From: Greg Kroah-Hartman Date: Fri, 8 Mar 2019 06:39:07 +0000 (+0100) Subject: 5.0-stable patches X-Git-Tag: v5.0.1~26 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a33c909e7b5e203563d430fddb3f00c82a9deae4;p=thirdparty%2Fkernel%2Fstable-queue.git 5.0-stable patches added patches: ip6mr-do-not-call-__ip6_inc_stats-from-preemptible-context.patch net-dsa-mv88e6xxx-add-call-to-mv88e6xxx_ports_cmode_init-to-probe-for-new-dsa-framework.patch net-dsa-mv88e6xxx-handle-unknown-duplex-modes-gracefully-in-mv88e6xxx_port_set_duplex.patch net-dsa-mv8e6xxx-fix-number-of-internal-phys-for-88e6x90-family.patch net-mscc-enable-all-ports-in-qsgmii.patch net-sched-put-back-q.qlen-into-a-single-location.patch net-sysfs-fix-mem-leak-in-netdev_register_kobject.patch qmi_wwan-add-support-for-quectel-eg12-em12.patch sctp-call-iov_iter_revert-after-sending-abort.patch sky2-disable-msi-on-dell-inspiron-1545-and-gateway-p-79.patch team-free-bpf-filter-when-unregistering-netdev.patch tipc-fix-rdm-dgram-connect-regression.patch --- diff --git a/queue-5.0/ip6mr-do-not-call-__ip6_inc_stats-from-preemptible-context.patch b/queue-5.0/ip6mr-do-not-call-__ip6_inc_stats-from-preemptible-context.patch new file mode 100644 index 00000000000..29e5e71f4a1 --- /dev/null +++ b/queue-5.0/ip6mr-do-not-call-__ip6_inc_stats-from-preemptible-context.patch @@ -0,0 +1,67 @@ +From foo@baz Fri Mar 8 07:37:28 CET 2019 +From: Ido Schimmel +Date: Sun, 3 Mar 2019 07:34:57 +0000 +Subject: ip6mr: Do not call __IP6_INC_STATS() from preemptible context + +From: Ido Schimmel + +[ Upstream commit 87c11f1ddbbad38ad8bad47af133a8208985fbdf ] + +Similar to commit 44f49dd8b5a6 ("ipmr: fix possible race resulting from +improper usage of IP_INC_STATS_BH() in preemptible context."), we cannot +assume preemption is disabled when incrementing the counter and +accessing a per-CPU variable. + +Preemption can be enabled when we add a route in process context that +corresponds to packets stored in the unresolved queue, which are then +forwarded using this route [1]. + +Fix this by using IP6_INC_STATS() which takes care of disabling +preemption on architectures where it is needed. + +[1] +[ 157.451447] BUG: using __this_cpu_add() in preemptible [00000000] code: smcrouted/2314 +[ 157.460409] caller is ip6mr_forward2+0x73e/0x10e0 +[ 157.460434] CPU: 3 PID: 2314 Comm: smcrouted Not tainted 5.0.0-rc7-custom-03635-g22f2712113f1 #1336 +[ 157.460449] Hardware name: Mellanox Technologies Ltd. MSN2100-CB2FO/SA001017, BIOS 5.6.5 06/07/2016 +[ 157.460461] Call Trace: +[ 157.460486] dump_stack+0xf9/0x1be +[ 157.460553] check_preemption_disabled+0x1d6/0x200 +[ 157.460576] ip6mr_forward2+0x73e/0x10e0 +[ 157.460705] ip6_mr_forward+0x9a0/0x1510 +[ 157.460771] ip6mr_mfc_add+0x16b3/0x1e00 +[ 157.461155] ip6_mroute_setsockopt+0x3cb/0x13c0 +[ 157.461384] do_ipv6_setsockopt.isra.8+0x348/0x4060 +[ 157.462013] ipv6_setsockopt+0x90/0x110 +[ 157.462036] rawv6_setsockopt+0x4a/0x120 +[ 157.462058] __sys_setsockopt+0x16b/0x340 +[ 157.462198] __x64_sys_setsockopt+0xbf/0x160 +[ 157.462220] do_syscall_64+0x14d/0x610 +[ 157.462349] entry_SYSCALL_64_after_hwframe+0x49/0xbe + +Fixes: 0912ea38de61 ("[IPV6] MROUTE: Add stats in multicast routing module method ip6_mr_forward().") +Signed-off-by: Ido Schimmel +Reported-by: Amit Cohen +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ip6mr.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/net/ipv6/ip6mr.c ++++ b/net/ipv6/ip6mr.c +@@ -1964,10 +1964,10 @@ int ip6mr_compat_ioctl(struct sock *sk, + + static inline int ip6mr_forward2_finish(struct net *net, struct sock *sk, struct sk_buff *skb) + { +- __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), +- IPSTATS_MIB_OUTFORWDATAGRAMS); +- __IP6_ADD_STATS(net, ip6_dst_idev(skb_dst(skb)), +- IPSTATS_MIB_OUTOCTETS, skb->len); ++ IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), ++ IPSTATS_MIB_OUTFORWDATAGRAMS); ++ IP6_ADD_STATS(net, ip6_dst_idev(skb_dst(skb)), ++ IPSTATS_MIB_OUTOCTETS, skb->len); + return dst_output(net, sk, skb); + } + diff --git a/queue-5.0/net-dsa-mv88e6xxx-add-call-to-mv88e6xxx_ports_cmode_init-to-probe-for-new-dsa-framework.patch b/queue-5.0/net-dsa-mv88e6xxx-add-call-to-mv88e6xxx_ports_cmode_init-to-probe-for-new-dsa-framework.patch new file mode 100644 index 00000000000..e4e823661d5 --- /dev/null +++ b/queue-5.0/net-dsa-mv88e6xxx-add-call-to-mv88e6xxx_ports_cmode_init-to-probe-for-new-dsa-framework.patch @@ -0,0 +1,33 @@ +From foo@baz Fri Mar 8 07:37:28 CET 2019 +From: Heiner Kallweit +Date: Mon, 4 Mar 2019 19:39:03 +0100 +Subject: net: dsa: mv88e6xxx: add call to mv88e6xxx_ports_cmode_init to probe for new DSA framework + +From: Heiner Kallweit + +[ Upstream commit 3acca1dd17060332cfab15693733cdaf9fba1c90 ] + +In the original patch I missed to add mv88e6xxx_ports_cmode_init() +to the second probe function, the one for the new DSA framework. + +Fixes: ed8fe20205ac ("net: dsa: mv88e6xxx: prevent interrupt storm caused by mv88e6390x_port_set_cmode") +Reported-by: Shaokun Zhang +Suggested-by: Andrew Lunn +Signed-off-by: Heiner Kallweit +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/mv88e6xxx/chip.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -4847,6 +4847,7 @@ static int mv88e6xxx_probe(struct mdio_d + if (err) + goto out; + ++ mv88e6xxx_ports_cmode_init(chip); + mv88e6xxx_phy_init(chip); + + if (chip->info->ops->get_eeprom) { diff --git a/queue-5.0/net-dsa-mv88e6xxx-handle-unknown-duplex-modes-gracefully-in-mv88e6xxx_port_set_duplex.patch b/queue-5.0/net-dsa-mv88e6xxx-handle-unknown-duplex-modes-gracefully-in-mv88e6xxx_port_set_duplex.patch new file mode 100644 index 00000000000..d6b52bae3f7 --- /dev/null +++ b/queue-5.0/net-dsa-mv88e6xxx-handle-unknown-duplex-modes-gracefully-in-mv88e6xxx_port_set_duplex.patch @@ -0,0 +1,35 @@ +From foo@baz Fri Mar 8 07:37:28 CET 2019 +From: Heiner Kallweit +Date: Fri, 1 Mar 2019 19:53:57 +0100 +Subject: net: dsa: mv88e6xxx: handle unknown duplex modes gracefully in mv88e6xxx_port_set_duplex + +From: Heiner Kallweit + +[ Upstream commit c6195a8bdfc62a7cecf7df685e64847a4b700275 ] + +When testing another issue I faced the problem that +mv88e6xxx_port_setup_mac() failed due to DUPLEX_UNKNOWN being passed +as argument to mv88e6xxx_port_set_duplex(). We should handle this case +gracefully and return -EOPNOTSUPP, like e.g. mv88e6xxx_port_set_speed() +is doing it. + +Fixes: 7f1ae07b51e8 ("net: dsa: mv88e6xxx: add port duplex setter") +Signed-off-by: Heiner Kallweit +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/mv88e6xxx/port.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/dsa/mv88e6xxx/port.c ++++ b/drivers/net/dsa/mv88e6xxx/port.c +@@ -190,7 +190,7 @@ int mv88e6xxx_port_set_duplex(struct mv8 + /* normal duplex detection */ + break; + default: +- return -EINVAL; ++ return -EOPNOTSUPP; + } + + err = mv88e6xxx_port_write(chip, port, MV88E6XXX_PORT_MAC_CTL, reg); diff --git a/queue-5.0/net-dsa-mv8e6xxx-fix-number-of-internal-phys-for-88e6x90-family.patch b/queue-5.0/net-dsa-mv8e6xxx-fix-number-of-internal-phys-for-88e6x90-family.patch new file mode 100644 index 00000000000..e9378fc303f --- /dev/null +++ b/queue-5.0/net-dsa-mv8e6xxx-fix-number-of-internal-phys-for-88e6x90-family.patch @@ -0,0 +1,80 @@ +From foo@baz Fri Mar 8 07:37:28 CET 2019 +From: Heiner Kallweit +Date: Sat, 2 Mar 2019 10:06:05 +0100 +Subject: net: dsa: mv8e6xxx: fix number of internal PHYs for 88E6x90 family + +From: Heiner Kallweit + +[ Upstream commit 95150f29ae480276e76368cdf8a9524b5a96c0ca ] + +Ports 9 and 10 don't have internal PHY's but are (dependent on the +version) SERDES/SGMII/XAUI/RXAUI ports. + +v2: +- fix it for all 88E6x90 family members + +Fixes: bc3931557d1d ("net: dsa: mv88e6xxx: Add number of internal PHYs") +Signed-off-by: Heiner Kallweit +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/mv88e6xxx/chip.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -4222,7 +4222,7 @@ static const struct mv88e6xxx_info mv88e + .name = "Marvell 88E6190", + .num_databases = 4096, + .num_ports = 11, /* 10 + Z80 */ +- .num_internal_phys = 11, ++ .num_internal_phys = 9, + .num_gpio = 16, + .max_vid = 8191, + .port_base_addr = 0x0, +@@ -4245,7 +4245,7 @@ static const struct mv88e6xxx_info mv88e + .name = "Marvell 88E6190X", + .num_databases = 4096, + .num_ports = 11, /* 10 + Z80 */ +- .num_internal_phys = 11, ++ .num_internal_phys = 9, + .num_gpio = 16, + .max_vid = 8191, + .port_base_addr = 0x0, +@@ -4268,7 +4268,7 @@ static const struct mv88e6xxx_info mv88e + .name = "Marvell 88E6191", + .num_databases = 4096, + .num_ports = 11, /* 10 + Z80 */ +- .num_internal_phys = 11, ++ .num_internal_phys = 9, + .max_vid = 8191, + .port_base_addr = 0x0, + .phy_base_addr = 0x0, +@@ -4315,7 +4315,7 @@ static const struct mv88e6xxx_info mv88e + .name = "Marvell 88E6290", + .num_databases = 4096, + .num_ports = 11, /* 10 + Z80 */ +- .num_internal_phys = 11, ++ .num_internal_phys = 9, + .num_gpio = 16, + .max_vid = 8191, + .port_base_addr = 0x0, +@@ -4477,7 +4477,7 @@ static const struct mv88e6xxx_info mv88e + .name = "Marvell 88E6390", + .num_databases = 4096, + .num_ports = 11, /* 10 + Z80 */ +- .num_internal_phys = 11, ++ .num_internal_phys = 9, + .num_gpio = 16, + .max_vid = 8191, + .port_base_addr = 0x0, +@@ -4500,7 +4500,7 @@ static const struct mv88e6xxx_info mv88e + .name = "Marvell 88E6390X", + .num_databases = 4096, + .num_ports = 11, /* 10 + Z80 */ +- .num_internal_phys = 11, ++ .num_internal_phys = 9, + .num_gpio = 16, + .max_vid = 8191, + .port_base_addr = 0x0, diff --git a/queue-5.0/net-mscc-enable-all-ports-in-qsgmii.patch b/queue-5.0/net-mscc-enable-all-ports-in-qsgmii.patch new file mode 100644 index 00000000000..2c0c849bfb4 --- /dev/null +++ b/queue-5.0/net-mscc-enable-all-ports-in-qsgmii.patch @@ -0,0 +1,62 @@ +From foo@baz Fri Mar 8 07:37:28 CET 2019 +From: Kavya Sree Kotagiri +Date: Thu, 28 Feb 2019 07:32:22 +0000 +Subject: net: mscc: Enable all ports in QSGMII + +From: Kavya Sree Kotagiri + +[ Upstream commit 084e5bb16bd7dc2b551bbd9fb358bf73e03ee8d8 ] + +When Ocelot phy-mode is QSGMII, all 4 ports involved in +QSGMII shall be kept out of reset and +Tx lanes shall be enabled to pass the data. + +Fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support") +Signed-off-by: Kavya Sree Kotagiri +Signed-off-by: Steen Hegelund +Co-developed-by: Steen Hegelund +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mscc/ocelot_board.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/mscc/ocelot_board.c ++++ b/drivers/net/ethernet/mscc/ocelot_board.c +@@ -267,6 +267,7 @@ static int mscc_ocelot_probe(struct plat + struct phy *serdes; + void __iomem *regs; + char res_name[8]; ++ int phy_mode; + u32 port; + + if (of_property_read_u32(portnp, "reg", &port)) +@@ -292,11 +293,11 @@ static int mscc_ocelot_probe(struct plat + if (err) + return err; + +- err = of_get_phy_mode(portnp); +- if (err < 0) ++ phy_mode = of_get_phy_mode(portnp); ++ if (phy_mode < 0) + ocelot->ports[port]->phy_mode = PHY_INTERFACE_MODE_NA; + else +- ocelot->ports[port]->phy_mode = err; ++ ocelot->ports[port]->phy_mode = phy_mode; + + switch (ocelot->ports[port]->phy_mode) { + case PHY_INTERFACE_MODE_NA: +@@ -304,6 +305,13 @@ static int mscc_ocelot_probe(struct plat + case PHY_INTERFACE_MODE_SGMII: + break; + case PHY_INTERFACE_MODE_QSGMII: ++ /* Ensure clock signals and speed is set on all ++ * QSGMII links ++ */ ++ ocelot_port_writel(ocelot->ports[port], ++ DEV_CLOCK_CFG_LINK_SPEED ++ (OCELOT_SPEED_1000), ++ DEV_CLOCK_CFG); + break; + default: + dev_err(ocelot->dev, diff --git a/queue-5.0/net-sched-put-back-q.qlen-into-a-single-location.patch b/queue-5.0/net-sched-put-back-q.qlen-into-a-single-location.patch new file mode 100644 index 00000000000..1ebb988e4a8 --- /dev/null +++ b/queue-5.0/net-sched-put-back-q.qlen-into-a-single-location.patch @@ -0,0 +1,219 @@ +From foo@baz Fri Mar 8 07:37:28 CET 2019 +From: Eric Dumazet +Date: Thu, 28 Feb 2019 12:55:43 -0800 +Subject: net: sched: put back q.qlen into a single location + +From: Eric Dumazet + +[ Upstream commit 46b1c18f9deb326a7e18348e668e4c7ab7c7458b ] + +In the series fc8b81a5981f ("Merge branch 'lockless-qdisc-series'") +John made the assumption that the data path had no need to read +the qdisc qlen (number of packets in the qdisc). + +It is true when pfifo_fast is used as the root qdisc, or as direct MQ/MQPRIO +children. + +But pfifo_fast can be used as leaf in class full qdiscs, and existing +logic needs to access the child qlen in an efficient way. + +HTB breaks badly, since it uses cl->leaf.q->q.qlen in : + htb_activate() -> WARN_ON() + htb_dequeue_tree() to decide if a class can be htb_deactivated + when it has no more packets. + +HFSC, DRR, CBQ, QFQ have similar issues, and some calls to +qdisc_tree_reduce_backlog() also read q.qlen directly. + +Using qdisc_qlen_sum() (which iterates over all possible cpus) +in the data path is a non starter. + +It seems we have to put back qlen in a central location, +at least for stable kernels. + +For all qdisc but pfifo_fast, qlen is guarded by the qdisc lock, +so the existing q.qlen{++|--} are correct. + +For 'lockless' qdisc (pfifo_fast so far), we need to use atomic_{inc|dec}() +because the spinlock might be not held (for example from +pfifo_fast_enqueue() and pfifo_fast_dequeue()) + +This patch adds atomic_qlen (in the same location than qlen) +and renames the following helpers, since we want to express +they can be used without qdisc lock, and that qlen is no longer percpu. + +- qdisc_qstats_cpu_qlen_dec -> qdisc_qstats_atomic_qlen_dec() +- qdisc_qstats_cpu_qlen_inc -> qdisc_qstats_atomic_qlen_inc() + +Later (net-next) we might revert this patch by tracking all these +qlen uses and replace them by a more efficient method (not having +to access a precise qlen, but an empty/non_empty status that might +be less expensive to maintain/track). + +Another possibility is to have a legacy pfifo_fast version that would +be used when used a a child qdisc, since the parent qdisc needs +a spinlock anyway. But then, future lockless qdiscs would also +have the same problem. + +Fixes: 7e66016f2c65 ("net: sched: helpers to sum qlen and qlen for per cpu logic") +Signed-off-by: Eric Dumazet +Cc: John Fastabend +Cc: Jamal Hadi Salim +Cc: Cong Wang +Cc: Jiri Pirko +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/net/sch_generic.h | 31 +++++++++++++------------------ + net/core/gen_stats.c | 2 -- + net/sched/sch_generic.c | 13 ++++++------- + 3 files changed, 19 insertions(+), 27 deletions(-) + +--- a/include/net/sch_generic.h ++++ b/include/net/sch_generic.h +@@ -51,7 +51,10 @@ struct qdisc_size_table { + struct qdisc_skb_head { + struct sk_buff *head; + struct sk_buff *tail; +- __u32 qlen; ++ union { ++ u32 qlen; ++ atomic_t atomic_qlen; ++ }; + spinlock_t lock; + }; + +@@ -408,27 +411,19 @@ static inline void qdisc_cb_private_vali + BUILD_BUG_ON(sizeof(qcb->data) < sz); + } + +-static inline int qdisc_qlen_cpu(const struct Qdisc *q) +-{ +- return this_cpu_ptr(q->cpu_qstats)->qlen; +-} +- + static inline int qdisc_qlen(const struct Qdisc *q) + { + return q->q.qlen; + } + +-static inline int qdisc_qlen_sum(const struct Qdisc *q) ++static inline u32 qdisc_qlen_sum(const struct Qdisc *q) + { +- __u32 qlen = q->qstats.qlen; +- int i; ++ u32 qlen = q->qstats.qlen; + +- if (q->flags & TCQ_F_NOLOCK) { +- for_each_possible_cpu(i) +- qlen += per_cpu_ptr(q->cpu_qstats, i)->qlen; +- } else { ++ if (q->flags & TCQ_F_NOLOCK) ++ qlen += atomic_read(&q->q.atomic_qlen); ++ else + qlen += q->q.qlen; +- } + + return qlen; + } +@@ -825,14 +820,14 @@ static inline void qdisc_qstats_cpu_back + this_cpu_add(sch->cpu_qstats->backlog, qdisc_pkt_len(skb)); + } + +-static inline void qdisc_qstats_cpu_qlen_inc(struct Qdisc *sch) ++static inline void qdisc_qstats_atomic_qlen_inc(struct Qdisc *sch) + { +- this_cpu_inc(sch->cpu_qstats->qlen); ++ atomic_inc(&sch->q.atomic_qlen); + } + +-static inline void qdisc_qstats_cpu_qlen_dec(struct Qdisc *sch) ++static inline void qdisc_qstats_atomic_qlen_dec(struct Qdisc *sch) + { +- this_cpu_dec(sch->cpu_qstats->qlen); ++ atomic_dec(&sch->q.atomic_qlen); + } + + static inline void qdisc_qstats_cpu_requeues_inc(struct Qdisc *sch) +--- a/net/core/gen_stats.c ++++ b/net/core/gen_stats.c +@@ -291,7 +291,6 @@ __gnet_stats_copy_queue_cpu(struct gnet_ + for_each_possible_cpu(i) { + const struct gnet_stats_queue *qcpu = per_cpu_ptr(q, i); + +- qstats->qlen = 0; + qstats->backlog += qcpu->backlog; + qstats->drops += qcpu->drops; + qstats->requeues += qcpu->requeues; +@@ -307,7 +306,6 @@ void __gnet_stats_copy_queue(struct gnet + if (cpu) { + __gnet_stats_copy_queue_cpu(qstats, cpu); + } else { +- qstats->qlen = q->qlen; + qstats->backlog = q->backlog; + qstats->drops = q->drops; + qstats->requeues = q->requeues; +--- a/net/sched/sch_generic.c ++++ b/net/sched/sch_generic.c +@@ -68,7 +68,7 @@ static inline struct sk_buff *__skb_dequ + skb = __skb_dequeue(&q->skb_bad_txq); + if (qdisc_is_percpu_stats(q)) { + qdisc_qstats_cpu_backlog_dec(q, skb); +- qdisc_qstats_cpu_qlen_dec(q); ++ qdisc_qstats_atomic_qlen_dec(q); + } else { + qdisc_qstats_backlog_dec(q, skb); + q->q.qlen--; +@@ -108,7 +108,7 @@ static inline void qdisc_enqueue_skb_bad + + if (qdisc_is_percpu_stats(q)) { + qdisc_qstats_cpu_backlog_inc(q, skb); +- qdisc_qstats_cpu_qlen_inc(q); ++ qdisc_qstats_atomic_qlen_inc(q); + } else { + qdisc_qstats_backlog_inc(q, skb); + q->q.qlen++; +@@ -147,7 +147,7 @@ static inline int dev_requeue_skb_locked + + qdisc_qstats_cpu_requeues_inc(q); + qdisc_qstats_cpu_backlog_inc(q, skb); +- qdisc_qstats_cpu_qlen_inc(q); ++ qdisc_qstats_atomic_qlen_inc(q); + + skb = next; + } +@@ -252,7 +252,7 @@ static struct sk_buff *dequeue_skb(struc + skb = __skb_dequeue(&q->gso_skb); + if (qdisc_is_percpu_stats(q)) { + qdisc_qstats_cpu_backlog_dec(q, skb); +- qdisc_qstats_cpu_qlen_dec(q); ++ qdisc_qstats_atomic_qlen_dec(q); + } else { + qdisc_qstats_backlog_dec(q, skb); + q->q.qlen--; +@@ -645,7 +645,7 @@ static int pfifo_fast_enqueue(struct sk_ + if (unlikely(err)) + return qdisc_drop_cpu(skb, qdisc, to_free); + +- qdisc_qstats_cpu_qlen_inc(qdisc); ++ qdisc_qstats_atomic_qlen_inc(qdisc); + /* Note: skb can not be used after skb_array_produce(), + * so we better not use qdisc_qstats_cpu_backlog_inc() + */ +@@ -670,7 +670,7 @@ static struct sk_buff *pfifo_fast_dequeu + if (likely(skb)) { + qdisc_qstats_cpu_backlog_dec(qdisc, skb); + qdisc_bstats_cpu_update(qdisc, skb); +- qdisc_qstats_cpu_qlen_dec(qdisc); ++ qdisc_qstats_atomic_qlen_dec(qdisc); + } + + return skb; +@@ -714,7 +714,6 @@ static void pfifo_fast_reset(struct Qdis + struct gnet_stats_queue *q = per_cpu_ptr(qdisc->cpu_qstats, i); + + q->backlog = 0; +- q->qlen = 0; + } + } + diff --git a/queue-5.0/net-sysfs-fix-mem-leak-in-netdev_register_kobject.patch b/queue-5.0/net-sysfs-fix-mem-leak-in-netdev_register_kobject.patch new file mode 100644 index 00000000000..a6d93b68649 --- /dev/null +++ b/queue-5.0/net-sysfs-fix-mem-leak-in-netdev_register_kobject.patch @@ -0,0 +1,55 @@ +From foo@baz Fri Mar 8 07:37:28 CET 2019 +From: YueHaibing +Date: Sat, 2 Mar 2019 10:34:55 +0800 +Subject: net-sysfs: Fix mem leak in netdev_register_kobject + +From: YueHaibing + +[ Upstream commit 895a5e96dbd6386c8e78e5b78e067dcc67b7f0ab ] + +syzkaller report this: +BUG: memory leak +unreferenced object 0xffff88837a71a500 (size 256): + comm "syz-executor.2", pid 9770, jiffies 4297825125 (age 17.843s) + hex dump (first 32 bytes): + 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N.......... + ff ff ff ff ff ff ff ff 20 c0 ef 86 ff ff ff ff ........ ....... + backtrace: + [<00000000db12624b>] netdev_register_kobject+0x124/0x2e0 net/core/net-sysfs.c:1751 + [<00000000dc49a994>] register_netdevice+0xcc1/0x1270 net/core/dev.c:8516 + [<00000000e5f3fea0>] tun_set_iff drivers/net/tun.c:2649 [inline] + [<00000000e5f3fea0>] __tun_chr_ioctl+0x2218/0x3d20 drivers/net/tun.c:2883 + [<000000001b8ac127>] vfs_ioctl fs/ioctl.c:46 [inline] + [<000000001b8ac127>] do_vfs_ioctl+0x1a5/0x10e0 fs/ioctl.c:690 + [<0000000079b269f8>] ksys_ioctl+0x89/0xa0 fs/ioctl.c:705 + [<00000000de649beb>] __do_sys_ioctl fs/ioctl.c:712 [inline] + [<00000000de649beb>] __se_sys_ioctl fs/ioctl.c:710 [inline] + [<00000000de649beb>] __x64_sys_ioctl+0x74/0xb0 fs/ioctl.c:710 + [<000000007ebded1e>] do_syscall_64+0xc8/0x580 arch/x86/entry/common.c:290 + [<00000000db315d36>] entry_SYSCALL_64_after_hwframe+0x49/0xbe + [<00000000115be9bb>] 0xffffffffffffffff + +It should call kset_unregister to free 'dev->queues_kset' +in error path of register_queue_kobjects, otherwise will cause a mem leak. + +Reported-by: Hulk Robot +Fixes: 1d24eb4815d1 ("xps: Transmit Packet Steering") +Signed-off-by: YueHaibing +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/core/net-sysfs.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/core/net-sysfs.c ++++ b/net/core/net-sysfs.c +@@ -1547,6 +1547,9 @@ static int register_queue_kobjects(struc + error: + netdev_queue_update_kobjects(dev, txq, 0); + net_rx_queue_update_kobjects(dev, rxq, 0); ++#ifdef CONFIG_SYSFS ++ kset_unregister(dev->queues_kset); ++#endif + return error; + } + diff --git a/queue-5.0/qmi_wwan-add-support-for-quectel-eg12-em12.patch b/queue-5.0/qmi_wwan-add-support-for-quectel-eg12-em12.patch new file mode 100644 index 00000000000..8dd878c8136 --- /dev/null +++ b/queue-5.0/qmi_wwan-add-support-for-quectel-eg12-em12.patch @@ -0,0 +1,82 @@ +From foo@baz Fri Mar 8 07:37:28 CET 2019 +From: Kristian Evensen +Date: Sat, 2 Mar 2019 13:32:26 +0100 +Subject: qmi_wwan: Add support for Quectel EG12/EM12 + +From: Kristian Evensen + +[ Upstream commit 822e44b45eb991c63487c5e2ce7d636411870a8d ] + +Quectel EG12 (module)/EM12 (M.2 card) is a Cat. 12 LTE modem. The modem +behaves in the same way as the EP06, so the "set DTR"-quirk must be +applied and the diagnostic-interface check performed. Since the +diagnostic-check now applies to more modems, I have renamed the function +from quectel_ep06_diag_detected() to quectel_diag_detected(). + +Signed-off-by: Kristian Evensen +Acked-by: Bjørn Mork +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/qmi_wwan.c | 26 ++++++++++++++++++-------- + 1 file changed, 18 insertions(+), 8 deletions(-) + +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -976,6 +976,13 @@ static const struct usb_device_id produc + 0xff), + .driver_info = (unsigned long)&qmi_wwan_info_quirk_dtr, + }, ++ { /* Quectel EG12/EM12 */ ++ USB_DEVICE_AND_INTERFACE_INFO(0x2c7c, 0x0512, ++ USB_CLASS_VENDOR_SPEC, ++ USB_SUBCLASS_VENDOR_SPEC, ++ 0xff), ++ .driver_info = (unsigned long)&qmi_wwan_info_quirk_dtr, ++ }, + + /* 3. Combined interface devices matching on interface number */ + {QMI_FIXED_INTF(0x0408, 0xea42, 4)}, /* Yota / Megafon M100-1 */ +@@ -1343,17 +1350,20 @@ static bool quectel_ec20_detected(struct + return false; + } + +-static bool quectel_ep06_diag_detected(struct usb_interface *intf) ++static bool quectel_diag_detected(struct usb_interface *intf) + { + struct usb_device *dev = interface_to_usbdev(intf); + struct usb_interface_descriptor intf_desc = intf->cur_altsetting->desc; ++ u16 id_vendor = le16_to_cpu(dev->descriptor.idVendor); ++ u16 id_product = le16_to_cpu(dev->descriptor.idProduct); + +- if (le16_to_cpu(dev->descriptor.idVendor) == 0x2c7c && +- le16_to_cpu(dev->descriptor.idProduct) == 0x0306 && +- intf_desc.bNumEndpoints == 2) +- return true; ++ if (id_vendor != 0x2c7c || intf_desc.bNumEndpoints != 2) ++ return false; + +- return false; ++ if (id_product == 0x0306 || id_product == 0x0512) ++ return true; ++ else ++ return false; + } + + static int qmi_wwan_probe(struct usb_interface *intf, +@@ -1390,13 +1400,13 @@ static int qmi_wwan_probe(struct usb_int + return -ENODEV; + } + +- /* Quectel EP06/EM06/EG06 supports dynamic interface configuration, so ++ /* Several Quectel modems supports dynamic interface configuration, so + * we need to match on class/subclass/protocol. These values are + * identical for the diagnostic- and QMI-interface, but bNumEndpoints is + * different. Ignore the current interface if the number of endpoints + * the number for the diag interface (two). + */ +- if (quectel_ep06_diag_detected(intf)) ++ if (quectel_diag_detected(intf)) + return -ENODEV; + + return usbnet_probe(intf, id); diff --git a/queue-5.0/sctp-call-iov_iter_revert-after-sending-abort.patch b/queue-5.0/sctp-call-iov_iter_revert-after-sending-abort.patch new file mode 100644 index 00000000000..4af7a81bd38 --- /dev/null +++ b/queue-5.0/sctp-call-iov_iter_revert-after-sending-abort.patch @@ -0,0 +1,35 @@ +From foo@baz Fri Mar 8 07:37:28 CET 2019 +From: Xin Long +Date: Sun, 3 Mar 2019 16:50:26 +0800 +Subject: sctp: call iov_iter_revert() after sending ABORT + +From: Xin Long + +[ Upstream commit 901efe12318b1ea8d3e2c88a7b75ed6e6d5d7245 ] + +The user msg is also copied to the abort packet when doing SCTP_ABORT in +sctp_sendmsg_check_sflags(). When SCTP_SENDALL is set, iov_iter_revert() +should have been called for sending abort on the next asoc with copying +this msg. Otherwise, memcpy_from_msg() in sctp_make_abort_user() will +fail and return error. + +Fixes: 4910280503f3 ("sctp: add support for snd flag SCTP_SENDALL process in sendmsg") +Reported-by: Ying Xu +Signed-off-by: Xin Long +Acked-by: Neil Horman +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/socket.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -1866,6 +1866,7 @@ static int sctp_sendmsg_check_sflags(str + + pr_debug("%s: aborting association:%p\n", __func__, asoc); + sctp_primitive_ABORT(net, asoc, chunk); ++ iov_iter_revert(&msg->msg_iter, msg_len); + + return 0; + } diff --git a/queue-5.0/series b/queue-5.0/series index febc118dc0d..e7d76dc5420 100644 --- a/queue-5.0/series +++ b/queue-5.0/series @@ -14,3 +14,15 @@ staging-wilc1000-fix-to-set-correct-value-for-vif_num.patch staging-android-ion-fix-sys-heap-pool-s-gfp_flags.patch staging-android-ashmem-don-t-call-fallocate-with-ashmem_mutex-held.patch staging-android-ashmem-avoid-range_alloc-allocation-with-ashmem_mutex-held.patch +ip6mr-do-not-call-__ip6_inc_stats-from-preemptible-context.patch +net-dsa-mv88e6xxx-add-call-to-mv88e6xxx_ports_cmode_init-to-probe-for-new-dsa-framework.patch +net-dsa-mv88e6xxx-handle-unknown-duplex-modes-gracefully-in-mv88e6xxx_port_set_duplex.patch +net-dsa-mv8e6xxx-fix-number-of-internal-phys-for-88e6x90-family.patch +net-mscc-enable-all-ports-in-qsgmii.patch +net-sched-put-back-q.qlen-into-a-single-location.patch +net-sysfs-fix-mem-leak-in-netdev_register_kobject.patch +qmi_wwan-add-support-for-quectel-eg12-em12.patch +sctp-call-iov_iter_revert-after-sending-abort.patch +sky2-disable-msi-on-dell-inspiron-1545-and-gateway-p-79.patch +team-free-bpf-filter-when-unregistering-netdev.patch +tipc-fix-rdm-dgram-connect-regression.patch diff --git a/queue-5.0/sky2-disable-msi-on-dell-inspiron-1545-and-gateway-p-79.patch b/queue-5.0/sky2-disable-msi-on-dell-inspiron-1545-and-gateway-p-79.patch new file mode 100644 index 00000000000..83f8379f9cf --- /dev/null +++ b/queue-5.0/sky2-disable-msi-on-dell-inspiron-1545-and-gateway-p-79.patch @@ -0,0 +1,82 @@ +From foo@baz Fri Mar 8 07:37:28 CET 2019 +From: Kai-Heng Feng +Date: Mon, 4 Mar 2019 15:00:03 +0800 +Subject: sky2: Disable MSI on Dell Inspiron 1545 and Gateway P-79 + +From: Kai-Heng Feng + +[ Upstream commit b33b7cd6fd86478dd2890a9abeb6f036aa01fdf7 ] + +Some sky2 chips fire IRQ after S3, before the driver is fully resumed: +[ 686.804877] do_IRQ: 1.37 No irq handler for vector + +This is likely a platform bug that device isn't fully quiesced during +S3. Use MSI-X, maskable MSI or INTx can prevent this issue from +happening. + +Since MSI-X and maskable MSI are not supported by this device, fallback +to use INTx on affected platforms. + +BugLink: https://bugs.launchpad.net/bugs/1807259 +BugLink: https://bugs.launchpad.net/bugs/1809843 +Signed-off-by: Kai-Heng Feng +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/marvell/sky2.c | 24 +++++++++++++++++++++++- + 1 file changed, 23 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/marvell/sky2.c ++++ b/drivers/net/ethernet/marvell/sky2.c +@@ -46,6 +46,7 @@ + #include + #include + #include ++#include + + #include + +@@ -93,7 +94,7 @@ static int copybreak __read_mostly = 128 + module_param(copybreak, int, 0); + MODULE_PARM_DESC(copybreak, "Receive copy threshold"); + +-static int disable_msi = 0; ++static int disable_msi = -1; + module_param(disable_msi, int, 0); + MODULE_PARM_DESC(disable_msi, "Disable Message Signaled Interrupt (MSI)"); + +@@ -4917,6 +4918,24 @@ static const char *sky2_name(u8 chipid, + return buf; + } + ++static const struct dmi_system_id msi_blacklist[] = { ++ { ++ .ident = "Dell Inspiron 1545", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 1545"), ++ }, ++ }, ++ { ++ .ident = "Gateway P-79", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Gateway"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "P-79"), ++ }, ++ }, ++ {} ++}; ++ + static int sky2_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + { + struct net_device *dev, *dev1; +@@ -5028,6 +5047,9 @@ static int sky2_probe(struct pci_dev *pd + goto err_out_free_pci; + } + ++ if (disable_msi == -1) ++ disable_msi = !!dmi_check_system(msi_blacklist); ++ + if (!disable_msi && pci_enable_msi(pdev) == 0) { + err = sky2_test_msi(hw); + if (err) { diff --git a/queue-5.0/team-free-bpf-filter-when-unregistering-netdev.patch b/queue-5.0/team-free-bpf-filter-when-unregistering-netdev.patch new file mode 100644 index 00000000000..11cd9de766a --- /dev/null +++ b/queue-5.0/team-free-bpf-filter-when-unregistering-netdev.patch @@ -0,0 +1,99 @@ +From foo@baz Fri Mar 8 07:37:28 CET 2019 +From: Ido Schimmel +Date: Sun, 3 Mar 2019 07:35:51 +0000 +Subject: team: Free BPF filter when unregistering netdev + +From: Ido Schimmel + +[ Upstream commit 692c31bd4054212312396b1d303bffab2c5b93a7 ] + +When team is used in loadbalance mode a BPF filter can be used to +provide a hash which will determine the Tx port. + +When the netdev is later unregistered the filter is not freed which +results in memory leaks [1]. + +Fix by freeing the program and the corresponding filter when +unregistering the netdev. + +[1] +unreferenced object 0xffff8881dbc47cc8 (size 16): + comm "teamd", pid 3068, jiffies 4294997779 (age 438.247s) + hex dump (first 16 bytes): + a3 00 6b 6b 6b 6b 6b 6b 88 a5 82 e1 81 88 ff ff ..kkkkkk........ + backtrace: + [<000000008a3b47e3>] team_nl_cmd_options_set+0x88f/0x11b0 + [<00000000c4f4f27e>] genl_family_rcv_msg+0x78f/0x1080 + [<00000000610ef838>] genl_rcv_msg+0xca/0x170 + [<00000000a281df93>] netlink_rcv_skb+0x132/0x380 + [<000000004d9448a2>] genl_rcv+0x29/0x40 + [<000000000321b2f4>] netlink_unicast+0x4c0/0x690 + [<000000008c25dffb>] netlink_sendmsg+0x929/0xe10 + [<00000000068298c5>] sock_sendmsg+0xc8/0x110 + [<0000000082a61ff0>] ___sys_sendmsg+0x77a/0x8f0 + [<00000000663ae29d>] __sys_sendmsg+0xf7/0x250 + [<0000000027c5f11a>] do_syscall_64+0x14d/0x610 + [<000000006cfbc8d3>] entry_SYSCALL_64_after_hwframe+0x49/0xbe + [<00000000e23197e2>] 0xffffffffffffffff +unreferenced object 0xffff8881e182a588 (size 2048): + comm "teamd", pid 3068, jiffies 4294997780 (age 438.247s) + hex dump (first 32 bytes): + 20 00 00 00 02 00 00 00 30 00 00 00 28 f0 ff ff .......0...(... + 07 00 00 00 00 00 00 00 28 00 00 00 00 00 00 00 ........(....... + backtrace: + [<000000002daf01fb>] lb_bpf_func_set+0x45c/0x6d0 + [<000000008a3b47e3>] team_nl_cmd_options_set+0x88f/0x11b0 + [<00000000c4f4f27e>] genl_family_rcv_msg+0x78f/0x1080 + [<00000000610ef838>] genl_rcv_msg+0xca/0x170 + [<00000000a281df93>] netlink_rcv_skb+0x132/0x380 + [<000000004d9448a2>] genl_rcv+0x29/0x40 + [<000000000321b2f4>] netlink_unicast+0x4c0/0x690 + [<000000008c25dffb>] netlink_sendmsg+0x929/0xe10 + [<00000000068298c5>] sock_sendmsg+0xc8/0x110 + [<0000000082a61ff0>] ___sys_sendmsg+0x77a/0x8f0 + [<00000000663ae29d>] __sys_sendmsg+0xf7/0x250 + [<0000000027c5f11a>] do_syscall_64+0x14d/0x610 + [<000000006cfbc8d3>] entry_SYSCALL_64_after_hwframe+0x49/0xbe + [<00000000e23197e2>] 0xffffffffffffffff + +Fixes: 01d7f30a9f96 ("team: add loadbalance mode") +Signed-off-by: Ido Schimmel +Reported-by: Amit Cohen +Acked-by: Jiri Pirko +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/team/team_mode_loadbalance.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +--- a/drivers/net/team/team_mode_loadbalance.c ++++ b/drivers/net/team/team_mode_loadbalance.c +@@ -325,6 +325,20 @@ static int lb_bpf_func_set(struct team * + return 0; + } + ++static void lb_bpf_func_free(struct team *team) ++{ ++ struct lb_priv *lb_priv = get_lb_priv(team); ++ struct bpf_prog *fp; ++ ++ if (!lb_priv->ex->orig_fprog) ++ return; ++ ++ __fprog_destroy(lb_priv->ex->orig_fprog); ++ fp = rcu_dereference_protected(lb_priv->fp, ++ lockdep_is_held(&team->lock)); ++ bpf_prog_destroy(fp); ++} ++ + static int lb_tx_method_get(struct team *team, struct team_gsetter_ctx *ctx) + { + struct lb_priv *lb_priv = get_lb_priv(team); +@@ -639,6 +653,7 @@ static void lb_exit(struct team *team) + + team_options_unregister(team, lb_options, + ARRAY_SIZE(lb_options)); ++ lb_bpf_func_free(team); + cancel_delayed_work_sync(&lb_priv->ex->stats.refresh_dw); + free_percpu(lb_priv->pcpu_stats); + kfree(lb_priv->ex); diff --git a/queue-5.0/tipc-fix-rdm-dgram-connect-regression.patch b/queue-5.0/tipc-fix-rdm-dgram-connect-regression.patch new file mode 100644 index 00000000000..79babd4cfec --- /dev/null +++ b/queue-5.0/tipc-fix-rdm-dgram-connect-regression.patch @@ -0,0 +1,36 @@ +From foo@baz Fri Mar 8 07:37:28 CET 2019 +From: Erik Hugne +Date: Mon, 4 Mar 2019 23:26:10 +0100 +Subject: tipc: fix RDM/DGRAM connect() regression + +From: Erik Hugne + +[ Upstream commit 0e63208915a8d7590d0a6218dadb2a6a00ac705a ] + +Fix regression bug introduced in +commit 365ad353c256 ("tipc: reduce risk of user starvation during link +congestion") + +Only signal -EDESTADDRREQ for RDM/DGRAM if we don't have a cached +sockaddr. + +Fixes: 365ad353c256 ("tipc: reduce risk of user starvation during link congestion") +Signed-off-by: Erik Hugne +Signed-off-by: Jon Maloy +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/tipc/socket.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/tipc/socket.c ++++ b/net/tipc/socket.c +@@ -1333,7 +1333,7 @@ static int __tipc_sendmsg(struct socket + + if (unlikely(!dest)) { + dest = &tsk->peer; +- if (!syn || dest->family != AF_TIPC) ++ if (!syn && dest->family != AF_TIPC) + return -EDESTADDRREQ; + } +