From: Sasha Levin Date: Wed, 16 Mar 2022 14:51:43 +0000 (-0400) Subject: Fixes for 5.16 X-Git-Tag: v5.4.186~21 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9c37adf14f168aad8af24c2715201ae9752a196c;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.16 Signed-off-by: Sasha Levin --- diff --git a/queue-5.16/arm-9178-1-fix-unmet-dependency-on-bitreverse-for-ha.patch b/queue-5.16/arm-9178-1-fix-unmet-dependency-on-bitreverse-for-ha.patch new file mode 100644 index 00000000000..cf1201352be --- /dev/null +++ b/queue-5.16/arm-9178-1-fix-unmet-dependency-on-bitreverse-for-ha.patch @@ -0,0 +1,51 @@ +From ed5925fbcc75a86c773d2757e58587e8bd928a55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jan 2022 05:09:40 +0100 +Subject: ARM: 9178/1: fix unmet dependency on BITREVERSE for + HAVE_ARCH_BITREVERSE + +From: Julian Braha + +[ Upstream commit 11c57c3ba94da74c3446924260e34e0b1950b5d7 ] + +Resending this to properly add it to the patch tracker - thanks for letting +me know, Arnd :) + +When ARM is enabled, and BITREVERSE is disabled, +Kbuild gives the following warning: + +WARNING: unmet direct dependencies detected for HAVE_ARCH_BITREVERSE + Depends on [n]: BITREVERSE [=n] + Selected by [y]: + - ARM [=y] && (CPU_32v7M [=n] || CPU_32v7 [=y]) && !CPU_32v6 [=n] + +This is because ARM selects HAVE_ARCH_BITREVERSE +without selecting BITREVERSE, despite +HAVE_ARCH_BITREVERSE depending on BITREVERSE. + +This unmet dependency bug was found by Kismet, +a static analysis tool for Kconfig. Please advise if this +is not the appropriate solution. + +Signed-off-by: Julian Braha +Signed-off-by: Russell King (Oracle) +Signed-off-by: Sasha Levin +--- + lib/Kconfig | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/lib/Kconfig b/lib/Kconfig +index 5e7165e6a346..fa4b10322efc 100644 +--- a/lib/Kconfig ++++ b/lib/Kconfig +@@ -45,7 +45,6 @@ config BITREVERSE + config HAVE_ARCH_BITREVERSE + bool + default n +- depends on BITREVERSE + help + This option enables the use of hardware bit-reversal instructions on + architectures which support such operations. +-- +2.34.1 + diff --git a/queue-5.16/arm-dts-rockchip-fix-a-typo-on-rk3288-crypto-control.patch b/queue-5.16/arm-dts-rockchip-fix-a-typo-on-rk3288-crypto-control.patch new file mode 100644 index 00000000000..a8d60a3322f --- /dev/null +++ b/queue-5.16/arm-dts-rockchip-fix-a-typo-on-rk3288-crypto-control.patch @@ -0,0 +1,37 @@ +From 74d1888505d1804e43bb90cb781442425ea587f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Feb 2022 12:03:55 +0000 +Subject: ARM: dts: rockchip: fix a typo on rk3288 crypto-controller + +From: Corentin Labbe + +[ Upstream commit 3916c3619599a3970d3e6f98fb430b7c46266ada ] + +crypto-controller had a typo, fix it. +In the same time, rename it to just crypto + +Signed-off-by: Corentin Labbe +Acked-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20220209120355.1985707-1-clabbe@baylibre.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rk3288.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi +index aaaa61875701..45a9d9b908d2 100644 +--- a/arch/arm/boot/dts/rk3288.dtsi ++++ b/arch/arm/boot/dts/rk3288.dtsi +@@ -971,7 +971,7 @@ + status = "disabled"; + }; + +- crypto: cypto-controller@ff8a0000 { ++ crypto: crypto@ff8a0000 { + compatible = "rockchip,rk3288-crypto"; + reg = <0x0 0xff8a0000 0x0 0x4000>; + interrupts = ; +-- +2.34.1 + diff --git a/queue-5.16/arm-dts-rockchip-reorder-rk322x-hmdi-clocks.patch b/queue-5.16/arm-dts-rockchip-reorder-rk322x-hmdi-clocks.patch new file mode 100644 index 00000000000..b34ee9c277d --- /dev/null +++ b/queue-5.16/arm-dts-rockchip-reorder-rk322x-hmdi-clocks.patch @@ -0,0 +1,38 @@ +From 160c48fadb79d6d8fcd991b51f4036933d7e3c4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Feb 2022 15:23:53 +0100 +Subject: ARM: dts: rockchip: reorder rk322x hmdi clocks + +From: Sascha Hauer + +[ Upstream commit be4e65bdffab5f588044325117df77dad7e9c45a ] + +The binding specifies the clock order to "iahb", "isfr", "cec". Reorder +the clocks accordingly. + +Signed-off-by: Sascha Hauer +Link: https://lore.kernel.org/r/20220210142353.3420859-1-s.hauer@pengutronix.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rk322x.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/rk322x.dtsi b/arch/arm/boot/dts/rk322x.dtsi +index 8eed9e3a92e9..5868eb512f69 100644 +--- a/arch/arm/boot/dts/rk322x.dtsi ++++ b/arch/arm/boot/dts/rk322x.dtsi +@@ -718,8 +718,8 @@ + interrupts = ; + assigned-clocks = <&cru SCLK_HDMI_PHY>; + assigned-clock-parents = <&hdmi_phy>; +- clocks = <&cru SCLK_HDMI_HDCP>, <&cru PCLK_HDMI_CTRL>, <&cru SCLK_HDMI_CEC>; +- clock-names = "isfr", "iahb", "cec"; ++ clocks = <&cru PCLK_HDMI_CTRL>, <&cru SCLK_HDMI_HDCP>, <&cru SCLK_HDMI_CEC>; ++ clock-names = "iahb", "isfr", "cec"; + pinctrl-names = "default"; + pinctrl-0 = <&hdmii2c_xfer &hdmi_hpd &hdmi_cec>; + resets = <&cru SRST_HDMI_P>; +-- +2.34.1 + diff --git a/queue-5.16/arm64-dts-agilex-use-the-compatible-intel-socfpga-ag.patch b/queue-5.16/arm64-dts-agilex-use-the-compatible-intel-socfpga-ag.patch new file mode 100644 index 00000000000..bd2769532fe --- /dev/null +++ b/queue-5.16/arm64-dts-agilex-use-the-compatible-intel-socfpga-ag.patch @@ -0,0 +1,44 @@ +From f1d85134e22c26c45ebeaffeeb86872911503138 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jan 2022 17:53:31 -0600 +Subject: arm64: dts: agilex: use the compatible "intel,socfpga-agilex-hsotg" + +From: Dinh Nguyen + +[ Upstream commit 268a491aebc25e6dc7c618903b09ac3a2e8af530 ] + +The DWC2 USB controller on the Agilex platform does not support clock +gating, so use the chip specific "intel,socfpga-agilex-hsotg" +compatible. + +Signed-off-by: Dinh Nguyen +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/intel/socfpga_agilex.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/intel/socfpga_agilex.dtsi b/arch/arm64/boot/dts/intel/socfpga_agilex.dtsi +index 0dd2d2ee765a..f4270cf18996 100644 +--- a/arch/arm64/boot/dts/intel/socfpga_agilex.dtsi ++++ b/arch/arm64/boot/dts/intel/socfpga_agilex.dtsi +@@ -502,7 +502,7 @@ + }; + + usb0: usb@ffb00000 { +- compatible = "snps,dwc2"; ++ compatible = "intel,socfpga-agilex-hsotg", "snps,dwc2"; + reg = <0xffb00000 0x40000>; + interrupts = ; + phys = <&usbphy0>; +@@ -515,7 +515,7 @@ + }; + + usb1: usb@ffb40000 { +- compatible = "snps,dwc2"; ++ compatible = "intel,socfpga-agilex-hsotg", "snps,dwc2"; + reg = <0xffb40000 0x40000>; + interrupts = ; + phys = <&usbphy0>; +-- +2.34.1 + diff --git a/queue-5.16/arm64-dts-rockchip-align-pl330-node-name-with-dtsche.patch b/queue-5.16/arm64-dts-rockchip-align-pl330-node-name-with-dtsche.patch new file mode 100644 index 00000000000..d7c308fbe5b --- /dev/null +++ b/queue-5.16/arm64-dts-rockchip-align-pl330-node-name-with-dtsche.patch @@ -0,0 +1,51 @@ +From 8e5eacdbce95eff96171b973fdc229ebf79470e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Jan 2022 18:54:29 +0100 +Subject: arm64: dts: rockchip: align pl330 node name with dtschema + +From: Krzysztof Kozlowski + +[ Upstream commit 8fd9415042826c7609c588e5ef45f3e84237785f ] + +Fixes dtbs_check warnings like: + + dmac@ff240000: $nodename:0: 'dmac@ff240000' does not match '^dma-controller(@.*)?$' + +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20220129175429.298836-1-krzysztof.kozlowski@canonical.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/px30.dtsi | 2 +- + arch/arm64/boot/dts/rockchip/rk3328.dtsi | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/px30.dtsi b/arch/arm64/boot/dts/rockchip/px30.dtsi +index 00f50b05d55a..b72874c16a71 100644 +--- a/arch/arm64/boot/dts/rockchip/px30.dtsi ++++ b/arch/arm64/boot/dts/rockchip/px30.dtsi +@@ -711,7 +711,7 @@ + clock-names = "pclk", "timer"; + }; + +- dmac: dmac@ff240000 { ++ dmac: dma-controller@ff240000 { + compatible = "arm,pl330", "arm,primecell"; + reg = <0x0 0xff240000 0x0 0x4000>; + interrupts = , +diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +index 39db0b85b4da..b822533dc7f1 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +@@ -489,7 +489,7 @@ + status = "disabled"; + }; + +- dmac: dmac@ff1f0000 { ++ dmac: dma-controller@ff1f0000 { + compatible = "arm,pl330", "arm,primecell"; + reg = <0x0 0xff1f0000 0x0 0x4000>; + interrupts = , +-- +2.34.1 + diff --git a/queue-5.16/arm64-dts-rockchip-fix-dma-controller-node-names-on-.patch b/queue-5.16/arm64-dts-rockchip-fix-dma-controller-node-names-on-.patch new file mode 100644 index 00000000000..688905f5c33 --- /dev/null +++ b/queue-5.16/arm64-dts-rockchip-fix-dma-controller-node-names-on-.patch @@ -0,0 +1,53 @@ +From 1b7353b9ccc84040f2a61ac6455acc4bba7366e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jan 2022 14:36:15 +0100 +Subject: arm64: dts: rockchip: fix dma-controller node names on rk356x + +From: Frank Wunderlich + +[ Upstream commit 2ddd96aadbd0412040ef49eda94549c32de6c92c ] + +DMA-Cotrollers defined in rk356x.dtsi do not match the pattern in bindings. + +arch/arm64/boot/dts/rockchip/rk3568-evb1-v10.dt.yaml: + dmac@fe530000: $nodename:0: 'dmac@fe530000' does not match '^dma-controller(@.*)?$' + From schema: Documentation/devicetree/bindings/dma/arm,pl330.yaml +arch/arm64/boot/dts/rockchip/rk3568-evb1-v10.dt.yaml: + dmac@fe550000: $nodename:0: 'dmac@fe550000' does not match '^dma-controller(@.*)?$' + From schema: Documentation/devicetree/bindings/dma/arm,pl330.yaml + +This Patch fixes it. + +Signed-off-by: Frank Wunderlich +Link: https://lore.kernel.org/r/20220123133615.135789-1-linux@fw-web.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk356x.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk356x.dtsi b/arch/arm64/boot/dts/rockchip/rk356x.dtsi +index 46d9552f6028..688e3585525a 100644 +--- a/arch/arm64/boot/dts/rockchip/rk356x.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk356x.dtsi +@@ -647,7 +647,7 @@ + status = "disabled"; + }; + +- dmac0: dmac@fe530000 { ++ dmac0: dma-controller@fe530000 { + compatible = "arm,pl330", "arm,primecell"; + reg = <0x0 0xfe530000 0x0 0x4000>; + interrupts = , +@@ -658,7 +658,7 @@ + #dma-cells = <1>; + }; + +- dmac1: dmac@fe550000 { ++ dmac1: dma-controller@fe550000 { + compatible = "arm,pl330", "arm,primecell"; + reg = <0x0 0xfe550000 0x0 0x4000>; + interrupts = , +-- +2.34.1 + diff --git a/queue-5.16/arm64-dts-rockchip-fix-rk3399-puma-emmc-hs400-signal.patch b/queue-5.16/arm64-dts-rockchip-fix-rk3399-puma-emmc-hs400-signal.patch new file mode 100644 index 00000000000..15dea24526b --- /dev/null +++ b/queue-5.16/arm64-dts-rockchip-fix-rk3399-puma-emmc-hs400-signal.patch @@ -0,0 +1,49 @@ +From 8da9c7e83c2775f63197f560a1922b8c8f460bb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jan 2022 14:49:48 +0100 +Subject: arm64: dts: rockchip: fix rk3399-puma eMMC HS400 signal integrity + +From: Jakob Unterwurzacher + +[ Upstream commit 62966cbdda8a92f82d966a45aa671e788b2006f7 ] + +There are signal integrity issues running the eMMC at 200MHz on Puma +RK3399-Q7. + +Similar to the work-around found for RK3399 Gru boards, lowering the +frequency to 100MHz made the eMMC much more stable, so let's lower the +frequency to 100MHz. + +It might be possible to run at 150MHz as on RK3399 Gru boards but only +100MHz was extensively tested. + +Cc: Quentin Schulz +Signed-off-by: Jakob Unterwurzacher +Signed-off-by: Quentin Schulz +Link: https://lore.kernel.org/r/20220119134948.1444965-1-quentin.schulz@theobroma-systems.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +index 002ece51c3ba..08fa00364b42 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +@@ -439,6 +439,12 @@ + }; + + &sdhci { ++ /* ++ * Signal integrity isn't great at 200MHz but 100MHz has proven stable ++ * enough. ++ */ ++ max-frequency = <100000000>; ++ + bus-width = <8>; + mmc-hs400-1_8v; + mmc-hs400-enhanced-strobe; +-- +2.34.1 + diff --git a/queue-5.16/arm64-dts-rockchip-fix-rk3399-puma-haikou-usb-otg-mo.patch b/queue-5.16/arm64-dts-rockchip-fix-rk3399-puma-haikou-usb-otg-mo.patch new file mode 100644 index 00000000000..5f1a9dd023b --- /dev/null +++ b/queue-5.16/arm64-dts-rockchip-fix-rk3399-puma-haikou-usb-otg-mo.patch @@ -0,0 +1,73 @@ +From cb82917c83607d58b8508d488bbc5cac382707ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jan 2022 13:51:56 +0100 +Subject: arm64: dts: rockchip: fix rk3399-puma-haikou USB OTG mode + +From: Quentin Schulz + +[ Upstream commit ed2c66a95c0c5669880aa93d0d34c6e9694b4cbd ] + +The micro USB3.0 port available on the Haikou evaluation kit for Puma +RK3399-Q7 SoM supports dual-role model (aka drd or OTG) but its support +was broken until now because of missing logic around the ID pin. + +This adds proper support for USB OTG on Puma Haikou by "connecting" the +GPIO used for USB ID to the USB3 controller device. + +Cc: Quentin Schulz +Signed-off-by: Quentin Schulz +Link: https://lore.kernel.org/r/20220120125156.16217-1-quentin.schulz@theobroma-systems.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + .../arm64/boot/dts/rockchip/rk3399-puma-haikou.dts | 1 + + arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 14 ++++++++++++++ + 2 files changed, 15 insertions(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts b/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts +index 292bb7e80cf3..3ae5d727e367 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts +@@ -232,6 +232,7 @@ + + &usbdrd_dwc3_0 { + dr_mode = "otg"; ++ extcon = <&extcon_usb3>; + status = "okay"; + }; + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +index fb67db4619ea..002ece51c3ba 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +@@ -25,6 +25,13 @@ + }; + }; + ++ extcon_usb3: extcon-usb3 { ++ compatible = "linux,extcon-usb-gpio"; ++ id-gpio = <&gpio1 RK_PC2 GPIO_ACTIVE_HIGH>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&usb3_id>; ++ }; ++ + clkin_gmac: external-gmac-clock { + compatible = "fixed-clock"; + clock-frequency = <125000000>; +@@ -422,6 +429,13 @@ + <4 RK_PA3 RK_FUNC_GPIO &pcfg_pull_none>; + }; + }; ++ ++ usb3 { ++ usb3_id: usb3-id { ++ rockchip,pins = ++ <1 RK_PC2 RK_FUNC_GPIO &pcfg_pull_none>; ++ }; ++ }; + }; + + &sdhci { +-- +2.34.1 + diff --git a/queue-5.16/arm64-dts-rockchip-reorder-rk3399-hdmi-clocks.patch b/queue-5.16/arm64-dts-rockchip-reorder-rk3399-hdmi-clocks.patch new file mode 100644 index 00000000000..48e46d4b31f --- /dev/null +++ b/queue-5.16/arm64-dts-rockchip-reorder-rk3399-hdmi-clocks.patch @@ -0,0 +1,41 @@ +From cc7b5c9f58c0d6f9a1d532015052690092a25262 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jan 2022 15:55:40 +0100 +Subject: arm64: dts: rockchip: reorder rk3399 hdmi clocks + +From: Sascha Hauer + +[ Upstream commit 2e8a8b5955a000cc655f7e368670518cbb77fe58 ] + +The binding specifies the clock order to "cec", "grf", "vpll". Reorder +the clocks accordingly. + +Signed-off-by: Sascha Hauer +Link: https://lore.kernel.org/r/20220126145549.617165-19-s.hauer@pengutronix.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi +index d3cdf6f42a30..080457a68e3c 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi +@@ -1881,10 +1881,10 @@ + interrupts = ; + clocks = <&cru PCLK_HDMI_CTRL>, + <&cru SCLK_HDMI_SFR>, +- <&cru PLL_VPLL>, ++ <&cru SCLK_HDMI_CEC>, + <&cru PCLK_VIO_GRF>, +- <&cru SCLK_HDMI_CEC>; +- clock-names = "iahb", "isfr", "vpll", "grf", "cec"; ++ <&cru PLL_VPLL>; ++ clock-names = "iahb", "isfr", "cec", "grf", "vpll"; + power-domains = <&power RK3399_PD_HDCP>; + reg-io-width = <4>; + rockchip,grf = <&grf>; +-- +2.34.1 + diff --git a/queue-5.16/atm-firestream-check-the-return-value-of-ioremap-in-.patch b/queue-5.16/atm-firestream-check-the-return-value-of-ioremap-in-.patch new file mode 100644 index 00000000000..4c9a11de3c9 --- /dev/null +++ b/queue-5.16/atm-firestream-check-the-return-value-of-ioremap-in-.patch @@ -0,0 +1,36 @@ +From afaf902be265783c4674d93983ce43f47293187a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Feb 2022 04:52:30 -0800 +Subject: atm: firestream: check the return value of ioremap() in fs_init() + +From: Jia-Ju Bai + +[ Upstream commit d4e26aaea7f82ba884dcb4acfe689406bc092dc3 ] + +The function ioremap() in fs_init() can fail, so its return value should +be checked. + +Reported-by: TOTE Robot +Signed-off-by: Jia-Ju Bai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/atm/firestream.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c +index 3bc3c314a467..4f67404fe64c 100644 +--- a/drivers/atm/firestream.c ++++ b/drivers/atm/firestream.c +@@ -1676,6 +1676,8 @@ static int fs_init(struct fs_dev *dev) + dev->hw_base = pci_resource_start(pci_dev, 0); + + dev->base = ioremap(dev->hw_base, 0x1000); ++ if (!dev->base) ++ return 1; + + reset_chip (dev); + +-- +2.34.1 + diff --git a/queue-5.16/bluetooth-hci_core-fix-leaking-sent_cmd-skb.patch b/queue-5.16/bluetooth-hci_core-fix-leaking-sent_cmd-skb.patch new file mode 100644 index 00000000000..4ba910cde41 --- /dev/null +++ b/queue-5.16/bluetooth-hci_core-fix-leaking-sent_cmd-skb.patch @@ -0,0 +1,34 @@ +From 09e58d862041cfd1bafee25d3714623f85d10daa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Feb 2022 13:12:35 -0800 +Subject: Bluetooth: hci_core: Fix leaking sent_cmd skb + +From: Luiz Augusto von Dentz + +[ Upstream commit dd3b1dc3dd050f1f47cd13e300732852414270f8 ] + +sent_cmd memory is not freed before freeing hci_dev causing it to leak +it contents. + +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index 6c00ce302f09..1c8fb27b155a 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -3969,6 +3969,7 @@ void hci_release_dev(struct hci_dev *hdev) + hci_dev_unlock(hdev); + + ida_simple_remove(&hci_index_ida, hdev->id); ++ kfree_skb(hdev->sent_cmd); + kfree(hdev); + } + EXPORT_SYMBOL(hci_release_dev); +-- +2.34.1 + diff --git a/queue-5.16/bnx2-fix-an-error-message.patch b/queue-5.16/bnx2-fix-an-error-message.patch new file mode 100644 index 00000000000..d1999b49e58 --- /dev/null +++ b/queue-5.16/bnx2-fix-an-error-message.patch @@ -0,0 +1,34 @@ +From a01942af6ecfeb1e111ad54d54aa8f029269e6c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Mar 2022 21:21:15 +0100 +Subject: bnx2: Fix an error message + +From: Christophe JAILLET + +[ Upstream commit 8ccffe9ac3239e549beaa0a9d5e1a1eac94e866c ] + +Fix an error message and report the correct failing function. + +Signed-off-by: Christophe JAILLET +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnx2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c +index babc955ba64e..b47a8237c6dd 100644 +--- a/drivers/net/ethernet/broadcom/bnx2.c ++++ b/drivers/net/ethernet/broadcom/bnx2.c +@@ -8212,7 +8212,7 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev) + rc = dma_set_coherent_mask(&pdev->dev, persist_dma_mask); + if (rc) { + dev_err(&pdev->dev, +- "pci_set_consistent_dma_mask failed, aborting\n"); ++ "dma_set_coherent_mask failed, aborting\n"); + goto err_out_unmap; + } + } else if ((rc = dma_set_mask(&pdev->dev, DMA_BIT_MASK(32))) != 0) { +-- +2.34.1 + diff --git a/queue-5.16/can-rcar_canfd-rcar_canfd_channel_probe-register-the.patch b/queue-5.16/can-rcar_canfd-rcar_canfd_channel_probe-register-the.patch new file mode 100644 index 00000000000..a3c65cfc8f2 --- /dev/null +++ b/queue-5.16/can-rcar_canfd-rcar_canfd_channel_probe-register-the.patch @@ -0,0 +1,51 @@ +From 64079d2c78257f128766021083307de760aa74f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Feb 2022 22:59:35 +0000 +Subject: can: rcar_canfd: rcar_canfd_channel_probe(): register the CAN device + when fully ready + +From: Lad Prabhakar + +[ Upstream commit c5048a7b2c23ab589f3476a783bd586b663eda5b ] + +Register the CAN device only when all the necessary initialization is +completed. This patch makes sure all the data structures and locks are +initialized before registering the CAN device. + +Link: https://lore.kernel.org/all/20220221225935.12300-1-prabhakar.mahadev-lad.rj@bp.renesas.com +Reported-by: Pavel Machek +Signed-off-by: Lad Prabhakar +Reviewed-by: Pavel Machek +Reviewed-by: Ulrich Hecht +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/rcar/rcar_canfd.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c +index 137eea4c7bad..4871428859fd 100644 +--- a/drivers/net/can/rcar/rcar_canfd.c ++++ b/drivers/net/can/rcar/rcar_canfd.c +@@ -1716,15 +1716,15 @@ static int rcar_canfd_channel_probe(struct rcar_canfd_global *gpriv, u32 ch, + + netif_napi_add(ndev, &priv->napi, rcar_canfd_rx_poll, + RCANFD_NAPI_WEIGHT); ++ spin_lock_init(&priv->tx_lock); ++ devm_can_led_init(ndev); ++ gpriv->ch[priv->channel] = priv; + err = register_candev(ndev); + if (err) { + dev_err(&pdev->dev, + "register_candev() failed, error %d\n", err); + goto fail_candev; + } +- spin_lock_init(&priv->tx_lock); +- devm_can_led_init(ndev); +- gpriv->ch[priv->channel] = priv; + dev_info(&pdev->dev, "device registered (channel %u)\n", priv->channel); + return 0; + +-- +2.34.1 + diff --git a/queue-5.16/drm-vrr-set-vrr-capable-prop-only-if-it-is-attached-.patch b/queue-5.16/drm-vrr-set-vrr-capable-prop-only-if-it-is-attached-.patch new file mode 100644 index 00000000000..75dd13bbe6d --- /dev/null +++ b/queue-5.16/drm-vrr-set-vrr-capable-prop-only-if-it-is-attached-.patch @@ -0,0 +1,45 @@ +From 7da80d6d5409f23d75d6c8bbcfab1d9f2da3a9ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Feb 2022 17:30:54 -0800 +Subject: drm/vrr: Set VRR capable prop only if it is attached to connector +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Manasi Navare + +[ Upstream commit 62929726ef0ec72cbbe9440c5d125d4278b99894 ] + +VRR capable property is not attached by default to the connector +It is attached only if VRR is supported. +So if the driver tries to call drm core set prop function without +it being attached that causes NULL dereference. + +Cc: Jani Nikula +Cc: Ville Syrjälä +Cc: dri-devel@lists.freedesktop.org +Signed-off-by: Manasi Navare +Reviewed-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20220225013055.9282-1-manasi.d.navare@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_connector.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c +index 52e20c68813b..6ae26e7d3dec 100644 +--- a/drivers/gpu/drm/drm_connector.c ++++ b/drivers/gpu/drm/drm_connector.c +@@ -2275,6 +2275,9 @@ EXPORT_SYMBOL(drm_connector_atomic_hdr_metadata_equal); + void drm_connector_set_vrr_capable_property( + struct drm_connector *connector, bool capable) + { ++ if (!connector->vrr_capable_property) ++ return; ++ + drm_object_property_set_value(&connector->base, + connector->vrr_capable_property, + capable); +-- +2.34.1 + diff --git a/queue-5.16/input-goodix-use-the-new-soc_intel_is_byt-helper.patch b/queue-5.16/input-goodix-use-the-new-soc_intel_is_byt-helper.patch new file mode 100644 index 00000000000..99df0843140 --- /dev/null +++ b/queue-5.16/input-goodix-use-the-new-soc_intel_is_byt-helper.patch @@ -0,0 +1,65 @@ +From 5983b49d253935f4eead8845befe411d389e4098 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Feb 2022 22:52:31 -0800 +Subject: Input: goodix - use the new soc_intel_is_byt() helper + +From: Hans de Goede + +[ Upstream commit d176708ffc20332d1c730098d2b111e0b77ece82 ] + +Use the new soc_intel_is_byt() helper from linux/platform_data/x86/soc.h. + +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20220131143539.109142-5-hdegoede@redhat.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/goodix.c | 18 ++---------------- + 1 file changed, 2 insertions(+), 16 deletions(-) + +diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c +index aaa3c455e01e..e053aadea3c9 100644 +--- a/drivers/input/touchscreen/goodix.c ++++ b/drivers/input/touchscreen/goodix.c +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -686,21 +687,6 @@ static int goodix_reset(struct goodix_ts_data *ts) + } + + #ifdef ACPI_GPIO_SUPPORT +-#include +-#include +- +-static const struct x86_cpu_id baytrail_cpu_ids[] = { +- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT, X86_FEATURE_ANY, }, +- {} +-}; +- +-static inline bool is_byt(void) +-{ +- const struct x86_cpu_id *id = x86_match_cpu(baytrail_cpu_ids); +- +- return !!id; +-} +- + static const struct acpi_gpio_params first_gpio = { 0, 0, false }; + static const struct acpi_gpio_params second_gpio = { 1, 0, false }; + +@@ -784,7 +770,7 @@ static int goodix_add_acpi_gpio_mappings(struct goodix_ts_data *ts) + dev_info(dev, "Using ACPI INTI and INTO methods for IRQ pin access\n"); + ts->irq_pin_access_method = IRQ_PIN_ACCESS_ACPI_METHOD; + gpio_mapping = acpi_goodix_reset_only_gpios; +- } else if (is_byt() && ts->gpio_count == 2 && ts->gpio_int_idx == -1) { ++ } else if (soc_intel_is_byt() && ts->gpio_count == 2 && ts->gpio_int_idx == -1) { + dev_info(dev, "No ACPI GpioInt resource, assuming that the GPIO order is reset, int\n"); + ts->irq_pin_access_method = IRQ_PIN_ACCESS_ACPI_GPIO; + gpio_mapping = acpi_goodix_int_last_gpios; +-- +2.34.1 + diff --git a/queue-5.16/input-goodix-workaround-cherry-trail-devices-with-a-.patch b/queue-5.16/input-goodix-workaround-cherry-trail-devices-with-a-.patch new file mode 100644 index 00000000000..2f6e806fc79 --- /dev/null +++ b/queue-5.16/input-goodix-workaround-cherry-trail-devices-with-a-.patch @@ -0,0 +1,65 @@ +From 23e74f74d2ec1dd0e063b8434b681d42e2ae74ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Feb 2022 22:53:12 -0800 +Subject: Input: goodix - workaround Cherry Trail devices with a bogus ACPI + Interrupt() resource + +From: Hans de Goede + +[ Upstream commit d982992669733dd75520000c6057d8ee0725a363 ] + +ACPI/x86 devices with a Cherry Trail SoC should have a GpioInt + a regular +GPIO ACPI resource in their ACPI tables. + +Some CHT devices have a bug, where the also is bogus interrupt resource +(likely copied from a previous Bay Trail based generation of the device). + +The i2c-core-acpi code will assign the bogus, non-working, interrupt +resource to client->irq. Add a workaround to fix this up. + +BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=2043960 +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20220228111613.363336-1-hdegoede@redhat.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/goodix.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c +index e053aadea3c9..d3136842b717 100644 +--- a/drivers/input/touchscreen/goodix.c ++++ b/drivers/input/touchscreen/goodix.c +@@ -745,7 +745,7 @@ static int goodix_add_acpi_gpio_mappings(struct goodix_ts_data *ts) + const struct acpi_gpio_mapping *gpio_mapping = NULL; + struct device *dev = &ts->client->dev; + LIST_HEAD(resources); +- int ret; ++ int irq, ret; + + ts->gpio_count = 0; + ts->gpio_int_idx = -1; +@@ -758,6 +758,20 @@ static int goodix_add_acpi_gpio_mappings(struct goodix_ts_data *ts) + + acpi_dev_free_resource_list(&resources); + ++ /* ++ * CHT devices should have a GpioInt + a regular GPIO ACPI resource. ++ * Some CHT devices have a bug (where the also is bogus Interrupt ++ * resource copied from a previous BYT based generation). i2c-core-acpi ++ * will use the non-working Interrupt resource, fix this up. ++ */ ++ if (soc_intel_is_cht() && ts->gpio_count == 2 && ts->gpio_int_idx != -1) { ++ irq = acpi_dev_gpio_irq_get(ACPI_COMPANION(dev), 0); ++ if (irq > 0 && irq != ts->client->irq) { ++ dev_warn(dev, "Overriding IRQ %d -> %d\n", ts->client->irq, irq); ++ ts->client->irq = irq; ++ } ++ } ++ + if (ts->gpio_count == 2 && ts->gpio_int_idx == 0) { + ts->irq_pin_access_method = IRQ_PIN_ACCESS_ACPI_GPIO; + gpio_mapping = acpi_goodix_int_first_gpios; +-- +2.34.1 + diff --git a/queue-5.16/iwlwifi-don-t-advertise-twt-support.patch b/queue-5.16/iwlwifi-don-t-advertise-twt-support.patch new file mode 100644 index 00000000000..06b9d57ff16 --- /dev/null +++ b/queue-5.16/iwlwifi-don-t-advertise-twt-support.patch @@ -0,0 +1,55 @@ +From 6ea764fd8baf0214438d78ab2f0d2fe4c3e70f1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Mar 2022 09:29:26 +0200 +Subject: iwlwifi: don't advertise TWT support + +From: Golan Ben Ami + +[ Upstream commit 1db5fcbba2631277b78d7f8aff99c9607d29f6d8 ] + +Some APs misbehave when TWT is used and cause our firmware to crash. +We don't know a reasonable way to detect and work around this problem +in the FW yet. To prevent these crashes, disable TWT in the driver by +stopping to advertise TWT support. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=215523 +Signed-off-by: Golan Ben Ami +[reworded the commit message] +Signed-off-by: Luca Coelho +Link: https://lore.kernel.org/r/20220301072926.153969-1-luca@coelho.fi +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | 3 +-- + drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 1 - + 2 files changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c +index f470f9aea50f..c97798f6290a 100644 +--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c ++++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c +@@ -552,8 +552,7 @@ static const struct ieee80211_sband_iftype_data iwl_he_capa[] = { + .has_he = true, + .he_cap_elem = { + .mac_cap_info[0] = +- IEEE80211_HE_MAC_CAP0_HTC_HE | +- IEEE80211_HE_MAC_CAP0_TWT_REQ, ++ IEEE80211_HE_MAC_CAP0_HTC_HE, + .mac_cap_info[1] = + IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US | + IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8, +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +index cde3d2ce0b85..a65024fc96dd 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -223,7 +223,6 @@ static const u8 he_if_types_ext_capa_sta[] = { + [0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING, + [2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT, + [7] = WLAN_EXT_CAPA8_OPMODE_NOTIF, +- [9] = WLAN_EXT_CAPA10_TWT_REQUESTER_SUPPORT, + }; + + static const struct wiphy_iftype_ext_capab he_iftypes_ext_capa[] = { +-- +2.34.1 + diff --git a/queue-5.16/kselftest-vm-fix-tests-build-with-old-libc.patch b/queue-5.16/kselftest-vm-fix-tests-build-with-old-libc.patch new file mode 100644 index 00000000000..c5f0d457f8b --- /dev/null +++ b/queue-5.16/kselftest-vm-fix-tests-build-with-old-libc.patch @@ -0,0 +1,47 @@ +From c3b11570523d723a6cc8ad5130d6b844317f29cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Mar 2022 20:29:04 -0800 +Subject: kselftest/vm: fix tests build with old libc + +From: Chengming Zhou + +[ Upstream commit b773827e361952b3f53ac6fa4c4e39ccd632102e ] + +The error message when I build vm tests on debian10 (GLIBC 2.28): + + userfaultfd.c: In function `userfaultfd_pagemap_test': + userfaultfd.c:1393:37: error: `MADV_PAGEOUT' undeclared (first use + in this function); did you mean `MADV_RANDOM'? + if (madvise(area_dst, test_pgsize, MADV_PAGEOUT)) + ^~~~~~~~~~~~ + MADV_RANDOM + +This patch includes these newer definitions from UAPI linux/mman.h, is +useful to fix tests build on systems without these definitions in glibc +sys/mman.h. + +Link: https://lkml.kernel.org/r/20220227055330.43087-2-zhouchengming@bytedance.com +Signed-off-by: Chengming Zhou +Reviewed-by: Shuah Khan +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/vm/userfaultfd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/vm/userfaultfd.c b/tools/testing/selftests/vm/userfaultfd.c +index 9354a5e0321c..3f7f5bd4e4c0 100644 +--- a/tools/testing/selftests/vm/userfaultfd.c ++++ b/tools/testing/selftests/vm/userfaultfd.c +@@ -46,6 +46,7 @@ + #include + #include + #include ++#include + #include + #include + #include +-- +2.34.1 + diff --git a/queue-5.16/mac80211-refuse-aggregations-sessions-before-authori.patch b/queue-5.16/mac80211-refuse-aggregations-sessions-before-authori.patch new file mode 100644 index 00000000000..bcf6c89d654 --- /dev/null +++ b/queue-5.16/mac80211-refuse-aggregations-sessions-before-authori.patch @@ -0,0 +1,54 @@ +From 8c92152b48e04b6858009ffb1f3dc19e853ff267 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Feb 2022 20:15:29 +0100 +Subject: mac80211: refuse aggregations sessions before authorized + +From: Johannes Berg + +[ Upstream commit a6bce78262f5dd4b50510f0aa47f3995f7b185f3 ] + +If an MFP station isn't authorized, the receiver will (or +at least should) drop the action frame since it's a robust +management frame, but if we're not authorized we haven't +installed keys yet. Refuse attempts to start a session as +they'd just time out. + +Signed-off-by: Johannes Berg +Link: https://lore.kernel.org/r/20220203201528.ff4d5679dce9.I34bb1f2bc341e161af2d6faf74f91b332ba11285@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/agg-tx.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c +index 74a878f213d3..1deb3d874a4b 100644 +--- a/net/mac80211/agg-tx.c ++++ b/net/mac80211/agg-tx.c +@@ -9,7 +9,7 @@ + * Copyright 2007, Michael Wu + * Copyright 2007-2010, Intel Corporation + * Copyright(c) 2015-2017 Intel Deutschland GmbH +- * Copyright (C) 2018 - 2021 Intel Corporation ++ * Copyright (C) 2018 - 2022 Intel Corporation + */ + + #include +@@ -626,6 +626,14 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid, + return -EINVAL; + } + ++ if (test_sta_flag(sta, WLAN_STA_MFP) && ++ !test_sta_flag(sta, WLAN_STA_AUTHORIZED)) { ++ ht_dbg(sdata, ++ "MFP STA not authorized - deny BA session request %pM tid %d\n", ++ sta->sta.addr, tid); ++ return -EINVAL; ++ } ++ + /* + * 802.11n-2009 11.5.1.1: If the initiating STA is an HT STA, is a + * member of an IBSS, and has no other existing Block Ack agreement +-- +2.34.1 + diff --git a/queue-5.16/mips-smp-fill-in-sibling-and-core-maps-earlier.patch b/queue-5.16/mips-smp-fill-in-sibling-and-core-maps-earlier.patch new file mode 100644 index 00000000000..9a9017d148f --- /dev/null +++ b/queue-5.16/mips-smp-fill-in-sibling-and-core-maps-earlier.patch @@ -0,0 +1,107 @@ +From 802db62534bfdc200dda60bce231b3ae23e4cdc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Feb 2022 22:21:11 +0000 +Subject: MIPS: smp: fill in sibling and core maps earlier +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alexander Lobakin + +[ Upstream commit f2703def339c793674010cc9f01bfe4980231808 ] + +After enabling CONFIG_SCHED_CORE (landed during 5.14 cycle), +2-core 2-thread-per-core interAptiv (CPS-driven) started emitting +the following: + +[ 0.025698] CPU1 revision is: 0001a120 (MIPS interAptiv (multi)) +[ 0.048183] ------------[ cut here ]------------ +[ 0.048187] WARNING: CPU: 1 PID: 0 at kernel/sched/core.c:6025 sched_core_cpu_starting+0x198/0x240 +[ 0.048220] Modules linked in: +[ 0.048233] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.17.0-rc3+ #35 b7b319f24073fd9a3c2aa7ad15fb7993eec0b26f +[ 0.048247] Stack : 817f0000 00000004 327804c8 810eb050 00000000 00000004 00000000 c314fdd1 +[ 0.048278] 830cbd64 819c0000 81800000 817f0000 83070bf4 00000001 830cbd08 00000000 +[ 0.048307] 00000000 00000000 815fcbc4 00000000 00000000 00000000 00000000 00000000 +[ 0.048334] 00000000 00000000 00000000 00000000 817f0000 00000000 00000000 817f6f34 +[ 0.048361] 817f0000 818a3c00 817f0000 00000004 00000000 00000000 4dc33260 0018c933 +[ 0.048389] ... +[ 0.048396] Call Trace: +[ 0.048399] [<8105a7bc>] show_stack+0x3c/0x140 +[ 0.048424] [<8131c2a0>] dump_stack_lvl+0x60/0x80 +[ 0.048440] [<8108b5c0>] __warn+0xc0/0xf4 +[ 0.048454] [<8108b658>] warn_slowpath_fmt+0x64/0x10c +[ 0.048467] [<810bd418>] sched_core_cpu_starting+0x198/0x240 +[ 0.048483] [<810c6514>] sched_cpu_starting+0x14/0x80 +[ 0.048497] [<8108c0f8>] cpuhp_invoke_callback_range+0x78/0x140 +[ 0.048510] [<8108d914>] notify_cpu_starting+0x94/0x140 +[ 0.048523] [<8106593c>] start_secondary+0xbc/0x280 +[ 0.048539] +[ 0.048543] ---[ end trace 0000000000000000 ]--- +[ 0.048636] Synchronize counters for CPU 1: done. + +...for each but CPU 0/boot. +Basic debug printks right before the mentioned line say: + +[ 0.048170] CPU: 1, smt_mask: + +So smt_mask, which is sibling mask obviously, is empty when entering +the function. +This is critical, as sched_core_cpu_starting() calculates +core-scheduling parameters only once per CPU start, and it's crucial +to have all the parameters filled in at that moment (at least it +uses cpu_smt_mask() which in fact is `&cpu_sibling_map[cpu]` on +MIPS). + +A bit of debugging led me to that set_cpu_sibling_map() performing +the actual map calculation, was being invocated after +notify_cpu_start(), and exactly the latter function starts CPU HP +callback round (sched_core_cpu_starting() is basically a CPU HP +callback). +While the flow is same on ARM64 (maps after the notifier, although +before calling set_cpu_online()), x86 started calculating sibling +maps earlier than starting the CPU HP callbacks in Linux 4.14 (see +[0] for the reference). Neither me nor my brief tests couldn't find +any potential caveats in calculating the maps right after performing +delay calibration, but the WARN splat is now gone. +The very same debug prints now yield exactly what I expected from +them: + +[ 0.048433] CPU: 1, smt_mask: 0-1 + +[0] https://git.kernel.org/pub/scm/linux/kernel/git/mips/linux.git/commit/?id=76ce7cfe35ef + +Signed-off-by: Alexander Lobakin +Reviewed-by: Philippe Mathieu-Daudé +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/kernel/smp.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c +index d542fb7af3ba..1986d1309410 100644 +--- a/arch/mips/kernel/smp.c ++++ b/arch/mips/kernel/smp.c +@@ -351,6 +351,9 @@ asmlinkage void start_secondary(void) + cpu = smp_processor_id(); + cpu_data[cpu].udelay_val = loops_per_jiffy; + ++ set_cpu_sibling_map(cpu); ++ set_cpu_core_map(cpu); ++ + cpumask_set_cpu(cpu, &cpu_coherent_mask); + notify_cpu_starting(cpu); + +@@ -362,9 +365,6 @@ asmlinkage void start_secondary(void) + /* The CPU is running and counters synchronised, now mark it online */ + set_cpu_online(cpu, true); + +- set_cpu_sibling_map(cpu); +- set_cpu_core_map(cpu); +- + calculate_cpu_foreign_map(); + + /* +-- +2.34.1 + diff --git a/queue-5.16/netfilter-egress-silence-egress-hook-lockdep-splats.patch b/queue-5.16/netfilter-egress-silence-egress-hook-lockdep-splats.patch new file mode 100644 index 00000000000..65c8aa8e387 --- /dev/null +++ b/queue-5.16/netfilter-egress-silence-egress-hook-lockdep-splats.patch @@ -0,0 +1,45 @@ +From b11353fe05c45221072ab82c7e43b875daacafab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Feb 2022 04:18:05 +0100 +Subject: netfilter: egress: silence egress hook lockdep splats + +From: Florian Westphal + +[ Upstream commit 17a8f31bba7bac8cce4bd12bab50697da96e7710 ] + +Netfilter assumes its called with rcu_read_lock held, but in egress +hook case it may be called with BH readlock. + +This triggers lockdep splat. + +In order to avoid to change all rcu_dereference() to +rcu_dereference_check(..., rcu_read_lock_bh_held()), wrap nf_hook_slow +with read lock/unlock pair. + +Reported-by: Eric Dumazet +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/linux/netfilter_netdev.h | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/include/linux/netfilter_netdev.h b/include/linux/netfilter_netdev.h +index b4dd96e4dc8d..e6487a691136 100644 +--- a/include/linux/netfilter_netdev.h ++++ b/include/linux/netfilter_netdev.h +@@ -101,7 +101,11 @@ static inline struct sk_buff *nf_hook_egress(struct sk_buff *skb, int *rc, + nf_hook_state_init(&state, NF_NETDEV_EGRESS, + NFPROTO_NETDEV, dev, NULL, NULL, + dev_net(dev), NULL); ++ ++ /* nf assumes rcu_read_lock, not just read_lock_bh */ ++ rcu_read_lock(); + ret = nf_hook_slow(skb, &state, e, 0); ++ rcu_read_unlock(); + + if (ret == 1) { + return skb; +-- +2.34.1 + diff --git a/queue-5.16/nl80211-update-bss-channel-on-channel-switch-for-p2p.patch b/queue-5.16/nl80211-update-bss-channel-on-channel-switch-for-p2p.patch new file mode 100644 index 00000000000..0d2e027938a --- /dev/null +++ b/queue-5.16/nl80211-update-bss-channel-on-channel-switch-for-p2p.patch @@ -0,0 +1,42 @@ +From db254b61f2819a565edc71002b892b4542575175 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Mar 2022 11:33:20 +0530 +Subject: nl80211: Update bss channel on channel switch for P2P_CLIENT + +From: Sreeramya Soratkal + +[ Upstream commit e50b88c4f076242358b66ddb67482b96947438f2 ] + +The wdev channel information is updated post channel switch only for +the station mode and not for the other modes. Due to this, the P2P client +still points to the old value though it moved to the new channel +when the channel change is induced from the P2P GO. + +Update the bss channel after CSA channel switch completion for P2P client +interface as well. + +Signed-off-by: Sreeramya Soratkal +Link: https://lore.kernel.org/r/1646114600-31479-1-git-send-email-quic_ssramya@quicinc.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/nl80211.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index f73251828782..9b4bb1460cef 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -17757,7 +17757,8 @@ void cfg80211_ch_switch_notify(struct net_device *dev, + wdev->chandef = *chandef; + wdev->preset_chandef = *chandef; + +- if (wdev->iftype == NL80211_IFTYPE_STATION && ++ if ((wdev->iftype == NL80211_IFTYPE_STATION || ++ wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) && + !WARN_ON(!wdev->current_bss)) + cfg80211_update_assoc_bss_entry(wdev, chandef->chan); + +-- +2.34.1 + diff --git a/queue-5.16/series b/queue-5.16/series index 8f5aea7fa8b..bea4d0e28e1 100644 --- a/queue-5.16/series +++ b/queue-5.16/series @@ -1 +1,27 @@ revert-xfrm-state-and-policy-should-fail-if-xfrma_if_id-0.patch +arm64-dts-rockchip-fix-dma-controller-node-names-on-.patch +arm64-dts-rockchip-fix-rk3399-puma-haikou-usb-otg-mo.patch +xfrm-check-if_id-in-xfrm_migrate.patch +xfrm-fix-xfrm-migrate-issues-when-address-family-cha.patch +arm64-dts-rockchip-fix-rk3399-puma-emmc-hs400-signal.patch +arm64-dts-rockchip-align-pl330-node-name-with-dtsche.patch +arm64-dts-rockchip-reorder-rk3399-hdmi-clocks.patch +arm64-dts-agilex-use-the-compatible-intel-socfpga-ag.patch +arm-dts-rockchip-reorder-rk322x-hmdi-clocks.patch +arm-dts-rockchip-fix-a-typo-on-rk3288-crypto-control.patch +mac80211-refuse-aggregations-sessions-before-authori.patch +mips-smp-fill-in-sibling-and-core-maps-earlier.patch +arm-9178-1-fix-unmet-dependency-on-bitreverse-for-ha.patch +bluetooth-hci_core-fix-leaking-sent_cmd-skb.patch +can-rcar_canfd-rcar_canfd_channel_probe-register-the.patch +atm-firestream-check-the-return-value-of-ioremap-in-.patch +netfilter-egress-silence-egress-hook-lockdep-splats.patch +input-goodix-use-the-new-soc_intel_is_byt-helper.patch +input-goodix-workaround-cherry-trail-devices-with-a-.patch +iwlwifi-don-t-advertise-twt-support.patch +drm-vrr-set-vrr-capable-prop-only-if-it-is-attached-.patch +nl80211-update-bss-channel-on-channel-switch-for-p2p.patch +tcp-make-tcp_read_sock-more-robust.patch +sfc-extend-the-locking-on-mcdi-seqno.patch +bnx2-fix-an-error-message.patch +kselftest-vm-fix-tests-build-with-old-libc.patch diff --git a/queue-5.16/sfc-extend-the-locking-on-mcdi-seqno.patch b/queue-5.16/sfc-extend-the-locking-on-mcdi-seqno.patch new file mode 100644 index 00000000000..9650a1d2eae --- /dev/null +++ b/queue-5.16/sfc-extend-the-locking-on-mcdi-seqno.patch @@ -0,0 +1,40 @@ +From fd7aba6b93dc14b7293b04b3ec19a401e4256e9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Mar 2022 23:28:22 +0100 +Subject: sfc: extend the locking on mcdi->seqno + +From: Niels Dossche + +[ Upstream commit f1fb205efb0ccca55626fd4ef38570dd16b44719 ] + +seqno could be read as a stale value outside of the lock. The lock is +already acquired to protect the modification of seqno against a possible +race condition. Place the reading of this value also inside this locking +to protect it against a possible race condition. + +Signed-off-by: Niels Dossche +Acked-by: Martin Habets +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/mcdi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/sfc/mcdi.c b/drivers/net/ethernet/sfc/mcdi.c +index be6bfd6b7ec7..50baf62b2cbc 100644 +--- a/drivers/net/ethernet/sfc/mcdi.c ++++ b/drivers/net/ethernet/sfc/mcdi.c +@@ -163,9 +163,9 @@ static void efx_mcdi_send_request(struct efx_nic *efx, unsigned cmd, + /* Serialise with efx_mcdi_ev_cpl() and efx_mcdi_ev_death() */ + spin_lock_bh(&mcdi->iface_lock); + ++mcdi->seqno; ++ seqno = mcdi->seqno & SEQ_MASK; + spin_unlock_bh(&mcdi->iface_lock); + +- seqno = mcdi->seqno & SEQ_MASK; + xflags = 0; + if (mcdi->mode == MCDI_MODE_EVENTS) + xflags |= MCDI_HEADER_XFLAGS_EVREQ; +-- +2.34.1 + diff --git a/queue-5.16/tcp-make-tcp_read_sock-more-robust.patch b/queue-5.16/tcp-make-tcp_read_sock-more-robust.patch new file mode 100644 index 00000000000..70ea6c0c1d0 --- /dev/null +++ b/queue-5.16/tcp-make-tcp_read_sock-more-robust.patch @@ -0,0 +1,50 @@ +From de79c8767ce3ad3e5d9b0851799715338a6141cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Mar 2022 08:17:23 -0800 +Subject: tcp: make tcp_read_sock() more robust + +From: Eric Dumazet + +[ Upstream commit e3d5ea2c011ecb16fb94c56a659364e6b30fac94 ] + +If recv_actor() returns an incorrect value, tcp_read_sock() +might loop forever. + +Instead, issue a one time warning and make sure to make progress. + +Signed-off-by: Eric Dumazet +Acked-by: John Fastabend +Acked-by: Jakub Sitnicki +Acked-by: Daniel Borkmann +Link: https://lore.kernel.org/r/20220302161723.3910001-2-eric.dumazet@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 28abb0bb1c51..38f936785179 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -1653,11 +1653,13 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc, + if (!copied) + copied = used; + break; +- } else if (used <= len) { +- seq += used; +- copied += used; +- offset += used; + } ++ if (WARN_ON_ONCE(used > len)) ++ used = len; ++ seq += used; ++ copied += used; ++ offset += used; ++ + /* If recv_actor drops the lock (e.g. TCP splice + * receive) the skb pointer might be invalid when + * getting here: tcp_collapse might have deleted it +-- +2.34.1 + diff --git a/queue-5.16/xfrm-check-if_id-in-xfrm_migrate.patch b/queue-5.16/xfrm-check-if_id-in-xfrm_migrate.patch new file mode 100644 index 00000000000..66ff9fd6aa3 --- /dev/null +++ b/queue-5.16/xfrm-check-if_id-in-xfrm_migrate.patch @@ -0,0 +1,205 @@ +From 595988fee53e2c1a8522bf2905e3459a10a699de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jan 2022 16:00:13 -0800 +Subject: xfrm: Check if_id in xfrm_migrate + +From: Yan Yan + +[ Upstream commit c1aca3080e382886e2e58e809787441984a2f89b ] + +This patch enables distinguishing SAs and SPs based on if_id during +the xfrm_migrate flow. This ensures support for xfrm interfaces +throughout the SA/SP lifecycle. + +When there are multiple existing SPs with the same direction, +the same xfrm_selector and different endpoint addresses, +xfrm_migrate might fail with ENODATA. + +Specifically, the code path for performing xfrm_migrate is: + Stage 1: find policy to migrate with + xfrm_migrate_policy_find(sel, dir, type, net) + Stage 2: find and update state(s) with + xfrm_migrate_state_find(mp, net) + Stage 3: update endpoint address(es) of template(s) with + xfrm_policy_migrate(pol, m, num_migrate) + +Currently "Stage 1" always returns the first xfrm_policy that +matches, and "Stage 3" looks for the xfrm_tmpl that matches the +old endpoint address. Thus if there are multiple xfrm_policy +with same selector, direction, type and net, "Stage 1" might +rertun a wrong xfrm_policy and "Stage 3" will fail with ENODATA +because it cannot find a xfrm_tmpl with the matching endpoint +address. + +The fix is to allow userspace to pass an if_id and add if_id +to the matching rule in Stage 1 and Stage 2 since if_id is a +unique ID for xfrm_policy and xfrm_state. For compatibility, +if_id will only be checked if the attribute is set. + +Tested with additions to Android's kernel unit test suite: +https://android-review.googlesource.com/c/kernel/tests/+/1668886 + +Signed-off-by: Yan Yan +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + include/net/xfrm.h | 5 +++-- + net/key/af_key.c | 2 +- + net/xfrm/xfrm_policy.c | 14 ++++++++------ + net/xfrm/xfrm_state.c | 7 ++++++- + net/xfrm/xfrm_user.c | 6 +++++- + 5 files changed, 23 insertions(+), 11 deletions(-) + +diff --git a/include/net/xfrm.h b/include/net/xfrm.h +index 301a164f17e9..358dfe6fefef 100644 +--- a/include/net/xfrm.h ++++ b/include/net/xfrm.h +@@ -1679,14 +1679,15 @@ int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, + const struct xfrm_migrate *m, int num_bundles, + const struct xfrm_kmaddress *k, + const struct xfrm_encap_tmpl *encap); +-struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net); ++struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net, ++ u32 if_id); + struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x, + struct xfrm_migrate *m, + struct xfrm_encap_tmpl *encap); + int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, + struct xfrm_migrate *m, int num_bundles, + struct xfrm_kmaddress *k, struct net *net, +- struct xfrm_encap_tmpl *encap); ++ struct xfrm_encap_tmpl *encap, u32 if_id); + #endif + + int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport); +diff --git a/net/key/af_key.c b/net/key/af_key.c +index de24a7d474df..9bf52a09b5ff 100644 +--- a/net/key/af_key.c ++++ b/net/key/af_key.c +@@ -2623,7 +2623,7 @@ static int pfkey_migrate(struct sock *sk, struct sk_buff *skb, + } + + return xfrm_migrate(&sel, dir, XFRM_POLICY_TYPE_MAIN, m, i, +- kma ? &k : NULL, net, NULL); ++ kma ? &k : NULL, net, NULL, 0); + + out: + return err; +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index 4924b9135c6e..fbc0b2798184 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -4257,7 +4257,7 @@ static bool xfrm_migrate_selector_match(const struct xfrm_selector *sel_cmp, + } + + static struct xfrm_policy *xfrm_migrate_policy_find(const struct xfrm_selector *sel, +- u8 dir, u8 type, struct net *net) ++ u8 dir, u8 type, struct net *net, u32 if_id) + { + struct xfrm_policy *pol, *ret = NULL; + struct hlist_head *chain; +@@ -4266,7 +4266,8 @@ static struct xfrm_policy *xfrm_migrate_policy_find(const struct xfrm_selector * + spin_lock_bh(&net->xfrm.xfrm_policy_lock); + chain = policy_hash_direct(net, &sel->daddr, &sel->saddr, sel->family, dir); + hlist_for_each_entry(pol, chain, bydst) { +- if (xfrm_migrate_selector_match(sel, &pol->selector) && ++ if ((if_id == 0 || pol->if_id == if_id) && ++ xfrm_migrate_selector_match(sel, &pol->selector) && + pol->type == type) { + ret = pol; + priority = ret->priority; +@@ -4278,7 +4279,8 @@ static struct xfrm_policy *xfrm_migrate_policy_find(const struct xfrm_selector * + if ((pol->priority >= priority) && ret) + break; + +- if (xfrm_migrate_selector_match(sel, &pol->selector) && ++ if ((if_id == 0 || pol->if_id == if_id) && ++ xfrm_migrate_selector_match(sel, &pol->selector) && + pol->type == type) { + ret = pol; + break; +@@ -4394,7 +4396,7 @@ static int xfrm_migrate_check(const struct xfrm_migrate *m, int num_migrate) + int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, + struct xfrm_migrate *m, int num_migrate, + struct xfrm_kmaddress *k, struct net *net, +- struct xfrm_encap_tmpl *encap) ++ struct xfrm_encap_tmpl *encap, u32 if_id) + { + int i, err, nx_cur = 0, nx_new = 0; + struct xfrm_policy *pol = NULL; +@@ -4413,14 +4415,14 @@ int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, + } + + /* Stage 1 - find policy */ +- if ((pol = xfrm_migrate_policy_find(sel, dir, type, net)) == NULL) { ++ if ((pol = xfrm_migrate_policy_find(sel, dir, type, net, if_id)) == NULL) { + err = -ENOENT; + goto out; + } + + /* Stage 2 - find and update state(s) */ + for (i = 0, mp = m; i < num_migrate; i++, mp++) { +- if ((x = xfrm_migrate_state_find(mp, net))) { ++ if ((x = xfrm_migrate_state_find(mp, net, if_id))) { + x_cur[nx_cur] = x; + nx_cur++; + xc = xfrm_state_migrate(x, mp, encap); +diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c +index 100b4b3723e7..291236d7676f 100644 +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -1605,7 +1605,8 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, + return NULL; + } + +-struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net) ++struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net, ++ u32 if_id) + { + unsigned int h; + struct xfrm_state *x = NULL; +@@ -1621,6 +1622,8 @@ struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *n + continue; + if (m->reqid && x->props.reqid != m->reqid) + continue; ++ if (if_id != 0 && x->if_id != if_id) ++ continue; + if (!xfrm_addr_equal(&x->id.daddr, &m->old_daddr, + m->old_family) || + !xfrm_addr_equal(&x->props.saddr, &m->old_saddr, +@@ -1636,6 +1639,8 @@ struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *n + if (x->props.mode != m->mode || + x->id.proto != m->proto) + continue; ++ if (if_id != 0 && x->if_id != if_id) ++ continue; + if (!xfrm_addr_equal(&x->id.daddr, &m->old_daddr, + m->old_family) || + !xfrm_addr_equal(&x->props.saddr, &m->old_saddr, +diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c +index 17f0623c4508..a8c142bd1263 100644 +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -2592,6 +2592,7 @@ static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh, + int n = 0; + struct net *net = sock_net(skb->sk); + struct xfrm_encap_tmpl *encap = NULL; ++ u32 if_id = 0; + + if (attrs[XFRMA_MIGRATE] == NULL) + return -EINVAL; +@@ -2616,7 +2617,10 @@ static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh, + return -ENOMEM; + } + +- err = xfrm_migrate(&pi->sel, pi->dir, type, m, n, kmp, net, encap); ++ if (attrs[XFRMA_IF_ID]) ++ if_id = nla_get_u32(attrs[XFRMA_IF_ID]); ++ ++ err = xfrm_migrate(&pi->sel, pi->dir, type, m, n, kmp, net, encap, if_id); + + kfree(encap); + +-- +2.34.1 + diff --git a/queue-5.16/xfrm-fix-xfrm-migrate-issues-when-address-family-cha.patch b/queue-5.16/xfrm-fix-xfrm-migrate-issues-when-address-family-cha.patch new file mode 100644 index 00000000000..1f222cd0192 --- /dev/null +++ b/queue-5.16/xfrm-fix-xfrm-migrate-issues-when-address-family-cha.patch @@ -0,0 +1,58 @@ +From 13f9458a8f4ed4b294fee11679cd068da69429a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jan 2022 16:00:14 -0800 +Subject: xfrm: Fix xfrm migrate issues when address family changes + +From: Yan Yan + +[ Upstream commit e03c3bba351f99ad932e8f06baa9da1afc418e02 ] + +xfrm_migrate cannot handle address family change of an xfrm_state. +The symptons are the xfrm_state will be migrated to a wrong address, +and sending as well as receiving packets wil be broken. + +This commit fixes it by breaking the original xfrm_state_clone +method into two steps so as to update the props.family before +running xfrm_init_state. As the result, xfrm_state's inner mode, +outer mode, type and IP header length in xfrm_state_migrate can +be updated with the new address family. + +Tested with additions to Android's kernel unit test suite: +https://android-review.googlesource.com/c/kernel/tests/+/1885354 + +Signed-off-by: Yan Yan +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_state.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c +index 291236d7676f..f7bfa1916968 100644 +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -1578,9 +1578,6 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, + memcpy(&x->mark, &orig->mark, sizeof(x->mark)); + memcpy(&x->props.smark, &orig->props.smark, sizeof(x->props.smark)); + +- if (xfrm_init_state(x) < 0) +- goto error; +- + x->props.flags = orig->props.flags; + x->props.extra_flags = orig->props.extra_flags; + +@@ -1667,6 +1664,11 @@ struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x, + if (!xc) + return NULL; + ++ xc->props.family = m->new_family; ++ ++ if (xfrm_init_state(xc) < 0) ++ goto error; ++ + memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr)); + memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr)); + +-- +2.34.1 +