From: Greg Kroah-Hartman Date: Mon, 4 Apr 2022 11:07:41 +0000 (+0200) Subject: 5.16-stable patches X-Git-Tag: v5.17.2~47 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a345f826c160c0796fa922d983f65c2224a2a713;p=thirdparty%2Fkernel%2Fstable-queue.git 5.16-stable patches added patches: docs-sysctl-kernel-add-missing-bit-to-panic_print.patch ice-xsk-fix-indexing-in-ice_tx_xsk_pool.patch n64cart-convert-bi_disk-to-bi_bdev-bd_disk-fix-build.patch openvswitch-fixed-nd-target-mask-field-in-the-flow-dump.patch torture-make-torture.sh-help-message-match-reality.patch vdpa-mlx5-avoid-processing-works-if-workqueue-was-destroyed.patch xsk-do-not-write-null-in-sw-ring-at-allocation-failure.patch --- diff --git a/queue-5.16/docs-sysctl-kernel-add-missing-bit-to-panic_print.patch b/queue-5.16/docs-sysctl-kernel-add-missing-bit-to-panic_print.patch new file mode 100644 index 00000000000..b80035c6e66 --- /dev/null +++ b/queue-5.16/docs-sysctl-kernel-add-missing-bit-to-panic_print.patch @@ -0,0 +1,55 @@ +From a1ff1de00db21ecb956213f046b79741b64c6b65 Mon Sep 17 00:00:00 2001 +From: "Guilherme G. Piccoli" +Date: Wed, 23 Mar 2022 16:07:03 -0700 +Subject: docs: sysctl/kernel: add missing bit to panic_print + +From: Guilherme G. Piccoli + +commit a1ff1de00db21ecb956213f046b79741b64c6b65 upstream. + +Patch series "Some improvements on panic_print". + +This is a mix of a documentation fix with some additions to the +"panic_print" syscall / parameter. The goal here is being able to collect +all CPUs backtraces during a panic event and also to enable "panic_print" +in a kdump event - details of the reasoning and design choices in the +patches. + +This patch (of 3): + +Commit de6da1e8bcf0 ("panic: add an option to replay all the printk +message in buffer") added a new bit to the sysctl/kernel parameter +"panic_print", but the documentation was added only in +kernel-parameters.txt, not in the sysctl guide. + +Fix it here by adding bit 5 to sysctl admin-guide documentation. + +[rdunlap@infradead.org: fix table format warning] + Link: https://lkml.kernel.org/r/20220109055635.6999-1-rdunlap@infradead.org + +Link: https://lkml.kernel.org/r/20211109202848.610874-1-gpiccoli@igalia.com +Link: https://lkml.kernel.org/r/20211109202848.610874-2-gpiccoli@igalia.com +Fixes: de6da1e8bcf0 ("panic: add an option to replay all the printk message in buffer") +Signed-off-by: Guilherme G. Piccoli +Reviewed-by: Feng Tang +Cc: Luis Chamberlain +Cc: Kees Cook +Cc: Iurii Zaikin +Cc: Samuel Iglesias Gonsalvez +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/admin-guide/sysctl/kernel.rst | 1 + + 1 file changed, 1 insertion(+) + +--- a/Documentation/admin-guide/sysctl/kernel.rst ++++ b/Documentation/admin-guide/sysctl/kernel.rst +@@ -795,6 +795,7 @@ bit 1 print system memory info + bit 2 print timer info + bit 3 print locks info if ``CONFIG_LOCKDEP`` is on + bit 4 print ftrace buffer ++bit 5 print all printk messages in buffer + ===== ============================================ + + So for example to print tasks and memory info on panic, user can:: diff --git a/queue-5.16/ice-xsk-fix-indexing-in-ice_tx_xsk_pool.patch b/queue-5.16/ice-xsk-fix-indexing-in-ice_tx_xsk_pool.patch new file mode 100644 index 00000000000..c6a879bd41a --- /dev/null +++ b/queue-5.16/ice-xsk-fix-indexing-in-ice_tx_xsk_pool.patch @@ -0,0 +1,48 @@ +From 1ac2524de7b366633fc336db6c94062768d0ab03 Mon Sep 17 00:00:00 2001 +From: Maciej Fijalkowski +Date: Mon, 28 Mar 2022 16:21:23 +0200 +Subject: ice: xsk: Fix indexing in ice_tx_xsk_pool() + +From: Maciej Fijalkowski + +commit 1ac2524de7b366633fc336db6c94062768d0ab03 upstream. + +Ice driver tries to always create XDP rings array to be +num_possible_cpus() sized, regardless of user's queue count setting that +can be changed via ethtool -L for example. + +Currently, ice_tx_xsk_pool() calculates the qid by decrementing the +ring->q_index by the count of XDP queues, but ring->q_index is set to 'i ++ vsi->alloc_txq'. + +When user did ethtool -L $IFACE combined 1, alloc_txq is 1, but +vsi->num_xdp_txq is still num_possible_cpus(). Then, ice_tx_xsk_pool() +will do OOB access and in the final result ring would not get xsk_pool +pointer assigned. Then, each ice_xsk_wakeup() call will fail with error +and it will not be possible to get into NAPI and do the processing from +driver side. + +Fix this by decrementing vsi->alloc_txq instead of vsi->num_xdp_txq from +ring-q_index in ice_tx_xsk_pool() so the calculation is reflected to the +setting of ring->q_index. + +Fixes: 22bf877e528f ("ice: introduce XDP_TX fallback path") +Signed-off-by: Maciej Fijalkowski +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/20220328142123.170157-5-maciej.fijalkowski@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ice/ice.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/ice/ice.h ++++ b/drivers/net/ethernet/intel/ice/ice.h +@@ -709,7 +709,7 @@ static inline struct xsk_buff_pool *ice_ + struct ice_vsi *vsi = ring->vsi; + u16 qid; + +- qid = ring->q_index - vsi->num_xdp_txq; ++ qid = ring->q_index - vsi->alloc_txq; + + if (!ice_is_xdp_ena_vsi(vsi) || !test_bit(qid, vsi->af_xdp_zc_qps)) + return NULL; diff --git a/queue-5.16/n64cart-convert-bi_disk-to-bi_bdev-bd_disk-fix-build.patch b/queue-5.16/n64cart-convert-bi_disk-to-bi_bdev-bd_disk-fix-build.patch new file mode 100644 index 00000000000..7e261d1a8fe --- /dev/null +++ b/queue-5.16/n64cart-convert-bi_disk-to-bi_bdev-bd_disk-fix-build.patch @@ -0,0 +1,47 @@ +From b2479de38d8fc7ef13d5c78ff5ded6e5a1a4eac0 Mon Sep 17 00:00:00 2001 +From: Jackie Liu +Date: Mon, 21 Mar 2022 15:12:16 +0800 +Subject: n64cart: convert bi_disk to bi_bdev->bd_disk fix build +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jackie Liu + +commit b2479de38d8fc7ef13d5c78ff5ded6e5a1a4eac0 upstream. + +My kernel robot report below: + + drivers/block/n64cart.c: In function ‘n64cart_submit_bio’: + drivers/block/n64cart.c:91:26: error: ‘struct bio’ has no member named ‘bi_disk’ + 91 | struct device *dev = bio->bi_disk->private_data; + | ^~ + CC drivers/slimbus/qcom-ctrl.o + CC drivers/auxdisplay/hd44780.o + CC drivers/watchdog/watchdog_core.o + CC drivers/nvme/host/fault_inject.o + AR drivers/accessibility/braille/built-in.a + make[2]: *** [scripts/Makefile.build:288: drivers/block/n64cart.o] Error 1 + +Fixes: 309dca309fc3 ("block: store a block_device pointer in struct bio"); +Reported-by: k2ci +Signed-off-by: Jackie Liu +Reviewed-by: Chaitanya Kulkarni +Link: https://lore.kernel.org/r/20220321071216.1549596-1-liu.yun@linux.dev +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/block/n64cart.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/block/n64cart.c ++++ b/drivers/block/n64cart.c +@@ -88,7 +88,7 @@ static void n64cart_submit_bio(struct bi + { + struct bio_vec bvec; + struct bvec_iter iter; +- struct device *dev = bio->bi_disk->private_data; ++ struct device *dev = bio->bi_bdev->bd_disk->private_data; + u32 pos = bio->bi_iter.bi_sector << SECTOR_SHIFT; + + bio_for_each_segment(bvec, bio, iter) { diff --git a/queue-5.16/openvswitch-fixed-nd-target-mask-field-in-the-flow-dump.patch b/queue-5.16/openvswitch-fixed-nd-target-mask-field-in-the-flow-dump.patch new file mode 100644 index 00000000000..dfb95221ddf --- /dev/null +++ b/queue-5.16/openvswitch-fixed-nd-target-mask-field-in-the-flow-dump.patch @@ -0,0 +1,49 @@ +From f19c44452b58a84d95e209b847f5495d91c9983a Mon Sep 17 00:00:00 2001 +From: Martin Varghese +Date: Mon, 28 Mar 2022 11:11:48 +0530 +Subject: openvswitch: Fixed nd target mask field in the flow dump. + +From: Martin Varghese + +commit f19c44452b58a84d95e209b847f5495d91c9983a upstream. + +IPv6 nd target mask was not getting populated in flow dump. + +In the function __ovs_nla_put_key the icmp code mask field was checked +instead of icmp code key field to classify the flow as neighbour discovery. + +ufid:bdfbe3e5-60c2-43b0-a5ff-dfcac1c37328, recirc_id(0),dp_hash(0/0), +skb_priority(0/0),in_port(ovs-nm1),skb_mark(0/0),ct_state(0/0), +ct_zone(0/0),ct_mark(0/0),ct_label(0/0), +eth(src=00:00:00:00:00:00/00:00:00:00:00:00, +dst=00:00:00:00:00:00/00:00:00:00:00:00), +eth_type(0x86dd), +ipv6(src=::/::,dst=::/::,label=0/0,proto=58,tclass=0/0,hlimit=0/0,frag=no), +icmpv6(type=135,code=0), +nd(target=2001::2/::, +sll=00:00:00:00:00:00/00:00:00:00:00:00, +tll=00:00:00:00:00:00/00:00:00:00:00:00), +packets:10, bytes:860, used:0.504s, dp:ovs, actions:ovs-nm2 + +Fixes: e64457191a25 (openvswitch: Restructure datapath.c and flow.c) +Signed-off-by: Martin Varghese +Link: https://lore.kernel.org/r/20220328054148.3057-1-martinvarghesenokia@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/openvswitch/flow_netlink.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/openvswitch/flow_netlink.c ++++ b/net/openvswitch/flow_netlink.c +@@ -2201,8 +2201,8 @@ static int __ovs_nla_put_key(const struc + icmpv6_key->icmpv6_type = ntohs(output->tp.src); + icmpv6_key->icmpv6_code = ntohs(output->tp.dst); + +- if (icmpv6_key->icmpv6_type == NDISC_NEIGHBOUR_SOLICITATION || +- icmpv6_key->icmpv6_type == NDISC_NEIGHBOUR_ADVERTISEMENT) { ++ if (swkey->tp.src == htons(NDISC_NEIGHBOUR_SOLICITATION) || ++ swkey->tp.src == htons(NDISC_NEIGHBOUR_ADVERTISEMENT)) { + struct ovs_key_nd *nd_key; + + nla = nla_reserve(skb, OVS_KEY_ATTR_ND, sizeof(*nd_key)); diff --git a/queue-5.16/series b/queue-5.16/series index 9357431d7a8..cf191ac2f3b 100644 --- a/queue-5.16/series +++ b/queue-5.16/series @@ -1000,3 +1000,10 @@ arm-dts-spear13xx-update-spi-dma-properties.patch arm64-dts-ls1043a-update-i2c-dma-properties.patch arm64-dts-ls1046a-update-i2c-node-dma-properties.patch um-fix-uml_mconsole-stop-go.patch +docs-sysctl-kernel-add-missing-bit-to-panic_print.patch +xsk-do-not-write-null-in-sw-ring-at-allocation-failure.patch +ice-xsk-fix-indexing-in-ice_tx_xsk_pool.patch +vdpa-mlx5-avoid-processing-works-if-workqueue-was-destroyed.patch +openvswitch-fixed-nd-target-mask-field-in-the-flow-dump.patch +torture-make-torture.sh-help-message-match-reality.patch +n64cart-convert-bi_disk-to-bi_bdev-bd_disk-fix-build.patch diff --git a/queue-5.16/torture-make-torture.sh-help-message-match-reality.patch b/queue-5.16/torture-make-torture.sh-help-message-match-reality.patch new file mode 100644 index 00000000000..fc60749e7a2 --- /dev/null +++ b/queue-5.16/torture-make-torture.sh-help-message-match-reality.patch @@ -0,0 +1,35 @@ +From f233673cd32a048f2eed69e56b61174c33fb740b Mon Sep 17 00:00:00 2001 +From: "Paul E. McKenney" +Date: Thu, 27 Jan 2022 09:39:15 -0800 +Subject: torture: Make torture.sh help message match reality + +From: Paul E. McKenney + +commit f233673cd32a048f2eed69e56b61174c33fb740b upstream. + +This commit fixes a couple of typos: s/--doall/--do-all/ and +s/--doallmodconfig/--do-allmodconfig/. + +[ paulmck: Add Fixes: supplied by Paul Menzel. ] + +Fixes: a115a775a8d5 ("torture: Add "make allmodconfig" to torture.sh") +Reported-by: Paul Menzel +Signed-off-by: Paul E. McKenney +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/rcutorture/bin/torture.sh | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/tools/testing/selftests/rcutorture/bin/torture.sh ++++ b/tools/testing/selftests/rcutorture/bin/torture.sh +@@ -71,8 +71,8 @@ usage () { + echo " --configs-rcutorture \"config-file list w/ repeat factor (3*TINY01)\"" + echo " --configs-locktorture \"config-file list w/ repeat factor (10*LOCK01)\"" + echo " --configs-scftorture \"config-file list w/ repeat factor (2*CFLIST)\"" +- echo " --doall" +- echo " --doallmodconfig / --do-no-allmodconfig" ++ echo " --do-all" ++ echo " --do-allmodconfig / --do-no-allmodconfig" + echo " --do-clocksourcewd / --do-no-clocksourcewd" + echo " --do-kasan / --do-no-kasan" + echo " --do-kcsan / --do-no-kcsan" diff --git a/queue-5.16/vdpa-mlx5-avoid-processing-works-if-workqueue-was-destroyed.patch b/queue-5.16/vdpa-mlx5-avoid-processing-works-if-workqueue-was-destroyed.patch new file mode 100644 index 00000000000..6696b610576 --- /dev/null +++ b/queue-5.16/vdpa-mlx5-avoid-processing-works-if-workqueue-was-destroyed.patch @@ -0,0 +1,52 @@ +From ad6dc1daaf29f97f23cc810d60ee01c0e83f4c6b Mon Sep 17 00:00:00 2001 +From: Eli Cohen +Date: Mon, 21 Mar 2022 16:13:03 +0200 +Subject: vdpa/mlx5: Avoid processing works if workqueue was destroyed + +From: Eli Cohen + +commit ad6dc1daaf29f97f23cc810d60ee01c0e83f4c6b upstream. + +If mlx5_vdpa gets unloaded while a VM is running, the workqueue will be +destroyed. However, vhost might still have reference to the kick +function and might attempt to push new works. This could lead to null +pointer dereference. + +To fix this, set mvdev->wq to NULL just before destroying and verify +that the workqueue is not NULL in mlx5_vdpa_kick_vq before attempting to +push a new work. + +Fixes: 5262912ef3cf ("vdpa/mlx5: Add support for control VQ and MAC setting") +Signed-off-by: Eli Cohen +Link: https://lore.kernel.org/r/20220321141303.9586-1-elic@nvidia.com +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/vdpa/mlx5/net/mlx5_vnet.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c ++++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c +@@ -1680,7 +1680,7 @@ static void mlx5_vdpa_kick_vq(struct vdp + return; + + if (unlikely(is_ctrl_vq_idx(mvdev, idx))) { +- if (!mvdev->cvq.ready) ++ if (!mvdev->wq || !mvdev->cvq.ready) + return; + + wqent = kzalloc(sizeof(*wqent), GFP_ATOMIC); +@@ -2673,9 +2673,12 @@ static void mlx5_vdpa_dev_del(struct vdp + struct mlx5_vdpa_mgmtdev *mgtdev = container_of(v_mdev, struct mlx5_vdpa_mgmtdev, mgtdev); + struct mlx5_vdpa_dev *mvdev = to_mvdev(dev); + struct mlx5_vdpa_net *ndev = to_mlx5_vdpa_ndev(mvdev); ++ struct workqueue_struct *wq; + + mlx5_notifier_unregister(mvdev->mdev, &ndev->nb); +- destroy_workqueue(mvdev->wq); ++ wq = mvdev->wq; ++ mvdev->wq = NULL; ++ destroy_workqueue(wq); + _vdpa_unregister_device(dev); + mgtdev->ndev = NULL; + } diff --git a/queue-5.16/xsk-do-not-write-null-in-sw-ring-at-allocation-failure.patch b/queue-5.16/xsk-do-not-write-null-in-sw-ring-at-allocation-failure.patch new file mode 100644 index 00000000000..52662dc9769 --- /dev/null +++ b/queue-5.16/xsk-do-not-write-null-in-sw-ring-at-allocation-failure.patch @@ -0,0 +1,50 @@ +From a95a4d9b39b0324402569ed7395aae59b8fd2b11 Mon Sep 17 00:00:00 2001 +From: Magnus Karlsson +Date: Mon, 28 Mar 2022 16:21:20 +0200 +Subject: xsk: Do not write NULL in SW ring at allocation failure + +From: Magnus Karlsson + +commit a95a4d9b39b0324402569ed7395aae59b8fd2b11 upstream. + +For the case when xp_alloc_batch() is used but the batched allocation +cannot be used, there is a slow path that uses the non-batched +xp_alloc(). When it fails to allocate an entry, it returns NULL. The +current code wrote this NULL into the entry of the provided results +array (pointer to the driver SW ring usually) and returned. This might +not be what the driver expects and to make things simpler, just write +successfully allocated xdp_buffs into the SW ring,. The driver might +have information in there that is still important after an allocation +failure. + +Note that at this point in time, there are no drivers using +xp_alloc_batch() that could trigger this slow path. But one might get +added. + +Fixes: 47e4075df300 ("xsk: Batched buffer allocation for the pool") +Signed-off-by: Magnus Karlsson +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/20220328142123.170157-2-maciej.fijalkowski@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + net/xdp/xsk_buff_pool.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/net/xdp/xsk_buff_pool.c ++++ b/net/xdp/xsk_buff_pool.c +@@ -584,9 +584,13 @@ u32 xp_alloc_batch(struct xsk_buff_pool + u32 nb_entries1 = 0, nb_entries2; + + if (unlikely(pool->dma_need_sync)) { ++ struct xdp_buff *buff; ++ + /* Slow path */ +- *xdp = xp_alloc(pool); +- return !!*xdp; ++ buff = xp_alloc(pool); ++ if (buff) ++ *xdp = buff; ++ return !!buff; + } + + if (unlikely(pool->free_list_cnt)) {