From: Sasha Levin Date: Mon, 27 Jun 2022 03:09:32 +0000 (-0400) Subject: Fixes for 4.19 X-Git-Tag: v5.10.126~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6f2fcaa1761444b283d0a258111598aa8db560f3;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/afs-fix-dynamic-root-getattr.patch b/queue-4.19/afs-fix-dynamic-root-getattr.patch new file mode 100644 index 00000000000..29dea9e8136 --- /dev/null +++ b/queue-4.19/afs-fix-dynamic-root-getattr.patch @@ -0,0 +1,59 @@ +From 0324e2c6d85c6dd7277619b6cb7b93da6f42ff55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jun 2022 15:59:57 +0100 +Subject: afs: Fix dynamic root getattr + +From: David Howells + +[ Upstream commit cb78d1b5efffe4cf97e16766329dd7358aed3deb ] + +The recent patch to make afs_getattr consult the server didn't account +for the pseudo-inodes employed by the dynamic root-type afs superblock +not having a volume or a server to access, and thus an oops occurs if +such a directory is stat'd. + +Fix this by checking to see if the vnode->volume pointer actually points +anywhere before following it in afs_getattr(). + +This can be tested by stat'ing a directory in /afs. It may be +sufficient just to do "ls /afs" and the oops looks something like: + + BUG: kernel NULL pointer dereference, address: 0000000000000020 + ... + RIP: 0010:afs_getattr+0x8b/0x14b + ... + Call Trace: + + vfs_statx+0x79/0xf5 + vfs_fstatat+0x49/0x62 + +Fixes: 2aeb8c86d499 ("afs: Fix afs_getattr() to refetch file status if callback break occurred") +Reported-by: Marc Dionne +Signed-off-by: David Howells +Reviewed-by: Marc Dionne +Tested-by: Marc Dionne +cc: linux-afs@lists.infradead.org +Link: https://lore.kernel.org/r/165408450783.1031787.7941404776393751186.stgit@warthog.procyon.org.uk/ +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/afs/inode.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/afs/inode.c b/fs/afs/inode.c +index a12ae3ef8fb4..0983d7e859c8 100644 +--- a/fs/afs/inode.c ++++ b/fs/afs/inode.c +@@ -473,7 +473,8 @@ int afs_getattr(const struct path *path, struct kstat *stat, + + _enter("{ ino=%lu v=%u }", inode->i_ino, inode->i_generation); + +- if (!(query_flags & AT_STATX_DONT_SYNC) && ++ if (vnode->volume && ++ !(query_flags & AT_STATX_DONT_SYNC) && + !test_bit(AFS_VNODE_CB_PROMISED, &vnode->flags)) { + key = afs_request_key(vnode->volume->cell); + if (IS_ERR(key)) +-- +2.35.1 + diff --git a/queue-4.19/bonding-arp-monitor-spams-netdev_notify_peers-notifi.patch b/queue-4.19/bonding-arp-monitor-spams-netdev_notify_peers-notifi.patch new file mode 100644 index 00000000000..d30cce09361 --- /dev/null +++ b/queue-4.19/bonding-arp-monitor-spams-netdev_notify_peers-notifi.patch @@ -0,0 +1,48 @@ +From a8d28b3c4471d5ff60d0027acd20f9e8205a7c12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jun 2022 12:32:40 -0700 +Subject: bonding: ARP monitor spams NETDEV_NOTIFY_PEERS notifiers + +From: Jay Vosburgh + +[ Upstream commit 7a9214f3d88cfdb099f3896e102a306b316d8707 ] + +The bonding ARP monitor fails to decrement send_peer_notif, the +number of peer notifications (gratuitous ARP or ND) to be sent. This +results in a continuous series of notifications. + +Correct this by decrementing the counter for each notification. + +Reported-by: Jonathan Toppins +Signed-off-by: Jay Vosburgh +Fixes: b0929915e035 ("bonding: Fix RTNL: assertion failed at net/core/rtnetlink.c for ab arp monitor") +Link: https://lore.kernel.org/netdev/b2fd4147-8f50-bebd-963a-1a3e8d1d9715@redhat.com/ +Tested-by: Jonathan Toppins +Reviewed-by: Jonathan Toppins +Link: https://lore.kernel.org/r/9400.1655407960@famine +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 2d70cdd26f89..cab5c1cc9fe9 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -3069,9 +3069,11 @@ static void bond_activebackup_arp_mon(struct bonding *bond) + if (!rtnl_trylock()) + return; + +- if (should_notify_peers) ++ if (should_notify_peers) { ++ bond->send_peer_notif--; + call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, + bond->dev); ++ } + if (should_notify_rtnl) { + bond_slave_state_notify(bond); + bond_slave_link_notify(bond); +-- +2.35.1 + diff --git a/queue-4.19/erspan-do-not-assume-transport-header-is-always-set.patch b/queue-4.19/erspan-do-not-assume-transport-header-is-always-set.patch new file mode 100644 index 00000000000..9dcd6d629fe --- /dev/null +++ b/queue-4.19/erspan-do-not-assume-transport-header-is-always-set.patch @@ -0,0 +1,127 @@ +From a56c985d484eeee70d0fc7986ee096ad807b4efd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jun 2022 01:35:06 -0700 +Subject: erspan: do not assume transport header is always set + +From: Eric Dumazet + +[ Upstream commit 301bd140ed0b24f0da660874c7e8a47dad8c8222 ] + +Rewrite tests in ip6erspan_tunnel_xmit() and +erspan_fb_xmit() to not assume transport header is set. + +syzbot reported: + +WARNING: CPU: 0 PID: 1350 at include/linux/skbuff.h:2911 skb_transport_header include/linux/skbuff.h:2911 [inline] +WARNING: CPU: 0 PID: 1350 at include/linux/skbuff.h:2911 ip6erspan_tunnel_xmit+0x15af/0x2eb0 net/ipv6/ip6_gre.c:963 +Modules linked in: +CPU: 0 PID: 1350 Comm: aoe_tx0 Not tainted 5.19.0-rc2-syzkaller-00160-g274295c6e53f #0 +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 +RIP: 0010:skb_transport_header include/linux/skbuff.h:2911 [inline] +RIP: 0010:ip6erspan_tunnel_xmit+0x15af/0x2eb0 net/ipv6/ip6_gre.c:963 +Code: 0f 47 f0 40 88 b5 7f fe ff ff e8 8c 16 4b f9 89 de bf ff ff ff ff e8 a0 12 4b f9 66 83 fb ff 0f 85 1d f1 ff ff e8 71 16 4b f9 <0f> 0b e9 43 f0 ff ff e8 65 16 4b f9 48 8d 85 30 ff ff ff ba 60 00 +RSP: 0018:ffffc90005daf910 EFLAGS: 00010293 +RAX: 0000000000000000 RBX: 000000000000ffff RCX: 0000000000000000 +RDX: ffff88801f032100 RSI: ffffffff882e8d3f RDI: 0000000000000003 +RBP: ffffc90005dafab8 R08: 0000000000000003 R09: 000000000000ffff +R10: 000000000000ffff R11: 0000000000000000 R12: ffff888024f21d40 +R13: 000000000000a288 R14: 00000000000000b0 R15: ffff888025a2e000 +FS: 0000000000000000(0000) GS:ffff88802c800000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000001b2e425000 CR3: 000000006d099000 CR4: 0000000000152ef0 +Call Trace: + +__netdev_start_xmit include/linux/netdevice.h:4805 [inline] +netdev_start_xmit include/linux/netdevice.h:4819 [inline] +xmit_one net/core/dev.c:3588 [inline] +dev_hard_start_xmit+0x188/0x880 net/core/dev.c:3604 +sch_direct_xmit+0x19f/0xbe0 net/sched/sch_generic.c:342 +__dev_xmit_skb net/core/dev.c:3815 [inline] +__dev_queue_xmit+0x14a1/0x3900 net/core/dev.c:4219 +dev_queue_xmit include/linux/netdevice.h:2994 [inline] +tx+0x6a/0xc0 drivers/block/aoe/aoenet.c:63 +kthread+0x1e7/0x3b0 drivers/block/aoe/aoecmd.c:1229 +kthread+0x2e9/0x3a0 kernel/kthread.c:376 +ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 + + +Fixes: d5db21a3e697 ("erspan: auto detect truncated ipv6 packets.") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Cc: William Tu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/ip_gre.c | 15 ++++++++++----- + net/ipv6/ip6_gre.c | 15 ++++++++++----- + 2 files changed, 20 insertions(+), 10 deletions(-) + +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index cf60d0e07965..c72432ce9bf5 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -574,7 +574,6 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev) + int tunnel_hlen; + int version; + int nhoff; +- int thoff; + + tun_info = skb_tunnel_info(skb); + if (unlikely(!tun_info || !(tun_info->mode & IP_TUNNEL_INFO_TX) || +@@ -609,10 +608,16 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev) + (ntohs(ip_hdr(skb)->tot_len) > skb->len - nhoff)) + truncate = true; + +- thoff = skb_transport_header(skb) - skb_mac_header(skb); +- if (skb->protocol == htons(ETH_P_IPV6) && +- (ntohs(ipv6_hdr(skb)->payload_len) > skb->len - thoff)) +- truncate = true; ++ if (skb->protocol == htons(ETH_P_IPV6)) { ++ int thoff; ++ ++ if (skb_transport_header_was_set(skb)) ++ thoff = skb_transport_header(skb) - skb_mac_header(skb); ++ else ++ thoff = nhoff + sizeof(struct ipv6hdr); ++ if (ntohs(ipv6_hdr(skb)->payload_len) > skb->len - thoff) ++ truncate = true; ++ } + + if (version == 1) { + erspan_build_header(skb, ntohl(tunnel_id_to_key32(key->tun_id)), +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c +index 4fd6c0929b14..e617a98f4df6 100644 +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -946,7 +946,6 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb, + __be16 proto; + __u32 mtu; + int nhoff; +- int thoff; + + if (!pskb_inet_may_pull(skb)) + goto tx_err; +@@ -967,10 +966,16 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb, + (ntohs(ip_hdr(skb)->tot_len) > skb->len - nhoff)) + truncate = true; + +- thoff = skb_transport_header(skb) - skb_mac_header(skb); +- if (skb->protocol == htons(ETH_P_IPV6) && +- (ntohs(ipv6_hdr(skb)->payload_len) > skb->len - thoff)) +- truncate = true; ++ if (skb->protocol == htons(ETH_P_IPV6)) { ++ int thoff; ++ ++ if (skb_transport_header_was_set(skb)) ++ thoff = skb_transport_header(skb) - skb_mac_header(skb); ++ else ++ thoff = nhoff + sizeof(struct ipv6hdr); ++ if (ntohs(ipv6_hdr(skb)->payload_len) > skb->len - thoff) ++ truncate = true; ++ } + + if (skb_cow_head(skb, dev->needed_headroom ?: t->hlen)) + goto tx_err; +-- +2.35.1 + diff --git a/queue-4.19/gpio-winbond-fix-error-code-in-winbond_gpio_get.patch b/queue-4.19/gpio-winbond-fix-error-code-in-winbond_gpio_get.patch new file mode 100644 index 00000000000..20e440e71ea --- /dev/null +++ b/queue-4.19/gpio-winbond-fix-error-code-in-winbond_gpio_get.patch @@ -0,0 +1,45 @@ +From c62988e132d549d407980f77a8de1f482117a4f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jun 2022 11:29:48 +0300 +Subject: gpio: winbond: Fix error code in winbond_gpio_get() + +From: Dan Carpenter + +[ Upstream commit 9ca766eaea2e87b8b773bff04ee56c055cb76d4e ] + +This error path returns 1, but it should instead propagate the negative +error code from winbond_sio_enter(). + +Fixes: a0d65009411c ("gpio: winbond: Add driver") +Signed-off-by: Dan Carpenter +Reviewed-by: Andy Shevchenko +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-winbond.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpio/gpio-winbond.c b/drivers/gpio/gpio-winbond.c +index 7f8f5b02e31d..4b61d975cc0e 100644 +--- a/drivers/gpio/gpio-winbond.c ++++ b/drivers/gpio/gpio-winbond.c +@@ -385,12 +385,13 @@ static int winbond_gpio_get(struct gpio_chip *gc, unsigned int offset) + unsigned long *base = gpiochip_get_data(gc); + const struct winbond_gpio_info *info; + bool val; ++ int ret; + + winbond_gpio_get_info(&offset, &info); + +- val = winbond_sio_enter(*base); +- if (val) +- return val; ++ ret = winbond_sio_enter(*base); ++ if (ret) ++ return ret; + + winbond_sio_select_logical(*base, info->dev); + +-- +2.35.1 + diff --git a/queue-4.19/igb-make-dma-faster-when-cpu-is-active-on-the-pcie-l.patch b/queue-4.19/igb-make-dma-faster-when-cpu-is-active-on-the-pcie-l.patch new file mode 100644 index 00000000000..3b4525726bb --- /dev/null +++ b/queue-4.19/igb-make-dma-faster-when-cpu-is-active-on-the-pcie-l.patch @@ -0,0 +1,83 @@ +From 5a90ffb710c62687f05085e83489018b73c49808 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jun 2022 15:10:56 -0700 +Subject: igb: Make DMA faster when CPU is active on the PCIe link + +From: Kai-Heng Feng + +[ Upstream commit 4e0effd9007ea0be31f7488611eb3824b4541554 ] + +Intel I210 on some Intel Alder Lake platforms can only achieve ~750Mbps +Tx speed via iperf. The RR2DCDELAY shows around 0x2xxx DMA delay, which +will be significantly lower when 1) ASPM is disabled or 2) SoC package +c-state stays above PC3. When the RR2DCDELAY is around 0x1xxx the Tx +speed can reach to ~950Mbps. + +According to the I210 datasheet "8.26.1 PCIe Misc. Register - PCIEMISC", +"DMA Idle Indication" doesn't seem to tie to DMA coalesce anymore, so +set it to 1b for "DMA is considered idle when there is no Rx or Tx AND +when there are no TLPs indicating that CPU is active detected on the +PCIe link (such as the host executes CSR or Configuration register read +or write operation)" and performing Tx should also fall under "active +CPU on PCIe link" case. + +In addition to that, commit b6e0c419f040 ("igb: Move DMA Coalescing init +code to separate function.") seems to wrongly changed from enabling +E1000_PCIEMISC_LX_DECISION to disabling it, also fix that. + +Fixes: b6e0c419f040 ("igb: Move DMA Coalescing init code to separate function.") +Signed-off-by: Kai-Heng Feng +Tested-by: Gurucharan (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Link: https://lore.kernel.org/r/20220621221056.604304-1-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igb/igb_main.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c +index a93edd31011f..9f45ecd9e8e5 100644 +--- a/drivers/net/ethernet/intel/igb/igb_main.c ++++ b/drivers/net/ethernet/intel/igb/igb_main.c +@@ -9444,11 +9444,10 @@ static void igb_init_dmac(struct igb_adapter *adapter, u32 pba) + struct e1000_hw *hw = &adapter->hw; + u32 dmac_thr; + u16 hwm; ++ u32 reg; + + if (hw->mac.type > e1000_82580) { + if (adapter->flags & IGB_FLAG_DMAC) { +- u32 reg; +- + /* force threshold to 0. */ + wr32(E1000_DMCTXTH, 0); + +@@ -9481,7 +9480,6 @@ static void igb_init_dmac(struct igb_adapter *adapter, u32 pba) + /* Disable BMC-to-OS Watchdog Enable */ + if (hw->mac.type != e1000_i354) + reg &= ~E1000_DMACR_DC_BMC2OSW_EN; +- + wr32(E1000_DMACR, reg); + + /* no lower threshold to disable +@@ -9498,12 +9496,12 @@ static void igb_init_dmac(struct igb_adapter *adapter, u32 pba) + */ + wr32(E1000_DMCTXTH, (IGB_MIN_TXPBSIZE - + (IGB_TX_BUF_4096 + adapter->max_frame_size)) >> 6); ++ } + +- /* make low power state decision controlled +- * by DMA coal +- */ ++ if (hw->mac.type >= e1000_i210 || ++ (adapter->flags & IGB_FLAG_DMAC)) { + reg = rd32(E1000_PCIEMISC); +- reg &= ~E1000_PCIEMISC_LX_DECISION; ++ reg |= E1000_PCIEMISC_LX_DECISION; + wr32(E1000_PCIEMISC, reg); + } /* endif adapter->dmac is not disabled */ + } else if (hw->mac.type == e1000_82580) { +-- +2.35.1 + diff --git a/queue-4.19/iio-adc-vf610-fix-conversion-mode-sysfs-node-name.patch b/queue-4.19/iio-adc-vf610-fix-conversion-mode-sysfs-node-name.patch new file mode 100644 index 00000000000..4d3a503eb28 --- /dev/null +++ b/queue-4.19/iio-adc-vf610-fix-conversion-mode-sysfs-node-name.patch @@ -0,0 +1,35 @@ +From dfe28d80b1a366f5a3e42f9de10740ab72ee4856 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 May 2022 11:50:26 +0300 +Subject: iio: adc: vf610: fix conversion mode sysfs node name + +From: Baruch Siach + +[ Upstream commit f1a633b15cd5371a2a83f02c513984e51132dd68 ] + +The documentation missed the "in_" prefix for this IIO_SHARED_BY_DIR +entry. + +Fixes: bf04c1a367e3 ("iio: adc: vf610: implement configurable conversion modes") +Signed-off-by: Baruch Siach +Acked-by: Haibo Chen +Link: https://lore.kernel.org/r/560dc93fafe5ef7e9a409885fd20b6beac3973d8.1653900626.git.baruch@tkos.co.il +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + Documentation/ABI/testing/sysfs-bus-iio-vf610 | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Documentation/ABI/testing/sysfs-bus-iio-vf610 b/Documentation/ABI/testing/sysfs-bus-iio-vf610 +index 308a6756d3bf..491ead804488 100644 +--- a/Documentation/ABI/testing/sysfs-bus-iio-vf610 ++++ b/Documentation/ABI/testing/sysfs-bus-iio-vf610 +@@ -1,4 +1,4 @@ +-What: /sys/bus/iio/devices/iio:deviceX/conversion_mode ++What: /sys/bus/iio/devices/iio:deviceX/in_conversion_mode + KernelVersion: 4.2 + Contact: linux-iio@vger.kernel.org + Description: +-- +2.35.1 + diff --git a/queue-4.19/mips-remove-repetitive-increase-irq_err_count.patch b/queue-4.19/mips-remove-repetitive-increase-irq_err_count.patch new file mode 100644 index 00000000000..f9b0e823361 --- /dev/null +++ b/queue-4.19/mips-remove-repetitive-increase-irq_err_count.patch @@ -0,0 +1,61 @@ +From bc846d85fa4bb3a7f6e87457da5411b7b78dd746 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jun 2022 19:14:20 +0800 +Subject: MIPS: Remove repetitive increase irq_err_count + +From: huhai + +[ Upstream commit c81aba8fde2aee4f5778ebab3a1d51bd2ef48e4c ] + +commit 979934da9e7a ("[PATCH] mips: update IRQ handling for vr41xx") added +a function irq_dispatch, and it'll increase irq_err_count when the get_irq +callback returns a negative value, but increase irq_err_count in get_irq +was not removed. + +And also, modpost complains once gpio-vr41xx drivers become modules. + ERROR: modpost: "irq_err_count" [drivers/gpio/gpio-vr41xx.ko] undefined! + +So it would be a good idea to remove repetitive increase irq_err_count in +get_irq callback. + +Fixes: 27fdd325dace ("MIPS: Update VR41xx GPIO driver to use gpiolib") +Fixes: 979934da9e7a ("[PATCH] mips: update IRQ handling for vr41xx") +Reported-by: k2ci +Signed-off-by: huhai +Signed-off-by: Genjian Zhang +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/vr41xx/common/icu.c | 2 -- + drivers/gpio/gpio-vr41xx.c | 2 -- + 2 files changed, 4 deletions(-) + +diff --git a/arch/mips/vr41xx/common/icu.c b/arch/mips/vr41xx/common/icu.c +index 745b7b436961..42f77b318974 100644 +--- a/arch/mips/vr41xx/common/icu.c ++++ b/arch/mips/vr41xx/common/icu.c +@@ -653,8 +653,6 @@ static int icu_get_irq(unsigned int irq) + + printk(KERN_ERR "spurious ICU interrupt: %04x,%04x\n", pend1, pend2); + +- atomic_inc(&irq_err_count); +- + return -1; + } + +diff --git a/drivers/gpio/gpio-vr41xx.c b/drivers/gpio/gpio-vr41xx.c +index 027699cec911..217b077838af 100644 +--- a/drivers/gpio/gpio-vr41xx.c ++++ b/drivers/gpio/gpio-vr41xx.c +@@ -230,8 +230,6 @@ static int giu_get_irq(unsigned int irq) + printk(KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n", + maskl, pendl, maskh, pendh); + +- atomic_inc(&irq_err_count); +- + return -EINVAL; + } + +-- +2.35.1 + diff --git a/queue-4.19/net-sched-sch_netem-fix-arithmetic-in-netem_dump-for.patch b/queue-4.19/net-sched-sch_netem-fix-arithmetic-in-netem_dump-for.patch new file mode 100644 index 00000000000..e73c25d65f2 --- /dev/null +++ b/queue-4.19/net-sched-sch_netem-fix-arithmetic-in-netem_dump-for.patch @@ -0,0 +1,73 @@ +From cbd0481cb67b41faadb9c618a1be7778386488b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jun 2022 16:43:36 -0700 +Subject: net/sched: sch_netem: Fix arithmetic in netem_dump() for 32-bit + platforms + +From: Peilin Ye + +[ Upstream commit a2b1a5d40bd12b44322c2ccd40bb0ec1699708b6 ] + +As reported by Yuming, currently tc always show a latency of UINT_MAX +for netem Qdisc's on 32-bit platforms: + + $ tc qdisc add dev dummy0 root netem latency 100ms + $ tc qdisc show dev dummy0 + qdisc netem 8001: root refcnt 2 limit 1000 delay 275s 275s + ^^^^^^^^^^^^^^^^ + +Let us take a closer look at netem_dump(): + + qopt.latency = min_t(psched_tdiff_t, PSCHED_NS2TICKS(q->latency, + UINT_MAX); + +qopt.latency is __u32, psched_tdiff_t is signed long, +(psched_tdiff_t)(UINT_MAX) is negative for 32-bit platforms, so +qopt.latency is always UINT_MAX. + +Fix it by using psched_time_t (u64) instead. + +Note: confusingly, users have two ways to specify 'latency': + + 1. normally, via '__u32 latency' in struct tc_netem_qopt; + 2. via the TCA_NETEM_LATENCY64 attribute, which is s64. + +For the second case, theoretically 'latency' could be negative. This +patch ignores that corner case, since it is broken (i.e. assigning a +negative s64 to __u32) anyways, and should be handled separately. + +Thanks Ted Lin for the analysis [1] . + +[1] https://github.com/raspberrypi/linux/issues/3512 + +Reported-by: Yuming Chen +Fixes: 112f9cb65643 ("netem: convert to qdisc_watchdog_schedule_ns") +Reviewed-by: Cong Wang +Signed-off-by: Peilin Ye +Acked-by: Stephen Hemminger +Link: https://lore.kernel.org/r/20220616234336.2443-1-yepeilin.cs@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/sch_netem.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c +index ad400f4f9a2d..31793af1a77b 100644 +--- a/net/sched/sch_netem.c ++++ b/net/sched/sch_netem.c +@@ -1120,9 +1120,9 @@ static int netem_dump(struct Qdisc *sch, struct sk_buff *skb) + struct tc_netem_rate rate; + struct tc_netem_slot slot; + +- qopt.latency = min_t(psched_tdiff_t, PSCHED_NS2TICKS(q->latency), ++ qopt.latency = min_t(psched_time_t, PSCHED_NS2TICKS(q->latency), + UINT_MAX); +- qopt.jitter = min_t(psched_tdiff_t, PSCHED_NS2TICKS(q->jitter), ++ qopt.jitter = min_t(psched_time_t, PSCHED_NS2TICKS(q->jitter), + UINT_MAX); + qopt.limit = q->limit; + qopt.loss = q->loss; +-- +2.35.1 + diff --git a/queue-4.19/series b/queue-4.19/series index 1018912b6e2..d5cd7b3d65c 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -9,3 +9,13 @@ random-quiet-urandom-warning-ratelimit-suppression-message.patch usb-serial-option-add-telit-le910cx-0x1250-composition.patch usb-serial-option-add-quectel-em05-g-modem.patch usb-serial-option-add-quectel-rm500k-module-support.patch +bonding-arp-monitor-spams-netdev_notify_peers-notifi.patch +net-sched-sch_netem-fix-arithmetic-in-netem_dump-for.patch +erspan-do-not-assume-transport-header-is-always-set.patch +x86-xen-remove-undefined-behavior-in-setup_features.patch +mips-remove-repetitive-increase-irq_err_count.patch +afs-fix-dynamic-root-getattr.patch +igb-make-dma-faster-when-cpu-is-active-on-the-pcie-l.patch +virtio_net-fix-xdp_rxq_info-bug-after-suspend-resume.patch +gpio-winbond-fix-error-code-in-winbond_gpio_get.patch +iio-adc-vf610-fix-conversion-mode-sysfs-node-name.patch diff --git a/queue-4.19/virtio_net-fix-xdp_rxq_info-bug-after-suspend-resume.patch b/queue-4.19/virtio_net-fix-xdp_rxq_info-bug-after-suspend-resume.patch new file mode 100644 index 00000000000..85bba3e7e42 --- /dev/null +++ b/queue-4.19/virtio_net-fix-xdp_rxq_info-bug-after-suspend-resume.patch @@ -0,0 +1,115 @@ +From fa90ee8895ee45a3dc296f1dcc732599b7af2a2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jun 2022 13:48:44 +0200 +Subject: virtio_net: fix xdp_rxq_info bug after suspend/resume + +From: Stephan Gerhold + +[ Upstream commit 8af52fe9fd3bf5e7478da99193c0632276e1dfce ] + +The following sequence currently causes a driver bug warning +when using virtio_net: + + # ip link set eth0 up + # echo mem > /sys/power/state (or e.g. # rtcwake -s 10 -m mem) + + # ip link set eth0 down + + Missing register, driver bug + WARNING: CPU: 0 PID: 375 at net/core/xdp.c:138 xdp_rxq_info_unreg+0x58/0x60 + Call trace: + xdp_rxq_info_unreg+0x58/0x60 + virtnet_close+0x58/0xac + __dev_close_many+0xac/0x140 + __dev_change_flags+0xd8/0x210 + dev_change_flags+0x24/0x64 + do_setlink+0x230/0xdd0 + ... + +This happens because virtnet_freeze() frees the receive_queue +completely (including struct xdp_rxq_info) but does not call +xdp_rxq_info_unreg(). Similarly, virtnet_restore() sets up the +receive_queue again but does not call xdp_rxq_info_reg(). + +Actually, parts of virtnet_freeze_down() and virtnet_restore_up() +are almost identical to virtnet_close() and virtnet_open(): only +the calls to xdp_rxq_info_(un)reg() are missing. This means that +we can fix this easily and avoid such problems in the future by +just calling virtnet_close()/open() from the freeze/restore handlers. + +Aside from adding the missing xdp_rxq_info calls the only difference +is that the refill work is only cancelled if netif_running(). However, +this should not make any functional difference since the refill work +should only be active if the network interface is actually up. + +Fixes: 754b8a21a96d ("virtio_net: setup xdp_rxq_info") +Signed-off-by: Stephan Gerhold +Acked-by: Jesper Dangaard Brouer +Acked-by: Jason Wang +Link: https://lore.kernel.org/r/20220621114845.3650258-1-stephan.gerhold@kernkonzept.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/virtio_net.c | 25 ++++++------------------- + 1 file changed, 6 insertions(+), 19 deletions(-) + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 1a8fe5bacb19..415b26c80fe7 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -2315,7 +2315,6 @@ static const struct ethtool_ops virtnet_ethtool_ops = { + static void virtnet_freeze_down(struct virtio_device *vdev) + { + struct virtnet_info *vi = vdev->priv; +- int i; + + /* Make sure no work handler is accessing the device */ + flush_work(&vi->config_work); +@@ -2323,14 +2322,8 @@ static void virtnet_freeze_down(struct virtio_device *vdev) + netif_tx_lock_bh(vi->dev); + netif_device_detach(vi->dev); + netif_tx_unlock_bh(vi->dev); +- cancel_delayed_work_sync(&vi->refill); +- +- if (netif_running(vi->dev)) { +- for (i = 0; i < vi->max_queue_pairs; i++) { +- napi_disable(&vi->rq[i].napi); +- virtnet_napi_tx_disable(&vi->sq[i].napi); +- } +- } ++ if (netif_running(vi->dev)) ++ virtnet_close(vi->dev); + } + + static int init_vqs(struct virtnet_info *vi); +@@ -2338,7 +2331,7 @@ static int init_vqs(struct virtnet_info *vi); + static int virtnet_restore_up(struct virtio_device *vdev) + { + struct virtnet_info *vi = vdev->priv; +- int err, i; ++ int err; + + err = init_vqs(vi); + if (err) +@@ -2347,15 +2340,9 @@ static int virtnet_restore_up(struct virtio_device *vdev) + virtio_device_ready(vdev); + + if (netif_running(vi->dev)) { +- for (i = 0; i < vi->curr_queue_pairs; i++) +- if (!try_fill_recv(vi, &vi->rq[i], GFP_KERNEL)) +- schedule_delayed_work(&vi->refill, 0); +- +- for (i = 0; i < vi->max_queue_pairs; i++) { +- virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi); +- virtnet_napi_tx_enable(vi, vi->sq[i].vq, +- &vi->sq[i].napi); +- } ++ err = virtnet_open(vi->dev); ++ if (err) ++ return err; + } + + netif_tx_lock_bh(vi->dev); +-- +2.35.1 + diff --git a/queue-4.19/x86-xen-remove-undefined-behavior-in-setup_features.patch b/queue-4.19/x86-xen-remove-undefined-behavior-in-setup_features.patch new file mode 100644 index 00000000000..38ef9224d52 --- /dev/null +++ b/queue-4.19/x86-xen-remove-undefined-behavior-in-setup_features.patch @@ -0,0 +1,36 @@ +From 8b667c0ddf8fb1e392e288f3981f3ecd1b1ddb87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jun 2022 11:30:37 +0100 +Subject: x86/xen: Remove undefined behavior in setup_features() + +From: Julien Grall + +[ Upstream commit ecb6237fa397b7b810d798ad19322eca466dbab1 ] + +1 << 31 is undefined. So switch to 1U << 31. + +Fixes: 5ead97c84fa7 ("xen: Core Xen implementation") +Signed-off-by: Julien Grall +Reviewed-by: Juergen Gross +Link: https://lore.kernel.org/r/20220617103037.57828-1-julien@xen.org +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + drivers/xen/features.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/xen/features.c b/drivers/xen/features.c +index d7d34fdfc993..f466f776604f 100644 +--- a/drivers/xen/features.c ++++ b/drivers/xen/features.c +@@ -28,6 +28,6 @@ void xen_setup_features(void) + if (HYPERVISOR_xen_version(XENVER_get_features, &fi) < 0) + break; + for (j = 0; j < 32; j++) +- xen_features[i * 32 + j] = !!(fi.submap & 1<