From: Greg Kroah-Hartman Date: Tue, 3 Mar 2020 10:00:19 +0000 (+0100) Subject: 5.5-stable patches X-Git-Tag: v4.19.108~47 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a08f298fb5a4e94cbbd7bb65749f6e315f9fa6e1;p=thirdparty%2Fkernel%2Fstable-queue.git 5.5-stable patches added patches: net-atlantic-better-loopback-mode-handling.patch net-atlantic-checksum-compat-issue.patch net-atlantic-fix-out-of-range-usage-of-active_vlans-array.patch net-atlantic-fix-potential-error-handling.patch net-atlantic-fix-use-after-free-kasan-warn.patch net-atlantic-possible-fault-in-transition-to-hibernation.patch net-netlink-cap-max-groups-which-will-be-considered-in-netlink_bind.patch nvme-pci-hold-cq_poll_lock-while-completing-cqes.patch s390-qeth-fix-off-by-one-in-rx-copybreak-check.patch s390-qeth-vnicc-fix-eopnotsupp-precedence.patch --- diff --git a/queue-5.5/net-atlantic-better-loopback-mode-handling.patch b/queue-5.5/net-atlantic-better-loopback-mode-handling.patch new file mode 100644 index 00000000000..32b6d2d8e4e --- /dev/null +++ b/queue-5.5/net-atlantic-better-loopback-mode-handling.patch @@ -0,0 +1,63 @@ +From b42726fcf76e9367e524392e0ead7e672cc0791c Mon Sep 17 00:00:00 2001 +From: Nikita Danilov +Date: Fri, 14 Feb 2020 18:44:54 +0300 +Subject: net: atlantic: better loopback mode handling + +From: Nikita Danilov + +commit b42726fcf76e9367e524392e0ead7e672cc0791c upstream. + +Add checks to not enable multiple loopback modes simultaneously, +It was also discovered that for dma loopback to function correctly +promisc mode should be enabled on device. + +Fixes: ea4b4d7fc106 ("net: atlantic: loopback tests via private flags") +Signed-off-by: Nikita Danilov +Signed-off-by: Igor Russkikh +Signed-off-by: Dmitry Bogdanov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c | 5 +++++ + drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c | 13 ++++++++----- + 2 files changed, 13 insertions(+), 5 deletions(-) + +--- a/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c +@@ -722,6 +722,11 @@ static int aq_ethtool_set_priv_flags(str + if (flags & ~AQ_PRIV_FLAGS_MASK) + return -EOPNOTSUPP; + ++ if (hweight32((flags | priv_flags) & AQ_HW_LOOPBACK_MASK) > 1) { ++ netdev_info(ndev, "Can't enable more than one loopback simultaneously\n"); ++ return -EINVAL; ++ } ++ + cfg->priv_flags = flags; + + if ((priv_flags ^ flags) & BIT(AQ_HW_LOOPBACK_DMA_NET)) { +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c +@@ -885,13 +885,16 @@ static int hw_atl_b0_hw_packet_filter_se + { + struct aq_nic_cfg_s *cfg = self->aq_nic_cfg; + unsigned int i = 0U; ++ u32 vlan_promisc; ++ u32 l2_promisc; + +- hw_atl_rpfl2promiscuous_mode_en_set(self, +- IS_FILTER_ENABLED(IFF_PROMISC)); ++ l2_promisc = IS_FILTER_ENABLED(IFF_PROMISC) || ++ !!(cfg->priv_flags & BIT(AQ_HW_LOOPBACK_DMA_NET)); ++ vlan_promisc = l2_promisc || cfg->is_vlan_force_promisc; + +- hw_atl_rpf_vlan_prom_mode_en_set(self, +- IS_FILTER_ENABLED(IFF_PROMISC) || +- cfg->is_vlan_force_promisc); ++ hw_atl_rpfl2promiscuous_mode_en_set(self, l2_promisc); ++ ++ hw_atl_rpf_vlan_prom_mode_en_set(self, vlan_promisc); + + hw_atl_rpfl2multicast_flr_en_set(self, + IS_FILTER_ENABLED(IFF_ALLMULTI) && diff --git a/queue-5.5/net-atlantic-checksum-compat-issue.patch b/queue-5.5/net-atlantic-checksum-compat-issue.patch new file mode 100644 index 00000000000..4a6e7749ba6 --- /dev/null +++ b/queue-5.5/net-atlantic-checksum-compat-issue.patch @@ -0,0 +1,92 @@ +From 15beab0a9d797be1b7c67458da007a62269be29a Mon Sep 17 00:00:00 2001 +From: Dmitry Bezrukov +Date: Fri, 14 Feb 2020 18:44:51 +0300 +Subject: net: atlantic: checksum compat issue + +From: Dmitry Bezrukov + +commit 15beab0a9d797be1b7c67458da007a62269be29a upstream. + +Yet another checksum offload compatibility issue was found. + +The known issue is that AQC HW marks tcp packets with 0xFFFF checksum +as invalid (1). This is workarounded in driver, passing all the suspicious +packets up to the stack for further csum validation. + +Another HW problem (2) is that it hides invalid csum of LRO aggregated +packets inside of the individual descriptors. That was workarounded +by forced scan of all LRO descriptors for checksum errors. + +However the scan logic was joint for both LRO and multi-descriptor +packets (jumbos). And this causes the issue. + +We have to drop LRO packets with the detected bad checksum +because of (2), but we have to pass jumbo packets to stack because of (1). + +When using windows tcp partner with jumbo frames but with LSO disabled +driver discards such frames as bad checksummed. But only LRO frames +should be dropped, not jumbos. + +On such a configurations tcp stream have a chance of drops and stucks. + +(1) 76f254d4afe2 ("net: aquantia: tcp checksum 0xffff being handled incorrectly") +(2) d08b9a0a3ebd ("net: aquantia: do not pass lro session with invalid tcp checksum") + +Fixes: d08b9a0a3ebd ("net: aquantia: do not pass lro session with invalid tcp checksum") +Signed-off-by: Dmitry Bezrukov +Signed-off-by: Igor Russkikh +Signed-off-by: Dmitry Bogdanov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 3 ++- + drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 3 ++- + drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c | 5 +++-- + 3 files changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +@@ -351,7 +351,8 @@ int aq_ring_rx_clean(struct aq_ring_s *s + err = 0; + goto err_exit; + } +- if (buff->is_error || buff->is_cso_err) { ++ if (buff->is_error || ++ (buff->is_lro && buff->is_cso_err)) { + buff_ = buff; + do { + next_ = buff_->next, +--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.h ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.h +@@ -78,7 +78,8 @@ struct __packed aq_ring_buff_s { + u32 is_cleaned:1; + u32 is_error:1; + u32 is_vlan:1; +- u32 rsvd3:4; ++ u32 is_lro:1; ++ u32 rsvd3:3; + u16 eop_index; + u16 rsvd4; + }; +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c +@@ -823,6 +823,8 @@ static int hw_atl_b0_hw_ring_rx_receive( + } + } + ++ buff->is_lro = !!(HW_ATL_B0_RXD_WB_STAT2_RSCCNT & ++ rxd_wb->status); + if (HW_ATL_B0_RXD_WB_STAT2_EOP & rxd_wb->status) { + buff->len = rxd_wb->pkt_len % + AQ_CFG_RX_FRAME_MAX; +@@ -835,8 +837,7 @@ static int hw_atl_b0_hw_ring_rx_receive( + rxd_wb->pkt_len > AQ_CFG_RX_FRAME_MAX ? + AQ_CFG_RX_FRAME_MAX : rxd_wb->pkt_len; + +- if (HW_ATL_B0_RXD_WB_STAT2_RSCCNT & +- rxd_wb->status) { ++ if (buff->is_lro) { + /* LRO */ + buff->next = rxd_wb->next_desc_ptr; + ++ring->stats.rx.lro_packets; diff --git a/queue-5.5/net-atlantic-fix-out-of-range-usage-of-active_vlans-array.patch b/queue-5.5/net-atlantic-fix-out-of-range-usage-of-active_vlans-array.patch new file mode 100644 index 00000000000..31eddbcc1f8 --- /dev/null +++ b/queue-5.5/net-atlantic-fix-out-of-range-usage-of-active_vlans-array.patch @@ -0,0 +1,34 @@ +From 5a292c89a84d49b598f8978f154bdda48b1072c0 Mon Sep 17 00:00:00 2001 +From: Dmitry Bogdanov +Date: Fri, 14 Feb 2020 18:44:58 +0300 +Subject: net: atlantic: fix out of range usage of active_vlans array + +From: Dmitry Bogdanov + +commit 5a292c89a84d49b598f8978f154bdda48b1072c0 upstream. + +fix static checker warning: + drivers/net/ethernet/aquantia/atlantic/aq_filters.c:166 aq_check_approve_fvlan() + error: passing untrusted data to 'test_bit()' + +Reported-by: Dan Carpenter +Fixes: 7975d2aff5af: ("net: aquantia: add support of rx-vlan-filter offload") +Signed-off-by: Dmitry Bogdanov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/aquantia/atlantic/aq_filters.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/aquantia/atlantic/aq_filters.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_filters.c +@@ -163,7 +163,7 @@ aq_check_approve_fvlan(struct aq_nic_s * + } + + if ((aq_nic->ndev->features & NETIF_F_HW_VLAN_CTAG_FILTER) && +- (!test_bit(be16_to_cpu(fsp->h_ext.vlan_tci), ++ (!test_bit(be16_to_cpu(fsp->h_ext.vlan_tci) & VLAN_VID_MASK, + aq_nic->active_vlans))) { + netdev_err(aq_nic->ndev, + "ethtool: unknown vlan-id specified"); diff --git a/queue-5.5/net-atlantic-fix-potential-error-handling.patch b/queue-5.5/net-atlantic-fix-potential-error-handling.patch new file mode 100644 index 00000000000..c282359628b --- /dev/null +++ b/queue-5.5/net-atlantic-fix-potential-error-handling.patch @@ -0,0 +1,40 @@ +From 380ec5b9af7f0d57dbf6ac067fd9f33cff2fef71 Mon Sep 17 00:00:00 2001 +From: Pavel Belous +Date: Fri, 14 Feb 2020 18:44:56 +0300 +Subject: net: atlantic: fix potential error handling + +From: Pavel Belous + +commit 380ec5b9af7f0d57dbf6ac067fd9f33cff2fef71 upstream. + +Code inspection found that in case of mapping error we do return current +'ret' value. But beside error, it is used to count number of descriptors +allocated for the packet. In that case map_skb function could return '1'. + +Changing it to return zero (number of mapped descriptors for skb) + +Fixes: 018423e90bee ("net: ethernet: aquantia: Add ring support code") +Signed-off-by: Pavel Belous +Signed-off-by: Igor Russkikh +Signed-off-by: Dmitry Bogdanov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +@@ -533,8 +533,10 @@ unsigned int aq_nic_map_skb(struct aq_ni + dx_buff->len, + DMA_TO_DEVICE); + +- if (unlikely(dma_mapping_error(aq_nic_get_dev(self), dx_buff->pa))) ++ if (unlikely(dma_mapping_error(aq_nic_get_dev(self), dx_buff->pa))) { ++ ret = 0; + goto exit; ++ } + + first = dx_buff; + dx_buff->len_pkt = skb->len; diff --git a/queue-5.5/net-atlantic-fix-use-after-free-kasan-warn.patch b/queue-5.5/net-atlantic-fix-use-after-free-kasan-warn.patch new file mode 100644 index 00000000000..49c5d8e41ee --- /dev/null +++ b/queue-5.5/net-atlantic-fix-use-after-free-kasan-warn.patch @@ -0,0 +1,62 @@ +From a4980919ad6a7be548d499bc5338015e1a9191c6 Mon Sep 17 00:00:00 2001 +From: Pavel Belous +Date: Fri, 14 Feb 2020 18:44:55 +0300 +Subject: net: atlantic: fix use after free kasan warn + +From: Pavel Belous + +commit a4980919ad6a7be548d499bc5338015e1a9191c6 upstream. + +skb->len is used to calculate statistics after xmit invocation. + +Under a stress load it may happen that skb will be xmited, +rx interrupt will come and skb will be freed, all before xmit function +is even returned. + +Eventually, skb->len will access unallocated area. + +Moving stats calculation into tx_clean routine. + +Fixes: 018423e90bee ("net: ethernet: aquantia: Add ring support code") +Reported-by: Christophe Vu-Brugier +Signed-off-by: Igor Russkikh +Signed-off-by: Pavel Belous +Signed-off-by: Dmitry Bogdanov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 4 ---- + drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 7 +++++-- + 2 files changed, 5 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +@@ -655,10 +655,6 @@ int aq_nic_xmit(struct aq_nic_s *self, s + if (likely(frags)) { + err = self->aq_hw_ops->hw_ring_tx_xmit(self->aq_hw, + ring, frags); +- if (err >= 0) { +- ++ring->stats.tx.packets; +- ring->stats.tx.bytes += skb->len; +- } + } else { + err = NETDEV_TX_BUSY; + } +--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +@@ -272,9 +272,12 @@ bool aq_ring_tx_clean(struct aq_ring_s * + } + } + +- if (unlikely(buff->is_eop)) +- dev_kfree_skb_any(buff->skb); ++ if (unlikely(buff->is_eop)) { ++ ++self->stats.rx.packets; ++ self->stats.tx.bytes += buff->skb->len; + ++ dev_kfree_skb_any(buff->skb); ++ } + buff->pa = 0U; + buff->eop_index = 0xffffU; + self->sw_head = aq_ring_next_dx(self, self->sw_head); diff --git a/queue-5.5/net-atlantic-possible-fault-in-transition-to-hibernation.patch b/queue-5.5/net-atlantic-possible-fault-in-transition-to-hibernation.patch new file mode 100644 index 00000000000..86563933168 --- /dev/null +++ b/queue-5.5/net-atlantic-possible-fault-in-transition-to-hibernation.patch @@ -0,0 +1,70 @@ +From 52a22f4d6ff95e8bdca557765c04893eb5dd83fd Mon Sep 17 00:00:00 2001 +From: Pavel Belous +Date: Fri, 14 Feb 2020 18:44:57 +0300 +Subject: net: atlantic: possible fault in transition to hibernation + +From: Pavel Belous + +commit 52a22f4d6ff95e8bdca557765c04893eb5dd83fd upstream. + +during hibernation freeze, aq_nic_stop could be invoked +on a stopped device. That may cause panic on access to +not yet allocated vector/ring structures. + +Add a check to stop device if it is not yet stopped. + +Similiarly after freeze in hibernation thaw, aq_nic_start +could be invoked on a not initialized net device. +Result will be the same. + +Add a check to start device if it is initialized. +In our case, this is the same as started. + +Fixes: 8aaa112a57c1 ("net: atlantic: refactoring pm logic") +Signed-off-by: Pavel Belous +Signed-off-by: Nikita Danilov +Signed-off-by: Igor Russkikh +Signed-off-by: Dmitry Bogdanov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c +@@ -359,7 +359,8 @@ static int aq_suspend_common(struct devi + netif_device_detach(nic->ndev); + netif_tx_stop_all_queues(nic->ndev); + +- aq_nic_stop(nic); ++ if (netif_running(nic->ndev)) ++ aq_nic_stop(nic); + + if (deep) { + aq_nic_deinit(nic, !nic->aq_hw->aq_nic_cfg->wol); +@@ -375,7 +376,7 @@ static int atl_resume_common(struct devi + { + struct pci_dev *pdev = to_pci_dev(dev); + struct aq_nic_s *nic; +- int ret; ++ int ret = 0; + + nic = pci_get_drvdata(pdev); + +@@ -390,9 +391,11 @@ static int atl_resume_common(struct devi + goto err_exit; + } + +- ret = aq_nic_start(nic); +- if (ret) +- goto err_exit; ++ if (netif_running(nic->ndev)) { ++ ret = aq_nic_start(nic); ++ if (ret) ++ goto err_exit; ++ } + + netif_device_attach(nic->ndev); + netif_tx_start_all_queues(nic->ndev); diff --git a/queue-5.5/net-netlink-cap-max-groups-which-will-be-considered-in-netlink_bind.patch b/queue-5.5/net-netlink-cap-max-groups-which-will-be-considered-in-netlink_bind.patch new file mode 100644 index 00000000000..a56ae4c03d9 --- /dev/null +++ b/queue-5.5/net-netlink-cap-max-groups-which-will-be-considered-in-netlink_bind.patch @@ -0,0 +1,53 @@ +From 3a20773beeeeadec41477a5ba872175b778ff752 Mon Sep 17 00:00:00 2001 +From: Nikolay Aleksandrov +Date: Thu, 20 Feb 2020 16:42:13 +0200 +Subject: net: netlink: cap max groups which will be considered in netlink_bind() + +From: Nikolay Aleksandrov + +commit 3a20773beeeeadec41477a5ba872175b778ff752 upstream. + +Since nl_groups is a u32 we can't bind more groups via ->bind +(netlink_bind) call, but netlink has supported more groups via +setsockopt() for a long time and thus nlk->ngroups could be over 32. +Recently I added support for per-vlan notifications and increased the +groups to 33 for NETLINK_ROUTE which exposed an old bug in the +netlink_bind() code causing out-of-bounds access on archs where unsigned +long is 32 bits via test_bit() on a local variable. Fix this by capping the +maximum groups in netlink_bind() to BITS_PER_TYPE(u32), effectively +capping them at 32 which is the minimum of allocated groups and the +maximum groups which can be bound via netlink_bind(). + +CC: Christophe Leroy +CC: Richard Guy Briggs +Fixes: 4f520900522f ("netlink: have netlink per-protocol bind function return an error code.") +Reported-by: Erhard F. +Signed-off-by: Nikolay Aleksandrov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/netlink/af_netlink.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -1014,7 +1014,8 @@ static int netlink_bind(struct socket *s + if (nlk->netlink_bind && groups) { + int group; + +- for (group = 0; group < nlk->ngroups; group++) { ++ /* nl_groups is a u32, so cap the maximum groups we can bind */ ++ for (group = 0; group < BITS_PER_TYPE(u32); group++) { + if (!test_bit(group, &groups)) + continue; + err = nlk->netlink_bind(net, group + 1); +@@ -1033,7 +1034,7 @@ static int netlink_bind(struct socket *s + netlink_insert(sk, nladdr->nl_pid) : + netlink_autobind(sock); + if (err) { +- netlink_undo_bind(nlk->ngroups, groups, sk); ++ netlink_undo_bind(BITS_PER_TYPE(u32), groups, sk); + goto unlock; + } + } diff --git a/queue-5.5/net-phy-restore-mdio-regs-in-the-iproc-mdio-driver.patch b/queue-5.5/net-phy-restore-mdio-regs-in-the-iproc-mdio-driver.patch index f3af696590e..5348029f9ff 100644 --- a/queue-5.5/net-phy-restore-mdio-regs-in-the-iproc-mdio-driver.patch +++ b/queue-5.5/net-phy-restore-mdio-regs-in-the-iproc-mdio-driver.patch @@ -5,6 +5,8 @@ Subject: net: phy: restore mdio regs in the iproc mdio driver From: Arun Parameswaran +commit 6f08e98d62799e53c89dbf2c9a49d77e20ca648c upstream. + The mii management register in iproc mdio block does not have a retention register so it is lost on suspend. Save and restore value of register while resuming from suspend. diff --git a/queue-5.5/nvme-pci-hold-cq_poll_lock-while-completing-cqes.patch b/queue-5.5/nvme-pci-hold-cq_poll_lock-while-completing-cqes.patch new file mode 100644 index 00000000000..cfe3fb5ad37 --- /dev/null +++ b/queue-5.5/nvme-pci-hold-cq_poll_lock-while-completing-cqes.patch @@ -0,0 +1,38 @@ +From 9515743bfb39c61aaf3d4f3219a645c8d1fe9a0e Mon Sep 17 00:00:00 2001 +From: Bijan Mottahedeh +Date: Wed, 26 Feb 2020 18:53:43 -0800 +Subject: nvme-pci: Hold cq_poll_lock while completing CQEs + +From: Bijan Mottahedeh + +commit 9515743bfb39c61aaf3d4f3219a645c8d1fe9a0e upstream. + +Completions need to consumed in the same order the controller submitted +them, otherwise future completion entries may overwrite ones we haven't +handled yet. Hold the nvme queue's poll lock while completing new CQEs to +prevent another thread from freeing command tags for reuse out-of-order. + +Fixes: dabcefab45d3 ("nvme: provide optimized poll function for separate poll queues") +Signed-off-by: Bijan Mottahedeh +Reviewed-by: Sagi Grimberg +Reviewed-by: Jens Axboe +Signed-off-by: Keith Busch +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/nvme/host/pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -1078,9 +1078,9 @@ static int nvme_poll(struct blk_mq_hw_ct + + spin_lock(&nvmeq->cq_poll_lock); + found = nvme_process_cq(nvmeq, &start, &end, -1); ++ nvme_complete_cqes(nvmeq, start, end); + spin_unlock(&nvmeq->cq_poll_lock); + +- nvme_complete_cqes(nvmeq, start, end); + return found; + } + diff --git a/queue-5.5/s390-qeth-fix-off-by-one-in-rx-copybreak-check.patch b/queue-5.5/s390-qeth-fix-off-by-one-in-rx-copybreak-check.patch new file mode 100644 index 00000000000..cbcec54dfa4 --- /dev/null +++ b/queue-5.5/s390-qeth-fix-off-by-one-in-rx-copybreak-check.patch @@ -0,0 +1,32 @@ +From 54a61fbc020fd2e305680871c453abcf7fc0339b Mon Sep 17 00:00:00 2001 +From: Julian Wiedmann +Date: Thu, 20 Feb 2020 15:54:56 +0100 +Subject: s390/qeth: fix off-by-one in RX copybreak check + +From: Julian Wiedmann + +commit 54a61fbc020fd2e305680871c453abcf7fc0339b upstream. + +The RX copybreak is intended as the _max_ value where the frame's data +should be copied. So for frame_len == copybreak, don't build an SG skb. + +Fixes: 4a71df50047f ("qeth: new qeth device driver") +Signed-off-by: Julian Wiedmann +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/s390/net/qeth_core_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -5142,7 +5142,7 @@ next_packet: + } + + use_rx_sg = (card->options.cq == QETH_CQ_ENABLED) || +- ((skb_len >= card->options.rx_sg_cb) && ++ (skb_len > card->options.rx_sg_cb && + !atomic_read(&card->force_alloc_skb) && + !IS_OSN(card)); + diff --git a/queue-5.5/s390-qeth-vnicc-fix-eopnotsupp-precedence.patch b/queue-5.5/s390-qeth-vnicc-fix-eopnotsupp-precedence.patch new file mode 100644 index 00000000000..1f176e2e26b --- /dev/null +++ b/queue-5.5/s390-qeth-vnicc-fix-eopnotsupp-precedence.patch @@ -0,0 +1,106 @@ +From 6f3846f0955308b6d1b219419da42b8de2c08845 Mon Sep 17 00:00:00 2001 +From: Alexandra Winter +Date: Thu, 20 Feb 2020 15:54:54 +0100 +Subject: s390/qeth: vnicc Fix EOPNOTSUPP precedence + +From: Alexandra Winter + +commit 6f3846f0955308b6d1b219419da42b8de2c08845 upstream. + +When getting or setting VNICC parameters, the error code EOPNOTSUPP +should have precedence over EBUSY. + +EBUSY is used because vnicc feature and bridgeport feature are mutually +exclusive, which is a temporary condition. +Whereas EOPNOTSUPP indicates that the HW does not support all or parts of +the vnicc feature. +This issue causes the vnicc sysfs params to show 'blocked by bridgeport' +for HW that does not support VNICC at all. + +Fixes: caa1f0b10d18 ("s390/qeth: add VNICC enable/disable support") +Signed-off-by: Alexandra Winter +Signed-off-by: Julian Wiedmann +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/s390/net/qeth_l2_main.c | 29 +++++++++++++---------------- + 1 file changed, 13 insertions(+), 16 deletions(-) + +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -1815,15 +1815,14 @@ int qeth_l2_vnicc_set_state(struct qeth_ + + QETH_CARD_TEXT(card, 2, "vniccsch"); + +- /* do not change anything if BridgePort is enabled */ +- if (qeth_bridgeport_is_in_use(card)) +- return -EBUSY; +- + /* check if characteristic and enable/disable are supported */ + if (!(card->options.vnicc.sup_chars & vnicc) || + !(card->options.vnicc.set_char_sup & vnicc)) + return -EOPNOTSUPP; + ++ if (qeth_bridgeport_is_in_use(card)) ++ return -EBUSY; ++ + /* set enable/disable command and store wanted characteristic */ + if (state) { + cmd = IPA_VNICC_ENABLE; +@@ -1869,14 +1868,13 @@ int qeth_l2_vnicc_get_state(struct qeth_ + + QETH_CARD_TEXT(card, 2, "vniccgch"); + +- /* do not get anything if BridgePort is enabled */ +- if (qeth_bridgeport_is_in_use(card)) +- return -EBUSY; +- + /* check if characteristic is supported */ + if (!(card->options.vnicc.sup_chars & vnicc)) + return -EOPNOTSUPP; + ++ if (qeth_bridgeport_is_in_use(card)) ++ return -EBUSY; ++ + /* if card is ready, query current VNICC state */ + if (qeth_card_hw_is_reachable(card)) + rc = qeth_l2_vnicc_query_chars(card); +@@ -1894,15 +1892,14 @@ int qeth_l2_vnicc_set_timeout(struct qet + + QETH_CARD_TEXT(card, 2, "vniccsto"); + +- /* do not change anything if BridgePort is enabled */ +- if (qeth_bridgeport_is_in_use(card)) +- return -EBUSY; +- + /* check if characteristic and set_timeout are supported */ + if (!(card->options.vnicc.sup_chars & QETH_VNICC_LEARNING) || + !(card->options.vnicc.getset_timeout_sup & QETH_VNICC_LEARNING)) + return -EOPNOTSUPP; + ++ if (qeth_bridgeport_is_in_use(card)) ++ return -EBUSY; ++ + /* do we need to do anything? */ + if (card->options.vnicc.learning_timeout == timeout) + return rc; +@@ -1931,14 +1928,14 @@ int qeth_l2_vnicc_get_timeout(struct qet + + QETH_CARD_TEXT(card, 2, "vniccgto"); + +- /* do not get anything if BridgePort is enabled */ +- if (qeth_bridgeport_is_in_use(card)) +- return -EBUSY; +- + /* check if characteristic and get_timeout are supported */ + if (!(card->options.vnicc.sup_chars & QETH_VNICC_LEARNING) || + !(card->options.vnicc.getset_timeout_sup & QETH_VNICC_LEARNING)) + return -EOPNOTSUPP; ++ ++ if (qeth_bridgeport_is_in_use(card)) ++ return -EBUSY; ++ + /* if card is ready, get timeout. Otherwise, just return stored value */ + *timeout = card->options.vnicc.learning_timeout; + if (qeth_card_hw_is_reachable(card)) diff --git a/queue-5.5/series b/queue-5.5/series index 0bfd9727141..58c8e9e6bb2 100644 --- a/queue-5.5/series +++ b/queue-5.5/series @@ -120,3 +120,13 @@ mac80211-remove-a-redundant-mutex-unlock.patch kbuild-fix-dt-binding-schema-rule-to-detect-command-line-changes.patch hv_netvsc-fix-unwanted-wakeup-in-netvsc_attach.patch usb-charger-assign-specific-number-for-enum-value.patch +nvme-pci-hold-cq_poll_lock-while-completing-cqes.patch +s390-qeth-vnicc-fix-eopnotsupp-precedence.patch +s390-qeth-fix-off-by-one-in-rx-copybreak-check.patch +net-netlink-cap-max-groups-which-will-be-considered-in-netlink_bind.patch +net-atlantic-checksum-compat-issue.patch +net-atlantic-better-loopback-mode-handling.patch +net-atlantic-fix-use-after-free-kasan-warn.patch +net-atlantic-fix-potential-error-handling.patch +net-atlantic-possible-fault-in-transition-to-hibernation.patch +net-atlantic-fix-out-of-range-usage-of-active_vlans-array.patch