From: Greg Kroah-Hartman Date: Mon, 25 Jan 2021 15:24:46 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v4.19.171~18 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=97c2bcebab3e01d5471a89d1e1fd0ece8fe88cf4;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: bpf-fix-buggy-rsh-min-max-bounds-tracking.patch compiler.h-raise-minimum-version-of-gcc-to-5.1-for-arm64.patch ipv6-create-multicast-route-with-rtprot_kernel.patch net-dsa-b53-fix-an-off-by-one-in-checking-vlan-vid.patch net_sched-avoid-shift-out-of-bounds-in-tcindex_set_parms.patch netfilter-rpfilter-mask-ecn-bits-before-fib-lookup.patch sh-dma-fix-kconfig-dependency-for-g2_dma.patch sh_eth-fix-power-down-vs.-is_opened-flag-ordering.patch skbuff-back-tiny-skbs-with-kmalloc-in-__netdev_alloc_skb-too.patch --- diff --git a/queue-4.9/bpf-fix-buggy-rsh-min-max-bounds-tracking.patch b/queue-4.9/bpf-fix-buggy-rsh-min-max-bounds-tracking.patch new file mode 100644 index 00000000000..d5e057b3c68 --- /dev/null +++ b/queue-4.9/bpf-fix-buggy-rsh-min-max-bounds-tracking.patch @@ -0,0 +1,45 @@ +From 58d0953dd1d7a2499c3e0d3b21dee27daf8de2a2 Mon Sep 17 00:00:00 2001 +From: Daniel Borkmann +Date: Fri, 22 Jan 2021 16:00:56 +0100 +Subject: bpf: Fix buggy rsh min/max bounds tracking + +From: Daniel Borkmann + +[ no upstream commit ] + +Fix incorrect bounds tracking for RSH opcode. Commit f23cc643f9ba ("bpf: fix +range arithmetic for bpf map access") had a wrong assumption about min/max +bounds. The new dst_reg->min_value needs to be derived by right shifting the +max_val bounds, not min_val, and likewise new dst_reg->max_value needs to be +derived by right shifting the min_val bounds, not max_val. Later stable kernels +than 4.9 are not affected since bounds tracking was overall reworked and they +already track this similarly as in the fix. + +Fixes: f23cc643f9ba ("bpf: fix range arithmetic for bpf map access") +Reported-by: Ryota Shiga (Flatt Security) +Signed-off-by: Daniel Borkmann +Reviewed-by: John Fastabend +Cc: Josef Bacik +Signed-off-by: Greg Kroah-Hartman +--- + kernel/bpf/verifier.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -1732,12 +1732,11 @@ static void adjust_reg_min_max_vals(stru + * unsigned shift, so make the appropriate casts. + */ + if (min_val < 0 || dst_reg->min_value < 0) +- dst_reg->min_value = BPF_REGISTER_MIN_RANGE; ++ reset_reg_range_values(regs, insn->dst_reg); + else +- dst_reg->min_value = +- (u64)(dst_reg->min_value) >> min_val; ++ dst_reg->min_value = (u64)(dst_reg->min_value) >> max_val; + if (dst_reg->max_value != BPF_REGISTER_MAX_RANGE) +- dst_reg->max_value >>= max_val; ++ dst_reg->max_value >>= min_val; + break; + default: + reset_reg_range_values(regs, insn->dst_reg); diff --git a/queue-4.9/compiler.h-raise-minimum-version-of-gcc-to-5.1-for-arm64.patch b/queue-4.9/compiler.h-raise-minimum-version-of-gcc-to-5.1-for-arm64.patch new file mode 100644 index 00000000000..921867fc1f4 --- /dev/null +++ b/queue-4.9/compiler.h-raise-minimum-version-of-gcc-to-5.1-for-arm64.patch @@ -0,0 +1,57 @@ +From dca5244d2f5b94f1809f0c02a549edf41ccd5493 Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Tue, 12 Jan 2021 22:48:32 +0000 +Subject: compiler.h: Raise minimum version of GCC to 5.1 for arm64 + +From: Will Deacon + +commit dca5244d2f5b94f1809f0c02a549edf41ccd5493 upstream. + +GCC versions >= 4.9 and < 5.1 have been shown to emit memory references +beyond the stack pointer, resulting in memory corruption if an interrupt +is taken after the stack pointer has been adjusted but before the +reference has been executed. This leads to subtle, infrequent data +corruption such as the EXT4 problems reported by Russell King at the +link below. + +Life is too short for buggy compilers, so raise the minimum GCC version +required by arm64 to 5.1. + +Reported-by: Russell King +Suggested-by: Arnd Bergmann +Signed-off-by: Will Deacon +Tested-by: Nathan Chancellor +Reviewed-by: Nick Desaulniers +Reviewed-by: Nathan Chancellor +Acked-by: Linus Torvalds +Cc: +Cc: Theodore Ts'o +Cc: Florian Weimer +Cc: Peter Zijlstra +Cc: Nick Desaulniers +Link: https://lore.kernel.org/r/20210105154726.GD1551@shell.armlinux.org.uk +Link: https://lore.kernel.org/r/20210112224832.10980-1-will@kernel.org +Signed-off-by: Catalin Marinas +[will: backport to 4.4.y/4.9.y/4.14.y; add __clang__ check] +Link: https://lore.kernel.org/r/CA+G9fYuzE9WMSB7uGjV4gTzK510SHEdJb_UXQCzsQ5MqA=h9SA@mail.gmail.com +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/compiler-gcc.h | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/include/linux/compiler-gcc.h ++++ b/include/linux/compiler-gcc.h +@@ -149,6 +149,12 @@ + + #if GCC_VERSION < 30200 + # error Sorry, your compiler is too old - please upgrade it. ++#elif defined(CONFIG_ARM64) && GCC_VERSION < 50100 && !defined(__clang__) ++/* ++ * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63293 ++ * https://lore.kernel.org/r/20210107111841.GN1551@shell.armlinux.org.uk ++ */ ++# error Sorry, your version of GCC is too old - please use 5.1 or newer. + #endif + + #if GCC_VERSION < 30300 diff --git a/queue-4.9/ipv6-create-multicast-route-with-rtprot_kernel.patch b/queue-4.9/ipv6-create-multicast-route-with-rtprot_kernel.patch new file mode 100644 index 00000000000..29f7b7f0685 --- /dev/null +++ b/queue-4.9/ipv6-create-multicast-route-with-rtprot_kernel.patch @@ -0,0 +1,40 @@ +From a826b04303a40d52439aa141035fca5654ccaccd Mon Sep 17 00:00:00 2001 +From: Matteo Croce +Date: Fri, 15 Jan 2021 19:42:08 +0100 +Subject: ipv6: create multicast route with RTPROT_KERNEL + +From: Matteo Croce + +commit a826b04303a40d52439aa141035fca5654ccaccd upstream. + +The ff00::/8 multicast route is created without specifying the fc_protocol +field, so the default RTPROT_BOOT value is used: + + $ ip -6 -d route + unicast ::1 dev lo proto kernel scope global metric 256 pref medium + unicast fe80::/64 dev eth0 proto kernel scope global metric 256 pref medium + unicast ff00::/8 dev eth0 proto boot scope global metric 256 pref medium + +As the documentation says, this value identifies routes installed during +boot, but the route is created when interface is set up. +Change the value to RTPROT_KERNEL which is a better value. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Matteo Croce +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv6/addrconf.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -2285,6 +2285,7 @@ static void addrconf_add_mroute(struct n + .fc_dst_len = 8, + .fc_flags = RTF_UP, + .fc_nlinfo.nl_net = dev_net(dev), ++ .fc_protocol = RTPROT_KERNEL, + }; + + ipv6_addr_set(&cfg.fc_dst, htonl(0xFF000000), 0, 0, 0); diff --git a/queue-4.9/net-dsa-b53-fix-an-off-by-one-in-checking-vlan-vid.patch b/queue-4.9/net-dsa-b53-fix-an-off-by-one-in-checking-vlan-vid.patch new file mode 100644 index 00000000000..d2573fbf2ce --- /dev/null +++ b/queue-4.9/net-dsa-b53-fix-an-off-by-one-in-checking-vlan-vid.patch @@ -0,0 +1,36 @@ +From 8e4052c32d6b4b39c1e13c652c7e33748d447409 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 19 Jan 2021 17:48:03 +0300 +Subject: net: dsa: b53: fix an off by one in checking "vlan->vid" + +From: Dan Carpenter + +commit 8e4052c32d6b4b39c1e13c652c7e33748d447409 upstream. + +The > comparison should be >= to prevent accessing one element beyond +the end of the dev->vlans[] array in the caller function, b53_vlan_add(). +The "dev->vlans" array is allocated in the b53_switch_init() function +and it has "dev->num_vlans" elements. + +Fixes: a2482d2ce349 ("net: dsa: b53: Plug in VLAN support") +Signed-off-by: Dan Carpenter +Acked-by: Florian Fainelli +Link: https://lore.kernel.org/r/YAbxI97Dl/pmBy5V@mwanda +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/dsa/b53/b53_common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/dsa/b53/b53_common.c ++++ b/drivers/net/dsa/b53/b53_common.c +@@ -946,7 +946,7 @@ static int b53_vlan_prepare(struct dsa_s + if ((is5325(dev) || is5365(dev)) && vlan->vid_begin == 0) + return -EOPNOTSUPP; + +- if (vlan->vid_end > dev->num_vlans) ++ if (vlan->vid_end >= dev->num_vlans) + return -ERANGE; + + b53_enable_vlan(dev, true); diff --git a/queue-4.9/net_sched-avoid-shift-out-of-bounds-in-tcindex_set_parms.patch b/queue-4.9/net_sched-avoid-shift-out-of-bounds-in-tcindex_set_parms.patch new file mode 100644 index 00000000000..a9a32f6f174 --- /dev/null +++ b/queue-4.9/net_sched-avoid-shift-out-of-bounds-in-tcindex_set_parms.patch @@ -0,0 +1,67 @@ +From bcd0cf19ef8258ac31b9a20248b05c15a1f4b4b0 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Thu, 14 Jan 2021 10:52:29 -0800 +Subject: net_sched: avoid shift-out-of-bounds in tcindex_set_parms() + +From: Eric Dumazet + +commit bcd0cf19ef8258ac31b9a20248b05c15a1f4b4b0 upstream. + +tc_index being 16bit wide, we need to check that TCA_TCINDEX_SHIFT +attribute is not silly. + +UBSAN: shift-out-of-bounds in net/sched/cls_tcindex.c:260:29 +shift exponent 255 is too large for 32-bit type 'int' +CPU: 0 PID: 8516 Comm: syz-executor228 Not tainted 5.10.0-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +Call Trace: + __dump_stack lib/dump_stack.c:79 [inline] + dump_stack+0x107/0x163 lib/dump_stack.c:120 + ubsan_epilogue+0xb/0x5a lib/ubsan.c:148 + __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395 + valid_perfect_hash net/sched/cls_tcindex.c:260 [inline] + tcindex_set_parms.cold+0x1b/0x215 net/sched/cls_tcindex.c:425 + tcindex_change+0x232/0x340 net/sched/cls_tcindex.c:546 + tc_new_tfilter+0x13fb/0x21b0 net/sched/cls_api.c:2127 + rtnetlink_rcv_msg+0x8b6/0xb80 net/core/rtnetlink.c:5555 + netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494 + netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline] + netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330 + netlink_sendmsg+0x907/0xe40 net/netlink/af_netlink.c:1919 + sock_sendmsg_nosec net/socket.c:652 [inline] + sock_sendmsg+0xcf/0x120 net/socket.c:672 + ____sys_sendmsg+0x6e8/0x810 net/socket.c:2336 + ___sys_sendmsg+0xf3/0x170 net/socket.c:2390 + __sys_sendmsg+0xe5/0x1b0 net/socket.c:2423 + do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Link: https://lore.kernel.org/r/20210114185229.1742255-1-eric.dumazet@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman + +--- + net/sched/cls_tcindex.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/net/sched/cls_tcindex.c ++++ b/net/sched/cls_tcindex.c +@@ -307,9 +307,13 @@ tcindex_set_parms(struct net *net, struc + if (tb[TCA_TCINDEX_MASK]) + cp->mask = nla_get_u16(tb[TCA_TCINDEX_MASK]); + +- if (tb[TCA_TCINDEX_SHIFT]) ++ if (tb[TCA_TCINDEX_SHIFT]) { + cp->shift = nla_get_u32(tb[TCA_TCINDEX_SHIFT]); +- ++ if (cp->shift > 16) { ++ err = -EINVAL; ++ goto errout; ++ } ++ } + if (!cp->hash) { + /* Hash not specified, use perfect hash if the upper limit + * of the hashing index is below the threshold. diff --git a/queue-4.9/netfilter-rpfilter-mask-ecn-bits-before-fib-lookup.patch b/queue-4.9/netfilter-rpfilter-mask-ecn-bits-before-fib-lookup.patch new file mode 100644 index 00000000000..e09b2852767 --- /dev/null +++ b/queue-4.9/netfilter-rpfilter-mask-ecn-bits-before-fib-lookup.patch @@ -0,0 +1,78 @@ +From 2e5a6266fbb11ae93c468dfecab169aca9c27b43 Mon Sep 17 00:00:00 2001 +From: Guillaume Nault +Date: Sat, 16 Jan 2021 11:44:26 +0100 +Subject: netfilter: rpfilter: mask ecn bits before fib lookup + +From: Guillaume Nault + +commit 2e5a6266fbb11ae93c468dfecab169aca9c27b43 upstream. + +RT_TOS() only masks one of the two ECN bits. Therefore rpfilter_mt() +treats Not-ECT or ECT(1) packets in a different way than those with +ECT(0) or CE. + +Reproducer: + + Create two netns, connected with a veth: + $ ip netns add ns0 + $ ip netns add ns1 + $ ip link add name veth01 netns ns0 type veth peer name veth10 netns ns1 + $ ip -netns ns0 link set dev veth01 up + $ ip -netns ns1 link set dev veth10 up + $ ip -netns ns0 address add 192.0.2.10/32 dev veth01 + $ ip -netns ns1 address add 192.0.2.11/32 dev veth10 + + Add a route to ns1 in ns0: + $ ip -netns ns0 route add 192.0.2.11/32 dev veth01 + + In ns1, only packets with TOS 4 can be routed to ns0: + $ ip -netns ns1 route add 192.0.2.10/32 tos 4 dev veth10 + + Ping from ns0 to ns1 works regardless of the ECN bits, as long as TOS + is 4: + $ ip netns exec ns0 ping -Q 4 192.0.2.11 # TOS 4, Not-ECT + ... 0% packet loss ... + $ ip netns exec ns0 ping -Q 5 192.0.2.11 # TOS 4, ECT(1) + ... 0% packet loss ... + $ ip netns exec ns0 ping -Q 6 192.0.2.11 # TOS 4, ECT(0) + ... 0% packet loss ... + $ ip netns exec ns0 ping -Q 7 192.0.2.11 # TOS 4, CE + ... 0% packet loss ... + + Now use iptable's rpfilter module in ns1: + $ ip netns exec ns1 iptables-legacy -t raw -A PREROUTING -m rpfilter --invert -j DROP + + Not-ECT and ECT(1) packets still pass: + $ ip netns exec ns0 ping -Q 4 192.0.2.11 # TOS 4, Not-ECT + ... 0% packet loss ... + $ ip netns exec ns0 ping -Q 5 192.0.2.11 # TOS 4, ECT(1) + ... 0% packet loss ... + + But ECT(0) and ECN packets are dropped: + $ ip netns exec ns0 ping -Q 6 192.0.2.11 # TOS 4, ECT(0) + ... 100% packet loss ... + $ ip netns exec ns0 ping -Q 7 192.0.2.11 # TOS 4, CE + ... 100% packet loss ... + +After this patch, rpfilter doesn't drop ECT(0) and CE packets anymore. + +Fixes: 8f97339d3feb ("netfilter: add ipv4 reverse path filter match") +Signed-off-by: Guillaume Nault +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/netfilter/ipt_rpfilter.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv4/netfilter/ipt_rpfilter.c ++++ b/net/ipv4/netfilter/ipt_rpfilter.c +@@ -92,7 +92,7 @@ static bool rpfilter_mt(const struct sk_ + flow.saddr = rpfilter_get_saddr(iph->daddr); + flow.flowi4_oif = 0; + flow.flowi4_mark = info->flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0; +- flow.flowi4_tos = RT_TOS(iph->tos); ++ flow.flowi4_tos = iph->tos & IPTOS_RT_MASK; + flow.flowi4_scope = RT_SCOPE_UNIVERSE; + + return rpfilter_lookup_reverse(par->net, &flow, par->in, info->flags) ^ invert; diff --git a/queue-4.9/series b/queue-4.9/series index fade71fbffe..c468b0f914a 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -16,3 +16,12 @@ usb-udc-core-use-lock-when-write-to-soft_connect.patch usb-bdc-make-bdc-pci-driver-depend-on-broken.patch xhci-make-sure-trb-is-fully-written-before-giving-it-to-the-controller.patch xhci-tegra-delay-for-disabling-lfps-detector.patch +bpf-fix-buggy-rsh-min-max-bounds-tracking.patch +compiler.h-raise-minimum-version-of-gcc-to-5.1-for-arm64.patch +netfilter-rpfilter-mask-ecn-bits-before-fib-lookup.patch +sh-dma-fix-kconfig-dependency-for-g2_dma.patch +sh_eth-fix-power-down-vs.-is_opened-flag-ordering.patch +skbuff-back-tiny-skbs-with-kmalloc-in-__netdev_alloc_skb-too.patch +ipv6-create-multicast-route-with-rtprot_kernel.patch +net_sched-avoid-shift-out-of-bounds-in-tcindex_set_parms.patch +net-dsa-b53-fix-an-off-by-one-in-checking-vlan-vid.patch diff --git a/queue-4.9/sh-dma-fix-kconfig-dependency-for-g2_dma.patch b/queue-4.9/sh-dma-fix-kconfig-dependency-for-g2_dma.patch new file mode 100644 index 00000000000..8f2314b5f11 --- /dev/null +++ b/queue-4.9/sh-dma-fix-kconfig-dependency-for-g2_dma.patch @@ -0,0 +1,50 @@ +From f477a538c14d07f8c45e554c8c5208d588514e98 Mon Sep 17 00:00:00 2001 +From: Necip Fazil Yildiran +Date: Thu, 17 Sep 2020 18:45:48 +0300 +Subject: sh: dma: fix kconfig dependency for G2_DMA + +From: Necip Fazil Yildiran + +commit f477a538c14d07f8c45e554c8c5208d588514e98 upstream. + +When G2_DMA is enabled and SH_DMA is disabled, it results in the following +Kbuild warning: + +WARNING: unmet direct dependencies detected for SH_DMA_API + Depends on [n]: SH_DMA [=n] + Selected by [y]: + - G2_DMA [=y] && SH_DREAMCAST [=y] + +The reason is that G2_DMA selects SH_DMA_API without depending on or +selecting SH_DMA while SH_DMA_API depends on SH_DMA. + +When G2_DMA was first introduced with commit 40f49e7ed77f +("sh: dma: Make G2 DMA configurable."), this wasn't an issue since +SH_DMA_API didn't have such dependency, and this way was the only way to +enable it since SH_DMA_API was non-visible. However, later SH_DMA_API was +made visible and dependent on SH_DMA with commit d8902adcc1a9 +("dmaengine: sh: Add Support SuperH DMA Engine driver"). + +Let G2_DMA depend on SH_DMA_API instead to avoid Kbuild issues. + +Fixes: d8902adcc1a9 ("dmaengine: sh: Add Support SuperH DMA Engine driver") +Signed-off-by: Necip Fazil Yildiran +Signed-off-by: Rich Felker +Signed-off-by: Greg Kroah-Hartman + +--- + arch/sh/drivers/dma/Kconfig | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/arch/sh/drivers/dma/Kconfig ++++ b/arch/sh/drivers/dma/Kconfig +@@ -62,8 +62,7 @@ config PVR2_DMA + + config G2_DMA + tristate "G2 Bus DMA support" +- depends on SH_DREAMCAST +- select SH_DMA_API ++ depends on SH_DREAMCAST && SH_DMA_API + help + This enables support for the DMA controller for the Dreamcast's + G2 bus. Drivers that want this will generally enable this on diff --git a/queue-4.9/sh_eth-fix-power-down-vs.-is_opened-flag-ordering.patch b/queue-4.9/sh_eth-fix-power-down-vs.-is_opened-flag-ordering.patch new file mode 100644 index 00000000000..2a50698ddfd --- /dev/null +++ b/queue-4.9/sh_eth-fix-power-down-vs.-is_opened-flag-ordering.patch @@ -0,0 +1,46 @@ +From f6a2e94b3f9d89cb40771ff746b16b5687650cbb Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Mon, 18 Jan 2021 16:08:12 +0100 +Subject: sh_eth: Fix power down vs. is_opened flag ordering +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +commit f6a2e94b3f9d89cb40771ff746b16b5687650cbb upstream. + +sh_eth_close() does a synchronous power down of the device before +marking it closed. Revert the order, to make sure the device is never +marked opened while suspended. + +While at it, use pm_runtime_put() instead of pm_runtime_put_sync(), as +there is no reason to do a synchronous power down. + +Fixes: 7fa2955ff70ce453 ("sh_eth: Fix sleeping function called from invalid context") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Sergei Shtylyov +Reviewed-by: Niklas Söderlund +Link: https://lore.kernel.org/r/20210118150812.796791-1-geert+renesas@glider.be +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/renesas/sh_eth.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/renesas/sh_eth.c ++++ b/drivers/net/ethernet/renesas/sh_eth.c +@@ -2411,10 +2411,10 @@ static int sh_eth_close(struct net_devic + /* Free all the skbuffs in the Rx queue and the DMA buffer. */ + sh_eth_ring_free(ndev); + +- pm_runtime_put_sync(&mdp->pdev->dev); +- + mdp->is_opened = 0; + ++ pm_runtime_put(&mdp->pdev->dev); ++ + return 0; + } + diff --git a/queue-4.9/skbuff-back-tiny-skbs-with-kmalloc-in-__netdev_alloc_skb-too.patch b/queue-4.9/skbuff-back-tiny-skbs-with-kmalloc-in-__netdev_alloc_skb-too.patch new file mode 100644 index 00000000000..031250a38df --- /dev/null +++ b/queue-4.9/skbuff-back-tiny-skbs-with-kmalloc-in-__netdev_alloc_skb-too.patch @@ -0,0 +1,51 @@ +From 66c556025d687dbdd0f748c5e1df89c977b6c02a Mon Sep 17 00:00:00 2001 +From: Alexander Lobakin +Date: Fri, 15 Jan 2021 15:04:40 +0000 +Subject: skbuff: back tiny skbs with kmalloc() in __netdev_alloc_skb() too + +From: Alexander Lobakin + +commit 66c556025d687dbdd0f748c5e1df89c977b6c02a upstream. + +Commit 3226b158e67c ("net: avoid 32 x truesize under-estimation for +tiny skbs") ensured that skbs with data size lower than 1025 bytes +will be kmalloc'ed to avoid excessive page cache fragmentation and +memory consumption. +However, the fix adressed only __napi_alloc_skb() (primarily for +virtio_net and napi_get_frags()), but the issue can still be achieved +through __netdev_alloc_skb(), which is still used by several drivers. +Drivers often allocate a tiny skb for headers and place the rest of +the frame to frags (so-called copybreak). +Mirror the condition to __netdev_alloc_skb() to handle this case too. + +Since v1 [0]: + - fix "Fixes:" tag; + - refine commit message (mention copybreak usecase). + +[0] https://lore.kernel.org/netdev/20210114235423.232737-1-alobakin@pm.me + +Fixes: a1c7fff7e18f ("net: netdev_alloc_skb() use build_skb()") +Signed-off-by: Alexander Lobakin +Link: https://lore.kernel.org/r/20210115150354.85967-1-alobakin@pm.me +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman + +--- + net/core/skbuff.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -428,7 +428,11 @@ struct sk_buff *__netdev_alloc_skb(struc + + len += NET_SKB_PAD; + +- if ((len > SKB_WITH_OVERHEAD(PAGE_SIZE)) || ++ /* If requested length is either too small or too big, ++ * we use kmalloc() for skb->head allocation. ++ */ ++ if (len <= SKB_WITH_OVERHEAD(1024) || ++ len > SKB_WITH_OVERHEAD(PAGE_SIZE) || + (gfp_mask & (__GFP_DIRECT_RECLAIM | GFP_DMA))) { + skb = __alloc_skb(len, gfp_mask, SKB_ALLOC_RX, NUMA_NO_NODE); + if (!skb)