From: Sasha Levin Date: Sun, 19 Jun 2022 13:03:25 +0000 (-0400) Subject: Fixes for 5.18 X-Git-Tag: v5.4.200~62 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=aeea87aa31518cdfa4200e1f798a2ad2c405a402;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.18 Signed-off-by: Sasha Levin --- diff --git a/queue-5.18/arm64-ftrace-consistently-handle-plts.patch b/queue-5.18/arm64-ftrace-consistently-handle-plts.patch new file mode 100644 index 00000000000..c0a14d5a36f --- /dev/null +++ b/queue-5.18/arm64-ftrace-consistently-handle-plts.patch @@ -0,0 +1,305 @@ +From 4da623bc9d52b2de3d07a26972b2f11c05c3e116 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jun 2022 09:09:43 +0100 +Subject: arm64: ftrace: consistently handle PLTs. + +From: Mark Rutland + +[ Upstream commit a6253579977e4c6f7818eeb05bf2bc65678a7187 ] + +Sometimes it is necessary to use a PLT entry to call an ftrace +trampoline. This is handled by ftrace_make_call() and ftrace_make_nop(), +with each having *almost* identical logic, but this is not handled by +ftrace_modify_call() since its introduction in commit: + + 3b23e4991fb66f6d ("arm64: implement ftrace with regs") + +Due to this, if we ever were to call ftrace_modify_call() for a callsite +which requires a PLT entry for a trampoline, then either: + +a) If the old addr requires a trampoline, ftrace_modify_call() will use + an out-of-range address to generate the 'old' branch instruction. + This will result in warnings from aarch64_insn_gen_branch_imm() and + ftrace_modify_code(), and no instructions will be modified. As + ftrace_modify_call() will return an error, this will result in + subsequent internal ftrace errors. + +b) If the old addr does not require a trampoline, but the new addr does, + ftrace_modify_call() will use an out-of-range address to generate the + 'new' branch instruction. This will result in warnings from + aarch64_insn_gen_branch_imm(), and ftrace_modify_code() will replace + the 'old' branch with a BRK. This will result in a kernel panic when + this BRK is later executed. + +Practically speaking, case (a) is vastly more likely than case (b), and +typically this will result in internal ftrace errors that don't +necessarily affect the rest of the system. This can be demonstrated with +an out-of-tree test module which triggers ftrace_modify_call(), e.g. + +| # insmod test_ftrace.ko +| test_ftrace: Function test_function raw=0xffffb3749399201c, callsite=0xffffb37493992024 +| branch_imm_common: offset out of range +| branch_imm_common: offset out of range +| ------------[ ftrace bug ]------------ +| ftrace failed to modify +| [] test_function+0x8/0x38 [test_ftrace] +| actual: 1d:00:00:94 +| Updating ftrace call site to call a different ftrace function +| ftrace record flags: e0000002 +| (2) R +| expected tramp: ffffb374ae42ed54 +| ------------[ cut here ]------------ +| WARNING: CPU: 0 PID: 165 at kernel/trace/ftrace.c:2085 ftrace_bug+0x280/0x2b0 +| Modules linked in: test_ftrace(+) +| CPU: 0 PID: 165 Comm: insmod Not tainted 5.19.0-rc2-00002-g4d9ead8b45ce #13 +| Hardware name: linux,dummy-virt (DT) +| pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +| pc : ftrace_bug+0x280/0x2b0 +| lr : ftrace_bug+0x280/0x2b0 +| sp : ffff80000839ba00 +| x29: ffff80000839ba00 x28: 0000000000000000 x27: ffff80000839bcf0 +| x26: ffffb37493994180 x25: ffffb374b0991c28 x24: ffffb374b0d70000 +| x23: 00000000ffffffea x22: ffffb374afcc33b0 x21: ffffb374b08f9cc8 +| x20: ffff572b8462c000 x19: ffffb374b08f9000 x18: ffffffffffffffff +| x17: 6c6c6163202c6331 x16: ffffb374ae5ad110 x15: ffffb374b0d51ee4 +| x14: 0000000000000000 x13: 3435646532346561 x12: 3437336266666666 +| x11: 203a706d61727420 x10: 6465746365707865 x9 : ffffb374ae5149e8 +| x8 : 336266666666203a x7 : 706d617274206465 x6 : 00000000fffff167 +| x5 : ffff572bffbc4a08 x4 : 00000000fffff167 x3 : 0000000000000000 +| x2 : 0000000000000000 x1 : ffff572b84461e00 x0 : 0000000000000022 +| Call trace: +| ftrace_bug+0x280/0x2b0 +| ftrace_replace_code+0x98/0xa0 +| ftrace_modify_all_code+0xe0/0x144 +| arch_ftrace_update_code+0x14/0x20 +| ftrace_startup+0xf8/0x1b0 +| register_ftrace_function+0x38/0x90 +| test_ftrace_init+0xd0/0x1000 [test_ftrace] +| do_one_initcall+0x50/0x2b0 +| do_init_module+0x50/0x1f0 +| load_module+0x17c8/0x1d64 +| __do_sys_finit_module+0xa8/0x100 +| __arm64_sys_finit_module+0x2c/0x3c +| invoke_syscall+0x50/0x120 +| el0_svc_common.constprop.0+0xdc/0x100 +| do_el0_svc+0x3c/0xd0 +| el0_svc+0x34/0xb0 +| el0t_64_sync_handler+0xbc/0x140 +| el0t_64_sync+0x18c/0x190 +| ---[ end trace 0000000000000000 ]--- + +We can solve this by consistently determining whether to use a PLT entry +for an address. + +Note that since (the earlier) commit: + + f1a54ae9af0da4d7 ("arm64: module/ftrace: intialize PLT at load time") + +... we can consistently determine the PLT address that a given callsite +will use, and therefore ftrace_make_nop() does not need to skip +validation when a PLT is in use. + +This patch factors the existing logic out of ftrace_make_call() and +ftrace_make_nop() into a common ftrace_find_callable_addr() helper +function, which is used by ftrace_make_call(), ftrace_make_nop(), and +ftrace_modify_call(). In ftrace_make_nop() the patching is consistently +validated by ftrace_modify_code() as we can always determine what the +old instruction should have been. + +Fixes: 3b23e4991fb6 ("arm64: implement ftrace with regs") +Signed-off-by: Mark Rutland +Cc: Ard Biesheuvel +Cc: Will Deacon +Tested-by: "Ivan T. Ivanov" +Reviewed-by: Chengming Zhou +Reviewed-by: Ard Biesheuvel +Link: https://lore.kernel.org/r/20220614080944.1349146-3-mark.rutland@arm.com +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/ftrace.c | 137 ++++++++++++++++++------------------- + 1 file changed, 66 insertions(+), 71 deletions(-) + +diff --git a/arch/arm64/kernel/ftrace.c b/arch/arm64/kernel/ftrace.c +index d9e3eda419ec..f3184cd81b19 100644 +--- a/arch/arm64/kernel/ftrace.c ++++ b/arch/arm64/kernel/ftrace.c +@@ -78,47 +78,76 @@ static struct plt_entry *get_ftrace_plt(struct module *mod, unsigned long addr) + } + + /* +- * Turn on the call to ftrace_caller() in instrumented function ++ * Find the address the callsite must branch to in order to reach '*addr'. ++ * ++ * Due to the limited range of 'BL' instructions, modules may be placed too far ++ * away to branch directly and must use a PLT. ++ * ++ * Returns true when '*addr' contains a reachable target address, or has been ++ * modified to contain a PLT address. Returns false otherwise. + */ +-int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr) ++static bool ftrace_find_callable_addr(struct dyn_ftrace *rec, ++ struct module *mod, ++ unsigned long *addr) + { + unsigned long pc = rec->ip; +- u32 old, new; +- long offset = (long)addr - (long)pc; ++ long offset = (long)*addr - (long)pc; ++ struct plt_entry *plt; + +- if (offset < -SZ_128M || offset >= SZ_128M) { +- struct module *mod; +- struct plt_entry *plt; ++ /* ++ * When the target is within range of the 'BL' instruction, use 'addr' ++ * as-is and branch to that directly. ++ */ ++ if (offset >= -SZ_128M && offset < SZ_128M) ++ return true; + +- if (!IS_ENABLED(CONFIG_ARM64_MODULE_PLTS)) +- return -EINVAL; ++ /* ++ * When the target is outside of the range of a 'BL' instruction, we ++ * must use a PLT to reach it. We can only place PLTs for modules, and ++ * only when module PLT support is built-in. ++ */ ++ if (!IS_ENABLED(CONFIG_ARM64_MODULE_PLTS)) ++ return false; + +- /* +- * On kernels that support module PLTs, the offset between the +- * branch instruction and its target may legally exceed the +- * range of an ordinary relative 'bl' opcode. In this case, we +- * need to branch via a trampoline in the module. +- * +- * NOTE: __module_text_address() must be called with preemption +- * disabled, but we can rely on ftrace_lock to ensure that 'mod' +- * retains its validity throughout the remainder of this code. +- */ ++ /* ++ * 'mod' is only set at module load time, but if we end up ++ * dealing with an out-of-range condition, we can assume it ++ * is due to a module being loaded far away from the kernel. ++ * ++ * NOTE: __module_text_address() must be called with preemption ++ * disabled, but we can rely on ftrace_lock to ensure that 'mod' ++ * retains its validity throughout the remainder of this code. ++ */ ++ if (!mod) { + preempt_disable(); + mod = __module_text_address(pc); + preempt_enable(); ++ } + +- if (WARN_ON(!mod)) +- return -EINVAL; ++ if (WARN_ON(!mod)) ++ return false; + +- plt = get_ftrace_plt(mod, addr); +- if (!plt) { +- pr_err("ftrace: no module PLT for %ps\n", (void *)addr); +- return -EINVAL; +- } +- +- addr = (unsigned long)plt; ++ plt = get_ftrace_plt(mod, *addr); ++ if (!plt) { ++ pr_err("ftrace: no module PLT for %ps\n", (void *)*addr); ++ return false; + } + ++ *addr = (unsigned long)plt; ++ return true; ++} ++ ++/* ++ * Turn on the call to ftrace_caller() in instrumented function ++ */ ++int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr) ++{ ++ unsigned long pc = rec->ip; ++ u32 old, new; ++ ++ if (!ftrace_find_callable_addr(rec, NULL, &addr)) ++ return -EINVAL; ++ + old = aarch64_insn_gen_nop(); + new = aarch64_insn_gen_branch_imm(pc, addr, AARCH64_INSN_BRANCH_LINK); + +@@ -132,6 +161,11 @@ int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_addr, + unsigned long pc = rec->ip; + u32 old, new; + ++ if (!ftrace_find_callable_addr(rec, NULL, &old_addr)) ++ return -EINVAL; ++ if (!ftrace_find_callable_addr(rec, NULL, &addr)) ++ return -EINVAL; ++ + old = aarch64_insn_gen_branch_imm(pc, old_addr, + AARCH64_INSN_BRANCH_LINK); + new = aarch64_insn_gen_branch_imm(pc, addr, AARCH64_INSN_BRANCH_LINK); +@@ -181,54 +215,15 @@ int ftrace_make_nop(struct module *mod, struct dyn_ftrace *rec, + unsigned long addr) + { + unsigned long pc = rec->ip; +- bool validate = true; + u32 old = 0, new; +- long offset = (long)addr - (long)pc; + +- if (offset < -SZ_128M || offset >= SZ_128M) { +- u32 replaced; +- +- if (!IS_ENABLED(CONFIG_ARM64_MODULE_PLTS)) +- return -EINVAL; +- +- /* +- * 'mod' is only set at module load time, but if we end up +- * dealing with an out-of-range condition, we can assume it +- * is due to a module being loaded far away from the kernel. +- */ +- if (!mod) { +- preempt_disable(); +- mod = __module_text_address(pc); +- preempt_enable(); +- +- if (WARN_ON(!mod)) +- return -EINVAL; +- } +- +- /* +- * The instruction we are about to patch may be a branch and +- * link instruction that was redirected via a PLT entry. In +- * this case, the normal validation will fail, but we can at +- * least check that we are dealing with a branch and link +- * instruction that points into the right module. +- */ +- if (aarch64_insn_read((void *)pc, &replaced)) +- return -EFAULT; +- +- if (!aarch64_insn_is_bl(replaced) || +- !within_module(pc + aarch64_get_branch_offset(replaced), +- mod)) +- return -EINVAL; +- +- validate = false; +- } else { +- old = aarch64_insn_gen_branch_imm(pc, addr, +- AARCH64_INSN_BRANCH_LINK); +- } ++ if (!ftrace_find_callable_addr(rec, mod, &addr)) ++ return -EINVAL; + ++ old = aarch64_insn_gen_branch_imm(pc, addr, AARCH64_INSN_BRANCH_LINK); + new = aarch64_insn_gen_nop(); + +- return ftrace_modify_code(pc, old, new, validate); ++ return ftrace_modify_code(pc, old, new, true); + } + + void arch_ftrace_update_code(int command) +-- +2.35.1 + diff --git a/queue-5.18/arm64-ftrace-fix-branch-range-checks.patch b/queue-5.18/arm64-ftrace-fix-branch-range-checks.patch new file mode 100644 index 00000000000..42cd84c76ce --- /dev/null +++ b/queue-5.18/arm64-ftrace-fix-branch-range-checks.patch @@ -0,0 +1,86 @@ +From 5325f46fa4232175ea0b0f3b76d2c103a9b7e5f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jun 2022 09:09:42 +0100 +Subject: arm64: ftrace: fix branch range checks + +From: Mark Rutland + +[ Upstream commit 3eefdf9d1e406f3da47470b2854347009ffcb6fa ] + +The branch range checks in ftrace_make_call() and ftrace_make_nop() are +incorrect, erroneously permitting a forwards branch of 128M and +erroneously rejecting a backwards branch of 128M. + +This is because both functions calculate the offset backwards, +calculating the offset *from* the target *to* the branch, rather than +the other way around as the later comparisons expect. + +If an out-of-range branch were erroeously permitted, this would later be +rejected by aarch64_insn_gen_branch_imm() as branch_imm_common() checks +the bounds correctly, resulting in warnings and the placement of a BRK +instruction. Note that this can only happen for a forwards branch of +exactly 128M, and so the caller would need to be exactly 128M bytes +below the relevant ftrace trampoline. + +If an in-range branch were erroeously rejected, then: + +* For modules when CONFIG_ARM64_MODULE_PLTS=y, this would result in the + use of a PLT entry, which is benign. + + Note that this is the common case, as this is selected by + CONFIG_RANDOMIZE_BASE (and therefore RANDOMIZE_MODULE_REGION_FULL), + which distributions typically seelct. This is also selected by + CONFIG_ARM64_ERRATUM_843419. + +* For modules when CONFIG_ARM64_MODULE_PLTS=n, this would result in + internal ftrace failures. + +* For core kernel text, this would result in internal ftrace failues. + + Note that for this to happen, the kernel text would need to be at + least 128M bytes in size, and typical configurations are smaller tha + this. + +Fix this by calculating the offset *from* the branch *to* the target in +both functions. + +Fixes: f8af0b364e24 ("arm64: ftrace: don't validate branch via PLT in ftrace_make_nop()") +Fixes: e71a4e1bebaf ("arm64: ftrace: add support for far branches to dynamic ftrace") +Signed-off-by: Mark Rutland +Cc: Ard Biesheuvel +Cc: Will Deacon +Tested-by: "Ivan T. Ivanov" +Reviewed-by: Chengming Zhou +Reviewed-by: Ard Biesheuvel +Link: https://lore.kernel.org/r/20220614080944.1349146-2-mark.rutland@arm.com +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/ftrace.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/kernel/ftrace.c b/arch/arm64/kernel/ftrace.c +index 4506c4a90ac1..d9e3eda419ec 100644 +--- a/arch/arm64/kernel/ftrace.c ++++ b/arch/arm64/kernel/ftrace.c +@@ -84,7 +84,7 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr) + { + unsigned long pc = rec->ip; + u32 old, new; +- long offset = (long)pc - (long)addr; ++ long offset = (long)addr - (long)pc; + + if (offset < -SZ_128M || offset >= SZ_128M) { + struct module *mod; +@@ -183,7 +183,7 @@ int ftrace_make_nop(struct module *mod, struct dyn_ftrace *rec, + unsigned long pc = rec->ip; + bool validate = true; + u32 old = 0, new; +- long offset = (long)pc - (long)addr; ++ long offset = (long)addr - (long)pc; + + if (offset < -SZ_128M || offset >= SZ_128M) { + u32 replaced; +-- +2.35.1 + diff --git a/queue-5.18/block-fix-handling-of-offline-queues-in-blk_mq_alloc.patch b/queue-5.18/block-fix-handling-of-offline-queues-in-blk_mq_alloc.patch new file mode 100644 index 00000000000..7e47f7504ea --- /dev/null +++ b/queue-5.18/block-fix-handling-of-offline-queues-in-blk_mq_alloc.patch @@ -0,0 +1,61 @@ +From 793a9b41b5e0c65370ea245f4e0a29b1f4800151 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jun 2022 14:00:04 -0700 +Subject: block: Fix handling of offline queues in blk_mq_alloc_request_hctx() + +From: Bart Van Assche + +[ Upstream commit 14dc7a18abbe4176f5626c13c333670da8e06aa1 ] + +This patch prevents that test nvme/004 triggers the following: + +UBSAN: array-index-out-of-bounds in block/blk-mq.h:135:9 +index 512 is out of range for type 'long unsigned int [512]' +Call Trace: + show_stack+0x52/0x58 + dump_stack_lvl+0x49/0x5e + dump_stack+0x10/0x12 + ubsan_epilogue+0x9/0x3b + __ubsan_handle_out_of_bounds.cold+0x44/0x49 + blk_mq_alloc_request_hctx+0x304/0x310 + __nvme_submit_sync_cmd+0x70/0x200 [nvme_core] + nvmf_connect_io_queue+0x23e/0x2a0 [nvme_fabrics] + nvme_loop_connect_io_queues+0x8d/0xb0 [nvme_loop] + nvme_loop_create_ctrl+0x58e/0x7d0 [nvme_loop] + nvmf_create_ctrl+0x1d7/0x4d0 [nvme_fabrics] + nvmf_dev_write+0xae/0x111 [nvme_fabrics] + vfs_write+0x144/0x560 + ksys_write+0xb7/0x140 + __x64_sys_write+0x42/0x50 + do_syscall_64+0x35/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Cc: Christoph Hellwig +Cc: Ming Lei +Fixes: 20e4d8139319 ("blk-mq: simplify queue mapping & schedule with each possisble CPU") +Signed-off-by: Bart Van Assche +Reviewed-by: Christoph Hellwig +Reviewed-by: Ming Lei +Link: https://lore.kernel.org/r/20220615210004.1031820-1-bvanassche@acm.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index de7fc6957271..631fb87b4976 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -579,6 +579,8 @@ struct request *blk_mq_alloc_request_hctx(struct request_queue *q, + if (!blk_mq_hw_queue_mapped(data.hctx)) + goto out_queue_exit; + cpu = cpumask_first_and(data.hctx->cpumask, cpu_online_mask); ++ if (cpu >= nr_cpu_ids) ++ goto out_queue_exit; + data.ctx = __blk_mq_get_ctx(q, cpu); + + if (!q->elevator) +-- +2.35.1 + diff --git a/queue-5.18/certs-blacklist_hashes.c-fix-const-confusion-in-cert.patch b/queue-5.18/certs-blacklist_hashes.c-fix-const-confusion-in-cert.patch new file mode 100644 index 00000000000..13072e88bf5 --- /dev/null +++ b/queue-5.18/certs-blacklist_hashes.c-fix-const-confusion-in-cert.patch @@ -0,0 +1,52 @@ +From bacdc9c1a3611de4b2871de2e9719acc63f765da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Jun 2022 02:22:30 +0900 +Subject: certs/blacklist_hashes.c: fix const confusion in certs blacklist +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Masahiro Yamada + +[ Upstream commit 6a1c3767d82ed8233de1263aa7da81595e176087 ] + +This file fails to compile as follows: + + CC certs/blacklist_hashes.o +certs/blacklist_hashes.c:4:1: error: ignoring attribute ‘section (".init.data")’ because it conflicts with previous ‘section (".init.rodata")’ [-Werror=attributes] + 4 | const char __initdata *const blacklist_hashes[] = { + | ^~~~~ +In file included from certs/blacklist_hashes.c:2: +certs/blacklist.h:5:38: note: previous declaration here + 5 | extern const char __initconst *const blacklist_hashes[]; + | ^~~~~~~~~~~~~~~~ + +Apply the same fix as commit 2be04df5668d ("certs/blacklist_nohashes.c: +fix const confusion in certs blacklist"). + +Fixes: 734114f8782f ("KEYS: Add a system blacklist keyring") +Signed-off-by: Masahiro Yamada +Reviewed-by: Jarkko Sakkinen +Reviewed-by: Mickaël Salaün +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + certs/blacklist_hashes.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c +index 344892337be0..d5961aa3d338 100644 +--- a/certs/blacklist_hashes.c ++++ b/certs/blacklist_hashes.c +@@ -1,7 +1,7 @@ + // SPDX-License-Identifier: GPL-2.0 + #include "blacklist.h" + +-const char __initdata *const blacklist_hashes[] = { ++const char __initconst *const blacklist_hashes[] = { + #include CONFIG_SYSTEM_BLACKLIST_HASH_LIST + , NULL + }; +-- +2.35.1 + diff --git a/queue-5.18/clocksource-hyper-v-unexport-__init-annotated-hv_ini.patch b/queue-5.18/clocksource-hyper-v-unexport-__init-annotated-hv_ini.patch new file mode 100644 index 00000000000..4f7d9f7ab40 --- /dev/null +++ b/queue-5.18/clocksource-hyper-v-unexport-__init-annotated-hv_ini.patch @@ -0,0 +1,52 @@ +From ccc6a126730def25a5f42ec705cdd40f6a9cebd5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jun 2022 14:02:38 +0900 +Subject: clocksource: hyper-v: unexport __init-annotated hv_init_clocksource() + +From: Masahiro Yamada + +[ Upstream commit 245b993d8f6c4e25f19191edfbd8080b645e12b1 ] + +EXPORT_SYMBOL and __init is a bad combination because the .init.text +section is freed up after the initialization. Hence, modules cannot +use symbols annotated __init. The access to a freed symbol may end up +with kernel panic. + +modpost used to detect it, but it has been broken for a decade. + +Recently, I fixed modpost so it started to warn it again, then this +showed up in linux-next builds. + +There are two ways to fix it: + + - Remove __init + - Remove EXPORT_SYMBOL + +I chose the latter for this case because the only in-tree call-site, +arch/x86/kernel/cpu/mshyperv.c is never compiled as modular. +(CONFIG_HYPERVISOR_GUEST is boolean) + +Fixes: dd2cb348613b ("clocksource/drivers: Continue making Hyper-V clocksource ISA agnostic") +Reported-by: Stephen Rothwell +Signed-off-by: Masahiro Yamada +Reviewed-by: Vitaly Kuznetsov +Reviewed-by: Michael Kelley +Link: https://lore.kernel.org/r/20220606050238.4162200-1-masahiroy@kernel.org +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/clocksource/hyperv_timer.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/clocksource/hyperv_timer.c b/drivers/clocksource/hyperv_timer.c +index ff188ab68496..bb47610bbd1c 100644 +--- a/drivers/clocksource/hyperv_timer.c ++++ b/drivers/clocksource/hyperv_timer.c +@@ -565,4 +565,3 @@ void __init hv_init_clocksource(void) + hv_sched_clock_offset = hv_read_reference_counter(); + hv_setup_sched_clock(read_hv_sched_clock_msr); + } +-EXPORT_SYMBOL_GPL(hv_init_clocksource); +-- +2.35.1 + diff --git a/queue-5.18/drivers-hv-vmbus-release-cpu-lock-in-error-case.patch b/queue-5.18/drivers-hv-vmbus-release-cpu-lock-in-error-case.patch new file mode 100644 index 00000000000..1aa762e1e4b --- /dev/null +++ b/queue-5.18/drivers-hv-vmbus-release-cpu-lock-in-error-case.patch @@ -0,0 +1,36 @@ +From a81833f7e6bcac243aeb37e99be4f98fbf18a89d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jun 2022 10:16:36 -0700 +Subject: Drivers: hv: vmbus: Release cpu lock in error case + +From: Saurabh Sengar + +[ Upstream commit 656c5ba50b7172a0ea25dc1b37606bd51d01fe8d ] + +In case of invalid sub channel, release cpu lock before returning. + +Fixes: a949e86c0d780 ("Drivers: hv: vmbus: Resolve race between init_vp_index() and CPU hotplug") +Signed-off-by: Saurabh Sengar +Reviewed-by: Michael Kelley +Link: https://lore.kernel.org/r/1654794996-13244-1-git-send-email-ssengar@linux.microsoft.com +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/hv/channel_mgmt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c +index 85a2142c9384..073ff9b6f535 100644 +--- a/drivers/hv/channel_mgmt.c ++++ b/drivers/hv/channel_mgmt.c +@@ -637,6 +637,7 @@ static void vmbus_process_offer(struct vmbus_channel *newchannel) + */ + if (newchannel->offermsg.offer.sub_channel_index == 0) { + mutex_unlock(&vmbus_connection.channel_mutex); ++ cpus_read_unlock(); + /* + * Don't call free_channel(), because newchannel->kobj + * is not initialized yet. +-- +2.35.1 + diff --git a/queue-5.18/drm-i915-reset-fix-error_state_read-ptr-offset-use.patch b/queue-5.18/drm-i915-reset-fix-error_state_read-ptr-offset-use.patch new file mode 100644 index 00000000000..fe547bdd071 --- /dev/null +++ b/queue-5.18/drm-i915-reset-fix-error_state_read-ptr-offset-use.patch @@ -0,0 +1,144 @@ +From dbf3d75ffe289de06a2cdc9911633862d61ffa4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Mar 2022 16:43:11 -0800 +Subject: drm/i915/reset: Fix error_state_read ptr + offset use + +From: Alan Previn + +[ Upstream commit c9b576d0c7bf55aeae1a736da7974fa202c4394d ] + +Fix our pointer offset usage in error_state_read +when there is no i915_gpu_coredump but buf offset +is non-zero. + +This fixes a kernel page fault can happen when +multiple tests are running concurrently in a loop +and one is producing engine resets and consuming +the i915 error_state dump while the other is +forcing full GT resets. (takes a while to trigger). + +The dmesg call trace: + +[ 5590.803000] BUG: unable to handle page fault for address: + ffffffffa0b0e000 +[ 5590.803009] #PF: supervisor read access in kernel mode +[ 5590.803013] #PF: error_code(0x0000) - not-present page +[ 5590.803016] PGD 5814067 P4D 5814067 PUD 5815063 PMD 109de4067 + PTE 0 +[ 5590.803022] Oops: 0000 [#1] PREEMPT SMP NOPTI +[ 5590.803026] CPU: 5 PID: 13656 Comm: i915_hangman Tainted: G U + 5.17.0-rc5-ups69-guc-err-capt-rev6+ #136 +[ 5590.803033] Hardware name: Intel Corporation Alder Lake Client + Platform/AlderLake-M LP4x RVP, BIOS ADLPFWI1.R00. + 3031.A02.2201171222 01/17/2022 +[ 5590.803039] RIP: 0010:memcpy_erms+0x6/0x10 +[ 5590.803045] Code: fe ff ff cc eb 1e 0f 1f 00 48 89 f8 48 89 d1 + 48 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 c3 + 66 0f 1f 44 00 00 48 89 f8 48 89 d1 a4 + c3 0f 1f 80 00 00 00 00 48 89 f8 48 83 fa 20 + 72 7e 40 38 fe +[ 5590.803054] RSP: 0018:ffffc90003a8fdf0 EFLAGS: 00010282 +[ 5590.803057] RAX: ffff888107ee9000 RBX: ffff888108cb1a00 + RCX: 0000000000000f8f +[ 5590.803061] RDX: 0000000000001000 RSI: ffffffffa0b0e000 + RDI: ffff888107ee9071 +[ 5590.803065] RBP: 0000000000000000 R08: 0000000000000001 + R09: 0000000000000001 +[ 5590.803069] R10: 0000000000000001 R11: 0000000000000002 + R12: 0000000000000019 +[ 5590.803073] R13: 0000000000174fff R14: 0000000000001000 + R15: ffff888107ee9000 +[ 5590.803077] FS: 00007f62a99bee80(0000) GS:ffff88849f880000(0000) + knlGS:0000000000000000 +[ 5590.803082] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 5590.803085] CR2: ffffffffa0b0e000 CR3: 000000010a1a8004 + CR4: 0000000000770ee0 +[ 5590.803089] PKRU: 55555554 +[ 5590.803091] Call Trace: +[ 5590.803093] +[ 5590.803096] error_state_read+0xa1/0xd0 [i915] +[ 5590.803175] kernfs_fop_read_iter+0xb2/0x1b0 +[ 5590.803180] new_sync_read+0x116/0x1a0 +[ 5590.803185] vfs_read+0x114/0x1b0 +[ 5590.803189] ksys_read+0x63/0xe0 +[ 5590.803193] do_syscall_64+0x38/0xc0 +[ 5590.803197] entry_SYSCALL_64_after_hwframe+0x44/0xae +[ 5590.803201] RIP: 0033:0x7f62aaea5912 +[ 5590.803204] Code: c0 e9 b2 fe ff ff 50 48 8d 3d 5a b9 0c 00 e8 05 + 19 02 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 + 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff + ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24 +[ 5590.803213] RSP: 002b:00007fff5b659ae8 EFLAGS: 00000246 + ORIG_RAX: 0000000000000000 +[ 5590.803218] RAX: ffffffffffffffda RBX: 0000000000100000 + RCX: 00007f62aaea5912 +[ 5590.803221] RDX: 000000000008b000 RSI: 00007f62a8c4000f + RDI: 0000000000000006 +[ 5590.803225] RBP: 00007f62a8bcb00f R08: 0000000000200010 + R09: 0000000000101000 +[ 5590.803229] R10: 0000000000000001 R11: 0000000000000246 + R12: 0000000000000006 +[ 5590.803233] R13: 0000000000075000 R14: 00007f62a8acb010 + R15: 0000000000200000 +[ 5590.803238] +[ 5590.803240] Modules linked in: i915 ttm drm_buddy drm_dp_helper + drm_kms_helper syscopyarea sysfillrect sysimgblt + fb_sys_fops prime_numbers nfnetlink br_netfilter + overlay mei_pxp mei_hdcp x86_pkg_temp_thermal + coretemp kvm_intel snd_hda_codec_hdmi snd_hda_intel + snd_intel_dspcfg snd_hda_codec snd_hwdep + snd_hda_core snd_pcm mei_me mei fuse ip_tables + x_tables crct10dif_pclmul e1000e crc32_pclmul ptp + i2c_i801 ghash_clmulni_intel i2c_smbus pps_core + [last unloa ded: ttm] +[ 5590.803277] CR2: ffffffffa0b0e000 +[ 5590.803280] ---[ end trace 0000000000000000 ]--- + +Fixes: 0e39037b3165 ("drm/i915: Cache the error string") +Signed-off-by: Alan Previn +Reviewed-by: John Harrison +Signed-off-by: John Harrison +Link: https://patchwork.freedesktop.org/patch/msgid/20220311004311.514198-2-alan.previn.teres.alexis@intel.com +(cherry picked from commit 3304033a1e69cd81a2044b4422f0d7e593afb4e6) +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/i915_sysfs.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/i915/i915_sysfs.c b/drivers/gpu/drm/i915/i915_sysfs.c +index a4d1759375b9..66a8880eaf19 100644 +--- a/drivers/gpu/drm/i915/i915_sysfs.c ++++ b/drivers/gpu/drm/i915/i915_sysfs.c +@@ -432,7 +432,14 @@ static ssize_t error_state_read(struct file *filp, struct kobject *kobj, + struct device *kdev = kobj_to_dev(kobj); + struct drm_i915_private *i915 = kdev_minor_to_i915(kdev); + struct i915_gpu_coredump *gpu; +- ssize_t ret; ++ ssize_t ret = 0; ++ ++ /* ++ * FIXME: Concurrent clients triggering resets and reading + clearing ++ * dumps can cause inconsistent sysfs reads when a user calls in with a ++ * non-zero offset to complete a prior partial read but the ++ * gpu_coredump has been cleared or replaced. ++ */ + + gpu = i915_first_error_state(i915); + if (IS_ERR(gpu)) { +@@ -444,8 +451,10 @@ static ssize_t error_state_read(struct file *filp, struct kobject *kobj, + const char *str = "No error state collected\n"; + size_t len = strlen(str); + +- ret = min_t(size_t, count, len - off); +- memcpy(buf, str + off, ret); ++ if (off < len) { ++ ret = min_t(size_t, count, len - off); ++ memcpy(buf, str + off, ret); ++ } + } + + return ret; +-- +2.35.1 + diff --git a/queue-5.18/i40e-fix-adding-adq-filter-to-tc0.patch b/queue-5.18/i40e-fix-adding-adq-filter-to-tc0.patch new file mode 100644 index 00000000000..b7c6547a07f --- /dev/null +++ b/queue-5.18/i40e-fix-adding-adq-filter-to-tc0.patch @@ -0,0 +1,45 @@ +From 7e63d06bc484a8c7792059662fa80bf49fecba67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Apr 2022 14:27:08 +0200 +Subject: i40e: Fix adding ADQ filter to TC0 + +From: Grzegorz Szczurek + +[ Upstream commit c3238d36c3a2be0a29a9d848d6c51e1b14be6692 ] + +Procedure of configure tc flower filters erroneously allows to create +filters on TC0 where unfiltered packets are also directed by default. +Issue was caused by insufficient checks of hw_tc parameter specifying +the hardware traffic class to pass matching packets to. + +Fix checking hw_tc parameter which blocks creation of filters on TC0. + +Fixes: 2f4b411a3d67 ("i40e: Enable cloud filters via tc-flower") +Signed-off-by: Grzegorz Szczurek +Signed-off-by: Jedrzej Jagielski +Tested-by: Bharathi Sreenivas +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 98871f014994..46bb1169a004 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -8537,6 +8537,11 @@ static int i40e_configure_clsflower(struct i40e_vsi *vsi, + return -EOPNOTSUPP; + } + ++ if (!tc) { ++ dev_err(&pf->pdev->dev, "Unable to add filter because of invalid destination"); ++ return -EINVAL; ++ } ++ + if (test_bit(__I40E_RESET_RECOVERY_PENDING, pf->state) || + test_bit(__I40E_RESET_INTR_RECEIVED, pf->state)) + return -EBUSY; +-- +2.35.1 + diff --git a/queue-5.18/i40e-fix-calculating-the-number-of-queue-pairs.patch b/queue-5.18/i40e-fix-calculating-the-number-of-queue-pairs.patch new file mode 100644 index 00000000000..2e0a51de477 --- /dev/null +++ b/queue-5.18/i40e-fix-calculating-the-number-of-queue-pairs.patch @@ -0,0 +1,41 @@ +From ec546d2a6c1f2f25d16a71156a1a06f8ce7b2a2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Apr 2022 14:40:23 +0200 +Subject: i40e: Fix calculating the number of queue pairs + +From: Grzegorz Szczurek + +[ Upstream commit 0bb050670ac90a167ecfa3f9590f92966c9a3677 ] + +If ADQ is enabled for a VF, then actual number of queue pair +is a number of currently available traffic classes for this VF. + +Without this change the configuration of the Rx/Tx queues +fails with error. + +Fixes: d29e0d233e0d ("i40e: missing input validation on VF message handling by the PF") +Signed-off-by: Grzegorz Szczurek +Signed-off-by: Jedrzej Jagielski +Tested-by: Bharathi Sreenivas +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index 2606e8f0f19b..033ea71763e3 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -2282,7 +2282,7 @@ static int i40e_vc_config_queues_msg(struct i40e_vf *vf, u8 *msg) + } + + if (vf->adq_enabled) { +- for (i = 0; i < I40E_MAX_VF_VSI; i++) ++ for (i = 0; i < vf->num_tc; i++) + num_qps_all += vf->ch[i].num_qps; + if (num_qps_all != qci->num_queue_pairs) { + aq_ret = I40E_ERR_PARAM; +-- +2.35.1 + diff --git a/queue-5.18/i40e-fix-call-trace-in-setup_tx_descriptors.patch b/queue-5.18/i40e-fix-call-trace-in-setup_tx_descriptors.patch new file mode 100644 index 00000000000..1502ec1b6c5 --- /dev/null +++ b/queue-5.18/i40e-fix-call-trace-in-setup_tx_descriptors.patch @@ -0,0 +1,83 @@ +From 41791d94e65fa53683364e3f5bde62ae7fe389e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 May 2022 16:01:45 +0200 +Subject: i40e: Fix call trace in setup_tx_descriptors + +From: Aleksandr Loktionov + +[ Upstream commit fd5855e6b1358e816710afee68a1d2bc685176ca ] + +After PF reset and ethtool -t there was call trace in dmesg +sometimes leading to panic. When there was some time, around 5 +seconds, between reset and test there were no errors. + +Problem was that pf reset calls i40e_vsi_close in prep_for_reset +and ethtool -t calls i40e_vsi_close in diag_test. If there was not +enough time between those commands the second i40e_vsi_close starts +before previous i40e_vsi_close was done which leads to crash. + +Add check to diag_test if pf is in reset and don't start offline +tests if it is true. +Add netif_info("testing failed") into unhappy path of i40e_diag_test() + +Fixes: e17bc411aea8 ("i40e: Disable offline diagnostics if VFs are enabled") +Fixes: 510efb2682b3 ("i40e: Fix ethtool offline diagnostic with netqueues") +Signed-off-by: Michal Jaron +Signed-off-by: Aleksandr Loktionov +Tested-by: Gurucharan (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + .../net/ethernet/intel/i40e/i40e_ethtool.c | 25 +++++++++++++------ + 1 file changed, 17 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +index e48499624d22..06c05a6b8b71 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +@@ -2584,15 +2584,16 @@ static void i40e_diag_test(struct net_device *netdev, + + set_bit(__I40E_TESTING, pf->state); + ++ if (test_bit(__I40E_RESET_RECOVERY_PENDING, pf->state) || ++ test_bit(__I40E_RESET_INTR_RECEIVED, pf->state)) { ++ dev_warn(&pf->pdev->dev, ++ "Cannot start offline testing when PF is in reset state.\n"); ++ goto skip_ol_tests; ++ } ++ + if (i40e_active_vfs(pf) || i40e_active_vmdqs(pf)) { + dev_warn(&pf->pdev->dev, + "Please take active VFs and Netqueues offline and restart the adapter before running NIC diagnostics\n"); +- data[I40E_ETH_TEST_REG] = 1; +- data[I40E_ETH_TEST_EEPROM] = 1; +- data[I40E_ETH_TEST_INTR] = 1; +- data[I40E_ETH_TEST_LINK] = 1; +- eth_test->flags |= ETH_TEST_FL_FAILED; +- clear_bit(__I40E_TESTING, pf->state); + goto skip_ol_tests; + } + +@@ -2639,9 +2640,17 @@ static void i40e_diag_test(struct net_device *netdev, + data[I40E_ETH_TEST_INTR] = 0; + } + +-skip_ol_tests: +- + netif_info(pf, drv, netdev, "testing finished\n"); ++ return; ++ ++skip_ol_tests: ++ data[I40E_ETH_TEST_REG] = 1; ++ data[I40E_ETH_TEST_EEPROM] = 1; ++ data[I40E_ETH_TEST_INTR] = 1; ++ data[I40E_ETH_TEST_LINK] = 1; ++ eth_test->flags |= ETH_TEST_FL_FAILED; ++ clear_bit(__I40E_TESTING, pf->state); ++ netif_info(pf, drv, netdev, "testing failed\n"); + } + + static void i40e_get_wol(struct net_device *netdev, +-- +2.35.1 + diff --git a/queue-5.18/iavf-fix-issue-with-mac-address-of-vf-shown-as-zero.patch b/queue-5.18/iavf-fix-issue-with-mac-address-of-vf-shown-as-zero.patch new file mode 100644 index 00000000000..ed22c5b1532 --- /dev/null +++ b/queue-5.18/iavf-fix-issue-with-mac-address-of-vf-shown-as-zero.patch @@ -0,0 +1,54 @@ +From 6003890a081976f33aba2c895b72e252e6f5cf11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 May 2022 13:19:27 +0200 +Subject: iavf: Fix issue with MAC address of VF shown as zero + +From: Michal Wilczynski + +[ Upstream commit 645603844270b69175899268be68b871295764fe ] + +After reinitialization of iavf, ice driver gets VIRTCHNL_OP_ADD_ETH_ADDR +message with incorrectly set type of MAC address. Hardware address should +have is_primary flag set as true. This way ice driver knows what it has +to set as a MAC address. + +Check if the address is primary in iavf_add_filter function and set flag +accordingly. + +To test set all-zero MAC on a VF. This triggers iavf re-initialization +and VIRTCHNL_OP_ADD_ETH_ADDR message gets sent to PF. +For example: + +ip link set dev ens785 vf 0 mac 00:00:00:00:00:00 + +This triggers re-initialization of iavf. New MAC should be assigned. +Now check if MAC is non-zero: + +ip link show dev ens785 + +Fixes: a3e839d539e0 ("iavf: Add usage of new virtchnl format to set default MAC") +Signed-off-by: Michal Wilczynski +Reviewed-by: Maciej Fijalkowski +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index 7dfcf78b57fb..f3ecb3bca33d 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -984,7 +984,7 @@ struct iavf_mac_filter *iavf_add_filter(struct iavf_adapter *adapter, + list_add_tail(&f->list, &adapter->mac_filter_list); + f->add = true; + f->is_new_mac = true; +- f->is_primary = false; ++ f->is_primary = ether_addr_equal(macaddr, adapter->hw.mac.addr); + adapter->aq_required |= IAVF_FLAG_AQ_ADD_MAC_FILTER; + } else { + f->remove = false; +-- +2.35.1 + diff --git a/queue-5.18/ice-fix-memory-corruption-in-vf-driver.patch b/queue-5.18/ice-fix-memory-corruption-in-vf-driver.patch new file mode 100644 index 00000000000..6a389f0d038 --- /dev/null +++ b/queue-5.18/ice-fix-memory-corruption-in-vf-driver.patch @@ -0,0 +1,84 @@ +From 7fed8208673cdede4cafcbf51a299d7354a26a1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jun 2022 12:09:17 +0200 +Subject: ice: Fix memory corruption in VF driver + +From: Przemyslaw Patynowski + +[ Upstream commit efe41860008e57fb6b69855b4b93fdf34bc42798 ] + +Disable VF's RX/TX queues, when it's disabled. VF can have queues enabled, +when it requests a reset. If PF driver assumes that VF is disabled, +while VF still has queues configured, VF may unmap DMA resources. +In such scenario device still can map packets to memory, which ends up +silently corrupting it. +Previously, VF driver could experience memory corruption, which lead to +crash: +[ 5119.170157] BUG: unable to handle kernel paging request at 00001b9780003237 +[ 5119.170166] PGD 0 P4D 0 +[ 5119.170173] Oops: 0002 [#1] PREEMPT_RT SMP PTI +[ 5119.170181] CPU: 30 PID: 427592 Comm: kworker/u96:2 Kdump: loaded Tainted: G W I --------- - - 4.18.0-372.9.1.rt7.166.el8.x86_64 #1 +[ 5119.170189] Hardware name: Dell Inc. PowerEdge R740/014X06, BIOS 2.3.10 08/15/2019 +[ 5119.170193] Workqueue: iavf iavf_adminq_task [iavf] +[ 5119.170219] RIP: 0010:__page_frag_cache_drain+0x5/0x30 +[ 5119.170238] Code: 0f 0f b6 77 51 85 f6 74 07 31 d2 e9 05 df ff ff e9 90 fe ff ff 48 8b 05 49 db 33 01 eb b4 0f 1f 80 00 00 00 00 0f 1f 44 00 00 29 77 34 74 01 c3 48 8b 07 f6 c4 80 74 0f 0f b6 77 51 85 f6 74 +[ 5119.170244] RSP: 0018:ffffa43b0bdcfd78 EFLAGS: 00010282 +[ 5119.170250] RAX: ffffffff896b3e40 RBX: ffff8fb282524000 RCX: 0000000000000002 +[ 5119.170254] RDX: 0000000049000000 RSI: 0000000000000000 RDI: 00001b9780003203 +[ 5119.170259] RBP: ffff8fb248217b00 R08: 0000000000000022 R09: 0000000000000009 +[ 5119.170262] R10: 2b849d6300000000 R11: 0000000000000020 R12: 0000000000000000 +[ 5119.170265] R13: 0000000000001000 R14: 0000000000000009 R15: 0000000000000000 +[ 5119.170269] FS: 0000000000000000(0000) GS:ffff8fb1201c0000(0000) knlGS:0000000000000000 +[ 5119.170274] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 5119.170279] CR2: 00001b9780003237 CR3: 00000008f3e1a003 CR4: 00000000007726e0 +[ 5119.170283] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 5119.170286] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 5119.170290] PKRU: 55555554 +[ 5119.170292] Call Trace: +[ 5119.170298] iavf_clean_rx_ring+0xad/0x110 [iavf] +[ 5119.170324] iavf_free_rx_resources+0xe/0x50 [iavf] +[ 5119.170342] iavf_free_all_rx_resources.part.51+0x30/0x40 [iavf] +[ 5119.170358] iavf_virtchnl_completion+0xd8a/0x15b0 [iavf] +[ 5119.170377] ? iavf_clean_arq_element+0x210/0x280 [iavf] +[ 5119.170397] iavf_adminq_task+0x126/0x2e0 [iavf] +[ 5119.170416] process_one_work+0x18f/0x420 +[ 5119.170429] worker_thread+0x30/0x370 +[ 5119.170437] ? process_one_work+0x420/0x420 +[ 5119.170445] kthread+0x151/0x170 +[ 5119.170452] ? set_kthread_struct+0x40/0x40 +[ 5119.170460] ret_from_fork+0x35/0x40 +[ 5119.170477] Modules linked in: iavf sctp ip6_udp_tunnel udp_tunnel mlx4_en mlx4_core nfp tls vhost_net vhost vhost_iotlb tap tun xt_CHECKSUM ipt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_counter nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink bridge stp llc rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache sunrpc intel_rapl_msr iTCO_wdt iTCO_vendor_support dell_smbios wmi_bmof dell_wmi_descriptor dcdbas kvm_intel kvm irqbypass intel_rapl_common isst_if_common skx_edac irdma nfit libnvdimm x86_pkg_temp_thermal i40e intel_powerclamp coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel ib_uverbs rapl ipmi_ssif intel_cstate intel_uncore mei_me pcspkr acpi_ipmi ib_core mei lpc_ich i2c_i801 ipmi_si ipmi_devintf wmi ipmi_msghandler acpi_power_meter xfs libcrc32c sd_mod t10_pi sg mgag200 drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ice ahci drm libahci crc32c_intel libata tg3 megaraid_sas +[ 5119.170613] i2c_algo_bit dm_mirror dm_region_hash dm_log dm_mod fuse [last unloaded: iavf] +[ 5119.170627] CR2: 00001b9780003237 + +Fixes: ec4f5a436bdf ("ice: Check if VF is disabled for Opcode and other operations") +Signed-off-by: Przemyslaw Patynowski +Co-developed-by: Slawomir Laba +Signed-off-by: Slawomir Laba +Signed-off-by: Mateusz Palczewski +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_vf_lib.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ethernet/intel/ice/ice_vf_lib.c b/drivers/net/ethernet/intel/ice/ice_vf_lib.c +index aefd66a4db80..9790df872c2a 100644 +--- a/drivers/net/ethernet/intel/ice/ice_vf_lib.c ++++ b/drivers/net/ethernet/intel/ice/ice_vf_lib.c +@@ -504,6 +504,11 @@ int ice_reset_vf(struct ice_vf *vf, u32 flags) + } + + if (ice_is_vf_disabled(vf)) { ++ vsi = ice_get_vf_vsi(vf); ++ if (WARN_ON(!vsi)) ++ return -EINVAL; ++ ice_vsi_stop_lan_tx_rings(vsi, ICE_NO_RESET, vf->vf_id); ++ ice_vsi_stop_all_rx_rings(vsi); + dev_dbg(dev, "VF is already disabled, there is no need for resetting it, telling VM, all is fine %d\n", + vf->vf_id); + return 0; +-- +2.35.1 + diff --git a/queue-5.18/ice-fix-ptp-tx-timestamp-offset-calculation.patch b/queue-5.18/ice-fix-ptp-tx-timestamp-offset-calculation.patch new file mode 100644 index 00000000000..66833268315 --- /dev/null +++ b/queue-5.18/ice-fix-ptp-tx-timestamp-offset-calculation.patch @@ -0,0 +1,89 @@ +From 5472806bf37dd7de6930d8604b519a69175a2020 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 May 2022 13:03:43 +0200 +Subject: ice: Fix PTP TX timestamp offset calculation + +From: Michal Michalik + +[ Upstream commit 71a579f0d3777a704355e6f1572dfba92a9b58b2 ] + +The offset was being incorrectly calculated for E822 - that led to +collisions in choosing TX timestamp register location when more than +one port was trying to use timestamping mechanism. + +In E822 one quad is being logically split between ports, so quad 0 is +having trackers for ports 0-3, quad 1 ports 4-7 etc. Each port should +have separate memory location for tracking timestamps. Due to error for +example ports 1 and 2 had been assigned to quad 0 with same offset (0), +while port 1 should have offset 0 and 1 offset 16. + +Fix it by correctly calculating quad offset. + +Fixes: 3a7496234d17 ("ice: implement basic E822 PTP support") +Signed-off-by: Michal Michalik +Tested-by: Gurucharan (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_ptp.c | 2 +- + drivers/net/ethernet/intel/ice/ice_ptp.h | 31 ++++++++++++++++++++++++ + 2 files changed, 32 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c +index 662947c882e8..ef9344ef0d8e 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ptp.c ++++ b/drivers/net/ethernet/intel/ice/ice_ptp.c +@@ -2271,7 +2271,7 @@ static int + ice_ptp_init_tx_e822(struct ice_pf *pf, struct ice_ptp_tx *tx, u8 port) + { + tx->quad = port / ICE_PORTS_PER_QUAD; +- tx->quad_offset = tx->quad * INDEX_PER_PORT; ++ tx->quad_offset = (port % ICE_PORTS_PER_QUAD) * INDEX_PER_PORT; + tx->len = INDEX_PER_PORT; + + return ice_ptp_alloc_tx_tracker(tx); +diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.h b/drivers/net/ethernet/intel/ice/ice_ptp.h +index afd048d69959..10e396abf130 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ptp.h ++++ b/drivers/net/ethernet/intel/ice/ice_ptp.h +@@ -49,6 +49,37 @@ struct ice_perout_channel { + * To allow multiple ports to access the shared register block independently, + * the blocks are split up so that indexes are assigned to each port based on + * hardware logical port number. ++ * ++ * The timestamp blocks are handled differently for E810- and E822-based ++ * devices. In E810 devices, each port has its own block of timestamps, while in ++ * E822 there is a need to logically break the block of registers into smaller ++ * chunks based on the port number to avoid collisions. ++ * ++ * Example for port 5 in E810: ++ * +--------+--------+--------+--------+--------+--------+--------+--------+ ++ * |register|register|register|register|register|register|register|register| ++ * | block | block | block | block | block | block | block | block | ++ * | for | for | for | for | for | for | for | for | ++ * | port 0 | port 1 | port 2 | port 3 | port 4 | port 5 | port 6 | port 7 | ++ * +--------+--------+--------+--------+--------+--------+--------+--------+ ++ * ^^ ++ * || ++ * |--- quad offset is always 0 ++ * ---- quad number ++ * ++ * Example for port 5 in E822: ++ * +-----------------------------+-----------------------------+ ++ * | register block for quad 0 | register block for quad 1 | ++ * |+------+------+------+------+|+------+------+------+------+| ++ * ||port 0|port 1|port 2|port 3|||port 0|port 1|port 2|port 3|| ++ * |+------+------+------+------+|+------+------+------+------+| ++ * +-----------------------------+-------^---------------------+ ++ * ^ | ++ * | --- quad offset* ++ * ---- quad number ++ * ++ * * PHY port 5 is port 1 in quad 1 ++ * + */ + + /** +-- +2.35.1 + diff --git a/queue-5.18/ice-fix-queue-config-fail-handling.patch b/queue-5.18/ice-fix-queue-config-fail-handling.patch new file mode 100644 index 00000000000..728dba98f57 --- /dev/null +++ b/queue-5.18/ice-fix-queue-config-fail-handling.patch @@ -0,0 +1,165 @@ +From c3e83eefcb651f4a438513e49053f154e06c846e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jun 2022 12:09:04 +0200 +Subject: ice: Fix queue config fail handling + +From: Przemyslaw Patynowski + +[ Upstream commit be2af71496a54a7195ac62caba6fab49cfe5006c ] + +Disable VF's RX/TX queues, when VIRTCHNL_OP_CONFIG_VSI_QUEUES fail. +Not disabling them might lead to scenario, where PF driver leaves VF +queues enabled, when VF's VSI failed queue config. +In this scenario VF should not have RX/TX queues enabled. If PF failed +to set up VF's queues, VF will reset due to TX timeouts in VF driver. +Initialize iterator 'i' to -1, so if error happens prior to configuring +queues then error path code will not disable queue 0. Loop that +configures queues will is using same iterator, so error path code will +only disable queues that were configured. + +Fixes: 77ca27c41705 ("ice: add support for virtchnl_queue_select.[tx|rx]_queues bitmap") +Suggested-by: Slawomir Laba +Signed-off-by: Przemyslaw Patynowski +Signed-off-by: Mateusz Palczewski +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_virtchnl.c | 53 +++++++++---------- + 1 file changed, 26 insertions(+), 27 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl.c b/drivers/net/ethernet/intel/ice/ice_virtchnl.c +index 5405a0e752cf..da7c5ce15be0 100644 +--- a/drivers/net/ethernet/intel/ice/ice_virtchnl.c ++++ b/drivers/net/ethernet/intel/ice/ice_virtchnl.c +@@ -1587,35 +1587,27 @@ static int ice_vc_cfg_irq_map_msg(struct ice_vf *vf, u8 *msg) + */ + static int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg) + { +- enum virtchnl_status_code v_ret = VIRTCHNL_STATUS_SUCCESS; + struct virtchnl_vsi_queue_config_info *qci = + (struct virtchnl_vsi_queue_config_info *)msg; + struct virtchnl_queue_pair_info *qpi; + struct ice_pf *pf = vf->pf; + struct ice_vsi *vsi; +- int i, q_idx; ++ int i = -1, q_idx; + +- if (!test_bit(ICE_VF_STATE_ACTIVE, vf->vf_states)) { +- v_ret = VIRTCHNL_STATUS_ERR_PARAM; ++ if (!test_bit(ICE_VF_STATE_ACTIVE, vf->vf_states)) + goto error_param; +- } + +- if (!ice_vc_isvalid_vsi_id(vf, qci->vsi_id)) { +- v_ret = VIRTCHNL_STATUS_ERR_PARAM; ++ if (!ice_vc_isvalid_vsi_id(vf, qci->vsi_id)) + goto error_param; +- } + + vsi = ice_get_vf_vsi(vf); +- if (!vsi) { +- v_ret = VIRTCHNL_STATUS_ERR_PARAM; ++ if (!vsi) + goto error_param; +- } + + if (qci->num_queue_pairs > ICE_MAX_RSS_QS_PER_VF || + qci->num_queue_pairs > min_t(u16, vsi->alloc_txq, vsi->alloc_rxq)) { + dev_err(ice_pf_to_dev(pf), "VF-%d requesting more than supported number of queues: %d\n", + vf->vf_id, min_t(u16, vsi->alloc_txq, vsi->alloc_rxq)); +- v_ret = VIRTCHNL_STATUS_ERR_PARAM; + goto error_param; + } + +@@ -1628,7 +1620,6 @@ static int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg) + !ice_vc_isvalid_ring_len(qpi->txq.ring_len) || + !ice_vc_isvalid_ring_len(qpi->rxq.ring_len) || + !ice_vc_isvalid_q_id(vf, qci->vsi_id, qpi->txq.queue_id)) { +- v_ret = VIRTCHNL_STATUS_ERR_PARAM; + goto error_param; + } + +@@ -1638,7 +1629,6 @@ static int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg) + * for selected "vsi" + */ + if (q_idx >= vsi->alloc_txq || q_idx >= vsi->alloc_rxq) { +- v_ret = VIRTCHNL_STATUS_ERR_PARAM; + goto error_param; + } + +@@ -1648,14 +1638,13 @@ static int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg) + vsi->tx_rings[i]->count = qpi->txq.ring_len; + + /* Disable any existing queue first */ +- if (ice_vf_vsi_dis_single_txq(vf, vsi, q_idx)) { +- v_ret = VIRTCHNL_STATUS_ERR_PARAM; ++ if (ice_vf_vsi_dis_single_txq(vf, vsi, q_idx)) + goto error_param; +- } + + /* Configure a queue with the requested settings */ + if (ice_vsi_cfg_single_txq(vsi, vsi->tx_rings, q_idx)) { +- v_ret = VIRTCHNL_STATUS_ERR_PARAM; ++ dev_warn(ice_pf_to_dev(pf), "VF-%d failed to configure TX queue %d\n", ++ vf->vf_id, i); + goto error_param; + } + } +@@ -1669,17 +1658,13 @@ static int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg) + + if (qpi->rxq.databuffer_size != 0 && + (qpi->rxq.databuffer_size > ((16 * 1024) - 128) || +- qpi->rxq.databuffer_size < 1024)) { +- v_ret = VIRTCHNL_STATUS_ERR_PARAM; ++ qpi->rxq.databuffer_size < 1024)) + goto error_param; +- } + vsi->rx_buf_len = qpi->rxq.databuffer_size; + vsi->rx_rings[i]->rx_buf_len = vsi->rx_buf_len; + if (qpi->rxq.max_pkt_size > max_frame_size || +- qpi->rxq.max_pkt_size < 64) { +- v_ret = VIRTCHNL_STATUS_ERR_PARAM; ++ qpi->rxq.max_pkt_size < 64) + goto error_param; +- } + + vsi->max_frame = qpi->rxq.max_pkt_size; + /* add space for the port VLAN since the VF driver is +@@ -1690,16 +1675,30 @@ static int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg) + vsi->max_frame += VLAN_HLEN; + + if (ice_vsi_cfg_single_rxq(vsi, q_idx)) { +- v_ret = VIRTCHNL_STATUS_ERR_PARAM; ++ dev_warn(ice_pf_to_dev(pf), "VF-%d failed to configure RX queue %d\n", ++ vf->vf_id, i); + goto error_param; + } + } + } + ++ /* send the response to the VF */ ++ return ice_vc_send_msg_to_vf(vf, VIRTCHNL_OP_CONFIG_VSI_QUEUES, ++ VIRTCHNL_STATUS_SUCCESS, NULL, 0); + error_param: ++ /* disable whatever we can */ ++ for (; i >= 0; i--) { ++ if (ice_vsi_ctrl_one_rx_ring(vsi, false, i, true)) ++ dev_err(ice_pf_to_dev(pf), "VF-%d could not disable RX queue %d\n", ++ vf->vf_id, i); ++ if (ice_vf_vsi_dis_single_txq(vf, vsi, i)) ++ dev_err(ice_pf_to_dev(pf), "VF-%d could not disable TX queue %d\n", ++ vf->vf_id, i); ++ } ++ + /* send the response to the VF */ +- return ice_vc_send_msg_to_vf(vf, VIRTCHNL_OP_CONFIG_VSI_QUEUES, v_ret, +- NULL, 0); ++ return ice_vc_send_msg_to_vf(vf, VIRTCHNL_OP_CONFIG_VSI_QUEUES, ++ VIRTCHNL_STATUS_ERR_PARAM, NULL, 0); + } + + /** +-- +2.35.1 + diff --git a/queue-5.18/ice-sync-vlan-filtering-features-for-dvm.patch b/queue-5.18/ice-sync-vlan-filtering-features-for-dvm.patch new file mode 100644 index 00000000000..90b6eef8867 --- /dev/null +++ b/queue-5.18/ice-sync-vlan-filtering-features-for-dvm.patch @@ -0,0 +1,90 @@ +From 9c5885c25b22285ebe7973a3f943b9e4fe84a7a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jun 2022 08:54:57 +0200 +Subject: ice: Sync VLAN filtering features for DVM + +From: Roman Storozhenko + +[ Upstream commit 9542ef4fba8c73e176b8aa18a8adf04aecb889e5 ] + +VLAN filtering features, that is C-Tag and S-Tag, in DVM mode must be +both enabled or disabled. +In case of turning off/on only one of the features, another feature must +be turned off/on automatically with issuing an appropriate message to +the kernel log. + +Fixes: 1babaf77f49d ("ice: Advertise 802.1ad VLAN filtering and offloads for PF netdev") +Signed-off-by: Roman Storozhenko +Co-developed-by: Anatolii Gerasymenko +Signed-off-by: Anatolii Gerasymenko +Tested-by: Gurucharan (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_main.c | 49 ++++++++++++++--------- + 1 file changed, 31 insertions(+), 18 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index 963a5f40e071..d069b19f9bf7 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -5746,25 +5746,38 @@ static netdev_features_t + ice_fix_features(struct net_device *netdev, netdev_features_t features) + { + struct ice_netdev_priv *np = netdev_priv(netdev); +- netdev_features_t supported_vlan_filtering; +- netdev_features_t requested_vlan_filtering; +- struct ice_vsi *vsi = np->vsi; +- +- requested_vlan_filtering = features & NETIF_VLAN_FILTERING_FEATURES; +- +- /* make sure supported_vlan_filtering works for both SVM and DVM */ +- supported_vlan_filtering = NETIF_F_HW_VLAN_CTAG_FILTER; +- if (ice_is_dvm_ena(&vsi->back->hw)) +- supported_vlan_filtering |= NETIF_F_HW_VLAN_STAG_FILTER; +- +- if (requested_vlan_filtering && +- requested_vlan_filtering != supported_vlan_filtering) { +- if (requested_vlan_filtering & NETIF_F_HW_VLAN_CTAG_FILTER) { +- netdev_warn(netdev, "cannot support requested VLAN filtering settings, enabling all supported VLAN filtering settings\n"); +- features |= supported_vlan_filtering; ++ netdev_features_t req_vlan_fltr, cur_vlan_fltr; ++ bool cur_ctag, cur_stag, req_ctag, req_stag; ++ ++ cur_vlan_fltr = netdev->features & NETIF_VLAN_FILTERING_FEATURES; ++ cur_ctag = cur_vlan_fltr & NETIF_F_HW_VLAN_CTAG_FILTER; ++ cur_stag = cur_vlan_fltr & NETIF_F_HW_VLAN_STAG_FILTER; ++ ++ req_vlan_fltr = features & NETIF_VLAN_FILTERING_FEATURES; ++ req_ctag = req_vlan_fltr & NETIF_F_HW_VLAN_CTAG_FILTER; ++ req_stag = req_vlan_fltr & NETIF_F_HW_VLAN_STAG_FILTER; ++ ++ if (req_vlan_fltr != cur_vlan_fltr) { ++ if (ice_is_dvm_ena(&np->vsi->back->hw)) { ++ if (req_ctag && req_stag) { ++ features |= NETIF_VLAN_FILTERING_FEATURES; ++ } else if (!req_ctag && !req_stag) { ++ features &= ~NETIF_VLAN_FILTERING_FEATURES; ++ } else if ((!cur_ctag && req_ctag && !cur_stag) || ++ (!cur_stag && req_stag && !cur_ctag)) { ++ features |= NETIF_VLAN_FILTERING_FEATURES; ++ netdev_warn(netdev, "802.1Q and 802.1ad VLAN filtering must be either both on or both off. VLAN filtering has been enabled for both types.\n"); ++ } else if ((cur_ctag && !req_ctag && cur_stag) || ++ (cur_stag && !req_stag && cur_ctag)) { ++ features &= ~NETIF_VLAN_FILTERING_FEATURES; ++ netdev_warn(netdev, "802.1Q and 802.1ad VLAN filtering must be either both on or both off. VLAN filtering has been disabled for both types.\n"); ++ } + } else { +- netdev_warn(netdev, "cannot support requested VLAN filtering settings, clearing all supported VLAN filtering settings\n"); +- features &= ~supported_vlan_filtering; ++ if (req_vlan_fltr & NETIF_F_HW_VLAN_STAG_FILTER) ++ netdev_warn(netdev, "cannot support requested 802.1ad filtering setting in SVM mode\n"); ++ ++ if (req_vlan_fltr & NETIF_F_HW_VLAN_CTAG_FILTER) ++ features |= NETIF_F_HW_VLAN_CTAG_FILTER; + } + } + +-- +2.35.1 + diff --git a/queue-5.18/init-initialize-noop_backing_dev_info-early.patch b/queue-5.18/init-initialize-noop_backing_dev_info-early.patch new file mode 100644 index 00000000000..8cdd5e74a75 --- /dev/null +++ b/queue-5.18/init-initialize-noop_backing_dev_info-early.patch @@ -0,0 +1,102 @@ +From 3036ee54a33c9c1d4ca77d911547cf26f67c1dc5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jun 2022 15:22:29 +0200 +Subject: init: Initialize noop_backing_dev_info early + +From: Jan Kara + +[ Upstream commit 4bca7e80b6455772b4bf3f536dcbc19aac424d6a ] + +noop_backing_dev_info is used by superblocks of various +pseudofilesystems such as kdevtmpfs. After commit 10e14073107d +("writeback: Fix inode->i_io_list not be protected by inode->i_lock +error") this broke because __mark_inode_dirty() started to access more +fields from noop_backing_dev_info and this led to crashes inside +locked_inode_to_wb_and_lock_list() called from __mark_inode_dirty(). +Fix the problem by initializing noop_backing_dev_info before the +filesystems get mounted. + +Fixes: 10e14073107d ("writeback: Fix inode->i_io_list not be protected by inode->i_lock error") +Reported-and-tested-by: Suzuki K Poulose +Reported-and-tested-by: Alexandru Elisei +Reported-and-tested-by: Guenter Roeck +Reviewed-by: Christoph Hellwig +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + drivers/base/init.c | 2 ++ + include/linux/backing-dev.h | 2 ++ + mm/backing-dev.c | 11 ++--------- + 3 files changed, 6 insertions(+), 9 deletions(-) + +diff --git a/drivers/base/init.c b/drivers/base/init.c +index d8d0fe687111..397eb9880cec 100644 +--- a/drivers/base/init.c ++++ b/drivers/base/init.c +@@ -8,6 +8,7 @@ + #include + #include + #include ++#include + + #include "base.h" + +@@ -20,6 +21,7 @@ + void __init driver_init(void) + { + /* These are the core pieces */ ++ bdi_init(&noop_backing_dev_info); + devtmpfs_init(); + devices_init(); + buses_init(); +diff --git a/include/linux/backing-dev.h b/include/linux/backing-dev.h +index 87ce24d238f3..8c2eed1b69c1 100644 +--- a/include/linux/backing-dev.h ++++ b/include/linux/backing-dev.h +@@ -121,6 +121,8 @@ int bdi_set_max_ratio(struct backing_dev_info *bdi, unsigned int max_ratio); + + extern struct backing_dev_info noop_backing_dev_info; + ++int bdi_init(struct backing_dev_info *bdi); ++ + /** + * writeback_in_progress - determine whether there is writeback in progress + * @wb: bdi_writeback of interest +diff --git a/mm/backing-dev.c b/mm/backing-dev.c +index 7176af65b103..e262739a0a23 100644 +--- a/mm/backing-dev.c ++++ b/mm/backing-dev.c +@@ -230,20 +230,13 @@ static __init int bdi_class_init(void) + } + postcore_initcall(bdi_class_init); + +-static int bdi_init(struct backing_dev_info *bdi); +- + static int __init default_bdi_init(void) + { +- int err; +- + bdi_wq = alloc_workqueue("writeback", WQ_MEM_RECLAIM | WQ_UNBOUND | + WQ_SYSFS, 0); + if (!bdi_wq) + return -ENOMEM; +- +- err = bdi_init(&noop_backing_dev_info); +- +- return err; ++ return 0; + } + subsys_initcall(default_bdi_init); + +@@ -782,7 +775,7 @@ static void cgwb_remove_from_bdi_list(struct bdi_writeback *wb) + + #endif /* CONFIG_CGROUP_WRITEBACK */ + +-static int bdi_init(struct backing_dev_info *bdi) ++int bdi_init(struct backing_dev_info *bdi) + { + int ret; + +-- +2.35.1 + diff --git a/queue-5.18/io_uring-fix-races-with-buffer-table-unregister.patch b/queue-5.18/io_uring-fix-races-with-buffer-table-unregister.patch new file mode 100644 index 00000000000..d194ae6f67d --- /dev/null +++ b/queue-5.18/io_uring-fix-races-with-buffer-table-unregister.patch @@ -0,0 +1,48 @@ +From 4b2ba4c9b8148563592663f341474355e3fe444a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jun 2022 06:30:06 +0100 +Subject: io_uring: fix races with buffer table unregister + +From: Pavel Begunkov + +[ Upstream commit d11d31fc5d8a96f707facee0babdcffaafa38de2 ] + +Fixed buffer table quiesce might unlock ->uring_lock, potentially +letting new requests to be submitted, don't allow those requests to +use the table as they will race with unregistration. + +Reported-and-tested-by: van fantasy +Fixes: bd54b6fe3316ec ("io_uring: implement fixed buffers registration similar to fixed files") +Signed-off-by: Pavel Begunkov +Signed-off-by: Sasha Levin +--- + fs/io_uring.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/fs/io_uring.c b/fs/io_uring.c +index 0a9f9000fc80..3d123ca028c9 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -9495,12 +9495,19 @@ static void __io_sqe_buffers_unregister(struct io_ring_ctx *ctx) + + static int io_sqe_buffers_unregister(struct io_ring_ctx *ctx) + { ++ unsigned nr = ctx->nr_user_bufs; + int ret; + + if (!ctx->buf_data) + return -ENXIO; + ++ /* ++ * Quiesce may unlock ->uring_lock, and while it's not held ++ * prevent new requests using the table. ++ */ ++ ctx->nr_user_bufs = 0; + ret = io_rsrc_ref_quiesce(ctx->buf_data, ctx); ++ ctx->nr_user_bufs = nr; + if (!ret) + __io_sqe_buffers_unregister(ctx); + return ret; +-- +2.35.1 + diff --git a/queue-5.18/io_uring-fix-races-with-file-table-unregister.patch b/queue-5.18/io_uring-fix-races-with-file-table-unregister.patch new file mode 100644 index 00000000000..af675b788d4 --- /dev/null +++ b/queue-5.18/io_uring-fix-races-with-file-table-unregister.patch @@ -0,0 +1,48 @@ +From bff6289889b6e794c4ed0c538e713c7cbc1a6486 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jun 2022 06:32:44 +0100 +Subject: io_uring: fix races with file table unregister + +From: Pavel Begunkov + +[ Upstream commit b0380bf6dad4601d92025841e2b7a135d566c6e3 ] + +Fixed file table quiesce might unlock ->uring_lock, potentially letting +new requests to be submitted, don't allow those requests to use the +table as they will race with unregistration. + +Reported-and-tested-by: van fantasy +Fixes: 05f3fb3c53975 ("io_uring: avoid ring quiesce for fixed file set unregister and update") +Signed-off-by: Pavel Begunkov +Signed-off-by: Sasha Levin +--- + fs/io_uring.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/fs/io_uring.c b/fs/io_uring.c +index 3582db014aad..0a9f9000fc80 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -8508,11 +8508,19 @@ static void __io_sqe_files_unregister(struct io_ring_ctx *ctx) + + static int io_sqe_files_unregister(struct io_ring_ctx *ctx) + { ++ unsigned nr = ctx->nr_user_files; + int ret; + + if (!ctx->file_data) + return -ENXIO; ++ ++ /* ++ * Quiesce may unlock ->uring_lock, and while it's not held ++ * prevent new requests using the table. ++ */ ++ ctx->nr_user_files = 0; + ret = io_rsrc_ref_quiesce(ctx->file_data, ctx); ++ ctx->nr_user_files = nr; + if (!ret) + __io_sqe_files_unregister(ctx); + return ret; +-- +2.35.1 + diff --git a/queue-5.18/misc-atmel-ssc-fix-irq-check-in-ssc_probe.patch b/queue-5.18/misc-atmel-ssc-fix-irq-check-in-ssc_probe.patch new file mode 100644 index 00000000000..64f13ac77a9 --- /dev/null +++ b/queue-5.18/misc-atmel-ssc-fix-irq-check-in-ssc_probe.patch @@ -0,0 +1,47 @@ +From 6ff2d9569084df35e328d666da766c1d7776e4e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jun 2022 16:30:26 +0400 +Subject: misc: atmel-ssc: Fix IRQ check in ssc_probe + +From: Miaoqian Lin + +[ Upstream commit 1c245358ce0b13669f6d1625f7a4e05c41f28980 ] + +platform_get_irq() returns negative error number instead 0 on failure. +And the doc of platform_get_irq() provides a usage example: + + int irq = platform_get_irq(pdev, 0); + if (irq < 0) + return irq; + +Fix the check of return value to catch errors correctly. + +Fixes: eb1f2930609b ("Driver for the Atmel on-chip SSC on AT32AP and AT91") +Reviewed-by: Claudiu Beznea +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220601123026.7119-1-linmq006@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/atmel-ssc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/misc/atmel-ssc.c b/drivers/misc/atmel-ssc.c +index d6cd5537126c..69f9b0336410 100644 +--- a/drivers/misc/atmel-ssc.c ++++ b/drivers/misc/atmel-ssc.c +@@ -232,9 +232,9 @@ static int ssc_probe(struct platform_device *pdev) + clk_disable_unprepare(ssc->clk); + + ssc->irq = platform_get_irq(pdev, 0); +- if (!ssc->irq) { ++ if (ssc->irq < 0) { + dev_dbg(&pdev->dev, "could not get irq\n"); +- return -ENXIO; ++ return ssc->irq; + } + + mutex_lock(&user_lock); +-- +2.35.1 + diff --git a/queue-5.18/mlxsw-spectrum_cnt-reorder-counter-pools.patch b/queue-5.18/mlxsw-spectrum_cnt-reorder-counter-pools.patch new file mode 100644 index 00000000000..39c6b64be46 --- /dev/null +++ b/queue-5.18/mlxsw-spectrum_cnt-reorder-counter-pools.patch @@ -0,0 +1,51 @@ +From 436923bf0ed12ca4cd3218ee0581a4eaab425142 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jun 2022 15:50:17 +0300 +Subject: mlxsw: spectrum_cnt: Reorder counter pools + +From: Petr Machata + +[ Upstream commit 4b7a632ac4e7101ceefee8484d5c2ca505d347b3 ] + +Both RIF and ACL flow counters use a 24-bit SW-managed counter address to +communicate which counter they want to bind. + +In a number of Spectrum FW releases, binding a RIF counter is broken and +slices the counter index to 16 bits. As a result, on Spectrum-2 and above, +no more than about 410 RIF counters can be effectively used. This +translates to 205 netdevices for which L3 HW stats can be enabled. (This +does not happen on Spectrum-1, because there are fewer counters available +overall and the counter index never exceeds 16 bits.) + +Binding counters to ACLs does not have this issue. Therefore reorder the +counter allocation scheme so that RIF counters come first and therefore get +lower indices that are below the 16-bit barrier. + +Fixes: 98e60dce4da1 ("Merge branch 'mlxsw-Introduce-initial-Spectrum-2-support'") +Reported-by: Maksym Yaremchuk +Signed-off-by: Petr Machata +Signed-off-by: Ido Schimmel +Link: https://lore.kernel.org/r/20220613125017.2018162-1-idosch@nvidia.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_cnt.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_cnt.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum_cnt.h +index a68d931090dd..15c8d4de8350 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_cnt.h ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_cnt.h +@@ -8,8 +8,8 @@ + #include "spectrum.h" + + enum mlxsw_sp_counter_sub_pool_id { +- MLXSW_SP_COUNTER_SUB_POOL_FLOW, + MLXSW_SP_COUNTER_SUB_POOL_RIF, ++ MLXSW_SP_COUNTER_SUB_POOL_FLOW, + }; + + int mlxsw_sp_counter_alloc(struct mlxsw_sp *mlxsw_sp, +-- +2.35.1 + diff --git a/queue-5.18/net-ax25-fix-deadlock-caused-by-skb_recv_datagram-in.patch b/queue-5.18/net-ax25-fix-deadlock-caused-by-skb_recv_datagram-in.patch new file mode 100644 index 00000000000..48689d6f86e --- /dev/null +++ b/queue-5.18/net-ax25-fix-deadlock-caused-by-skb_recv_datagram-in.patch @@ -0,0 +1,124 @@ +From df2251d9952a440adb27784798572a49525eedb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jun 2022 17:25:57 +0800 +Subject: net: ax25: Fix deadlock caused by skb_recv_datagram in ax25_recvmsg + +From: Duoming Zhou + +[ Upstream commit 219b51a6f040fa5367adadd7d58c4dda0896a01d ] + +The skb_recv_datagram() in ax25_recvmsg() will hold lock_sock +and block until it receives a packet from the remote. If the client +doesn`t connect to server and calls read() directly, it will not +receive any packets forever. As a result, the deadlock will happen. + +The fail log caused by deadlock is shown below: + +[ 369.606973] INFO: task ax25_deadlock:157 blocked for more than 245 seconds. +[ 369.608919] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 369.613058] Call Trace: +[ 369.613315] +[ 369.614072] __schedule+0x2f9/0xb20 +[ 369.615029] schedule+0x49/0xb0 +[ 369.615734] __lock_sock+0x92/0x100 +[ 369.616763] ? destroy_sched_domains_rcu+0x20/0x20 +[ 369.617941] lock_sock_nested+0x6e/0x70 +[ 369.618809] ax25_bind+0xaa/0x210 +[ 369.619736] __sys_bind+0xca/0xf0 +[ 369.620039] ? do_futex+0xae/0x1b0 +[ 369.620387] ? __x64_sys_futex+0x7c/0x1c0 +[ 369.620601] ? fpregs_assert_state_consistent+0x19/0x40 +[ 369.620613] __x64_sys_bind+0x11/0x20 +[ 369.621791] do_syscall_64+0x3b/0x90 +[ 369.622423] entry_SYSCALL_64_after_hwframe+0x46/0xb0 +[ 369.623319] RIP: 0033:0x7f43c8aa8af7 +[ 369.624301] RSP: 002b:00007f43c8197ef8 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 +[ 369.625756] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f43c8aa8af7 +[ 369.626724] RDX: 0000000000000010 RSI: 000055768e2021d0 RDI: 0000000000000005 +[ 369.628569] RBP: 00007f43c8197f00 R08: 0000000000000011 R09: 00007f43c8198700 +[ 369.630208] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff845e6afe +[ 369.632240] R13: 00007fff845e6aff R14: 00007f43c8197fc0 R15: 00007f43c8198700 + +This patch replaces skb_recv_datagram() with an open-coded variant of it +releasing the socket lock before the __skb_wait_for_more_packets() call +and re-acquiring it after such call in order that other functions that +need socket lock could be executed. + +what's more, the socket lock will be released only when recvmsg() will +block and that should produce nicer overall behavior. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Suggested-by: Thomas Osterried +Signed-off-by: Duoming Zhou +Reported-by: Thomas Habets +Acked-by: Paolo Abeni +Reviewed-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ax25/af_ax25.c | 33 ++++++++++++++++++++++++++++----- + 1 file changed, 28 insertions(+), 5 deletions(-) + +diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c +index 95393bb2760b..4c7030ed8d33 100644 +--- a/net/ax25/af_ax25.c ++++ b/net/ax25/af_ax25.c +@@ -1661,9 +1661,12 @@ static int ax25_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, + int flags) + { + struct sock *sk = sock->sk; +- struct sk_buff *skb; ++ struct sk_buff *skb, *last; ++ struct sk_buff_head *sk_queue; + int copied; + int err = 0; ++ int off = 0; ++ long timeo; + + lock_sock(sk); + /* +@@ -1675,10 +1678,29 @@ static int ax25_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, + goto out; + } + +- /* Now we can treat all alike */ +- skb = skb_recv_datagram(sk, flags, &err); +- if (skb == NULL) +- goto out; ++ /* We need support for non-blocking reads. */ ++ sk_queue = &sk->sk_receive_queue; ++ skb = __skb_try_recv_datagram(sk, sk_queue, flags, &off, &err, &last); ++ /* If no packet is available, release_sock(sk) and try again. */ ++ if (!skb) { ++ if (err != -EAGAIN) ++ goto out; ++ release_sock(sk); ++ timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT); ++ while (timeo && !__skb_wait_for_more_packets(sk, sk_queue, &err, ++ &timeo, last)) { ++ skb = __skb_try_recv_datagram(sk, sk_queue, flags, &off, ++ &err, &last); ++ if (skb) ++ break; ++ ++ if (err != -EAGAIN) ++ goto done; ++ } ++ if (!skb) ++ goto done; ++ lock_sock(sk); ++ } + + if (!sk_to_ax25(sk)->pidincl) + skb_pull(skb, 1); /* Remove PID */ +@@ -1725,6 +1747,7 @@ static int ax25_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, + out: + release_sock(sk); + ++done: + return err; + } + +-- +2.35.1 + diff --git a/queue-5.18/net-bgmac-fix-an-erroneous-kfree-in-bgmac_remove.patch b/queue-5.18/net-bgmac-fix-an-erroneous-kfree-in-bgmac_remove.patch new file mode 100644 index 00000000000..f79b1b255c1 --- /dev/null +++ b/queue-5.18/net-bgmac-fix-an-erroneous-kfree-in-bgmac_remove.patch @@ -0,0 +1,39 @@ +From 346e798923b19eaa7969808917fc897e63159be6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jun 2022 22:53:50 +0200 +Subject: net: bgmac: Fix an erroneous kfree() in bgmac_remove() + +From: Christophe JAILLET + +[ Upstream commit d7dd6eccfbc95ac47a12396f84e7e1b361db654b ] + +'bgmac' is part of a managed resource allocated with bgmac_alloc(). It +should not be freed explicitly. + +Remove the erroneous kfree() from the .remove() function. + +Fixes: 34a5102c3235 ("net: bgmac: allocate struct bgmac just once & don't copy it") +Signed-off-by: Christophe JAILLET +Reviewed-by: Florian Fainelli +Link: https://lore.kernel.org/r/a026153108dd21239036a032b95c25b5cece253b.1655153616.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bgmac-bcma.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bgmac-bcma.c b/drivers/net/ethernet/broadcom/bgmac-bcma.c +index e6f48786949c..02bd3cf9a260 100644 +--- a/drivers/net/ethernet/broadcom/bgmac-bcma.c ++++ b/drivers/net/ethernet/broadcom/bgmac-bcma.c +@@ -332,7 +332,6 @@ static void bgmac_remove(struct bcma_device *core) + bcma_mdio_mii_unregister(bgmac->mii_bus); + bgmac_enet_remove(bgmac); + bcma_set_drvdata(core, NULL); +- kfree(bgmac); + } + + static struct bcma_driver bgmac_bcma_driver = { +-- +2.35.1 + diff --git a/queue-5.18/net-hns3-don-t-push-link-state-to-vf-if-unalive.patch b/queue-5.18/net-hns3-don-t-push-link-state-to-vf-if-unalive.patch new file mode 100644 index 00000000000..99d388869c1 --- /dev/null +++ b/queue-5.18/net-hns3-don-t-push-link-state-to-vf-if-unalive.patch @@ -0,0 +1,41 @@ +From fc257a990d576e92b9be6b6865e296d23c802780 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Jun 2022 20:25:25 +0800 +Subject: net: hns3: don't push link state to VF if unalive + +From: Jian Shen + +[ Upstream commit 283847e3ef6dbf79bf67083b5ce7b8033e8b6f34 ] + +It's unnecessary to push link state to unalive VF, and the VF will +query link state from PF when it being start works. + +Fixes: 18b6e31f8bf4 ("net: hns3: PF add support for pushing link status to VFs") +Signed-off-by: Jian Shen +Signed-off-by: Guangbin Huang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index 5d1615e27a1c..c8c99ab60ec1 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -3384,6 +3384,12 @@ static int hclge_set_vf_link_state(struct hnae3_handle *handle, int vf, + link_state_old = vport->vf_info.link_state; + vport->vf_info.link_state = link_state; + ++ /* return success directly if the VF is unalive, VF will ++ * query link state itself when it starts work. ++ */ ++ if (!test_bit(HCLGE_VPORT_STATE_ALIVE, &vport->state)) ++ return 0; ++ + ret = hclge_push_vf_link_status(vport); + if (ret) { + vport->vf_info.link_state = link_state_old; +-- +2.35.1 + diff --git a/queue-5.18/net-hns3-fix-pf-rss-size-initialization-bug.patch b/queue-5.18/net-hns3-fix-pf-rss-size-initialization-bug.patch new file mode 100644 index 00000000000..3aed5fec952 --- /dev/null +++ b/queue-5.18/net-hns3-fix-pf-rss-size-initialization-bug.patch @@ -0,0 +1,40 @@ +From d2f1edcb94a582816a86680dff969d7b64a3b474 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Jun 2022 20:25:28 +0800 +Subject: net: hns3: fix PF rss size initialization bug + +From: Jie Wang + +[ Upstream commit 71b215f36dca1a3d5d1c576b2099e6d7ea03047e ] + +Currently hns3 driver misuses the VF rss size to initialize the PF rss size +in hclge_tm_vport_tc_info_update. So this patch fix it by checking the +vport id before initialization. + +Fixes: 7347255ea389 ("net: hns3: refactor PF rss get APIs with new common rss get APIs") +Signed-off-by: Jie Wang +Signed-off-by: Guangbin Huang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +index ad53a3447322..f5296ff60694 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +@@ -681,7 +681,9 @@ static void hclge_tm_vport_tc_info_update(struct hclge_vport *vport) + kinfo->num_tqps = hclge_vport_get_tqp_num(vport); + vport->dwrr = 100; /* 100 percent as init */ + vport->bw_limit = hdev->tm_info.pg_info[0].bw_limit; +- hdev->rss_cfg.rss_size = kinfo->rss_size; ++ ++ if (vport->vport_id == PF_VPORT_ID) ++ hdev->rss_cfg.rss_size = kinfo->rss_size; + + /* when enable mqprio, the tc_info has been updated. */ + if (kinfo->tc_info.mqprio_active) +-- +2.35.1 + diff --git a/queue-5.18/net-hns3-fix-tm-port-shapping-of-fibre-port-is-incor.patch b/queue-5.18/net-hns3-fix-tm-port-shapping-of-fibre-port-is-incor.patch new file mode 100644 index 00000000000..e5ab1dc8b18 --- /dev/null +++ b/queue-5.18/net-hns3-fix-tm-port-shapping-of-fibre-port-is-incor.patch @@ -0,0 +1,94 @@ +From d18c921f2b54ab14ec6c601cc58a42349bed24c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Jun 2022 20:25:29 +0800 +Subject: net: hns3: fix tm port shapping of fibre port is incorrect after + driver initialization + +From: Guangbin Huang + +[ Upstream commit 12a3670887725df364cc3e030cf3bede6f13b364 ] + +Currently in driver initialization process, driver will set shapping +parameters of tm port to default speed read from firmware. However, the +speed of SFP module may not be default speed, so shapping parameters of +tm port may be incorrect. + +To fix this problem, driver sets new shapping parameters for tm port +after getting exact speed of SFP module in this case. + +Fixes: 88d10bd6f730 ("net: hns3: add support for multiple media type") +Signed-off-by: Guangbin Huang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 11 ++++++++--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 2 +- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h | 1 + + 3 files changed, 10 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index c8c99ab60ec1..c0b4ff73128f 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -3276,7 +3276,7 @@ static int hclge_tp_port_init(struct hclge_dev *hdev) + static int hclge_update_port_info(struct hclge_dev *hdev) + { + struct hclge_mac *mac = &hdev->hw.mac; +- int speed = HCLGE_MAC_SPEED_UNKNOWN; ++ int speed; + int ret; + + /* get the port info from SFP cmd if not copper port */ +@@ -3287,10 +3287,13 @@ static int hclge_update_port_info(struct hclge_dev *hdev) + if (!hdev->support_sfp_query) + return 0; + +- if (hdev->ae_dev->dev_version >= HNAE3_DEVICE_VERSION_V2) ++ if (hdev->ae_dev->dev_version >= HNAE3_DEVICE_VERSION_V2) { ++ speed = mac->speed; + ret = hclge_get_sfp_info(hdev, mac); +- else ++ } else { ++ speed = HCLGE_MAC_SPEED_UNKNOWN; + ret = hclge_get_sfp_speed(hdev, &speed); ++ } + + if (ret == -EOPNOTSUPP) { + hdev->support_sfp_query = false; +@@ -3302,6 +3305,8 @@ static int hclge_update_port_info(struct hclge_dev *hdev) + if (hdev->ae_dev->dev_version >= HNAE3_DEVICE_VERSION_V2) { + if (mac->speed_type == QUERY_ACTIVE_SPEED) { + hclge_update_port_capability(hdev, mac); ++ if (mac->speed != speed) ++ (void)hclge_tm_port_shaper_cfg(hdev); + return 0; + } + return hclge_cfg_mac_speed_dup(hdev, mac->speed, +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +index f5296ff60694..2f33b036a47a 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +@@ -420,7 +420,7 @@ static int hclge_tm_pg_shapping_cfg(struct hclge_dev *hdev, + return hclge_cmd_send(&hdev->hw, &desc, 1); + } + +-static int hclge_tm_port_shaper_cfg(struct hclge_dev *hdev) ++int hclge_tm_port_shaper_cfg(struct hclge_dev *hdev) + { + struct hclge_port_shapping_cmd *shap_cfg_cmd; + struct hclge_shaper_ir_para ir_para; +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h +index 619cc30a2dfc..d943943912f7 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h +@@ -237,6 +237,7 @@ int hclge_pause_addr_cfg(struct hclge_dev *hdev, const u8 *mac_addr); + void hclge_pfc_rx_stats_get(struct hclge_dev *hdev, u64 *stats); + void hclge_pfc_tx_stats_get(struct hclge_dev *hdev, u64 *stats); + int hclge_tm_qs_shaper_cfg(struct hclge_vport *vport, int max_tx_rate); ++int hclge_tm_port_shaper_cfg(struct hclge_dev *hdev); + int hclge_tm_get_qset_num(struct hclge_dev *hdev, u16 *qset_num); + int hclge_tm_get_pri_num(struct hclge_dev *hdev, u8 *pri_num); + int hclge_tm_get_qset_map_pri(struct hclge_dev *hdev, u16 qset_id, u8 *priority, +-- +2.35.1 + diff --git a/queue-5.18/net-hns3-restore-tm-priority-qset-to-default-setting.patch b/queue-5.18/net-hns3-restore-tm-priority-qset-to-default-setting.patch new file mode 100644 index 00000000000..779a9c74b94 --- /dev/null +++ b/queue-5.18/net-hns3-restore-tm-priority-qset-to-default-setting.patch @@ -0,0 +1,248 @@ +From 1816db766609fce38c160ae091c6520c0470ff9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Jun 2022 20:25:27 +0800 +Subject: net: hns3: restore tm priority/qset to default settings when tc + disabled + +From: Guangbin Huang + +[ Upstream commit e93530ae0e5d8fcf2d908933d206e0c93bc3c09b ] + +Currently, settings parameters of schedule mode, dwrr, shaper of tm +priority or qset of one tc are only be set when tc is enabled, they are +not restored to the default settings when tc is disabled. It confuses +users when they cat tm_priority or tm_qset files of debugfs. So this +patch fixes it. + +Fixes: 848440544b41 ("net: hns3: Add support of TX Scheduler & Shaper to HNS3 driver") +Signed-off-by: Guangbin Huang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hnae3.h | 1 + + .../ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 95 +++++++++++++------ + 2 files changed, 65 insertions(+), 31 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h +index 79c64f4e67d2..3affcdb34c91 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h +@@ -765,6 +765,7 @@ struct hnae3_tc_info { + u8 prio_tc[HNAE3_MAX_USER_PRIO]; /* TC indexed by prio */ + u16 tqp_count[HNAE3_MAX_TC]; + u16 tqp_offset[HNAE3_MAX_TC]; ++ u8 max_tc; /* Total number of TCs */ + u8 num_tc; /* Total number of enabled TCs */ + bool mqprio_active; + }; +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +index 1f87a8a3fe32..ad53a3447322 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +@@ -282,8 +282,8 @@ static int hclge_tm_pg_to_pri_map_cfg(struct hclge_dev *hdev, + return hclge_cmd_send(&hdev->hw, &desc, 1); + } + +-static int hclge_tm_qs_to_pri_map_cfg(struct hclge_dev *hdev, +- u16 qs_id, u8 pri) ++static int hclge_tm_qs_to_pri_map_cfg(struct hclge_dev *hdev, u16 qs_id, u8 pri, ++ bool link_vld) + { + struct hclge_qs_to_pri_link_cmd *map; + struct hclge_desc desc; +@@ -294,7 +294,7 @@ static int hclge_tm_qs_to_pri_map_cfg(struct hclge_dev *hdev, + + map->qs_id = cpu_to_le16(qs_id); + map->priority = pri; +- map->link_vld = HCLGE_TM_QS_PRI_LINK_VLD_MSK; ++ map->link_vld = link_vld ? HCLGE_TM_QS_PRI_LINK_VLD_MSK : 0; + + return hclge_cmd_send(&hdev->hw, &desc, 1); + } +@@ -642,11 +642,13 @@ static void hclge_tm_update_kinfo_rss_size(struct hclge_vport *vport) + * one tc for VF for simplicity. VF's vport_id is non zero. + */ + if (vport->vport_id) { ++ kinfo->tc_info.max_tc = 1; + kinfo->tc_info.num_tc = 1; + vport->qs_offset = HNAE3_MAX_TC + + vport->vport_id - HCLGE_VF_VPORT_START_NUM; + vport_max_rss_size = hdev->vf_rss_size_max; + } else { ++ kinfo->tc_info.max_tc = hdev->tc_max; + kinfo->tc_info.num_tc = + min_t(u16, vport->alloc_tqps, hdev->tm_info.num_tc); + vport->qs_offset = 0; +@@ -714,14 +716,22 @@ static void hclge_tm_vport_info_update(struct hclge_dev *hdev) + + static void hclge_tm_tc_info_init(struct hclge_dev *hdev) + { +- u8 i; ++ u8 i, tc_sch_mode; ++ u32 bw_limit; ++ ++ for (i = 0; i < hdev->tc_max; i++) { ++ if (i < hdev->tm_info.num_tc) { ++ tc_sch_mode = HCLGE_SCH_MODE_DWRR; ++ bw_limit = hdev->tm_info.pg_info[0].bw_limit; ++ } else { ++ tc_sch_mode = HCLGE_SCH_MODE_SP; ++ bw_limit = 0; ++ } + +- for (i = 0; i < hdev->tm_info.num_tc; i++) { + hdev->tm_info.tc_info[i].tc_id = i; +- hdev->tm_info.tc_info[i].tc_sch_mode = HCLGE_SCH_MODE_DWRR; ++ hdev->tm_info.tc_info[i].tc_sch_mode = tc_sch_mode; + hdev->tm_info.tc_info[i].pgid = 0; +- hdev->tm_info.tc_info[i].bw_limit = +- hdev->tm_info.pg_info[0].bw_limit; ++ hdev->tm_info.tc_info[i].bw_limit = bw_limit; + } + + for (i = 0; i < HNAE3_MAX_USER_PRIO; i++) +@@ -926,10 +936,13 @@ static int hclge_tm_pri_q_qs_cfg_tc_base(struct hclge_dev *hdev) + for (k = 0; k < hdev->num_alloc_vport; k++) { + struct hnae3_knic_private_info *kinfo = &vport[k].nic.kinfo; + +- for (i = 0; i < kinfo->tc_info.num_tc; i++) { ++ for (i = 0; i < kinfo->tc_info.max_tc; i++) { ++ u8 pri = i < kinfo->tc_info.num_tc ? i : 0; ++ bool link_vld = i < kinfo->tc_info.num_tc; ++ + ret = hclge_tm_qs_to_pri_map_cfg(hdev, + vport[k].qs_offset + i, +- i); ++ pri, link_vld); + if (ret) + return ret; + } +@@ -949,7 +962,7 @@ static int hclge_tm_pri_q_qs_cfg_vnet_base(struct hclge_dev *hdev) + for (i = 0; i < HNAE3_MAX_TC; i++) { + ret = hclge_tm_qs_to_pri_map_cfg(hdev, + vport[k].qs_offset + i, +- k); ++ k, true); + if (ret) + return ret; + } +@@ -989,33 +1002,39 @@ static int hclge_tm_pri_tc_base_shaper_cfg(struct hclge_dev *hdev) + { + u32 max_tm_rate = hdev->ae_dev->dev_specs.max_tm_rate; + struct hclge_shaper_ir_para ir_para; +- u32 shaper_para; ++ u32 shaper_para_c, shaper_para_p; + int ret; + u32 i; + +- for (i = 0; i < hdev->tm_info.num_tc; i++) { ++ for (i = 0; i < hdev->tc_max; i++) { + u32 rate = hdev->tm_info.tc_info[i].bw_limit; + +- ret = hclge_shaper_para_calc(rate, HCLGE_SHAPER_LVL_PRI, +- &ir_para, max_tm_rate); +- if (ret) +- return ret; ++ if (rate) { ++ ret = hclge_shaper_para_calc(rate, HCLGE_SHAPER_LVL_PRI, ++ &ir_para, max_tm_rate); ++ if (ret) ++ return ret; ++ ++ shaper_para_c = hclge_tm_get_shapping_para(0, 0, 0, ++ HCLGE_SHAPER_BS_U_DEF, ++ HCLGE_SHAPER_BS_S_DEF); ++ shaper_para_p = hclge_tm_get_shapping_para(ir_para.ir_b, ++ ir_para.ir_u, ++ ir_para.ir_s, ++ HCLGE_SHAPER_BS_U_DEF, ++ HCLGE_SHAPER_BS_S_DEF); ++ } else { ++ shaper_para_c = 0; ++ shaper_para_p = 0; ++ } + +- shaper_para = hclge_tm_get_shapping_para(0, 0, 0, +- HCLGE_SHAPER_BS_U_DEF, +- HCLGE_SHAPER_BS_S_DEF); + ret = hclge_tm_pri_shapping_cfg(hdev, HCLGE_TM_SHAP_C_BUCKET, i, +- shaper_para, rate); ++ shaper_para_c, rate); + if (ret) + return ret; + +- shaper_para = hclge_tm_get_shapping_para(ir_para.ir_b, +- ir_para.ir_u, +- ir_para.ir_s, +- HCLGE_SHAPER_BS_U_DEF, +- HCLGE_SHAPER_BS_S_DEF); + ret = hclge_tm_pri_shapping_cfg(hdev, HCLGE_TM_SHAP_P_BUCKET, i, +- shaper_para, rate); ++ shaper_para_p, rate); + if (ret) + return ret; + } +@@ -1125,7 +1144,7 @@ static int hclge_tm_pri_tc_base_dwrr_cfg(struct hclge_dev *hdev) + int ret; + u32 i, k; + +- for (i = 0; i < hdev->tm_info.num_tc; i++) { ++ for (i = 0; i < hdev->tc_max; i++) { + pg_info = + &hdev->tm_info.pg_info[hdev->tm_info.tc_info[i].pgid]; + dwrr = pg_info->tc_dwrr[i]; +@@ -1135,9 +1154,15 @@ static int hclge_tm_pri_tc_base_dwrr_cfg(struct hclge_dev *hdev) + return ret; + + for (k = 0; k < hdev->num_alloc_vport; k++) { ++ struct hnae3_knic_private_info *kinfo = &vport[k].nic.kinfo; ++ ++ if (i >= kinfo->tc_info.max_tc) ++ continue; ++ ++ dwrr = i < kinfo->tc_info.num_tc ? vport[k].dwrr : 0; + ret = hclge_tm_qs_weight_cfg( + hdev, vport[k].qs_offset + i, +- vport[k].dwrr); ++ dwrr); + if (ret) + return ret; + } +@@ -1303,6 +1328,7 @@ static int hclge_tm_schd_mode_tc_base_cfg(struct hclge_dev *hdev, u8 pri_id) + { + struct hclge_vport *vport = hdev->vport; + int ret; ++ u8 mode; + u16 i; + + ret = hclge_tm_pri_schd_mode_cfg(hdev, pri_id); +@@ -1310,9 +1336,16 @@ static int hclge_tm_schd_mode_tc_base_cfg(struct hclge_dev *hdev, u8 pri_id) + return ret; + + for (i = 0; i < hdev->num_alloc_vport; i++) { ++ struct hnae3_knic_private_info *kinfo = &vport[i].nic.kinfo; ++ ++ if (pri_id >= kinfo->tc_info.max_tc) ++ continue; ++ ++ mode = pri_id < kinfo->tc_info.num_tc ? HCLGE_SCH_MODE_DWRR : ++ HCLGE_SCH_MODE_SP; + ret = hclge_tm_qs_schd_mode_cfg(hdev, + vport[i].qs_offset + pri_id, +- HCLGE_SCH_MODE_DWRR); ++ mode); + if (ret) + return ret; + } +@@ -1353,7 +1386,7 @@ static int hclge_tm_lvl34_schd_mode_cfg(struct hclge_dev *hdev) + u8 i; + + if (hdev->tx_sch_mode == HCLGE_FLAG_TC_BASE_SCH_MODE) { +- for (i = 0; i < hdev->tm_info.num_tc; i++) { ++ for (i = 0; i < hdev->tc_max; i++) { + ret = hclge_tm_schd_mode_tc_base_cfg(hdev, i); + if (ret) + return ret; +-- +2.35.1 + diff --git a/queue-5.18/net-hns3-set-port-base-vlan-tbl_sta-to-false-before-.patch b/queue-5.18/net-hns3-set-port-base-vlan-tbl_sta-to-false-before-.patch new file mode 100644 index 00000000000..20fc2c3bd18 --- /dev/null +++ b/queue-5.18/net-hns3-set-port-base-vlan-tbl_sta-to-false-before-.patch @@ -0,0 +1,36 @@ +From f2e938d3f94e2c81f3345d8a36746f9afc2794e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Jun 2022 20:25:24 +0800 +Subject: net: hns3: set port base vlan tbl_sta to false before removing old + vlan + +From: Guangbin Huang + +[ Upstream commit 9eda7d8bcbdb6909f202edeedff51948f1cad1e5 ] + +When modify port base vlan, the port base vlan tbl_sta needs to set to +false before removing old vlan, to indicate this operation is not finish. + +Fixes: c0f46de30c96 ("net: hns3: fix port base vlan add fail when concurrent with reset") +Signed-off-by: Guangbin Huang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index 8cebb180c812..5d1615e27a1c 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -10136,6 +10136,7 @@ static int hclge_modify_port_base_vlan_tag(struct hclge_vport *vport, + if (ret) + return ret; + ++ vport->port_base_vlan_cfg.tbl_sta = false; + /* remove old VLAN tag */ + if (old_info->vlan_tag == 0) + ret = hclge_set_vf_vlan_common(hdev, vport->vport_id, +-- +2.35.1 + diff --git a/queue-5.18/net-remove-noblock-parameter-from-skb_recv_datagram.patch b/queue-5.18/net-remove-noblock-parameter-from-skb_recv_datagram.patch new file mode 100644 index 00000000000..4555e2409af --- /dev/null +++ b/queue-5.18/net-remove-noblock-parameter-from-skb_recv_datagram.patch @@ -0,0 +1,716 @@ +From 7143c10150fcf20a47ab2f0332c9d52ffd6bf27d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Apr 2022 18:30:22 +0200 +Subject: net: remove noblock parameter from skb_recv_datagram() + +From: Oliver Hartkopp + +[ Upstream commit f4b41f062c424209e3939a81e6da022e049a45f2 ] + +skb_recv_datagram() has two parameters 'flags' and 'noblock' that are +merged inside skb_recv_datagram() by 'flags | (noblock ? MSG_DONTWAIT : 0)' + +As 'flags' may contain MSG_DONTWAIT as value most callers split the 'flags' +into 'flags' and 'noblock' with finally obsolete bit operations like this: + +skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, flags & MSG_DONTWAIT, &rc); + +And this is not even done consistently with the 'flags' parameter. + +This patch removes the obsolete and costly splitting into two parameters +and only performs bit operations when really needed on the caller side. + +One missing conversion thankfully reported by kernel test robot. I missed +to enable kunit tests to build the mctp code. + +Reported-by: kernel test robot +Signed-off-by: Oliver Hartkopp +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/isdn/mISDN/socket.c | 2 +- + drivers/net/ppp/pppoe.c | 3 +-- + include/linux/skbuff.h | 3 +-- + net/appletalk/ddp.c | 3 +-- + net/atm/common.c | 2 +- + net/ax25/af_ax25.c | 3 +-- + net/bluetooth/af_bluetooth.c | 3 +-- + net/bluetooth/hci_sock.c | 3 +-- + net/caif/caif_socket.c | 2 +- + net/can/bcm.c | 5 +---- + net/can/isotp.c | 4 +--- + net/can/j1939/socket.c | 2 +- + net/can/raw.c | 6 +----- + net/core/datagram.c | 5 ++--- + net/ieee802154/socket.c | 6 ++++-- + net/ipv4/ping.c | 3 ++- + net/ipv4/raw.c | 3 ++- + net/ipv6/raw.c | 3 ++- + net/iucv/af_iucv.c | 3 +-- + net/key/af_key.c | 2 +- + net/l2tp/l2tp_ip.c | 3 ++- + net/l2tp/l2tp_ip6.c | 3 ++- + net/l2tp/l2tp_ppp.c | 3 +-- + net/mctp/af_mctp.c | 2 +- + net/mctp/test/route-test.c | 8 ++++---- + net/netlink/af_netlink.c | 3 +-- + net/netrom/af_netrom.c | 3 ++- + net/nfc/llcp_sock.c | 3 +-- + net/nfc/rawsock.c | 3 +-- + net/packet/af_packet.c | 2 +- + net/phonet/datagram.c | 3 ++- + net/phonet/pep.c | 6 ++++-- + net/qrtr/af_qrtr.c | 3 +-- + net/rose/af_rose.c | 3 ++- + net/unix/af_unix.c | 5 +++-- + net/vmw_vsock/vmci_transport.c | 5 +---- + net/x25/af_x25.c | 3 +-- + 37 files changed, 57 insertions(+), 70 deletions(-) + +diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c +index a6606736d8c5..2776ca5fc33f 100644 +--- a/drivers/isdn/mISDN/socket.c ++++ b/drivers/isdn/mISDN/socket.c +@@ -121,7 +121,7 @@ mISDN_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + if (sk->sk_state == MISDN_CLOSED) + return 0; + +- skb = skb_recv_datagram(sk, flags, flags & MSG_DONTWAIT, &err); ++ skb = skb_recv_datagram(sk, flags, &err); + if (!skb) + return err; + +diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c +index e172743948ed..ce2cbb5903d7 100644 +--- a/drivers/net/ppp/pppoe.c ++++ b/drivers/net/ppp/pppoe.c +@@ -1012,8 +1012,7 @@ static int pppoe_recvmsg(struct socket *sock, struct msghdr *m, + goto end; + } + +- skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, +- flags & MSG_DONTWAIT, &error); ++ skb = skb_recv_datagram(sk, flags, &error); + if (error < 0) + goto end; + +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index 3a30cae8b0a5..2394441fa3dd 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -3836,8 +3836,7 @@ struct sk_buff *__skb_try_recv_datagram(struct sock *sk, + struct sk_buff *__skb_recv_datagram(struct sock *sk, + struct sk_buff_head *sk_queue, + unsigned int flags, int *off, int *err); +-struct sk_buff *skb_recv_datagram(struct sock *sk, unsigned flags, int noblock, +- int *err); ++struct sk_buff *skb_recv_datagram(struct sock *sk, unsigned int flags, int *err); + __poll_t datagram_poll(struct file *file, struct socket *sock, + struct poll_table_struct *wait); + int skb_copy_datagram_iter(const struct sk_buff *from, int offset, +diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c +index bf5736c1d458..a06f4d4a6f47 100644 +--- a/net/appletalk/ddp.c ++++ b/net/appletalk/ddp.c +@@ -1753,8 +1753,7 @@ static int atalk_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, + int err = 0; + struct sk_buff *skb; + +- skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, +- flags & MSG_DONTWAIT, &err); ++ skb = skb_recv_datagram(sk, flags, &err); + lock_sock(sk); + + if (!skb) +diff --git a/net/atm/common.c b/net/atm/common.c +index 1cfa9bf1d187..d0c8ab7ff8f6 100644 +--- a/net/atm/common.c ++++ b/net/atm/common.c +@@ -540,7 +540,7 @@ int vcc_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, + !test_bit(ATM_VF_READY, &vcc->flags)) + return 0; + +- skb = skb_recv_datagram(sk, flags, flags & MSG_DONTWAIT, &error); ++ skb = skb_recv_datagram(sk, flags, &error); + if (!skb) + return error; + +diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c +index 289f355e1853..95393bb2760b 100644 +--- a/net/ax25/af_ax25.c ++++ b/net/ax25/af_ax25.c +@@ -1676,8 +1676,7 @@ static int ax25_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, + } + + /* Now we can treat all alike */ +- skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, +- flags & MSG_DONTWAIT, &err); ++ skb = skb_recv_datagram(sk, flags, &err); + if (skb == NULL) + goto out; + +diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c +index a0cb2e3da8d4..62705734343b 100644 +--- a/net/bluetooth/af_bluetooth.c ++++ b/net/bluetooth/af_bluetooth.c +@@ -251,7 +251,6 @@ EXPORT_SYMBOL(bt_accept_dequeue); + int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + int flags) + { +- int noblock = flags & MSG_DONTWAIT; + struct sock *sk = sock->sk; + struct sk_buff *skb; + size_t copied; +@@ -263,7 +262,7 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + if (flags & MSG_OOB) + return -EOPNOTSUPP; + +- skb = skb_recv_datagram(sk, flags, noblock, &err); ++ skb = skb_recv_datagram(sk, flags, &err); + if (!skb) { + if (sk->sk_shutdown & RCV_SHUTDOWN) + return 0; +diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c +index 33b3c0ffc339..189e3115c8c6 100644 +--- a/net/bluetooth/hci_sock.c ++++ b/net/bluetooth/hci_sock.c +@@ -1453,7 +1453,6 @@ static void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, + static int hci_sock_recvmsg(struct socket *sock, struct msghdr *msg, + size_t len, int flags) + { +- int noblock = flags & MSG_DONTWAIT; + struct sock *sk = sock->sk; + struct sk_buff *skb; + int copied, err; +@@ -1470,7 +1469,7 @@ static int hci_sock_recvmsg(struct socket *sock, struct msghdr *msg, + if (sk->sk_state == BT_CLOSED) + return 0; + +- skb = skb_recv_datagram(sk, flags, noblock, &err); ++ skb = skb_recv_datagram(sk, flags, &err); + if (!skb) + return err; + +diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c +index 2b8892d502f7..251e666ba9a2 100644 +--- a/net/caif/caif_socket.c ++++ b/net/caif/caif_socket.c +@@ -282,7 +282,7 @@ static int caif_seqpkt_recvmsg(struct socket *sock, struct msghdr *m, + if (flags & MSG_OOB) + goto read_error; + +- skb = skb_recv_datagram(sk, flags, 0 , &ret); ++ skb = skb_recv_datagram(sk, flags, &ret); + if (!skb) + goto read_error; + copylen = skb->len; +diff --git a/net/can/bcm.c b/net/can/bcm.c +index 95d209b52e6a..64c07e650bb4 100644 +--- a/net/can/bcm.c ++++ b/net/can/bcm.c +@@ -1632,12 +1632,9 @@ static int bcm_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, + struct sock *sk = sock->sk; + struct sk_buff *skb; + int error = 0; +- int noblock; + int err; + +- noblock = flags & MSG_DONTWAIT; +- flags &= ~MSG_DONTWAIT; +- skb = skb_recv_datagram(sk, flags, noblock, &error); ++ skb = skb_recv_datagram(sk, flags, &error); + if (!skb) + return error; + +diff --git a/net/can/isotp.c b/net/can/isotp.c +index 1e7c6a460ef9..35a1ae61744c 100644 +--- a/net/can/isotp.c ++++ b/net/can/isotp.c +@@ -1055,7 +1055,6 @@ static int isotp_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, + struct sock *sk = sock->sk; + struct sk_buff *skb; + struct isotp_sock *so = isotp_sk(sk); +- int noblock = flags & MSG_DONTWAIT; + int ret = 0; + + if (flags & ~(MSG_DONTWAIT | MSG_TRUNC | MSG_PEEK)) +@@ -1064,8 +1063,7 @@ static int isotp_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, + if (!so->bound) + return -EADDRNOTAVAIL; + +- flags &= ~MSG_DONTWAIT; +- skb = skb_recv_datagram(sk, flags, noblock, &ret); ++ skb = skb_recv_datagram(sk, flags, &ret); + if (!skb) + return ret; + +diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c +index 6dff4510687a..0bb4fd3f6264 100644 +--- a/net/can/j1939/socket.c ++++ b/net/can/j1939/socket.c +@@ -802,7 +802,7 @@ static int j1939_sk_recvmsg(struct socket *sock, struct msghdr *msg, + return sock_recv_errqueue(sock->sk, msg, size, SOL_CAN_J1939, + SCM_J1939_ERRQUEUE); + +- skb = skb_recv_datagram(sk, flags, 0, &ret); ++ skb = skb_recv_datagram(sk, flags, &ret); + if (!skb) + return ret; + +diff --git a/net/can/raw.c b/net/can/raw.c +index 7105fa4824e4..0cf728dcff36 100644 +--- a/net/can/raw.c ++++ b/net/can/raw.c +@@ -846,16 +846,12 @@ static int raw_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, + struct sock *sk = sock->sk; + struct sk_buff *skb; + int err = 0; +- int noblock; +- +- noblock = flags & MSG_DONTWAIT; +- flags &= ~MSG_DONTWAIT; + + if (flags & MSG_ERRQUEUE) + return sock_recv_errqueue(sk, msg, size, + SOL_CAN_RAW, SCM_CAN_RAW_ERRQUEUE); + +- skb = skb_recv_datagram(sk, flags, noblock, &err); ++ skb = skb_recv_datagram(sk, flags, &err); + if (!skb) + return err; + +diff --git a/net/core/datagram.c b/net/core/datagram.c +index ee290776c661..70126d15ca6e 100644 +--- a/net/core/datagram.c ++++ b/net/core/datagram.c +@@ -310,12 +310,11 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, + EXPORT_SYMBOL(__skb_recv_datagram); + + struct sk_buff *skb_recv_datagram(struct sock *sk, unsigned int flags, +- int noblock, int *err) ++ int *err) + { + int off = 0; + +- return __skb_recv_datagram(sk, &sk->sk_receive_queue, +- flags | (noblock ? MSG_DONTWAIT : 0), ++ return __skb_recv_datagram(sk, &sk->sk_receive_queue, flags, + &off, err); + } + EXPORT_SYMBOL(skb_recv_datagram); +diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c +index 3b2366a88c3c..a725dd9bbda8 100644 +--- a/net/ieee802154/socket.c ++++ b/net/ieee802154/socket.c +@@ -314,7 +314,8 @@ static int raw_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, + int err = -EOPNOTSUPP; + struct sk_buff *skb; + +- skb = skb_recv_datagram(sk, flags, noblock, &err); ++ flags |= (noblock ? MSG_DONTWAIT : 0); ++ skb = skb_recv_datagram(sk, flags, &err); + if (!skb) + goto out; + +@@ -703,7 +704,8 @@ static int dgram_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, + struct dgram_sock *ro = dgram_sk(sk); + DECLARE_SOCKADDR(struct sockaddr_ieee802154 *, saddr, msg->msg_name); + +- skb = skb_recv_datagram(sk, flags, noblock, &err); ++ flags |= (noblock ? MSG_DONTWAIT : 0); ++ skb = skb_recv_datagram(sk, flags, &err); + if (!skb) + goto out; + +diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c +index aa9a11b20d18..4e5ceca7ff7f 100644 +--- a/net/ipv4/ping.c ++++ b/net/ipv4/ping.c +@@ -871,7 +871,8 @@ int ping_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int noblock, + if (flags & MSG_ERRQUEUE) + return inet_recv_error(sk, msg, len, addr_len); + +- skb = skb_recv_datagram(sk, flags, noblock, &err); ++ flags |= (noblock ? MSG_DONTWAIT : 0); ++ skb = skb_recv_datagram(sk, flags, &err); + if (!skb) + goto out; + +diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c +index 9f97b9cbf7b3..c9dd9603f2e7 100644 +--- a/net/ipv4/raw.c ++++ b/net/ipv4/raw.c +@@ -769,7 +769,8 @@ static int raw_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, + goto out; + } + +- skb = skb_recv_datagram(sk, flags, noblock, &err); ++ flags |= (noblock ? MSG_DONTWAIT : 0); ++ skb = skb_recv_datagram(sk, flags, &err); + if (!skb) + goto out; + +diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c +index c51d5ce3711c..8bb41f3b246a 100644 +--- a/net/ipv6/raw.c ++++ b/net/ipv6/raw.c +@@ -477,7 +477,8 @@ static int rawv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, + if (np->rxpmtu && np->rxopt.bits.rxpmtu) + return ipv6_recv_rxpmtu(sk, msg, len, addr_len); + +- skb = skb_recv_datagram(sk, flags, noblock, &err); ++ flags |= (noblock ? MSG_DONTWAIT : 0); ++ skb = skb_recv_datagram(sk, flags, &err); + if (!skb) + goto out; + +diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c +index a1760add5bf1..a0385ddbffcf 100644 +--- a/net/iucv/af_iucv.c ++++ b/net/iucv/af_iucv.c +@@ -1223,7 +1223,6 @@ static void iucv_process_message_q(struct sock *sk) + static int iucv_sock_recvmsg(struct socket *sock, struct msghdr *msg, + size_t len, int flags) + { +- int noblock = flags & MSG_DONTWAIT; + struct sock *sk = sock->sk; + struct iucv_sock *iucv = iucv_sk(sk); + unsigned int copied, rlen; +@@ -1242,7 +1241,7 @@ static int iucv_sock_recvmsg(struct socket *sock, struct msghdr *msg, + + /* receive/dequeue next skb: + * the function understands MSG_PEEK and, thus, does not dequeue skb */ +- skb = skb_recv_datagram(sk, flags, noblock, &err); ++ skb = skb_recv_datagram(sk, flags, &err); + if (!skb) { + if (sk->sk_shutdown & RCV_SHUTDOWN) + return 0; +diff --git a/net/key/af_key.c b/net/key/af_key.c +index d93bde657359..c249b84efbb2 100644 +--- a/net/key/af_key.c ++++ b/net/key/af_key.c +@@ -3700,7 +3700,7 @@ static int pfkey_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT)) + goto out; + +- skb = skb_recv_datagram(sk, flags, flags & MSG_DONTWAIT, &err); ++ skb = skb_recv_datagram(sk, flags, &err); + if (skb == NULL) + goto out; + +diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c +index b3edafa5fba4..c6a5cc2d88e7 100644 +--- a/net/l2tp/l2tp_ip.c ++++ b/net/l2tp/l2tp_ip.c +@@ -526,7 +526,8 @@ static int l2tp_ip_recvmsg(struct sock *sk, struct msghdr *msg, + if (flags & MSG_OOB) + goto out; + +- skb = skb_recv_datagram(sk, flags, noblock, &err); ++ flags |= (noblock ? MSG_DONTWAIT : 0); ++ skb = skb_recv_datagram(sk, flags, &err); + if (!skb) + goto out; + +diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c +index d54dbd01d86f..8f76e647adbb 100644 +--- a/net/l2tp/l2tp_ip6.c ++++ b/net/l2tp/l2tp_ip6.c +@@ -672,7 +672,8 @@ static int l2tp_ip6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, + if (flags & MSG_ERRQUEUE) + return ipv6_recv_error(sk, msg, len, addr_len); + +- skb = skb_recv_datagram(sk, flags, noblock, &err); ++ flags |= (noblock ? MSG_DONTWAIT : 0); ++ skb = skb_recv_datagram(sk, flags, &err); + if (!skb) + goto out; + +diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c +index bf35710127dd..8be1fdc68a0b 100644 +--- a/net/l2tp/l2tp_ppp.c ++++ b/net/l2tp/l2tp_ppp.c +@@ -191,8 +191,7 @@ static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg, + goto end; + + err = 0; +- skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, +- flags & MSG_DONTWAIT, &err); ++ skb = skb_recv_datagram(sk, flags, &err); + if (!skb) + goto end; + +diff --git a/net/mctp/af_mctp.c b/net/mctp/af_mctp.c +index e22b0cbb2f35..221863afc4b1 100644 +--- a/net/mctp/af_mctp.c ++++ b/net/mctp/af_mctp.c +@@ -216,7 +216,7 @@ static int mctp_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + if (flags & ~(MSG_DONTWAIT | MSG_TRUNC | MSG_PEEK)) + return -EOPNOTSUPP; + +- skb = skb_recv_datagram(sk, flags, flags & MSG_DONTWAIT, &rc); ++ skb = skb_recv_datagram(sk, flags, &rc); + if (!skb) + return rc; + +diff --git a/net/mctp/test/route-test.c b/net/mctp/test/route-test.c +index 61205cf40074..24df29e135ed 100644 +--- a/net/mctp/test/route-test.c ++++ b/net/mctp/test/route-test.c +@@ -352,7 +352,7 @@ static void mctp_test_route_input_sk(struct kunit *test) + if (params->deliver) { + KUNIT_EXPECT_EQ(test, rc, 0); + +- skb2 = skb_recv_datagram(sock->sk, 0, 1, &rc); ++ skb2 = skb_recv_datagram(sock->sk, MSG_DONTWAIT, &rc); + KUNIT_EXPECT_NOT_ERR_OR_NULL(test, skb2); + KUNIT_EXPECT_EQ(test, skb->len, 1); + +@@ -360,7 +360,7 @@ static void mctp_test_route_input_sk(struct kunit *test) + + } else { + KUNIT_EXPECT_NE(test, rc, 0); +- skb2 = skb_recv_datagram(sock->sk, 0, 1, &rc); ++ skb2 = skb_recv_datagram(sock->sk, MSG_DONTWAIT, &rc); + KUNIT_EXPECT_PTR_EQ(test, skb2, NULL); + } + +@@ -423,7 +423,7 @@ static void mctp_test_route_input_sk_reasm(struct kunit *test) + rc = mctp_route_input(&rt->rt, skb); + } + +- skb2 = skb_recv_datagram(sock->sk, 0, 1, &rc); ++ skb2 = skb_recv_datagram(sock->sk, MSG_DONTWAIT, &rc); + + if (params->rx_len) { + KUNIT_EXPECT_NOT_ERR_OR_NULL(test, skb2); +@@ -582,7 +582,7 @@ static void mctp_test_route_input_sk_keys(struct kunit *test) + rc = mctp_route_input(&rt->rt, skb); + + /* (potentially) receive message */ +- skb2 = skb_recv_datagram(sock->sk, 0, 1, &rc); ++ skb2 = skb_recv_datagram(sock->sk, MSG_DONTWAIT, &rc); + + if (params->deliver) + KUNIT_EXPECT_NOT_ERR_OR_NULL(test, skb2); +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index 73e9c0a9c187..0cd91f813a3b 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -1931,7 +1931,6 @@ static int netlink_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + struct scm_cookie scm; + struct sock *sk = sock->sk; + struct netlink_sock *nlk = nlk_sk(sk); +- int noblock = flags & MSG_DONTWAIT; + size_t copied; + struct sk_buff *skb, *data_skb; + int err, ret; +@@ -1941,7 +1940,7 @@ static int netlink_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + + copied = 0; + +- skb = skb_recv_datagram(sk, flags, noblock, &err); ++ skb = skb_recv_datagram(sk, flags, &err); + if (skb == NULL) + goto out; + +diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c +index fa9dc2ba3941..6f7f4392cffb 100644 +--- a/net/netrom/af_netrom.c ++++ b/net/netrom/af_netrom.c +@@ -1159,7 +1159,8 @@ static int nr_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, + } + + /* Now we can treat all alike */ +- if ((skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, flags & MSG_DONTWAIT, &er)) == NULL) { ++ skb = skb_recv_datagram(sk, flags, &er); ++ if (!skb) { + release_sock(sk); + return er; + } +diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c +index 4ca35791c93b..77642d18a3b4 100644 +--- a/net/nfc/llcp_sock.c ++++ b/net/nfc/llcp_sock.c +@@ -821,7 +821,6 @@ static int llcp_sock_sendmsg(struct socket *sock, struct msghdr *msg, + static int llcp_sock_recvmsg(struct socket *sock, struct msghdr *msg, + size_t len, int flags) + { +- int noblock = flags & MSG_DONTWAIT; + struct sock *sk = sock->sk; + unsigned int copied, rlen; + struct sk_buff *skb, *cskb; +@@ -842,7 +841,7 @@ static int llcp_sock_recvmsg(struct socket *sock, struct msghdr *msg, + if (flags & (MSG_OOB)) + return -EOPNOTSUPP; + +- skb = skb_recv_datagram(sk, flags, noblock, &err); ++ skb = skb_recv_datagram(sk, flags, &err); + if (!skb) { + pr_err("Recv datagram failed state %d %d %d", + sk->sk_state, err, sock_error(sk)); +diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c +index 0ca214ab5aef..8dd569765f96 100644 +--- a/net/nfc/rawsock.c ++++ b/net/nfc/rawsock.c +@@ -238,7 +238,6 @@ static int rawsock_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) + static int rawsock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + int flags) + { +- int noblock = flags & MSG_DONTWAIT; + struct sock *sk = sock->sk; + struct sk_buff *skb; + int copied; +@@ -246,7 +245,7 @@ static int rawsock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + + pr_debug("sock=%p sk=%p len=%zu flags=%d\n", sock, sk, len, flags); + +- skb = skb_recv_datagram(sk, flags, noblock, &rc); ++ skb = skb_recv_datagram(sk, flags, &rc); + if (!skb) + return rc; + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 002d2b9c69dd..243566129784 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -3426,7 +3426,7 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + * but then it will block. + */ + +- skb = skb_recv_datagram(sk, flags, flags & MSG_DONTWAIT, &err); ++ skb = skb_recv_datagram(sk, flags, &err); + + /* + * An error occurred so return it. Because skb_recv_datagram() +diff --git a/net/phonet/datagram.c b/net/phonet/datagram.c +index 393e6aa7a592..3f2e62b63dd4 100644 +--- a/net/phonet/datagram.c ++++ b/net/phonet/datagram.c +@@ -123,7 +123,8 @@ static int pn_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, + MSG_CMSG_COMPAT)) + goto out_nofree; + +- skb = skb_recv_datagram(sk, flags, noblock, &rval); ++ flags |= (noblock ? MSG_DONTWAIT : 0); ++ skb = skb_recv_datagram(sk, flags, &rval); + if (skb == NULL) + goto out_nofree; + +diff --git a/net/phonet/pep.c b/net/phonet/pep.c +index 65d463ad8770..441a26706592 100644 +--- a/net/phonet/pep.c ++++ b/net/phonet/pep.c +@@ -772,7 +772,8 @@ static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp, + u8 pipe_handle, enabled, n_sb; + u8 aligned = 0; + +- skb = skb_recv_datagram(sk, 0, flags & O_NONBLOCK, errp); ++ skb = skb_recv_datagram(sk, (flags & O_NONBLOCK) ? MSG_DONTWAIT : 0, ++ errp); + if (!skb) + return NULL; + +@@ -1267,7 +1268,8 @@ static int pep_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, + return -EINVAL; + } + +- skb = skb_recv_datagram(sk, flags, noblock, &err); ++ flags |= (noblock ? MSG_DONTWAIT : 0); ++ skb = skb_recv_datagram(sk, flags, &err); + lock_sock(sk); + if (skb == NULL) { + if (err == -ENOTCONN && sk->sk_state == TCP_CLOSE_WAIT) +diff --git a/net/qrtr/af_qrtr.c b/net/qrtr/af_qrtr.c +index ec2322529727..5c2fb992803b 100644 +--- a/net/qrtr/af_qrtr.c ++++ b/net/qrtr/af_qrtr.c +@@ -1035,8 +1035,7 @@ static int qrtr_recvmsg(struct socket *sock, struct msghdr *msg, + return -EADDRNOTAVAIL; + } + +- skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, +- flags & MSG_DONTWAIT, &rc); ++ skb = skb_recv_datagram(sk, flags, &rc); + if (!skb) { + release_sock(sk); + return rc; +diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c +index 30a1cf4c16c6..bf2d986a6bc3 100644 +--- a/net/rose/af_rose.c ++++ b/net/rose/af_rose.c +@@ -1230,7 +1230,8 @@ static int rose_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, + return -ENOTCONN; + + /* Now we can treat all alike */ +- if ((skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, flags & MSG_DONTWAIT, &er)) == NULL) ++ skb = skb_recv_datagram(sk, flags, &er); ++ if (!skb) + return er; + + qbit = (skb->data[0] & ROSE_Q_BIT) == ROSE_Q_BIT; +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c +index 4aed12e94221..6114d69b8a2d 100644 +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -1643,7 +1643,8 @@ static int unix_accept(struct socket *sock, struct socket *newsock, int flags, + * so that no locks are necessary. + */ + +- skb = skb_recv_datagram(sk, 0, flags&O_NONBLOCK, &err); ++ skb = skb_recv_datagram(sk, (flags & O_NONBLOCK) ? MSG_DONTWAIT : 0, ++ &err); + if (!skb) { + /* This means receive shutdown. */ + if (err == 0) +@@ -2500,7 +2501,7 @@ static int unix_read_sock(struct sock *sk, read_descriptor_t *desc, + int used, err; + + mutex_lock(&u->iolock); +- skb = skb_recv_datagram(sk, 0, 1, &err); ++ skb = skb_recv_datagram(sk, MSG_DONTWAIT, &err); + mutex_unlock(&u->iolock); + if (!skb) + return err; +diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c +index b17dc9745188..b14f0ed7427b 100644 +--- a/net/vmw_vsock/vmci_transport.c ++++ b/net/vmw_vsock/vmci_transport.c +@@ -1732,19 +1732,16 @@ static int vmci_transport_dgram_dequeue(struct vsock_sock *vsk, + int flags) + { + int err; +- int noblock; + struct vmci_datagram *dg; + size_t payload_len; + struct sk_buff *skb; + +- noblock = flags & MSG_DONTWAIT; +- + if (flags & MSG_OOB || flags & MSG_ERRQUEUE) + return -EOPNOTSUPP; + + /* Retrieve the head sk_buff from the socket's receive queue. */ + err = 0; +- skb = skb_recv_datagram(&vsk->sk, flags, noblock, &err); ++ skb = skb_recv_datagram(&vsk->sk, flags, &err); + if (!skb) + return err; + +diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c +index 3a171828638b..6bc2ac8d8146 100644 +--- a/net/x25/af_x25.c ++++ b/net/x25/af_x25.c +@@ -1315,8 +1315,7 @@ static int x25_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, + } else { + /* Now we can treat all alike */ + release_sock(sk); +- skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, +- flags & MSG_DONTWAIT, &rc); ++ skb = skb_recv_datagram(sk, flags, &rc); + lock_sock(sk); + if (!skb) + goto out; +-- +2.35.1 + diff --git a/queue-5.18/nvme-add-device-name-to-warning-in-uuid_show.patch b/queue-5.18/nvme-add-device-name-to-warning-in-uuid_show.patch new file mode 100644 index 00000000000..4e217436ae1 --- /dev/null +++ b/queue-5.18/nvme-add-device-name-to-warning-in-uuid_show.patch @@ -0,0 +1,48 @@ +From 5255fe33c404d0a6537141378e859f9208679fcc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jun 2022 17:55:55 +0200 +Subject: nvme: add device name to warning in uuid_show() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 1fc766b5c08417248e0008bca14c3572ac0f1c26 ] + +This provides more context to users. + +Old message: + +[ 00.000000] No UUID available providing old NGUID + +New message: + +[ 00.000000] block nvme0n1: No UUID available providing old NGUID + +Fixes: d934f9848a77 ("nvme: provide UUID value to userspace") +Signed-off-by: Thomas Weißschuh +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 2d6a01853109..1ea85c88d795 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -3226,8 +3226,8 @@ static ssize_t uuid_show(struct device *dev, struct device_attribute *attr, + * we have no UUID set + */ + if (uuid_is_null(&ids->uuid)) { +- printk_ratelimited(KERN_WARNING +- "No UUID available providing old NGUID\n"); ++ dev_warn_ratelimited(dev, ++ "No UUID available providing old NGUID\n"); + return sysfs_emit(buf, "%pU\n", ids->nguid); + } + return sysfs_emit(buf, "%pU\n", &ids->uuid); +-- +2.35.1 + diff --git a/queue-5.18/pnfs-avoid-a-live-lock-condition-in-pnfs_update_layo.patch b/queue-5.18/pnfs-avoid-a-live-lock-condition-in-pnfs_update_layo.patch new file mode 100644 index 00000000000..f6601aa1084 --- /dev/null +++ b/queue-5.18/pnfs-avoid-a-live-lock-condition-in-pnfs_update_layo.patch @@ -0,0 +1,106 @@ +From 717029d6b78e8280bbb717d94a1ef2318867b4a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 May 2022 11:03:07 -0400 +Subject: pNFS: Avoid a live lock condition in pnfs_update_layout() + +From: Trond Myklebust + +[ Upstream commit 880265c77ac415090090d1fe72a188fee71cb458 ] + +If we're about to send the first layoutget for an empty layout, we want +to make sure that we drain out the existing pending layoutget calls +first. The reason is that these layouts may have been already implicitly +returned to the server by a recall to which the client gave a +NFS4ERR_NOMATCHING_LAYOUT response. + +The problem is that wait_var_event_killable() could in principle see the +plh_outstanding count go back to '1' when the first process to wake up +starts sending a new layoutget. If it fails to get a layout, then this +loop can continue ad infinitum... + +Fixes: 0b77f97a7e42 ("NFSv4/pnfs: Fix layoutget behaviour after invalidation") +Signed-off-by: Trond Myklebust +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/callback_proc.c | 1 + + fs/nfs/pnfs.c | 15 +++++++++------ + fs/nfs/pnfs.h | 1 + + 3 files changed, 11 insertions(+), 6 deletions(-) + +diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c +index c8520284dda7..c1eda73254e1 100644 +--- a/fs/nfs/callback_proc.c ++++ b/fs/nfs/callback_proc.c +@@ -288,6 +288,7 @@ static u32 initiate_file_draining(struct nfs_client *clp, + rv = NFS4_OK; + break; + case -ENOENT: ++ set_bit(NFS_LAYOUT_DRAIN, &lo->plh_flags); + /* Embrace your forgetfulness! */ + rv = NFS4ERR_NOMATCHING_LAYOUT; + +diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c +index 4609e641710e..41a9b6b58fb9 100644 +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -469,6 +469,7 @@ pnfs_mark_layout_stateid_invalid(struct pnfs_layout_hdr *lo, + pnfs_clear_lseg_state(lseg, lseg_list); + pnfs_clear_layoutreturn_info(lo); + pnfs_free_returned_lsegs(lo, lseg_list, &range, 0); ++ set_bit(NFS_LAYOUT_DRAIN, &lo->plh_flags); + if (test_bit(NFS_LAYOUT_RETURN, &lo->plh_flags) && + !test_and_set_bit(NFS_LAYOUT_RETURN_LOCK, &lo->plh_flags)) + pnfs_clear_layoutreturn_waitbit(lo); +@@ -1917,8 +1918,9 @@ static void nfs_layoutget_begin(struct pnfs_layout_hdr *lo) + + static void nfs_layoutget_end(struct pnfs_layout_hdr *lo) + { +- if (atomic_dec_and_test(&lo->plh_outstanding)) +- wake_up_var(&lo->plh_outstanding); ++ if (atomic_dec_and_test(&lo->plh_outstanding) && ++ test_and_clear_bit(NFS_LAYOUT_DRAIN, &lo->plh_flags)) ++ wake_up_bit(&lo->plh_flags, NFS_LAYOUT_DRAIN); + } + + static bool pnfs_is_first_layoutget(struct pnfs_layout_hdr *lo) +@@ -2025,11 +2027,11 @@ pnfs_update_layout(struct inode *ino, + * If the layout segment list is empty, but there are outstanding + * layoutget calls, then they might be subject to a layoutrecall. + */ +- if ((list_empty(&lo->plh_segs) || !pnfs_layout_is_valid(lo)) && ++ if (test_bit(NFS_LAYOUT_DRAIN, &lo->plh_flags) && + atomic_read(&lo->plh_outstanding) != 0) { + spin_unlock(&ino->i_lock); +- lseg = ERR_PTR(wait_var_event_killable(&lo->plh_outstanding, +- !atomic_read(&lo->plh_outstanding))); ++ lseg = ERR_PTR(wait_on_bit(&lo->plh_flags, NFS_LAYOUT_DRAIN, ++ TASK_KILLABLE)); + if (IS_ERR(lseg)) + goto out_put_layout_hdr; + pnfs_put_layout_hdr(lo); +@@ -2413,7 +2415,8 @@ pnfs_layout_process(struct nfs4_layoutget *lgp) + goto out_forget; + } + +- if (!pnfs_layout_is_valid(lo) && !pnfs_is_first_layoutget(lo)) ++ if (test_bit(NFS_LAYOUT_DRAIN, &lo->plh_flags) && ++ !pnfs_is_first_layoutget(lo)) + goto out_forget; + + if (nfs4_stateid_match_other(&lo->plh_stateid, &res->stateid)) { +diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h +index 07f11489e4e9..f331f067691b 100644 +--- a/fs/nfs/pnfs.h ++++ b/fs/nfs/pnfs.h +@@ -105,6 +105,7 @@ enum { + NFS_LAYOUT_FIRST_LAYOUTGET, /* Serialize first layoutget */ + NFS_LAYOUT_INODE_FREEING, /* The inode is being freed */ + NFS_LAYOUT_HASHED, /* The layout visible */ ++ NFS_LAYOUT_DRAIN, + }; + + enum layoutdriver_policy_flags { +-- +2.35.1 + diff --git a/queue-5.18/pnfs-don-t-keep-retrying-if-the-server-replied-nfs4e.patch b/queue-5.18/pnfs-don-t-keep-retrying-if-the-server-replied-nfs4e.patch new file mode 100644 index 00000000000..d6243e90e79 --- /dev/null +++ b/queue-5.18/pnfs-don-t-keep-retrying-if-the-server-replied-nfs4e.patch @@ -0,0 +1,42 @@ +From 834e325fbabdaeee447be278d4aea8e52a1e9761 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 May 2022 11:03:06 -0400 +Subject: pNFS: Don't keep retrying if the server replied + NFS4ERR_LAYOUTUNAVAILABLE + +From: Trond Myklebust + +[ Upstream commit fe44fb23d6ccde4c914c44ef74ab8d9d9ba02bea ] + +If the server tells us that a pNFS layout is not available for a +specific file, then we should not keep pounding it with further +layoutget requests. + +Fixes: 183d9e7b112a ("pnfs: rework LAYOUTGET retry handling") +Signed-off-by: Trond Myklebust +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/pnfs.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c +index 68a87be3e6f9..4609e641710e 100644 +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -2152,6 +2152,12 @@ pnfs_update_layout(struct inode *ino, + case -ERECALLCONFLICT: + case -EAGAIN: + break; ++ case -ENODATA: ++ /* The server returned NFS4ERR_LAYOUTUNAVAILABLE */ ++ pnfs_layout_set_fail_bit( ++ lo, pnfs_iomode_to_fail_bit(iomode)); ++ lseg = NULL; ++ goto out_put_layout_hdr; + default: + if (!nfs_error_is_fatal(PTR_ERR(lseg))) { + pnfs_layout_clear_fail_bit(lo, pnfs_iomode_to_fail_bit(iomode)); +-- +2.35.1 + diff --git a/queue-5.18/riscv-dts-microchip-re-add-pdma-to-mpfs-device-tree.patch b/queue-5.18/riscv-dts-microchip-re-add-pdma-to-mpfs-device-tree.patch new file mode 100644 index 00000000000..5d0c0639432 --- /dev/null +++ b/queue-5.18/riscv-dts-microchip-re-add-pdma-to-mpfs-device-tree.patch @@ -0,0 +1,44 @@ +From e8ecd8459f8488dca6439ab34b7b5dad20cbd85b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jun 2022 09:38:26 +0100 +Subject: riscv: dts: microchip: re-add pdma to mpfs device tree + +From: Conor Dooley + +[ Upstream commit 5e757deddd918edb8cb2fdb56eb79656ffc6dade ] + +PolarFire SoC /does/ have a SiFive pdma, despite what I suggested as a +conflict resolution to Zong. Somehow the entry fell through the cracks +between versions of my dt patches, so re-add it with Zong's updated +compatible & dma-channels property. + +Fixes: c5094f371008 ("riscv: dts: microchip: refactor icicle kit device tree") +Signed-off-by: Conor Dooley +Signed-off-by: Sasha Levin +--- + arch/riscv/boot/dts/microchip/microchip-mpfs.dtsi | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/arch/riscv/boot/dts/microchip/microchip-mpfs.dtsi b/arch/riscv/boot/dts/microchip/microchip-mpfs.dtsi +index cf2f55e1dcb6..f44fce1fe080 100644 +--- a/arch/riscv/boot/dts/microchip/microchip-mpfs.dtsi ++++ b/arch/riscv/boot/dts/microchip/microchip-mpfs.dtsi +@@ -188,6 +188,15 @@ + riscv,ndev = <186>; + }; + ++ pdma: dma-controller@3000000 { ++ compatible = "sifive,fu540-c000-pdma", "sifive,pdma0"; ++ reg = <0x0 0x3000000 0x0 0x8000>; ++ interrupt-parent = <&plic>; ++ interrupts = <5 6>, <7 8>, <9 10>, <11 12>; ++ dma-channels = <4>; ++ #dma-cells = <1>; ++ }; ++ + clkcfg: clkcfg@20002000 { + compatible = "microchip,mpfs-clkcfg"; + reg = <0x0 0x20002000 0x0 0x1000>, <0x0 0x3E001000 0x0 0x1000>; +-- +2.35.1 + diff --git a/queue-5.18/series b/queue-5.18/series index da017fc5c0c..3465c7c13dd 100644 --- a/queue-5.18/series +++ b/queue-5.18/series @@ -49,3 +49,39 @@ platform-x86-intel-pmc-support-intel-raptorlake-p.patch platform-x86-gigabyte-wmi-add-z690m-aorus-elite-ax-d.patch platform-x86-gigabyte-wmi-add-support-for-b450m-ds3h.patch platform-x86-intel-hid-add-surface-go-to-vgbs-allow-.patch +staging-r8188eu-fix-rtw_alloc_hwxmits-error-detectio.patch +staging-r8188eu-fix-warning-of-array-overflow-in-ioc.patch +pnfs-don-t-keep-retrying-if-the-server-replied-nfs4e.patch +pnfs-avoid-a-live-lock-condition-in-pnfs_update_layo.patch +sunrpc-set-cl_max_connect-when-cloning-an-rpc_clnt.patch +clocksource-hyper-v-unexport-__init-annotated-hv_ini.patch +i40e-fix-adding-adq-filter-to-tc0.patch +i40e-fix-calculating-the-number-of-queue-pairs.patch +i40e-fix-call-trace-in-setup_tx_descriptors.patch +iavf-fix-issue-with-mac-address-of-vf-shown-as-zero.patch +drivers-hv-vmbus-release-cpu-lock-in-error-case.patch +tty-goldfish-fix-free_irq-on-remove.patch +misc-atmel-ssc-fix-irq-check-in-ssc_probe.patch +riscv-dts-microchip-re-add-pdma-to-mpfs-device-tree.patch +io_uring-fix-races-with-file-table-unregister.patch +io_uring-fix-races-with-buffer-table-unregister.patch +drm-i915-reset-fix-error_state_read-ptr-offset-use.patch +net-hns3-set-port-base-vlan-tbl_sta-to-false-before-.patch +net-hns3-don-t-push-link-state-to-vf-if-unalive.patch +net-hns3-restore-tm-priority-qset-to-default-setting.patch +net-hns3-fix-pf-rss-size-initialization-bug.patch +net-hns3-fix-tm-port-shapping-of-fibre-port-is-incor.patch +nvme-add-device-name-to-warning-in-uuid_show.patch +mlxsw-spectrum_cnt-reorder-counter-pools.patch +ice-fix-ptp-tx-timestamp-offset-calculation.patch +ice-sync-vlan-filtering-features-for-dvm.patch +ice-fix-queue-config-fail-handling.patch +ice-fix-memory-corruption-in-vf-driver.patch +net-bgmac-fix-an-erroneous-kfree-in-bgmac_remove.patch +net-remove-noblock-parameter-from-skb_recv_datagram.patch +net-ax25-fix-deadlock-caused-by-skb_recv_datagram-in.patch +arm64-ftrace-fix-branch-range-checks.patch +arm64-ftrace-consistently-handle-plts.patch +certs-blacklist_hashes.c-fix-const-confusion-in-cert.patch +init-initialize-noop_backing_dev_info-early.patch +block-fix-handling-of-offline-queues-in-blk_mq_alloc.patch diff --git a/queue-5.18/staging-r8188eu-fix-rtw_alloc_hwxmits-error-detectio.patch b/queue-5.18/staging-r8188eu-fix-rtw_alloc_hwxmits-error-detectio.patch new file mode 100644 index 00000000000..cada7ad2568 --- /dev/null +++ b/queue-5.18/staging-r8188eu-fix-rtw_alloc_hwxmits-error-detectio.patch @@ -0,0 +1,71 @@ +From c365452603a2972e4dbb362e8b8c9e12666f9162 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 May 2022 21:47:41 +0100 +Subject: staging: r8188eu: fix rtw_alloc_hwxmits error detection for now + +From: Phillip Potter + +[ Upstream commit 5b7419ae1d208cab1e2826d473d8dab045aa75c7 ] + +In _rtw_init_xmit_priv, we use the res variable to store the error +return from the newly converted rtw_alloc_hwxmits function. Sadly, the +calling function interprets res using _SUCCESS and _FAIL still, meaning +we change the semantics of the variable, even in the success case. + +This leads to the following on boot: +r8188eu 1-2:1.0: _rtw_init_xmit_priv failed + +In the long term, we should reverse these semantics, but for now, this +fixes the driver. Also, inside rtw_alloc_hwxmits remove the if blocks, +as HWXMIT_ENTRY is always 4. + +Fixes: f94b47c6bde6 ("staging: r8188eu: add check for kzalloc") +Signed-off-by: Phillip Potter +Link: https://lore.kernel.org/r/20220521204741.921-1-phil@philpotter.co.uk +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/r8188eu/core/rtw_xmit.c | 20 +++++--------------- + 1 file changed, 5 insertions(+), 15 deletions(-) + +diff --git a/drivers/staging/r8188eu/core/rtw_xmit.c b/drivers/staging/r8188eu/core/rtw_xmit.c +index 2ee92bbe66a0..ea5c88904961 100644 +--- a/drivers/staging/r8188eu/core/rtw_xmit.c ++++ b/drivers/staging/r8188eu/core/rtw_xmit.c +@@ -178,8 +178,7 @@ s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter) + + pxmitpriv->free_xmit_extbuf_cnt = num_xmit_extbuf; + +- res = rtw_alloc_hwxmits(padapter); +- if (res) { ++ if (rtw_alloc_hwxmits(padapter)) { + res = _FAIL; + goto exit; + } +@@ -1492,19 +1491,10 @@ int rtw_alloc_hwxmits(struct adapter *padapter) + + hwxmits = pxmitpriv->hwxmits; + +- if (pxmitpriv->hwxmit_entry == 5) { +- hwxmits[0] .sta_queue = &pxmitpriv->bm_pending; +- hwxmits[1] .sta_queue = &pxmitpriv->vo_pending; +- hwxmits[2] .sta_queue = &pxmitpriv->vi_pending; +- hwxmits[3] .sta_queue = &pxmitpriv->bk_pending; +- hwxmits[4] .sta_queue = &pxmitpriv->be_pending; +- } else if (pxmitpriv->hwxmit_entry == 4) { +- hwxmits[0] .sta_queue = &pxmitpriv->vo_pending; +- hwxmits[1] .sta_queue = &pxmitpriv->vi_pending; +- hwxmits[2] .sta_queue = &pxmitpriv->be_pending; +- hwxmits[3] .sta_queue = &pxmitpriv->bk_pending; +- } else { +- } ++ hwxmits[0].sta_queue = &pxmitpriv->vo_pending; ++ hwxmits[1].sta_queue = &pxmitpriv->vi_pending; ++ hwxmits[2].sta_queue = &pxmitpriv->be_pending; ++ hwxmits[3].sta_queue = &pxmitpriv->bk_pending; + + return 0; + } +-- +2.35.1 + diff --git a/queue-5.18/staging-r8188eu-fix-warning-of-array-overflow-in-ioc.patch b/queue-5.18/staging-r8188eu-fix-warning-of-array-overflow-in-ioc.patch new file mode 100644 index 00000000000..b8e9d745da5 --- /dev/null +++ b/queue-5.18/staging-r8188eu-fix-warning-of-array-overflow-in-ioc.patch @@ -0,0 +1,70 @@ +From dec406063fb13a6c4faa657a206cbd5216af896a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 May 2022 20:31:03 -0500 +Subject: staging: r8188eu: Fix warning of array overflow in ioctl_linux.c +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Larry Finger + +[ Upstream commit 96f0a54e8e65a765b3a4ad4b53751581f23279f3 ] + +Building with -Warray-bounds results in the following warning plus others +related to the same problem: + +CC [M] drivers/staging/r8188eu/os_dep/ioctl_linux.o +In function ‘wpa_set_encryption’, + inlined from ‘rtw_wx_set_enc_ext’ at drivers/staging/r8188eu/os_dep/ioctl_linux.c:1868:9: +drivers/staging/r8188eu/os_dep/ioctl_linux.c:412:41: warning: array subscript ‘struct ndis_802_11_wep[0]’ is partly outside array bounds of ‘void[25]’ [-Warray-bounds] + 412 | pwep->KeyLength = wep_key_len; + | ~~~~~~~~~~~~~~~~^~~~~~~~~~~~~ +In file included from drivers/staging/r8188eu/os_dep/../include/osdep_service.h:19, + from drivers/staging/r8188eu/os_dep/ioctl_linux.c:4: +In function ‘kmalloc’, + inlined from ‘kzalloc’ at ./include/linux/slab.h:733:9, + inlined from ‘wpa_set_encryption’ at drivers/staging/r8188eu/os_dep/ioctl_linux.c:408:11, + inlined from ‘rtw_wx_set_enc_ext’ at drivers/staging/r8188eu/os_dep/ioctl_linux.c:1868:9: +./include/linux/slab.h:605:16: note: object of size [17, 25] allocated by ‘__kmalloc’ + 605 | return __kmalloc(size, flags); + | ^~~~~~~~~~~~~~~~~~~~~~ +./include/linux/slab.h:600:24: note: object of size [17, 25] allocated by ‘kmem_cache_alloc_trace’ + 600 | return kmem_cache_alloc_trace( + | ^~~~~~~~~~~~~~~~~~~~~~~ + 601 | kmalloc_caches[kmalloc_type(flags)][index], + | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + 602 | flags, size); + | ~~~~~~~~~~~~ + +Although it is unlikely that anyone is still using WEP encryption, the +size of the allocation needs to be increased just in case. + +Fixes commit 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for RTL8188eu driver") + +Fixes: 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for RTL8188eu driver") +Signed-off-by: Larry Finger +Cc: Phillip Potter +Cc: Dan Carpenter +Link: https://lore.kernel.org/r/20220531013103.2175-3-Larry.Finger@lwfinger.net +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/r8188eu/os_dep/ioctl_linux.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/r8188eu/os_dep/ioctl_linux.c b/drivers/staging/r8188eu/os_dep/ioctl_linux.c +index 60bd1cc2b3af..607c5e1eb320 100644 +--- a/drivers/staging/r8188eu/os_dep/ioctl_linux.c ++++ b/drivers/staging/r8188eu/os_dep/ioctl_linux.c +@@ -404,7 +404,7 @@ static int wpa_set_encryption(struct net_device *dev, struct ieee_param *param, + + if (wep_key_len > 0) { + wep_key_len = wep_key_len <= 5 ? 5 : 13; +- wep_total_len = wep_key_len + FIELD_OFFSET(struct ndis_802_11_wep, KeyMaterial); ++ wep_total_len = wep_key_len + sizeof(*pwep); + pwep = kzalloc(wep_total_len, GFP_KERNEL); + if (!pwep) + goto exit; +-- +2.35.1 + diff --git a/queue-5.18/sunrpc-set-cl_max_connect-when-cloning-an-rpc_clnt.patch b/queue-5.18/sunrpc-set-cl_max_connect-when-cloning-an-rpc_clnt.patch new file mode 100644 index 00000000000..22e788f0861 --- /dev/null +++ b/queue-5.18/sunrpc-set-cl_max_connect-when-cloning-an-rpc_clnt.patch @@ -0,0 +1,43 @@ +From 5ff63200a0492338f89a5483592de15b6f77cefc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jun 2022 13:34:49 -0400 +Subject: sunrpc: set cl_max_connect when cloning an rpc_clnt + +From: Scott Mayhew + +[ Upstream commit 304791255a2dc1c9be7e7c8a6cbdb31b6847b0e5 ] + +If the initial attempt at trunking detection using the krb5i auth flavor +fails with -EACCES, -NFS4ERR_CLID_INUSE, or -NFS4ERR_WRONGSEC, then the +NFS client tries again using auth_sys, cloning the rpc_clnt in the +process. If this second attempt at trunking detection succeeds, then +the resulting nfs_client->cl_rpcclient winds up having cl_max_connect=0 +and subsequent attempts to add additional transport connections to the +rpc_clnt will fail with a message similar to the following being logged: + +[502044.312640] SUNRPC: reached max allowed number (0) did not add +transport to server: 192.168.122.3 + +Signed-off-by: Scott Mayhew +Fixes: dc48e0abee24 ("SUNRPC enforce creation of no more than max_connect xprts") +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + net/sunrpc/clnt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c +index e2c6eca0271b..b6781ada3aa8 100644 +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -651,6 +651,7 @@ static struct rpc_clnt *__rpc_clone_client(struct rpc_create_args *args, + new->cl_discrtry = clnt->cl_discrtry; + new->cl_chatty = clnt->cl_chatty; + new->cl_principal = clnt->cl_principal; ++ new->cl_max_connect = clnt->cl_max_connect; + return new; + + out_err: +-- +2.35.1 + diff --git a/queue-5.18/tty-goldfish-fix-free_irq-on-remove.patch b/queue-5.18/tty-goldfish-fix-free_irq-on-remove.patch new file mode 100644 index 00000000000..185dcbb1b2a --- /dev/null +++ b/queue-5.18/tty-goldfish-fix-free_irq-on-remove.patch @@ -0,0 +1,51 @@ +From 9acdd7b536ceca0a1738898a4ef07e4e0ee76383 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jun 2022 16:17:04 +0200 +Subject: tty: goldfish: Fix free_irq() on remove + +From: Vincent Whitchurch + +[ Upstream commit 499e13aac6c762e1e828172b0f0f5275651d6512 ] + +Pass the correct dev_id to free_irq() to fix this splat when the driver +is unbound: + + WARNING: CPU: 0 PID: 30 at kernel/irq/manage.c:1895 free_irq + Trying to free already-free IRQ 65 + Call Trace: + warn_slowpath_fmt + free_irq + goldfish_tty_remove + platform_remove + device_remove + device_release_driver_internal + device_driver_detach + unbind_store + drv_attr_store + ... + +Fixes: 465893e18878e119 ("tty: goldfish: support platform_device with id -1") +Signed-off-by: Vincent Whitchurch +Link: https://lore.kernel.org/r/20220609141704.1080024-1-vincent.whitchurch@axis.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/goldfish.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/goldfish.c b/drivers/tty/goldfish.c +index c7968aecd870..d02de3f0326f 100644 +--- a/drivers/tty/goldfish.c ++++ b/drivers/tty/goldfish.c +@@ -426,7 +426,7 @@ static int goldfish_tty_remove(struct platform_device *pdev) + tty_unregister_device(goldfish_tty_driver, qtty->console.index); + iounmap(qtty->base); + qtty->base = NULL; +- free_irq(qtty->irq, pdev); ++ free_irq(qtty->irq, qtty); + tty_port_destroy(&qtty->port); + goldfish_tty_current_line_count--; + if (goldfish_tty_current_line_count == 0) +-- +2.35.1 +