From: Sasha Levin Date: Sun, 18 Jun 2023 14:10:51 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v4.14.319~36 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6419eb8ce1117e8a7310c3a35fade1b595ed29e8;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/afs-fix-vlserver-probe-rtt-handling.patch b/queue-5.4/afs-fix-vlserver-probe-rtt-handling.patch new file mode 100644 index 00000000000..a4e330df0dc --- /dev/null +++ b/queue-5.4/afs-fix-vlserver-probe-rtt-handling.patch @@ -0,0 +1,48 @@ +From 96a38d8932fdf92f0eda941727d5dabf28b82683 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jun 2023 22:39:39 +0100 +Subject: afs: Fix vlserver probe RTT handling + +From: David Howells + +[ Upstream commit ba00b190670809c1a89326d80de96d714f6004f2 ] + +In the same spirit as commit ca57f02295f1 ("afs: Fix fileserver probe +RTT handling"), don't rule out using a vlserver just because there +haven't been enough packets yet to calculate a real rtt. Always set the +server's probe rtt from the estimate provided by rxrpc_kernel_get_srtt, +which is capped at 1 second. + +This could lead to EDESTADDRREQ errors when accessing a cell for the +first time, even though the vl servers are known and have responded to a +probe. + +Fixes: 1d4adfaf6574 ("rxrpc: Make rxrpc_kernel_get_srtt() indicate validity") +Signed-off-by: Marc Dionne +Signed-off-by: David Howells +cc: linux-afs@lists.infradead.org +Link: http://lists.infradead.org/pipermail/linux-afs/2023-June/006746.html +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/afs/vl_probe.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/afs/vl_probe.c b/fs/afs/vl_probe.c +index 081b7e5b13f58..163069d9fc161 100644 +--- a/fs/afs/vl_probe.c ++++ b/fs/afs/vl_probe.c +@@ -92,8 +92,8 @@ void afs_vlserver_probe_result(struct afs_call *call) + } + } + +- if (rxrpc_kernel_get_srtt(call->net->socket, call->rxcall, &rtt_us) && +- rtt_us < server->probe.rtt) { ++ rxrpc_kernel_get_srtt(call->net->socket, call->rxcall, &rtt_us); ++ if (rtt_us < server->probe.rtt) { + server->probe.rtt = rtt_us; + alist->preferred = index; + have_result = true; +-- +2.39.2 + diff --git a/queue-5.4/drm-nouveau-add-nv_encoder-pointer-check-for-null.patch b/queue-5.4/drm-nouveau-add-nv_encoder-pointer-check-for-null.patch new file mode 100644 index 00000000000..2462dc8c890 --- /dev/null +++ b/queue-5.4/drm-nouveau-add-nv_encoder-pointer-check-for-null.patch @@ -0,0 +1,43 @@ +From 5d06b3dca71efae7082397676711792a1f03dbda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 May 2023 13:33:20 +0300 +Subject: drm/nouveau: add nv_encoder pointer check for NULL + +From: Natalia Petrova + +[ Upstream commit 55b94bb8c42464bad3d2217f6874aa1a85664eac ] + +Pointer nv_encoder could be dereferenced at nouveau_connector.c +in case it's equal to NULL by jumping to goto label. +This patch adds a NULL-check to avoid it. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 3195c5f9784a ("drm/nouveau: set encoder for lvds") +Signed-off-by: Natalia Petrova +Reviewed-by: Lyude Paul +[Fixed patch title] +Signed-off-by: Lyude Paul +Link: https://patchwork.freedesktop.org/patch/msgid/20230512103320.82234-1-n.petrova@fintech.ru +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nouveau_connector.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c +index 048a04701910e..85a20fe2709af 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_connector.c ++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c +@@ -730,7 +730,8 @@ nouveau_connector_detect_lvds(struct drm_connector *connector, bool force) + #endif + + nouveau_connector_set_edid(nv_connector, edid); +- nouveau_connector_set_encoder(connector, nv_encoder); ++ if (nv_encoder) ++ nouveau_connector_set_encoder(connector, nv_encoder); + return status; + } + +-- +2.39.2 + diff --git a/queue-5.4/drm-nouveau-dp-check-for-null-nv_connector-native_mo.patch b/queue-5.4/drm-nouveau-dp-check-for-null-nv_connector-native_mo.patch new file mode 100644 index 00000000000..7b1eb220100 --- /dev/null +++ b/queue-5.4/drm-nouveau-dp-check-for-null-nv_connector-native_mo.patch @@ -0,0 +1,53 @@ +From bb3292469f9b442cc92b33e4b6425bd6e263757f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 May 2023 14:15:26 +0300 +Subject: drm/nouveau/dp: check for NULL nv_connector->native_mode + +From: Natalia Petrova + +[ Upstream commit 20a2ce87fbaf81e4c3dcb631d738e423959eb320 ] + +Add checking for NULL before calling nouveau_connector_detect_depth() in +nouveau_connector_get_modes() function because nv_connector->native_mode +could be dereferenced there since connector pointer passed to +nouveau_connector_detect_depth() and the same value of +nv_connector->native_mode is used there. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: d4c2c99bdc83 ("drm/nouveau/dp: remove broken display depth function, use the improved one") + +Signed-off-by: Natalia Petrova +Reviewed-by: Lyude Paul +Signed-off-by: Lyude Paul +Link: https://patchwork.freedesktop.org/patch/msgid/20230512111526.82408-1-n.petrova@fintech.ru +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nouveau_connector.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c +index 496e7dcd6b7dc..18c3aae91be26 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_connector.c ++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c +@@ -950,7 +950,7 @@ nouveau_connector_get_modes(struct drm_connector *connector) + /* Determine display colour depth for everything except LVDS now, + * DP requires this before mode_valid() is called. + */ +- if (connector->connector_type != DRM_MODE_CONNECTOR_LVDS) ++ if (connector->connector_type != DRM_MODE_CONNECTOR_LVDS && nv_connector->native_mode) + nouveau_connector_detect_depth(connector); + + /* Find the native mode if this is a digital panel, if we didn't +@@ -971,7 +971,7 @@ nouveau_connector_get_modes(struct drm_connector *connector) + * "native" mode as some VBIOS tables require us to use the + * pixel clock as part of the lookup... + */ +- if (connector->connector_type == DRM_MODE_CONNECTOR_LVDS) ++ if (connector->connector_type == DRM_MODE_CONNECTOR_LVDS && nv_connector->native_mode) + nouveau_connector_detect_depth(connector); + + if (nv_encoder->dcb->type == DCB_OUTPUT_TV) +-- +2.39.2 + diff --git a/queue-5.4/drm-nouveau-kms-don-t-change-edid-when-it-hasn-t-act.patch b/queue-5.4/drm-nouveau-kms-don-t-change-edid-when-it-hasn-t-act.patch new file mode 100644 index 00000000000..0089bca62c0 --- /dev/null +++ b/queue-5.4/drm-nouveau-kms-don-t-change-edid-when-it-hasn-t-act.patch @@ -0,0 +1,168 @@ +From d19b08afe48fc6406fb60114009960985633081d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 14:24:54 -0400 +Subject: drm/nouveau/kms: Don't change EDID when it hasn't actually changed + +From: Lyude Paul + +[ Upstream commit f28e32d3906eac2e1cb3291b448f0d528ec93996 ] + +Currently in nouveau_connector_ddc_detect() and +nouveau_connector_detect_lvds(), we start the connector probing process +by releasing the previous EDID and informing DRM of the change. However, +since commit 5186421cbfe2 ("drm: Introduce epoch counter to +drm_connector") drm_connector_update_edid_property() actually checks +whether the new EDID we've specified is different from the previous one, +and updates the connector's epoch accordingly if it is. But, because we +always set the EDID to NULL first in nouveau_connector_ddc_detect() and +nouveau_connector_detect_lvds() we end up making DRM think that the EDID +changes every single time we do a connector probe - which isn't needed. + +So, let's fix this by not clearing the EDID at the start of the +connector probing process, and instead simply changing or removing it +once near the end of the probing process. This will help prevent us from +sending unneeded hotplug events to userspace when nothing has actually +changed. + +Signed-off-by: Lyude Paul +Reviewed-by: Ben Skeggs +Link: https://patchwork.freedesktop.org/patch/msgid/20200826182456.322681-19-lyude@redhat.com +Stable-dep-of: 55b94bb8c424 ("drm/nouveau: add nv_encoder pointer check for NULL") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nouveau_connector.c | 54 ++++++++++----------- + 1 file changed, 27 insertions(+), 27 deletions(-) + +diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c +index 18c3aae91be26..048a04701910e 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_connector.c ++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c +@@ -538,6 +538,17 @@ nouveau_connector_set_encoder(struct drm_connector *connector, + } + } + ++static void ++nouveau_connector_set_edid(struct nouveau_connector *nv_connector, ++ struct edid *edid) ++{ ++ struct edid *old_edid = nv_connector->edid; ++ ++ drm_connector_update_edid_property(&nv_connector->base, edid); ++ kfree(old_edid); ++ nv_connector->edid = edid; ++} ++ + static enum drm_connector_status + nouveau_connector_detect(struct drm_connector *connector, bool force) + { +@@ -551,13 +562,6 @@ nouveau_connector_detect(struct drm_connector *connector, bool force) + int ret; + enum drm_connector_status conn_status = connector_status_disconnected; + +- /* Cleanup the previous EDID block. */ +- if (nv_connector->edid) { +- drm_connector_update_edid_property(connector, NULL); +- kfree(nv_connector->edid); +- nv_connector->edid = NULL; +- } +- + /* Outputs are only polled while runtime active, so resuming the + * device here is unnecessary (and would deadlock upon runtime suspend + * because it waits for polling to finish). We do however, want to +@@ -570,22 +574,23 @@ nouveau_connector_detect(struct drm_connector *connector, bool force) + ret = pm_runtime_get_sync(dev->dev); + if (ret < 0 && ret != -EACCES) { + pm_runtime_put_autosuspend(dev->dev); ++ nouveau_connector_set_edid(nv_connector, NULL); + return conn_status; + } + } + + nv_encoder = nouveau_connector_ddc_detect(connector); + if (nv_encoder && (i2c = nv_encoder->i2c) != NULL) { ++ struct edid *new_edid; ++ + if ((vga_switcheroo_handler_flags() & + VGA_SWITCHEROO_CAN_SWITCH_DDC) && + nv_connector->type == DCB_CONNECTOR_LVDS) +- nv_connector->edid = drm_get_edid_switcheroo(connector, +- i2c); ++ new_edid = drm_get_edid_switcheroo(connector, i2c); + else +- nv_connector->edid = drm_get_edid(connector, i2c); ++ new_edid = drm_get_edid(connector, i2c); + +- drm_connector_update_edid_property(connector, +- nv_connector->edid); ++ nouveau_connector_set_edid(nv_connector, new_edid); + if (!nv_connector->edid) { + NV_ERROR(drm, "DDC responded, but no EDID for %s\n", + connector->name); +@@ -619,6 +624,8 @@ nouveau_connector_detect(struct drm_connector *connector, bool force) + conn_status = connector_status_connected; + drm_dp_cec_set_edid(&nv_connector->aux, nv_connector->edid); + goto out; ++ } else { ++ nouveau_connector_set_edid(nv_connector, NULL); + } + + nv_encoder = nouveau_connector_of_detect(connector); +@@ -661,18 +668,12 @@ nouveau_connector_detect_lvds(struct drm_connector *connector, bool force) + struct nouveau_drm *drm = nouveau_drm(dev); + struct nouveau_connector *nv_connector = nouveau_connector(connector); + struct nouveau_encoder *nv_encoder = NULL; ++ struct edid *edid = NULL; + enum drm_connector_status status = connector_status_disconnected; + +- /* Cleanup the previous EDID block. */ +- if (nv_connector->edid) { +- drm_connector_update_edid_property(connector, NULL); +- kfree(nv_connector->edid); +- nv_connector->edid = NULL; +- } +- + nv_encoder = find_encoder(connector, DCB_OUTPUT_LVDS); + if (!nv_encoder) +- return connector_status_disconnected; ++ goto out; + + /* Try retrieving EDID via DDC */ + if (!drm->vbios.fp_no_ddc) { +@@ -691,7 +692,8 @@ nouveau_connector_detect_lvds(struct drm_connector *connector, bool force) + * valid - it's not (rh#613284) + */ + if (nv_encoder->dcb->lvdsconf.use_acpi_for_edid) { +- if ((nv_connector->edid = nouveau_acpi_edid(dev, connector))) { ++ edid = nouveau_acpi_edid(dev, connector); ++ if (edid) { + status = connector_status_connected; + goto out; + } +@@ -711,12 +713,10 @@ nouveau_connector_detect_lvds(struct drm_connector *connector, bool force) + * stored for the panel stored in them. + */ + if (!drm->vbios.fp_no_ddc) { +- struct edid *edid = +- (struct edid *)nouveau_bios_embedded_edid(dev); ++ edid = (struct edid *)nouveau_bios_embedded_edid(dev); + if (edid) { +- nv_connector->edid = +- kmemdup(edid, EDID_LENGTH, GFP_KERNEL); +- if (nv_connector->edid) ++ edid = kmemdup(edid, EDID_LENGTH, GFP_KERNEL); ++ if (edid) + status = connector_status_connected; + } + } +@@ -729,7 +729,7 @@ nouveau_connector_detect_lvds(struct drm_connector *connector, bool force) + status = connector_status_unknown; + #endif + +- drm_connector_update_edid_property(connector, nv_connector->edid); ++ nouveau_connector_set_edid(nv_connector, edid); + nouveau_connector_set_encoder(connector, nv_encoder); + return status; + } +-- +2.39.2 + diff --git a/queue-5.4/iavf-remove-mask-from-iavf_irq_enable_queues.patch b/queue-5.4/iavf-remove-mask-from-iavf_irq_enable_queues.patch new file mode 100644 index 00000000000..937484e8017 --- /dev/null +++ b/queue-5.4/iavf-remove-mask-from-iavf_irq_enable_queues.patch @@ -0,0 +1,103 @@ +From 6b309e5dee21877bc6a9a9451298009dbbea9c05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jun 2023 13:02:26 -0700 +Subject: iavf: remove mask from iavf_irq_enable_queues() + +From: Ahmed Zaki + +[ Upstream commit c37cf54c12cfaa51e7aaf88708167b0d3259e64e ] + +Enable more than 32 IRQs by removing the u32 bit mask in +iavf_irq_enable_queues(). There is no need for the mask as there are no +callers that select individual IRQs through the bitmask. Also, if the PF +allocates more than 32 IRQs, this mask will prevent us from using all of +them. + +Modify the comment in iavf_register.h to show that the maximum number +allowed for the IRQ index is 63 as per the iAVF standard 1.0 [1]. + +link: [1] https://www.intel.com/content/dam/www/public/us/en/documents/product-specifications/ethernet-adaptive-virtual-function-hardware-spec.pdf +Fixes: 5eae00c57f5e ("i40evf: main driver core") +Signed-off-by: Ahmed Zaki +Tested-by: Rafal Romanowski +Reviewed-by: Simon Horman +Reviewed-by: Maciej Fijalkowski +Signed-off-by: Tony Nguyen +Link: https://lore.kernel.org/r/20230608200226.451861-1-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf.h | 2 +- + drivers/net/ethernet/intel/iavf/iavf_main.c | 15 ++++++--------- + drivers/net/ethernet/intel/iavf/iavf_register.h | 2 +- + 3 files changed, 8 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf.h b/drivers/net/ethernet/intel/iavf/iavf.h +index 85275b6ede4d3..83fb44f2332ce 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf.h ++++ b/drivers/net/ethernet/intel/iavf/iavf.h +@@ -385,7 +385,7 @@ void iavf_set_ethtool_ops(struct net_device *netdev); + void iavf_update_stats(struct iavf_adapter *adapter); + void iavf_reset_interrupt_capability(struct iavf_adapter *adapter); + int iavf_init_interrupt_scheme(struct iavf_adapter *adapter); +-void iavf_irq_enable_queues(struct iavf_adapter *adapter, u32 mask); ++void iavf_irq_enable_queues(struct iavf_adapter *adapter); + void iavf_free_all_tx_resources(struct iavf_adapter *adapter); + void iavf_free_all_rx_resources(struct iavf_adapter *adapter); + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index 4c41bb47fc1a6..838cd7881f2f7 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -244,21 +244,18 @@ static void iavf_irq_disable(struct iavf_adapter *adapter) + } + + /** +- * iavf_irq_enable_queues - Enable interrupt for specified queues ++ * iavf_irq_enable_queues - Enable interrupt for all queues + * @adapter: board private structure +- * @mask: bitmap of queues to enable + **/ +-void iavf_irq_enable_queues(struct iavf_adapter *adapter, u32 mask) ++void iavf_irq_enable_queues(struct iavf_adapter *adapter) + { + struct iavf_hw *hw = &adapter->hw; + int i; + + for (i = 1; i < adapter->num_msix_vectors; i++) { +- if (mask & BIT(i - 1)) { +- wr32(hw, IAVF_VFINT_DYN_CTLN1(i - 1), +- IAVF_VFINT_DYN_CTLN1_INTENA_MASK | +- IAVF_VFINT_DYN_CTLN1_ITR_INDX_MASK); +- } ++ wr32(hw, IAVF_VFINT_DYN_CTLN1(i - 1), ++ IAVF_VFINT_DYN_CTLN1_INTENA_MASK | ++ IAVF_VFINT_DYN_CTLN1_ITR_INDX_MASK); + } + } + +@@ -272,7 +269,7 @@ void iavf_irq_enable(struct iavf_adapter *adapter, bool flush) + struct iavf_hw *hw = &adapter->hw; + + iavf_misc_irq_enable(adapter); +- iavf_irq_enable_queues(adapter, ~0); ++ iavf_irq_enable_queues(adapter); + + if (flush) + iavf_flush(hw); +diff --git a/drivers/net/ethernet/intel/iavf/iavf_register.h b/drivers/net/ethernet/intel/iavf/iavf_register.h +index bf793332fc9d5..a19e88898a0bb 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_register.h ++++ b/drivers/net/ethernet/intel/iavf/iavf_register.h +@@ -40,7 +40,7 @@ + #define IAVF_VFINT_DYN_CTL01_INTENA_MASK IAVF_MASK(0x1, IAVF_VFINT_DYN_CTL01_INTENA_SHIFT) + #define IAVF_VFINT_DYN_CTL01_ITR_INDX_SHIFT 3 + #define IAVF_VFINT_DYN_CTL01_ITR_INDX_MASK IAVF_MASK(0x3, IAVF_VFINT_DYN_CTL01_ITR_INDX_SHIFT) +-#define IAVF_VFINT_DYN_CTLN1(_INTVF) (0x00003800 + ((_INTVF) * 4)) /* _i=0...15 */ /* Reset: VFR */ ++#define IAVF_VFINT_DYN_CTLN1(_INTVF) (0x00003800 + ((_INTVF) * 4)) /* _i=0...63 */ /* Reset: VFR */ + #define IAVF_VFINT_DYN_CTLN1_INTENA_SHIFT 0 + #define IAVF_VFINT_DYN_CTLN1_INTENA_MASK IAVF_MASK(0x1, IAVF_VFINT_DYN_CTLN1_INTENA_SHIFT) + #define IAVF_VFINT_DYN_CTLN1_SWINT_TRIG_SHIFT 2 +-- +2.39.2 + diff --git a/queue-5.4/ib-isert-fix-dead-lock-in-ib_isert.patch b/queue-5.4/ib-isert-fix-dead-lock-in-ib_isert.patch new file mode 100644 index 00000000000..bcc7e38e38d --- /dev/null +++ b/queue-5.4/ib-isert-fix-dead-lock-in-ib_isert.patch @@ -0,0 +1,121 @@ +From 3ee88d34cc587dbedf5528a9b4b387a7b6e2cec3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 03:25:29 -0700 +Subject: IB/isert: Fix dead lock in ib_isert + +From: Saravanan Vajravel + +[ Upstream commit 691b0480933f0ce88a81ed1d1a0aff340ff6293a ] + +- When a iSER session is released, ib_isert module is taking a mutex + lock and releasing all pending connections. As part of this, ib_isert + is destroying rdma cm_id. To destroy cm_id, rdma_cm module is sending + CM events to CMA handler of ib_isert. This handler is taking same + mutex lock. Hence it leads to deadlock between ib_isert & rdma_cm + modules. + +- For fix, created local list of pending connections and release the + connection outside of mutex lock. + +Calltrace: +--------- +[ 1229.791410] INFO: task kworker/10:1:642 blocked for more than 120 seconds. +[ 1229.791416] Tainted: G OE --------- - - 4.18.0-372.9.1.el8.x86_64 #1 +[ 1229.791418] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 1229.791419] task:kworker/10:1 state:D stack: 0 pid: 642 ppid: 2 flags:0x80004000 +[ 1229.791424] Workqueue: ib_cm cm_work_handler [ib_cm] +[ 1229.791436] Call Trace: +[ 1229.791438] __schedule+0x2d1/0x830 +[ 1229.791445] ? select_idle_sibling+0x23/0x6f0 +[ 1229.791449] schedule+0x35/0xa0 +[ 1229.791451] schedule_preempt_disabled+0xa/0x10 +[ 1229.791453] __mutex_lock.isra.7+0x310/0x420 +[ 1229.791456] ? select_task_rq_fair+0x351/0x990 +[ 1229.791459] isert_cma_handler+0x224/0x330 [ib_isert] +[ 1229.791463] ? ttwu_queue_wakelist+0x159/0x170 +[ 1229.791466] cma_cm_event_handler+0x25/0xd0 [rdma_cm] +[ 1229.791474] cma_ib_handler+0xa7/0x2e0 [rdma_cm] +[ 1229.791478] cm_process_work+0x22/0xf0 [ib_cm] +[ 1229.791483] cm_work_handler+0xf4/0xf30 [ib_cm] +[ 1229.791487] ? move_linked_works+0x6e/0xa0 +[ 1229.791490] process_one_work+0x1a7/0x360 +[ 1229.791491] ? create_worker+0x1a0/0x1a0 +[ 1229.791493] worker_thread+0x30/0x390 +[ 1229.791494] ? create_worker+0x1a0/0x1a0 +[ 1229.791495] kthread+0x10a/0x120 +[ 1229.791497] ? set_kthread_struct+0x40/0x40 +[ 1229.791499] ret_from_fork+0x1f/0x40 + +[ 1229.791739] INFO: task targetcli:28666 blocked for more than 120 seconds. +[ 1229.791740] Tainted: G OE --------- - - 4.18.0-372.9.1.el8.x86_64 #1 +[ 1229.791741] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 1229.791742] task:targetcli state:D stack: 0 pid:28666 ppid: 5510 flags:0x00004080 +[ 1229.791743] Call Trace: +[ 1229.791744] __schedule+0x2d1/0x830 +[ 1229.791746] schedule+0x35/0xa0 +[ 1229.791748] schedule_preempt_disabled+0xa/0x10 +[ 1229.791749] __mutex_lock.isra.7+0x310/0x420 +[ 1229.791751] rdma_destroy_id+0x15/0x20 [rdma_cm] +[ 1229.791755] isert_connect_release+0x115/0x130 [ib_isert] +[ 1229.791757] isert_free_np+0x87/0x140 [ib_isert] +[ 1229.791761] iscsit_del_np+0x74/0x120 [iscsi_target_mod] +[ 1229.791776] lio_target_np_driver_store+0xe9/0x140 [iscsi_target_mod] +[ 1229.791784] configfs_write_file+0xb2/0x110 +[ 1229.791788] vfs_write+0xa5/0x1a0 +[ 1229.791792] ksys_write+0x4f/0xb0 +[ 1229.791794] do_syscall_64+0x5b/0x1a0 +[ 1229.791798] entry_SYSCALL_64_after_hwframe+0x65/0xca + +Fixes: bd3792205aae ("iser-target: Fix pending connections handling in target stack shutdown sequnce") +Reviewed-by: Sagi Grimberg +Signed-off-by: Selvin Xavier +Signed-off-by: Saravanan Vajravel +Link: https://lore.kernel.org/r/20230606102531.162967-2-saravanan.vajravel@broadcom.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/isert/ib_isert.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c +index 71268d61d2b8a..226ddf92b7362 100644 +--- a/drivers/infiniband/ulp/isert/ib_isert.c ++++ b/drivers/infiniband/ulp/isert/ib_isert.c +@@ -2507,6 +2507,7 @@ isert_free_np(struct iscsi_np *np) + { + struct isert_np *isert_np = np->np_context; + struct isert_conn *isert_conn, *n; ++ LIST_HEAD(drop_conn_list); + + if (isert_np->cm_id) + rdma_destroy_id(isert_np->cm_id); +@@ -2526,7 +2527,7 @@ isert_free_np(struct iscsi_np *np) + node) { + isert_info("cleaning isert_conn %p state (%d)\n", + isert_conn, isert_conn->state); +- isert_connect_release(isert_conn); ++ list_move_tail(&isert_conn->node, &drop_conn_list); + } + } + +@@ -2537,11 +2538,16 @@ isert_free_np(struct iscsi_np *np) + node) { + isert_info("cleaning isert_conn %p state (%d)\n", + isert_conn, isert_conn->state); +- isert_connect_release(isert_conn); ++ list_move_tail(&isert_conn->node, &drop_conn_list); + } + } + mutex_unlock(&isert_np->mutex); + ++ list_for_each_entry_safe(isert_conn, n, &drop_conn_list, node) { ++ list_del_init(&isert_conn->node); ++ isert_connect_release(isert_conn); ++ } ++ + np->np_context = NULL; + kfree(isert_np); + } +-- +2.39.2 + diff --git a/queue-5.4/ib-isert-fix-incorrect-release-of-isert-connection.patch b/queue-5.4/ib-isert-fix-incorrect-release-of-isert-connection.patch new file mode 100644 index 00000000000..170a58a426e --- /dev/null +++ b/queue-5.4/ib-isert-fix-incorrect-release-of-isert-connection.patch @@ -0,0 +1,45 @@ +From b57e443a896b29cd10ed8e50c174fdc9c80dc30f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 03:25:31 -0700 +Subject: IB/isert: Fix incorrect release of isert connection + +From: Saravanan Vajravel + +[ Upstream commit 699826f4e30ab76a62c238c86fbef7e826639c8d ] + +The ib_isert module is releasing the isert connection both in +isert_wait_conn() handler as well as isert_free_conn() handler. +In isert_wait_conn() handler, it is expected to wait for iSCSI +session logout operation to complete. It should free the isert +connection only in isert_free_conn() handler. + +When a bunch of iSER target is cleared, this issue can lead to +use-after-free memory issue as isert conn is twice released + +Fixes: b02efbfc9a05 ("iser-target: Fix implicit termination of connections") +Reviewed-by: Sagi Grimberg +Signed-off-by: Saravanan Vajravel +Signed-off-by: Selvin Xavier +Link: https://lore.kernel.org/r/20230606102531.162967-4-saravanan.vajravel@broadcom.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/isert/ib_isert.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c +index 6ff92dca2898c..5bb1fc7fd79c9 100644 +--- a/drivers/infiniband/ulp/isert/ib_isert.c ++++ b/drivers/infiniband/ulp/isert/ib_isert.c +@@ -2646,8 +2646,6 @@ static void isert_wait_conn(struct iscsi_conn *conn) + isert_put_unsol_pending_cmds(conn); + isert_wait4cmds(conn); + isert_wait4logout(isert_conn); +- +- queue_work(isert_release_wq, &isert_conn->release_work); + } + + static void isert_free_conn(struct iscsi_conn *conn) +-- +2.39.2 + diff --git a/queue-5.4/ib-isert-fix-possible-list-corruption-in-cma-handler.patch b/queue-5.4/ib-isert-fix-possible-list-corruption-in-cma-handler.patch new file mode 100644 index 00000000000..79a148008f7 --- /dev/null +++ b/queue-5.4/ib-isert-fix-possible-list-corruption-in-cma-handler.patch @@ -0,0 +1,45 @@ +From e6df300147d585f671d5398f7a47e97a371e9bb3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 03:25:30 -0700 +Subject: IB/isert: Fix possible list corruption in CMA handler + +From: Saravanan Vajravel + +[ Upstream commit 7651e2d6c5b359a28c2d4c904fec6608d1021ca8 ] + +When ib_isert module receives connection error event, it is +releasing the isert session and removes corresponding list +node but it doesn't take appropriate mutex lock to remove +the list node. This can lead to linked list corruption + +Fixes: bd3792205aae ("iser-target: Fix pending connections handling in target stack shutdown sequnce") +Signed-off-by: Selvin Xavier +Signed-off-by: Saravanan Vajravel +Link: https://lore.kernel.org/r/20230606102531.162967-3-saravanan.vajravel@broadcom.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/isert/ib_isert.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c +index 226ddf92b7362..6ff92dca2898c 100644 +--- a/drivers/infiniband/ulp/isert/ib_isert.c ++++ b/drivers/infiniband/ulp/isert/ib_isert.c +@@ -733,9 +733,13 @@ static int + isert_connect_error(struct rdma_cm_id *cma_id) + { + struct isert_conn *isert_conn = cma_id->qp->qp_context; ++ struct isert_np *isert_np = cma_id->context; + + ib_drain_qp(isert_conn->qp); ++ ++ mutex_lock(&isert_np->mutex); + list_del_init(&isert_conn->node); ++ mutex_unlock(&isert_np->mutex); + isert_conn->cm_id = NULL; + isert_put_conn(isert_conn); + +-- +2.39.2 + diff --git a/queue-5.4/ib-uverbs-fix-to-consider-event-queue-closing-also-u.patch b/queue-5.4/ib-uverbs-fix-to-consider-event-queue-closing-also-u.patch new file mode 100644 index 00000000000..f54584a22ac --- /dev/null +++ b/queue-5.4/ib-uverbs-fix-to-consider-event-queue-closing-also-u.patch @@ -0,0 +1,69 @@ +From be9922b072e467c066d159a335a32f7fe09b0c65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jun 2023 13:33:25 +0300 +Subject: IB/uverbs: Fix to consider event queue closing also upon non-blocking + mode + +From: Yishai Hadas + +[ Upstream commit 62fab312fa1683e812e605db20d4f22de3e3fb2f ] + +Fix ib_uverbs_event_read() to consider event queue closing also upon +non-blocking mode. + +Once the queue is closed (e.g. hot-plug flow) all the existing events +are cleaned-up as part of ib_uverbs_free_event_queue(). + +An application that uses the non-blocking FD mode should get -EIO in +that case to let it knows that the device was removed already. + +Otherwise, it can loose the indication that the device was removed and +won't recover. + +As part of that, refactor the code to have a single flow with regards to +'is_closed' for both blocking and non-blocking modes. + +Fixes: 14e23bd6d221 ("RDMA/core: Fix locking in ib_uverbs_event_read") +Reviewed-by: Maor Gottlieb +Signed-off-by: Yishai Hadas +Link: https://lore.kernel.org/r/97b00116a1e1e13f8dc4ec38a5ea81cf8c030210.1685960567.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/uverbs_main.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c +index adb08c3fc085a..e5fd43162b768 100644 +--- a/drivers/infiniband/core/uverbs_main.c ++++ b/drivers/infiniband/core/uverbs_main.c +@@ -230,8 +230,12 @@ static ssize_t ib_uverbs_event_read(struct ib_uverbs_event_queue *ev_queue, + spin_lock_irq(&ev_queue->lock); + + while (list_empty(&ev_queue->event_list)) { +- spin_unlock_irq(&ev_queue->lock); ++ if (ev_queue->is_closed) { ++ spin_unlock_irq(&ev_queue->lock); ++ return -EIO; ++ } + ++ spin_unlock_irq(&ev_queue->lock); + if (filp->f_flags & O_NONBLOCK) + return -EAGAIN; + +@@ -241,12 +245,6 @@ static ssize_t ib_uverbs_event_read(struct ib_uverbs_event_queue *ev_queue, + return -ERESTARTSYS; + + spin_lock_irq(&ev_queue->lock); +- +- /* If device was disassociated and no event exists set an error */ +- if (list_empty(&ev_queue->event_list) && ev_queue->is_closed) { +- spin_unlock_irq(&ev_queue->lock); +- return -EIO; +- } + } + + event = list_entry(ev_queue->event_list.next, struct ib_uverbs_event, list); +-- +2.39.2 + diff --git a/queue-5.4/igb-fix-nvm.ops.read-error-handling.patch b/queue-5.4/igb-fix-nvm.ops.read-error-handling.patch new file mode 100644 index 00000000000..6b8d190a3dc --- /dev/null +++ b/queue-5.4/igb-fix-nvm.ops.read-error-handling.patch @@ -0,0 +1,44 @@ +From a0c03b02e42c6f092a84447f4faba776abc0ed15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Apr 2023 17:44:14 +0200 +Subject: igb: fix nvm.ops.read() error handling + +From: Aleksandr Loktionov + +[ Upstream commit 48a821fd58837800750ec1b3962f0f799630a844 ] + +Add error handling into igb_set_eeprom() function, in case +nvm.ops.read() fails just quit with error code asap. + +Fixes: 9d5c824399de ("igb: PCI-Express 82575 Gigabit Ethernet driver") +Signed-off-by: Aleksandr Loktionov +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igb/igb_ethtool.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c +index 6196f9bbd67df..50f61b18ae1e3 100644 +--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c ++++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c +@@ -814,6 +814,8 @@ static int igb_set_eeprom(struct net_device *netdev, + */ + ret_val = hw->nvm.ops.read(hw, last_word, 1, + &eeprom_buff[last_word - first_word]); ++ if (ret_val) ++ goto out; + } + + /* Device's eeprom is always little-endian, word addressable */ +@@ -833,6 +835,7 @@ static int igb_set_eeprom(struct net_device *netdev, + hw->nvm.ops.update(hw); + + igb_set_fw_version(adapter); ++out: + kfree(eeprom_buff); + return ret_val; + } +-- +2.39.2 + diff --git a/queue-5.4/ipvlan-fix-bound-dev-checking-for-ipv6-l3s-mode.patch b/queue-5.4/ipvlan-fix-bound-dev-checking-for-ipv6-l3s-mode.patch new file mode 100644 index 00000000000..60f056d313d --- /dev/null +++ b/queue-5.4/ipvlan-fix-bound-dev-checking-for-ipv6-l3s-mode.patch @@ -0,0 +1,50 @@ +From 00efbd4632ce29c9957328586473766a8be93211 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 17:15:02 +0800 +Subject: ipvlan: fix bound dev checking for IPv6 l3s mode + +From: Hangbin Liu + +[ Upstream commit ce57adc222aba32431c42632b396e9213d0eb0b8 ] + +The commit 59a0b022aa24 ("ipvlan: Make skb->skb_iif track skb->dev for l3s +mode") fixed ipvlan bonded dev checking by updating skb skb_iif. This fix +works for IPv4, as in raw_v4_input() the dif is from inet_iif(skb), which +is skb->skb_iif when there is no route. + +But for IPv6, the fix is not enough, because in ipv6_raw_deliver() -> +raw_v6_match(), the dif is inet6_iif(skb), which is returns IP6CB(skb)->iif +instead of skb->skb_iif if it's not a l3_slave. To fix the IPv6 part +issue. Let's set IP6CB(skb)->iif to correct ifindex. + +BTW, ipvlan handles NS/NA specifically. Since it works fine, I will not +reset IP6CB(skb)->iif when addr->atype is IPVL_ICMPV6. + +Fixes: c675e06a98a4 ("ipvlan: decouple l3s mode dependencies from other modes") +Link: https://bugzilla.redhat.com/show_bug.cgi?id=2196710 +Signed-off-by: Hangbin Liu +Reviewed-by: Larysa Zaremba +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ipvlan/ipvlan_l3s.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ipvlan/ipvlan_l3s.c b/drivers/net/ipvlan/ipvlan_l3s.c +index 71712ea25403d..d5b05e8032199 100644 +--- a/drivers/net/ipvlan/ipvlan_l3s.c ++++ b/drivers/net/ipvlan/ipvlan_l3s.c +@@ -102,6 +102,10 @@ static unsigned int ipvlan_nf_input(void *priv, struct sk_buff *skb, + + skb->dev = addr->master->dev; + skb->skb_iif = skb->dev->ifindex; ++#if IS_ENABLED(CONFIG_IPV6) ++ if (addr->atype == IPVL_IPV6) ++ IP6CB(skb)->iif = skb->dev->ifindex; ++#endif + len = skb->len + ETH_HLEN; + ipvlan_count_rx(addr->master, len, true, false); + out: +-- +2.39.2 + diff --git a/queue-5.4/net-lapbether-only-support-ethernet-devices.patch b/queue-5.4/net-lapbether-only-support-ethernet-devices.patch new file mode 100644 index 00000000000..28c17cf56cc --- /dev/null +++ b/queue-5.4/net-lapbether-only-support-ethernet-devices.patch @@ -0,0 +1,96 @@ +From 58adb69e1ca2eb551d9b4a579fc7533f67f1a6d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 16:18:02 +0000 +Subject: net: lapbether: only support ethernet devices + +From: Eric Dumazet + +[ Upstream commit 9eed321cde22fc1afd76eac563ce19d899e0d6b2 ] + +It probbaly makes no sense to support arbitrary network devices +for lapbether. + +syzbot reported: + +skbuff: skb_under_panic: text:ffff80008934c100 len:44 put:40 head:ffff0000d18dd200 data:ffff0000d18dd1ea tail:0x16 end:0x140 dev:bond1 +kernel BUG at net/core/skbuff.c:200 ! +Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP +Modules linked in: +CPU: 0 PID: 5643 Comm: dhcpcd Not tainted 6.4.0-rc5-syzkaller-g4641cff8e810 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 +pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : skb_panic net/core/skbuff.c:196 [inline] +pc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:210 +lr : skb_panic net/core/skbuff.c:196 [inline] +lr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:210 +sp : ffff8000973b7260 +x29: ffff8000973b7270 x28: ffff8000973b7360 x27: dfff800000000000 +x26: ffff0000d85d8150 x25: 0000000000000016 x24: ffff0000d18dd1ea +x23: ffff0000d18dd200 x22: 000000000000002c x21: 0000000000000140 +x20: 0000000000000028 x19: ffff80008934c100 x18: ffff8000973b68a0 +x17: 0000000000000000 x16: ffff80008a43bfbc x15: 0000000000000202 +x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000001 +x11: 0000000000000201 x10: 0000000000000000 x9 : f22f7eb937cced00 +x8 : f22f7eb937cced00 x7 : 0000000000000001 x6 : 0000000000000001 +x5 : ffff8000973b6b78 x4 : ffff80008df9ee80 x3 : ffff8000805974f4 +x2 : 0000000000000001 x1 : 0000000100000201 x0 : 0000000000000086 +Call trace: +skb_panic net/core/skbuff.c:196 [inline] +skb_under_panic+0x13c/0x140 net/core/skbuff.c:210 +skb_push+0xf0/0x108 net/core/skbuff.c:2409 +ip6gre_header+0xbc/0x738 net/ipv6/ip6_gre.c:1383 +dev_hard_header include/linux/netdevice.h:3137 [inline] +lapbeth_data_transmit+0x1c4/0x298 drivers/net/wan/lapbether.c:257 +lapb_data_transmit+0x8c/0xb0 net/lapb/lapb_iface.c:447 +lapb_transmit_buffer+0x178/0x204 net/lapb/lapb_out.c:149 +lapb_send_control+0x220/0x320 net/lapb/lapb_subr.c:251 +lapb_establish_data_link+0x94/0xec +lapb_device_event+0x348/0x4e0 +notifier_call_chain+0x1a4/0x510 kernel/notifier.c:93 +raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461 +__dev_notify_flags+0x2bc/0x544 +dev_change_flags+0xd0/0x15c net/core/dev.c:8643 +devinet_ioctl+0x858/0x17e4 net/ipv4/devinet.c:1150 +inet_ioctl+0x2ac/0x4d8 net/ipv4/af_inet.c:979 +sock_do_ioctl+0x134/0x2dc net/socket.c:1201 +sock_ioctl+0x4ec/0x858 net/socket.c:1318 +vfs_ioctl fs/ioctl.c:51 [inline] +__do_sys_ioctl fs/ioctl.c:870 [inline] +__se_sys_ioctl fs/ioctl.c:856 [inline] +__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856 +__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] +invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52 +el0_svc_common+0x138/0x244 arch/arm64/kernel/syscall.c:142 +do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:191 +el0_svc+0x4c/0x160 arch/arm64/kernel/entry-common.c:647 +el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665 +el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591 +Code: aa1803e6 aa1903e7 a90023f5 947730f5 (d4210000) + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Cc: Martin Schiller +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/wan/lapbether.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c +index bbcd8ef2873f6..4f52003bf422e 100644 +--- a/drivers/net/wan/lapbether.c ++++ b/drivers/net/wan/lapbether.c +@@ -341,6 +341,9 @@ static int lapbeth_new_device(struct net_device *dev) + + ASSERT_RTNL(); + ++ if (dev->type != ARPHRD_ETHER) ++ return -EINVAL; ++ + ndev = alloc_netdev(sizeof(*lapbeth), "lapb%d", NET_NAME_UNKNOWN, + lapbeth_setup); + if (!ndev) +-- +2.39.2 + diff --git a/queue-5.4/net-sched-cls_api-fix-lockup-on-flushing-explicitly-.patch b/queue-5.4/net-sched-cls_api-fix-lockup-on-flushing-explicitly-.patch new file mode 100644 index 00000000000..0eb3c24950a --- /dev/null +++ b/queue-5.4/net-sched-cls_api-fix-lockup-on-flushing-explicitly-.patch @@ -0,0 +1,71 @@ +From 583e00039be4ad4b2f07a081bb290aa7f863ce71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jun 2023 11:34:26 +0200 +Subject: net/sched: cls_api: Fix lockup on flushing explicitly created chain + +From: Vlad Buslov + +[ Upstream commit c9a82bec02c339cdda99b37c5e62b3b71fc4209c ] + +Mingshuai Ren reports: + +When a new chain is added by using tc, one soft lockup alarm will be + generated after delete the prio 0 filter of the chain. To reproduce + the problem, perform the following steps: +(1) tc qdisc add dev eth0 root handle 1: htb default 1 +(2) tc chain add dev eth0 +(3) tc filter del dev eth0 chain 0 parent 1: prio 0 +(4) tc filter add dev eth0 chain 0 parent 1: + +Fix the issue by accounting for additional reference to chains that are +explicitly created by RTM_NEWCHAIN message as opposed to implicitly by +RTM_NEWTFILTER message. + +Fixes: 726d061286ce ("net: sched: prevent insertion of new classifiers during chain flush") +Reported-by: Mingshuai Ren +Closes: https://lore.kernel.org/lkml/87legswvi3.fsf@nvidia.com/T/ +Signed-off-by: Vlad Buslov +Link: https://lore.kernel.org/r/20230612093426.2867183-1-vladbu@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/cls_api.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c +index a4cf718bdb8a0..30e30b5a9baf6 100644 +--- a/net/sched/cls_api.c ++++ b/net/sched/cls_api.c +@@ -518,8 +518,8 @@ static void __tcf_chain_put(struct tcf_chain *chain, bool by_act, + { + struct tcf_block *block = chain->block; + const struct tcf_proto_ops *tmplt_ops; ++ unsigned int refcnt, non_act_refcnt; + bool free_block = false; +- unsigned int refcnt; + void *tmplt_priv; + + mutex_lock(&block->lock); +@@ -539,13 +539,15 @@ static void __tcf_chain_put(struct tcf_chain *chain, bool by_act, + * save these to temporary variables. + */ + refcnt = --chain->refcnt; ++ non_act_refcnt = refcnt - chain->action_refcnt; + tmplt_ops = chain->tmplt_ops; + tmplt_priv = chain->tmplt_priv; + +- /* The last dropped non-action reference will trigger notification. */ +- if (refcnt - chain->action_refcnt == 0 && !by_act) { +- tc_chain_notify_delete(tmplt_ops, tmplt_priv, chain->index, +- block, NULL, 0, 0, false); ++ if (non_act_refcnt == chain->explicitly_created && !by_act) { ++ if (non_act_refcnt == 0) ++ tc_chain_notify_delete(tmplt_ops, tmplt_priv, ++ chain->index, block, NULL, 0, 0, ++ false); + /* Last reference to chain, no need to lock. */ + chain->flushing = false; + } +-- +2.39.2 + diff --git a/queue-5.4/net-sched-cls_u32-fix-reference-counter-leak-leading.patch b/queue-5.4/net-sched-cls_u32-fix-reference-counter-leak-leading.patch new file mode 100644 index 00000000000..6a078cf106d --- /dev/null +++ b/queue-5.4/net-sched-cls_u32-fix-reference-counter-leak-leading.patch @@ -0,0 +1,77 @@ +From e442758c225c4c898f53ee27189cb264ac3d45cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jun 2023 08:29:03 +0100 +Subject: net/sched: cls_u32: Fix reference counter leak leading to overflow + +From: Lee Jones + +[ Upstream commit 04c55383fa5689357bcdd2c8036725a55ed632bc ] + +In the event of a failure in tcf_change_indev(), u32_set_parms() will +immediately return without decrementing the recently incremented +reference counter. If this happens enough times, the counter will +rollover and the reference freed, leading to a double free which can be +used to do 'bad things'. + +In order to prevent this, move the point of possible failure above the +point where the reference counter is incremented. Also save any +meaningful return values to be applied to the return data at the +appropriate point in time. + +This issue was caught with KASAN. + +Fixes: 705c7091262d ("net: sched: cls_u32: no need to call tcf_exts_change for newly allocated struct") +Suggested-by: Eric Dumazet +Signed-off-by: Lee Jones +Reviewed-by: Eric Dumazet +Acked-by: Jamal Hadi Salim +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/cls_u32.c | 18 ++++++++++-------- + 1 file changed, 10 insertions(+), 8 deletions(-) + +diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c +index ed8d26e6468ca..e5cc2b4d38d5a 100644 +--- a/net/sched/cls_u32.c ++++ b/net/sched/cls_u32.c +@@ -716,12 +716,18 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp, + struct nlattr *est, bool ovr, + struct netlink_ext_ack *extack) + { +- int err; ++ int err, ifindex = -1; + + err = tcf_exts_validate(net, tp, tb, est, &n->exts, ovr, true, extack); + if (err < 0) + return err; + ++ if (tb[TCA_U32_INDEV]) { ++ ifindex = tcf_change_indev(net, tb[TCA_U32_INDEV], extack); ++ if (ifindex < 0) ++ return -EINVAL; ++ } ++ + if (tb[TCA_U32_LINK]) { + u32 handle = nla_get_u32(tb[TCA_U32_LINK]); + struct tc_u_hnode *ht_down = NULL, *ht_old; +@@ -756,13 +762,9 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp, + tcf_bind_filter(tp, &n->res, base); + } + +- if (tb[TCA_U32_INDEV]) { +- int ret; +- ret = tcf_change_indev(net, tb[TCA_U32_INDEV], extack); +- if (ret < 0) +- return -EINVAL; +- n->ifindex = ret; +- } ++ if (ifindex >= 0) ++ n->ifindex = ifindex; ++ + return 0; + } + +-- +2.39.2 + diff --git a/queue-5.4/net-tipc-resize-nlattr-array-to-correct-size.patch b/queue-5.4/net-tipc-resize-nlattr-array-to-correct-size.patch new file mode 100644 index 00000000000..21406376873 --- /dev/null +++ b/queue-5.4/net-tipc-resize-nlattr-array-to-correct-size.patch @@ -0,0 +1,51 @@ +From 544daa9e09757ccbcbe322c2553a50cb932e317a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 20:06:04 +0800 +Subject: net: tipc: resize nlattr array to correct size + +From: Lin Ma + +[ Upstream commit 44194cb1b6045dea33ae9a0d54fb7e7cd93a2e09 ] + +According to nla_parse_nested_deprecated(), the tb[] is supposed to the +destination array with maxtype+1 elements. In current +tipc_nl_media_get() and __tipc_nl_media_set(), a larger array is used +which is unnecessary. This patch resize them to a proper size. + +Fixes: 1e55417d8fc6 ("tipc: add media set to new netlink api") +Fixes: 46f15c6794fb ("tipc: add media get/dump to new netlink api") +Signed-off-by: Lin Ma +Reviewed-by: Florian Westphal +Reviewed-by: Tung Nguyen +Link: https://lore.kernel.org/r/20230614120604.1196377-1-linma@zju.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tipc/bearer.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c +index 577f71dd63fb4..ca26c41396f74 100644 +--- a/net/tipc/bearer.c ++++ b/net/tipc/bearer.c +@@ -1195,7 +1195,7 @@ int tipc_nl_media_get(struct sk_buff *skb, struct genl_info *info) + struct tipc_nl_msg msg; + struct tipc_media *media; + struct sk_buff *rep; +- struct nlattr *attrs[TIPC_NLA_BEARER_MAX + 1]; ++ struct nlattr *attrs[TIPC_NLA_MEDIA_MAX + 1]; + + if (!info->attrs[TIPC_NLA_MEDIA]) + return -EINVAL; +@@ -1244,7 +1244,7 @@ int __tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info) + int err; + char *name; + struct tipc_media *m; +- struct nlattr *attrs[TIPC_NLA_BEARER_MAX + 1]; ++ struct nlattr *attrs[TIPC_NLA_MEDIA_MAX + 1]; + + if (!info->attrs[TIPC_NLA_MEDIA]) + return -EINVAL; +-- +2.39.2 + diff --git a/queue-5.4/netfilter-nfnetlink-skip-error-delivery-on-batch-in-.patch b/queue-5.4/netfilter-nfnetlink-skip-error-delivery-on-batch-in-.patch new file mode 100644 index 00000000000..e2867410f63 --- /dev/null +++ b/queue-5.4/netfilter-nfnetlink-skip-error-delivery-on-batch-in-.patch @@ -0,0 +1,36 @@ +From 94134376960332fd59ad4a896c54c712f70cc600 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jun 2023 00:19:12 +0200 +Subject: netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM + +From: Pablo Neira Ayuso + +[ Upstream commit a1a64a151dae8ac3581c1cbde44b672045cb658b ] + +If caller reports ENOMEM, then stop iterating over the batch and send a +single netlink message to userspace to report OOM. + +Fixes: cbb8125eb40b ("netfilter: nfnetlink: deliver netlink errors on batch completion") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nfnetlink.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c +index e3f6e27a9a06d..3cff23c814c37 100644 +--- a/net/netfilter/nfnetlink.c ++++ b/net/netfilter/nfnetlink.c +@@ -455,7 +455,8 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh, + * processed, this avoids that the same error is + * reported several times when replaying the batch. + */ +- if (nfnl_err_add(&err_list, nlh, err, &extack) < 0) { ++ if (err == -ENOMEM || ++ nfnl_err_add(&err_list, nlh, err, &extack) < 0) { + /* We failed to enqueue an error, reset the + * list of errors and send OOM to userspace + * pointing to the batch header. +-- +2.39.2 + diff --git a/queue-5.4/ping6-fix-send-to-link-local-addresses-with-vrf.patch b/queue-5.4/ping6-fix-send-to-link-local-addresses-with-vrf.patch new file mode 100644 index 00000000000..daf87c48a56 --- /dev/null +++ b/queue-5.4/ping6-fix-send-to-link-local-addresses-with-vrf.patch @@ -0,0 +1,58 @@ +From 578c08c0333f8edfb28d818103f280c0e1ba3dff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jun 2023 18:05:02 +0200 +Subject: ping6: Fix send to link-local addresses with VRF. + +From: Guillaume Nault + +[ Upstream commit 91ffd1bae1dafbb9e34b46813f5b058581d9144d ] + +Ping sockets can't send packets when they're bound to a VRF master +device and the output interface is set to a slave device. + +For example, when net.ipv4.ping_group_range is properly set, so that +ping6 can use ping sockets, the following kind of commands fails: + $ ip vrf exec red ping6 fe80::854:e7ff:fe88:4bf1%eth1 + +What happens is that sk->sk_bound_dev_if is set to the VRF master +device, but 'oif' is set to the real output device. Since both are set +but different, ping_v6_sendmsg() sees their value as inconsistent and +fails. + +Fix this by allowing 'oif' to be a slave device of ->sk_bound_dev_if. + +This fixes the following kselftest failure: + $ ./fcnal-test.sh -t ipv6_ping + [...] + TEST: ping out, vrf device+address bind - ns-B IPv6 LLA [FAIL] + +Reported-by: Mirsad Todorovac +Closes: https://lore.kernel.org/netdev/b6191f90-ffca-dbca-7d06-88a9788def9c@alu.unizg.hr/ +Tested-by: Mirsad Todorovac +Fixes: 5e457896986e ("net: ipv6: Fix ping to link-local addresses.") +Signed-off-by: Guillaume Nault +Reviewed-by: David Ahern +Link: https://lore.kernel.org/r/6c8b53108816a8d0d5705ae37bdc5a8322b5e3d9.1686153846.git.gnault@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/ping.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c +index 98ac32b49d8c9..91f352427dca2 100644 +--- a/net/ipv6/ping.c ++++ b/net/ipv6/ping.c +@@ -96,7 +96,8 @@ static int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + addr_type = ipv6_addr_type(daddr); + if ((__ipv6_addr_needs_scope_id(addr_type) && !oif) || + (addr_type & IPV6_ADDR_MAPPED) || +- (oif && sk->sk_bound_dev_if && oif != sk->sk_bound_dev_if)) ++ (oif && sk->sk_bound_dev_if && oif != sk->sk_bound_dev_if && ++ l3mdev_master_ifindex_by_index(sock_net(sk), oif) != sk->sk_bound_dev_if)) + return -EINVAL; + + /* TODO: use ip6_datagram_send_ctl to get options from cmsg */ +-- +2.39.2 + diff --git a/queue-5.4/rdma-rxe-fix-the-use-before-initialization-error-of-.patch b/queue-5.4/rdma-rxe-fix-the-use-before-initialization-error-of-.patch new file mode 100644 index 00000000000..e72693bf934 --- /dev/null +++ b/queue-5.4/rdma-rxe-fix-the-use-before-initialization-error-of-.patch @@ -0,0 +1,82 @@ +From 9636b372681c982be67f7502e2c8ae693873a6df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 11:54:08 +0800 +Subject: RDMA/rxe: Fix the use-before-initialization error of resp_pkts + +From: Zhu Yanjun + +[ Upstream commit 2a62b6210ce876c596086ab8fd4c8a0c3d10611a ] + +In the following: + + Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106 + assign_lock_key kernel/locking/lockdep.c:982 [inline] + register_lock_class+0xdb6/0x1120 kernel/locking/lockdep.c:1295 + __lock_acquire+0x10a/0x5df0 kernel/locking/lockdep.c:4951 + lock_acquire kernel/locking/lockdep.c:5691 [inline] + lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5656 + __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] + _raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162 + skb_dequeue+0x20/0x180 net/core/skbuff.c:3639 + drain_resp_pkts drivers/infiniband/sw/rxe/rxe_comp.c:555 [inline] + rxe_completer+0x250d/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:652 + rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761 + execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473 + __rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233 + rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583 + +This is a use-before-initialization problem. + +It happens because rxe_qp_do_cleanup is called during error unwind before +the struct has been fully initialized. + +Move the initialization of the skb earlier. + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Link: https://lore.kernel.org/r/20230602035408.741534-1-yanjun.zhu@intel.com +Reported-by: syzbot+eba589d8f49c73d356da@syzkaller.appspotmail.com +Signed-off-by: Zhu Yanjun +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_qp.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c +index c36000e08f65d..d93ed04276ac1 100644 +--- a/drivers/infiniband/sw/rxe/rxe_qp.c ++++ b/drivers/infiniband/sw/rxe/rxe_qp.c +@@ -219,6 +219,9 @@ static void rxe_qp_init_misc(struct rxe_dev *rxe, struct rxe_qp *qp, + spin_lock_init(&qp->rq.producer_lock); + spin_lock_init(&qp->rq.consumer_lock); + ++ skb_queue_head_init(&qp->req_pkts); ++ skb_queue_head_init(&qp->resp_pkts); ++ + atomic_set(&qp->ssn, 0); + atomic_set(&qp->skb_out, 0); + } +@@ -276,8 +279,6 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp, + qp->req.opcode = -1; + qp->comp.opcode = -1; + +- skb_queue_head_init(&qp->req_pkts); +- + rxe_init_task(&qp->req.task, qp, rxe_requester); + rxe_init_task(&qp->comp.task, qp, rxe_completer); + +@@ -323,8 +324,6 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp, + } + } + +- skb_queue_head_init(&qp->resp_pkts); +- + rxe_init_task(&qp->resp.task, qp, rxe_responder); + + qp->resp.opcode = OPCODE_NONE; +-- +2.39.2 + diff --git a/queue-5.4/rdma-rxe-remove-the-unused-variable-obj.patch b/queue-5.4/rdma-rxe-remove-the-unused-variable-obj.patch new file mode 100644 index 00000000000..19dc2f0e4cc --- /dev/null +++ b/queue-5.4/rdma-rxe-remove-the-unused-variable-obj.patch @@ -0,0 +1,90 @@ +From 4228afb5efca11e20c0abe9d9f8a47b0b9fb31c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Aug 2022 21:16:15 -0400 +Subject: RDMA/rxe: Remove the unused variable obj + +From: Zhu Yanjun + +[ Upstream commit f07853582d1f6ed282f8d9a0b1209a87dd761f58 ] + +The member variable obj in struct rxe_task is not needed. +So remove it to save memory. + +Link: https://lore.kernel.org/r/20220822011615.805603-4-yanjun.zhu@linux.dev +Signed-off-by: Zhu Yanjun +Reviewed-by: Li Zhijian +Reviewed-by: Bob Pearson +Signed-off-by: Leon Romanovsky +Stable-dep-of: 2a62b6210ce8 ("RDMA/rxe: Fix the use-before-initialization error of resp_pkts") +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_qp.c | 6 +++--- + drivers/infiniband/sw/rxe/rxe_task.c | 3 +-- + drivers/infiniband/sw/rxe/rxe_task.h | 3 +-- + 3 files changed, 5 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c +index 5dd9bcef5921a..5b59907594f75 100644 +--- a/drivers/infiniband/sw/rxe/rxe_qp.c ++++ b/drivers/infiniband/sw/rxe/rxe_qp.c +@@ -278,9 +278,9 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp, + + skb_queue_head_init(&qp->req_pkts); + +- rxe_init_task(rxe, &qp->req.task, qp, ++ rxe_init_task(&qp->req.task, qp, + rxe_requester, "req"); +- rxe_init_task(rxe, &qp->comp.task, qp, ++ rxe_init_task(&qp->comp.task, qp, + rxe_completer, "comp"); + + qp->qp_timeout_jiffies = 0; /* Can't be set for UD/UC in modify_qp */ +@@ -327,7 +327,7 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp, + + skb_queue_head_init(&qp->resp_pkts); + +- rxe_init_task(rxe, &qp->resp.task, qp, ++ rxe_init_task(&qp->resp.task, qp, + rxe_responder, "resp"); + + qp->resp.opcode = OPCODE_NONE; +diff --git a/drivers/infiniband/sw/rxe/rxe_task.c b/drivers/infiniband/sw/rxe/rxe_task.c +index 08f05ac5f5d52..ea7d5a69eb2a3 100644 +--- a/drivers/infiniband/sw/rxe/rxe_task.c ++++ b/drivers/infiniband/sw/rxe/rxe_task.c +@@ -114,10 +114,9 @@ void rxe_do_task(unsigned long data) + task->ret = ret; + } + +-int rxe_init_task(void *obj, struct rxe_task *task, ++int rxe_init_task(struct rxe_task *task, + void *arg, int (*func)(void *), char *name) + { +- task->obj = obj; + task->arg = arg; + task->func = func; + snprintf(task->name, sizeof(task->name), "%s", name); +diff --git a/drivers/infiniband/sw/rxe/rxe_task.h b/drivers/infiniband/sw/rxe/rxe_task.h +index 08ff42d451c62..e87ee072e3179 100644 +--- a/drivers/infiniband/sw/rxe/rxe_task.h ++++ b/drivers/infiniband/sw/rxe/rxe_task.h +@@ -46,7 +46,6 @@ enum { + * called again. + */ + struct rxe_task { +- void *obj; + struct tasklet_struct tasklet; + int state; + spinlock_t state_lock; /* spinlock for task state */ +@@ -62,7 +61,7 @@ struct rxe_task { + * arg => parameter to pass to fcn + * fcn => function to call until it returns != 0 + */ +-int rxe_init_task(void *obj, struct rxe_task *task, ++int rxe_init_task(struct rxe_task *task, + void *arg, int (*func)(void *), char *name); + + /* cleanup task */ +-- +2.39.2 + diff --git a/queue-5.4/rdma-rxe-removed-unused-name-from-rxe_task-struct.patch b/queue-5.4/rdma-rxe-removed-unused-name-from-rxe_task-struct.patch new file mode 100644 index 00000000000..b1b0bf3723d --- /dev/null +++ b/queue-5.4/rdma-rxe-removed-unused-name-from-rxe_task-struct.patch @@ -0,0 +1,93 @@ +From 7a13b71885629545e0cd00e5370a6633d4d0b6e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Oct 2022 15:01:04 -0500 +Subject: RDMA/rxe: Removed unused name from rxe_task struct + +From: Bob Pearson + +[ Upstream commit de669ae8af49ceed0eed44f5b3d51dc62affc5e4 ] + +The name field in struct rxe_task is never used. This patch removes it. + +Link: https://lore.kernel.org/r/20221021200118.2163-4-rpearsonhpe@gmail.com +Signed-off-by: Ian Ziemba +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Stable-dep-of: 2a62b6210ce8 ("RDMA/rxe: Fix the use-before-initialization error of resp_pkts") +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_qp.c | 9 +++------ + drivers/infiniband/sw/rxe/rxe_task.c | 4 +--- + drivers/infiniband/sw/rxe/rxe_task.h | 4 +--- + 3 files changed, 5 insertions(+), 12 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c +index 5b59907594f75..c36000e08f65d 100644 +--- a/drivers/infiniband/sw/rxe/rxe_qp.c ++++ b/drivers/infiniband/sw/rxe/rxe_qp.c +@@ -278,10 +278,8 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp, + + skb_queue_head_init(&qp->req_pkts); + +- rxe_init_task(&qp->req.task, qp, +- rxe_requester, "req"); +- rxe_init_task(&qp->comp.task, qp, +- rxe_completer, "comp"); ++ rxe_init_task(&qp->req.task, qp, rxe_requester); ++ rxe_init_task(&qp->comp.task, qp, rxe_completer); + + qp->qp_timeout_jiffies = 0; /* Can't be set for UD/UC in modify_qp */ + if (init->qp_type == IB_QPT_RC) { +@@ -327,8 +325,7 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp, + + skb_queue_head_init(&qp->resp_pkts); + +- rxe_init_task(&qp->resp.task, qp, +- rxe_responder, "resp"); ++ rxe_init_task(&qp->resp.task, qp, rxe_responder); + + qp->resp.opcode = OPCODE_NONE; + qp->resp.msn = 0; +diff --git a/drivers/infiniband/sw/rxe/rxe_task.c b/drivers/infiniband/sw/rxe/rxe_task.c +index ea7d5a69eb2a3..39b3adda16550 100644 +--- a/drivers/infiniband/sw/rxe/rxe_task.c ++++ b/drivers/infiniband/sw/rxe/rxe_task.c +@@ -114,12 +114,10 @@ void rxe_do_task(unsigned long data) + task->ret = ret; + } + +-int rxe_init_task(struct rxe_task *task, +- void *arg, int (*func)(void *), char *name) ++int rxe_init_task(struct rxe_task *task, void *arg, int (*func)(void *)) + { + task->arg = arg; + task->func = func; +- snprintf(task->name, sizeof(task->name), "%s", name); + task->destroyed = false; + + tasklet_init(&task->tasklet, rxe_do_task, (unsigned long)task); +diff --git a/drivers/infiniband/sw/rxe/rxe_task.h b/drivers/infiniband/sw/rxe/rxe_task.h +index e87ee072e3179..ecd81b1d1a8cb 100644 +--- a/drivers/infiniband/sw/rxe/rxe_task.h ++++ b/drivers/infiniband/sw/rxe/rxe_task.h +@@ -52,7 +52,6 @@ struct rxe_task { + void *arg; + int (*func)(void *arg); + int ret; +- char name[16]; + bool destroyed; + }; + +@@ -61,8 +60,7 @@ struct rxe_task { + * arg => parameter to pass to fcn + * fcn => function to call until it returns != 0 + */ +-int rxe_init_task(struct rxe_task *task, +- void *arg, int (*func)(void *), char *name); ++int rxe_init_task(struct rxe_task *task, void *arg, int (*func)(void *)); + + /* cleanup task */ + void rxe_cleanup_task(struct rxe_task *task); +-- +2.39.2 + diff --git a/queue-5.4/sctp-fix-an-error-code-in-sctp_sf_eat_auth.patch b/queue-5.4/sctp-fix-an-error-code-in-sctp_sf_eat_auth.patch new file mode 100644 index 00000000000..8e21b73e227 --- /dev/null +++ b/queue-5.4/sctp-fix-an-error-code-in-sctp_sf_eat_auth.patch @@ -0,0 +1,38 @@ +From e326704015ec60d39920bee370ac47287577da79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 14:05:19 +0300 +Subject: sctp: fix an error code in sctp_sf_eat_auth() + +From: Dan Carpenter + +[ Upstream commit 75e6def3b26736e7ff80639810098c9074229737 ] + +The sctp_sf_eat_auth() function is supposed to enum sctp_disposition +values and returning a kernel error code will cause issues in the +caller. Change -ENOMEM to SCTP_DISPOSITION_NOMEM. + +Fixes: 65b07e5d0d09 ("[SCTP]: API updates to suport SCTP-AUTH extensions.") +Signed-off-by: Dan Carpenter +Acked-by: Xin Long +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sctp/sm_statefuns.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c +index 1d2f633c6c7c3..67df4022853ba 100644 +--- a/net/sctp/sm_statefuns.c ++++ b/net/sctp/sm_statefuns.c +@@ -4379,7 +4379,7 @@ enum sctp_disposition sctp_sf_eat_auth(struct net *net, + SCTP_AUTH_NEW_KEY, GFP_ATOMIC); + + if (!ev) +- return -ENOMEM; ++ return SCTP_DISPOSITION_NOMEM; + + sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, + SCTP_ULPEVENT(ev)); +-- +2.39.2 + diff --git a/queue-5.4/selftests-ptp-fix-timestamp-printf-format-for-ptp_sy.patch b/queue-5.4/selftests-ptp-fix-timestamp-printf-format-for-ptp_sy.patch new file mode 100644 index 00000000000..79009ca2ad4 --- /dev/null +++ b/queue-5.4/selftests-ptp-fix-timestamp-printf-format-for-ptp_sy.patch @@ -0,0 +1,50 @@ +From c11fe840dab4b52a5d7d9ac58e103ad7ab1218f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 09:34:04 +0100 +Subject: selftests/ptp: Fix timestamp printf format for PTP_SYS_OFFSET + +From: Alex Maftei + +[ Upstream commit 76a4c8b82938bc5020b67663db41f451684bf327 ] + +Previously, timestamps were printed using "%lld.%u" which is incorrect +for nanosecond values lower than 100,000,000 as they're fractional +digits, therefore leading zeros are meaningful. + +This patch changes the format strings to "%lld.%09u" in order to add +leading zeros to the nanosecond value. + +Fixes: 568ebc5985f5 ("ptp: add the PTP_SYS_OFFSET ioctl to the testptp program") +Fixes: 4ec54f95736f ("ptp: Fix compiler warnings in the testptp utility") +Fixes: 6ab0e475f1f3 ("Documentation: fix misc. warnings") +Signed-off-by: Alex Maftei +Acked-by: Richard Cochran +Link: https://lore.kernel.org/r/20230615083404.57112-1-alex.maftei@amd.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/ptp/testptp.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/ptp/testptp.c b/tools/testing/selftests/ptp/testptp.c +index c0dd10257df5a..49e6eddcb3617 100644 +--- a/tools/testing/selftests/ptp/testptp.c ++++ b/tools/testing/selftests/ptp/testptp.c +@@ -455,11 +455,11 @@ int main(int argc, char *argv[]) + interval = t2 - t1; + offset = (t2 + t1) / 2 - tp; + +- printf("system time: %lld.%u\n", ++ printf("system time: %lld.%09u\n", + (pct+2*i)->sec, (pct+2*i)->nsec); +- printf("phc time: %lld.%u\n", ++ printf("phc time: %lld.%09u\n", + (pct+2*i+1)->sec, (pct+2*i+1)->nsec); +- printf("system time: %lld.%u\n", ++ printf("system time: %lld.%09u\n", + (pct+2*i+2)->sec, (pct+2*i+2)->nsec); + printf("system/phc clock time offset is %" PRId64 " ns\n" + "system clock time delay is %" PRId64 " ns\n", +-- +2.39.2 + diff --git a/queue-5.4/series b/queue-5.4/series index af9c271fff8..a59dc0fed3c 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -34,3 +34,27 @@ remove-decnet-support-from-kernel.patch usb-serial-option-add-quectel-em061kgl-series.patch serial-lantiq-add-missing-interrupt-ack.patch usb-dwc3-gadget-reset-num-trbs-before-giving-back-the-request.patch +spi-spi-fsl-dspi-remove-unused-chip-void_write_data.patch +spi-fsl-dspi-avoid-sck-glitches-with-continuous-tran.patch +netfilter-nfnetlink-skip-error-delivery-on-batch-in-.patch +ping6-fix-send-to-link-local-addresses-with-vrf.patch +net-sched-cls_u32-fix-reference-counter-leak-leading.patch +rdma-rxe-remove-the-unused-variable-obj.patch +rdma-rxe-removed-unused-name-from-rxe_task-struct.patch +rdma-rxe-fix-the-use-before-initialization-error-of-.patch +iavf-remove-mask-from-iavf_irq_enable_queues.patch +ib-uverbs-fix-to-consider-event-queue-closing-also-u.patch +ib-isert-fix-dead-lock-in-ib_isert.patch +ib-isert-fix-possible-list-corruption-in-cma-handler.patch +ib-isert-fix-incorrect-release-of-isert-connection.patch +ipvlan-fix-bound-dev-checking-for-ipv6-l3s-mode.patch +sctp-fix-an-error-code-in-sctp_sf_eat_auth.patch +igb-fix-nvm.ops.read-error-handling.patch +drm-nouveau-dp-check-for-null-nv_connector-native_mo.patch +drm-nouveau-kms-don-t-change-edid-when-it-hasn-t-act.patch +drm-nouveau-add-nv_encoder-pointer-check-for-null.patch +net-sched-cls_api-fix-lockup-on-flushing-explicitly-.patch +net-lapbether-only-support-ethernet-devices.patch +net-tipc-resize-nlattr-array-to-correct-size.patch +selftests-ptp-fix-timestamp-printf-format-for-ptp_sy.patch +afs-fix-vlserver-probe-rtt-handling.patch diff --git a/queue-5.4/spi-fsl-dspi-avoid-sck-glitches-with-continuous-tran.patch b/queue-5.4/spi-fsl-dspi-avoid-sck-glitches-with-continuous-tran.patch new file mode 100644 index 00000000000..5c751c4d14d --- /dev/null +++ b/queue-5.4/spi-fsl-dspi-avoid-sck-glitches-with-continuous-tran.patch @@ -0,0 +1,95 @@ +From 48d7bea6c91cebde42242fa22b333a899d8b6e02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 01:34:02 +0300 +Subject: spi: fsl-dspi: avoid SCK glitches with continuous transfers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Vladimir Oltean + +[ Upstream commit c5c31fb71f16ba75bad4ade208abbae225305b65 ] + +The DSPI controller has configurable timing for + +(a) tCSC: the interval between the assertion of the chip select and the + first clock edge + +(b) tASC: the interval between the last clock edge and the deassertion + of the chip select + +What is a bit surprising, but is documented in the figure "Example of +continuous transfer (CPHA=1, CONT=1)" in the datasheet, is that when the +chip select stays asserted between multiple TX FIFO writes, the tCSC and +tASC times still apply. With CONT=1, chip select remains asserted, but +SCK takes a break and goes to the idle state for tASC + tCSC ns. + +In other words, the default values (of 0 and 0 ns) result in SCK +glitches where the SCK transition to the idle state, as well as the SCK +transition from the idle state, will have no delay in between, and it +may appear that a SCK cycle has simply gone missing. The resulting +timing violation might cause data corruption in many peripherals, as +their chip select is asserted. + +The driver has device tree bindings for tCSC ("fsl,spi-cs-sck-delay") +and tASC ("fsl,spi-sck-cs-delay"), but these are only specified to apply +when the chip select toggles in the first place, and this timing +characteristic depends on each peripheral. Many peripherals do not have +explicit timing requirements, so many device trees do not have these +properties present at all. + +Nonetheless, the lack of SCK glitches is a common sense requirement, and +since the SCK stays in the idle state during transfers for tCSC+tASC ns, +and that in itself should look like half a cycle, then let's ensure that +tCSC and tASC are at least a quarter of a SCK period, such that their +sum is at least half of one. + +Fixes: 95bf15f38641 ("spi: fsl-dspi: Add ~50ns delay between cs and sck") +Reported-by: Lisa Chen (陈敏捷) +Debugged-by: Lisa Chen (陈敏捷) +Tested-by: Lisa Chen (陈敏捷) +Signed-off-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20230529223402.1199503-1-vladimir.oltean@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-dspi.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c +index 51e17f0828646..351b2989db071 100644 +--- a/drivers/spi/spi-fsl-dspi.c ++++ b/drivers/spi/spi-fsl-dspi.c +@@ -816,7 +816,9 @@ static int dspi_transfer_one_message(struct spi_controller *ctlr, + static int dspi_setup(struct spi_device *spi) + { + struct fsl_dspi *dspi = spi_controller_get_devdata(spi->controller); ++ u32 period_ns = DIV_ROUND_UP(NSEC_PER_SEC, spi->max_speed_hz); + unsigned char br = 0, pbr = 0, pcssck = 0, cssck = 0; ++ u32 quarter_period_ns = DIV_ROUND_UP(period_ns, 4); + u32 cs_sck_delay = 0, sck_cs_delay = 0; + struct fsl_dspi_platform_data *pdata; + unsigned char pasc = 0, asc = 0; +@@ -844,6 +846,19 @@ static int dspi_setup(struct spi_device *spi) + sck_cs_delay = pdata->sck_cs_delay; + } + ++ /* Since tCSC and tASC apply to continuous transfers too, avoid SCK ++ * glitches of half a cycle by never allowing tCSC + tASC to go below ++ * half a SCK period. ++ */ ++ if (cs_sck_delay < quarter_period_ns) ++ cs_sck_delay = quarter_period_ns; ++ if (sck_cs_delay < quarter_period_ns) ++ sck_cs_delay = quarter_period_ns; ++ ++ dev_dbg(&spi->dev, ++ "DSPI controller timing params: CS-to-SCK delay %u ns, SCK-to-CS delay %u ns\n", ++ cs_sck_delay, sck_cs_delay); ++ + clkrate = clk_get_rate(dspi->clk); + hz_to_spi_baud(&pbr, &br, spi->max_speed_hz, clkrate); + +-- +2.39.2 + diff --git a/queue-5.4/spi-spi-fsl-dspi-remove-unused-chip-void_write_data.patch b/queue-5.4/spi-spi-fsl-dspi-remove-unused-chip-void_write_data.patch new file mode 100644 index 00000000000..ec90ef04eaa --- /dev/null +++ b/queue-5.4/spi-spi-fsl-dspi-remove-unused-chip-void_write_data.patch @@ -0,0 +1,65 @@ +From df2e6e473b491dd495a008eb51e53dd40ad9c944 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Mar 2020 00:00:34 +0200 +Subject: spi: spi-fsl-dspi: Remove unused chip->void_write_data + +From: Vladimir Oltean + +[ Upstream commit 6d6af5796e5d9a88ae83c9c753023bba61deb18b ] + +This variable has been present since the initial submission of the +driver, and held, for some reason, the value of zero, to be sent on the +wire in the case there wasn't any TX buffer for the current transfer. + +Since quite a while now, however, it isn't doing anything at all. + +Signed-off-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20200304220044.11193-3-olteanv@gmail.com +Signed-off-by: Mark Brown +Stable-dep-of: c5c31fb71f16 ("spi: fsl-dspi: avoid SCK glitches with continuous transfers") +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-dspi.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c +index 3e0200618af30..51e17f0828646 100644 +--- a/drivers/spi/spi-fsl-dspi.c ++++ b/drivers/spi/spi-fsl-dspi.c +@@ -121,7 +121,6 @@ + + struct chip_data { + u32 ctar_val; +- u16 void_write_data; + }; + + enum dspi_trans_mode { +@@ -190,7 +189,6 @@ struct fsl_dspi { + const void *tx; + void *rx; + void *rx_end; +- u16 void_write_data; + u16 tx_cmd; + u8 bits_per_word; + u8 bytes_per_word; +@@ -748,8 +746,6 @@ static int dspi_transfer_one_message(struct spi_controller *ctlr, + dspi->tx_cmd |= SPI_PUSHR_CMD_CONT; + } + +- dspi->void_write_data = dspi->cur_chip->void_write_data; +- + dspi->tx = transfer->tx_buf; + dspi->rx = transfer->rx_buf; + dspi->rx_end = dspi->rx + transfer->len; +@@ -848,8 +844,6 @@ static int dspi_setup(struct spi_device *spi) + sck_cs_delay = pdata->sck_cs_delay; + } + +- chip->void_write_data = 0; +- + clkrate = clk_get_rate(dspi->clk); + hz_to_spi_baud(&pbr, &br, spi->max_speed_hz, clkrate); + +-- +2.39.2 +