From: Sasha Levin Date: Fri, 12 May 2023 06:32:38 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v4.14.315~104 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=38a665835f32ab2a3912b21436cef5dba43262a9;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/af_packet-don-t-send-zero-byte-data-in-packet_sendms.patch b/queue-5.4/af_packet-don-t-send-zero-byte-data-in-packet_sendms.patch new file mode 100644 index 00000000000..f60fbae2f48 --- /dev/null +++ b/queue-5.4/af_packet-don-t-send-zero-byte-data-in-packet_sendms.patch @@ -0,0 +1,111 @@ +From 1030d5e9492c01629e5d14e77dd44e2437dbf1eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 May 2023 13:28:57 -0700 +Subject: af_packet: Don't send zero-byte data in packet_sendmsg_spkt(). + +From: Kuniyuki Iwashima + +[ Upstream commit 6a341729fb31b4c5df9f74f24b4b1c98410c9b87 ] + +syzkaller reported a warning below [0]. + +We can reproduce it by sending 0-byte data from the (AF_PACKET, +SOCK_PACKET) socket via some devices whose dev->hard_header_len +is 0. + + struct sockaddr_pkt addr = { + .spkt_family = AF_PACKET, + .spkt_device = "tun0", + }; + int fd; + + fd = socket(AF_PACKET, SOCK_PACKET, 0); + sendto(fd, NULL, 0, 0, (struct sockaddr *)&addr, sizeof(addr)); + +We have a similar fix for the (AF_PACKET, SOCK_RAW) socket as +commit dc633700f00f ("net/af_packet: check len when min_header_len +equals to 0"). + +Let's add the same test for the SOCK_PACKET socket. + +[0]: +skb_assert_len +WARNING: CPU: 1 PID: 19945 at include/linux/skbuff.h:2552 skb_assert_len include/linux/skbuff.h:2552 [inline] +WARNING: CPU: 1 PID: 19945 at include/linux/skbuff.h:2552 __dev_queue_xmit+0x1f26/0x31d0 net/core/dev.c:4159 +Modules linked in: +CPU: 1 PID: 19945 Comm: syz-executor.0 Not tainted 6.3.0-rc7-02330-gca6270c12e20 #1 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 +RIP: 0010:skb_assert_len include/linux/skbuff.h:2552 [inline] +RIP: 0010:__dev_queue_xmit+0x1f26/0x31d0 net/core/dev.c:4159 +Code: 89 de e8 1d a2 85 fd 84 db 75 21 e8 64 a9 85 fd 48 c7 c6 80 2a 1f 86 48 c7 c7 c0 06 1f 86 c6 05 23 cf 27 04 01 e8 fa ee 56 fd <0f> 0b e8 43 a9 85 fd 0f b6 1d 0f cf 27 04 31 ff 89 de e8 e3 a1 85 +RSP: 0018:ffff8880217af6e0 EFLAGS: 00010282 +RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffc90001133000 +RDX: 0000000000040000 RSI: ffffffff81186922 RDI: 0000000000000001 +RBP: ffff8880217af8b0 R08: 0000000000000001 R09: 0000000000000000 +R10: 0000000000000001 R11: 0000000000000001 R12: ffff888030045640 +R13: ffff8880300456b0 R14: ffff888030045650 R15: ffff888030045718 +FS: 00007fc5864da640(0000) GS:ffff88806cd00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000000020005740 CR3: 000000003f856003 CR4: 0000000000770ee0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +PKRU: 55555554 +Call Trace: + + dev_queue_xmit include/linux/netdevice.h:3085 [inline] + packet_sendmsg_spkt+0xc4b/0x1230 net/packet/af_packet.c:2066 + sock_sendmsg_nosec net/socket.c:724 [inline] + sock_sendmsg+0x1b4/0x200 net/socket.c:747 + ____sys_sendmsg+0x331/0x970 net/socket.c:2503 + ___sys_sendmsg+0x11d/0x1c0 net/socket.c:2557 + __sys_sendmmsg+0x18c/0x430 net/socket.c:2643 + __do_sys_sendmmsg net/socket.c:2672 [inline] + __se_sys_sendmmsg net/socket.c:2669 [inline] + __x64_sys_sendmmsg+0x9c/0x100 net/socket.c:2669 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3c/0x90 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x72/0xdc +RIP: 0033:0x7fc58791de5d +Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48 +RSP: 002b:00007fc5864d9cc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 +RAX: ffffffffffffffda RBX: 00000000004bbf80 RCX: 00007fc58791de5d +RDX: 0000000000000001 RSI: 0000000020005740 RDI: 0000000000000004 +RBP: 00000000004bbf80 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 +R13: 000000000000000b R14: 00007fc58797e530 R15: 0000000000000000 + +---[ end trace 0000000000000000 ]--- +skb len=0 headroom=16 headlen=0 tailroom=304 +mac=(16,0) net=(16,-1) trans=-1 +shinfo(txflags=0 nr_frags=0 gso(size=0 type=0 segs=0)) +csum(0x0 ip_summed=0 complete_sw=0 valid=0 level=0) +hash(0x0 sw=0 l4=0) proto=0x0000 pkttype=0 iif=0 +dev name=sit0 feat=0x00000006401d7869 +sk family=17 type=10 proto=0 + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: syzbot +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/packet/af_packet.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 13666fe787db7..109a848aca151 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -1975,7 +1975,7 @@ static int packet_sendmsg_spkt(struct socket *sock, struct msghdr *msg, + goto retry; + } + +- if (!dev_validate_header(dev, skb->data, len)) { ++ if (!dev_validate_header(dev, skb->data, len) || !skb->len) { + err = -EINVAL; + goto out_unlock; + } +-- +2.39.2 + diff --git a/queue-5.4/alsa-caiaq-input-add-error-handling-for-unsupported-.patch b/queue-5.4/alsa-caiaq-input-add-error-handling-for-unsupported-.patch new file mode 100644 index 00000000000..5d23977a5be --- /dev/null +++ b/queue-5.4/alsa-caiaq-input-add-error-handling-for-unsupported-.patch @@ -0,0 +1,44 @@ +From 1bf27c6cd0ebda501e1061ae0261700821e4ea1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 May 2023 14:50:53 +0800 +Subject: ALSA: caiaq: input: Add error handling for unsupported input methods + in `snd_usb_caiaq_input_init` + +From: Ruliang Lin + +[ Upstream commit 0d727e1856ef22dd9337199430258cb64cbbc658 ] + +Smatch complains that: +snd_usb_caiaq_input_init() warn: missing error code 'ret' + +This patch adds a new case to handle the situation where the +device does not support any input methods in the +`snd_usb_caiaq_input_init` function. It returns an `-EINVAL` error code +to indicate that no input methods are supported on the device. + +Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support") +Signed-off-by: Ruliang Lin +Reviewed-by: Dongliang Mu +Acked-by: Daniel Mack +Link: https://lore.kernel.org/r/20230504065054.3309-1-u202112092@hust.edu.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/caiaq/input.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/usb/caiaq/input.c b/sound/usb/caiaq/input.c +index 533eb69fe4e69..cd5a8584dbe32 100644 +--- a/sound/usb/caiaq/input.c ++++ b/sound/usb/caiaq/input.c +@@ -804,6 +804,7 @@ int snd_usb_caiaq_input_init(struct snd_usb_caiaqdev *cdev) + + default: + /* no input methods supported on this device */ ++ ret = -EINVAL; + goto exit_free_idev; + } + +-- +2.39.2 + diff --git a/queue-5.4/drm-amdgpu-add-a-missing-lock-for-amdgpu_sched.patch b/queue-5.4/drm-amdgpu-add-a-missing-lock-for-amdgpu_sched.patch new file mode 100644 index 00000000000..9b37a8d23ea --- /dev/null +++ b/queue-5.4/drm-amdgpu-add-a-missing-lock-for-amdgpu_sched.patch @@ -0,0 +1,54 @@ +From 1d55f319e9c360e0b8440c6e779fbd64ce5601e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Apr 2023 15:54:55 -0700 +Subject: drm/amdgpu: add a missing lock for AMDGPU_SCHED +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chia-I Wu + +[ Upstream commit 2397e3d8d2e120355201a8310b61929f5a8bd2c0 ] + +mgr->ctx_handles should be protected by mgr->lock. + +v2: improve commit message +v3: add a Fixes tag + +Signed-off-by: Chia-I Wu +Reviewed-by: Christian König +Fixes: 52c6a62c64fa ("drm/amdgpu: add interface for editing a foreign process's priority v3") +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c +index c799691dfa848..94a503dc08b72 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c +@@ -58,6 +58,7 @@ static int amdgpu_sched_process_priority_override(struct amdgpu_device *adev, + { + struct fd f = fdget(fd); + struct amdgpu_fpriv *fpriv; ++ struct amdgpu_ctx_mgr *mgr; + struct amdgpu_ctx *ctx; + uint32_t id; + int r; +@@ -71,8 +72,11 @@ static int amdgpu_sched_process_priority_override(struct amdgpu_device *adev, + return r; + } + +- idr_for_each_entry(&fpriv->ctx_mgr.ctx_handles, ctx, id) ++ mgr = &fpriv->ctx_mgr; ++ mutex_lock(&mgr->lock); ++ idr_for_each_entry(&mgr->ctx_handles, ctx, id) + amdgpu_ctx_priority_override(ctx, priority); ++ mutex_unlock(&mgr->lock); + + fdput(f); + return 0; +-- +2.39.2 + diff --git a/queue-5.4/ionic-remove-noise-from-ethtool-rxnfc-error-msg.patch b/queue-5.4/ionic-remove-noise-from-ethtool-rxnfc-error-msg.patch new file mode 100644 index 00000000000..be5f2da0cde --- /dev/null +++ b/queue-5.4/ionic-remove-noise-from-ethtool-rxnfc-error-msg.patch @@ -0,0 +1,38 @@ +From 05df0bfd73fa149783a3167043f0be96131ae7e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 May 2023 11:47:40 -0700 +Subject: ionic: remove noise from ethtool rxnfc error msg + +From: Shannon Nelson + +[ Upstream commit 3711d44fac1f80ea69ecb7315fed05b3812a7401 ] + +It seems that ethtool is calling into .get_rxnfc more often with +ETHTOOL_GRXCLSRLCNT which ionic doesn't know about. We don't +need to log a message about it, just return not supported. + +Fixes: aa3198819bea6 ("ionic: Add RSS support") +Signed-off-by: Shannon Nelson +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/pensando/ionic/ionic_ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c b/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c +index b8de3784d9769..c53d2271d8abc 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c +@@ -573,7 +573,7 @@ static int ionic_get_rxnfc(struct net_device *netdev, + info->data = lif->nxqs; + break; + default: +- netdev_err(netdev, "Command parameter %d is not supported\n", ++ netdev_dbg(netdev, "Command parameter %d is not supported\n", + info->cmd); + err = -EOPNOTSUPP; + } +-- +2.39.2 + diff --git a/queue-5.4/net-bcmgenet-remove-phy_stop-from-bcmgenet_netif_sto.patch b/queue-5.4/net-bcmgenet-remove-phy_stop-from-bcmgenet_netif_sto.patch new file mode 100644 index 00000000000..b1909b704a3 --- /dev/null +++ b/queue-5.4/net-bcmgenet-remove-phy_stop-from-bcmgenet_netif_sto.patch @@ -0,0 +1,37 @@ +From e5826e4a0f7a2bf79a7a34f3b78e41d51133ccaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 May 2023 16:07:27 -0700 +Subject: net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop() + +From: Florian Fainelli + +[ Upstream commit 93e0401e0fc0c54b0ac05b687cd135c2ac38187c ] + +The call to phy_stop() races with the later call to phy_disconnect(), +resulting in concurrent phy_suspend() calls being run from different +CPUs. The final call to phy_disconnect() ensures that the PHY is +stopped and suspended, too. + +Fixes: c96e731c93ff ("net: bcmgenet: connect and disconnect from the PHY state machine") +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index 1b725a021455b..468f79c270ac3 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -2988,7 +2988,6 @@ static void bcmgenet_netif_stop(struct net_device *dev) + /* Disable MAC transmit. TX DMA disabled must be done before this */ + umac_enable_set(priv, CMD_TX_EN, false); + +- phy_stop(dev->phydev); + bcmgenet_disable_rx_napi(priv); + bcmgenet_intr_disable(priv); + +-- +2.39.2 + diff --git a/queue-5.4/net-dsa-mt7530-fix-corrupt-frames-using-trgmii-on-40.patch b/queue-5.4/net-dsa-mt7530-fix-corrupt-frames-using-trgmii-on-40.patch new file mode 100644 index 00000000000..1f4e6fcd860 --- /dev/null +++ b/queue-5.4/net-dsa-mt7530-fix-corrupt-frames-using-trgmii-on-40.patch @@ -0,0 +1,65 @@ +From 171eca69f01d2a0c4a7f6b4cfb9e98476b1c733a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 May 2023 00:09:46 +0300 +Subject: net: dsa: mt7530: fix corrupt frames using trgmii on 40 MHz XTAL + MT7621 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arınç ÜNAL + +[ Upstream commit 37c218d8021e36e226add4bab93d071d30fe0704 ] + +The multi-chip module MT7530 switch with a 40 MHz oscillator on the +MT7621AT, MT7621DAT, and MT7621ST SoCs forwards corrupt frames using +trgmii. + +This is caused by the assumption that MT7621 SoCs have got 150 MHz PLL, +hence using the ncpo1 value, 0x0780. + +My testing shows this value works on Unielec U7621-06, Bartel's testing +shows it won't work on Hi-Link HLK-MT7621A and Netgear WAC104. All devices +tested have got 40 MHz oscillators. + +Using the value for 125 MHz PLL, 0x0640, works on all boards at hand. The +definitions for 125 MHz PLL exist on the Banana Pi BPI-R2 BSP source code +whilst 150 MHz PLL don't. + +Forwarding frames using trgmii on the MCM MT7530 switch with a 25 MHz +oscillator on the said MT7621 SoCs works fine because the ncpo1 value +defined for it is for 125 MHz PLL. + +Change the 150 MHz PLL comment to 125 MHz PLL, and use the 125 MHz PLL +ncpo1 values for both oscillator frequencies. + +Link: https://github.com/BPI-SINOVOIP/BPI-R2-bsp/blob/81d24bbce7d99524d0771a8bdb2d6663e4eb4faa/u-boot-mt/drivers/net/rt2880_eth.c#L2195 +Fixes: 7ef6f6f8d237 ("net: dsa: mt7530: Add MT7621 TRGMII mode support") +Tested-by: Bartel Eerdekens +Signed-off-by: Arınç ÜNAL +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mt7530.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c +index 2d8382eb9add3..baa994b7f78b5 100644 +--- a/drivers/net/dsa/mt7530.c ++++ b/drivers/net/dsa/mt7530.c +@@ -397,9 +397,9 @@ mt7530_pad_clk_setup(struct dsa_switch *ds, int mode) + case PHY_INTERFACE_MODE_TRGMII: + trgint = 1; + if (priv->id == ID_MT7621) { +- /* PLL frequency: 150MHz: 1.2GBit */ ++ /* PLL frequency: 125MHz: 1.0GBit */ + if (xtal == HWTRAP_XTAL_40MHZ) +- ncpo1 = 0x0780; ++ ncpo1 = 0x0640; + if (xtal == HWTRAP_XTAL_25MHZ) + ncpo1 = 0x0a00; + } else { /* PLL frequency: 250MHz: 2.0Gbit */ +-- +2.39.2 + diff --git a/queue-5.4/net-dsa-mv88e6xxx-add-mv88e6321-rsvd2cpu.patch b/queue-5.4/net-dsa-mv88e6xxx-add-mv88e6321-rsvd2cpu.patch new file mode 100644 index 00000000000..25df04573d2 --- /dev/null +++ b/queue-5.4/net-dsa-mv88e6xxx-add-mv88e6321-rsvd2cpu.patch @@ -0,0 +1,36 @@ +From 8d96da5ef82197cec4325628459573bb8979c16f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Apr 2023 22:28:15 +0200 +Subject: net: dsa: mv88e6xxx: add mv88e6321 rsvd2cpu + +From: Angelo Dureghello + +[ Upstream commit 6686317855c6997671982d4489ccdd946f644957 ] + +Add rsvd2cpu capability for mv88e6321 model, to allow proper bpdu +processing. + +Signed-off-by: Angelo Dureghello +Fixes: 51c901a775621 ("net: dsa: mv88e6xxx: distinguish Global 2 Rsvd2CPU") +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6xxx/chip.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index ea32be579e7b1..3a8a49b7ec3d9 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -3876,6 +3876,7 @@ static const struct mv88e6xxx_ops mv88e6321_ops = { + .set_cpu_port = mv88e6095_g1_set_cpu_port, + .set_egress_port = mv88e6095_g1_set_egress_port, + .watchdog_ops = &mv88e6390_watchdog_ops, ++ .mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu, + .reset = mv88e6352_g1_reset, + .vtu_getnext = mv88e6185_g1_vtu_getnext, + .vtu_loadpurge = mv88e6185_g1_vtu_loadpurge, +-- +2.39.2 + diff --git a/queue-5.4/net-ncsi-clear-tx-enable-mode-when-handling-a-config.patch b/queue-5.4/net-ncsi-clear-tx-enable-mode-when-handling-a-config.patch new file mode 100644 index 00000000000..e97f26c90f7 --- /dev/null +++ b/queue-5.4/net-ncsi-clear-tx-enable-mode-when-handling-a-config.patch @@ -0,0 +1,41 @@ +From a35dc104e4ef8733195017d054d3b925348f933e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Apr 2023 16:13:50 +0800 +Subject: net/ncsi: clear Tx enable mode when handling a Config required AEN + +From: Cosmo Chou + +[ Upstream commit 6f75cd166a5a3c0bc50441faa8b8304f60522fdd ] + +ncsi_channel_is_tx() determines whether a given channel should be +used for Tx or not. However, when reconfiguring the channel by +handling a Configuration Required AEN, there is a misjudgment that +the channel Tx has already been enabled, which results in the Enable +Channel Network Tx command not being sent. + +Clear the channel Tx enable flag before reconfiguring the channel to +avoid the misjudgment. + +Fixes: 8d951a75d022 ("net/ncsi: Configure multi-package, multi-channel modes with failover") +Signed-off-by: Cosmo Chou +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ncsi/ncsi-aen.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/ncsi/ncsi-aen.c b/net/ncsi/ncsi-aen.c +index b635c194f0a85..62fb1031763d1 100644 +--- a/net/ncsi/ncsi-aen.c ++++ b/net/ncsi/ncsi-aen.c +@@ -165,6 +165,7 @@ static int ncsi_aen_handler_cr(struct ncsi_dev_priv *ndp, + nc->state = NCSI_CHANNEL_INACTIVE; + list_add_tail_rcu(&nc->link, &ndp->channel_queue); + spin_unlock_irqrestore(&ndp->lock, flags); ++ nc->modes[NCSI_MODE_TX_ENABLE].enable = 0; + + return ncsi_process_next_channel(ndp); + } +-- +2.39.2 + diff --git a/queue-5.4/net-sched-act_mirred-add-carrier-check.patch b/queue-5.4/net-sched-act_mirred-add-carrier-check.patch new file mode 100644 index 00000000000..bab4cb7cc30 --- /dev/null +++ b/queue-5.4/net-sched-act_mirred-add-carrier-check.patch @@ -0,0 +1,49 @@ +From c87146535abdaa5985aa1b4b2c48466d899cd5c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Apr 2023 15:19:40 +0000 +Subject: net/sched: act_mirred: Add carrier check + +From: Victor Nogueira + +[ Upstream commit 526f28bd0fbdc699cda31426928802650c1528e5 ] + +There are cases where the device is adminstratively UP, but operationally +down. For example, we have a physical device (Nvidia ConnectX-6 Dx, 25Gbps) +who's cable was pulled out, here is its ip link output: + +5: ens2f1: mtu 1500 qdisc mq state DOWN mode DEFAULT group default qlen 1000 + link/ether b8:ce:f6:4b:68:35 brd ff:ff:ff:ff:ff:ff + altname enp179s0f1np1 + +As you can see, it's administratively UP but operationally down. +In this case, sending a packet to this port caused a nasty kernel hang (so +nasty that we were unable to capture it). Aborting a transmit based on +operational status (in addition to administrative status) fixes the issue. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Acked-by: Jamal Hadi Salim +Signed-off-by: Victor Nogueira +v1->v2: Add fixes tag +v2->v3: Remove blank line between tags + add change log, suggested by Leon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/act_mirred.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c +index b87d2a1ee0b16..e3f28cb03f7e5 100644 +--- a/net/sched/act_mirred.c ++++ b/net/sched/act_mirred.c +@@ -244,7 +244,7 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, + goto out; + } + +- if (unlikely(!(dev->flags & IFF_UP))) { ++ if (unlikely(!(dev->flags & IFF_UP)) || !netif_carrier_ok(dev)) { + net_notice_ratelimited("tc mirred to Houston: device %s is down\n", + dev->name); + goto out; +-- +2.39.2 + diff --git a/queue-5.4/net-sched-cls_api-remove-block_cb-from-driver_list-b.patch b/queue-5.4/net-sched-cls_api-remove-block_cb-from-driver_list-b.patch new file mode 100644 index 00000000000..2a4543c1739 --- /dev/null +++ b/queue-5.4/net-sched-cls_api-remove-block_cb-from-driver_list-b.patch @@ -0,0 +1,192 @@ +From 9f13b88933be2fdb5a7ca17270dbe992c803c782 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Apr 2023 14:31:11 +0200 +Subject: net/sched: cls_api: remove block_cb from driver_list before freeing + +From: Vlad Buslov + +[ Upstream commit da94a7781fc3c92e7df7832bc2746f4d39bc624e ] + +Error handler of tcf_block_bind() frees the whole bo->cb_list on error. +However, by that time the flow_block_cb instances are already in the driver +list because driver ndo_setup_tc() callback is called before that up the +call chain in tcf_block_offload_cmd(). This leaves dangling pointers to +freed objects in the list and causes use-after-free[0]. Fix it by also +removing flow_block_cb instances from driver_list before deallocating them. + +[0]: +[ 279.868433] ================================================================== +[ 279.869964] BUG: KASAN: slab-use-after-free in flow_block_cb_setup_simple+0x631/0x7c0 +[ 279.871527] Read of size 8 at addr ffff888147e2bf20 by task tc/2963 + +[ 279.873151] CPU: 6 PID: 2963 Comm: tc Not tainted 6.3.0-rc6+ #4 +[ 279.874273] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 +[ 279.876295] Call Trace: +[ 279.876882] +[ 279.877413] dump_stack_lvl+0x33/0x50 +[ 279.878198] print_report+0xc2/0x610 +[ 279.878987] ? flow_block_cb_setup_simple+0x631/0x7c0 +[ 279.879994] kasan_report+0xae/0xe0 +[ 279.880750] ? flow_block_cb_setup_simple+0x631/0x7c0 +[ 279.881744] ? mlx5e_tc_reoffload_flows_work+0x240/0x240 [mlx5_core] +[ 279.883047] flow_block_cb_setup_simple+0x631/0x7c0 +[ 279.884027] tcf_block_offload_cmd.isra.0+0x189/0x2d0 +[ 279.885037] ? tcf_block_setup+0x6b0/0x6b0 +[ 279.885901] ? mutex_lock+0x7d/0xd0 +[ 279.886669] ? __mutex_unlock_slowpath.constprop.0+0x2d0/0x2d0 +[ 279.887844] ? ingress_init+0x1c0/0x1c0 [sch_ingress] +[ 279.888846] tcf_block_get_ext+0x61c/0x1200 +[ 279.889711] ingress_init+0x112/0x1c0 [sch_ingress] +[ 279.890682] ? clsact_init+0x2b0/0x2b0 [sch_ingress] +[ 279.891701] qdisc_create+0x401/0xea0 +[ 279.892485] ? qdisc_tree_reduce_backlog+0x470/0x470 +[ 279.893473] tc_modify_qdisc+0x6f7/0x16d0 +[ 279.894344] ? tc_get_qdisc+0xac0/0xac0 +[ 279.895213] ? mutex_lock+0x7d/0xd0 +[ 279.896005] ? __mutex_lock_slowpath+0x10/0x10 +[ 279.896910] rtnetlink_rcv_msg+0x5fe/0x9d0 +[ 279.897770] ? rtnl_calcit.isra.0+0x2b0/0x2b0 +[ 279.898672] ? __sys_sendmsg+0xb5/0x140 +[ 279.899494] ? do_syscall_64+0x3d/0x90 +[ 279.900302] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0 +[ 279.901337] ? kasan_save_stack+0x2e/0x40 +[ 279.902177] ? kasan_save_stack+0x1e/0x40 +[ 279.903058] ? kasan_set_track+0x21/0x30 +[ 279.903913] ? kasan_save_free_info+0x2a/0x40 +[ 279.904836] ? ____kasan_slab_free+0x11a/0x1b0 +[ 279.905741] ? kmem_cache_free+0x179/0x400 +[ 279.906599] netlink_rcv_skb+0x12c/0x360 +[ 279.907450] ? rtnl_calcit.isra.0+0x2b0/0x2b0 +[ 279.908360] ? netlink_ack+0x1550/0x1550 +[ 279.909192] ? rhashtable_walk_peek+0x170/0x170 +[ 279.910135] ? kmem_cache_alloc_node+0x1af/0x390 +[ 279.911086] ? _copy_from_iter+0x3d6/0xc70 +[ 279.912031] netlink_unicast+0x553/0x790 +[ 279.912864] ? netlink_attachskb+0x6a0/0x6a0 +[ 279.913763] ? netlink_recvmsg+0x416/0xb50 +[ 279.914627] netlink_sendmsg+0x7a1/0xcb0 +[ 279.915473] ? netlink_unicast+0x790/0x790 +[ 279.916334] ? iovec_from_user.part.0+0x4d/0x220 +[ 279.917293] ? netlink_unicast+0x790/0x790 +[ 279.918159] sock_sendmsg+0xc5/0x190 +[ 279.918938] ____sys_sendmsg+0x535/0x6b0 +[ 279.919813] ? import_iovec+0x7/0x10 +[ 279.920601] ? kernel_sendmsg+0x30/0x30 +[ 279.921423] ? __copy_msghdr+0x3c0/0x3c0 +[ 279.922254] ? import_iovec+0x7/0x10 +[ 279.923041] ___sys_sendmsg+0xeb/0x170 +[ 279.923854] ? copy_msghdr_from_user+0x110/0x110 +[ 279.924797] ? ___sys_recvmsg+0xd9/0x130 +[ 279.925630] ? __perf_event_task_sched_in+0x183/0x470 +[ 279.926656] ? ___sys_sendmsg+0x170/0x170 +[ 279.927529] ? ctx_sched_in+0x530/0x530 +[ 279.928369] ? update_curr+0x283/0x4f0 +[ 279.929185] ? perf_event_update_userpage+0x570/0x570 +[ 279.930201] ? __fget_light+0x57/0x520 +[ 279.931023] ? __switch_to+0x53d/0xe70 +[ 279.931846] ? sockfd_lookup_light+0x1a/0x140 +[ 279.932761] __sys_sendmsg+0xb5/0x140 +[ 279.933560] ? __sys_sendmsg_sock+0x20/0x20 +[ 279.934436] ? fpregs_assert_state_consistent+0x1d/0xa0 +[ 279.935490] do_syscall_64+0x3d/0x90 +[ 279.936300] entry_SYSCALL_64_after_hwframe+0x46/0xb0 +[ 279.937311] RIP: 0033:0x7f21c814f887 +[ 279.938085] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 +[ 279.941448] RSP: 002b:00007fff11efd478 EFLAGS: 00000246 ORIG_RAX: 000000000000002e +[ 279.942964] RAX: ffffffffffffffda RBX: 0000000064401979 RCX: 00007f21c814f887 +[ 279.944337] RDX: 0000000000000000 RSI: 00007fff11efd4e0 RDI: 0000000000000003 +[ 279.945660] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 +[ 279.947003] R10: 00007f21c8008708 R11: 0000000000000246 R12: 0000000000000001 +[ 279.948345] R13: 0000000000409980 R14: 000000000047e538 R15: 0000000000485400 +[ 279.949690] + +[ 279.950706] Allocated by task 2960: +[ 279.951471] kasan_save_stack+0x1e/0x40 +[ 279.952338] kasan_set_track+0x21/0x30 +[ 279.953165] __kasan_kmalloc+0x77/0x90 +[ 279.954006] flow_block_cb_setup_simple+0x3dd/0x7c0 +[ 279.955001] tcf_block_offload_cmd.isra.0+0x189/0x2d0 +[ 279.956020] tcf_block_get_ext+0x61c/0x1200 +[ 279.956881] ingress_init+0x112/0x1c0 [sch_ingress] +[ 279.957873] qdisc_create+0x401/0xea0 +[ 279.958656] tc_modify_qdisc+0x6f7/0x16d0 +[ 279.959506] rtnetlink_rcv_msg+0x5fe/0x9d0 +[ 279.960392] netlink_rcv_skb+0x12c/0x360 +[ 279.961216] netlink_unicast+0x553/0x790 +[ 279.962044] netlink_sendmsg+0x7a1/0xcb0 +[ 279.962906] sock_sendmsg+0xc5/0x190 +[ 279.963702] ____sys_sendmsg+0x535/0x6b0 +[ 279.964534] ___sys_sendmsg+0xeb/0x170 +[ 279.965343] __sys_sendmsg+0xb5/0x140 +[ 279.966132] do_syscall_64+0x3d/0x90 +[ 279.966908] entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +[ 279.968407] Freed by task 2960: +[ 279.969114] kasan_save_stack+0x1e/0x40 +[ 279.969929] kasan_set_track+0x21/0x30 +[ 279.970729] kasan_save_free_info+0x2a/0x40 +[ 279.971603] ____kasan_slab_free+0x11a/0x1b0 +[ 279.972483] __kmem_cache_free+0x14d/0x280 +[ 279.973337] tcf_block_setup+0x29d/0x6b0 +[ 279.974173] tcf_block_offload_cmd.isra.0+0x226/0x2d0 +[ 279.975186] tcf_block_get_ext+0x61c/0x1200 +[ 279.976080] ingress_init+0x112/0x1c0 [sch_ingress] +[ 279.977065] qdisc_create+0x401/0xea0 +[ 279.977857] tc_modify_qdisc+0x6f7/0x16d0 +[ 279.978695] rtnetlink_rcv_msg+0x5fe/0x9d0 +[ 279.979562] netlink_rcv_skb+0x12c/0x360 +[ 279.980388] netlink_unicast+0x553/0x790 +[ 279.981214] netlink_sendmsg+0x7a1/0xcb0 +[ 279.982043] sock_sendmsg+0xc5/0x190 +[ 279.982827] ____sys_sendmsg+0x535/0x6b0 +[ 279.983703] ___sys_sendmsg+0xeb/0x170 +[ 279.984510] __sys_sendmsg+0xb5/0x140 +[ 279.985298] do_syscall_64+0x3d/0x90 +[ 279.986076] entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +[ 279.987532] The buggy address belongs to the object at ffff888147e2bf00 + which belongs to the cache kmalloc-192 of size 192 +[ 279.989747] The buggy address is located 32 bytes inside of + freed 192-byte region [ffff888147e2bf00, ffff888147e2bfc0) + +[ 279.992367] The buggy address belongs to the physical page: +[ 279.993430] page:00000000550f405c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x147e2a +[ 279.995182] head:00000000550f405c order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0 +[ 279.996713] anon flags: 0x200000000010200(slab|head|node=0|zone=2) +[ 279.997878] raw: 0200000000010200 ffff888100042a00 0000000000000000 dead000000000001 +[ 279.999384] raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 +[ 280.000894] page dumped because: kasan: bad access detected + +[ 280.002386] Memory state around the buggy address: +[ 280.003338] ffff888147e2be00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 280.004781] ffff888147e2be80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc +[ 280.006224] >ffff888147e2bf00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 280.007700] ^ +[ 280.008592] ffff888147e2bf80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc +[ 280.010035] ffff888147e2c000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 280.011564] ================================================================== + +Fixes: 59094b1e5094 ("net: sched: use flow block API") +Signed-off-by: Vlad Buslov +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/cls_api.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c +index 77a1988d5ddc7..49777da9f2634 100644 +--- a/net/sched/cls_api.c ++++ b/net/sched/cls_api.c +@@ -1500,6 +1500,7 @@ static int tcf_block_bind(struct tcf_block *block, + + err_unroll: + list_for_each_entry_safe(block_cb, next, &bo->cb_list, list) { ++ list_del(&block_cb->driver_list); + if (i-- > 0) { + list_del(&block_cb->list); + tcf_block_playback_offloads(block, block_cb->cb, +-- +2.39.2 + diff --git a/queue-5.4/perf-map-delete-two-variable-initialisations-before-.patch b/queue-5.4/perf-map-delete-two-variable-initialisations-before-.patch new file mode 100644 index 00000000000..4d7613d8a87 --- /dev/null +++ b/queue-5.4/perf-map-delete-two-variable-initialisations-before-.patch @@ -0,0 +1,60 @@ +From 526ff192d74f95f742834c0b1118486e00e92e53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 14:46:39 +0200 +Subject: perf map: Delete two variable initialisations before null pointer + checks in sort__sym_from_cmp() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Markus Elfring + +[ Upstream commit c160118a90d4acf335993d8d59b02ae2147a524e ] + +Addresses of two data structure members were determined before +corresponding null pointer checks in the implementation of the function +“sort__sym_from_cmp”. + +Thus avoid the risk for undefined behaviour by removing extra +initialisations for the local variables “from_l” and “from_r” (also +because they were already reassigned with the same value behind this +pointer check). + +This issue was detected by using the Coccinelle software. + +Fixes: 1b9e97a2a95e4941 ("perf tools: Fix report -F symbol_from for data without branch info") +Signed-off-by: +Acked-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: German Gomez +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Link: https://lore.kernel.org/cocci/54a21fea-64e3-de67-82ef-d61b90ffad05@web.de/ +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/sort.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c +index 4027906fd3e38..baf73ca66a2bd 100644 +--- a/tools/perf/util/sort.c ++++ b/tools/perf/util/sort.c +@@ -830,8 +830,7 @@ static int hist_entry__dso_to_filter(struct hist_entry *he, int type, + static int64_t + sort__sym_from_cmp(struct hist_entry *left, struct hist_entry *right) + { +- struct addr_map_symbol *from_l = &left->branch_info->from; +- struct addr_map_symbol *from_r = &right->branch_info->from; ++ struct addr_map_symbol *from_l, *from_r; + + if (!left->branch_info || !right->branch_info) + return cmp_null(left->branch_info, right->branch_info); +-- +2.39.2 + diff --git a/queue-5.4/perf-symbols-fix-return-incorrect-build_id-size-in-e.patch b/queue-5.4/perf-symbols-fix-return-incorrect-build_id-size-in-e.patch new file mode 100644 index 00000000000..93d761b73c8 --- /dev/null +++ b/queue-5.4/perf-symbols-fix-return-incorrect-build_id-size-in-e.patch @@ -0,0 +1,52 @@ +From aed5aa48e69b028fcad747d4afef490569eed2b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Apr 2023 01:28:41 +0000 +Subject: perf symbols: Fix return incorrect build_id size in + elf_read_build_id() + +From: Yang Jihong + +[ Upstream commit 1511e4696acb715a4fe48be89e1e691daec91c0e ] + +In elf_read_build_id(), if gnu build_id is found, should return the size of +the actually copied data. If descsz is greater thanBuild_ID_SIZE, +write_buildid data access may occur. + +Fixes: be96ea8ffa788dcc ("perf symbols: Fix issue with binaries using 16-bytes buildids (v2)") +Reported-by: Will Ochowicz +Signed-off-by: Yang Jihong +Tested-by: Will Ochowicz +Acked-by: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Leo Yan +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Stephane Eranian +Link: https://lore.kernel.org/lkml/CWLP265MB49702F7BA3D6D8F13E4B1A719C649@CWLP265MB4970.GBRP265.PROD.OUTLOOK.COM/T/ +Link: https://lore.kernel.org/r/20230427012841.231729-1-yangjihong1@huawei.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/symbol-elf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c +index 4fef8d6bc2255..73f890664be5e 100644 +--- a/tools/perf/util/symbol-elf.c ++++ b/tools/perf/util/symbol-elf.c +@@ -546,7 +546,7 @@ static int elf_read_build_id(Elf *elf, void *bf, size_t size) + size_t sz = min(size, descsz); + memcpy(bf, ptr, sz); + memset(bf + sz, 0, size - sz); +- err = descsz; ++ err = sz; + break; + } + } +-- +2.39.2 + diff --git a/queue-5.4/perf-vendor-events-power9-remove-utf-8-characters-fr.patch b/queue-5.4/perf-vendor-events-power9-remove-utf-8-characters-fr.patch new file mode 100644 index 00000000000..2c52006a7cd --- /dev/null +++ b/queue-5.4/perf-vendor-events-power9-remove-utf-8-characters-fr.patch @@ -0,0 +1,108 @@ +From 63f82559e54c7e5682cb44b6fa5e38d694111c8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 16:59:08 +0530 +Subject: perf vendor events power9: Remove UTF-8 characters from JSON files + +From: Kajol Jain + +[ Upstream commit 5d9df8731c0941f3add30f96745a62586a0c9d52 ] + +Commit 3c22ba5243040c13 ("perf vendor events powerpc: Update POWER9 +events") added and updated power9 PMU JSON events. However some of the +JSON events which are part of other.json and pipeline.json files, +contains UTF-8 characters in their brief description. Having UTF-8 +character could breaks the perf build on some distros. + +Fix this issue by removing the UTF-8 characters from other.json and +pipeline.json files. + +Result without the fix: + + [command]# file -i pmu-events/arch/powerpc/power9/* + pmu-events/arch/powerpc/power9/cache.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/floating-point.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/frontend.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/marked.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/memory.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/metrics.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/nest_metrics.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/other.json: application/json; charset=utf-8 + pmu-events/arch/powerpc/power9/pipeline.json: application/json; charset=utf-8 + pmu-events/arch/powerpc/power9/pmc.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/translation.json: application/json; charset=us-ascii + [command]# + +Result with the fix: + + [command]# file -i pmu-events/arch/powerpc/power9/* + pmu-events/arch/powerpc/power9/cache.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/floating-point.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/frontend.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/marked.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/memory.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/metrics.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/nest_metrics.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/other.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/pipeline.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/pmc.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/translation.json: application/json; charset=us-ascii + [command]# + +Fixes: 3c22ba5243040c13 ("perf vendor events powerpc: Update POWER9 events") +Reported-by: Arnaldo Carvalho de Melo +Signed-off-by: Kajol Jain +Acked-by: Ian Rogers +Tested-by: Arnaldo Carvalho de Melo +Cc: Athira Rajeev +Cc: Disha Goel +Cc: Jiri Olsa +Cc: Madhavan Srinivasan +Cc: Sukadev Bhattiprolu +Cc: linuxppc-dev@lists.ozlabs.org +Link: https://lore.kernel.org/lkml/ZBxP77deq7ikTxwG@kernel.org/ +Link: https://lore.kernel.org/r/20230328112908.113158-1-kjain@linux.ibm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/pmu-events/arch/powerpc/power9/other.json | 4 ++-- + tools/perf/pmu-events/arch/powerpc/power9/pipeline.json | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/pmu-events/arch/powerpc/power9/other.json b/tools/perf/pmu-events/arch/powerpc/power9/other.json +index 62b8642696237..ce75652e90516 100644 +--- a/tools/perf/pmu-events/arch/powerpc/power9/other.json ++++ b/tools/perf/pmu-events/arch/powerpc/power9/other.json +@@ -1417,7 +1417,7 @@ + {, + "EventCode": "0x45054", + "EventName": "PM_FMA_CMPL", +- "BriefDescription": "two flops operation completed (fmadd, fnmadd, fmsub, fnmsub) Scalar instructions only. " ++ "BriefDescription": "two flops operation completed (fmadd, fnmadd, fmsub, fnmsub) Scalar instructions only." + }, + {, + "EventCode": "0x201E8", +@@ -2017,7 +2017,7 @@ + {, + "EventCode": "0xC0BC", + "EventName": "PM_LSU_FLUSH_OTHER", +- "BriefDescription": "Other LSU flushes including: Sync (sync ack from L2 caused search of LRQ for oldest snooped load, This will either signal a Precise Flush of the oldest snooped loa or a Flush Next PPC); Data Valid Flush Next (several cases of this, one example is store and reload are lined up such that a store-hit-reload scenario exists and the CDF has already launched and has gotten bad/stale data); Bad Data Valid Flush Next (might be a few cases of this, one example is a larxa (D$ hit) return data and dval but can't allocate to LMQ (LMQ full or other reason). Already gave dval but can't watch it for snoop_hit_larx. Need to take the “bad dval” back and flush all younger ops)" ++ "BriefDescription": "Other LSU flushes including: Sync (sync ack from L2 caused search of LRQ for oldest snooped load, This will either signal a Precise Flush of the oldest snooped loa or a Flush Next PPC); Data Valid Flush Next (several cases of this, one example is store and reload are lined up such that a store-hit-reload scenario exists and the CDF has already launched and has gotten bad/stale data); Bad Data Valid Flush Next (might be a few cases of this, one example is a larxa (D$ hit) return data and dval but can't allocate to LMQ (LMQ full or other reason). Already gave dval but can't watch it for snoop_hit_larx. Need to take the 'bad dval' back and flush all younger ops)" + }, + {, + "EventCode": "0x5094", +diff --git a/tools/perf/pmu-events/arch/powerpc/power9/pipeline.json b/tools/perf/pmu-events/arch/powerpc/power9/pipeline.json +index b4772f54a2718..e2f2ed0a35496 100644 +--- a/tools/perf/pmu-events/arch/powerpc/power9/pipeline.json ++++ b/tools/perf/pmu-events/arch/powerpc/power9/pipeline.json +@@ -442,7 +442,7 @@ + {, + "EventCode": "0x4D052", + "EventName": "PM_2FLOP_CMPL", +- "BriefDescription": "DP vector version of fmul, fsub, fcmp, fsel, fabs, fnabs, fres ,fsqrte, fneg " ++ "BriefDescription": "DP vector version of fmul, fsub, fcmp, fsel, fabs, fnabs, fres ,fsqrte, fneg" + }, + {, + "EventCode": "0x1F142", +-- +2.39.2 + diff --git a/queue-5.4/rxrpc-fix-hard-call-timeout-units.patch b/queue-5.4/rxrpc-fix-hard-call-timeout-units.patch new file mode 100644 index 00000000000..26e4baf6d90 --- /dev/null +++ b/queue-5.4/rxrpc-fix-hard-call-timeout-units.patch @@ -0,0 +1,45 @@ +From 3a83354ed157ee493a0b884151a61f919d5156c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Apr 2023 21:27:54 +0100 +Subject: rxrpc: Fix hard call timeout units + +From: David Howells + +[ Upstream commit 0d098d83c5d9e107b2df7f5e11f81492f56d2fe7 ] + +The hard call timeout is specified in the RXRPC_SET_CALL_TIMEOUT cmsg in +seconds, so fix the point at which sendmsg() applies it to the call to +convert to jiffies from seconds, not milliseconds. + +Fixes: a158bdd3247b ("rxrpc: Fix timeout of a call that hasn't yet been granted a channel") +Signed-off-by: David Howells +cc: Marc Dionne +cc: "David S. Miller" +cc: Eric Dumazet +cc: Jakub Kicinski +cc: Paolo Abeni +cc: linux-afs@lists.infradead.org +cc: netdev@vger.kernel.org +cc: linux-kernel@vger.kernel.org +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/rxrpc/sendmsg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c +index 1cb90d32d553d..3439d14168e81 100644 +--- a/net/rxrpc/sendmsg.c ++++ b/net/rxrpc/sendmsg.c +@@ -738,7 +738,7 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len) + /* Fall through */ + case 1: + if (p.call.timeouts.hard > 0) { +- j = msecs_to_jiffies(p.call.timeouts.hard); ++ j = p.call.timeouts.hard * HZ; + now = jiffies; + j += now; + WRITE_ONCE(call->expect_term_by, j); +-- +2.39.2 + diff --git a/queue-5.4/series b/queue-5.4/series index 6d6f0105f59..985a11c85ed 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -219,3 +219,21 @@ crypto-inside-secure-irq-balance.patch crypto-safexcel-cleanup-ring-irq-workqueues-on-load-.patch kernel-relay.c-fix-read_pos-error-when-multiple-read.patch relayfs-fix-out-of-bounds-access-in-relay_file_read.patch +net-ncsi-clear-tx-enable-mode-when-handling-a-config.patch +net-sched-cls_api-remove-block_cb-from-driver_list-b.patch +sit-update-dev-needed_headroom-in-ipip6_tunnel_bind_.patch +net-dsa-mv88e6xxx-add-mv88e6321-rsvd2cpu.patch +writeback-fix-call-of-incorrect-macro.patch +net-sched-act_mirred-add-carrier-check.patch +rxrpc-fix-hard-call-timeout-units.patch +ionic-remove-noise-from-ethtool-rxnfc-error-msg.patch +af_packet-don-t-send-zero-byte-data-in-packet_sendms.patch +drm-amdgpu-add-a-missing-lock-for-amdgpu_sched.patch +alsa-caiaq-input-add-error-handling-for-unsupported-.patch +net-dsa-mt7530-fix-corrupt-frames-using-trgmii-on-40.patch +virtio_net-split-free_unused_bufs.patch +virtio_net-suppress-cpu-stall-when-free_unused_bufs.patch +net-bcmgenet-remove-phy_stop-from-bcmgenet_netif_sto.patch +perf-vendor-events-power9-remove-utf-8-characters-fr.patch +perf-map-delete-two-variable-initialisations-before-.patch +perf-symbols-fix-return-incorrect-build_id-size-in-e.patch diff --git a/queue-5.4/sit-update-dev-needed_headroom-in-ipip6_tunnel_bind_.patch b/queue-5.4/sit-update-dev-needed_headroom-in-ipip6_tunnel_bind_.patch new file mode 100644 index 00000000000..8b10bf9c304 --- /dev/null +++ b/queue-5.4/sit-update-dev-needed_headroom-in-ipip6_tunnel_bind_.patch @@ -0,0 +1,69 @@ +From 7466e9d6e42c6335577dbc6ead4d248cc3ad9e1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Apr 2023 23:00:06 -0700 +Subject: sit: update dev->needed_headroom in ipip6_tunnel_bind_dev() + +From: Cong Wang + +[ Upstream commit c88f8d5cd95fd039cff95d682b8e71100c001df0 ] + +When a tunnel device is bound with the underlying device, its +dev->needed_headroom needs to be updated properly. IPv4 tunnels +already do the same in ip_tunnel_bind_dev(). Otherwise we may +not have enough header room for skb, especially after commit +b17f709a2401 ("gue: TX support for using remote checksum offload option"). + +Fixes: 32b8a8e59c9c ("sit: add IPv4 over IPv4 support") +Reported-by: Palash Oswal +Link: https://lore.kernel.org/netdev/CAGyP=7fDcSPKu6nttbGwt7RXzE3uyYxLjCSE97J64pRxJP8jPA@mail.gmail.com/ +Cc: Kuniyuki Iwashima +Cc: Eric Dumazet +Signed-off-by: Cong Wang +Reviewed-by: Eric Dumazet +Reviewed-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv6/sit.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c +index 1179608955f5f..8d704ea946933 100644 +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -1054,12 +1054,13 @@ static netdev_tx_t sit_tunnel_xmit(struct sk_buff *skb, + + static void ipip6_tunnel_bind_dev(struct net_device *dev) + { ++ struct ip_tunnel *tunnel = netdev_priv(dev); ++ int t_hlen = tunnel->hlen + sizeof(struct iphdr); + struct net_device *tdev = NULL; +- struct ip_tunnel *tunnel; ++ int hlen = LL_MAX_HEADER; + const struct iphdr *iph; + struct flowi4 fl4; + +- tunnel = netdev_priv(dev); + iph = &tunnel->parms.iph; + + if (iph->daddr) { +@@ -1082,14 +1083,15 @@ static void ipip6_tunnel_bind_dev(struct net_device *dev) + tdev = __dev_get_by_index(tunnel->net, tunnel->parms.link); + + if (tdev && !netif_is_l3_master(tdev)) { +- int t_hlen = tunnel->hlen + sizeof(struct iphdr); + int mtu; + + mtu = tdev->mtu - t_hlen; + if (mtu < IPV6_MIN_MTU) + mtu = IPV6_MIN_MTU; + WRITE_ONCE(dev->mtu, mtu); ++ hlen = tdev->hard_header_len + tdev->needed_headroom; + } ++ dev->needed_headroom = t_hlen + hlen; + } + + static void ipip6_tunnel_update(struct ip_tunnel *t, struct ip_tunnel_parm *p, +-- +2.39.2 + diff --git a/queue-5.4/virtio_net-split-free_unused_bufs.patch b/queue-5.4/virtio_net-split-free_unused_bufs.patch new file mode 100644 index 00000000000..0b01db5c11b --- /dev/null +++ b/queue-5.4/virtio_net-split-free_unused_bufs.patch @@ -0,0 +1,91 @@ +From 5826b68cbfa056c8eb6e4cfedbceedd1db3ead23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Aug 2022 14:38:59 +0800 +Subject: virtio_net: split free_unused_bufs() + +From: Xuan Zhuo + +[ Upstream commit 6e345f8c7cd029ad3aaece15ad4425ac26e4eb63 ] + +This patch separates two functions for freeing sq buf and rq buf from +free_unused_bufs(). + +When supporting the enable/disable tx/rq queue in the future, it is +necessary to support separate recovery of a sq buf or a rq buf. + +Signed-off-by: Xuan Zhuo +Acked-by: Jason Wang +Message-Id: <20220801063902.129329-40-xuanzhuo@linux.alibaba.com> +Signed-off-by: Michael S. Tsirkin +Stable-dep-of: f8bb51043945 ("virtio_net: suppress cpu stall when free_unused_bufs") +Signed-off-by: Sasha Levin +--- + drivers/net/virtio_net.c | 41 ++++++++++++++++++++++++---------------- + 1 file changed, 25 insertions(+), 16 deletions(-) + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 59d4449450ee8..b77181f04b119 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -2792,6 +2792,27 @@ static void free_receive_page_frags(struct virtnet_info *vi) + put_page(vi->rq[i].alloc_frag.page); + } + ++static void virtnet_sq_free_unused_buf(struct virtqueue *vq, void *buf) ++{ ++ if (!is_xdp_frame(buf)) ++ dev_kfree_skb(buf); ++ else ++ xdp_return_frame(ptr_to_xdp(buf)); ++} ++ ++static void virtnet_rq_free_unused_buf(struct virtqueue *vq, void *buf) ++{ ++ struct virtnet_info *vi = vq->vdev->priv; ++ int i = vq2rxq(vq); ++ ++ if (vi->mergeable_rx_bufs) ++ put_page(virt_to_head_page(buf)); ++ else if (vi->big_packets) ++ give_pages(&vi->rq[i], buf); ++ else ++ put_page(virt_to_head_page(buf)); ++} ++ + static void free_unused_bufs(struct virtnet_info *vi) + { + void *buf; +@@ -2799,26 +2820,14 @@ static void free_unused_bufs(struct virtnet_info *vi) + + for (i = 0; i < vi->max_queue_pairs; i++) { + struct virtqueue *vq = vi->sq[i].vq; +- while ((buf = virtqueue_detach_unused_buf(vq)) != NULL) { +- if (!is_xdp_frame(buf)) +- dev_kfree_skb(buf); +- else +- xdp_return_frame(ptr_to_xdp(buf)); +- } ++ while ((buf = virtqueue_detach_unused_buf(vq)) != NULL) ++ virtnet_sq_free_unused_buf(vq, buf); + } + + for (i = 0; i < vi->max_queue_pairs; i++) { + struct virtqueue *vq = vi->rq[i].vq; +- +- while ((buf = virtqueue_detach_unused_buf(vq)) != NULL) { +- if (vi->mergeable_rx_bufs) { +- put_page(virt_to_head_page(buf)); +- } else if (vi->big_packets) { +- give_pages(&vi->rq[i], buf); +- } else { +- put_page(virt_to_head_page(buf)); +- } +- } ++ while ((buf = virtqueue_detach_unused_buf(vq)) != NULL) ++ virtnet_rq_free_unused_buf(vq, buf); + } + } + +-- +2.39.2 + diff --git a/queue-5.4/virtio_net-suppress-cpu-stall-when-free_unused_bufs.patch b/queue-5.4/virtio_net-suppress-cpu-stall-when-free_unused_bufs.patch new file mode 100644 index 00000000000..2f45924f12b --- /dev/null +++ b/queue-5.4/virtio_net-suppress-cpu-stall-when-free_unused_bufs.patch @@ -0,0 +1,44 @@ +From b8974557fe2a5ceb5f01441d8a993eb39e9cc472 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 May 2023 10:27:06 +0800 +Subject: virtio_net: suppress cpu stall when free_unused_bufs + +From: Wenliang Wang + +[ Upstream commit f8bb5104394560e29017c25bcade4c6b7aabd108 ] + +For multi-queue and large ring-size use case, the following error +occurred when free_unused_bufs: +rcu: INFO: rcu_sched self-detected stall on CPU. + +Fixes: 986a4f4d452d ("virtio_net: multiqueue support") +Signed-off-by: Wenliang Wang +Acked-by: Michael S. Tsirkin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/virtio_net.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index b77181f04b119..7922e833620e8 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -2822,12 +2822,14 @@ static void free_unused_bufs(struct virtnet_info *vi) + struct virtqueue *vq = vi->sq[i].vq; + while ((buf = virtqueue_detach_unused_buf(vq)) != NULL) + virtnet_sq_free_unused_buf(vq, buf); ++ cond_resched(); + } + + for (i = 0; i < vi->max_queue_pairs; i++) { + struct virtqueue *vq = vi->rq[i].vq; + while ((buf = virtqueue_detach_unused_buf(vq)) != NULL) + virtnet_rq_free_unused_buf(vq, buf); ++ cond_resched(); + } + } + +-- +2.39.2 + diff --git a/queue-5.4/writeback-fix-call-of-incorrect-macro.patch b/queue-5.4/writeback-fix-call-of-incorrect-macro.patch new file mode 100644 index 00000000000..61569f7ca43 --- /dev/null +++ b/queue-5.4/writeback-fix-call-of-incorrect-macro.patch @@ -0,0 +1,41 @@ +From f8c3f8b3bb16637f40ba9f7e7ab2dea3ce60ee92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jan 2023 13:44:43 +0300 +Subject: writeback: fix call of incorrect macro + +From: Maxim Korotkov + +[ Upstream commit 3e46c89c74f2c38e5337d2cf44b0b551adff1cb4 ] + + the variable 'history' is of type u16, it may be an error + that the hweight32 macro was used for it + I guess macro hweight16 should be used + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 2a81490811d0 ("writeback: implement foreign cgroup inode detection") +Signed-off-by: Maxim Korotkov +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20230119104443.3002-1-korotkov.maxim.s@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + fs/fs-writeback.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c +index 5b3a288e0f14b..3ec2c16abece3 100644 +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -700,7 +700,7 @@ void wbc_detach_inode(struct writeback_control *wbc) + * is okay. The main goal is avoiding keeping an inode on + * the wrong wb for an extended period of time. + */ +- if (hweight32(history) > WB_FRN_HIST_THR_SLOTS) ++ if (hweight16(history) > WB_FRN_HIST_THR_SLOTS) + inode_switch_wbs(inode, max_id); + } + +-- +2.39.2 +