(SYS_COUNT_TX_OCTETS, 0x000200), + REG(SYS_COUNT_TX_COLLISION, 0x000210), + REG(SYS_COUNT_TX_DROPS, 0x000214), + REG(SYS_COUNT_TX_64, 0x00021c), + REG(SYS_COUNT_TX_65_127, 0x000220), +- REG(SYS_COUNT_TX_128_511, 0x000224), +- REG(SYS_COUNT_TX_512_1023, 0x000228), +- REG(SYS_COUNT_TX_1024_1526, 0x00022c), +- REG(SYS_COUNT_TX_1527_MAX, 0x000230), ++ REG(SYS_COUNT_TX_128_255, 0x000224), ++ REG(SYS_COUNT_TX_256_511, 0x000228), ++ REG(SYS_COUNT_TX_512_1023, 0x00022c), ++ REG(SYS_COUNT_TX_1024_1526, 0x000230), ++ REG(SYS_COUNT_TX_1527_MAX, 0x000234), + REG(SYS_COUNT_TX_AGING, 0x000278), + REG(SYS_RESET_CFG, 0x000e00), + REG(SYS_SR_ETYPE_CFG, 0x000e04), +--- a/drivers/net/dsa/ocelot/seville_vsc9953.c ++++ b/drivers/net/dsa/ocelot/seville_vsc9953.c +@@ -277,19 +277,21 @@ static const u32 vsc9953_sys_regmap[] = + REG(SYS_COUNT_RX_64, 0x000024), + REG(SYS_COUNT_RX_65_127, 0x000028), + REG(SYS_COUNT_RX_128_255, 0x00002c), +- REG(SYS_COUNT_RX_256_1023, 0x000030), +- REG(SYS_COUNT_RX_1024_1526, 0x000034), +- REG(SYS_COUNT_RX_1527_MAX, 0x000038), ++ REG(SYS_COUNT_RX_256_511, 0x000030), ++ REG(SYS_COUNT_RX_512_1023, 0x000034), ++ REG(SYS_COUNT_RX_1024_1526, 0x000038), ++ REG(SYS_COUNT_RX_1527_MAX, 0x00003c), + REG(SYS_COUNT_RX_LONGS, 0x000048), + REG(SYS_COUNT_TX_OCTETS, 0x000100), + REG(SYS_COUNT_TX_COLLISION, 0x000110), + REG(SYS_COUNT_TX_DROPS, 0x000114), + REG(SYS_COUNT_TX_64, 0x00011c), + REG(SYS_COUNT_TX_65_127, 0x000120), +- REG(SYS_COUNT_TX_128_511, 0x000124), +- REG(SYS_COUNT_TX_512_1023, 0x000128), +- REG(SYS_COUNT_TX_1024_1526, 0x00012c), +- REG(SYS_COUNT_TX_1527_MAX, 0x000130), ++ REG(SYS_COUNT_TX_128_255, 0x000124), ++ REG(SYS_COUNT_TX_256_511, 0x000128), ++ REG(SYS_COUNT_TX_512_1023, 0x00012c), ++ REG(SYS_COUNT_TX_1024_1526, 0x000130), ++ REG(SYS_COUNT_TX_1527_MAX, 0x000134), + REG(SYS_COUNT_TX_AGING, 0x000178), + REG(SYS_RESET_CFG, 0x000318), + REG_RESERVED(SYS_SR_ETYPE_CFG), +--- a/drivers/net/ethernet/mscc/ocelot_net.c ++++ b/drivers/net/ethernet/mscc/ocelot_net.c +@@ -739,7 +739,8 @@ static void ocelot_get_stats64(struct ne + ocelot_read(ocelot, SYS_COUNT_RX_64) + + ocelot_read(ocelot, SYS_COUNT_RX_65_127) + + ocelot_read(ocelot, SYS_COUNT_RX_128_255) + +- ocelot_read(ocelot, SYS_COUNT_RX_256_1023) + ++ ocelot_read(ocelot, SYS_COUNT_RX_256_511) + ++ ocelot_read(ocelot, SYS_COUNT_RX_512_1023) + + ocelot_read(ocelot, SYS_COUNT_RX_1024_1526) + + ocelot_read(ocelot, SYS_COUNT_RX_1527_MAX); + stats->multicast = ocelot_read(ocelot, SYS_COUNT_RX_MULTICAST); +@@ -749,7 +750,8 @@ static void ocelot_get_stats64(struct ne + stats->tx_bytes = ocelot_read(ocelot, SYS_COUNT_TX_OCTETS); + stats->tx_packets = ocelot_read(ocelot, SYS_COUNT_TX_64) + + ocelot_read(ocelot, SYS_COUNT_TX_65_127) + +- ocelot_read(ocelot, SYS_COUNT_TX_128_511) + ++ ocelot_read(ocelot, SYS_COUNT_TX_128_255) + ++ ocelot_read(ocelot, SYS_COUNT_TX_256_511) + + ocelot_read(ocelot, SYS_COUNT_TX_512_1023) + + ocelot_read(ocelot, SYS_COUNT_TX_1024_1526) + + ocelot_read(ocelot, SYS_COUNT_TX_1527_MAX); +--- a/drivers/net/ethernet/mscc/vsc7514_regs.c ++++ b/drivers/net/ethernet/mscc/vsc7514_regs.c +@@ -180,13 +180,14 @@ const u32 vsc7514_sys_regmap[] = { + REG(SYS_COUNT_RX_64, 0x000024), + REG(SYS_COUNT_RX_65_127, 0x000028), + REG(SYS_COUNT_RX_128_255, 0x00002c), +- REG(SYS_COUNT_RX_256_1023, 0x000030), +- REG(SYS_COUNT_RX_1024_1526, 0x000034), +- REG(SYS_COUNT_RX_1527_MAX, 0x000038), +- REG(SYS_COUNT_RX_PAUSE, 0x00003c), +- REG(SYS_COUNT_RX_CONTROL, 0x000040), +- REG(SYS_COUNT_RX_LONGS, 0x000044), +- REG(SYS_COUNT_RX_CLASSIFIED_DROPS, 0x000048), ++ REG(SYS_COUNT_RX_256_511, 0x000030), ++ REG(SYS_COUNT_RX_512_1023, 0x000034), ++ REG(SYS_COUNT_RX_1024_1526, 0x000038), ++ REG(SYS_COUNT_RX_1527_MAX, 0x00003c), ++ REG(SYS_COUNT_RX_PAUSE, 0x000040), ++ REG(SYS_COUNT_RX_CONTROL, 0x000044), ++ REG(SYS_COUNT_RX_LONGS, 0x000048), ++ REG(SYS_COUNT_RX_CLASSIFIED_DROPS, 0x00004c), + REG(SYS_COUNT_TX_OCTETS, 0x000100), + REG(SYS_COUNT_TX_UNICAST, 0x000104), + REG(SYS_COUNT_TX_MULTICAST, 0x000108), +@@ -196,10 +197,11 @@ const u32 vsc7514_sys_regmap[] = { + REG(SYS_COUNT_TX_PAUSE, 0x000118), + REG(SYS_COUNT_TX_64, 0x00011c), + REG(SYS_COUNT_TX_65_127, 0x000120), +- REG(SYS_COUNT_TX_128_511, 0x000124), +- REG(SYS_COUNT_TX_512_1023, 0x000128), +- REG(SYS_COUNT_TX_1024_1526, 0x00012c), +- REG(SYS_COUNT_TX_1527_MAX, 0x000130), ++ REG(SYS_COUNT_TX_128_255, 0x000124), ++ REG(SYS_COUNT_TX_256_511, 0x000128), ++ REG(SYS_COUNT_TX_512_1023, 0x00012c), ++ REG(SYS_COUNT_TX_1024_1526, 0x000130), ++ REG(SYS_COUNT_TX_1527_MAX, 0x000134), + REG(SYS_COUNT_TX_AGING, 0x000170), + REG(SYS_RESET_CFG, 0x000508), + REG(SYS_CMID, 0x00050c), +--- a/include/soc/mscc/ocelot.h ++++ b/include/soc/mscc/ocelot.h +@@ -335,7 +335,8 @@ enum ocelot_reg { + SYS_COUNT_RX_64, + SYS_COUNT_RX_65_127, + SYS_COUNT_RX_128_255, +- SYS_COUNT_RX_256_1023, ++ SYS_COUNT_RX_256_511, ++ SYS_COUNT_RX_512_1023, + SYS_COUNT_RX_1024_1526, + SYS_COUNT_RX_1527_MAX, + SYS_COUNT_RX_PAUSE, +@@ -351,7 +352,8 @@ enum ocelot_reg { + SYS_COUNT_TX_PAUSE, + SYS_COUNT_TX_64, + SYS_COUNT_TX_65_127, +- SYS_COUNT_TX_128_511, ++ SYS_COUNT_TX_128_255, ++ SYS_COUNT_TX_256_511, + SYS_COUNT_TX_512_1023, + SYS_COUNT_TX_1024_1526, + SYS_COUNT_TX_1527_MAX, diff --git a/queue-5.19/net-qrtr-start-mhi-channel-after-endpoit-creation.patch b/queue-5.19/net-qrtr-start-mhi-channel-after-endpoit-creation.patch new file mode 100644 index 00000000000..f20fd624011 --- /dev/null +++ b/queue-5.19/net-qrtr-start-mhi-channel-after-endpoit-creation.patch @@ -0,0 +1,75 @@ +From 68a838b84effb7b57ba7d50b1863fc6ae35a54ce Mon Sep 17 00:00:00 2001 +From: Maxim Kochetkov +Date: Thu, 11 Aug 2022 12:48:40 +0300 +Subject: net: qrtr: start MHI channel after endpoit creation + +From: Maxim Kochetkov + +commit 68a838b84effb7b57ba7d50b1863fc6ae35a54ce upstream. + +MHI channel may generates event/interrupt right after enabling. +It may leads to 2 race conditions issues. + +1) +Such event may be dropped by qcom_mhi_qrtr_dl_callback() at check: + + if (!qdev || mhi_res->transaction_status) + return; + +Because dev_set_drvdata(&mhi_dev->dev, qdev) may be not performed at +this moment. In this situation qrtr-ns will be unable to enumerate +services in device. +--------------------------------------------------------------- + +2) +Such event may come at the moment after dev_set_drvdata() and +before qrtr_endpoint_register(). In this case kernel will panic with +accessing wrong pointer at qcom_mhi_qrtr_dl_callback(): + + rc = qrtr_endpoint_post(&qdev->ep, mhi_res->buf_addr, + mhi_res->bytes_xferd); + +Because endpoint is not created yet. +-------------------------------------------------------------- +So move mhi_prepare_for_transfer_autoqueue after endpoint creation +to fix it. + +Fixes: a2e2cc0dbb11 ("net: qrtr: Start MHI channels during init") +Signed-off-by: Maxim Kochetkov +Reviewed-by: Hemant Kumar +Reviewed-by: Manivannan Sadhasivam +Reviewed-by: Loic Poulain +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/qrtr/mhi.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/net/qrtr/mhi.c ++++ b/net/qrtr/mhi.c +@@ -78,11 +78,6 @@ static int qcom_mhi_qrtr_probe(struct mh + struct qrtr_mhi_dev *qdev; + int rc; + +- /* start channels */ +- rc = mhi_prepare_for_transfer_autoqueue(mhi_dev); +- if (rc) +- return rc; +- + qdev = devm_kzalloc(&mhi_dev->dev, sizeof(*qdev), GFP_KERNEL); + if (!qdev) + return -ENOMEM; +@@ -96,6 +91,13 @@ static int qcom_mhi_qrtr_probe(struct mh + if (rc) + return rc; + ++ /* start channels */ ++ rc = mhi_prepare_for_transfer_autoqueue(mhi_dev); ++ if (rc) { ++ qrtr_endpoint_unregister(&qdev->ep); ++ return rc; ++ } ++ + dev_dbg(qdev->dev, "Qualcomm MHI QRTR driver probed\n"); + + return 0; diff --git a/queue-5.19/net-rtnetlink-fix-module-reference-count-leak-issue-in-rtnetlink_rcv_msg.patch b/queue-5.19/net-rtnetlink-fix-module-reference-count-leak-issue-in-rtnetlink_rcv_msg.patch new file mode 100644 index 00000000000..57f7b151c19 --- /dev/null +++ b/queue-5.19/net-rtnetlink-fix-module-reference-count-leak-issue-in-rtnetlink_rcv_msg.patch @@ -0,0 +1,38 @@ +From 5b22f62724a0a09e00d301abf5b57b0c12be8a16 Mon Sep 17 00:00:00 2001 +From: Zhengchao Shao +Date: Mon, 15 Aug 2022 10:46:29 +0800 +Subject: net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg + +From: Zhengchao Shao + +commit 5b22f62724a0a09e00d301abf5b57b0c12be8a16 upstream. + +When bulk delete command is received in the rtnetlink_rcv_msg function, +if bulk delete is not supported, module_put is not called to release +the reference counting. As a result, module reference count is leaked. + +Fixes: a6cec0bcd342 ("net: rtnetlink: add bulk delete support flag") +Signed-off-by: Zhengchao Shao +Acked-by: Nikolay Aleksandrov +Link: https://lore.kernel.org/r/20220815024629.240367-1-shaozhengchao@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/core/rtnetlink.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index ac45328607f7..4b5b15c684ed 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -6070,6 +6070,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, + if (kind == RTNL_KIND_DEL && (nlh->nlmsg_flags & NLM_F_BULK) && + !(flags & RTNL_FLAG_BULK_DEL_SUPPORTED)) { + NL_SET_ERR_MSG(extack, "Bulk delete is not supported"); ++ module_put(owner); + goto err_unlock; + } + +-- +2.37.2 + diff --git a/queue-5.19/net-sched-fix-misuse-of-qcpu-backlog-in-gnet_stats_add_queue_cpu.patch b/queue-5.19/net-sched-fix-misuse-of-qcpu-backlog-in-gnet_stats_add_queue_cpu.patch new file mode 100644 index 00000000000..61bb8e03d33 --- /dev/null +++ b/queue-5.19/net-sched-fix-misuse-of-qcpu-backlog-in-gnet_stats_add_queue_cpu.patch @@ -0,0 +1,32 @@ +From de64b6b6fb6f369840d171b7c5a9baf31b8b2630 Mon Sep 17 00:00:00 2001 +From: Zhengchao Shao +Date: Mon, 15 Aug 2022 11:08:48 +0800 +Subject: net: sched: fix misuse of qcpu->backlog in gnet_stats_add_queue_cpu + +From: Zhengchao Shao + +commit de64b6b6fb6f369840d171b7c5a9baf31b8b2630 upstream. + +In the gnet_stats_add_queue_cpu function, the qstats->qlen statistics +are incorrectly set to qcpu->backlog. + +Fixes: 448e163f8b9b ("gen_stats: Add gnet_stats_add_queue()") +Signed-off-by: Zhengchao Shao +Link: https://lore.kernel.org/r/20220815030848.276746-1-shaozhengchao@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/core/gen_stats.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/core/gen_stats.c ++++ b/net/core/gen_stats.c +@@ -345,7 +345,7 @@ static void gnet_stats_add_queue_cpu(str + for_each_possible_cpu(i) { + const struct gnet_stats_queue *qcpu = per_cpu_ptr(q, i); + +- qstats->qlen += qcpu->backlog; ++ qstats->qlen += qcpu->qlen; + qstats->backlog += qcpu->backlog; + qstats->drops += qcpu->drops; + qstats->requeues += qcpu->requeues; diff --git a/queue-5.19/net-sunrpc-fix-potential-memory-leaks-in-rpc_sysfs_xprt_state_change.patch b/queue-5.19/net-sunrpc-fix-potential-memory-leaks-in-rpc_sysfs_xprt_state_change.patch new file mode 100644 index 00000000000..be1e6e74d3d --- /dev/null +++ b/queue-5.19/net-sunrpc-fix-potential-memory-leaks-in-rpc_sysfs_xprt_state_change.patch @@ -0,0 +1,43 @@ +From bfc48f1b0505ffcb03a6d749139b7577d6b81ae0 Mon Sep 17 00:00:00 2001 +From: Xin Xiong +Date: Wed, 10 Aug 2022 23:29:13 +0800 +Subject: net/sunrpc: fix potential memory leaks in rpc_sysfs_xprt_state_change() + +From: Xin Xiong + +commit bfc48f1b0505ffcb03a6d749139b7577d6b81ae0 upstream. + +The issue happens on some error handling paths. When the function +fails to grab the object `xprt`, it simply returns 0, forgetting to +decrease the reference count of another object `xps`, which is +increased by rpc_sysfs_xprt_kobj_get_xprt_switch(), causing refcount +leaks. Also, the function forgets to check whether `xps` is valid +before using it, which may result in NULL-dereferencing issues. + +Fix it by adding proper error handling code when either `xprt` or +`xps` is NULL. + +Fixes: 5b7eb78486cd ("SUNRPC: take a xprt offline using sysfs") +Signed-off-by: Xin Xiong +Signed-off-by: Xin Tan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/sunrpc/sysfs.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/net/sunrpc/sysfs.c ++++ b/net/sunrpc/sysfs.c +@@ -291,8 +291,10 @@ static ssize_t rpc_sysfs_xprt_state_chan + int offline = 0, online = 0, remove = 0; + struct rpc_xprt_switch *xps = rpc_sysfs_xprt_kobj_get_xprt_switch(kobj); + +- if (!xprt) +- return 0; ++ if (!xprt || !xps) { ++ count = 0; ++ goto out_put; ++ } + + if (!strncmp(buf, "offline", 7)) + offline = 1; diff --git a/queue-5.19/netfilter-nf_ct_ftp-prefer-skb_linearize.patch b/queue-5.19/netfilter-nf_ct_ftp-prefer-skb_linearize.patch new file mode 100644 index 00000000000..41f98321a32 --- /dev/null +++ b/queue-5.19/netfilter-nf_ct_ftp-prefer-skb_linearize.patch @@ -0,0 +1,111 @@ +From c783a29c7e5934eabac2b760571489ad83bf4fd1 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Tue, 9 Aug 2022 15:16:34 +0200 +Subject: netfilter: nf_ct_ftp: prefer skb_linearize + +From: Florian Westphal + +commit c783a29c7e5934eabac2b760571489ad83bf4fd1 upstream. + +This uses a pseudo-linearization scheme with a 64k global buffer, +but BIG TCP arrival means IPv6 TCP stack can generate skbs +that exceed this size. + +Use skb_linearize. It should be possible to rewrite this to properly +deal with segmented skbs (i.e., only do small chunk-wise accesses), +but this is going to be a lot more intrusive than this because every +helper function needs to get the sk_buff instead of a pointer to a raw +data buffer. + +In practice, provided we're really looking at FTP control channel packets, +there should never be a case where we deal with huge packets. + +Fixes: 7c4e983c4f3c ("net: allow gso_max_size to exceed 65536") +Fixes: 0fe79f28bfaf ("net: allow gro_max_size to exceed 65536") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_conntrack_ftp.c | 24 ++++++------------------ + 1 file changed, 6 insertions(+), 18 deletions(-) + +diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c +index a414274338cf..0d9332e9cf71 100644 +--- a/net/netfilter/nf_conntrack_ftp.c ++++ b/net/netfilter/nf_conntrack_ftp.c +@@ -34,11 +34,6 @@ MODULE_DESCRIPTION("ftp connection tracking helper"); + MODULE_ALIAS("ip_conntrack_ftp"); + MODULE_ALIAS_NFCT_HELPER(HELPER_NAME); + +-/* This is slow, but it's simple. --RR */ +-static char *ftp_buffer; +- +-static DEFINE_SPINLOCK(nf_ftp_lock); +- + #define MAX_PORTS 8 + static u_int16_t ports[MAX_PORTS]; + static unsigned int ports_c; +@@ -398,6 +393,9 @@ static int help(struct sk_buff *skb, + return NF_ACCEPT; + } + ++ if (unlikely(skb_linearize(skb))) ++ return NF_DROP; ++ + th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph); + if (th == NULL) + return NF_ACCEPT; +@@ -411,12 +409,8 @@ static int help(struct sk_buff *skb, + } + datalen = skb->len - dataoff; + +- spin_lock_bh(&nf_ftp_lock); +- fb_ptr = skb_header_pointer(skb, dataoff, datalen, ftp_buffer); +- if (!fb_ptr) { +- spin_unlock_bh(&nf_ftp_lock); +- return NF_ACCEPT; +- } ++ spin_lock_bh(&ct->lock); ++ fb_ptr = skb->data + dataoff; + + ends_in_nl = (fb_ptr[datalen - 1] == '\n'); + seq = ntohl(th->seq) + datalen; +@@ -544,7 +538,7 @@ static int help(struct sk_buff *skb, + if (ends_in_nl) + update_nl_seq(ct, seq, ct_ftp_info, dir, skb); + out: +- spin_unlock_bh(&nf_ftp_lock); ++ spin_unlock_bh(&ct->lock); + return ret; + } + +@@ -571,7 +565,6 @@ static const struct nf_conntrack_expect_policy ftp_exp_policy = { + static void __exit nf_conntrack_ftp_fini(void) + { + nf_conntrack_helpers_unregister(ftp, ports_c * 2); +- kfree(ftp_buffer); + } + + static int __init nf_conntrack_ftp_init(void) +@@ -580,10 +573,6 @@ static int __init nf_conntrack_ftp_init(void) + + NF_CT_HELPER_BUILD_BUG_ON(sizeof(struct nf_ct_ftp_master)); + +- ftp_buffer = kmalloc(65536, GFP_KERNEL); +- if (!ftp_buffer) +- return -ENOMEM; +- + if (ports_c == 0) + ports[ports_c++] = FTP_PORT; + +@@ -603,7 +592,6 @@ static int __init nf_conntrack_ftp_init(void) + ret = nf_conntrack_helpers_register(ftp, ports_c * 2); + if (ret < 0) { + pr_err("failed to register helpers\n"); +- kfree(ftp_buffer); + return ret; + } + +-- +2.37.2 + diff --git a/queue-5.19/netfilter-nf_ct_h323-cap-packet-size-at-64k.patch b/queue-5.19/netfilter-nf_ct_h323-cap-packet-size-at-64k.patch new file mode 100644 index 00000000000..fc58ce308a4 --- /dev/null +++ b/queue-5.19/netfilter-nf_ct_h323-cap-packet-size-at-64k.patch @@ -0,0 +1,69 @@ +From f3e124c36f70d5ffcdd4e8bdbe7bb28a98a715c0 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Tue, 9 Aug 2022 15:16:33 +0200 +Subject: netfilter: nf_ct_h323: cap packet size at 64k + +From: Florian Westphal + +commit f3e124c36f70d5ffcdd4e8bdbe7bb28a98a715c0 upstream. + +With BIG TCP, packets generated by tcp stack may exceed 64kb. +Cap datalen at 64kb. The internal message format uses 16bit fields, +so no embedded message can exceed 64k size. + +Multiple h323 messages in a single superpacket may now result +in a message to get treated as incomplete/truncated, but thats +better than scribbling past h323_buffer. + +Another alternative suitable for net tree would be a switch to +skb_linearize(). + +Fixes: 7c4e983c4f3c ("net: allow gso_max_size to exceed 65536") +Fixes: 0fe79f28bfaf ("net: allow gro_max_size to exceed 65536") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_conntrack_h323_main.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/net/netfilter/nf_conntrack_h323_main.c ++++ b/net/netfilter/nf_conntrack_h323_main.c +@@ -34,6 +34,8 @@ + #include + #include + ++#define H323_MAX_SIZE 65535 ++ + /* Parameters */ + static unsigned int default_rrq_ttl __read_mostly = 300; + module_param(default_rrq_ttl, uint, 0600); +@@ -142,6 +144,9 @@ static int get_tpkt_data(struct sk_buff + if (tcpdatalen <= 0) /* No TCP data */ + goto clear_out; + ++ if (tcpdatalen > H323_MAX_SIZE) ++ tcpdatalen = H323_MAX_SIZE; ++ + if (*data == NULL) { /* first TPKT */ + /* Get first TPKT pointer */ + tpkt = skb_header_pointer(skb, tcpdataoff, tcpdatalen, +@@ -1220,6 +1225,9 @@ static unsigned char *get_udp_data(struc + if (dataoff >= skb->len) + return NULL; + *datalen = skb->len - dataoff; ++ if (*datalen > H323_MAX_SIZE) ++ *datalen = H323_MAX_SIZE; ++ + return skb_header_pointer(skb, dataoff, *datalen, h323_buffer); + } + +@@ -1821,7 +1829,7 @@ static int __init nf_conntrack_h323_init + + NF_CT_HELPER_BUILD_BUG_ON(sizeof(struct nf_ct_h323_master)); + +- h323_buffer = kmalloc(65536, GFP_KERNEL); ++ h323_buffer = kmalloc(H323_MAX_SIZE + 1, GFP_KERNEL); + if (!h323_buffer) + return -ENOMEM; + ret = h323_helper_init(); diff --git a/queue-5.19/netfilter-nf_ct_irc-cap-packet-search-space-to-4k.patch b/queue-5.19/netfilter-nf_ct_irc-cap-packet-search-space-to-4k.patch new file mode 100644 index 00000000000..56896e795a5 --- /dev/null +++ b/queue-5.19/netfilter-nf_ct_irc-cap-packet-search-space-to-4k.patch @@ -0,0 +1,84 @@ +From 976bf59c69cd2e2c17f0ab20a14c0e700cba0f15 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Tue, 9 Aug 2022 15:16:35 +0200 +Subject: netfilter: nf_ct_irc: cap packet search space to 4k + +From: Florian Westphal + +commit 976bf59c69cd2e2c17f0ab20a14c0e700cba0f15 upstream. + +This uses a pseudo-linearization scheme with a 64k global buffer, +but BIG TCP arrival means IPv6 TCP stack can generate skbs +that exceed this size. + +In practice, IRC commands are not expected to exceed 512 bytes, plus +this is interactive protocol, so we should not see large packets +in practice. + +Given most IRC connections nowadays use TLS so this helper could also be +removed in the near future. + +Fixes: 7c4e983c4f3c ("net: allow gso_max_size to exceed 65536") +Fixes: 0fe79f28bfaf ("net: allow gro_max_size to exceed 65536") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_conntrack_irc.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c +index 08ee4e760a3d..1796c456ac98 100644 +--- a/net/netfilter/nf_conntrack_irc.c ++++ b/net/netfilter/nf_conntrack_irc.c +@@ -39,6 +39,7 @@ unsigned int (*nf_nat_irc_hook)(struct sk_buff *skb, + EXPORT_SYMBOL_GPL(nf_nat_irc_hook); + + #define HELPER_NAME "irc" ++#define MAX_SEARCH_SIZE 4095 + + MODULE_AUTHOR("Harald Welte "); + MODULE_DESCRIPTION("IRC (DCC) connection tracking helper"); +@@ -121,6 +122,7 @@ static int help(struct sk_buff *skb, unsigned int protoff, + int i, ret = NF_ACCEPT; + char *addr_beg_p, *addr_end_p; + typeof(nf_nat_irc_hook) nf_nat_irc; ++ unsigned int datalen; + + /* If packet is coming from IRC server */ + if (dir == IP_CT_DIR_REPLY) +@@ -140,8 +142,12 @@ static int help(struct sk_buff *skb, unsigned int protoff, + if (dataoff >= skb->len) + return NF_ACCEPT; + ++ datalen = skb->len - dataoff; ++ if (datalen > MAX_SEARCH_SIZE) ++ datalen = MAX_SEARCH_SIZE; ++ + spin_lock_bh(&irc_buffer_lock); +- ib_ptr = skb_header_pointer(skb, dataoff, skb->len - dataoff, ++ ib_ptr = skb_header_pointer(skb, dataoff, datalen, + irc_buffer); + if (!ib_ptr) { + spin_unlock_bh(&irc_buffer_lock); +@@ -149,7 +155,7 @@ static int help(struct sk_buff *skb, unsigned int protoff, + } + + data = ib_ptr; +- data_limit = ib_ptr + skb->len - dataoff; ++ data_limit = ib_ptr + datalen; + + /* strlen("\1DCC SENT t AAAAAAAA P\1\n")=24 + * 5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14 */ +@@ -251,7 +257,7 @@ static int __init nf_conntrack_irc_init(void) + irc_exp_policy.max_expected = max_dcc_channels; + irc_exp_policy.timeout = dcc_timeout; + +- irc_buffer = kmalloc(65536, GFP_KERNEL); ++ irc_buffer = kmalloc(MAX_SEARCH_SIZE + 1, GFP_KERNEL); + if (!irc_buffer) + return -ENOMEM; + +-- +2.37.2 + diff --git a/queue-5.19/netfilter-nf_ct_sane-remove-pseudo-skb-linearization.patch b/queue-5.19/netfilter-nf_ct_sane-remove-pseudo-skb-linearization.patch new file mode 100644 index 00000000000..ed7f97ebd2c --- /dev/null +++ b/queue-5.19/netfilter-nf_ct_sane-remove-pseudo-skb-linearization.patch @@ -0,0 +1,181 @@ +From a664375da76c6da8f83dc7997e43c568e1eb9a6a Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Tue, 9 Aug 2022 15:16:32 +0200 +Subject: netfilter: nf_ct_sane: remove pseudo skb linearization + +From: Florian Westphal + +commit a664375da76c6da8f83dc7997e43c568e1eb9a6a upstream. + +For historical reason this code performs pseudo linearization of skbs +via skb_header_pointer and a global 64k buffer. + +With arrival of BIG TCP, packets generated by TCP stack can exceed 64kb. + +Rewrite this to only extract the needed header data. This also allows +to get rid of the locking. + +Fixes: 7c4e983c4f3c ("net: allow gso_max_size to exceed 65536") +Fixes: 0fe79f28bfaf ("net: allow gro_max_size to exceed 65536") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_conntrack_sane.c | 68 ++++++++++++++++---------------------- + 1 file changed, 30 insertions(+), 38 deletions(-) + +--- a/net/netfilter/nf_conntrack_sane.c ++++ b/net/netfilter/nf_conntrack_sane.c +@@ -34,10 +34,6 @@ MODULE_AUTHOR("Michal Schmidt len - dataoff; +- +- spin_lock_bh(&nf_sane_lock); +- sb_ptr = skb_header_pointer(skb, dataoff, datalen, sane_buffer); +- if (!sb_ptr) { +- spin_unlock_bh(&nf_sane_lock); +- return NF_ACCEPT; +- } +- + if (dir == IP_CT_DIR_ORIGINAL) { ++ const struct sane_request *req; ++ + if (datalen != sizeof(struct sane_request)) +- goto out; ++ return NF_ACCEPT; ++ ++ req = skb_header_pointer(skb, dataoff, datalen, &buf.req); ++ if (!req) ++ return NF_ACCEPT; + +- req = sb_ptr; + if (req->RPC_code != htonl(SANE_NET_START)) { + /* Not an interesting command */ +- ct_sane_info->state = SANE_STATE_NORMAL; +- goto out; ++ WRITE_ONCE(ct_sane_info->state, SANE_STATE_NORMAL); ++ return NF_ACCEPT; + } + + /* We're interested in the next reply */ +- ct_sane_info->state = SANE_STATE_START_REQUESTED; +- goto out; ++ WRITE_ONCE(ct_sane_info->state, SANE_STATE_START_REQUESTED); ++ return NF_ACCEPT; + } + ++ /* IP_CT_DIR_REPLY */ ++ + /* Is it a reply to an uninteresting command? */ +- if (ct_sane_info->state != SANE_STATE_START_REQUESTED) +- goto out; ++ if (READ_ONCE(ct_sane_info->state) != SANE_STATE_START_REQUESTED) ++ return NF_ACCEPT; + + /* It's a reply to SANE_NET_START. */ +- ct_sane_info->state = SANE_STATE_NORMAL; ++ WRITE_ONCE(ct_sane_info->state, SANE_STATE_NORMAL); + + if (datalen < sizeof(struct sane_reply_net_start)) { + pr_debug("NET_START reply too short\n"); +- goto out; ++ return NF_ACCEPT; + } + +- reply = sb_ptr; ++ datalen = sizeof(struct sane_reply_net_start); ++ ++ reply = skb_header_pointer(skb, dataoff, datalen, &buf.repl); ++ if (!reply) ++ return NF_ACCEPT; ++ + if (reply->status != htonl(SANE_STATUS_SUCCESS)) { + /* saned refused the command */ + pr_debug("unsuccessful SANE_STATUS = %u\n", + ntohl(reply->status)); +- goto out; ++ return NF_ACCEPT; + } + + /* Invalid saned reply? Ignore it. */ + if (reply->zero != 0) +- goto out; ++ return NF_ACCEPT; + + exp = nf_ct_expect_alloc(ct); + if (exp == NULL) { + nf_ct_helper_log(skb, ct, "cannot alloc expectation"); +- ret = NF_DROP; +- goto out; ++ return NF_DROP; + } + + tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple; +@@ -162,9 +163,6 @@ static int help(struct sk_buff *skb, + } + + nf_ct_expect_put(exp); +- +-out: +- spin_unlock_bh(&nf_sane_lock); + return ret; + } + +@@ -178,7 +176,6 @@ static const struct nf_conntrack_expect_ + static void __exit nf_conntrack_sane_fini(void) + { + nf_conntrack_helpers_unregister(sane, ports_c * 2); +- kfree(sane_buffer); + } + + static int __init nf_conntrack_sane_init(void) +@@ -187,10 +184,6 @@ static int __init nf_conntrack_sane_init + + NF_CT_HELPER_BUILD_BUG_ON(sizeof(struct nf_ct_sane_master)); + +- sane_buffer = kmalloc(65536, GFP_KERNEL); +- if (!sane_buffer) +- return -ENOMEM; +- + if (ports_c == 0) + ports[ports_c++] = SANE_PORT; + +@@ -210,7 +203,6 @@ static int __init nf_conntrack_sane_init + ret = nf_conntrack_helpers_register(sane, ports_c * 2); + if (ret < 0) { + pr_err("failed to register helpers\n"); +- kfree(sane_buffer); + return ret; + } + diff --git a/queue-5.19/netfilter-nf_tables-check-nft_set_concat-flag-if-field_count-is-specified.patch b/queue-5.19/netfilter-nf_tables-check-nft_set_concat-flag-if-field_count-is-specified.patch new file mode 100644 index 00000000000..f735962d610 --- /dev/null +++ b/queue-5.19/netfilter-nf_tables-check-nft_set_concat-flag-if-field_count-is-specified.patch @@ -0,0 +1,40 @@ +From 1b6345d4160ecd3d04bd8cd75df90c67811e8cc9 Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Mon, 15 Aug 2022 17:55:07 +0200 +Subject: netfilter: nf_tables: check NFT_SET_CONCAT flag if field_count is specified + +From: Pablo Neira Ayuso + +commit 1b6345d4160ecd3d04bd8cd75df90c67811e8cc9 upstream. + +Since f3a2181e16f1 ("netfilter: nf_tables: Support for sets with +multiple ranged fields"), it possible to combine intervals and +concatenations. Later on, ef516e8625dd ("netfilter: nf_tables: +reintroduce the NFT_SET_CONCAT flag") provides the NFT_SET_CONCAT flag +for userspace to report that the set stores a concatenation. + +Make sure NFT_SET_CONCAT is set on if field_count is specified for +consistency. Otherwise, if NFT_SET_CONCAT is specified with no +field_count, bail out with EINVAL. + +Fixes: ef516e8625dd ("netfilter: nf_tables: reintroduce the NFT_SET_CONCAT flag") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_tables_api.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -4451,6 +4451,11 @@ static int nf_tables_newset(struct sk_bu + err = nf_tables_set_desc_parse(&desc, nla[NFTA_SET_DESC]); + if (err < 0) + return err; ++ ++ if (desc.field_count > 1 && !(flags & NFT_SET_CONCAT)) ++ return -EINVAL; ++ } else if (flags & NFT_SET_CONCAT) { ++ return -EINVAL; + } + + if (nla[NFTA_SET_EXPR] || nla[NFTA_SET_EXPRESSIONS]) diff --git a/queue-5.19/netfilter-nf_tables-disallow-nft_set_elem_catchall-and-nft_set_elem_interval_end.patch b/queue-5.19/netfilter-nf_tables-disallow-nft_set_elem_catchall-and-nft_set_elem_interval_end.patch new file mode 100644 index 00000000000..4547543c851 --- /dev/null +++ b/queue-5.19/netfilter-nf_tables-disallow-nft_set_elem_catchall-and-nft_set_elem_interval_end.patch @@ -0,0 +1,30 @@ +From fc0ae524b5fd2938c94d56da3f749f11eb3273d5 Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Sat, 13 Aug 2022 15:22:05 +0200 +Subject: netfilter: nf_tables: disallow NFT_SET_ELEM_CATCHALL and NFT_SET_ELEM_INTERVAL_END + +From: Pablo Neira Ayuso + +commit fc0ae524b5fd2938c94d56da3f749f11eb3273d5 upstream. + +These flags are mutually exclusive, report EINVAL in this case. + +Fixes: aaa31047a6d2 ("netfilter: nftables: add catch-all set element support") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_tables_api.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -5198,6 +5198,9 @@ static int nft_setelem_parse_flags(const + if (!(set->flags & NFT_SET_INTERVAL) && + *flags & NFT_SET_ELEM_INTERVAL_END) + return -EINVAL; ++ if ((*flags & (NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL)) == ++ (NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL)) ++ return -EINVAL; + + return 0; + } diff --git a/queue-5.19/netfilter-nf_tables-disallow-nfta_set_elem_key_end-with-nft_set_elem_interval_end-flag.patch b/queue-5.19/netfilter-nf_tables-disallow-nfta_set_elem_key_end-with-nft_set_elem_interval_end-flag.patch new file mode 100644 index 00000000000..8dfb2560baf --- /dev/null +++ b/queue-5.19/netfilter-nf_tables-disallow-nfta_set_elem_key_end-with-nft_set_elem_interval_end-flag.patch @@ -0,0 +1,29 @@ +From 4963674c2e71fc062f8f089f0f58ffbb5533060b Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Tue, 9 Aug 2022 13:39:18 +0200 +Subject: netfilter: nf_tables: disallow NFTA_SET_ELEM_KEY_END with NFT_SET_ELEM_INTERVAL_END flag + +From: Pablo Neira Ayuso + +commit 4963674c2e71fc062f8f089f0f58ffbb5533060b upstream. + +These are mutually exclusive, actually NFTA_SET_ELEM_KEY_END replaces +the flag notation. + +Fixes: 7b225d0b5c6d ("netfilter: nf_tables: add NFTA_SET_ELEM_KEY_END attribute") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_tables_api.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -5855,6 +5855,7 @@ static int nft_add_set_elem(struct nft_c + nla[NFTA_SET_ELEM_EXPIRATION] || + nla[NFTA_SET_ELEM_USERDATA] || + nla[NFTA_SET_ELEM_EXPR] || ++ nla[NFTA_SET_ELEM_KEY_END] || + nla[NFTA_SET_ELEM_EXPRESSIONS])) + return -EINVAL; + diff --git a/queue-5.19/netfilter-nf_tables-fix-scheduling-while-atomic-splat.patch b/queue-5.19/netfilter-nf_tables-fix-scheduling-while-atomic-splat.patch new file mode 100644 index 00000000000..b904a7c5f79 --- /dev/null +++ b/queue-5.19/netfilter-nf_tables-fix-scheduling-while-atomic-splat.patch @@ -0,0 +1,36 @@ +From 2024439bd5ceb145eeeb428b2a59e9b905153ac3 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Thu, 11 Aug 2022 13:30:39 +0200 +Subject: netfilter: nf_tables: fix scheduling-while-atomic splat + +From: Florian Westphal + +commit 2024439bd5ceb145eeeb428b2a59e9b905153ac3 upstream. + +nf_tables_check_loops() can be called from rhashtable list +walk so cond_resched() cannot be used here. + +Fixes: 81ea01066741 ("netfilter: nf_tables: add rescheduling points during loop detection walks") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_tables_api.c | 4 ---- + 1 file changed, 4 deletions(-) + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -9372,13 +9372,9 @@ static int nf_tables_check_loops(const s + break; + } + } +- +- cond_resched(); + } + + list_for_each_entry(set, &ctx->table->sets, list) { +- cond_resched(); +- + if (!nft_is_active_next(ctx->net, set)) + continue; + if (!(set->flags & NFT_SET_MAP) || diff --git a/queue-5.19/netfilter-nf_tables-nfta_set_elem_key_end-requires-concat-and-interval-flags.patch b/queue-5.19/netfilter-nf_tables-nfta_set_elem_key_end-requires-concat-and-interval-flags.patch new file mode 100644 index 00000000000..264802adc99 --- /dev/null +++ b/queue-5.19/netfilter-nf_tables-nfta_set_elem_key_end-requires-concat-and-interval-flags.patch @@ -0,0 +1,71 @@ +From 88cccd908d51397f9754f89a937cd13fa59dee37 Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Fri, 12 Aug 2022 16:21:28 +0200 +Subject: netfilter: nf_tables: NFTA_SET_ELEM_KEY_END requires concat and interval flags + +From: Pablo Neira Ayuso + +commit 88cccd908d51397f9754f89a937cd13fa59dee37 upstream. + +If the NFT_SET_CONCAT|NFT_SET_INTERVAL flags are set on, then the +netlink attribute NFTA_SET_ELEM_KEY_END must be specified. Otherwise, +NFTA_SET_ELEM_KEY_END should not be present. + +For catch-all element, NFTA_SET_ELEM_KEY_END should not be present. +The NFT_SET_ELEM_INTERVAL_END is never used with this set flags +combination. + +Fixes: 7b225d0b5c6d ("netfilter: nf_tables: add NFTA_SET_ELEM_KEY_END attribute") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_tables_api.c | 24 ++++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -5798,6 +5798,24 @@ static void nft_setelem_remove(const str + set->ops->remove(net, set, elem); + } + ++static bool nft_setelem_valid_key_end(const struct nft_set *set, ++ struct nlattr **nla, u32 flags) ++{ ++ if ((set->flags & (NFT_SET_CONCAT | NFT_SET_INTERVAL)) == ++ (NFT_SET_CONCAT | NFT_SET_INTERVAL)) { ++ if (flags & NFT_SET_ELEM_INTERVAL_END) ++ return false; ++ if (!nla[NFTA_SET_ELEM_KEY_END] && ++ !(flags & NFT_SET_ELEM_CATCHALL)) ++ return false; ++ } else { ++ if (nla[NFTA_SET_ELEM_KEY_END]) ++ return false; ++ } ++ ++ return true; ++} ++ + static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, + const struct nlattr *attr, u32 nlmsg_flags) + { +@@ -5857,6 +5875,9 @@ static int nft_add_set_elem(struct nft_c + return -EINVAL; + } + ++ if (!nft_setelem_valid_key_end(set, nla, flags)) ++ return -EINVAL; ++ + if ((flags & NFT_SET_ELEM_INTERVAL_END) && + (nla[NFTA_SET_ELEM_DATA] || + nla[NFTA_SET_ELEM_OBJREF] || +@@ -6281,6 +6302,9 @@ static int nft_del_setelem(struct nft_ct + if (!nla[NFTA_SET_ELEM_KEY] && !(flags & NFT_SET_ELEM_CATCHALL)) + return -EINVAL; + ++ if (!nft_setelem_valid_key_end(set, nla, flags)) ++ return -EINVAL; ++ + nft_set_ext_prepare(&tmpl); + + if (flags != 0) { diff --git a/queue-5.19/netfilter-nf_tables-possible-module-reference-underflow-in-error-path.patch b/queue-5.19/netfilter-nf_tables-possible-module-reference-underflow-in-error-path.patch new file mode 100644 index 00000000000..c0d79fb371a --- /dev/null +++ b/queue-5.19/netfilter-nf_tables-possible-module-reference-underflow-in-error-path.patch @@ -0,0 +1,31 @@ +From c485c35ff6783ccd12c160fcac6a0e504e83e0bf Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Tue, 9 Aug 2022 17:23:52 +0200 +Subject: netfilter: nf_tables: possible module reference underflow in error path + +From: Pablo Neira Ayuso + +commit c485c35ff6783ccd12c160fcac6a0e504e83e0bf upstream. + +dst->ops is set on when nft_expr_clone() fails, but module refcount has +not been bumped yet, therefore nft_expr_destroy() leads to module +reference underflow. + +Fixes: 8cfd9b0f8515 ("netfilter: nftables: generalize set expressions support") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_tables_api.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -5566,7 +5566,7 @@ int nft_set_elem_expr_clone(const struct + + err = nft_expr_clone(expr, set->exprs[i]); + if (err < 0) { +- nft_expr_destroy(ctx, expr); ++ kfree(expr); + goto err_expr; + } + expr_array[i] = expr; diff --git a/queue-5.19/netfilter-nf_tables-really-skip-inactive-sets-when-allocating-name.patch b/queue-5.19/netfilter-nf_tables-really-skip-inactive-sets-when-allocating-name.patch new file mode 100644 index 00000000000..33b7e371f07 --- /dev/null +++ b/queue-5.19/netfilter-nf_tables-really-skip-inactive-sets-when-allocating-name.patch @@ -0,0 +1,30 @@ +From 271c5ca826e0c3c53e0eb4032f8eaedea1ee391c Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Tue, 9 Aug 2022 17:23:53 +0200 +Subject: netfilter: nf_tables: really skip inactive sets when allocating name + +From: Pablo Neira Ayuso + +commit 271c5ca826e0c3c53e0eb4032f8eaedea1ee391c upstream. + +While looping to build the bitmap of used anonymous set names, check the +current set in the iteration, instead of the one that is being created. + +Fixes: 37a9cc525525 ("netfilter: nf_tables: add generation mask to sets") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_tables_api.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -3907,7 +3907,7 @@ cont: + list_for_each_entry(i, &ctx->table->sets, list) { + int tmp; + +- if (!nft_is_active_next(ctx->net, set)) ++ if (!nft_is_active_next(ctx->net, i)) + continue; + if (!sscanf(i->name, name, &tmp)) + continue; diff --git a/queue-5.19/netfilter-nf_tables-validate-nfta_set_elem_objref-based-on-nft_set_object-flag.patch b/queue-5.19/netfilter-nf_tables-validate-nfta_set_elem_objref-based-on-nft_set_object-flag.patch new file mode 100644 index 00000000000..c98fe43c973 --- /dev/null +++ b/queue-5.19/netfilter-nf_tables-validate-nfta_set_elem_objref-based-on-nft_set_object-flag.patch @@ -0,0 +1,51 @@ +From 5a2f3dc31811e93be15522d9eb13ed61460b76c8 Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Fri, 12 Aug 2022 16:19:23 +0200 +Subject: netfilter: nf_tables: validate NFTA_SET_ELEM_OBJREF based on NFT_SET_OBJECT flag + +From: Pablo Neira Ayuso + +commit 5a2f3dc31811e93be15522d9eb13ed61460b76c8 upstream. + +If the NFTA_SET_ELEM_OBJREF netlink attribute is present and +NFT_SET_OBJECT flag is set on, report EINVAL. + +Move existing sanity check earlier to validate that NFT_SET_OBJECT +requires NFTA_SET_ELEM_OBJREF. + +Fixes: 8aeff920dcc9 ("netfilter: nf_tables: add stateful object reference to set elements") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_tables_api.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -5848,6 +5848,15 @@ static int nft_add_set_elem(struct nft_c + return -EINVAL; + } + ++ if (set->flags & NFT_SET_OBJECT) { ++ if (!nla[NFTA_SET_ELEM_OBJREF] && ++ !(flags & NFT_SET_ELEM_INTERVAL_END)) ++ return -EINVAL; ++ } else { ++ if (nla[NFTA_SET_ELEM_OBJREF]) ++ return -EINVAL; ++ } ++ + if ((flags & NFT_SET_ELEM_INTERVAL_END) && + (nla[NFTA_SET_ELEM_DATA] || + nla[NFTA_SET_ELEM_OBJREF] || +@@ -5986,10 +5995,6 @@ static int nft_add_set_elem(struct nft_c + } + + if (nla[NFTA_SET_ELEM_OBJREF] != NULL) { +- if (!(set->flags & NFT_SET_OBJECT)) { +- err = -EINVAL; +- goto err_parse_key_end; +- } + obj = nft_obj_lookup(ctx->net, ctx->table, + nla[NFTA_SET_ELEM_OBJREF], + set->objtype, genmask); diff --git a/queue-5.19/powerpc-pci-fix-get_phb_number-locking.patch b/queue-5.19/powerpc-pci-fix-get_phb_number-locking.patch new file mode 100644 index 00000000000..abce494b4f6 --- /dev/null +++ b/queue-5.19/powerpc-pci-fix-get_phb_number-locking.patch @@ -0,0 +1,105 @@ +From 8d48562a2729742f767b0fdd994d6b2a56a49c63 Mon Sep 17 00:00:00 2001 +From: Michael Ellerman +Date: Mon, 15 Aug 2022 16:55:23 +1000 +Subject: powerpc/pci: Fix get_phb_number() locking + +From: Michael Ellerman + +commit 8d48562a2729742f767b0fdd994d6b2a56a49c63 upstream. + +The recent change to get_phb_number() causes a DEBUG_ATOMIC_SLEEP +warning on some systems: + + BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580 + in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper + preempt_count: 1, expected: 0 + RCU nest depth: 0, expected: 0 + 1 lock held by swapper/1: + #0: c157efb0 (hose_spinlock){+.+.}-{2:2}, at: pcibios_alloc_controller+0x64/0x220 + Preemption disabled at: + [<00000000>] 0x0 + CPU: 0 PID: 1 Comm: swapper Not tainted 5.19.0-yocto-standard+ #1 + Call Trace: + [d101dc90] [c073b264] dump_stack_lvl+0x50/0x8c (unreliable) + [d101dcb0] [c0093b70] __might_resched+0x258/0x2a8 + [d101dcd0] [c0d3e634] __mutex_lock+0x6c/0x6ec + [d101dd50] [c0a84174] of_alias_get_id+0x50/0xf4 + [d101dd80] [c002ec78] pcibios_alloc_controller+0x1b8/0x220 + [d101ddd0] [c140c9dc] pmac_pci_init+0x198/0x784 + [d101de50] [c140852c] discover_phbs+0x30/0x4c + [d101de60] [c0007fd4] do_one_initcall+0x94/0x344 + [d101ded0] [c1403b40] kernel_init_freeable+0x1a8/0x22c + [d101df10] [c00086e0] kernel_init+0x34/0x160 + [d101df30] [c001b334] ret_from_kernel_thread+0x5c/0x64 + +This is because pcibios_alloc_controller() holds hose_spinlock but +of_alias_get_id() takes of_mutex which can sleep. + +The hose_spinlock protects the phb_bitmap, and also the hose_list, but +it doesn't need to be held while get_phb_number() calls the OF routines, +because those are only looking up information in the device tree. + +So fix it by having get_phb_number() take the hose_spinlock itself, only +where required, and then dropping the lock before returning. +pcibios_alloc_controller() then needs to take the lock again before the +list_add() but that's safe, the order of the list is not important. + +Fixes: 0fe1e96fef0a ("powerpc/pci: Prefer PCI domain assignment via DT 'linux,pci-domain' and alias") +Reported-by: Guenter Roeck +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220815065550.1303620-1-mpe@ellerman.id.au +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/kernel/pci-common.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/arch/powerpc/kernel/pci-common.c ++++ b/arch/powerpc/kernel/pci-common.c +@@ -67,10 +67,6 @@ void __init set_pci_dma_ops(const struct + pci_dma_ops = dma_ops; + } + +-/* +- * This function should run under locking protection, specifically +- * hose_spinlock. +- */ + static int get_phb_number(struct device_node *dn) + { + int ret, phb_id = -1; +@@ -107,15 +103,20 @@ static int get_phb_number(struct device_ + if (!ret) + phb_id = (int)(prop & (MAX_PHBS - 1)); + ++ spin_lock(&hose_spinlock); ++ + /* We need to be sure to not use the same PHB number twice. */ + if ((phb_id >= 0) && !test_and_set_bit(phb_id, phb_bitmap)) +- return phb_id; ++ goto out_unlock; + + /* If everything fails then fallback to dynamic PHB numbering. */ + phb_id = find_first_zero_bit(phb_bitmap, MAX_PHBS); + BUG_ON(phb_id >= MAX_PHBS); + set_bit(phb_id, phb_bitmap); + ++out_unlock: ++ spin_unlock(&hose_spinlock); ++ + return phb_id; + } + +@@ -126,10 +127,13 @@ struct pci_controller *pcibios_alloc_con + phb = zalloc_maybe_bootmem(sizeof(struct pci_controller), GFP_KERNEL); + if (phb == NULL) + return NULL; +- spin_lock(&hose_spinlock); ++ + phb->global_number = get_phb_number(dev); ++ ++ spin_lock(&hose_spinlock); + list_add_tail(&phb->list_node, &hose_list); + spin_unlock(&hose_spinlock); ++ + phb->dn = dev; + phb->is_dynamic = slab_is_available(); + #ifdef CONFIG_PPC64 diff --git a/queue-5.19/regulator-pca9450-remove-restrictions-for-regulator-name.patch b/queue-5.19/regulator-pca9450-remove-restrictions-for-regulator-name.patch new file mode 100644 index 00000000000..506b22678f5 --- /dev/null +++ b/queue-5.19/regulator-pca9450-remove-restrictions-for-regulator-name.patch @@ -0,0 +1,50 @@ +From b0de7fa706506bf0591037908376351beda8c5d6 Mon Sep 17 00:00:00 2001 +From: Frieder Schrempf +Date: Tue, 2 Aug 2022 08:43:34 +0200 +Subject: regulator: pca9450: Remove restrictions for regulator-name + +From: Frieder Schrempf + +commit b0de7fa706506bf0591037908376351beda8c5d6 upstream. + +The device bindings shouldn't put any constraints on the regulator-name +property specified in the generic bindings. This allows using arbitrary +and descriptive names for the regulators. + +Suggested-by: Mark Brown +Fixes: 7ae9e3a6bf3f ("dt-bindings: regulator: add pca9450 regulator yaml") +Signed-off-by: Frieder Schrempf +Link: https://lore.kernel.org/r/20220802064335.8481-1-frieder@fris.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/regulator/nxp,pca9450-regulator.yaml | 11 ---------- + 1 file changed, 11 deletions(-) + +--- a/Documentation/devicetree/bindings/regulator/nxp,pca9450-regulator.yaml ++++ b/Documentation/devicetree/bindings/regulator/nxp,pca9450-regulator.yaml +@@ -47,12 +47,6 @@ properties: + description: + Properties for single LDO regulator. + +- properties: +- regulator-name: +- pattern: "^LDO[1-5]$" +- description: +- should be "LDO1", ..., "LDO5" +- + unevaluatedProperties: false + + "^BUCK[1-6]$": +@@ -62,11 +56,6 @@ properties: + Properties for single BUCK regulator. + + properties: +- regulator-name: +- pattern: "^BUCK[1-6]$" +- description: +- should be "BUCK1", ..., "BUCK6" +- + nxp,dvs-run-voltage: + $ref: "/schemas/types.yaml#/definitions/uint32" + minimum: 600000 diff --git a/queue-5.19/series b/queue-5.19/series index 632dd9c02e4..2200ea2d132 100644 --- a/queue-5.19/series +++ b/queue-5.19/series @@ -188,3 +188,53 @@ rdma-cxgb4-fix-accept-failure-due-to-increased-cpl_t5_pass_accept_rpl-size.patch netfilter-nfnetlink-re-enable-conntrack-expectation-events.patch netfilter-nf_tables-use-read_once-and-write_once-for-shared-generation-id-access.patch fs-ntfs3-uninitialized-variable-in-ntfs_set_acl_ex.patch +netfilter-nf_tables-disallow-nfta_set_elem_key_end-with-nft_set_elem_interval_end-flag.patch +netfilter-nf_ct_sane-remove-pseudo-skb-linearization.patch +netfilter-nf_ct_h323-cap-packet-size-at-64k.patch +netfilter-nf_ct_ftp-prefer-skb_linearize.patch +netfilter-nf_ct_irc-cap-packet-search-space-to-4k.patch +netfilter-nf_tables-possible-module-reference-underflow-in-error-path.patch +netfilter-nf_tables-really-skip-inactive-sets-when-allocating-name.patch +netfilter-nf_tables-fix-scheduling-while-atomic-splat.patch +netfilter-nf_tables-validate-nfta_set_elem_objref-based-on-nft_set_object-flag.patch +netfilter-nf_tables-nfta_set_elem_key_end-requires-concat-and-interval-flags.patch +netfilter-nf_tables-disallow-nft_set_elem_catchall-and-nft_set_elem_interval_end.patch +netfilter-nf_tables-check-nft_set_concat-flag-if-field_count-is-specified.patch +powerpc-pci-fix-get_phb_number-locking.patch +spi-meson-spicc-add-local-pow2-clock-ops-to-preserve-rate-between-messages.patch +net-sunrpc-fix-potential-memory-leaks-in-rpc_sysfs_xprt_state_change.patch +net-dsa-mv88e6060-prevent-crash-on-an-unused-port.patch +net-qrtr-start-mhi-channel-after-endpoit-creation.patch +virtio_net-fix-endian-ness-for-rss.patch +mlxsw-spectrum-clear-ptp-configuration-after-unregistering-the-netdevice.patch +net-moxa-pass-pdev-instead-of-ndev-to-dma-functions.patch +net-fix-potential-refcount-leak-in-ndisc_router_discovery.patch +net-rtnetlink-fix-module-reference-count-leak-issue-in-rtnetlink_rcv_msg.patch +net-sched-fix-misuse-of-qcpu-backlog-in-gnet_stats_add_queue_cpu.patch +net-dsa-microchip-ksz9477-fix-fdb_dump-last-invalid-entry.patch +net-dsa-felix-fix-ethtool-256-511-and-512-1023-tx-packet-counters.patch +net-mscc-ocelot-fix-incorrect-ndo_get_stats64-packet-counters.patch +net-mscc-ocelot-fix-address-of-sys_count_tx_aging-counter.patch +net-genl-fix-error-path-memory-leak-in-policy-dumping.patch +net-dsa-don-t-warn-in-dsa_port_set_state_now-when-driver-doesn-t-support-it.patch +net-dsa-sja1105-fix-buffer-overflow-in-sja1105_setup_devlink_regions.patch +ice-fix-vsi-rebuild-warn_on-check-for-vf.patch +ice-fix-call-trace-with-null-vsi-during-vf-reset.patch +ice-fix-vf-not-able-to-send-tagged-traffic-with-no-vlan-filters.patch +ice-fix-double-vlan-error-when-entering-promisc-mode.patch +ice-ignore-eexist-when-setting-promisc-mode.patch +ice-fix-clearing-of-promisc-mode-with-bridge-over-bond.patch +ice-ignore-error-message-when-setting-same-promiscuous-mode.patch +modpost-fix-module-versioning-when-a-symbol-lacks-valid-crc.patch +i2c-imx-make-sure-to-unregister-adapter-on-remove.patch +i40e-fix-tunnel-checksum-offload-with-fragmented-traffic.patch +regulator-pca9450-remove-restrictions-for-regulator-name.patch +i40e-fix-to-stop-tx_timeout-recovery-if-globr-fails.patch +blk-mq-run-queue-no-matter-whether-the-request-is-the-last-request.patch +tools-rtla-fix-command-symlinks.patch +fec-fix-timer-capture-timing-in-fec_ptp_enable_pps.patch +dt-bindings-display-sun4i-add-d1-tcons-to-conditionals.patch +stmmac-intel-add-a-missing-clk_disable_unprepare-call-in-intel_eth_pci_remove.patch +igb-add-lock-to-avoid-data-race.patch +kbuild-fix-the-modules-order-between-drivers-and-libs.patch +gcc-plugins-undefine-latent_entropy_plugin-when-plugin-disabled-for-a-file.patch diff --git a/queue-5.19/spi-meson-spicc-add-local-pow2-clock-ops-to-preserve-rate-between-messages.patch b/queue-5.19/spi-meson-spicc-add-local-pow2-clock-ops-to-preserve-rate-between-messages.patch new file mode 100644 index 00000000000..9504df0a68e --- /dev/null +++ b/queue-5.19/spi-meson-spicc-add-local-pow2-clock-ops-to-preserve-rate-between-messages.patch @@ -0,0 +1,255 @@ +From 09992025dacd258c823f50e82db09d7ef06cdac4 Mon Sep 17 00:00:00 2001 +From: Neil Armstrong +Date: Thu, 11 Aug 2022 15:44:45 +0200 +Subject: spi: meson-spicc: add local pow2 clock ops to preserve rate between messages + +From: Neil Armstrong + +commit 09992025dacd258c823f50e82db09d7ef06cdac4 upstream. + +At the end of a message, the HW gets a reset in meson_spicc_unprepare_transfer(), +this resets the SPICC_CONREG register and notably the value set by the +Common Clock Framework. + +This is problematic because: +- the register value CCF can be different from the corresponding CCF cached rate +- CCF is allowed to change the clock rate whenever the HW state + +This introduces: +- local pow2 clock ops checking the HW state before allowing a clock operation +- separation of legacy pow2 clock patch and new enhanced clock path +- SPICC_CONREG datarate value is now value kepts across messages + +It has been checked that: +- SPICC_CONREG datarate value is kept across messages +- CCF is only allowed to change the SPICC_CONREG datarate value when busy +- SPICC_CONREG datarate value is correct for each transfer + +This didn't appear before commit 3e0cf4d3fc29 ("spi: meson-spicc: add a linear clock divider support") +because we recalculated and wrote the rate for each xfer. + +Fixes: 3e0cf4d3fc29 ("spi: meson-spicc: add a linear clock divider support") +Reported-by: Da Xue +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20220811134445.678446-1-narmstrong@baylibre.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-meson-spicc.c | 129 ++++++++++++++++++++++++++++++++---------- + 1 file changed, 101 insertions(+), 28 deletions(-) + +--- a/drivers/spi/spi-meson-spicc.c ++++ b/drivers/spi/spi-meson-spicc.c +@@ -156,6 +156,7 @@ struct meson_spicc_device { + void __iomem *base; + struct clk *core; + struct clk *pclk; ++ struct clk_divider pow2_div; + struct clk *clk; + struct spi_message *message; + struct spi_transfer *xfer; +@@ -168,6 +169,8 @@ struct meson_spicc_device { + unsigned long xfer_remain; + }; + ++#define pow2_clk_to_spicc(_div) container_of(_div, struct meson_spicc_device, pow2_div) ++ + static void meson_spicc_oen_enable(struct meson_spicc_device *spicc) + { + u32 conf; +@@ -421,7 +424,7 @@ static int meson_spicc_prepare_message(s + { + struct meson_spicc_device *spicc = spi_master_get_devdata(master); + struct spi_device *spi = message->spi; +- u32 conf = 0; ++ u32 conf = readl_relaxed(spicc->base + SPICC_CONREG) & SPICC_DATARATE_MASK; + + /* Store current message */ + spicc->message = message; +@@ -458,8 +461,6 @@ static int meson_spicc_prepare_message(s + /* Select CS */ + conf |= FIELD_PREP(SPICC_CS_MASK, spi->chip_select); + +- /* Default Clock rate core/4 */ +- + /* Default 8bit word */ + conf |= FIELD_PREP(SPICC_BITLENGTH_MASK, 8 - 1); + +@@ -476,12 +477,16 @@ static int meson_spicc_prepare_message(s + static int meson_spicc_unprepare_transfer(struct spi_master *master) + { + struct meson_spicc_device *spicc = spi_master_get_devdata(master); ++ u32 conf = readl_relaxed(spicc->base + SPICC_CONREG) & SPICC_DATARATE_MASK; + + /* Disable all IRQs */ + writel(0, spicc->base + SPICC_INTREG); + + device_reset_optional(&spicc->pdev->dev); + ++ /* Set default configuration, keeping datarate field */ ++ writel_relaxed(conf, spicc->base + SPICC_CONREG); ++ + return 0; + } + +@@ -518,14 +523,60 @@ static void meson_spicc_cleanup(struct s + * Clk path for G12A series: + * pclk -> pow2 fixed div -> pow2 div -> mux -> out + * pclk -> enh fixed div -> enh div -> mux -> out ++ * ++ * The pow2 divider is tied to the controller HW state, and the ++ * divider is only valid when the controller is initialized. ++ * ++ * A set of clock ops is added to make sure we don't read/set this ++ * clock rate while the controller is in an unknown state. + */ + +-static int meson_spicc_clk_init(struct meson_spicc_device *spicc) ++static unsigned long meson_spicc_pow2_recalc_rate(struct clk_hw *hw, ++ unsigned long parent_rate) ++{ ++ struct clk_divider *divider = to_clk_divider(hw); ++ struct meson_spicc_device *spicc = pow2_clk_to_spicc(divider); ++ ++ if (!spicc->master->cur_msg || !spicc->master->busy) ++ return 0; ++ ++ return clk_divider_ops.recalc_rate(hw, parent_rate); ++} ++ ++static int meson_spicc_pow2_determine_rate(struct clk_hw *hw, ++ struct clk_rate_request *req) ++{ ++ struct clk_divider *divider = to_clk_divider(hw); ++ struct meson_spicc_device *spicc = pow2_clk_to_spicc(divider); ++ ++ if (!spicc->master->cur_msg || !spicc->master->busy) ++ return -EINVAL; ++ ++ return clk_divider_ops.determine_rate(hw, req); ++} ++ ++static int meson_spicc_pow2_set_rate(struct clk_hw *hw, unsigned long rate, ++ unsigned long parent_rate) ++{ ++ struct clk_divider *divider = to_clk_divider(hw); ++ struct meson_spicc_device *spicc = pow2_clk_to_spicc(divider); ++ ++ if (!spicc->master->cur_msg || !spicc->master->busy) ++ return -EINVAL; ++ ++ return clk_divider_ops.set_rate(hw, rate, parent_rate); ++} ++ ++const struct clk_ops meson_spicc_pow2_clk_ops = { ++ .recalc_rate = meson_spicc_pow2_recalc_rate, ++ .determine_rate = meson_spicc_pow2_determine_rate, ++ .set_rate = meson_spicc_pow2_set_rate, ++}; ++ ++static int meson_spicc_pow2_clk_init(struct meson_spicc_device *spicc) + { + struct device *dev = &spicc->pdev->dev; +- struct clk_fixed_factor *pow2_fixed_div, *enh_fixed_div; +- struct clk_divider *pow2_div, *enh_div; +- struct clk_mux *mux; ++ struct clk_fixed_factor *pow2_fixed_div; + struct clk_init_data init; + struct clk *clk; + struct clk_parent_data parent_data[2]; +@@ -560,31 +611,45 @@ static int meson_spicc_clk_init(struct m + if (WARN_ON(IS_ERR(clk))) + return PTR_ERR(clk); + +- pow2_div = devm_kzalloc(dev, sizeof(*pow2_div), GFP_KERNEL); +- if (!pow2_div) +- return -ENOMEM; +- + snprintf(name, sizeof(name), "%s#pow2_div", dev_name(dev)); + init.name = name; +- init.ops = &clk_divider_ops; +- init.flags = CLK_SET_RATE_PARENT; ++ init.ops = &meson_spicc_pow2_clk_ops; ++ /* ++ * Set NOCACHE here to make sure we read the actual HW value ++ * since we reset the HW after each transfer. ++ */ ++ init.flags = CLK_SET_RATE_PARENT | CLK_GET_RATE_NOCACHE; + parent_data[0].hw = &pow2_fixed_div->hw; + init.num_parents = 1; + +- pow2_div->shift = 16, +- pow2_div->width = 3, +- pow2_div->flags = CLK_DIVIDER_POWER_OF_TWO, +- pow2_div->reg = spicc->base + SPICC_CONREG; +- pow2_div->hw.init = &init; ++ spicc->pow2_div.shift = 16, ++ spicc->pow2_div.width = 3, ++ spicc->pow2_div.flags = CLK_DIVIDER_POWER_OF_TWO, ++ spicc->pow2_div.reg = spicc->base + SPICC_CONREG; ++ spicc->pow2_div.hw.init = &init; + +- clk = devm_clk_register(dev, &pow2_div->hw); +- if (WARN_ON(IS_ERR(clk))) +- return PTR_ERR(clk); ++ spicc->clk = devm_clk_register(dev, &spicc->pow2_div.hw); ++ if (WARN_ON(IS_ERR(spicc->clk))) ++ return PTR_ERR(spicc->clk); + +- if (!spicc->data->has_enhance_clk_div) { +- spicc->clk = clk; +- return 0; +- } ++ return 0; ++} ++ ++static int meson_spicc_enh_clk_init(struct meson_spicc_device *spicc) ++{ ++ struct device *dev = &spicc->pdev->dev; ++ struct clk_fixed_factor *enh_fixed_div; ++ struct clk_divider *enh_div; ++ struct clk_mux *mux; ++ struct clk_init_data init; ++ struct clk *clk; ++ struct clk_parent_data parent_data[2]; ++ char name[64]; ++ ++ memset(&init, 0, sizeof(init)); ++ memset(&parent_data, 0, sizeof(parent_data)); ++ ++ init.parent_data = parent_data; + + /* algorithm for enh div: rate = freq / 2 / (N + 1) */ + +@@ -637,7 +702,7 @@ static int meson_spicc_clk_init(struct m + snprintf(name, sizeof(name), "%s#sel", dev_name(dev)); + init.name = name; + init.ops = &clk_mux_ops; +- parent_data[0].hw = &pow2_div->hw; ++ parent_data[0].hw = &spicc->pow2_div.hw; + parent_data[1].hw = &enh_div->hw; + init.num_parents = 2; + init.flags = CLK_SET_RATE_PARENT; +@@ -754,12 +819,20 @@ static int meson_spicc_probe(struct plat + + meson_spicc_oen_enable(spicc); + +- ret = meson_spicc_clk_init(spicc); ++ ret = meson_spicc_pow2_clk_init(spicc); + if (ret) { +- dev_err(&pdev->dev, "clock registration failed\n"); ++ dev_err(&pdev->dev, "pow2 clock registration failed\n"); + goto out_clk; + } + ++ if (spicc->data->has_enhance_clk_div) { ++ ret = meson_spicc_enh_clk_init(spicc); ++ if (ret) { ++ dev_err(&pdev->dev, "clock registration failed\n"); ++ goto out_clk; ++ } ++ } ++ + ret = devm_spi_register_master(&pdev->dev, master); + if (ret) { + dev_err(&pdev->dev, "spi master registration failed\n"); diff --git a/queue-5.19/stmmac-intel-add-a-missing-clk_disable_unprepare-call-in-intel_eth_pci_remove.patch b/queue-5.19/stmmac-intel-add-a-missing-clk_disable_unprepare-call-in-intel_eth_pci_remove.patch new file mode 100644 index 00000000000..f932e3f3068 --- /dev/null +++ b/queue-5.19/stmmac-intel-add-a-missing-clk_disable_unprepare-call-in-intel_eth_pci_remove.patch @@ -0,0 +1,47 @@ +From 5c23d6b717e4e956376f3852b90f58e262946b50 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Tue, 16 Aug 2022 16:23:57 +0200 +Subject: stmmac: intel: Add a missing clk_disable_unprepare() call in intel_eth_pci_remove() + +From: Christophe JAILLET + +commit 5c23d6b717e4e956376f3852b90f58e262946b50 upstream. + +Commit 09f012e64e4b ("stmmac: intel: Fix clock handling on error and remove +paths") removed this clk_disable_unprepare() + +This was partly revert by commit ac322f86b56c ("net: stmmac: Fix clock +handling on remove path") which removed this clk_disable_unprepare() +because: +" + While unloading the dwmac-intel driver, clk_disable_unprepare() is + being called twice in stmmac_dvr_remove() and + intel_eth_pci_remove(). This causes kernel panic on the second call. +" + +However later on, commit 5ec55823438e8 ("net: stmmac: add clocks management +for gmac driver") has updated stmmac_dvr_remove() which do not call +clk_disable_unprepare() anymore. + +So this call should now be called from intel_eth_pci_remove(). + +Fixes: 5ec55823438e8 ("net: stmmac: add clocks management for gmac driver") +Signed-off-by: Christophe JAILLET +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/d7c8c1dadf40df3a7c9e643f76ffadd0ccc1ad1b.1660659689.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c +@@ -1104,6 +1104,7 @@ static void intel_eth_pci_remove(struct + + stmmac_dvr_remove(&pdev->dev); + ++ clk_disable_unprepare(priv->plat->stmmac_clk); + clk_unregister_fixed_rate(priv->plat->stmmac_clk); + + pcim_iounmap_regions(pdev, BIT(0)); diff --git a/queue-5.19/tools-rtla-fix-command-symlinks.patch b/queue-5.19/tools-rtla-fix-command-symlinks.patch new file mode 100644 index 00000000000..9d8b23b649f --- /dev/null +++ b/queue-5.19/tools-rtla-fix-command-symlinks.patch @@ -0,0 +1,43 @@ +From ff5a55dcdb343e3db9b9fb08795b78544b032773 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Sat, 16 Jul 2022 15:47:08 +0200 +Subject: tools/rtla: Fix command symlinks + +From: Ben Hutchings + +commit ff5a55dcdb343e3db9b9fb08795b78544b032773 upstream. + +"ln -s" stores the next argument directly as the symlink target, so +it needs to be a relative path. In this case, just "rtla". + +Link: https://lore.kernel.org/linux-trace-devel/YtLBXMI6Ui4HLIF1@decadent.org.uk + +Fixes: 0605bf009f18 ("rtla: Add osnoise tool") +Fixes: a828cd18bc4a ("rtla: Add timerlat tool and timelart top mode") +Signed-off-by: Ben Hutchings +Acked-by: Daniel Bristot de Oliveira +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +--- + tools/tracing/rtla/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/tracing/rtla/Makefile b/tools/tracing/rtla/Makefile +index 1bea2d16d4c1..b8fe10d941ce 100644 +--- a/tools/tracing/rtla/Makefile ++++ b/tools/tracing/rtla/Makefile +@@ -108,9 +108,9 @@ install: doc_install + $(INSTALL) rtla -m 755 $(DESTDIR)$(BINDIR) + $(STRIP) $(DESTDIR)$(BINDIR)/rtla + @test ! -f $(DESTDIR)$(BINDIR)/osnoise || rm $(DESTDIR)$(BINDIR)/osnoise +- ln -s $(DESTDIR)$(BINDIR)/rtla $(DESTDIR)$(BINDIR)/osnoise ++ ln -s rtla $(DESTDIR)$(BINDIR)/osnoise + @test ! -f $(DESTDIR)$(BINDIR)/timerlat || rm $(DESTDIR)$(BINDIR)/timerlat +- ln -s $(DESTDIR)$(BINDIR)/rtla $(DESTDIR)$(BINDIR)/timerlat ++ ln -s rtla $(DESTDIR)$(BINDIR)/timerlat + + .PHONY: clean tarball + clean: doc_clean +-- +2.37.2 + diff --git a/queue-5.19/virtio_net-fix-endian-ness-for-rss.patch b/queue-5.19/virtio_net-fix-endian-ness-for-rss.patch new file mode 100644 index 00000000000..b6d5f407758 --- /dev/null +++ b/queue-5.19/virtio_net-fix-endian-ness-for-rss.patch @@ -0,0 +1,46 @@ +From 95bb633048fab742230eb2cdf20b8e2676240a54 Mon Sep 17 00:00:00 2001 +From: "Michael S. Tsirkin" +Date: Thu, 11 Aug 2022 08:51:58 -0400 +Subject: virtio_net: fix endian-ness for RSS + +From: Michael S. Tsirkin + +commit 95bb633048fab742230eb2cdf20b8e2676240a54 upstream. + +Using native endian-ness for device supplied fields is wrong +on BE platforms. Sparse warns about this. + +Fixes: 91f41f01d219 ("drivers/net/virtio_net: Added RSS hash report.") +Cc: "Andrew Melnychenko" +Signed-off-by: Michael S. Tsirkin +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/virtio_net.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 3b3eebad3977..d4e0a775b1ba 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -1199,7 +1199,7 @@ static void virtio_skb_set_hash(const struct virtio_net_hdr_v1_hash *hdr_hash, + if (!hdr_hash || !skb) + return; + +- switch ((int)hdr_hash->hash_report) { ++ switch (__le16_to_cpu(hdr_hash->hash_report)) { + case VIRTIO_NET_HASH_REPORT_TCPv4: + case VIRTIO_NET_HASH_REPORT_UDPv4: + case VIRTIO_NET_HASH_REPORT_TCPv6: +@@ -1217,7 +1217,7 @@ static void virtio_skb_set_hash(const struct virtio_net_hdr_v1_hash *hdr_hash, + default: + rss_hash_type = PKT_HASH_TYPE_NONE; + } +- skb_set_hash(skb, (unsigned int)hdr_hash->hash_value, rss_hash_type); ++ skb_set_hash(skb, __le32_to_cpu(hdr_hash->hash_value), rss_hash_type); + } + + static void receive_buf(struct virtnet_info *vi, struct receive_queue *rq, +-- +2.37.2 +