From: Sasha Levin Date: Fri, 20 Dec 2024 14:39:01 +0000 (-0500) Subject: Fixes for 5.10 X-Git-Tag: v6.1.122~43 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9dc3e140f4cc2935ac5cbd752c800eb9f4af455f;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/ionic-use-ee-offset-when-returning-sprom-data.patch b/queue-5.10/ionic-use-ee-offset-when-returning-sprom-data.patch new file mode 100644 index 00000000000..d42e2bf5f0f --- /dev/null +++ b/queue-5.10/ionic-use-ee-offset-when-returning-sprom-data.patch @@ -0,0 +1,42 @@ +From 4fc0693c35489e3dbe2e547604f36298c85cc2f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Dec 2024 13:31:57 -0800 +Subject: ionic: use ee->offset when returning sprom data + +From: Shannon Nelson + +[ Upstream commit b096d62ba1323391b2db98b7704e2468cf3b1588 ] + +Some calls into ionic_get_module_eeprom() don't use a single +full buffer size, but instead multiple calls with an offset. +Teach our driver to use the offset correctly so we can +respond appropriately to the caller. + +Fixes: 4d03e00a2140 ("ionic: Add initial ethtool support") +Signed-off-by: Shannon Nelson +Reviewed-by: Jacob Keller +Link: https://patch.msgid.link/20241212213157.12212-4-shannon.nelson@amd.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/pensando/ionic/ionic_ethtool.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c b/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c +index 8e5b01af85ed..d0a613fac9ff 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c +@@ -835,8 +835,8 @@ static int ionic_get_module_eeprom(struct net_device *netdev, + len = min_t(u32, sizeof(xcvr->sprom), ee->len); + + do { +- memcpy(data, xcvr->sprom, len); +- memcpy(tbuf, xcvr->sprom, len); ++ memcpy(data, &xcvr->sprom[ee->offset], len); ++ memcpy(tbuf, &xcvr->sprom[ee->offset], len); + + /* Let's make sure we got a consistent copy */ + if (!memcmp(data, tbuf, len)) +-- +2.39.5 + diff --git a/queue-5.10/net-ethernet-bgmac-platform-fix-an-of-node-reference.patch b/queue-5.10/net-ethernet-bgmac-platform-fix-an-of-node-reference.patch new file mode 100644 index 00000000000..17d44e594c7 --- /dev/null +++ b/queue-5.10/net-ethernet-bgmac-platform-fix-an-of-node-reference.patch @@ -0,0 +1,51 @@ +From 87487550daa1278607c3be73ace82ebbc3fc4dc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Dec 2024 10:49:12 +0900 +Subject: net: ethernet: bgmac-platform: fix an OF node reference leak + +From: Joe Hattori + +[ Upstream commit 0cb2c504d79e7caa3abade3f466750c82ad26f01 ] + +The OF node obtained by of_parse_phandle() is not freed. Call +of_node_put() to balance the refcount. + +This bug was found by an experimental static analysis tool that I am +developing. + +Fixes: 1676aba5ef7e ("net: ethernet: bgmac: device tree phy enablement") +Signed-off-by: Joe Hattori +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20241214014912.2810315-1-joe@pf.is.s.u-tokyo.ac.jp +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bgmac-platform.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bgmac-platform.c b/drivers/net/ethernet/broadcom/bgmac-platform.c +index f37f1c58f368..c2e0bc1326fe 100644 +--- a/drivers/net/ethernet/broadcom/bgmac-platform.c ++++ b/drivers/net/ethernet/broadcom/bgmac-platform.c +@@ -171,6 +171,7 @@ static int platform_phy_connect(struct bgmac *bgmac) + static int bgmac_probe(struct platform_device *pdev) + { + struct device_node *np = pdev->dev.of_node; ++ struct device_node *phy_node; + struct bgmac *bgmac; + struct resource *regs; + const u8 *mac_addr; +@@ -232,7 +233,9 @@ static int bgmac_probe(struct platform_device *pdev) + bgmac->cco_ctl_maskset = platform_bgmac_cco_ctl_maskset; + bgmac->get_bus_clock = platform_bgmac_get_bus_clock; + bgmac->cmn_maskset32 = platform_bgmac_cmn_maskset32; +- if (of_parse_phandle(np, "phy-handle", 0)) { ++ phy_node = of_parse_phandle(np, "phy-handle", 0); ++ if (phy_node) { ++ of_node_put(phy_node); + bgmac->phy_connect = platform_phy_connect; + } else { + bgmac->phy_connect = bgmac_phy_connect_direct; +-- +2.39.5 + diff --git a/queue-5.10/net-hinic-fix-cleanup-in-create_rxqs-txqs.patch b/queue-5.10/net-hinic-fix-cleanup-in-create_rxqs-txqs.patch new file mode 100644 index 00000000000..994ec1a219d --- /dev/null +++ b/queue-5.10/net-hinic-fix-cleanup-in-create_rxqs-txqs.patch @@ -0,0 +1,54 @@ +From c3edb2281a1f0bdd0b530729dbfa670525f94a7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Dec 2024 17:28:11 +0300 +Subject: net: hinic: Fix cleanup in create_rxqs/txqs() + +From: Dan Carpenter + +[ Upstream commit 7203d10e93b6e6e1d19481ef7907de6a9133a467 ] + +There is a check for NULL at the start of create_txqs() and +create_rxqs() which tess if "nic_dev->txqs" is non-NULL. The +intention is that if the device is already open and the queues +are already created then we don't create them a second time. + +However, the bug is that if we have an error in the create_txqs() +then the pointer doesn't get set back to NULL. The NULL check +at the start of the function will say that it's already open when +it's not and the device can't be used. + +Set ->txqs back to NULL on cleanup on error. + +Fixes: c3e79baf1b03 ("net-next/hinic: Add logical Txq and Rxq") +Signed-off-by: Dan Carpenter +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/0cc98faf-a0ed-4565-a55b-0fa2734bc205@stanley.mountain +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/huawei/hinic/hinic_main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/huawei/hinic/hinic_main.c b/drivers/net/ethernet/huawei/hinic/hinic_main.c +index 6ec042d48cd1..dd5c96557976 100644 +--- a/drivers/net/ethernet/huawei/hinic/hinic_main.c ++++ b/drivers/net/ethernet/huawei/hinic/hinic_main.c +@@ -173,6 +173,7 @@ static int create_txqs(struct hinic_dev *nic_dev) + hinic_sq_dbgfs_uninit(nic_dev); + + devm_kfree(&netdev->dev, nic_dev->txqs); ++ nic_dev->txqs = NULL; + return err; + } + +@@ -269,6 +270,7 @@ static int create_rxqs(struct hinic_dev *nic_dev) + hinic_rq_dbgfs_uninit(nic_dev); + + devm_kfree(&netdev->dev, nic_dev->rxqs); ++ nic_dev->rxqs = NULL; + return err; + } + +-- +2.39.5 + diff --git a/queue-5.10/net-smc-check-iparea_offset-and-ipv6_prefixes_cnt-wh.patch b/queue-5.10/net-smc-check-iparea_offset-and-ipv6_prefixes_cnt-wh.patch new file mode 100644 index 00000000000..fa8c1933d4b --- /dev/null +++ b/queue-5.10/net-smc-check-iparea_offset-and-ipv6_prefixes_cnt-wh.patch @@ -0,0 +1,90 @@ +From 1ddaad433b5d242dd3218aa920c5a9e43fe89dfc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 17:21:18 +0800 +Subject: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving + proposal msg + +From: Guangguan Wang + +[ Upstream commit a29e220d3c8edbf0e1beb0f028878a4a85966556 ] + +When receiving proposal msg in server, the field iparea_offset +and the field ipv6_prefixes_cnt in proposal msg are from the +remote client and can not be fully trusted. Especially the +field iparea_offset, once exceed the max value, there has the +chance to access wrong address, and crash may happen. + +This patch checks iparea_offset and ipv6_prefixes_cnt before using them. + +Fixes: e7b7a64a8493 ("smc: support variable CLC proposal messages") +Signed-off-by: Guangguan Wang +Reviewed-by: Wen Gu +Reviewed-by: D. Wythe +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/smc/af_smc.c | 6 +++++- + net/smc/smc_clc.c | 4 ++++ + net/smc/smc_clc.h | 6 +++++- + 3 files changed, 14 insertions(+), 2 deletions(-) + +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index 3a4ae589671a..0e0a12f4bb61 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -1422,6 +1422,8 @@ static int smc_listen_prfx_check(struct smc_sock *new_smc, + if (pclc->hdr.typev1 == SMC_TYPE_N) + return 0; + pclc_prfx = smc_clc_proposal_get_prefix(pclc); ++ if (!pclc_prfx) ++ return -EPROTO; + if (smc_clc_prfx_match(newclcsock, pclc_prfx)) + return SMC_CLC_DECL_DIFFPREFIX; + +@@ -1578,7 +1580,9 @@ static void smc_find_ism_v1_device_serv(struct smc_sock *new_smc, + struct smc_clc_msg_smcd *pclc_smcd = smc_get_clc_msg_smcd(pclc); + + /* check if ISM V1 is available */ +- if (!(ini->smcd_version & SMC_V1) || !smcd_indicated(ini->smc_type_v1)) ++ if (!(ini->smcd_version & SMC_V1) || ++ !smcd_indicated(ini->smc_type_v1) || ++ !pclc_smcd) + goto not_found; + ini->is_smcd = true; /* prepare ISM check */ + ini->ism_peer_gid[0] = ntohll(pclc_smcd->ism.gid); +diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c +index 5ee5b2ce29a6..32cbdc321aec 100644 +--- a/net/smc/smc_clc.c ++++ b/net/smc/smc_clc.c +@@ -49,6 +49,10 @@ static bool smc_clc_msg_prop_valid(struct smc_clc_msg_proposal *pclc) + + v2_ext = smc_get_clc_v2_ext(pclc); + pclc_prfx = smc_clc_proposal_get_prefix(pclc); ++ if (!pclc_prfx || ++ pclc_prfx->ipv6_prefixes_cnt > SMC_CLC_MAX_V6_PREFIX) ++ return false; ++ + if (hdr->version == SMC_V1) { + if (hdr->typev1 == SMC_TYPE_N) + return false; +diff --git a/net/smc/smc_clc.h b/net/smc/smc_clc.h +index c579d1d5995a..a57a3489df4a 100644 +--- a/net/smc/smc_clc.h ++++ b/net/smc/smc_clc.h +@@ -259,8 +259,12 @@ struct smc_clc_msg_decline { /* clc decline message */ + static inline struct smc_clc_msg_proposal_prefix * + smc_clc_proposal_get_prefix(struct smc_clc_msg_proposal *pclc) + { ++ u16 offset = ntohs(pclc->iparea_offset); ++ ++ if (offset > sizeof(struct smc_clc_msg_smcd)) ++ return NULL; + return (struct smc_clc_msg_proposal_prefix *) +- ((u8 *)pclc + sizeof(*pclc) + ntohs(pclc->iparea_offset)); ++ ((u8 *)pclc + sizeof(*pclc) + offset); + } + + static inline bool smcr_indicated(int smc_type) +-- +2.39.5 + diff --git a/queue-5.10/net-smc-check-return-value-of-sock_recvmsg-when-drai.patch b/queue-5.10/net-smc-check-return-value-of-sock_recvmsg-when-drai.patch new file mode 100644 index 00000000000..a8b0d4926fa --- /dev/null +++ b/queue-5.10/net-smc-check-return-value-of-sock_recvmsg-when-drai.patch @@ -0,0 +1,47 @@ +From 4216f0cdb32f4991830d21eff4627b963bc95a29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 17:21:21 +0800 +Subject: net/smc: check return value of sock_recvmsg when draining clc data + +From: Guangguan Wang + +[ Upstream commit c5b8ee5022a19464783058dc6042e8eefa34e8cd ] + +When receiving clc msg, the field length in smc_clc_msg_hdr indicates the +length of msg should be received from network and the value should not be +fully trusted as it is from the network. Once the value of length exceeds +the value of buflen in function smc_clc_wait_msg it may run into deadloop +when trying to drain the remaining data exceeding buflen. + +This patch checks the return value of sock_recvmsg when draining data in +case of deadloop in draining. + +Fixes: fb4f79264c0f ("net/smc: tolerate future SMCD versions") +Signed-off-by: Guangguan Wang +Reviewed-by: Wen Gu +Reviewed-by: D. Wythe +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/smc/smc_clc.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c +index 32cbdc321aec..2aa69e29fa1d 100644 +--- a/net/smc/smc_clc.c ++++ b/net/smc/smc_clc.c +@@ -427,6 +427,11 @@ int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen, + SMC_CLC_RECV_BUF_LEN : datlen; + iov_iter_kvec(&msg.msg_iter, READ, &vec, 1, recvlen); + len = sock_recvmsg(smc->clcsock, &msg, krflags); ++ if (len < recvlen) { ++ smc->sk.sk_err = EPROTO; ++ reason_code = -EPROTO; ++ goto out; ++ } + datlen -= len; + } + if (clcm->type == SMC_CLC_DECLINE) { +-- +2.39.5 + diff --git a/queue-5.10/net-smc-check-sndbuf_space-again-after-nospace-flag-.patch b/queue-5.10/net-smc-check-sndbuf_space-again-after-nospace-flag-.patch new file mode 100644 index 00000000000..779d478d1d7 --- /dev/null +++ b/queue-5.10/net-smc-check-sndbuf_space-again-after-nospace-flag-.patch @@ -0,0 +1,63 @@ +From 5d04092d4c4cb2c67af9b63ce97ff13c6832e206 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 17:21:17 +0800 +Subject: net/smc: check sndbuf_space again after NOSPACE flag is set in + smc_poll + +From: Guangguan Wang + +[ Upstream commit 679e9ddcf90dbdf98aaaa71a492454654b627bcb ] + +When application sending data more than sndbuf_space, there have chances +application will sleep in epoll_wait, and will never be wakeup again. This +is caused by a race between smc_poll and smc_cdc_tx_handler. + +application tasklet +smc_tx_sendmsg(len > sndbuf_space) | +epoll_wait for EPOLL_OUT,timeout=0 | + smc_poll | + if (!smc->conn.sndbuf_space) | + | smc_cdc_tx_handler + | atomic_add sndbuf_space + | smc_tx_sndbuf_nonfull + | if (!test_bit SOCK_NOSPACE) + | do not sk_write_space; + set_bit SOCK_NOSPACE; | + return mask=0; | + +Application will sleep in epoll_wait as smc_poll returns 0. And +smc_cdc_tx_handler will not call sk_write_space because the SOCK_NOSPACE +has not be set. If there is no inflight cdc msg, sk_write_space will not be +called any more, and application will sleep in epoll_wait forever. +So check sndbuf_space again after NOSPACE flag is set to break the race. + +Fixes: 8dce2786a290 ("net/smc: smc_poll improvements") +Signed-off-by: Guangguan Wang +Suggested-by: Paolo Abeni +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/smc/af_smc.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index 664ddf5641de..3a4ae589671a 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -2110,6 +2110,13 @@ static __poll_t smc_poll(struct file *file, struct socket *sock, + } else { + sk_set_bit(SOCKWQ_ASYNC_NOSPACE, sk); + set_bit(SOCK_NOSPACE, &sk->sk_socket->flags); ++ ++ if (sk->sk_state != SMC_INIT) { ++ /* Race breaker the same way as tcp_poll(). */ ++ smp_mb__after_atomic(); ++ if (atomic_read(&smc->conn.sndbuf_space)) ++ mask |= EPOLLOUT | EPOLLWRNORM; ++ } + } + if (atomic_read(&smc->conn.bytes_to_rcv)) + mask |= EPOLLIN | EPOLLRDNORM; +-- +2.39.5 + diff --git a/queue-5.10/netdevsim-prevent-bad-user-input-in-nsim_dev_health_.patch b/queue-5.10/netdevsim-prevent-bad-user-input-in-nsim_dev_health_.patch new file mode 100644 index 00000000000..753b72498f5 --- /dev/null +++ b/queue-5.10/netdevsim-prevent-bad-user-input-in-nsim_dev_health_.patch @@ -0,0 +1,40 @@ +From eaa385c0205b778070daa450f32cdf0c95b850af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Dec 2024 17:25:18 +0000 +Subject: netdevsim: prevent bad user input in nsim_dev_health_break_write() + +From: Eric Dumazet + +[ Upstream commit ee76746387f6233bdfa93d7406990f923641568f ] + +If either a zero count or a large one is provided, kernel can crash. + +Fixes: 82c93a87bf8b ("netdevsim: implement couple of testing devlink health reporters") +Reported-by: syzbot+ea40e4294e58b0292f74@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/675c6862.050a0220.37aaf.00b1.GAE@google.com/T/#u +Signed-off-by: Eric Dumazet +Cc: Jiri Pirko +Reviewed-by: Joe Damato +Link: https://patch.msgid.link/20241213172518.2415666-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/netdevsim/health.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/netdevsim/health.c b/drivers/net/netdevsim/health.c +index 04aebdf85747..c9306506b741 100644 +--- a/drivers/net/netdevsim/health.c ++++ b/drivers/net/netdevsim/health.c +@@ -235,6 +235,8 @@ static ssize_t nsim_dev_health_break_write(struct file *file, + char *break_msg; + int err; + ++ if (count == 0 || count > PAGE_SIZE) ++ return -EINVAL; + break_msg = memdup_user_nul(data, count); + if (IS_ERR(break_msg)) + return PTR_ERR(break_msg); +-- +2.39.5 + diff --git a/queue-5.10/netdevsim-switch-to-memdup_user_nul.patch b/queue-5.10/netdevsim-switch-to-memdup_user_nul.patch new file mode 100644 index 00000000000..dcda8f747ce --- /dev/null +++ b/queue-5.10/netdevsim-switch-to-memdup_user_nul.patch @@ -0,0 +1,48 @@ +From 0605daccaf3b7e1a742c248a36d4c8fbce8797e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 14:42:20 +0000 +Subject: netdevsim: switch to memdup_user_nul() + +From: Wei Yongjun + +[ Upstream commit 20fd4f421cf4c21ab37a8bf31db50c69f1b49355 ] + +Use memdup_user_nul() helper instead of open-coding to +simplify the code. + +Reported-by: Hulk Robot +Signed-off-by: Wei Yongjun +Reviewed-by: Jakub Kicinski +Signed-off-by: David S. Miller +Stable-dep-of: ee76746387f6 ("netdevsim: prevent bad user input in nsim_dev_health_break_write()") +Signed-off-by: Sasha Levin +--- + drivers/net/netdevsim/health.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/netdevsim/health.c b/drivers/net/netdevsim/health.c +index 21e2974660e7..04aebdf85747 100644 +--- a/drivers/net/netdevsim/health.c ++++ b/drivers/net/netdevsim/health.c +@@ -235,15 +235,10 @@ static ssize_t nsim_dev_health_break_write(struct file *file, + char *break_msg; + int err; + +- break_msg = kmalloc(count + 1, GFP_KERNEL); +- if (!break_msg) +- return -ENOMEM; ++ break_msg = memdup_user_nul(data, count); ++ if (IS_ERR(break_msg)) ++ return PTR_ERR(break_msg); + +- if (copy_from_user(break_msg, data, count)) { +- err = -EFAULT; +- goto out; +- } +- break_msg[count] = '\0'; + if (break_msg[count - 1] == '\n') + break_msg[count - 1] = '\0'; + +-- +2.39.5 + diff --git a/queue-5.10/netfilter-ipset-fix-for-recursive-locking-warning.patch b/queue-5.10/netfilter-ipset-fix-for-recursive-locking-warning.patch new file mode 100644 index 00000000000..0112bd70d30 --- /dev/null +++ b/queue-5.10/netfilter-ipset-fix-for-recursive-locking-warning.patch @@ -0,0 +1,62 @@ +From 2e715e296ea4a4e532f52444742a568149848e80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Dec 2024 20:56:55 +0100 +Subject: netfilter: ipset: Fix for recursive locking warning + +From: Phil Sutter + +[ Upstream commit 70b6f46a4ed8bd56c85ffff22df91e20e8c85e33 ] + +With CONFIG_PROVE_LOCKING, when creating a set of type bitmap:ip, adding +it to a set of type list:set and populating it from iptables SET target +triggers a kernel warning: + +| WARNING: possible recursive locking detected +| 6.12.0-rc7-01692-g5e9a28f41134-dirty #594 Not tainted +| -------------------------------------------- +| ping/4018 is trying to acquire lock: +| ffff8881094a6848 (&set->lock){+.-.}-{2:2}, at: ip_set_add+0x28c/0x360 [ip_set] +| +| but task is already holding lock: +| ffff88811034c048 (&set->lock){+.-.}-{2:2}, at: ip_set_add+0x28c/0x360 [ip_set] + +This is a false alarm: ipset does not allow nested list:set type, so the +loop in list_set_kadd() can never encounter the outer set itself. No +other set type supports embedded sets, so this is the only case to +consider. + +To avoid the false report, create a distinct lock class for list:set +type ipset locks. + +Fixes: f830837f0eed ("netfilter: ipset: list:set set type support") +Signed-off-by: Phil Sutter +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/ipset/ip_set_list_set.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c +index 902ff2f3bc72..5cc35b553a04 100644 +--- a/net/netfilter/ipset/ip_set_list_set.c ++++ b/net/netfilter/ipset/ip_set_list_set.c +@@ -611,6 +611,8 @@ init_list_set(struct net *net, struct ip_set *set, u32 size) + return true; + } + ++static struct lock_class_key list_set_lockdep_key; ++ + static int + list_set_create(struct net *net, struct ip_set *set, struct nlattr *tb[], + u32 flags) +@@ -627,6 +629,7 @@ list_set_create(struct net *net, struct ip_set *set, struct nlattr *tb[], + if (size < IP_SET_LIST_MIN_SIZE) + size = IP_SET_LIST_MIN_SIZE; + ++ lockdep_set_class(&set->lock, &list_set_lockdep_key); + set->variant = &set_variant; + set->dsize = ip_set_elem_len(set, tb, sizeof(struct set_elem), + __alignof__(struct set_elem)); +-- +2.39.5 + diff --git a/queue-5.10/series b/queue-5.10/series index efb00a7a7cf..1b3f3ed2a14 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -9,3 +9,12 @@ usb-dwc2-gadget-don-t-write-invalid-mapped-sg-entrie.patch i2c-pnx-fix-timeout-in-wait-functions.patch erofs-fix-order-max_order-warning-due-to-crafted-neg.patch erofs-fix-incorrect-symlink-detection-in-fast-symlin.patch +net-smc-check-sndbuf_space-again-after-nospace-flag-.patch +net-smc-check-iparea_offset-and-ipv6_prefixes_cnt-wh.patch +net-smc-check-return-value-of-sock_recvmsg-when-drai.patch +netdevsim-switch-to-memdup_user_nul.patch +netdevsim-prevent-bad-user-input-in-nsim_dev_health_.patch +ionic-use-ee-offset-when-returning-sprom-data.patch +net-hinic-fix-cleanup-in-create_rxqs-txqs.patch +net-ethernet-bgmac-platform-fix-an-of-node-reference.patch +netfilter-ipset-fix-for-recursive-locking-warning.patch