From: Sasha Levin Date: Mon, 26 Feb 2024 22:21:33 +0000 (-0500) Subject: Fixes for 5.15 X-Git-Tag: v4.19.308~32 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=38813d6b7e99c9a614488bf11fbcb2f9cdedd071;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/afs-increase-buffer-size-in-afs_update_volume_status.patch b/queue-5.15/afs-increase-buffer-size-in-afs_update_volume_status.patch new file mode 100644 index 00000000000..f6a58545b3b --- /dev/null +++ b/queue-5.15/afs-increase-buffer-size-in-afs_update_volume_status.patch @@ -0,0 +1,53 @@ +From 289dc8c4d17570d678191812a465c608708dc15c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Feb 2024 14:39:03 +0000 +Subject: afs: Increase buffer size in afs_update_volume_status() + +From: Daniil Dulov + +[ Upstream commit 6ea38e2aeb72349cad50e38899b0ba6fbcb2af3d ] + +The max length of volume->vid value is 20 characters. +So increase idbuf[] size up to 24 to avoid overflow. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +[DH: Actually, it's 20 + NUL, so increase it to 24 and use snprintf()] + +Fixes: d2ddc776a458 ("afs: Overhaul volume and server record caching and fileserver rotation") +Signed-off-by: Daniil Dulov +Signed-off-by: David Howells +Link: https://lore.kernel.org/r/20240211150442.3416-1-d.dulov@aladdin.ru/ # v1 +Link: https://lore.kernel.org/r/20240212083347.10742-1-d.dulov@aladdin.ru/ # v2 +Link: https://lore.kernel.org/r/20240219143906.138346-3-dhowells@redhat.com +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/afs/volume.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/afs/volume.c b/fs/afs/volume.c +index 137a970c19fb3..3d39ce5a23f22 100644 +--- a/fs/afs/volume.c ++++ b/fs/afs/volume.c +@@ -327,7 +327,7 @@ static int afs_update_volume_status(struct afs_volume *volume, struct key *key) + { + struct afs_server_list *new, *old, *discard; + struct afs_vldb_entry *vldb; +- char idbuf[16]; ++ char idbuf[24]; + int ret, idsz; + + _enter(""); +@@ -335,7 +335,7 @@ static int afs_update_volume_status(struct afs_volume *volume, struct key *key) + /* We look up an ID by passing it as a decimal string in the + * operation's name parameter. + */ +- idsz = sprintf(idbuf, "%llu", volume->vid); ++ idsz = snprintf(idbuf, sizeof(idbuf), "%llu", volume->vid); + + vldb = afs_vl_lookup_vldb(volume->cell, key, idbuf, idsz); + if (IS_ERR(vldb)) { +-- +2.43.0 + diff --git a/queue-5.15/arm64-dts-rockchip-set-num-cs-property-for-spi-on-px.patch b/queue-5.15/arm64-dts-rockchip-set-num-cs-property-for-spi-on-px.patch new file mode 100644 index 00000000000..166baf30530 --- /dev/null +++ b/queue-5.15/arm64-dts-rockchip-set-num-cs-property-for-spi-on-px.patch @@ -0,0 +1,50 @@ +From 7c2d48df5cd4685f595890a1e5efbc625e97e8c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jan 2024 11:16:56 +0100 +Subject: arm64: dts: rockchip: set num-cs property for spi on px30 + +From: Heiko Stuebner + +[ Upstream commit 334bf0710c98d391f4067b72f535d6c4c84dfb6f ] + +The px30 has two spi controllers with two chip-selects each. +The num-cs property is specified as the total number of chip +selects a controllers has and is used since 2020 to find uses +of chipselects outside that range in the Rockchip spi driver. + +Without the property set, the default is 1, so spi devices +using the second chipselect will not be created. + +Fixes: eb1262e3cc8b ("spi: spi-rockchip: use num-cs property and ctlr->enable_gpiods") +Signed-off-by: Heiko Stuebner +Reviewed-by: Quentin Schulz +Link: https://lore.kernel.org/r/20240119101656.965744-1-heiko@sntech.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/px30.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/rockchip/px30.dtsi b/arch/arm64/boot/dts/rockchip/px30.dtsi +index 5200d0bbd9e9c..b2dae28a98502 100644 +--- a/arch/arm64/boot/dts/rockchip/px30.dtsi ++++ b/arch/arm64/boot/dts/rockchip/px30.dtsi +@@ -585,6 +585,7 @@ + clock-names = "spiclk", "apb_pclk"; + dmas = <&dmac 12>, <&dmac 13>; + dma-names = "tx", "rx"; ++ num-cs = <2>; + pinctrl-names = "default"; + pinctrl-0 = <&spi0_clk &spi0_csn &spi0_miso &spi0_mosi>; + #address-cells = <1>; +@@ -600,6 +601,7 @@ + clock-names = "spiclk", "apb_pclk"; + dmas = <&dmac 14>, <&dmac 15>; + dma-names = "tx", "rx"; ++ num-cs = <2>; + pinctrl-names = "default"; + pinctrl-0 = <&spi1_clk &spi1_csn0 &spi1_csn1 &spi1_miso &spi1_mosi>; + #address-cells = <1>; +-- +2.43.0 + diff --git a/queue-5.15/ata-ahci_ceva-fix-error-handling-for-xilinx-gt-phy-s.patch b/queue-5.15/ata-ahci_ceva-fix-error-handling-for-xilinx-gt-phy-s.patch new file mode 100644 index 00000000000..556a5757630 --- /dev/null +++ b/queue-5.15/ata-ahci_ceva-fix-error-handling-for-xilinx-gt-phy-s.patch @@ -0,0 +1,245 @@ +From 658f6f7d08d61ef94b2a454deae06bebf97dedf3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 23:44:57 +0530 +Subject: ata: ahci_ceva: fix error handling for Xilinx GT PHY support + +From: Radhey Shyam Pandey + +[ Upstream commit 26c8404e162b43dddcb037ba2d0cb58c0ed60aab ] + +Platform clock and phy error resources are not cleaned up in Xilinx GT PHY +error path. + +To fix introduce the function ceva_ahci_platform_enable_resources() which +is a customized version of ahci_platform_enable_resources() and inline with +SATA IP programming sequence it does: + +- Assert SATA reset +- Program PS GTR phy +- Bring SATA by de-asserting the reset +- Wait for GT lane PLL to be locked + +ceva_ahci_platform_enable_resources() is also used in the resume path +as the same SATA programming sequence (as in probe) should be followed. +Also cleanup the mixed usage of ahci_platform_enable_resources() and custom +implementation in the probe function as both are not required. + +Fixes: 9a9d3abe24bb ("ata: ahci: ceva: Update the driver to support xilinx GT phy") +Signed-off-by: Radhey Shyam Pandey +Reviewed-by: Damien Le Moal +Signed-off-by: Niklas Cassel +Signed-off-by: Sasha Levin +--- + drivers/ata/ahci_ceva.c | 125 +++++++++++++++++++++++++--------------- + 1 file changed, 79 insertions(+), 46 deletions(-) + +diff --git a/drivers/ata/ahci_ceva.c b/drivers/ata/ahci_ceva.c +index 50b56cd0039d2..3a32710820046 100644 +--- a/drivers/ata/ahci_ceva.c ++++ b/drivers/ata/ahci_ceva.c +@@ -88,7 +88,6 @@ struct ceva_ahci_priv { + u32 axicc; + bool is_cci_enabled; + int flags; +- struct reset_control *rst; + }; + + static unsigned int ceva_ahci_read_id(struct ata_device *dev, +@@ -189,6 +188,60 @@ static struct scsi_host_template ahci_platform_sht = { + AHCI_SHT(DRV_NAME), + }; + ++static int ceva_ahci_platform_enable_resources(struct ahci_host_priv *hpriv) ++{ ++ int rc, i; ++ ++ rc = ahci_platform_enable_regulators(hpriv); ++ if (rc) ++ return rc; ++ ++ rc = ahci_platform_enable_clks(hpriv); ++ if (rc) ++ goto disable_regulator; ++ ++ /* Assert the controller reset */ ++ rc = ahci_platform_assert_rsts(hpriv); ++ if (rc) ++ goto disable_clks; ++ ++ for (i = 0; i < hpriv->nports; i++) { ++ rc = phy_init(hpriv->phys[i]); ++ if (rc) ++ goto disable_rsts; ++ } ++ ++ /* De-assert the controller reset */ ++ ahci_platform_deassert_rsts(hpriv); ++ ++ for (i = 0; i < hpriv->nports; i++) { ++ rc = phy_power_on(hpriv->phys[i]); ++ if (rc) { ++ phy_exit(hpriv->phys[i]); ++ goto disable_phys; ++ } ++ } ++ ++ return 0; ++ ++disable_rsts: ++ ahci_platform_deassert_rsts(hpriv); ++ ++disable_phys: ++ while (--i >= 0) { ++ phy_power_off(hpriv->phys[i]); ++ phy_exit(hpriv->phys[i]); ++ } ++ ++disable_clks: ++ ahci_platform_disable_clks(hpriv); ++ ++disable_regulator: ++ ahci_platform_disable_regulators(hpriv); ++ ++ return rc; ++} ++ + static int ceva_ahci_probe(struct platform_device *pdev) + { + struct device_node *np = pdev->dev.of_node; +@@ -203,47 +256,19 @@ static int ceva_ahci_probe(struct platform_device *pdev) + return -ENOMEM; + + cevapriv->ahci_pdev = pdev; +- +- cevapriv->rst = devm_reset_control_get_optional_exclusive(&pdev->dev, +- NULL); +- if (IS_ERR(cevapriv->rst)) +- dev_err_probe(&pdev->dev, PTR_ERR(cevapriv->rst), +- "failed to get reset\n"); +- + hpriv = ahci_platform_get_resources(pdev, 0); + if (IS_ERR(hpriv)) + return PTR_ERR(hpriv); + +- if (!cevapriv->rst) { +- rc = ahci_platform_enable_resources(hpriv); +- if (rc) +- return rc; +- } else { +- int i; ++ hpriv->rsts = devm_reset_control_get_optional_exclusive(&pdev->dev, ++ NULL); ++ if (IS_ERR(hpriv->rsts)) ++ return dev_err_probe(&pdev->dev, PTR_ERR(hpriv->rsts), ++ "failed to get reset\n"); + +- rc = ahci_platform_enable_clks(hpriv); +- if (rc) +- return rc; +- /* Assert the controller reset */ +- reset_control_assert(cevapriv->rst); +- +- for (i = 0; i < hpriv->nports; i++) { +- rc = phy_init(hpriv->phys[i]); +- if (rc) +- return rc; +- } +- +- /* De-assert the controller reset */ +- reset_control_deassert(cevapriv->rst); +- +- for (i = 0; i < hpriv->nports; i++) { +- rc = phy_power_on(hpriv->phys[i]); +- if (rc) { +- phy_exit(hpriv->phys[i]); +- return rc; +- } +- } +- } ++ rc = ceva_ahci_platform_enable_resources(hpriv); ++ if (rc) ++ return rc; + + if (of_property_read_bool(np, "ceva,broken-gen2")) + cevapriv->flags = CEVA_FLAG_BROKEN_GEN2; +@@ -252,52 +277,60 @@ static int ceva_ahci_probe(struct platform_device *pdev) + if (of_property_read_u8_array(np, "ceva,p0-cominit-params", + (u8 *)&cevapriv->pp2c[0], 4) < 0) { + dev_warn(dev, "ceva,p0-cominit-params property not defined\n"); +- return -EINVAL; ++ rc = -EINVAL; ++ goto disable_resources; + } + + if (of_property_read_u8_array(np, "ceva,p1-cominit-params", + (u8 *)&cevapriv->pp2c[1], 4) < 0) { + dev_warn(dev, "ceva,p1-cominit-params property not defined\n"); +- return -EINVAL; ++ rc = -EINVAL; ++ goto disable_resources; + } + + /* Read OOB timing value for COMWAKE from device-tree*/ + if (of_property_read_u8_array(np, "ceva,p0-comwake-params", + (u8 *)&cevapriv->pp3c[0], 4) < 0) { + dev_warn(dev, "ceva,p0-comwake-params property not defined\n"); +- return -EINVAL; ++ rc = -EINVAL; ++ goto disable_resources; + } + + if (of_property_read_u8_array(np, "ceva,p1-comwake-params", + (u8 *)&cevapriv->pp3c[1], 4) < 0) { + dev_warn(dev, "ceva,p1-comwake-params property not defined\n"); +- return -EINVAL; ++ rc = -EINVAL; ++ goto disable_resources; + } + + /* Read phy BURST timing value from device-tree */ + if (of_property_read_u8_array(np, "ceva,p0-burst-params", + (u8 *)&cevapriv->pp4c[0], 4) < 0) { + dev_warn(dev, "ceva,p0-burst-params property not defined\n"); +- return -EINVAL; ++ rc = -EINVAL; ++ goto disable_resources; + } + + if (of_property_read_u8_array(np, "ceva,p1-burst-params", + (u8 *)&cevapriv->pp4c[1], 4) < 0) { + dev_warn(dev, "ceva,p1-burst-params property not defined\n"); +- return -EINVAL; ++ rc = -EINVAL; ++ goto disable_resources; + } + + /* Read phy RETRY interval timing value from device-tree */ + if (of_property_read_u16_array(np, "ceva,p0-retry-params", + (u16 *)&cevapriv->pp5c[0], 2) < 0) { + dev_warn(dev, "ceva,p0-retry-params property not defined\n"); +- return -EINVAL; ++ rc = -EINVAL; ++ goto disable_resources; + } + + if (of_property_read_u16_array(np, "ceva,p1-retry-params", + (u16 *)&cevapriv->pp5c[1], 2) < 0) { + dev_warn(dev, "ceva,p1-retry-params property not defined\n"); +- return -EINVAL; ++ rc = -EINVAL; ++ goto disable_resources; + } + + /* +@@ -335,7 +368,7 @@ static int __maybe_unused ceva_ahci_resume(struct device *dev) + struct ahci_host_priv *hpriv = host->private_data; + int rc; + +- rc = ahci_platform_enable_resources(hpriv); ++ rc = ceva_ahci_platform_enable_resources(hpriv); + if (rc) + return rc; + +-- +2.43.0 + diff --git a/queue-5.15/ata-libahci_platform-convert-to-using-devm-bulk-cloc.patch b/queue-5.15/ata-libahci_platform-convert-to-using-devm-bulk-cloc.patch new file mode 100644 index 00000000000..ee0e9695066 --- /dev/null +++ b/queue-5.15/ata-libahci_platform-convert-to-using-devm-bulk-cloc.patch @@ -0,0 +1,317 @@ +From 87194cda7a0bdad7a1924a31a581090757169db7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Sep 2022 22:36:05 +0300 +Subject: ata: libahci_platform: Convert to using devm bulk clocks API + +From: Serge Semin + +[ Upstream commit e28b3abf8020a884bd3b7758ea8915365af8fadf ] + +In order to simplify the clock-related code there is a way to convert the +current fixed clocks array into using the common bulk clocks kernel API +with dynamic set of the clock handlers and device-managed clock-resource +tracking. It's a bit tricky due to the complication coming from the +requirement to support the platforms (da850, spear13xx) with the +non-OF-based clock source, but still doable. + +Before this modification there are two methods have been used to get the +clocks connected to an AHCI device: clk_get() - to get the very first +clock in the list and of_clk_get() - to get the rest of them. Basically +the platforms with non-OF-based clocks definition could specify only a +single reference clock source. The platforms with OF-hw clocks have been +luckier and could setup up to AHCI_MAX_CLKS clocks. Such semantic can be +retained with using devm_clk_bulk_get_all() to retrieve the clocks defined +via the DT firmware and devm_clk_get_optional() otherwise. In both cases +using the device-managed version of the methods will cause the automatic +resources deallocation on the AHCI device removal event. The only +complicated part in the suggested approach is the explicit allocation and +initialization of the clk_bulk_data structure instance for the non-OF +reference clocks. It's required in order to use the Bulk Clocks API for +the both denoted cases of the clocks definition. + +Note aside with the clock-related code reduction and natural +simplification, there are several bonuses the suggested modification +provides. First of all the limitation of having no greater than +AHCI_MAX_CLKS clocks is now removed, since the devm_clk_bulk_get_all() +method will allocate as many reference clocks data descriptors as there +are clocks specified for the device. Secondly the clock names are +auto-detected. So the LLDD (glue) drivers can make sure that the required +clocks are specified just by checking the clock IDs in the clk_bulk_data +array. Thirdly using the handy Bulk Clocks kernel API improves the +clocks-handling code readability. And the last but not least this +modification implements a true optional clocks support to the +ahci_platform_get_resources() method. Indeed the previous clocks getting +procedure just stopped getting the clocks on any errors (aside from +non-critical -EPROBE_DEFER) in a way so the callee wasn't even informed +about abnormal loop termination. The new implementation lacks of such +problem. The ahci_platform_get_resources() will return an error code if +the corresponding clocks getting method ends execution abnormally. + +Signed-off-by: Serge Semin +Reviewed-by: Hannes Reinecke +Signed-off-by: Damien Le Moal +Stable-dep-of: 26c8404e162b ("ata: ahci_ceva: fix error handling for Xilinx GT PHY support") +Signed-off-by: Sasha Levin +--- + drivers/ata/ahci.h | 4 +- + drivers/ata/ahci_da850.c | 47 ++++++++----------- + drivers/ata/ahci_dm816.c | 4 +- + drivers/ata/libahci_platform.c | 83 ++++++++++++++++------------------ + 4 files changed, 61 insertions(+), 77 deletions(-) + +diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h +index 69557e602e2ea..54e79f966444c 100644 +--- a/drivers/ata/ahci.h ++++ b/drivers/ata/ahci.h +@@ -39,7 +39,6 @@ + + enum { + AHCI_MAX_PORTS = 32, +- AHCI_MAX_CLKS = 5, + AHCI_MAX_SG = 168, /* hardware max is 64K */ + AHCI_DMA_BOUNDARY = 0xffffffff, + AHCI_MAX_CMDS = 32, +@@ -343,7 +342,8 @@ struct ahci_host_priv { + u32 em_msg_type; /* EM message type */ + u32 remapped_nvme; /* NVMe remapped device count */ + bool got_runtime_pm; /* Did we do pm_runtime_get? */ +- struct clk *clks[AHCI_MAX_CLKS]; /* Optional */ ++ unsigned int n_clks; ++ struct clk_bulk_data *clks; /* Optional */ + struct reset_control *rsts; /* Optional */ + struct regulator **target_pwrs; /* Optional */ + struct regulator *ahci_regulator;/* Optional */ +diff --git a/drivers/ata/ahci_da850.c b/drivers/ata/ahci_da850.c +index 0e82766007128..389268c1ef456 100644 +--- a/drivers/ata/ahci_da850.c ++++ b/drivers/ata/ahci_da850.c +@@ -163,7 +163,6 @@ static int ahci_da850_probe(struct platform_device *pdev) + struct ahci_host_priv *hpriv; + void __iomem *pwrdn_reg; + struct resource *res; +- struct clk *clk; + u32 mpy; + int rc; + +@@ -172,36 +171,28 @@ static int ahci_da850_probe(struct platform_device *pdev) + return PTR_ERR(hpriv); + + /* +- * Internally ahci_platform_get_resources() calls clk_get(dev, NULL) +- * when trying to obtain the functional clock. This SATA controller +- * uses two clocks for which we specify two connection ids. If we don't +- * have the functional clock at this point - call clk_get() again with +- * con_id = "fck". ++ * Internally ahci_platform_get_resources() calls the bulk clocks ++ * get method or falls back to using a single clk_get_optional(). ++ * This AHCI SATA controller uses two clocks: functional clock ++ * with "fck" connection id and external reference clock with ++ * "refclk" id. If we haven't got all of them re-try the clocks ++ * getting procedure with the explicitly specified ids. + */ +- if (!hpriv->clks[0]) { +- clk = clk_get(dev, "fck"); +- if (IS_ERR(clk)) +- return PTR_ERR(clk); +- +- hpriv->clks[0] = clk; +- } +- +- /* +- * The second clock used by ahci-da850 is the external REFCLK. If we +- * didn't get it from ahci_platform_get_resources(), let's try to +- * specify the con_id in clk_get(). +- */ +- if (!hpriv->clks[1]) { +- clk = clk_get(dev, "refclk"); +- if (IS_ERR(clk)) { +- dev_err(dev, "unable to obtain the reference clock"); +- return -ENODEV; +- } +- +- hpriv->clks[1] = clk; ++ if (hpriv->n_clks < 2) { ++ hpriv->clks = devm_kcalloc(dev, 2, sizeof(*hpriv->clks), GFP_KERNEL); ++ if (!hpriv->clks) ++ return -ENOMEM; ++ ++ hpriv->clks[0].id = "fck"; ++ hpriv->clks[1].id = "refclk"; ++ hpriv->n_clks = 2; ++ ++ rc = devm_clk_bulk_get(dev, hpriv->n_clks, hpriv->clks); ++ if (rc) ++ return rc; + } + +- mpy = ahci_da850_calculate_mpy(clk_get_rate(hpriv->clks[1])); ++ mpy = ahci_da850_calculate_mpy(clk_get_rate(hpriv->clks[1].clk)); + if (mpy == 0) { + dev_err(dev, "invalid REFCLK multiplier value: 0x%x", mpy); + return -EINVAL; +diff --git a/drivers/ata/ahci_dm816.c b/drivers/ata/ahci_dm816.c +index 8bec410416714..ec83ba8858060 100644 +--- a/drivers/ata/ahci_dm816.c ++++ b/drivers/ata/ahci_dm816.c +@@ -69,12 +69,12 @@ static int ahci_dm816_phy_init(struct ahci_host_priv *hpriv, struct device *dev) + * keep-alive clock and the external reference clock. We need the + * rate of the latter to calculate the correct value of MPY bits. + */ +- if (!hpriv->clks[1]) { ++ if (hpriv->n_clks < 2) { + dev_err(dev, "reference clock not supplied\n"); + return -EINVAL; + } + +- refclk_rate = clk_get_rate(hpriv->clks[1]); ++ refclk_rate = clk_get_rate(hpriv->clks[1].clk); + if ((refclk_rate % 100) != 0) { + dev_err(dev, "reference clock rate must be divisible by 100\n"); + return -EINVAL; +diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c +index 64d6da0a53035..6ae1d8b870a2d 100644 +--- a/drivers/ata/libahci_platform.c ++++ b/drivers/ata/libahci_platform.c +@@ -97,28 +97,14 @@ EXPORT_SYMBOL_GPL(ahci_platform_disable_phys); + * ahci_platform_enable_clks - Enable platform clocks + * @hpriv: host private area to store config values + * +- * This function enables all the clks found in hpriv->clks, starting at +- * index 0. If any clk fails to enable it disables all the clks already +- * enabled in reverse order, and then returns an error. ++ * This function enables all the clks found for the AHCI device. + * + * RETURNS: + * 0 on success otherwise a negative error code + */ + int ahci_platform_enable_clks(struct ahci_host_priv *hpriv) + { +- int c, rc; +- +- for (c = 0; c < AHCI_MAX_CLKS && hpriv->clks[c]; c++) { +- rc = clk_prepare_enable(hpriv->clks[c]); +- if (rc) +- goto disable_unprepare_clk; +- } +- return 0; +- +-disable_unprepare_clk: +- while (--c >= 0) +- clk_disable_unprepare(hpriv->clks[c]); +- return rc; ++ return clk_bulk_prepare_enable(hpriv->n_clks, hpriv->clks); + } + EXPORT_SYMBOL_GPL(ahci_platform_enable_clks); + +@@ -126,16 +112,13 @@ EXPORT_SYMBOL_GPL(ahci_platform_enable_clks); + * ahci_platform_disable_clks - Disable platform clocks + * @hpriv: host private area to store config values + * +- * This function disables all the clks found in hpriv->clks, in reverse +- * order of ahci_platform_enable_clks (starting at the end of the array). ++ * This function disables all the clocks enabled before ++ * (bulk-clocks-disable function is supposed to do that in reverse ++ * from the enabling procedure order). + */ + void ahci_platform_disable_clks(struct ahci_host_priv *hpriv) + { +- int c; +- +- for (c = AHCI_MAX_CLKS - 1; c >= 0; c--) +- if (hpriv->clks[c]) +- clk_disable_unprepare(hpriv->clks[c]); ++ clk_bulk_disable_unprepare(hpriv->n_clks, hpriv->clks); + } + EXPORT_SYMBOL_GPL(ahci_platform_disable_clks); + +@@ -292,8 +275,6 @@ static void ahci_platform_put_resources(struct device *dev, void *res) + pm_runtime_disable(dev); + } + +- for (c = 0; c < AHCI_MAX_CLKS && hpriv->clks[c]; c++) +- clk_put(hpriv->clks[c]); + /* + * The regulators are tied to child node device and not to the + * SATA device itself. So we can't use devm for automatically +@@ -374,8 +355,8 @@ static int ahci_platform_get_regulator(struct ahci_host_priv *hpriv, u32 port, + * 1) mmio registers (IORESOURCE_MEM 0, mandatory) + * 2) regulator for controlling the targets power (optional) + * regulator for controlling the AHCI controller (optional) +- * 3) 0 - AHCI_MAX_CLKS clocks, as specified in the devs devicetree node, +- * or for non devicetree enabled platforms a single clock ++ * 3) all clocks specified in the devicetree node, or a single ++ * clock for non-OF platforms (optional) + * 4) resets, if flags has AHCI_PLATFORM_GET_RESETS (optional) + * 5) phys (optional) + * +@@ -385,11 +366,10 @@ static int ahci_platform_get_regulator(struct ahci_host_priv *hpriv, u32 port, + struct ahci_host_priv *ahci_platform_get_resources(struct platform_device *pdev, + unsigned int flags) + { ++ int child_nodes, rc = -ENOMEM, enabled_ports = 0; + struct device *dev = &pdev->dev; + struct ahci_host_priv *hpriv; +- struct clk *clk; + struct device_node *child; +- int i, enabled_ports = 0, rc = -ENOMEM, child_nodes; + u32 mask_port_map = 0; + + if (!devres_open_group(dev, NULL, GFP_KERNEL)) +@@ -409,25 +389,38 @@ struct ahci_host_priv *ahci_platform_get_resources(struct platform_device *pdev, + goto err_out; + } + +- for (i = 0; i < AHCI_MAX_CLKS; i++) { ++ /* ++ * Bulk clocks getting procedure can fail to find any clock due to ++ * running on a non-OF platform or due to the clocks being defined in ++ * bypass of the DT firmware (like da850, spear13xx). In that case we ++ * fallback to getting a single clock source right from the dev clocks ++ * list. ++ */ ++ rc = devm_clk_bulk_get_all(dev, &hpriv->clks); ++ if (rc < 0) ++ goto err_out; ++ ++ if (rc > 0) { ++ /* Got clocks in bulk */ ++ hpriv->n_clks = rc; ++ } else { + /* +- * For now we must use clk_get(dev, NULL) for the first clock, +- * because some platforms (da850, spear13xx) are not yet +- * converted to use devicetree for clocks. For new platforms +- * this is equivalent to of_clk_get(dev->of_node, 0). ++ * No clock bulk found: fallback to manually getting ++ * the optional clock. + */ +- if (i == 0) +- clk = clk_get(dev, NULL); +- else +- clk = of_clk_get(dev->of_node, i); +- +- if (IS_ERR(clk)) { +- rc = PTR_ERR(clk); +- if (rc == -EPROBE_DEFER) +- goto err_out; +- break; ++ hpriv->clks = devm_kzalloc(dev, sizeof(*hpriv->clks), GFP_KERNEL); ++ if (!hpriv->clks) { ++ rc = -ENOMEM; ++ goto err_out; ++ } ++ hpriv->clks->clk = devm_clk_get_optional(dev, NULL); ++ if (IS_ERR(hpriv->clks->clk)) { ++ rc = PTR_ERR(hpriv->clks->clk); ++ goto err_out; ++ } else if (hpriv->clks->clk) { ++ hpriv->clks->id = "ahci"; ++ hpriv->n_clks = 1; + } +- hpriv->clks[i] = clk; + } + + hpriv->ahci_regulator = devm_regulator_get(dev, "ahci"); +-- +2.43.0 + diff --git a/queue-5.15/ata-libahci_platform-introduce-reset-assertion-deass.patch b/queue-5.15/ata-libahci_platform-introduce-reset-assertion-deass.patch new file mode 100644 index 00000000000..f9278e1571d --- /dev/null +++ b/queue-5.15/ata-libahci_platform-introduce-reset-assertion-deass.patch @@ -0,0 +1,181 @@ +From 818de4019e847062382ee42997c6c37edd7615fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Sep 2022 22:36:08 +0300 +Subject: ata: libahci_platform: Introduce reset assertion/deassertion methods + +From: Serge Semin + +[ Upstream commit f67f12ff57bcfcd7d64280f748787793217faeaf ] + +Currently the ACHI-platform library supports only the assert and deassert +reset signals and ignores the platforms with self-deasserting reset lines. +That prone to having the platforms with self-deasserting reset method +misbehaviour when it comes to resuming from sleep state after the clocks +have been fully disabled. For such cases the controller needs to be fully +reset all over after the reference clocks are enabled and stable, +otherwise the controller state machine might be in an undetermined state. + +The best solution would be to auto-detect which reset method is supported +by the particular platform and use it implicitly in the framework of the +ahci_platform_enable_resources()/ahci_platform_disable_resources() +methods. Alas it can't be implemented due to the AHCI-platform library +already supporting the shared reset control lines. As [1] says in such +case we have to use only one of the next methods: ++ reset_control_assert()/reset_control_deassert(); ++ reset_control_reset()/reset_control_rearm(). +If the driver had an exclusive control over the reset lines we could have +been able to manipulate the lines with no much limitation and just used +the combination of the methods above to cover all the possible +reset-control cases. Since the shared reset control has already been +advertised and couldn't be changed with no risk to breaking the platforms +relying on it, we have no choice but to make the platform drivers to +determine which reset methods the platform reset system supports. + +In order to implement both types of reset control support we suggest to +introduce the new AHCI-platform flag: AHCI_PLATFORM_RST_TRIGGER, which +when passed to the ahci_platform_get_resources() method together with the +AHCI_PLATFORM_GET_RESETS flag will indicate that the reset lines are +self-deasserting thus the reset_control_reset()/reset_control_rearm() will +be used to control the reset state. Otherwise the +reset_control_deassert()/reset_control_assert() methods will be utilized. + +[1] Documentation/driver-api/reset.rst + +Signed-off-by: Serge Semin +Reviewed-by: Hannes Reinecke +Signed-off-by: Damien Le Moal +Stable-dep-of: 26c8404e162b ("ata: ahci_ceva: fix error handling for Xilinx GT PHY support") +Signed-off-by: Sasha Levin +--- + drivers/ata/ahci.h | 1 + + drivers/ata/libahci_platform.c | 50 ++++++++++++++++++++++++++++++---- + include/linux/ahci_platform.h | 5 +++- + 3 files changed, 50 insertions(+), 6 deletions(-) + +diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h +index 54e79f966444c..b4c59fe2db60a 100644 +--- a/drivers/ata/ahci.h ++++ b/drivers/ata/ahci.h +@@ -344,6 +344,7 @@ struct ahci_host_priv { + bool got_runtime_pm; /* Did we do pm_runtime_get? */ + unsigned int n_clks; + struct clk_bulk_data *clks; /* Optional */ ++ unsigned int f_rsts; + struct reset_control *rsts; /* Optional */ + struct regulator **target_pwrs; /* Optional */ + struct regulator *ahci_regulator;/* Optional */ +diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c +index 6ae1d8b870a2d..43380d1a410e2 100644 +--- a/drivers/ata/libahci_platform.c ++++ b/drivers/ata/libahci_platform.c +@@ -122,6 +122,44 @@ void ahci_platform_disable_clks(struct ahci_host_priv *hpriv) + } + EXPORT_SYMBOL_GPL(ahci_platform_disable_clks); + ++/** ++ * ahci_platform_deassert_rsts - Deassert/trigger platform resets ++ * @hpriv: host private area to store config values ++ * ++ * This function deasserts or triggers all the reset lines found for ++ * the AHCI device. ++ * ++ * RETURNS: ++ * 0 on success otherwise a negative error code ++ */ ++int ahci_platform_deassert_rsts(struct ahci_host_priv *hpriv) ++{ ++ if (hpriv->f_rsts & AHCI_PLATFORM_RST_TRIGGER) ++ return reset_control_reset(hpriv->rsts); ++ ++ return reset_control_deassert(hpriv->rsts); ++} ++EXPORT_SYMBOL_GPL(ahci_platform_deassert_rsts); ++ ++/** ++ * ahci_platform_assert_rsts - Assert/rearm platform resets ++ * @hpriv: host private area to store config values ++ * ++ * This function asserts or rearms (for self-deasserting resets) all ++ * the reset controls found for the AHCI device. ++ * ++ * RETURNS: ++ * 0 on success otherwise a negative error code ++ */ ++int ahci_platform_assert_rsts(struct ahci_host_priv *hpriv) ++{ ++ if (hpriv->f_rsts & AHCI_PLATFORM_RST_TRIGGER) ++ return reset_control_rearm(hpriv->rsts); ++ ++ return reset_control_assert(hpriv->rsts); ++} ++EXPORT_SYMBOL_GPL(ahci_platform_assert_rsts); ++ + /** + * ahci_platform_enable_regulators - Enable regulators + * @hpriv: host private area to store config values +@@ -219,18 +257,18 @@ int ahci_platform_enable_resources(struct ahci_host_priv *hpriv) + if (rc) + goto disable_regulator; + +- rc = reset_control_deassert(hpriv->rsts); ++ rc = ahci_platform_deassert_rsts(hpriv); + if (rc) + goto disable_clks; + + rc = ahci_platform_enable_phys(hpriv); + if (rc) +- goto disable_resets; ++ goto disable_rsts; + + return 0; + +-disable_resets: +- reset_control_assert(hpriv->rsts); ++disable_rsts: ++ ahci_platform_assert_rsts(hpriv); + + disable_clks: + ahci_platform_disable_clks(hpriv); +@@ -257,7 +295,7 @@ void ahci_platform_disable_resources(struct ahci_host_priv *hpriv) + { + ahci_platform_disable_phys(hpriv); + +- reset_control_assert(hpriv->rsts); ++ ahci_platform_assert_rsts(hpriv); + + ahci_platform_disable_clks(hpriv); + +@@ -442,6 +480,8 @@ struct ahci_host_priv *ahci_platform_get_resources(struct platform_device *pdev, + rc = PTR_ERR(hpriv->rsts); + goto err_out; + } ++ ++ hpriv->f_rsts = flags & AHCI_PLATFORM_RST_TRIGGER; + } + + /* +diff --git a/include/linux/ahci_platform.h b/include/linux/ahci_platform.h +index 49e5383d42222..6d7dd472d3703 100644 +--- a/include/linux/ahci_platform.h ++++ b/include/linux/ahci_platform.h +@@ -23,6 +23,8 @@ int ahci_platform_enable_phys(struct ahci_host_priv *hpriv); + void ahci_platform_disable_phys(struct ahci_host_priv *hpriv); + int ahci_platform_enable_clks(struct ahci_host_priv *hpriv); + void ahci_platform_disable_clks(struct ahci_host_priv *hpriv); ++int ahci_platform_deassert_rsts(struct ahci_host_priv *hpriv); ++int ahci_platform_assert_rsts(struct ahci_host_priv *hpriv); + int ahci_platform_enable_regulators(struct ahci_host_priv *hpriv); + void ahci_platform_disable_regulators(struct ahci_host_priv *hpriv); + int ahci_platform_enable_resources(struct ahci_host_priv *hpriv); +@@ -41,6 +43,7 @@ int ahci_platform_resume_host(struct device *dev); + int ahci_platform_suspend(struct device *dev); + int ahci_platform_resume(struct device *dev); + +-#define AHCI_PLATFORM_GET_RESETS 0x01 ++#define AHCI_PLATFORM_GET_RESETS BIT(0) ++#define AHCI_PLATFORM_RST_TRIGGER BIT(1) + + #endif /* _AHCI_PLATFORM_H */ +-- +2.43.0 + diff --git a/queue-5.15/bpf-fix-racing-between-bpf_timer_cancel_and_free-and.patch b/queue-5.15/bpf-fix-racing-between-bpf_timer_cancel_and_free-and.patch new file mode 100644 index 00000000000..1f7c2b2d6ae --- /dev/null +++ b/queue-5.15/bpf-fix-racing-between-bpf_timer_cancel_and_free-and.patch @@ -0,0 +1,98 @@ +From 1fe4e7b4412f7cc37b86629aaea8a6fccda9dfa1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Feb 2024 13:12:17 -0800 +Subject: bpf: Fix racing between bpf_timer_cancel_and_free and + bpf_timer_cancel + +From: Martin KaFai Lau + +[ Upstream commit 0281b919e175bb9c3128bd3872ac2903e9436e3f ] + +The following race is possible between bpf_timer_cancel_and_free +and bpf_timer_cancel. It will lead a UAF on the timer->timer. + +bpf_timer_cancel(); + spin_lock(); + t = timer->time; + spin_unlock(); + + bpf_timer_cancel_and_free(); + spin_lock(); + t = timer->timer; + timer->timer = NULL; + spin_unlock(); + hrtimer_cancel(&t->timer); + kfree(t); + + /* UAF on t */ + hrtimer_cancel(&t->timer); + +In bpf_timer_cancel_and_free, this patch frees the timer->timer +after a rcu grace period. This requires a rcu_head addition +to the "struct bpf_hrtimer". Another kfree(t) happens in bpf_timer_init, +this does not need a kfree_rcu because it is still under the +spin_lock and timer->timer has not been visible by others yet. + +In bpf_timer_cancel, rcu_read_lock() is added because this helper +can be used in a non rcu critical section context (e.g. from +a sleepable bpf prog). Other timer->timer usages in helpers.c +have been audited, bpf_timer_cancel() is the only place where +timer->timer is used outside of the spin_lock. + +Another solution considered is to mark a t->flag in bpf_timer_cancel +and clear it after hrtimer_cancel() is done. In bpf_timer_cancel_and_free, +it busy waits for the flag to be cleared before kfree(t). This patch +goes with a straight forward solution and frees timer->timer after +a rcu grace period. + +Fixes: b00628b1c7d5 ("bpf: Introduce bpf timers.") +Suggested-by: Alexei Starovoitov +Signed-off-by: Martin KaFai Lau +Signed-off-by: Daniel Borkmann +Acked-by: Hou Tao +Link: https://lore.kernel.org/bpf/20240215211218.990808-1-martin.lau@linux.dev +Signed-off-by: Sasha Levin +--- + kernel/bpf/helpers.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c +index c8827d1ff3c59..870127c895c49 100644 +--- a/kernel/bpf/helpers.c ++++ b/kernel/bpf/helpers.c +@@ -1048,6 +1048,7 @@ struct bpf_hrtimer { + struct bpf_prog *prog; + void __rcu *callback_fn; + void *value; ++ struct rcu_head rcu; + }; + + /* the actual struct hidden inside uapi struct bpf_timer */ +@@ -1269,6 +1270,7 @@ BPF_CALL_1(bpf_timer_cancel, struct bpf_timer_kern *, timer) + + if (in_nmi()) + return -EOPNOTSUPP; ++ rcu_read_lock(); + __bpf_spin_lock_irqsave(&timer->lock); + t = timer->timer; + if (!t) { +@@ -1290,6 +1292,7 @@ BPF_CALL_1(bpf_timer_cancel, struct bpf_timer_kern *, timer) + * if it was running. + */ + ret = ret ?: hrtimer_cancel(&t->timer); ++ rcu_read_unlock(); + return ret; + } + +@@ -1344,7 +1347,7 @@ void bpf_timer_cancel_and_free(void *val) + */ + if (this_cpu_read(hrtimer_running) != t) + hrtimer_cancel(&t->timer); +- kfree(t); ++ kfree_rcu(t, rcu); + } + + const struct bpf_func_proto bpf_get_current_task_proto __weak; +-- +2.43.0 + diff --git a/queue-5.15/bpf-scripts-correct-gpl-license-name.patch b/queue-5.15/bpf-scripts-correct-gpl-license-name.patch new file mode 100644 index 00000000000..4602be8e1f8 --- /dev/null +++ b/queue-5.15/bpf-scripts-correct-gpl-license-name.patch @@ -0,0 +1,41 @@ +From 593c59cb4212b8ccb1c6b729a1749be26f5b92c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 23:05:46 +0000 +Subject: bpf, scripts: Correct GPL license name + +From: Gianmarco Lusvardi + +[ Upstream commit e37243b65d528a8a9f8b9a57a43885f8e8dfc15c ] + +The bpf_doc script refers to the GPL as the "GNU Privacy License". +I strongly suspect that the author wanted to refer to the GNU General +Public License, under which the Linux kernel is released, as, to the +best of my knowledge, there is no license named "GNU Privacy License". +This patch corrects the license name in the script accordingly. + +Fixes: 56a092c89505 ("bpf: add script and prepare bpf.h for new helpers documentation") +Signed-off-by: Gianmarco Lusvardi +Signed-off-by: Daniel Borkmann +Reviewed-by: Quentin Monnet +Link: https://lore.kernel.org/bpf/20240213230544.930018-3-glusvardi@posteo.net +Signed-off-by: Sasha Levin +--- + scripts/bpf_doc.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/bpf_doc.py b/scripts/bpf_doc.py +index 00ac7b79cddb4..7772c6424089e 100755 +--- a/scripts/bpf_doc.py ++++ b/scripts/bpf_doc.py +@@ -369,7 +369,7 @@ eBPF programs can have an associated license, passed along with the bytecode + instructions to the kernel when the programs are loaded. The format for that + string is identical to the one in use for kernel modules (Dual licenses, such + as "Dual BSD/GPL", may be used). Some helper functions are only accessible to +-programs that are compatible with the GNU Privacy License (GPL). ++programs that are compatible with the GNU General Public License (GNU GPL). + + In order to use such helpers, the eBPF program must be loaded with the correct + license string passed (via **attr**) to the **bpf**\ () system call, and this +-- +2.43.0 + diff --git a/queue-5.15/drm-amd-display-fix-memory-leak-in-dm_sw_fini.patch b/queue-5.15/drm-amd-display-fix-memory-leak-in-dm_sw_fini.patch new file mode 100644 index 00000000000..8933399ce36 --- /dev/null +++ b/queue-5.15/drm-amd-display-fix-memory-leak-in-dm_sw_fini.patch @@ -0,0 +1,60 @@ +From 978dec007ac1ff482c5e645221d026f2aa671059 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 01:50:50 +0100 +Subject: drm/amd/display: Fix memory leak in dm_sw_fini() + +From: Armin Wolf + +[ Upstream commit bae67893578d608e35691dcdfa90c4957debf1d3 ] + +After destroying dmub_srv, the memory associated with it is +not freed, causing a memory leak: + +unreferenced object 0xffff896302b45800 (size 1024): + comm "(udev-worker)", pid 222, jiffies 4294894636 + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace (crc 6265fd77): + [] kmalloc_trace+0x29d/0x340 + [] dm_dmub_sw_init+0xb4/0x450 [amdgpu] + [] dm_sw_init+0x15/0x2b0 [amdgpu] + [] amdgpu_device_init+0x1417/0x24e0 [amdgpu] + [] amdgpu_driver_load_kms+0x15/0x190 [amdgpu] + [] amdgpu_pci_probe+0x187/0x4e0 [amdgpu] + [] local_pci_probe+0x3e/0x90 + [] pci_device_probe+0xc3/0x230 + [] really_probe+0xe2/0x480 + [] __driver_probe_device+0x78/0x160 + [] driver_probe_device+0x1f/0x90 + [] __driver_attach+0xce/0x1c0 + [] bus_for_each_dev+0x70/0xc0 + [] bus_add_driver+0x112/0x210 + [] driver_register+0x55/0x100 + [] do_one_initcall+0x41/0x300 + +Fix this by freeing dmub_srv after destroying it. + +Fixes: 743b9786b14a ("drm/amd/display: Hook up the DMUB service in DM") +Signed-off-by: Armin Wolf +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index f5b257cb32cbd..7385efe699f88 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -2088,6 +2088,7 @@ static int dm_sw_fini(void *handle) + + if (adev->dm.dmub_srv) { + dmub_srv_destroy(adev->dm.dmub_srv); ++ kfree(adev->dm.dmub_srv); + adev->dm.dmub_srv = NULL; + } + +-- +2.43.0 + diff --git a/queue-5.15/drm-nouveau-instmem-fix-uninitialized_var.cocci-warn.patch b/queue-5.15/drm-nouveau-instmem-fix-uninitialized_var.cocci-warn.patch new file mode 100644 index 00000000000..fcdb42dc317 --- /dev/null +++ b/queue-5.15/drm-nouveau-instmem-fix-uninitialized_var.cocci-warn.patch @@ -0,0 +1,47 @@ +From 85b40f3672abf68559b33420a05133d5ac1e7e20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Feb 2022 22:23:50 +0800 +Subject: drm/nouveau/instmem: fix uninitialized_var.cocci warning + +From: Guo Zhengkui + +[ Upstream commit 2046e733e125fa58ed997f3d26d43543faf82c95 ] + +Fix following coccicheck warning: +drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c:316:11-12: +WARNING this kind of initialization is deprecated. + +`void *map = map` has the same form of +uninitialized_var() macro. I remove the redundant assignement. It has +been tested with gcc (Debian 8.3.0-6) 8.3.0. + +The patch which removed uninitialized_var() is: +https://lore.kernel.org/all/20121028102007.GA7547@gmail.com/ +And there is very few "/* GCC */" comments in the Linux kernel code now. + +Signed-off-by: Guo Zhengkui +Reviewed-by: Lyude Paul +Signed-off-by: Lyude Paul +Link: https://patchwork.freedesktop.org/patch/msgid/20220228142352.18006-1-guozhengkui@vivo.com +Stable-dep-of: 3b1ae9b71c2a ("octeontx2-af: Consider the action set by PF") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c b/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c +index 96aca0edfa3c0..c51bac76174c1 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c +@@ -313,7 +313,7 @@ nv50_instobj_dtor(struct nvkm_memory *memory) + struct nv50_instobj *iobj = nv50_instobj(memory); + struct nvkm_instmem *imem = &iobj->imem->base; + struct nvkm_vma *bar; +- void *map = map; ++ void *map; + + mutex_lock(&imem->mutex); + if (likely(iobj->lru.next)) +-- +2.43.0 + diff --git a/queue-5.15/drm-syncobj-call-drm_syncobj_fence_add_wait-when-wai.patch b/queue-5.15/drm-syncobj-call-drm_syncobj_fence_add_wait-when-wai.patch new file mode 100644 index 00000000000..83d11684bc3 --- /dev/null +++ b/queue-5.15/drm-syncobj-call-drm_syncobj_fence_add_wait-when-wai.patch @@ -0,0 +1,75 @@ +From 71de25f8f0c90cb7efc7e75d0b8128b8508464b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jan 2024 08:32:06 -0800 +Subject: drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag + is set + +From: Erik Kurzinger + +[ Upstream commit 3c43177ffb54ea5be97505eb8e2690e99ac96bc9 ] + +When waiting for a syncobj timeline point whose fence has not yet been +submitted with the WAIT_FOR_SUBMIT flag, a callback is registered using +drm_syncobj_fence_add_wait and the thread is put to sleep until the +timeout expires. If the fence is submitted before then, +drm_syncobj_add_point will wake up the sleeping thread immediately which +will proceed to wait for the fence to be signaled. + +However, if the WAIT_AVAILABLE flag is used instead, +drm_syncobj_fence_add_wait won't get called, meaning the waiting thread +will always sleep for the full timeout duration, even if the fence gets +submitted earlier. If it turns out that the fence *has* been submitted +by the time it eventually wakes up, it will still indicate to userspace +that the wait completed successfully (it won't return -ETIME), but it +will have taken much longer than it should have. + +To fix this, we must call drm_syncobj_fence_add_wait if *either* the +WAIT_FOR_SUBMIT flag or the WAIT_AVAILABLE flag is set. The only +difference being that with WAIT_FOR_SUBMIT we will also wait for the +fence to be signaled after it has been submitted while with +WAIT_AVAILABLE we will return immediately. + +IGT test patch: https://lists.freedesktop.org/archives/igt-dev/2024-January/067537.html + +v1 -> v2: adjust lockdep_assert_none_held_once condition + +(cherry picked from commit 8c44ea81634a4a337df70a32621a5f3791be23df) + +Fixes: 01d6c3578379 ("drm/syncobj: add support for timeline point wait v8") +Signed-off-by: Erik Kurzinger +Signed-off-by: Simon Ser +Reviewed-by: Daniel Vetter +Reviewed-by: Simon Ser +Link: https://patchwork.freedesktop.org/patch/msgid/20240119163208.3723457-1-ekurzinger@nvidia.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_syncobj.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c +index c26f916996352..2de679ffd88de 100644 +--- a/drivers/gpu/drm/drm_syncobj.c ++++ b/drivers/gpu/drm/drm_syncobj.c +@@ -1021,7 +1021,8 @@ static signed long drm_syncobj_array_wait_timeout(struct drm_syncobj **syncobjs, + uint64_t *points; + uint32_t signaled_count, i; + +- if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT) ++ if (flags & (DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT | ++ DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE)) + lockdep_assert_none_held_once(); + + points = kmalloc_array(count, sizeof(*points), GFP_KERNEL); +@@ -1090,7 +1091,8 @@ static signed long drm_syncobj_array_wait_timeout(struct drm_syncobj **syncobjs, + * fallthough and try a 0 timeout wait! + */ + +- if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT) { ++ if (flags & (DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT | ++ DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE)) { + for (i = 0; i < count; ++i) + drm_syncobj_fence_add_wait(syncobjs[i], &entries[i]); + } +-- +2.43.0 + diff --git a/queue-5.15/i2c-imx-add-timer-for-handling-the-stop-condition.patch b/queue-5.15/i2c-imx-add-timer-for-handling-the-stop-condition.patch new file mode 100644 index 00000000000..c890bfb9072 --- /dev/null +++ b/queue-5.15/i2c-imx-add-timer-for-handling-the-stop-condition.patch @@ -0,0 +1,224 @@ +From 2a4d6c0e48a18492d3a2755cc0ff06492feb1338 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Nov 2021 07:39:55 -0600 +Subject: i2c: imx: Add timer for handling the stop condition + +From: Corey Minyard + +[ Upstream commit f89bf95632b41695402996d96476c44c641d23d7 ] + +Most IMX I2C interfaces don't generate an interrupt on a stop condition, +so it won't generate a timely stop event on a slave mode transfer. +Some users, like IPMB, need a timely stop event to work properly. + +So, add a timer and add the proper handling to generate a stop event in +slave mode if the interface goes idle. + +Signed-off-by: Corey Minyard +Tested-by: Andrew Manley +Reviewed-by: Andrew Manley +Reviewed-by: Oleksij Rempel +Signed-off-by: Wolfram Sang +Stable-dep-of: 87aec499368d ("i2c: imx: when being a target, mark the last read as processed") +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-imx.c | 92 ++++++++++++++++++++++++++++-------- + 1 file changed, 73 insertions(+), 19 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c +index 5e8853d3f8da7..d545547c89ca7 100644 +--- a/drivers/i2c/busses/i2c-imx.c ++++ b/drivers/i2c/busses/i2c-imx.c +@@ -37,6 +37,8 @@ + #include + #include + #include ++#include ++#include + #include + #include + #include +@@ -51,6 +53,8 @@ + /* This will be the driver name the kernel reports */ + #define DRIVER_NAME "imx-i2c" + ++#define I2C_IMX_CHECK_DELAY 30000 /* Time to check for bus idle, in NS */ ++ + /* + * Enable DMA if transfer byte size is bigger than this threshold. + * As the hardware request, it must bigger than 4 bytes.\ +@@ -210,6 +214,10 @@ struct imx_i2c_struct { + struct imx_i2c_dma *dma; + struct i2c_client *slave; + enum i2c_slave_event last_slave_event; ++ ++ /* For checking slave events. */ ++ spinlock_t slave_lock; ++ struct hrtimer slave_timer; + }; + + static const struct imx_i2c_hwdata imx1_i2c_hwdata = { +@@ -680,7 +688,7 @@ static void i2c_imx_slave_event(struct imx_i2c_struct *i2c_imx, + + static void i2c_imx_slave_finish_op(struct imx_i2c_struct *i2c_imx) + { +- u8 val; ++ u8 val = 0; + + while (i2c_imx->last_slave_event != I2C_SLAVE_STOP) { + switch (i2c_imx->last_slave_event) { +@@ -701,10 +709,11 @@ static void i2c_imx_slave_finish_op(struct imx_i2c_struct *i2c_imx) + } + } + +-static irqreturn_t i2c_imx_slave_isr(struct imx_i2c_struct *i2c_imx, +- unsigned int status, unsigned int ctl) ++/* Returns true if the timer should be restarted, false if not. */ ++static irqreturn_t i2c_imx_slave_handle(struct imx_i2c_struct *i2c_imx, ++ unsigned int status, unsigned int ctl) + { +- u8 value; ++ u8 value = 0; + + if (status & I2SR_IAL) { /* Arbitration lost */ + i2c_imx_clear_irq(i2c_imx, I2SR_IAL); +@@ -712,6 +721,16 @@ static irqreturn_t i2c_imx_slave_isr(struct imx_i2c_struct *i2c_imx, + return IRQ_HANDLED; + } + ++ if (!(status & I2SR_IBB)) { ++ /* No master on the bus, that could mean a stop condition. */ ++ i2c_imx_slave_finish_op(i2c_imx); ++ return IRQ_HANDLED; ++ } ++ ++ if (!(status & I2SR_ICF)) ++ /* Data transfer still in progress, ignore this. */ ++ goto out; ++ + if (status & I2SR_IAAS) { /* Addressed as a slave */ + i2c_imx_slave_finish_op(i2c_imx); + if (status & I2SR_SRW) { /* Master wants to read from us*/ +@@ -737,16 +756,9 @@ static irqreturn_t i2c_imx_slave_isr(struct imx_i2c_struct *i2c_imx, + imx_i2c_read_reg(i2c_imx, IMX_I2C_I2DR); + } + } else if (!(ctl & I2CR_MTX)) { /* Receive mode */ +- if (status & I2SR_IBB) { /* No STOP signal detected */ +- value = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2DR); +- i2c_imx_slave_event(i2c_imx, +- I2C_SLAVE_WRITE_RECEIVED, &value); +- } else { /* STOP signal is detected */ +- dev_dbg(&i2c_imx->adapter.dev, +- "STOP signal detected"); +- i2c_imx_slave_event(i2c_imx, +- I2C_SLAVE_STOP, &value); +- } ++ value = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2DR); ++ i2c_imx_slave_event(i2c_imx, ++ I2C_SLAVE_WRITE_RECEIVED, &value); + } else if (!(status & I2SR_RXAK)) { /* Transmit mode received ACK */ + ctl |= I2CR_MTX; + imx_i2c_write_reg(ctl, i2c_imx, IMX_I2C_I2CR); +@@ -755,15 +767,43 @@ static irqreturn_t i2c_imx_slave_isr(struct imx_i2c_struct *i2c_imx, + I2C_SLAVE_READ_PROCESSED, &value); + + imx_i2c_write_reg(value, i2c_imx, IMX_I2C_I2DR); +- } else { /* Transmit mode received NAK */ ++ } else { /* Transmit mode received NAK, operation is done */ + ctl &= ~I2CR_MTX; + imx_i2c_write_reg(ctl, i2c_imx, IMX_I2C_I2CR); + imx_i2c_read_reg(i2c_imx, IMX_I2C_I2DR); ++ i2c_imx_slave_finish_op(i2c_imx); ++ return IRQ_HANDLED; + } + ++out: ++ /* ++ * No need to check the return value here. If it returns 0 or ++ * 1, then everything is fine. If it returns -1, then the ++ * timer is running in the handler. This will still work, ++ * though it may be redone (or already have been done) by the ++ * timer function. ++ */ ++ hrtimer_try_to_cancel(&i2c_imx->slave_timer); ++ hrtimer_forward_now(&i2c_imx->slave_timer, I2C_IMX_CHECK_DELAY); ++ hrtimer_restart(&i2c_imx->slave_timer); + return IRQ_HANDLED; + } + ++static enum hrtimer_restart i2c_imx_slave_timeout(struct hrtimer *t) ++{ ++ struct imx_i2c_struct *i2c_imx = container_of(t, struct imx_i2c_struct, ++ slave_timer); ++ unsigned int ctl, status; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&i2c_imx->slave_lock, flags); ++ status = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2SR); ++ ctl = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2CR); ++ i2c_imx_slave_handle(i2c_imx, status, ctl); ++ spin_unlock_irqrestore(&i2c_imx->slave_lock, flags); ++ return HRTIMER_NORESTART; ++} ++ + static void i2c_imx_slave_init(struct imx_i2c_struct *i2c_imx) + { + int temp; +@@ -843,7 +883,9 @@ static irqreturn_t i2c_imx_isr(int irq, void *dev_id) + { + struct imx_i2c_struct *i2c_imx = dev_id; + unsigned int ctl, status; ++ unsigned long flags; + ++ spin_lock_irqsave(&i2c_imx->slave_lock, flags); + status = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2SR); + ctl = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2CR); + +@@ -851,14 +893,20 @@ static irqreturn_t i2c_imx_isr(int irq, void *dev_id) + i2c_imx_clear_irq(i2c_imx, I2SR_IIF); + if (i2c_imx->slave) { + if (!(ctl & I2CR_MSTA)) { +- return i2c_imx_slave_isr(i2c_imx, status, ctl); +- } else if (i2c_imx->last_slave_event != +- I2C_SLAVE_STOP) { +- i2c_imx_slave_finish_op(i2c_imx); ++ irqreturn_t ret; ++ ++ ret = i2c_imx_slave_handle(i2c_imx, ++ status, ctl); ++ spin_unlock_irqrestore(&i2c_imx->slave_lock, ++ flags); ++ return ret; + } ++ i2c_imx_slave_finish_op(i2c_imx); + } ++ spin_unlock_irqrestore(&i2c_imx->slave_lock, flags); + return i2c_imx_master_isr(i2c_imx, status); + } ++ spin_unlock_irqrestore(&i2c_imx->slave_lock, flags); + + return IRQ_NONE; + } +@@ -1380,6 +1428,10 @@ static int i2c_imx_probe(struct platform_device *pdev) + if (!i2c_imx) + return -ENOMEM; + ++ spin_lock_init(&i2c_imx->slave_lock); ++ hrtimer_init(&i2c_imx->slave_timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS); ++ i2c_imx->slave_timer.function = i2c_imx_slave_timeout; ++ + match = device_get_match_data(&pdev->dev); + if (match) + i2c_imx->hwdata = match; +@@ -1491,6 +1543,8 @@ static int i2c_imx_remove(struct platform_device *pdev) + + ret = pm_runtime_get_sync(&pdev->dev); + ++ hrtimer_cancel(&i2c_imx->slave_timer); ++ + /* remove adapter */ + dev_dbg(&i2c_imx->adapter.dev, "adapter removed\n"); + i2c_del_adapter(&i2c_imx->adapter); +-- +2.43.0 + diff --git a/queue-5.15/i2c-imx-when-being-a-target-mark-the-last-read-as-pr.patch b/queue-5.15/i2c-imx-when-being-a-target-mark-the-last-read-as-pr.patch new file mode 100644 index 00000000000..c42d8085b38 --- /dev/null +++ b/queue-5.15/i2c-imx-when-being-a-target-mark-the-last-read-as-pr.patch @@ -0,0 +1,45 @@ +From f6760a91c5bd52a9aa9e603ae886741ca50345d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Feb 2024 20:27:13 +0100 +Subject: i2c: imx: when being a target, mark the last read as processed + +From: Corey Minyard + +[ Upstream commit 87aec499368d488c20292952d6d4be7cb9e49c5e ] + +When being a target, NAK from the controller means that all bytes have +been transferred. So, the last byte needs also to be marked as +'processed'. Otherwise index registers of backends may not increase. + +Fixes: f7414cd6923f ("i2c: imx: support slave mode for imx I2C driver") +Signed-off-by: Corey Minyard +Tested-by: Andrew Manley +Reviewed-by: Andrew Manley +Reviewed-by: Oleksij Rempel +[wsa: fixed comment and commit message to properly describe the case] +Signed-off-by: Wolfram Sang +Signed-off-by: Andi Shyti +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-imx.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c +index d545547c89ca7..fae674969628b 100644 +--- a/drivers/i2c/busses/i2c-imx.c ++++ b/drivers/i2c/busses/i2c-imx.c +@@ -771,6 +771,11 @@ static irqreturn_t i2c_imx_slave_handle(struct imx_i2c_struct *i2c_imx, + ctl &= ~I2CR_MTX; + imx_i2c_write_reg(ctl, i2c_imx, IMX_I2C_I2CR); + imx_i2c_read_reg(i2c_imx, IMX_I2C_I2DR); ++ ++ /* flag the last byte as processed */ ++ i2c_imx_slave_event(i2c_imx, ++ I2C_SLAVE_READ_PROCESSED, &value); ++ + i2c_imx_slave_finish_op(i2c_imx); + return IRQ_HANDLED; + } +-- +2.43.0 + diff --git a/queue-5.15/ib-hfi1-fix-a-memleak-in-init_credit_return.patch b/queue-5.15/ib-hfi1-fix-a-memleak-in-init_credit_return.patch new file mode 100644 index 00000000000..b3f7c570b52 --- /dev/null +++ b/queue-5.15/ib-hfi1-fix-a-memleak-in-init_credit_return.patch @@ -0,0 +1,51 @@ +From 6b2279db700cd0629d66f92bf603f4efe3c6d792 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Jan 2024 16:55:23 +0800 +Subject: IB/hfi1: Fix a memleak in init_credit_return + +From: Zhipeng Lu + +[ Upstream commit 809aa64ebff51eb170ee31a95f83b2d21efa32e2 ] + +When dma_alloc_coherent fails to allocate dd->cr_base[i].va, +init_credit_return should deallocate dd->cr_base and +dd->cr_base[i] that allocated before. Or those resources +would be never freed and a memleak is triggered. + +Fixes: 7724105686e7 ("IB/hfi1: add driver files") +Signed-off-by: Zhipeng Lu +Link: https://lore.kernel.org/r/20240112085523.3731720-1-alexious@zju.edu.cn +Acked-by: Dennis Dalessandro +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/pio.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hfi1/pio.c b/drivers/infiniband/hw/hfi1/pio.c +index 51ae58c02b15c..802b0e5801a7d 100644 +--- a/drivers/infiniband/hw/hfi1/pio.c ++++ b/drivers/infiniband/hw/hfi1/pio.c +@@ -2089,7 +2089,7 @@ int init_credit_return(struct hfi1_devdata *dd) + "Unable to allocate credit return DMA range for NUMA %d\n", + i); + ret = -ENOMEM; +- goto done; ++ goto free_cr_base; + } + } + set_dev_node(&dd->pcidev->dev, dd->node); +@@ -2097,6 +2097,10 @@ int init_credit_return(struct hfi1_devdata *dd) + ret = 0; + done: + return ret; ++ ++free_cr_base: ++ free_credit_return(dd); ++ goto done; + } + + void free_credit_return(struct hfi1_devdata *dd) +-- +2.43.0 + diff --git a/queue-5.15/ipv4-properly-combine-dev_base_seq-and-ipv4.dev_addr.patch b/queue-5.15/ipv4-properly-combine-dev_base_seq-and-ipv4.dev_addr.patch new file mode 100644 index 00000000000..03300a7b185 --- /dev/null +++ b/queue-5.15/ipv4-properly-combine-dev_base_seq-and-ipv4.dev_addr.patch @@ -0,0 +1,73 @@ +From 9b43784473250a3d5c495e11c9acae39667ef52a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Feb 2024 17:21:06 +0000 +Subject: ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid + +From: Eric Dumazet + +[ Upstream commit 081a0e3b0d4c061419d3f4679dec9f68725b17e4 ] + +net->dev_base_seq and ipv4.dev_addr_genid are monotonically increasing. + +If we XOR their values, we could miss to detect if both values +were changed with the same amount. + +Fixes: 0465277f6b3f ("ipv4: provide addr and netconf dump consistency info") +Signed-off-by: Eric Dumazet +Cc: Nicolas Dichtel +Acked-by: Nicolas Dichtel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/devinet.c | 21 +++++++++++++++++---- + 1 file changed, 17 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c +index c511751c2f41a..425dfa8e4fd0a 100644 +--- a/net/ipv4/devinet.c ++++ b/net/ipv4/devinet.c +@@ -1797,6 +1797,21 @@ static int in_dev_dump_addr(struct in_device *in_dev, struct sk_buff *skb, + return err; + } + ++/* Combine dev_addr_genid and dev_base_seq to detect changes. ++ */ ++static u32 inet_base_seq(const struct net *net) ++{ ++ u32 res = atomic_read(&net->ipv4.dev_addr_genid) + ++ net->dev_base_seq; ++ ++ /* Must not return 0 (see nl_dump_check_consistent()). ++ * Chose a value far away from 0. ++ */ ++ if (!res) ++ res = 0x80000000; ++ return res; ++} ++ + static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb) + { + const struct nlmsghdr *nlh = cb->nlh; +@@ -1848,8 +1863,7 @@ static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb) + idx = 0; + head = &tgt_net->dev_index_head[h]; + rcu_read_lock(); +- cb->seq = atomic_read(&tgt_net->ipv4.dev_addr_genid) ^ +- tgt_net->dev_base_seq; ++ cb->seq = inet_base_seq(tgt_net); + hlist_for_each_entry_rcu(dev, head, index_hlist) { + if (idx < s_idx) + goto cont; +@@ -2250,8 +2264,7 @@ static int inet_netconf_dump_devconf(struct sk_buff *skb, + idx = 0; + head = &net->dev_index_head[h]; + rcu_read_lock(); +- cb->seq = atomic_read(&net->ipv4.dev_addr_genid) ^ +- net->dev_base_seq; ++ cb->seq = inet_base_seq(net); + hlist_for_each_entry_rcu(dev, head, index_hlist) { + if (idx < s_idx) + goto cont; +-- +2.43.0 + diff --git a/queue-5.15/ipv6-properly-combine-dev_base_seq-and-ipv6.dev_addr.patch b/queue-5.15/ipv6-properly-combine-dev_base_seq-and-ipv6.dev_addr.patch new file mode 100644 index 00000000000..56c9a417b05 --- /dev/null +++ b/queue-5.15/ipv6-properly-combine-dev_base_seq-and-ipv6.dev_addr.patch @@ -0,0 +1,75 @@ +From 2c4ee6e084284b36841e55316c1ffe89d4454812 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Feb 2024 17:21:07 +0000 +Subject: ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid + +From: Eric Dumazet + +[ Upstream commit e898e4cd1aab271ca414f9ac6e08e4c761f6913c ] + +net->dev_base_seq and ipv6.dev_addr_genid are monotonically increasing. + +If we XOR their values, we could miss to detect if both values +were changed with the same amount. + +Fixes: 63998ac24f83 ("ipv6: provide addr and netconf dump consistency info") +Signed-off-by: Eric Dumazet +Cc: Nicolas Dichtel + +Signed-off-by: Eric Dumazet +Acked-by: Nicolas Dichtel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv6/addrconf.c | 21 ++++++++++++++++++--- + 1 file changed, 18 insertions(+), 3 deletions(-) + +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index 1e4eedf7f2129..c52317184e3e2 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -707,6 +707,22 @@ static int inet6_netconf_get_devconf(struct sk_buff *in_skb, + return err; + } + ++/* Combine dev_addr_genid and dev_base_seq to detect changes. ++ */ ++static u32 inet6_base_seq(const struct net *net) ++{ ++ u32 res = atomic_read(&net->ipv6.dev_addr_genid) + ++ net->dev_base_seq; ++ ++ /* Must not return 0 (see nl_dump_check_consistent()). ++ * Chose a value far away from 0. ++ */ ++ if (!res) ++ res = 0x80000000; ++ return res; ++} ++ ++ + static int inet6_netconf_dump_devconf(struct sk_buff *skb, + struct netlink_callback *cb) + { +@@ -740,8 +756,7 @@ static int inet6_netconf_dump_devconf(struct sk_buff *skb, + idx = 0; + head = &net->dev_index_head[h]; + rcu_read_lock(); +- cb->seq = atomic_read(&net->ipv6.dev_addr_genid) ^ +- net->dev_base_seq; ++ cb->seq = inet6_base_seq(net); + hlist_for_each_entry_rcu(dev, head, index_hlist) { + if (idx < s_idx) + goto cont; +@@ -5316,7 +5331,7 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb, + } + + rcu_read_lock(); +- cb->seq = atomic_read(&tgt_net->ipv6.dev_addr_genid) ^ tgt_net->dev_base_seq; ++ cb->seq = inet6_base_seq(tgt_net); + for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) { + idx = 0; + head = &tgt_net->dev_index_head[h]; +-- +2.43.0 + diff --git a/queue-5.15/ipv6-sr-fix-possible-use-after-free-and-null-ptr-der.patch b/queue-5.15/ipv6-sr-fix-possible-use-after-free-and-null-ptr-der.patch new file mode 100644 index 00000000000..dbe3fb61225 --- /dev/null +++ b/queue-5.15/ipv6-sr-fix-possible-use-after-free-and-null-ptr-der.patch @@ -0,0 +1,74 @@ +From 520373b27ce0f958d523bc0f45a0bf1a7ccaca72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Feb 2024 23:27:17 +0300 +Subject: ipv6: sr: fix possible use-after-free and null-ptr-deref + +From: Vasiliy Kovalev + +[ Upstream commit 5559cea2d5aa3018a5f00dd2aca3427ba09b386b ] + +The pernet operations structure for the subsystem must be registered +before registering the generic netlink family. + +Fixes: 915d7e5e5930 ("ipv6: sr: add code base for control plane support of SR-IPv6") +Signed-off-by: Vasiliy Kovalev +Link: https://lore.kernel.org/r/20240215202717.29815-1-kovalev@altlinux.org +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv6/seg6.c | 20 +++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c +index 0c7c6fc16c3c3..dc434e4ee6d66 100644 +--- a/net/ipv6/seg6.c ++++ b/net/ipv6/seg6.c +@@ -507,22 +507,24 @@ int __init seg6_init(void) + { + int err; + +- err = genl_register_family(&seg6_genl_family); ++ err = register_pernet_subsys(&ip6_segments_ops); + if (err) + goto out; + +- err = register_pernet_subsys(&ip6_segments_ops); ++ err = genl_register_family(&seg6_genl_family); + if (err) +- goto out_unregister_genl; ++ goto out_unregister_pernet; + + #ifdef CONFIG_IPV6_SEG6_LWTUNNEL + err = seg6_iptunnel_init(); + if (err) +- goto out_unregister_pernet; ++ goto out_unregister_genl; + + err = seg6_local_init(); +- if (err) +- goto out_unregister_pernet; ++ if (err) { ++ seg6_iptunnel_exit(); ++ goto out_unregister_genl; ++ } + #endif + + #ifdef CONFIG_IPV6_SEG6_HMAC +@@ -543,11 +545,11 @@ int __init seg6_init(void) + #endif + #endif + #ifdef CONFIG_IPV6_SEG6_LWTUNNEL +-out_unregister_pernet: +- unregister_pernet_subsys(&ip6_segments_ops); +-#endif + out_unregister_genl: + genl_unregister_family(&seg6_genl_family); ++#endif ++out_unregister_pernet: ++ unregister_pernet_subsys(&ip6_segments_ops); + goto out; + } + +-- +2.43.0 + diff --git a/queue-5.15/net-dev-convert-sa_data-to-flexible-array-in-struct-.patch b/queue-5.15/net-dev-convert-sa_data-to-flexible-array-in-struct-.patch new file mode 100644 index 00000000000..c1f31d3e800 --- /dev/null +++ b/queue-5.15/net-dev-convert-sa_data-to-flexible-array-in-struct-.patch @@ -0,0 +1,135 @@ +From 522c16b0ff6653facfea0721e388488fea2ee657 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 02:56:03 -0700 +Subject: net: dev: Convert sa_data to flexible array in struct sockaddr + +From: Kees Cook + +[ Upstream commit b5f0de6df6dce8d641ef58ef7012f3304dffb9a1 ] + +One of the worst offenders of "fake flexible arrays" is struct sockaddr, +as it is the classic example of why GCC and Clang have been traditionally +forced to treat all trailing arrays as fake flexible arrays: in the +distant misty past, sa_data became too small, and code started just +treating it as a flexible array, even though it was fixed-size. The +special case by the compiler is specifically that sizeof(sa->sa_data) +and FORTIFY_SOURCE (which uses __builtin_object_size(sa->sa_data, 1)) +do not agree (14 and -1 respectively), which makes FORTIFY_SOURCE treat +it as a flexible array. + +However, the coming -fstrict-flex-arrays compiler flag will remove +these special cases so that FORTIFY_SOURCE can gain coverage over all +the trailing arrays in the kernel that are _not_ supposed to be treated +as a flexible array. To deal with this change, convert sa_data to a true +flexible array. To keep the structure size the same, move sa_data into +a union with a newly introduced sa_data_min with the original size. The +result is that FORTIFY_SOURCE can continue to have no idea how large +sa_data may actually be, but anything using sizeof(sa->sa_data) must +switch to sizeof(sa->sa_data_min). + +Cc: Jens Axboe +Cc: Pavel Begunkov +Cc: David Ahern +Cc: Dylan Yudaken +Cc: Yajun Deng +Cc: Petr Machata +Cc: Hangbin Liu +Cc: Leon Romanovsky +Cc: syzbot +Cc: Willem de Bruijn +Cc: Pablo Neira Ayuso +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20221018095503.never.671-kees@kernel.org +Signed-off-by: Jakub Kicinski +Stable-dep-of: a7d6027790ac ("arp: Prevent overflow in arp_req_get().") +Signed-off-by: Sasha Levin +--- + include/linux/socket.h | 5 ++++- + net/core/dev.c | 2 +- + net/core/dev_ioctl.c | 2 +- + net/packet/af_packet.c | 10 +++++----- + 4 files changed, 11 insertions(+), 8 deletions(-) + +diff --git a/include/linux/socket.h b/include/linux/socket.h +index 041d6032a3489..4c5ce8124f8e7 100644 +--- a/include/linux/socket.h ++++ b/include/linux/socket.h +@@ -31,7 +31,10 @@ typedef __kernel_sa_family_t sa_family_t; + + struct sockaddr { + sa_family_t sa_family; /* address family, AF_xxx */ +- char sa_data[14]; /* 14 bytes of protocol address */ ++ union { ++ char sa_data_min[14]; /* Minimum 14 bytes of protocol address */ ++ DECLARE_FLEX_ARRAY(char, sa_data); ++ }; + }; + + struct linger { +diff --git a/net/core/dev.c b/net/core/dev.c +index 8501645ff67dd..af77dc77eb9c8 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -9090,7 +9090,7 @@ EXPORT_SYMBOL(dev_set_mac_address_user); + + int dev_get_mac_address(struct sockaddr *sa, struct net *net, char *dev_name) + { +- size_t size = sizeof(sa->sa_data); ++ size_t size = sizeof(sa->sa_data_min); + struct net_device *dev; + int ret = 0; + +diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c +index 0e87237fd8712..6ddfd7bfc5127 100644 +--- a/net/core/dev_ioctl.c ++++ b/net/core/dev_ioctl.c +@@ -339,7 +339,7 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, void __user *data, + if (ifr->ifr_hwaddr.sa_family != dev->type) + return -EINVAL; + memcpy(dev->broadcast, ifr->ifr_hwaddr.sa_data, +- min(sizeof(ifr->ifr_hwaddr.sa_data), ++ min(sizeof(ifr->ifr_hwaddr.sa_data_min), + (size_t)dev->addr_len)); + call_netdevice_notifiers(NETDEV_CHANGEADDR, dev); + return 0; +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index d62f79cf873dd..75fb80717e489 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -3252,7 +3252,7 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, + int addr_len) + { + struct sock *sk = sock->sk; +- char name[sizeof(uaddr->sa_data) + 1]; ++ char name[sizeof(uaddr->sa_data_min) + 1]; + + /* + * Check legality +@@ -3263,8 +3263,8 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, + /* uaddr->sa_data comes from the userspace, it's not guaranteed to be + * zero-terminated. + */ +- memcpy(name, uaddr->sa_data, sizeof(uaddr->sa_data)); +- name[sizeof(uaddr->sa_data)] = 0; ++ memcpy(name, uaddr->sa_data, sizeof(uaddr->sa_data_min)); ++ name[sizeof(uaddr->sa_data_min)] = 0; + + return packet_do_bind(sk, name, 0, 0); + } +@@ -3536,11 +3536,11 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr, + return -EOPNOTSUPP; + + uaddr->sa_family = AF_PACKET; +- memset(uaddr->sa_data, 0, sizeof(uaddr->sa_data)); ++ memset(uaddr->sa_data, 0, sizeof(uaddr->sa_data_min)); + rcu_read_lock(); + dev = dev_get_by_index_rcu(sock_net(sk), READ_ONCE(pkt_sk(sk)->ifindex)); + if (dev) +- strscpy(uaddr->sa_data, dev->name, sizeof(uaddr->sa_data)); ++ strscpy(uaddr->sa_data, dev->name, sizeof(uaddr->sa_data_min)); + rcu_read_unlock(); + + return sizeof(*uaddr); +-- +2.43.0 + diff --git a/queue-5.15/net-stmmac-fix-incorrect-dereference-in-interrupt-ha.patch b/queue-5.15/net-stmmac-fix-incorrect-dereference-in-interrupt-ha.patch new file mode 100644 index 00000000000..e94a4e9212a --- /dev/null +++ b/queue-5.15/net-stmmac-fix-incorrect-dereference-in-interrupt-ha.patch @@ -0,0 +1,84 @@ +From 3d99e3ded0da45115616811fbe6431e8c6486042 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 12:27:17 +0300 +Subject: net: stmmac: Fix incorrect dereference in interrupt handlers + +From: Pavel Sakharov + +[ Upstream commit 97dde84026339e4b4af9a6301f825d1828d7874b ] + +If 'dev' or 'data' is NULL, the 'priv' variable has an incorrect address +when dereferencing calling netdev_err(). + +Since we get as 'dev_id' or 'data' what was passed as the 'dev' argument +to request_irq() during interrupt initialization (that is, the net_device +and rx/tx queue pointers initialized at the time of the call) and since +there are usually no checks for the 'dev_id' argument in such handlers +in other drivers, remove these checks from the handlers in stmmac driver. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 8532f613bc78 ("net: stmmac: introduce MSI Interrupt routines for mac, safety, RX & TX") +Signed-off-by: Pavel Sakharov +Reviewed-by: Serge Semin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/stmicro/stmmac/stmmac_main.c | 20 ------------------- + 1 file changed, 20 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index ab3ded6e0e6a3..a1c1e353ca072 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -5737,11 +5737,6 @@ static irqreturn_t stmmac_mac_interrupt(int irq, void *dev_id) + struct net_device *dev = (struct net_device *)dev_id; + struct stmmac_priv *priv = netdev_priv(dev); + +- if (unlikely(!dev)) { +- netdev_err(priv->dev, "%s: invalid dev pointer\n", __func__); +- return IRQ_NONE; +- } +- + /* Check if adapter is up */ + if (test_bit(STMMAC_DOWN, &priv->state)) + return IRQ_HANDLED; +@@ -5757,11 +5752,6 @@ static irqreturn_t stmmac_safety_interrupt(int irq, void *dev_id) + struct net_device *dev = (struct net_device *)dev_id; + struct stmmac_priv *priv = netdev_priv(dev); + +- if (unlikely(!dev)) { +- netdev_err(priv->dev, "%s: invalid dev pointer\n", __func__); +- return IRQ_NONE; +- } +- + /* Check if adapter is up */ + if (test_bit(STMMAC_DOWN, &priv->state)) + return IRQ_HANDLED; +@@ -5781,11 +5771,6 @@ static irqreturn_t stmmac_msi_intr_tx(int irq, void *data) + + priv = container_of(tx_q, struct stmmac_priv, tx_queue[chan]); + +- if (unlikely(!data)) { +- netdev_err(priv->dev, "%s: invalid dev pointer\n", __func__); +- return IRQ_NONE; +- } +- + /* Check if adapter is up */ + if (test_bit(STMMAC_DOWN, &priv->state)) + return IRQ_HANDLED; +@@ -5824,11 +5809,6 @@ static irqreturn_t stmmac_msi_intr_rx(int irq, void *data) + + priv = container_of(rx_q, struct stmmac_priv, rx_queue[chan]); + +- if (unlikely(!data)) { +- netdev_err(priv->dev, "%s: invalid dev pointer\n", __func__); +- return IRQ_NONE; +- } +- + /* Check if adapter is up */ + if (test_bit(STMMAC_DOWN, &priv->state)) + return IRQ_HANDLED; +-- +2.43.0 + diff --git a/queue-5.15/netfilter-flowtable-simplify-route-logic.patch b/queue-5.15/netfilter-flowtable-simplify-route-logic.patch new file mode 100644 index 00000000000..1ab711d70f1 --- /dev/null +++ b/queue-5.15/netfilter-flowtable-simplify-route-logic.patch @@ -0,0 +1,128 @@ +From 1e5703215418dea2931f1e812fb2314d5502873b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 May 2023 07:35:33 +0200 +Subject: netfilter: flowtable: simplify route logic + +From: Pablo Neira Ayuso + +[ Upstream commit fa502c86566680ac62bc28ec883a069bf7a2aa5e ] + +Grab reference to dst from skbuff earlier to simplify route caching. + +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Florian Westphal +Stable-dep-of: 9e0f0430389b ("netfilter: nft_flow_offload: reset dst in route object after setting up flow") +Signed-off-by: Sasha Levin +--- + include/net/netfilter/nf_flow_table.h | 4 ++-- + net/netfilter/nf_flow_table_core.c | 24 +++--------------------- + net/netfilter/nft_flow_offload.c | 12 ++++++++---- + 3 files changed, 13 insertions(+), 27 deletions(-) + +diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h +index aaa518e777e9e..7677aacf72002 100644 +--- a/include/net/netfilter/nf_flow_table.h ++++ b/include/net/netfilter/nf_flow_table.h +@@ -257,8 +257,8 @@ nf_flow_table_offload_del_cb(struct nf_flowtable *flow_table, + up_write(&flow_table->flow_block_lock); + } + +-int flow_offload_route_init(struct flow_offload *flow, +- const struct nf_flow_route *route); ++void flow_offload_route_init(struct flow_offload *flow, ++ const struct nf_flow_route *route); + + int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow); + void flow_offload_refresh(struct nf_flowtable *flow_table, +diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c +index 4f61eb1282834..4e0a2d47f6a6b 100644 +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -124,9 +124,6 @@ static int flow_offload_fill_route(struct flow_offload *flow, + break; + case FLOW_OFFLOAD_XMIT_XFRM: + case FLOW_OFFLOAD_XMIT_NEIGH: +- if (!dst_hold_safe(route->tuple[dir].dst)) +- return -1; +- + flow_tuple->dst_cache = dst; + flow_tuple->dst_cookie = flow_offload_dst_cookie(flow_tuple); + break; +@@ -147,27 +144,12 @@ static void nft_flow_dst_release(struct flow_offload *flow, + dst_release(flow->tuplehash[dir].tuple.dst_cache); + } + +-int flow_offload_route_init(struct flow_offload *flow, ++void flow_offload_route_init(struct flow_offload *flow, + const struct nf_flow_route *route) + { +- int err; +- +- err = flow_offload_fill_route(flow, route, FLOW_OFFLOAD_DIR_ORIGINAL); +- if (err < 0) +- return err; +- +- err = flow_offload_fill_route(flow, route, FLOW_OFFLOAD_DIR_REPLY); +- if (err < 0) +- goto err_route_reply; +- ++ flow_offload_fill_route(flow, route, FLOW_OFFLOAD_DIR_ORIGINAL); ++ flow_offload_fill_route(flow, route, FLOW_OFFLOAD_DIR_REPLY); + flow->type = NF_FLOW_OFFLOAD_ROUTE; +- +- return 0; +- +-err_route_reply: +- nft_flow_dst_release(flow, FLOW_OFFLOAD_DIR_ORIGINAL); +- +- return err; + } + EXPORT_SYMBOL_GPL(flow_offload_route_init); + +diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c +index f8346497c9b49..fbb9f3a6c8444 100644 +--- a/net/netfilter/nft_flow_offload.c ++++ b/net/netfilter/nft_flow_offload.c +@@ -240,9 +240,14 @@ static int nft_flow_route(const struct nft_pktinfo *pkt, + break; + } + ++ if (!dst_hold_safe(this_dst)) ++ return -ENOENT; ++ + nf_route(nft_net(pkt), &other_dst, &fl, false, nft_pf(pkt)); +- if (!other_dst) ++ if (!other_dst) { ++ dst_release(this_dst); + return -ENOENT; ++ } + + nft_default_forward_path(route, this_dst, dir); + nft_default_forward_path(route, other_dst, !dir); +@@ -326,8 +331,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, + if (!flow) + goto err_flow_alloc; + +- if (flow_offload_route_init(flow, &route) < 0) +- goto err_flow_add; ++ flow_offload_route_init(flow, &route); + + if (tcph) { + ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL; +@@ -338,12 +342,12 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, + if (ret < 0) + goto err_flow_add; + +- dst_release(route.tuple[!dir].dst); + return; + + err_flow_add: + flow_offload_free(flow); + err_flow_alloc: ++ dst_release(route.tuple[dir].dst); + dst_release(route.tuple[!dir].dst); + err_flow_route: + clear_bit(IPS_OFFLOAD_BIT, &ct->status); +-- +2.43.0 + diff --git a/queue-5.15/netfilter-nf_tables-set-dormant-flag-on-hook-registe.patch b/queue-5.15/netfilter-nf_tables-set-dormant-flag-on-hook-registe.patch new file mode 100644 index 00000000000..03e4f313ffb --- /dev/null +++ b/queue-5.15/netfilter-nf_tables-set-dormant-flag-on-hook-registe.patch @@ -0,0 +1,42 @@ +From 871e966209eb6c86caf5213ef4b7e9da43336dbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Feb 2024 16:58:04 +0100 +Subject: netfilter: nf_tables: set dormant flag on hook register failure + +From: Florian Westphal + +[ Upstream commit bccebf64701735533c8db37773eeacc6566cc8ec ] + +We need to set the dormant flag again if we fail to register +the hooks. + +During memory pressure hook registration can fail and we end up +with a table marked as active but no registered hooks. + +On table/base chain deletion, nf_tables will attempt to unregister +the hook again which yields a warn splat from the nftables core. + +Reported-and-tested-by: syzbot+de4025c006ec68ac56fc@syzkaller.appspotmail.com +Fixes: 179d9ba5559a ("netfilter: nf_tables: fix table flag updates") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 361fbbd430ad8..1a7bfd4be61d5 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -1193,6 +1193,7 @@ static int nf_tables_updtable(struct nft_ctx *ctx) + return 0; + + err_register_hooks: ++ ctx->table->flags |= NFT_TABLE_F_DORMANT; + nft_trans_destroy(trans); + return ret; + } +-- +2.43.0 + diff --git a/queue-5.15/netfilter-nft_flow_offload-release-dst-in-case-direc.patch b/queue-5.15/netfilter-nft_flow_offload-release-dst-in-case-direc.patch new file mode 100644 index 00000000000..c46d90fd740 --- /dev/null +++ b/queue-5.15/netfilter-nft_flow_offload-release-dst-in-case-direc.patch @@ -0,0 +1,61 @@ +From 417f004a0de084d38656bb944dcf973ce173d96a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Feb 2024 21:36:39 +0100 +Subject: netfilter: nft_flow_offload: release dst in case direct xmit path is + used + +From: Pablo Neira Ayuso + +[ Upstream commit 8762785f459be1cfe6fcf7285c123aad6a3703f0 ] + +Direct xmit does not use it since it calls dev_queue_xmit() to send +packets, hence it calls dst_release(). + +kmemleak reports: + +unreferenced object 0xffff88814f440900 (size 184): + comm "softirq", pid 0, jiffies 4294951896 + hex dump (first 32 bytes): + 00 60 5b 04 81 88 ff ff 00 e6 e8 82 ff ff ff ff .`[............. + 21 0b 50 82 ff ff ff ff 00 00 00 00 00 00 00 00 !.P............. + backtrace (crc cb2bf5d6): + [<000000003ee17107>] kmem_cache_alloc+0x286/0x340 + [<0000000021a5de2c>] dst_alloc+0x43/0xb0 + [<00000000f0671159>] rt_dst_alloc+0x2e/0x190 + [<00000000fe5092c9>] __mkroute_output+0x244/0x980 + [<000000005fb96fb0>] ip_route_output_flow+0xc0/0x160 + [<0000000045367433>] nf_ip_route+0xf/0x30 + [<0000000085da1d8e>] nf_route+0x2d/0x60 + [<00000000d1ecd1cb>] nft_flow_route+0x171/0x6a0 [nft_flow_offload] + [<00000000d9b2fb60>] nft_flow_offload_eval+0x4e8/0x700 [nft_flow_offload] + [<000000009f447dbb>] expr_call_ops_eval+0x53/0x330 [nf_tables] + [<00000000072e1be6>] nft_do_chain+0x17c/0x840 [nf_tables] + [<00000000d0551029>] nft_do_chain_inet+0xa1/0x210 [nf_tables] + [<0000000097c9d5c6>] nf_hook_slow+0x5b/0x160 + [<0000000005eccab1>] ip_forward+0x8b6/0x9b0 + [<00000000553a269b>] ip_rcv+0x221/0x230 + [<00000000412872e5>] __netif_receive_skb_one_core+0xfe/0x110 + +Fixes: fa502c865666 ("netfilter: flowtable: simplify route logic") +Reported-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_flow_table_core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c +index a213a7cb80435..e78cdd73ef628 100644 +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -131,6 +131,7 @@ static int flow_offload_fill_route(struct flow_offload *flow, + ETH_ALEN); + flow_tuple->out.ifidx = route->tuple[dir].out.ifindex; + flow_tuple->out.hw_ifidx = route->tuple[dir].out.hw_ifindex; ++ dst_release(dst); + break; + case FLOW_OFFLOAD_XMIT_XFRM: + case FLOW_OFFLOAD_XMIT_NEIGH: +-- +2.43.0 + diff --git a/queue-5.15/netfilter-nft_flow_offload-reset-dst-in-route-object.patch b/queue-5.15/netfilter-nft_flow_offload-reset-dst-in-route-object.patch new file mode 100644 index 00000000000..37f76718463 --- /dev/null +++ b/queue-5.15/netfilter-nft_flow_offload-reset-dst-in-route-object.patch @@ -0,0 +1,76 @@ +From 67192824e8b46b1cf78a458c16c895eff9bff797 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Feb 2024 12:32:58 +0100 +Subject: netfilter: nft_flow_offload: reset dst in route object after setting + up flow + +From: Pablo Neira Ayuso + +[ Upstream commit 9e0f0430389be7696396c62f037be4bf72cf93e3 ] + +dst is transferred to the flow object, route object does not own it +anymore. Reset dst in route object, otherwise if flow_offload_add() +fails, error path releases dst twice, leading to a refcount underflow. + +Fixes: a3c90f7a2323 ("netfilter: nf_tables: flow offload expression") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/net/netfilter/nf_flow_table.h | 2 +- + net/netfilter/nf_flow_table_core.c | 16 +++++++++++++--- + 2 files changed, 14 insertions(+), 4 deletions(-) + +diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h +index 7677aacf72002..dabd84fa3fd36 100644 +--- a/include/net/netfilter/nf_flow_table.h ++++ b/include/net/netfilter/nf_flow_table.h +@@ -258,7 +258,7 @@ nf_flow_table_offload_del_cb(struct nf_flowtable *flow_table, + } + + void flow_offload_route_init(struct flow_offload *flow, +- const struct nf_flow_route *route); ++ struct nf_flow_route *route); + + int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow); + void flow_offload_refresh(struct nf_flowtable *flow_table, +diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c +index 4e0a2d47f6a6b..a213a7cb80435 100644 +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -86,12 +86,22 @@ static u32 flow_offload_dst_cookie(struct flow_offload_tuple *flow_tuple) + return 0; + } + ++static struct dst_entry *nft_route_dst_fetch(struct nf_flow_route *route, ++ enum flow_offload_tuple_dir dir) ++{ ++ struct dst_entry *dst = route->tuple[dir].dst; ++ ++ route->tuple[dir].dst = NULL; ++ ++ return dst; ++} ++ + static int flow_offload_fill_route(struct flow_offload *flow, +- const struct nf_flow_route *route, ++ struct nf_flow_route *route, + enum flow_offload_tuple_dir dir) + { + struct flow_offload_tuple *flow_tuple = &flow->tuplehash[dir].tuple; +- struct dst_entry *dst = route->tuple[dir].dst; ++ struct dst_entry *dst = nft_route_dst_fetch(route, dir); + int i, j = 0; + + switch (flow_tuple->l3proto) { +@@ -145,7 +155,7 @@ static void nft_flow_dst_release(struct flow_offload *flow, + } + + void flow_offload_route_init(struct flow_offload *flow, +- const struct nf_flow_route *route) ++ struct nf_flow_route *route) + { + flow_offload_fill_route(flow, route, FLOW_OFFLOAD_DIR_ORIGINAL); + flow_offload_fill_route(flow, route, FLOW_OFFLOAD_DIR_REPLY); +-- +2.43.0 + diff --git a/queue-5.15/nouveau-fix-function-cast-warnings.patch b/queue-5.15/nouveau-fix-function-cast-warnings.patch new file mode 100644 index 00000000000..cf19cceeed2 --- /dev/null +++ b/queue-5.15/nouveau-fix-function-cast-warnings.patch @@ -0,0 +1,54 @@ +From 265eeaa25aaac5d97dff1cf3bd71c120dae1ecc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 10:57:37 +0100 +Subject: nouveau: fix function cast warnings + +From: Arnd Bergmann + +[ Upstream commit 0affdba22aca5573f9d989bcb1d71d32a6a03efe ] + +clang-16 warns about casting between incompatible function types: + +drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c:161:10: error: cast from 'void (*)(const struct firmware *)' to 'void (*)(void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict] + 161 | .fini = (void(*)(void *))release_firmware, + +This one was done to use the generic shadow_fw_release() function as a +callback for struct nvbios_source. Change it to use the same prototype +as the other five instances, with a trivial helper function that actually +calls release_firmware. + +Fixes: 70c0f263cc2e ("drm/nouveau/bios: pull in basic vbios subdev, more to come later") +Signed-off-by: Arnd Bergmann +Signed-off-by: Danilo Krummrich +Link: https://patchwork.freedesktop.org/patch/msgid/20240213095753.455062-1-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c +index 4b571cc6bc70f..6597def18627e 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c +@@ -154,11 +154,17 @@ shadow_fw_init(struct nvkm_bios *bios, const char *name) + return (void *)fw; + } + ++static void ++shadow_fw_release(void *fw) ++{ ++ release_firmware(fw); ++} ++ + static const struct nvbios_source + shadow_fw = { + .name = "firmware", + .init = shadow_fw_init, +- .fini = (void(*)(void *))release_firmware, ++ .fini = shadow_fw_release, + .read = shadow_fw_read, + .rw = false, + }; +-- +2.43.0 + diff --git a/queue-5.15/octeontx2-af-consider-the-action-set-by-pf.patch b/queue-5.15/octeontx2-af-consider-the-action-set-by-pf.patch new file mode 100644 index 00000000000..f1c24fca85e --- /dev/null +++ b/queue-5.15/octeontx2-af-consider-the-action-set-by-pf.patch @@ -0,0 +1,46 @@ +From 027493cf3e94c8af22e6606f81ce6e747d8fcd70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Feb 2024 18:25:14 +0530 +Subject: octeontx2-af: Consider the action set by PF + +From: Subbaraya Sundeep + +[ Upstream commit 3b1ae9b71c2a97f848b00fb085a2bd29bddbe8d9 ] + +AF reserves MCAM entries for each PF, VF present in the +system and populates the entry with DMAC and action with +default RSS so that basic packet I/O works. Since PF/VF is +not aware of the RSS action installed by AF, AF only fixup +the actions of the rules installed by PF/VF with corresponding +default RSS action. This worked well for rules installed by +PF/VF for features like RX VLAN offload and DMAC filters but +rules involving action like drop/forward to queue are also +getting modified by AF. Hence fix it by setting the default +RSS action only if requested by PF/VF. + +Fixes: 967db3529eca ("octeontx2-af: add support for multicast/promisc packet replication feature") +Signed-off-by: Subbaraya Sundeep +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +index 70b4f2a3b02fd..604aaa9b960e9 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +@@ -436,6 +436,10 @@ static void npc_fixup_vf_rule(struct rvu *rvu, struct npc_mcam *mcam, + return; + } + ++ /* AF modifies given action iff PF/VF has requested for it */ ++ if ((entry->action & 0xFULL) != NIX_RX_ACTION_DEFAULT) ++ return; ++ + /* copy VF default entry action to the VF mcam entry */ + rx_action = npc_get_default_entry_action(rvu, mcam, blkaddr, + target_func); +-- +2.43.0 + diff --git a/queue-5.15/packet-move-from-strlcpy-with-unused-retval-to-strsc.patch b/queue-5.15/packet-move-from-strlcpy-with-unused-retval-to-strsc.patch new file mode 100644 index 00000000000..3ec89885b0e --- /dev/null +++ b/queue-5.15/packet-move-from-strlcpy-with-unused-retval-to-strsc.patch @@ -0,0 +1,48 @@ +From 305c99afdc8d67f9b923794f52a47fb187e92466 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Aug 2022 23:02:27 +0200 +Subject: packet: move from strlcpy with unused retval to strscpy + +From: Wolfram Sang + +[ Upstream commit 8fc9d51ea2d32a05f7d7cf86a25cc86ecc57eb45 ] + +Follow the advice of the below link and prefer 'strscpy' in this +subsystem. Conversion is 1:1 because the return value is not used. +Generated by a coccinelle script. + +Link: https://lore.kernel.org/r/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmknw@mail.gmail.com/ +Signed-off-by: Wolfram Sang +Link: https://lore.kernel.org/r/20220818210227.8611-1-wsa+renesas@sang-engineering.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: a7d6027790ac ("arp: Prevent overflow in arp_req_get().") +Signed-off-by: Sasha Levin +--- + net/packet/af_packet.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index e7b54f7214110..d62f79cf873dd 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -1874,7 +1874,7 @@ static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev, + */ + + spkt->spkt_family = dev->type; +- strlcpy(spkt->spkt_device, dev->name, sizeof(spkt->spkt_device)); ++ strscpy(spkt->spkt_device, dev->name, sizeof(spkt->spkt_device)); + spkt->spkt_protocol = skb->protocol; + + /* +@@ -3540,7 +3540,7 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr, + rcu_read_lock(); + dev = dev_get_by_index_rcu(sock_net(sk), READ_ONCE(pkt_sk(sk)->ifindex)); + if (dev) +- strlcpy(uaddr->sa_data, dev->name, sizeof(uaddr->sa_data)); ++ strscpy(uaddr->sa_data, dev->name, sizeof(uaddr->sa_data)); + rcu_read_unlock(); + + return sizeof(*uaddr); +-- +2.43.0 + diff --git a/queue-5.15/rdma-bnxt_re-return-error-for-srq-resize.patch b/queue-5.15/rdma-bnxt_re-return-error-for-srq-resize.patch new file mode 100644 index 00000000000..a8426531136 --- /dev/null +++ b/queue-5.15/rdma-bnxt_re-return-error-for-srq-resize.patch @@ -0,0 +1,53 @@ +From ae44bc0d91ed0ba008b57cd5ae0d03321de97991 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jan 2024 20:54:36 -0800 +Subject: RDMA/bnxt_re: Return error for SRQ resize + +From: Kalesh AP + +[ Upstream commit 3687b450c5f32e80f179ce4b09e0454da1449eac ] + +SRQ resize is not supported in the driver. But driver is not +returning error from bnxt_re_modify_srq() for SRQ resize. + +Fixes: 37cb11acf1f7 ("RDMA/bnxt_re: Add SRQ support for Broadcom adapters") +Signed-off-by: Kalesh AP +Signed-off-by: Selvin Xavier +Link: https://lore.kernel.org/r/1705985677-15551-5-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +index 87ee616e69384..91b71fa3c1216 100644 +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +@@ -1705,7 +1705,7 @@ int bnxt_re_modify_srq(struct ib_srq *ib_srq, struct ib_srq_attr *srq_attr, + switch (srq_attr_mask) { + case IB_SRQ_MAX_WR: + /* SRQ resize is not supported */ +- break; ++ return -EINVAL; + case IB_SRQ_LIMIT: + /* Change the SRQ threshold */ + if (srq_attr->srq_limit > srq->qplib_srq.max_wqe) +@@ -1720,13 +1720,12 @@ int bnxt_re_modify_srq(struct ib_srq *ib_srq, struct ib_srq_attr *srq_attr, + /* On success, update the shadow */ + srq->srq_limit = srq_attr->srq_limit; + /* No need to Build and send response back to udata */ +- break; ++ return 0; + default: + ibdev_err(&rdev->ibdev, + "Unsupported srq_attr_mask 0x%x", srq_attr_mask); + return -EINVAL; + } +- return 0; + } + + int bnxt_re_query_srq(struct ib_srq *ib_srq, struct ib_srq_attr *srq_attr) +-- +2.43.0 + diff --git a/queue-5.15/rdma-irdma-add-ae-for-too-many-rnrs.patch b/queue-5.15/rdma-irdma-add-ae-for-too-many-rnrs.patch new file mode 100644 index 00000000000..65c3b489746 --- /dev/null +++ b/queue-5.15/rdma-irdma-add-ae-for-too-many-rnrs.patch @@ -0,0 +1,51 @@ +From 4496ff551aaed22800d38e78cc0b8afda9a0b3f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 17:38:49 -0600 +Subject: RDMA/irdma: Add AE for too many RNRS + +From: Mustafa Ismail + +[ Upstream commit 630bdb6f28ca9e5ff79e244030170ac788478332 ] + +Add IRDMA_AE_LLP_TOO_MANY_RNRS to the list of AE's processed as an +abnormal asyncronous event. + +Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") +Signed-off-by: Mustafa Ismail +Signed-off-by: Shiraz Saleem +Signed-off-by: Sindhu Devale +Link: https://lore.kernel.org/r/20240131233849.400285-5-sindhu.devale@intel.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/irdma/defs.h | 1 + + drivers/infiniband/hw/irdma/hw.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/infiniband/hw/irdma/defs.h b/drivers/infiniband/hw/irdma/defs.h +index afd16a93ac69c..504449fc36c28 100644 +--- a/drivers/infiniband/hw/irdma/defs.h ++++ b/drivers/infiniband/hw/irdma/defs.h +@@ -345,6 +345,7 @@ enum irdma_cqp_op_type { + #define IRDMA_AE_LLP_TOO_MANY_KEEPALIVE_RETRIES 0x050b + #define IRDMA_AE_LLP_DOUBT_REACHABILITY 0x050c + #define IRDMA_AE_LLP_CONNECTION_ESTABLISHED 0x050e ++#define IRDMA_AE_LLP_TOO_MANY_RNRS 0x050f + #define IRDMA_AE_RESOURCE_EXHAUSTION 0x0520 + #define IRDMA_AE_RESET_SENT 0x0601 + #define IRDMA_AE_TERMINATE_SENT 0x0602 +diff --git a/drivers/infiniband/hw/irdma/hw.c b/drivers/infiniband/hw/irdma/hw.c +index 21d55a12ebd9f..8781638d74272 100644 +--- a/drivers/infiniband/hw/irdma/hw.c ++++ b/drivers/infiniband/hw/irdma/hw.c +@@ -379,6 +379,7 @@ static void irdma_process_aeq(struct irdma_pci_f *rf) + case IRDMA_AE_LLP_TOO_MANY_RETRIES: + case IRDMA_AE_LCE_QP_CATASTROPHIC: + case IRDMA_AE_LCE_FUNCTION_CATASTROPHIC: ++ case IRDMA_AE_LLP_TOO_MANY_RNRS: + case IRDMA_AE_LCE_CQ_CATASTROPHIC: + case IRDMA_AE_UDA_XMIT_DGRAM_TOO_LONG: + default: +-- +2.43.0 + diff --git a/queue-5.15/rdma-irdma-fix-kasan-issue-with-tasklet.patch b/queue-5.15/rdma-irdma-fix-kasan-issue-with-tasklet.patch new file mode 100644 index 00000000000..31a0a138173 --- /dev/null +++ b/queue-5.15/rdma-irdma-fix-kasan-issue-with-tasklet.patch @@ -0,0 +1,69 @@ +From f4f38abbbf731d7d1f43c274a301f1b532c94d3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 17:38:46 -0600 +Subject: RDMA/irdma: Fix KASAN issue with tasklet + +From: Mike Marciniszyn + +[ Upstream commit bd97cea7b18a0a553773af806dfbfac27a7c4acb ] + +KASAN testing revealed the following issue assocated with freeing an IRQ. + +[50006.466686] Call Trace: +[50006.466691] +[50006.489538] dump_stack+0x5c/0x80 +[50006.493475] print_address_description.constprop.6+0x1a/0x150 +[50006.499872] ? irdma_sc_process_ceq+0x483/0x790 [irdma] +[50006.505742] ? irdma_sc_process_ceq+0x483/0x790 [irdma] +[50006.511644] kasan_report.cold.11+0x7f/0x118 +[50006.516572] ? irdma_sc_process_ceq+0x483/0x790 [irdma] +[50006.522473] irdma_sc_process_ceq+0x483/0x790 [irdma] +[50006.528232] irdma_process_ceq+0xb2/0x400 [irdma] +[50006.533601] ? irdma_hw_flush_wqes_callback+0x370/0x370 [irdma] +[50006.540298] irdma_ceq_dpc+0x44/0x100 [irdma] +[50006.545306] tasklet_action_common.isra.14+0x148/0x2c0 +[50006.551096] __do_softirq+0x1d0/0xaf8 +[50006.555396] irq_exit_rcu+0x219/0x260 +[50006.559670] irq_exit+0xa/0x20 +[50006.563320] smp_apic_timer_interrupt+0x1bf/0x690 +[50006.568645] apic_timer_interrupt+0xf/0x20 +[50006.573341] + +The issue is that a tasklet could be pending on another core racing +the delete of the irq. + +Fix by insuring any scheduled tasklet is killed after deleting the +irq. + +Fixes: 44d9e52977a1 ("RDMA/irdma: Implement device initialization definitions") +Signed-off-by: Mike Marciniszyn +Signed-off-by: Shiraz Saleem +Signed-off-by: Sindhu Devale +Link: https://lore.kernel.org/r/20240131233849.400285-2-sindhu.devale@intel.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/irdma/hw.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/infiniband/hw/irdma/hw.c b/drivers/infiniband/hw/irdma/hw.c +index 0359f415280c8..21d55a12ebd9f 100644 +--- a/drivers/infiniband/hw/irdma/hw.c ++++ b/drivers/infiniband/hw/irdma/hw.c +@@ -562,6 +562,13 @@ static void irdma_destroy_irq(struct irdma_pci_f *rf, + dev->irq_ops->irdma_dis_irq(dev, msix_vec->idx); + irq_set_affinity_hint(msix_vec->irq, NULL); + free_irq(msix_vec->irq, dev_id); ++ if (rf == dev_id) { ++ tasklet_kill(&rf->dpc_tasklet); ++ } else { ++ struct irdma_ceq *iwceq = (struct irdma_ceq *)dev_id; ++ ++ tasklet_kill(&iwceq->dpc_tasklet); ++ } + } + + /** +-- +2.43.0 + diff --git a/queue-5.15/rdma-irdma-set-the-cq-read-threshold-for-gen-1.patch b/queue-5.15/rdma-irdma-set-the-cq-read-threshold-for-gen-1.patch new file mode 100644 index 00000000000..e79c4358645 --- /dev/null +++ b/queue-5.15/rdma-irdma-set-the-cq-read-threshold-for-gen-1.patch @@ -0,0 +1,43 @@ +From 1b570be7c5c105c4830026c8468baabea9d356f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 17:38:48 -0600 +Subject: RDMA/irdma: Set the CQ read threshold for GEN 1 + +From: Mustafa Ismail + +[ Upstream commit 666047f3ece9f991774c1fe9b223139a9ef8908d ] + +The CQ shadow read threshold is currently not set for GEN 2. This could +cause an invalid CQ overflow condition, so remove the GEN check that +exclused GEN 1. + +Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") +Signed-off-by: Mustafa Ismail +Signed-off-by: Shiraz Saleem +Signed-off-by: Sindhu Devale +Link: https://lore.kernel.org/r/20240131233849.400285-4-sindhu.devale@intel.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/irdma/verbs.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c +index c15af65cba333..d43833e141a02 100644 +--- a/drivers/infiniband/hw/irdma/verbs.c ++++ b/drivers/infiniband/hw/irdma/verbs.c +@@ -2076,9 +2076,8 @@ static int irdma_create_cq(struct ib_cq *ibcq, + info.cq_base_pa = iwcq->kmem.pa; + } + +- if (dev->hw_attrs.uk_attrs.hw_rev >= IRDMA_GEN_2) +- info.shadow_read_threshold = min(info.cq_uk_init_info.cq_size / 2, +- (u32)IRDMA_MAX_CQ_READ_THRESH); ++ info.shadow_read_threshold = min(info.cq_uk_init_info.cq_size / 2, ++ (u32)IRDMA_MAX_CQ_READ_THRESH); + + if (irdma_sc_cq_init(cq, &info)) { + ibdev_dbg(&iwdev->ibdev, "VERBS: init cq fail\n"); +-- +2.43.0 + diff --git a/queue-5.15/rdma-irdma-validate-max_send_wr-and-max_recv_wr.patch b/queue-5.15/rdma-irdma-validate-max_send_wr-and-max_recv_wr.patch new file mode 100644 index 00000000000..778b52e1ef0 --- /dev/null +++ b/queue-5.15/rdma-irdma-validate-max_send_wr-and-max_recv_wr.patch @@ -0,0 +1,41 @@ +From 9c7af0886b0f1e527063c6273ccc3a7bdf36dfee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 17:38:47 -0600 +Subject: RDMA/irdma: Validate max_send_wr and max_recv_wr + +From: Shiraz Saleem + +[ Upstream commit ee107186bcfd25d7873258f3f75440e20f5e6416 ] + +Validate that max_send_wr and max_recv_wr is within the +supported range. + +Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") +Change-Id: I2fc8b10292b641fddd20b36986a9dae90a93f4be +Signed-off-by: Shiraz Saleem +Signed-off-by: Sindhu Devale +Link: https://lore.kernel.org/r/20240131233849.400285-3-sindhu.devale@intel.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/irdma/verbs.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c +index 8981bf834a581..c15af65cba333 100644 +--- a/drivers/infiniband/hw/irdma/verbs.c ++++ b/drivers/infiniband/hw/irdma/verbs.c +@@ -749,7 +749,9 @@ static int irdma_validate_qp_attrs(struct ib_qp_init_attr *init_attr, + + if (init_attr->cap.max_inline_data > uk_attrs->max_hw_inline || + init_attr->cap.max_send_sge > uk_attrs->max_hw_wq_frags || +- init_attr->cap.max_recv_sge > uk_attrs->max_hw_wq_frags) ++ init_attr->cap.max_recv_sge > uk_attrs->max_hw_wq_frags || ++ init_attr->cap.max_send_wr > uk_attrs->max_hw_wq_quanta || ++ init_attr->cap.max_recv_wr > uk_attrs->max_hw_rq_quanta) + return -EINVAL; + + if (rdma_protocol_roce(&iwdev->ibdev, 1)) { +-- +2.43.0 + diff --git a/queue-5.15/rdma-qedr-fix-qedr_create_user_qp-error-flow.patch b/queue-5.15/rdma-qedr-fix-qedr_create_user_qp-error-flow.patch new file mode 100644 index 00000000000..f47f314a311 --- /dev/null +++ b/queue-5.15/rdma-qedr-fix-qedr_create_user_qp-error-flow.patch @@ -0,0 +1,109 @@ +From c70230a159438cdecfc231d9c7aa4c24cbfa3420 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Feb 2024 17:36:28 -0500 +Subject: RDMA/qedr: Fix qedr_create_user_qp error flow + +From: Kamal Heib + +[ Upstream commit 5ba4e6d5863c53e937f49932dee0ecb004c65928 ] + +Avoid the following warning by making sure to free the allocated +resources in case that qedr_init_user_queue() fail. + +-----------[ cut here ]----------- +WARNING: CPU: 0 PID: 143192 at drivers/infiniband/core/rdma_core.c:874 uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs] +Modules linked in: tls target_core_user uio target_core_pscsi target_core_file target_core_iblock ib_srpt ib_srp scsi_transport_srp nfsd nfs_acl rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs 8021q garp mrp stp llc ext4 mbcache jbd2 opa_vnic ib_umad ib_ipoib sunrpc rdma_ucm ib_isert iscsi_target_mod target_core_mod ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm hfi1 intel_rapl_msr intel_rapl_common mgag200 qedr sb_edac drm_shmem_helper rdmavt x86_pkg_temp_thermal drm_kms_helper intel_powerclamp ib_uverbs coretemp i2c_algo_bit kvm_intel dell_wmi_descriptor ipmi_ssif sparse_keymap kvm ib_core rfkill syscopyarea sysfillrect video sysimgblt irqbypass ipmi_si ipmi_devintf fb_sys_fops rapl iTCO_wdt mxm_wmi iTCO_vendor_support intel_cstate pcspkr dcdbas intel_uncore ipmi_msghandler lpc_ich acpi_power_meter mei_me mei fuse drm xfs libcrc32c qede sd_mod ahci libahci t10_pi sg crct10dif_pclmul crc32_pclmul crc32c_intel qed libata tg3 +ghash_clmulni_intel megaraid_sas crc8 wmi [last unloaded: ib_srpt] +CPU: 0 PID: 143192 Comm: fi_rdm_tagged_p Kdump: loaded Not tainted 5.14.0-408.el9.x86_64 #1 +Hardware name: Dell Inc. PowerEdge R430/03XKDV, BIOS 2.14.0 01/25/2022 +RIP: 0010:uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs] +Code: 5d 41 5c 41 5d 41 5e e9 0f 26 1b dd 48 89 df e8 67 6a ff ff 49 8b 86 10 01 00 00 48 85 c0 74 9c 4c 89 e7 e8 83 c0 cb dd eb 92 <0f> 0b eb be 0f 0b be 04 00 00 00 48 89 df e8 8e f5 ff ff e9 6d ff +RSP: 0018:ffffb7c6cadfbc60 EFLAGS: 00010286 +RAX: ffff8f0889ee3f60 RBX: ffff8f088c1a5200 RCX: 00000000802a0016 +RDX: 00000000802a0017 RSI: 0000000000000001 RDI: ffff8f0880042600 +RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000 +R10: ffff8f11fffd5000 R11: 0000000000039000 R12: ffff8f0d5b36cd80 +R13: ffff8f088c1a5250 R14: ffff8f1206d91000 R15: 0000000000000000 +FS: 0000000000000000(0000) GS:ffff8f11d7c00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000147069200e20 CR3: 00000001c7210002 CR4: 00000000001706f0 +Call Trace: + +? show_trace_log_lvl+0x1c4/0x2df +? show_trace_log_lvl+0x1c4/0x2df +? ib_uverbs_close+0x1f/0xb0 [ib_uverbs] +? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs] +? __warn+0x81/0x110 +? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs] +? report_bug+0x10a/0x140 +? handle_bug+0x3c/0x70 +? exc_invalid_op+0x14/0x70 +? asm_exc_invalid_op+0x16/0x20 +? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs] +ib_uverbs_close+0x1f/0xb0 [ib_uverbs] +__fput+0x94/0x250 +task_work_run+0x5c/0x90 +do_exit+0x270/0x4a0 +do_group_exit+0x2d/0x90 +get_signal+0x87c/0x8c0 +arch_do_signal_or_restart+0x25/0x100 +? ib_uverbs_ioctl+0xc2/0x110 [ib_uverbs] +exit_to_user_mode_loop+0x9c/0x130 +exit_to_user_mode_prepare+0xb6/0x100 +syscall_exit_to_user_mode+0x12/0x40 +do_syscall_64+0x69/0x90 +? syscall_exit_work+0x103/0x130 +? syscall_exit_to_user_mode+0x22/0x40 +? do_syscall_64+0x69/0x90 +? syscall_exit_work+0x103/0x130 +? syscall_exit_to_user_mode+0x22/0x40 +? do_syscall_64+0x69/0x90 +? do_syscall_64+0x69/0x90 +? common_interrupt+0x43/0xa0 +entry_SYSCALL_64_after_hwframe+0x72/0xdc +RIP: 0033:0x1470abe3ec6b +Code: Unable to access opcode bytes at RIP 0x1470abe3ec41. +RSP: 002b:00007fff13ce9108 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 +RAX: fffffffffffffffc RBX: 00007fff13ce9218 RCX: 00001470abe3ec6b +RDX: 00007fff13ce9200 RSI: 00000000c0181b01 RDI: 0000000000000004 +RBP: 00007fff13ce91e0 R08: 0000558d9655da10 R09: 0000558d9655dd00 +R10: 00007fff13ce95c0 R11: 0000000000000246 R12: 00007fff13ce9358 +R13: 0000000000000013 R14: 0000558d9655db50 R15: 00007fff13ce9470 + +--[ end trace 888a9b92e04c5c97 ]-- + +Fixes: df15856132bc ("RDMA/qedr: restructure functions that create/destroy QPs") +Signed-off-by: Kamal Heib +Link: https://lore.kernel.org/r/20240208223628.2040841-1-kheib@redhat.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/qedr/verbs.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c +index bb0c2b93a34d8..c0993e3bad12d 100644 +--- a/drivers/infiniband/hw/qedr/verbs.c ++++ b/drivers/infiniband/hw/qedr/verbs.c +@@ -1888,8 +1888,17 @@ static int qedr_create_user_qp(struct qedr_dev *dev, + /* RQ - read access only (0) */ + rc = qedr_init_user_queue(udata, dev, &qp->urq, ureq.rq_addr, + ureq.rq_len, true, 0, alloc_and_init); +- if (rc) ++ if (rc) { ++ ib_umem_release(qp->usq.umem); ++ qp->usq.umem = NULL; ++ if (rdma_protocol_roce(&dev->ibdev, 1)) { ++ qedr_free_pbl(dev, &qp->usq.pbl_info, ++ qp->usq.pbl_tbl); ++ } else { ++ kfree(qp->usq.pbl_tbl); ++ } + return rc; ++ } + } + + memset(&in_params, 0, sizeof(in_params)); +-- +2.43.0 + diff --git a/queue-5.15/rdma-srpt-fix-function-pointer-cast-warnings.patch b/queue-5.15/rdma-srpt-fix-function-pointer-cast-warnings.patch new file mode 100644 index 00000000000..45d25f0009f --- /dev/null +++ b/queue-5.15/rdma-srpt-fix-function-pointer-cast-warnings.patch @@ -0,0 +1,60 @@ +From 0b0b14e561a05d34006a961f18d4d11144eacc24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 11:07:13 +0100 +Subject: RDMA/srpt: fix function pointer cast warnings + +From: Arnd Bergmann + +[ Upstream commit eb5c7465c3240151cd42a55c7ace9da0026308a1 ] + +clang-16 notices that srpt_qp_event() gets called through an incompatible +pointer here: + +drivers/infiniband/ulp/srpt/ib_srpt.c:1815:5: error: cast from 'void (*)(struct ib_event *, struct srpt_rdma_ch *)' to 'void (*)(struct ib_event *, void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict] + 1815 | = (void(*)(struct ib_event *, void*))srpt_qp_event; + +Change srpt_qp_event() to use the correct prototype and adjust the +argument inside of it. + +Fixes: a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20240213100728.458348-1-arnd@kernel.org +Reviewed-by: Bart Van Assche +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/srpt/ib_srpt.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c +index deb834a7d75cd..60f9c612eb3c3 100644 +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -214,10 +214,12 @@ static const char *get_ch_state_name(enum rdma_ch_state s) + /** + * srpt_qp_event - QP event callback function + * @event: Description of the event that occurred. +- * @ch: SRPT RDMA channel. ++ * @ptr: SRPT RDMA channel. + */ +-static void srpt_qp_event(struct ib_event *event, struct srpt_rdma_ch *ch) ++static void srpt_qp_event(struct ib_event *event, void *ptr) + { ++ struct srpt_rdma_ch *ch = ptr; ++ + pr_debug("QP event %d on ch=%p sess_name=%s-%d state=%s\n", + event->event, ch, ch->sess_name, ch->qp->qp_num, + get_ch_state_name(ch->state)); +@@ -1811,8 +1813,7 @@ static int srpt_create_ch_ib(struct srpt_rdma_ch *ch) + ch->cq_size = ch->rq_size + sq_size; + + qp_init->qp_context = (void *)ch; +- qp_init->event_handler +- = (void(*)(struct ib_event *, void*))srpt_qp_event; ++ qp_init->event_handler = srpt_qp_event; + qp_init->send_cq = ch->cq; + qp_init->recv_cq = ch->cq; + qp_init->sq_sig_type = IB_SIGNAL_REQ_WR; +-- +2.43.0 + diff --git a/queue-5.15/rdma-srpt-support-specifying-the-srpt_service_guid-p.patch b/queue-5.15/rdma-srpt-support-specifying-the-srpt_service_guid-p.patch new file mode 100644 index 00000000000..f1cc14c0669 --- /dev/null +++ b/queue-5.15/rdma-srpt-support-specifying-the-srpt_service_guid-p.patch @@ -0,0 +1,62 @@ +From 32d8a1703cdec3252e6dba87fe5b2bf8d990122b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Feb 2024 16:42:07 -0800 +Subject: RDMA/srpt: Support specifying the srpt_service_guid parameter + +From: Bart Van Assche + +[ Upstream commit fdfa083549de5d50ebf7f6811f33757781e838c0 ] + +Make loading ib_srpt with this parameter set work. The current behavior is +that setting that parameter while loading the ib_srpt kernel module +triggers the following kernel crash: + +BUG: kernel NULL pointer dereference, address: 0000000000000000 +Call Trace: + + parse_one+0x18c/0x1d0 + parse_args+0xe1/0x230 + load_module+0x8de/0xa60 + init_module_from_file+0x8b/0xd0 + idempotent_init_module+0x181/0x240 + __x64_sys_finit_module+0x5a/0xb0 + do_syscall_64+0x5f/0xe0 + entry_SYSCALL_64_after_hwframe+0x6e/0x76 + +Cc: LiHonggang +Reported-by: LiHonggang +Fixes: a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1") +Signed-off-by: Bart Van Assche +Link: https://lore.kernel.org/r/20240205004207.17031-1-bvanassche@acm.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/srpt/ib_srpt.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c +index 38494943bd748..deb834a7d75cd 100644 +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -79,12 +79,16 @@ module_param(srpt_srq_size, int, 0444); + MODULE_PARM_DESC(srpt_srq_size, + "Shared receive queue (SRQ) size."); + ++static int srpt_set_u64_x(const char *buffer, const struct kernel_param *kp) ++{ ++ return kstrtou64(buffer, 16, (u64 *)kp->arg); ++} + static int srpt_get_u64_x(char *buffer, const struct kernel_param *kp) + { + return sprintf(buffer, "0x%016llx\n", *(u64 *)kp->arg); + } +-module_param_call(srpt_service_guid, NULL, srpt_get_u64_x, &srpt_service_guid, +- 0444); ++module_param_call(srpt_service_guid, srpt_set_u64_x, srpt_get_u64_x, ++ &srpt_service_guid, 0444); + MODULE_PARM_DESC(srpt_service_guid, + "Using this value for ioc_guid, id_ext, and cm_listen_id instead of using the node_guid of the first HCA."); + +-- +2.43.0 + diff --git a/queue-5.15/s390-use-the-correct-count-for-__iowrite64_copy.patch b/queue-5.15/s390-use-the-correct-count-for-__iowrite64_copy.patch new file mode 100644 index 00000000000..67316c8d3f1 --- /dev/null +++ b/queue-5.15/s390-use-the-correct-count-for-__iowrite64_copy.patch @@ -0,0 +1,39 @@ +From fedd6596937f335b9456feebdb1031f8215552e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 20:48:14 -0400 +Subject: s390: use the correct count for __iowrite64_copy() + +From: Jason Gunthorpe + +[ Upstream commit 723a2cc8d69d4342b47dfddbfe6c19f1b135f09b ] + +The signature for __iowrite64_copy() requires the number of 64 bit +quantities, not bytes. Multiple by 8 to get to a byte length before +invoking zpci_memcpy_toio() + +Fixes: 87bc359b9822 ("s390/pci: speed up __iowrite64_copy by using pci store block insn") +Acked-by: Niklas Schnelle +Signed-off-by: Jason Gunthorpe +Link: https://lore.kernel.org/r/0-v1-9223d11a7662+1d7785-s390_iowrite64_jgg@nvidia.com +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/pci/pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c +index 56c4cecdbbf9e..8764f0ae6d345 100644 +--- a/arch/s390/pci/pci.c ++++ b/arch/s390/pci/pci.c +@@ -228,7 +228,7 @@ resource_size_t pcibios_align_resource(void *data, const struct resource *res, + /* combine single writes by using store-block insn */ + void __iowrite64_copy(void __iomem *to, const void *from, size_t count) + { +- zpci_memcpy_toio(to, from, count); ++ zpci_memcpy_toio(to, from, count * 8); + } + + static void __iomem *__ioremap(phys_addr_t addr, size_t size, pgprot_t prot) +-- +2.43.0 + diff --git a/queue-5.15/scsi-jazz_esp-only-build-if-scsi-core-is-builtin.patch b/queue-5.15/scsi-jazz_esp-only-build-if-scsi-core-is-builtin.patch new file mode 100644 index 00000000000..a1a690dfd79 --- /dev/null +++ b/queue-5.15/scsi-jazz_esp-only-build-if-scsi-core-is-builtin.patch @@ -0,0 +1,54 @@ +From fba386f0b710b800da9ef4efdab354029f17e44c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 21:59:53 -0800 +Subject: scsi: jazz_esp: Only build if SCSI core is builtin + +From: Randy Dunlap + +[ Upstream commit 9ddf190a7df77b77817f955fdb9c2ae9d1c9c9a3 ] + +JAZZ_ESP is a bool kconfig symbol that selects SCSI_SPI_ATTRS. When +CONFIG_SCSI=m, this results in SCSI_SPI_ATTRS=m while JAZZ_ESP=y, which +causes many undefined symbol linker errors. + +Fix this by only offering to build this driver when CONFIG_SCSI=y. + +[mkp: JAZZ_ESP is unique in that it does not support being compiled as a +module unlike the remaining SPI SCSI HBA drivers] + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Randy Dunlap +Link: https://lore.kernel.org/r/20240214055953.9612-1-rdunlap@infradead.org +Cc: Thomas Bogendoerfer +Cc: linux-mips@vger.kernel.org +Cc: Arnd Bergmann +Cc: Masahiro Yamada +Cc: Nicolas Schier +Cc: James E.J. Bottomley +Cc: Martin K. Petersen +Cc: linux-scsi@vger.kernel.org +Cc: Geert Uytterhoeven +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202402112222.Gl0udKyU-lkp@intel.com/ +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig +index eea574e89b872..43e6f86e08c33 100644 +--- a/drivers/scsi/Kconfig ++++ b/drivers/scsi/Kconfig +@@ -1296,7 +1296,7 @@ source "drivers/scsi/arm/Kconfig" + + config JAZZ_ESP + bool "MIPS JAZZ FAS216 SCSI support" +- depends on MACH_JAZZ && SCSI ++ depends on MACH_JAZZ && SCSI=y + select SCSI_SPI_ATTRS + help + This is the driver for the onboard SCSI host adapter of MIPS Magnum +-- +2.43.0 + diff --git a/queue-5.15/series b/queue-5.15/series index e5d9d8103b3..d8daa2f2d1f 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -198,3 +198,41 @@ xhci-clear-usb2-resume-related-variables-in-one-plac.patch xhci-decouple-usb2-port-resume-and-get_port_status-r.patch xhci-track-port-suspend-state-correctly-in-unsuccess.patch cifs-add-a-warning-when-the-in-flight-count-goes-neg.patch +ib-hfi1-fix-a-memleak-in-init_credit_return.patch +rdma-bnxt_re-return-error-for-srq-resize.patch +rdma-irdma-fix-kasan-issue-with-tasklet.patch +rdma-irdma-validate-max_send_wr-and-max_recv_wr.patch +rdma-irdma-set-the-cq-read-threshold-for-gen-1.patch +rdma-irdma-add-ae-for-too-many-rnrs.patch +rdma-srpt-support-specifying-the-srpt_service_guid-p.patch +rdma-qedr-fix-qedr_create_user_qp-error-flow.patch +arm64-dts-rockchip-set-num-cs-property-for-spi-on-px.patch +rdma-srpt-fix-function-pointer-cast-warnings.patch +bpf-scripts-correct-gpl-license-name.patch +scsi-jazz_esp-only-build-if-scsi-core-is-builtin.patch +nouveau-fix-function-cast-warnings.patch +net-stmmac-fix-incorrect-dereference-in-interrupt-ha.patch +ipv4-properly-combine-dev_base_seq-and-ipv4.dev_addr.patch +ipv6-properly-combine-dev_base_seq-and-ipv6.dev_addr.patch +ata-libahci_platform-convert-to-using-devm-bulk-cloc.patch +ata-libahci_platform-introduce-reset-assertion-deass.patch +ata-ahci_ceva-fix-error-handling-for-xilinx-gt-phy-s.patch +bpf-fix-racing-between-bpf_timer_cancel_and_free-and.patch +afs-increase-buffer-size-in-afs_update_volume_status.patch +ipv6-sr-fix-possible-use-after-free-and-null-ptr-der.patch +packet-move-from-strlcpy-with-unused-retval-to-strsc.patch +net-dev-convert-sa_data-to-flexible-array-in-struct-.patch +drm-nouveau-instmem-fix-uninitialized_var.cocci-warn.patch +octeontx2-af-consider-the-action-set-by-pf.patch +s390-use-the-correct-count-for-__iowrite64_copy.patch +tls-rx-jump-to-a-more-appropriate-label.patch +tls-rx-drop-pointless-else-after-goto.patch +tls-stop-recv-if-initial-process_rx_list-gave-us-non.patch +netfilter-nf_tables-set-dormant-flag-on-hook-registe.patch +netfilter-flowtable-simplify-route-logic.patch +netfilter-nft_flow_offload-reset-dst-in-route-object.patch +netfilter-nft_flow_offload-release-dst-in-case-direc.patch +drm-syncobj-call-drm_syncobj_fence_add_wait-when-wai.patch +drm-amd-display-fix-memory-leak-in-dm_sw_fini.patch +i2c-imx-add-timer-for-handling-the-stop-condition.patch +i2c-imx-when-being-a-target-mark-the-last-read-as-pr.patch diff --git a/queue-5.15/tls-rx-drop-pointless-else-after-goto.patch b/queue-5.15/tls-rx-drop-pointless-else-after-goto.patch new file mode 100644 index 00000000000..d2b6e0ab917 --- /dev/null +++ b/queue-5.15/tls-rx-drop-pointless-else-after-goto.patch @@ -0,0 +1,39 @@ +From d8f3132b02c2a6849c65c4382c4a87a82904901d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 20:38:15 -0700 +Subject: tls: rx: drop pointless else after goto + +From: Jakub Kicinski + +[ Upstream commit d5123edd10cf9d324fcb88e276bdc7375f3c5321 ] + +Pointless else branch after goto makes the code harder to refactor +down the line. + +Signed-off-by: Jakub Kicinski +Signed-off-by: David S. Miller +Stable-dep-of: fdfbaec5923d ("tls: stop recv() if initial process_rx_list gave us non-DATA") +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index c8285c596b5f4..92eab4a7a80b5 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1784,10 +1784,9 @@ int tls_sw_recvmsg(struct sock *sk, + if (err < 0) { + tls_err_abort(sk, err); + goto end; +- } else { +- copied = err; + } + ++ copied = err; + if (len <= copied) + goto end; + +-- +2.43.0 + diff --git a/queue-5.15/tls-rx-jump-to-a-more-appropriate-label.patch b/queue-5.15/tls-rx-jump-to-a-more-appropriate-label.patch new file mode 100644 index 00000000000..8068abc63bd --- /dev/null +++ b/queue-5.15/tls-rx-jump-to-a-more-appropriate-label.patch @@ -0,0 +1,64 @@ +From 405b56a824973d8d600a5114a19c09db2c82326b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 20:38:14 -0700 +Subject: tls: rx: jump to a more appropriate label + +From: Jakub Kicinski + +[ Upstream commit bfc06e1aaa130b86a81ce3c41ec71a2f5e191690 ] + +'recv_end:' checks num_async and decrypted, and is then followed +by the 'end' label. Since we know that decrypted and num_async +are 0 at the start we can jump to 'end'. + +Move the init of decrypted and num_async to let the compiler +catch if I'm wrong. + +Signed-off-by: Jakub Kicinski +Signed-off-by: David S. Miller +Stable-dep-of: fdfbaec5923d ("tls: stop recv() if initial process_rx_list gave us non-DATA") +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 9ff3e4df2d6c5..c8285c596b5f4 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1755,6 +1755,7 @@ int tls_sw_recvmsg(struct sock *sk, + struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx); + struct tls_prot_info *prot = &tls_ctx->prot_info; + struct sk_psock *psock; ++ int num_async, pending; + unsigned char control = 0; + ssize_t decrypted = 0; + struct strp_msg *rxm; +@@ -1767,8 +1768,6 @@ int tls_sw_recvmsg(struct sock *sk, + bool is_kvec = iov_iter_is_kvec(&msg->msg_iter); + bool is_peek = flags & MSG_PEEK; + bool bpf_strp_enabled; +- int num_async = 0; +- int pending; + + flags |= nonblock; + +@@ -1790,12 +1789,14 @@ int tls_sw_recvmsg(struct sock *sk, + } + + if (len <= copied) +- goto recv_end; ++ goto end; + + target = sock_rcvlowat(sk, flags & MSG_WAITALL, len); + len = len - copied; + timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT); + ++ decrypted = 0; ++ num_async = 0; + while (len && (decrypted + copied < target || ctx->recv_pkt)) { + bool retain_skb = false; + bool zc = false; +-- +2.43.0 + diff --git a/queue-5.15/tls-stop-recv-if-initial-process_rx_list-gave-us-non.patch b/queue-5.15/tls-stop-recv-if-initial-process_rx_list-gave-us-non.patch new file mode 100644 index 00000000000..027b5503e68 --- /dev/null +++ b/queue-5.15/tls-stop-recv-if-initial-process_rx_list-gave-us-non.patch @@ -0,0 +1,44 @@ +From 44b6a19a04787d9464733a7fbe64150b3dd58b03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Feb 2024 17:17:30 +0100 +Subject: tls: stop recv() if initial process_rx_list gave us non-DATA + +From: Sabrina Dubroca + +[ Upstream commit fdfbaec5923d9359698cbb286bc0deadbb717504 ] + +If we have a non-DATA record on the rx_list and another record of the +same type still on the queue, we will end up merging them: + - process_rx_list copies the non-DATA record + - we start the loop and process the first available record since it's + of the same type + - we break out of the loop since the record was not DATA + +Just check the record type and jump to the end in case process_rx_list +did some work. + +Fixes: 692d7b5d1f91 ("tls: Fix recvmsg() to be able to peek across multiple records") +Signed-off-by: Sabrina Dubroca +Link: https://lore.kernel.org/r/bd31449e43bd4b6ff546f5c51cf958c31c511deb.1708007371.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 92eab4a7a80b5..e6f700f67c010 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1787,7 +1787,7 @@ int tls_sw_recvmsg(struct sock *sk, + } + + copied = err; +- if (len <= copied) ++ if (len <= copied || (copied && control != TLS_RECORD_TYPE_DATA)) + goto end; + + target = sock_rcvlowat(sk, flags & MSG_WAITALL, len); +-- +2.43.0 +