From: Sasha Levin Date: Wed, 5 Jun 2024 12:09:32 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v6.1.93~40 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b100e07451cd92e02a07c76f5a1ed4ec6e5821d8;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/dma-buf-sw-sync-don-t-enable-irq-from-sync_print_obj.patch b/queue-5.4/dma-buf-sw-sync-don-t-enable-irq-from-sync_print_obj.patch new file mode 100644 index 00000000000..008c2160278 --- /dev/null +++ b/queue-5.4/dma-buf-sw-sync-don-t-enable-irq-from-sync_print_obj.patch @@ -0,0 +1,55 @@ +From 0871cc6b6908ba3e045f343347bb600b3842738b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 May 2024 23:08:31 +0900 +Subject: dma-buf/sw-sync: don't enable IRQ from sync_print_obj() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tetsuo Handa + +[ Upstream commit b794918961516f667b0c745aebdfebbb8a98df39 ] + +Since commit a6aa8fca4d79 ("dma-buf/sw-sync: Reduce irqsave/irqrestore from +known context") by error replaced spin_unlock_irqrestore() with +spin_unlock_irq() for both sync_debugfs_show() and sync_print_obj() despite +sync_print_obj() is called from sync_debugfs_show(), lockdep complains +inconsistent lock state warning. + +Use plain spin_{lock,unlock}() for sync_print_obj(), for +sync_debugfs_show() is already using spin_{lock,unlock}_irq(). + +Reported-by: syzbot +Closes: https://syzkaller.appspot.com/bug?extid=a225ee3df7e7f9372dbe +Fixes: a6aa8fca4d79 ("dma-buf/sw-sync: Reduce irqsave/irqrestore from known context") +Signed-off-by: Tetsuo Handa +Reviewed-by: Christian König +Link: https://patchwork.freedesktop.org/patch/msgid/c2e46020-aaa6-4e06-bf73-f05823f913f0@I-love.SAKURA.ne.jp +Signed-off-by: Christian König +Signed-off-by: Sasha Levin +--- + drivers/dma-buf/sync_debug.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma-buf/sync_debug.c b/drivers/dma-buf/sync_debug.c +index 101394f16930f..237bce21d1e72 100644 +--- a/drivers/dma-buf/sync_debug.c ++++ b/drivers/dma-buf/sync_debug.c +@@ -110,12 +110,12 @@ static void sync_print_obj(struct seq_file *s, struct sync_timeline *obj) + + seq_printf(s, "%s: %d\n", obj->name, obj->value); + +- spin_lock_irq(&obj->lock); ++ spin_lock(&obj->lock); /* Caller already disabled IRQ. */ + list_for_each(pos, &obj->pt_list) { + struct sync_pt *pt = container_of(pos, struct sync_pt, link); + sync_print_fence(s, &pt->base, false); + } +- spin_unlock_irq(&obj->lock); ++ spin_unlock(&obj->lock); + } + + static void sync_print_sync_file(struct seq_file *s, +-- +2.43.0 + diff --git a/queue-5.4/enic-validate-length-of-nl-attributes-in-enic_set_vf.patch b/queue-5.4/enic-validate-length-of-nl-attributes-in-enic_set_vf.patch new file mode 100644 index 00000000000..cc9591f6867 --- /dev/null +++ b/queue-5.4/enic-validate-length-of-nl-attributes-in-enic_set_vf.patch @@ -0,0 +1,69 @@ +From cf737e472c9d355d1390a7d21d4ae62eddc25a85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 May 2024 10:30:44 +0300 +Subject: enic: Validate length of nl attributes in enic_set_vf_port + +From: Roded Zats + +[ Upstream commit e8021b94b0412c37bcc79027c2e382086b6ce449 ] + +enic_set_vf_port assumes that the nl attribute IFLA_PORT_PROFILE +is of length PORT_PROFILE_MAX and that the nl attributes +IFLA_PORT_INSTANCE_UUID, IFLA_PORT_HOST_UUID are of length PORT_UUID_MAX. +These attributes are validated (in the function do_setlink in rtnetlink.c) +using the nla_policy ifla_port_policy. The policy defines IFLA_PORT_PROFILE +as NLA_STRING, IFLA_PORT_INSTANCE_UUID as NLA_BINARY and +IFLA_PORT_HOST_UUID as NLA_STRING. That means that the length validation +using the policy is for the max size of the attributes and not on exact +size so the length of these attributes might be less than the sizes that +enic_set_vf_port expects. This might cause an out of bands +read access in the memcpys of the data of these +attributes in enic_set_vf_port. + +Fixes: f8bd909183ac ("net: Add ndo_{set|get}_vf_port support for enic dynamic vnics") +Signed-off-by: Roded Zats +Link: https://lore.kernel.org/r/20240522073044.33519-1-rzats@paloaltonetworks.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cisco/enic/enic_main.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c +index 03c8af58050c9..892c4b5ff3036 100644 +--- a/drivers/net/ethernet/cisco/enic/enic_main.c ++++ b/drivers/net/ethernet/cisco/enic/enic_main.c +@@ -1152,18 +1152,30 @@ static int enic_set_vf_port(struct net_device *netdev, int vf, + pp->request = nla_get_u8(port[IFLA_PORT_REQUEST]); + + if (port[IFLA_PORT_PROFILE]) { ++ if (nla_len(port[IFLA_PORT_PROFILE]) != PORT_PROFILE_MAX) { ++ memcpy(pp, &prev_pp, sizeof(*pp)); ++ return -EINVAL; ++ } + pp->set |= ENIC_SET_NAME; + memcpy(pp->name, nla_data(port[IFLA_PORT_PROFILE]), + PORT_PROFILE_MAX); + } + + if (port[IFLA_PORT_INSTANCE_UUID]) { ++ if (nla_len(port[IFLA_PORT_INSTANCE_UUID]) != PORT_UUID_MAX) { ++ memcpy(pp, &prev_pp, sizeof(*pp)); ++ return -EINVAL; ++ } + pp->set |= ENIC_SET_INSTANCE; + memcpy(pp->instance_uuid, + nla_data(port[IFLA_PORT_INSTANCE_UUID]), PORT_UUID_MAX); + } + + if (port[IFLA_PORT_HOST_UUID]) { ++ if (nla_len(port[IFLA_PORT_HOST_UUID]) != PORT_UUID_MAX) { ++ memcpy(pp, &prev_pp, sizeof(*pp)); ++ return -EINVAL; ++ } + pp->set |= ENIC_SET_HOST; + memcpy(pp->host_uuid, + nla_data(port[IFLA_PORT_HOST_UUID]), PORT_UUID_MAX); +-- +2.43.0 + diff --git a/queue-5.4/ipvlan-dont-use-skb-sk-in-ipvlan_process_v-4-6-_outb.patch b/queue-5.4/ipvlan-dont-use-skb-sk-in-ipvlan_process_v-4-6-_outb.patch new file mode 100644 index 00000000000..17f77e5d2a5 --- /dev/null +++ b/queue-5.4/ipvlan-dont-use-skb-sk-in-ipvlan_process_v-4-6-_outb.patch @@ -0,0 +1,107 @@ +From 6622fdef66e246f6abbc64e81f09d02204e5e802 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 May 2024 17:56:33 +0800 +Subject: ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound + +From: Yue Haibing + +[ Upstream commit b3dc6e8003b500861fa307e9a3400c52e78e4d3a ] + +Raw packet from PF_PACKET socket ontop of an IPv6-backed ipvlan device will +hit WARN_ON_ONCE() in sk_mc_loop() through sch_direct_xmit() path. + +WARNING: CPU: 2 PID: 0 at net/core/sock.c:775 sk_mc_loop+0x2d/0x70 +Modules linked in: sch_netem ipvlan rfkill cirrus drm_shmem_helper sg drm_kms_helper +CPU: 2 PID: 0 Comm: swapper/2 Kdump: loaded Not tainted 6.9.0+ #279 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 +RIP: 0010:sk_mc_loop+0x2d/0x70 +Code: fa 0f 1f 44 00 00 65 0f b7 15 f7 96 a3 4f 31 c0 66 85 d2 75 26 48 85 ff 74 1c +RSP: 0018:ffffa9584015cd78 EFLAGS: 00010212 +RAX: 0000000000000011 RBX: ffff91e585793e00 RCX: 0000000002c6a001 +RDX: 0000000000000000 RSI: 0000000000000040 RDI: ffff91e589c0f000 +RBP: ffff91e5855bd100 R08: 0000000000000000 R09: 3d00545216f43d00 +R10: ffff91e584fdcc50 R11: 00000060dd8616f4 R12: ffff91e58132d000 +R13: ffff91e584fdcc68 R14: ffff91e5869ce800 R15: ffff91e589c0f000 +FS: 0000000000000000(0000) GS:ffff91e898100000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007f788f7c44c0 CR3: 0000000008e1a000 CR4: 00000000000006f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + ? __warn (kernel/panic.c:693) + ? sk_mc_loop (net/core/sock.c:760) + ? report_bug (lib/bug.c:201 lib/bug.c:219) + ? handle_bug (arch/x86/kernel/traps.c:239) + ? exc_invalid_op (arch/x86/kernel/traps.c:260 (discriminator 1)) + ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621) + ? sk_mc_loop (net/core/sock.c:760) + ip6_finish_output2 (net/ipv6/ip6_output.c:83 (discriminator 1)) + ? nf_hook_slow (net/netfilter/core.c:626) + ip6_finish_output (net/ipv6/ip6_output.c:222) + ? __pfx_ip6_finish_output (net/ipv6/ip6_output.c:215) + ipvlan_xmit_mode_l3 (drivers/net/ipvlan/ipvlan_core.c:602) ipvlan + ipvlan_start_xmit (drivers/net/ipvlan/ipvlan_main.c:226) ipvlan + dev_hard_start_xmit (net/core/dev.c:3594) + sch_direct_xmit (net/sched/sch_generic.c:343) + __qdisc_run (net/sched/sch_generic.c:416) + net_tx_action (net/core/dev.c:5286) + handle_softirqs (kernel/softirq.c:555) + __irq_exit_rcu (kernel/softirq.c:589) + sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1043) + +The warning triggers as this: +packet_sendmsg + packet_snd //skb->sk is packet sk + __dev_queue_xmit + __dev_xmit_skb //q->enqueue is not NULL + __qdisc_run + sch_direct_xmit + dev_hard_start_xmit + ipvlan_start_xmit + ipvlan_xmit_mode_l3 //l3 mode + ipvlan_process_outbound //vepa flag + ipvlan_process_v6_outbound + ip6_local_out + __ip6_finish_output + ip6_finish_output2 //multicast packet + sk_mc_loop //sk->sk_family is AF_PACKET + +Call ip{6}_local_out() with NULL sk in ipvlan as other tunnels to fix this. + +Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.") +Suggested-by: Eric Dumazet +Signed-off-by: Yue Haibing +Reviewed-by: Eric Dumazet +Link: https://lore.kernel.org/r/20240529095633.613103-1-yuehaibing@huawei.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ipvlan/ipvlan_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c +index bfea28bd45027..d04b1450875b6 100644 +--- a/drivers/net/ipvlan/ipvlan_core.c ++++ b/drivers/net/ipvlan/ipvlan_core.c +@@ -440,7 +440,7 @@ static noinline_for_stack int ipvlan_process_v4_outbound(struct sk_buff *skb) + + memset(IPCB(skb), 0, sizeof(*IPCB(skb))); + +- err = ip_local_out(net, skb->sk, skb); ++ err = ip_local_out(net, NULL, skb); + if (unlikely(net_xmit_eval(err))) + DEV_STATS_INC(dev, tx_errors); + else +@@ -495,7 +495,7 @@ static int ipvlan_process_v6_outbound(struct sk_buff *skb) + + memset(IP6CB(skb), 0, sizeof(*IP6CB(skb))); + +- err = ip6_local_out(dev_net(dev), skb->sk, skb); ++ err = ip6_local_out(dev_net(dev), NULL, skb); + if (unlikely(net_xmit_eval(err))) + DEV_STATS_INC(dev, tx_errors); + else +-- +2.43.0 + diff --git a/queue-5.4/kconfig-fix-comparison-to-constant-symbols-m-n.patch b/queue-5.4/kconfig-fix-comparison-to-constant-symbols-m-n.patch new file mode 100644 index 00000000000..618d727f3bf --- /dev/null +++ b/queue-5.4/kconfig-fix-comparison-to-constant-symbols-m-n.patch @@ -0,0 +1,124 @@ +From 4be291bc929e81e88741b59470138d7d48fcea92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 May 2024 18:22:27 +0900 +Subject: kconfig: fix comparison to constant symbols, 'm', 'n' + +From: Masahiro Yamada + +[ Upstream commit aabdc960a283ba78086b0bf66ee74326f49e218e ] + +Currently, comparisons to 'm' or 'n' result in incorrect output. + +[Test Code] + + config MODULES + def_bool y + modules + + config A + def_tristate m + + config B + def_bool A > n + +CONFIG_B is unset, while CONFIG_B=y is expected. + +The reason for the issue is because Kconfig compares the tristate values +as strings. + +Currently, the .type fields in the constant symbol definitions, +symbol_{yes,mod,no} are unspecified, i.e., S_UNKNOWN. + +When expr_calc_value() evaluates 'A > n', it checks the types of 'A' and +'n' to determine how to compare them. + +The left-hand side, 'A', is a tristate symbol with a value of 'm', which +corresponds to a numeric value of 1. (Internally, 'y', 'm', and 'n' are +represented as 2, 1, and 0, respectively.) + +The right-hand side, 'n', has an unknown type, so it is treated as the +string "n" during the comparison. + +expr_calc_value() compares two values numerically only when both can +have numeric values. Otherwise, they are compared as strings. + + symbol numeric value ASCII code + ------------------------------------- + y 2 0x79 + m 1 0x6d + n 0 0x6e + +'m' is greater than 'n' if compared numerically (since 1 is greater +than 0), but smaller than 'n' if compared as strings (since the ASCII +code 0x6d is smaller than 0x6e). + +Specifying .type=S_TRISTATE for symbol_{yes,mod,no} fixes the above +test code. + +Doing so, however, would cause a regression to the following test code. + +[Test Code 2] + + config MODULES + def_bool n + modules + + config A + def_tristate n + + config B + def_bool A = m + +You would get CONFIG_B=y, while CONFIG_B should not be set. + +The reason is because sym_get_string_value() turns 'm' into 'n' when the +module feature is disabled. Consequently, expr_calc_value() evaluates +'A = n' instead of 'A = m'. This oddity has been hidden because the type +of 'm' was previously S_UNKNOWN instead of S_TRISTATE. + +sym_get_string_value() should not tweak the string because the tristate +value has already been correctly calculated. There is no reason to +return the string "n" where its tristate value is mod. + +Fixes: 31847b67bec0 ("kconfig: allow use of relations other than (in)equality") +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/kconfig/symbol.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/scripts/kconfig/symbol.c b/scripts/kconfig/symbol.c +index 342fefe5dba40..1e82838771003 100644 +--- a/scripts/kconfig/symbol.c ++++ b/scripts/kconfig/symbol.c +@@ -13,14 +13,17 @@ + + struct symbol symbol_yes = { + .name = "y", ++ .type = S_TRISTATE, + .curr = { "y", yes }, + .flags = SYMBOL_CONST|SYMBOL_VALID, + }, symbol_mod = { + .name = "m", ++ .type = S_TRISTATE, + .curr = { "m", mod }, + .flags = SYMBOL_CONST|SYMBOL_VALID, + }, symbol_no = { + .name = "n", ++ .type = S_TRISTATE, + .curr = { "n", no }, + .flags = SYMBOL_CONST|SYMBOL_VALID, + }, symbol_empty = { +@@ -771,8 +774,7 @@ const char *sym_get_string_value(struct symbol *sym) + case no: + return "n"; + case mod: +- sym_calc_value(modules_sym); +- return (modules_sym->curr.tri == no) ? "n" : "m"; ++ return "m"; + case yes: + return "y"; + } +-- +2.43.0 + diff --git a/queue-5.4/net-fec-add-fec_enet_deinit.patch b/queue-5.4/net-fec-add-fec_enet_deinit.patch new file mode 100644 index 00000000000..4c245c18762 --- /dev/null +++ b/queue-5.4/net-fec-add-fec_enet_deinit.patch @@ -0,0 +1,63 @@ +From 603a3ed844c26b450460c2f6e35f8b67fbe9bdde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 May 2024 13:05:28 +0800 +Subject: net:fec: Add fec_enet_deinit() + +From: Xiaolei Wang + +[ Upstream commit bf0497f53c8535f99b72041529d3f7708a6e2c0d ] + +When fec_probe() fails or fec_drv_remove() needs to release the +fec queue and remove a NAPI context, therefore add a function +corresponding to fec_enet_init() and call fec_enet_deinit() which +does the opposite to release memory and remove a NAPI context. + +Fixes: 59d0f7465644 ("net: fec: init multi queue date structure") +Signed-off-by: Xiaolei Wang +Reviewed-by: Wei Fang +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20240524050528.4115581-1-xiaolei.wang@windriver.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fec_main.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index b55d6ed9aa133..fb7039b001ef8 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -3371,6 +3371,14 @@ static int fec_enet_init(struct net_device *ndev) + return ret; + } + ++static void fec_enet_deinit(struct net_device *ndev) ++{ ++ struct fec_enet_private *fep = netdev_priv(ndev); ++ ++ netif_napi_del(&fep->napi); ++ fec_enet_free_queue(ndev); ++} ++ + #ifdef CONFIG_OF + static int fec_reset_phy(struct platform_device *pdev) + { +@@ -3735,6 +3743,7 @@ fec_probe(struct platform_device *pdev) + fec_enet_mii_remove(fep); + failed_mii_init: + failed_irq: ++ fec_enet_deinit(ndev); + failed_init: + fec_ptp_stop(pdev); + failed_reset: +@@ -3796,6 +3805,7 @@ fec_drv_remove(struct platform_device *pdev) + pm_runtime_put_noidle(&pdev->dev); + pm_runtime_disable(&pdev->dev); + ++ fec_enet_deinit(ndev); + free_netdev(ndev); + return 0; + } +-- +2.43.0 + diff --git a/queue-5.4/net-mlx5e-use-rx_missed_errors-instead-of-rx_dropped.patch b/queue-5.4/net-mlx5e-use-rx_missed_errors-instead-of-rx_dropped.patch new file mode 100644 index 00000000000..d5e17c07c41 --- /dev/null +++ b/queue-5.4/net-mlx5e-use-rx_missed_errors-instead-of-rx_dropped.patch @@ -0,0 +1,46 @@ +From ed00b170467b65d229841a3574f2b383c85912c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 May 2024 22:26:58 +0300 +Subject: net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting + buffer exhaustion + +From: Carolina Jubran + +[ Upstream commit 5c74195d5dd977e97556e6fa76909b831c241230 ] + +Previously, the driver incorrectly used rx_dropped to report device +buffer exhaustion. + +According to the documentation, rx_dropped should not be used to count +packets dropped due to buffer exhaustion, which is the purpose of +rx_missed_errors. + +Use rx_missed_errors as intended for counting packets dropped due to +buffer exhaustion. + +Fixes: 269e6b3af3bf ("net/mlx5e: Report additional error statistics in get stats ndo") +Signed-off-by: Carolina Jubran +Signed-off-by: Tariq Toukan +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 35630b538c826..facbbd3fac66a 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -3667,7 +3667,7 @@ mlx5e_get_stats(struct net_device *dev, struct rtnl_link_stats64 *stats) + mlx5e_fold_sw_stats64(priv, stats); + } + +- stats->rx_dropped = priv->stats.qcnt.rx_out_of_buffer; ++ stats->rx_missed_errors = priv->stats.qcnt.rx_out_of_buffer; + + stats->rx_length_errors = + PPORT_802_3_GET(pstats, a_in_range_length_errors) + +-- +2.43.0 + diff --git a/queue-5.4/net-usb-smsc95xx-fix-changing-led_sel-bit-value-upda.patch b/queue-5.4/net-usb-smsc95xx-fix-changing-led_sel-bit-value-upda.patch new file mode 100644 index 00000000000..99ee36d4ce7 --- /dev/null +++ b/queue-5.4/net-usb-smsc95xx-fix-changing-led_sel-bit-value-upda.patch @@ -0,0 +1,68 @@ +From 7f3078f3e8d4b7256b64e02271e19878f06ea90f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 May 2024 14:23:14 +0530 +Subject: net: usb: smsc95xx: fix changing LED_SEL bit value updated from + EEPROM + +From: Parthiban Veerasooran + +[ Upstream commit 52a2f0608366a629d43dacd3191039c95fef74ba ] + +LED Select (LED_SEL) bit in the LED General Purpose IO Configuration +register is used to determine the functionality of external LED pins +(Speed Indicator, Link and Activity Indicator, Full Duplex Link +Indicator). The default value for this bit is 0 when no EEPROM is +present. If a EEPROM is present, the default value is the value of the +LED Select bit in the Configuration Flags of the EEPROM. A USB Reset or +Lite Reset (LRST) will cause this bit to be restored to the image value +last loaded from EEPROM, or to be set to 0 if no EEPROM is present. + +While configuring the dual purpose GPIO/LED pins to LED outputs in the +LED General Purpose IO Configuration register, the LED_SEL bit is changed +as 0 and resulting the configured value from the EEPROM is cleared. The +issue is fixed by using read-modify-write approach. + +Fixes: f293501c61c5 ("smsc95xx: configure LED outputs") +Signed-off-by: Parthiban Veerasooran +Reviewed-by: Simon Horman +Reviewed-by: Woojung Huh +Link: https://lore.kernel.org/r/20240523085314.167650-1-Parthiban.Veerasooran@microchip.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/usb/smsc95xx.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c +index 7fe5673e256e6..2dd4c78f5465b 100644 +--- a/drivers/net/usb/smsc95xx.c ++++ b/drivers/net/usb/smsc95xx.c +@@ -1022,7 +1022,7 @@ static int smsc95xx_phy_initialize(struct usbnet *dev) + static int smsc95xx_reset(struct usbnet *dev) + { + struct smsc95xx_priv *pdata = dev->driver_priv; +- u32 read_buf, write_buf, burst_cap; ++ u32 read_buf, burst_cap; + int ret = 0, timeout; + + netif_dbg(dev, ifup, dev->net, "entering smsc95xx_reset\n"); +@@ -1164,10 +1164,13 @@ static int smsc95xx_reset(struct usbnet *dev) + return ret; + netif_dbg(dev, ifup, dev->net, "ID_REV = 0x%08x\n", read_buf); + ++ ret = smsc95xx_read_reg(dev, LED_GPIO_CFG, &read_buf); ++ if (ret < 0) ++ return ret; + /* Configure GPIO pins as LED outputs */ +- write_buf = LED_GPIO_CFG_SPD_LED | LED_GPIO_CFG_LNK_LED | +- LED_GPIO_CFG_FDX_LED; +- ret = smsc95xx_write_reg(dev, LED_GPIO_CFG, write_buf); ++ read_buf |= LED_GPIO_CFG_SPD_LED | LED_GPIO_CFG_LNK_LED | ++ LED_GPIO_CFG_FDX_LED; ++ ret = smsc95xx_write_reg(dev, LED_GPIO_CFG, read_buf); + if (ret < 0) + return ret; + +-- +2.43.0 + diff --git a/queue-5.4/netfilter-nfnetlink_queue-acquire-rcu_read_lock-in-i.patch b/queue-5.4/netfilter-nfnetlink_queue-acquire-rcu_read_lock-in-i.patch new file mode 100644 index 00000000000..1f4d1b1dc3b --- /dev/null +++ b/queue-5.4/netfilter-nfnetlink_queue-acquire-rcu_read_lock-in-i.patch @@ -0,0 +1,79 @@ +From b776dea2972d5118a54645c771e43c65abc60194 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 May 2024 13:23:39 +0000 +Subject: netfilter: nfnetlink_queue: acquire rcu_read_lock() in + instance_destroy_rcu() + +From: Eric Dumazet + +[ Upstream commit dc21c6cc3d6986d938efbf95de62473982c98dec ] + +syzbot reported that nf_reinject() could be called without rcu_read_lock() : + +WARNING: suspicious RCU usage +6.9.0-rc7-syzkaller-02060-g5c1672705a1a #0 Not tainted + +net/netfilter/nfnetlink_queue.c:263 suspicious rcu_dereference_check() usage! + +other info that might help us debug this: + +rcu_scheduler_active = 2, debug_locks = 1 +2 locks held by syz-executor.4/13427: + #0: ffffffff8e334f60 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline] + #0: ffffffff8e334f60 (rcu_callback){....}-{0:0}, at: rcu_do_batch kernel/rcu/tree.c:2190 [inline] + #0: ffffffff8e334f60 (rcu_callback){....}-{0:0}, at: rcu_core+0xa86/0x1830 kernel/rcu/tree.c:2471 + #1: ffff88801ca92958 (&inst->lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] + #1: ffff88801ca92958 (&inst->lock){+.-.}-{2:2}, at: nfqnl_flush net/netfilter/nfnetlink_queue.c:405 [inline] + #1: ffff88801ca92958 (&inst->lock){+.-.}-{2:2}, at: instance_destroy_rcu+0x30/0x220 net/netfilter/nfnetlink_queue.c:172 + +stack backtrace: +CPU: 0 PID: 13427 Comm: syz-executor.4 Not tainted 6.9.0-rc7-syzkaller-02060-g5c1672705a1a #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 + lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712 + nf_reinject net/netfilter/nfnetlink_queue.c:323 [inline] + nfqnl_reinject+0x6ec/0x1120 net/netfilter/nfnetlink_queue.c:397 + nfqnl_flush net/netfilter/nfnetlink_queue.c:410 [inline] + instance_destroy_rcu+0x1ae/0x220 net/netfilter/nfnetlink_queue.c:172 + rcu_do_batch kernel/rcu/tree.c:2196 [inline] + rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2471 + handle_softirqs+0x2d6/0x990 kernel/softirq.c:554 + __do_softirq kernel/softirq.c:588 [inline] + invoke_softirq kernel/softirq.c:428 [inline] + __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637 + irq_exit_rcu+0x9/0x30 kernel/softirq.c:649 + instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] + sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 + + + +Fixes: 9872bec773c2 ("[NETFILTER]: nfnetlink: use RCU for queue instances hash") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Acked-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nfnetlink_queue.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c +index 772f8c69818c6..c4005a42a78ba 100644 +--- a/net/netfilter/nfnetlink_queue.c ++++ b/net/netfilter/nfnetlink_queue.c +@@ -167,7 +167,9 @@ instance_destroy_rcu(struct rcu_head *head) + struct nfqnl_instance *inst = container_of(head, struct nfqnl_instance, + rcu); + ++ rcu_read_lock(); + nfqnl_flush(inst, NULL, 0); ++ rcu_read_unlock(); + kfree(inst); + module_put(THIS_MODULE); + } +-- +2.43.0 + diff --git a/queue-5.4/netfilter-tproxy-bail-out-if-ip-has-been-disabled-on.patch b/queue-5.4/netfilter-tproxy-bail-out-if-ip-has-been-disabled-on.patch new file mode 100644 index 00000000000..d23ac0a2512 --- /dev/null +++ b/queue-5.4/netfilter-tproxy-bail-out-if-ip-has-been-disabled-on.patch @@ -0,0 +1,45 @@ +From d926d0f3f6dc4fbd7fa506ea3db7be0af6dcf2f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 May 2024 12:27:15 +0200 +Subject: netfilter: tproxy: bail out if IP has been disabled on the device + +From: Florian Westphal + +[ Upstream commit 21a673bddc8fd4873c370caf9ae70ffc6d47e8d3 ] + +syzbot reports: +general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN PTI +KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] +[..] +RIP: 0010:nf_tproxy_laddr4+0xb7/0x340 net/ipv4/netfilter/nf_tproxy_ipv4.c:62 +Call Trace: + nft_tproxy_eval_v4 net/netfilter/nft_tproxy.c:56 [inline] + nft_tproxy_eval+0xa9a/0x1a00 net/netfilter/nft_tproxy.c:168 + +__in_dev_get_rcu() can return NULL, so check for this. + +Reported-and-tested-by: syzbot+b94a6818504ea90d7661@syzkaller.appspotmail.com +Fixes: cc6eb4338569 ("tproxy: use the interface primary IP address as a default value for --on-ip") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/ipv4/netfilter/nf_tproxy_ipv4.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/ipv4/netfilter/nf_tproxy_ipv4.c b/net/ipv4/netfilter/nf_tproxy_ipv4.c +index 61cb2341f50fe..7c1a0cd9f4359 100644 +--- a/net/ipv4/netfilter/nf_tproxy_ipv4.c ++++ b/net/ipv4/netfilter/nf_tproxy_ipv4.c +@@ -58,6 +58,8 @@ __be32 nf_tproxy_laddr4(struct sk_buff *skb, __be32 user_laddr, __be32 daddr) + + laddr = 0; + indev = __in_dev_get_rcu(skb->dev); ++ if (!indev) ++ return daddr; + + in_dev_for_each_ifa_rcu(ifa, indev) { + if (ifa->ifa_flags & IFA_F_SECONDARY) +-- +2.43.0 + diff --git a/queue-5.4/nvmet-fix-ns-enable-disable-possible-hang.patch b/queue-5.4/nvmet-fix-ns-enable-disable-possible-hang.patch new file mode 100644 index 00000000000..a5cb5e4c620 --- /dev/null +++ b/queue-5.4/nvmet-fix-ns-enable-disable-possible-hang.patch @@ -0,0 +1,59 @@ +From 1a5efd83a3b663fd425feea8f1abd5d49d354ec6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 23:20:28 +0300 +Subject: nvmet: fix ns enable/disable possible hang + +From: Sagi Grimberg + +[ Upstream commit f97914e35fd98b2b18fb8a092e0a0799f73afdfe ] + +When disabling an nvmet namespace, there is a period where the +subsys->lock is released, as the ns disable waits for backend IO to +complete, and the ns percpu ref to be properly killed. The original +intent was to avoid taking the subsystem lock for a prolong period as +other processes may need to acquire it (for example new incoming +connections). + +However, it opens up a window where another process may come in and +enable the ns, (re)intiailizing the ns percpu_ref, causing the disable +sequence to hang. + +Solve this by taking the global nvmet_config_sem over the entire configfs +enable/disable sequence. + +Fixes: a07b4970f464 ("nvmet: add a generic NVMe target") +Signed-off-by: Sagi Grimberg +Reviewed-by: Christoph Hellwig +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/configfs.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c +index baf8a3e4ed12a..9add3516ae2e2 100644 +--- a/drivers/nvme/target/configfs.c ++++ b/drivers/nvme/target/configfs.c +@@ -507,10 +507,18 @@ static ssize_t nvmet_ns_enable_store(struct config_item *item, + if (strtobool(page, &enable)) + return -EINVAL; + ++ /* ++ * take a global nvmet_config_sem because the disable routine has a ++ * window where it releases the subsys-lock, giving a chance to ++ * a parallel enable to concurrently execute causing the disable to ++ * have a misaccounting of the ns percpu_ref. ++ */ ++ down_write(&nvmet_config_sem); + if (enable) + ret = nvmet_ns_enable(ns); + else + nvmet_ns_disable(ns); ++ up_write(&nvmet_config_sem); + + return ret ? ret : count; + } +-- +2.43.0 + diff --git a/queue-5.4/series b/queue-5.4/series index d612a56d04c..9acb065b9af 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -147,3 +147,17 @@ net-fec-avoid-lock-evasion-when-reading-pps_enable.patch tcp-remove-64-kbyte-limit-for-initial-tp-rcv_wnd-val.patch nfc-nci-fix-kcov-check-in-nci_rx_work.patch nfc-nci-fix-handling-of-zero-length-payload-packets-.patch +netfilter-nfnetlink_queue-acquire-rcu_read_lock-in-i.patch +spi-don-t-mark-message-dma-mapped-when-no-transfer-i.patch +nvmet-fix-ns-enable-disable-possible-hang.patch +net-mlx5e-use-rx_missed_errors-instead-of-rx_dropped.patch +dma-buf-sw-sync-don-t-enable-irq-from-sync_print_obj.patch +enic-validate-length-of-nl-attributes-in-enic_set_vf.patch +smsc95xx-remove-redundant-function-arguments.patch +smsc95xx-use-usbnet-driver_priv.patch +net-usb-smsc95xx-fix-changing-led_sel-bit-value-upda.patch +net-fec-add-fec_enet_deinit.patch +netfilter-tproxy-bail-out-if-ip-has-been-disabled-on.patch +kconfig-fix-comparison-to-constant-symbols-m-n.patch +spi-stm32-don-t-warn-about-spurious-interrupts.patch +ipvlan-dont-use-skb-sk-in-ipvlan_process_v-4-6-_outb.patch diff --git a/queue-5.4/smsc95xx-remove-redundant-function-arguments.patch b/queue-5.4/smsc95xx-remove-redundant-function-arguments.patch new file mode 100644 index 00000000000..ac8e812ca77 --- /dev/null +++ b/queue-5.4/smsc95xx-remove-redundant-function-arguments.patch @@ -0,0 +1,128 @@ +From 35bfb08dd9a60c107b8460ebc44cc378fb0d7351 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 13:17:15 +0200 +Subject: smsc95xx: remove redundant function arguments + +From: Andre Edich + +[ Upstream commit 368be1ca28f66deba16627e2a02e78adedd023a6 ] + +This patch removes arguments netdev and phy_id from the functions +smsc95xx_mdio_read_nopm and smsc95xx_mdio_write_nopm. Both removed +arguments are recovered from a new argument `struct usbnet *dev`. + +Signed-off-by: Andre Edich +Signed-off-by: David S. Miller +Stable-dep-of: 52a2f0608366 ("net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM") +Signed-off-by: Sasha Levin +--- + drivers/net/usb/smsc95xx.c | 35 +++++++++++++++++------------------ + 1 file changed, 17 insertions(+), 18 deletions(-) + +diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c +index 1aa99727d40c7..6fe6edc59623d 100644 +--- a/drivers/net/usb/smsc95xx.c ++++ b/drivers/net/usb/smsc95xx.c +@@ -261,16 +261,18 @@ static void __smsc95xx_mdio_write(struct net_device *netdev, int phy_id, + mutex_unlock(&dev->phy_mutex); + } + +-static int smsc95xx_mdio_read_nopm(struct net_device *netdev, int phy_id, +- int idx) ++static int smsc95xx_mdio_read_nopm(struct usbnet *dev, int idx) + { +- return __smsc95xx_mdio_read(netdev, phy_id, idx, 1); ++ struct mii_if_info *mii = &dev->mii; ++ ++ return __smsc95xx_mdio_read(dev->net, mii->phy_id, idx, 1); + } + +-static void smsc95xx_mdio_write_nopm(struct net_device *netdev, int phy_id, +- int idx, int regval) ++static void smsc95xx_mdio_write_nopm(struct usbnet *dev, int idx, int regval) + { +- __smsc95xx_mdio_write(netdev, phy_id, idx, regval, 1); ++ struct mii_if_info *mii = &dev->mii; ++ ++ __smsc95xx_mdio_write(dev->net, mii->phy_id, idx, regval, 1); + } + + static int smsc95xx_mdio_read(struct net_device *netdev, int phy_id, int idx) +@@ -1347,39 +1349,37 @@ static u32 smsc_crc(const u8 *buffer, size_t len, int filter) + + static int smsc95xx_enable_phy_wakeup_interrupts(struct usbnet *dev, u16 mask) + { +- struct mii_if_info *mii = &dev->mii; + int ret; + + netdev_dbg(dev->net, "enabling PHY wakeup interrupts\n"); + + /* read to clear */ +- ret = smsc95xx_mdio_read_nopm(dev->net, mii->phy_id, PHY_INT_SRC); ++ ret = smsc95xx_mdio_read_nopm(dev, PHY_INT_SRC); + if (ret < 0) + return ret; + + /* enable interrupt source */ +- ret = smsc95xx_mdio_read_nopm(dev->net, mii->phy_id, PHY_INT_MASK); ++ ret = smsc95xx_mdio_read_nopm(dev, PHY_INT_MASK); + if (ret < 0) + return ret; + + ret |= mask; + +- smsc95xx_mdio_write_nopm(dev->net, mii->phy_id, PHY_INT_MASK, ret); ++ smsc95xx_mdio_write_nopm(dev, PHY_INT_MASK, ret); + + return 0; + } + + static int smsc95xx_link_ok_nopm(struct usbnet *dev) + { +- struct mii_if_info *mii = &dev->mii; + int ret; + + /* first, a dummy read, needed to latch some MII phys */ +- ret = smsc95xx_mdio_read_nopm(dev->net, mii->phy_id, MII_BMSR); ++ ret = smsc95xx_mdio_read_nopm(dev, MII_BMSR); + if (ret < 0) + return ret; + +- ret = smsc95xx_mdio_read_nopm(dev->net, mii->phy_id, MII_BMSR); ++ ret = smsc95xx_mdio_read_nopm(dev, MII_BMSR); + if (ret < 0) + return ret; + +@@ -1428,7 +1428,6 @@ static int smsc95xx_enter_suspend0(struct usbnet *dev) + static int smsc95xx_enter_suspend1(struct usbnet *dev) + { + struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); +- struct mii_if_info *mii = &dev->mii; + u32 val; + int ret; + +@@ -1436,17 +1435,17 @@ static int smsc95xx_enter_suspend1(struct usbnet *dev) + * compatibility with non-standard link partners + */ + if (pdata->features & FEATURE_PHY_NLP_CROSSOVER) +- smsc95xx_mdio_write_nopm(dev->net, mii->phy_id, PHY_EDPD_CONFIG, +- PHY_EDPD_CONFIG_DEFAULT); ++ smsc95xx_mdio_write_nopm(dev, PHY_EDPD_CONFIG, ++ PHY_EDPD_CONFIG_DEFAULT); + + /* enable energy detect power-down mode */ +- ret = smsc95xx_mdio_read_nopm(dev->net, mii->phy_id, PHY_MODE_CTRL_STS); ++ ret = smsc95xx_mdio_read_nopm(dev, PHY_MODE_CTRL_STS); + if (ret < 0) + return ret; + + ret |= MODE_CTRL_STS_EDPWRDOWN_; + +- smsc95xx_mdio_write_nopm(dev->net, mii->phy_id, PHY_MODE_CTRL_STS, ret); ++ smsc95xx_mdio_write_nopm(dev, PHY_MODE_CTRL_STS, ret); + + /* enter SUSPEND1 mode */ + ret = smsc95xx_read_reg_nopm(dev, PM_CTRL, &val); +-- +2.43.0 + diff --git a/queue-5.4/smsc95xx-use-usbnet-driver_priv.patch b/queue-5.4/smsc95xx-use-usbnet-driver_priv.patch new file mode 100644 index 00000000000..f941ebb84d6 --- /dev/null +++ b/queue-5.4/smsc95xx-use-usbnet-driver_priv.patch @@ -0,0 +1,246 @@ +From c644b93b23ae3536a6729fcfef7a6a1a79f88734 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 13:17:16 +0200 +Subject: smsc95xx: use usbnet->driver_priv + +From: Andre Edich + +[ Upstream commit ad90a73f0236c41f7a2dedc2e75c7b5a364eb93e ] + +Using `void *driver_priv` instead of `unsigned long data[]` is more +straightforward way to recover the `struct smsc95xx_priv *` from the +`struct net_device *`. + +Signed-off-by: Andre Edich +Signed-off-by: David S. Miller +Stable-dep-of: 52a2f0608366 ("net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM") +Signed-off-by: Sasha Levin +--- + drivers/net/usb/smsc95xx.c | 61 +++++++++++++++++--------------------- + 1 file changed, 28 insertions(+), 33 deletions(-) + +diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c +index 6fe6edc59623d..7fe5673e256e6 100644 +--- a/drivers/net/usb/smsc95xx.c ++++ b/drivers/net/usb/smsc95xx.c +@@ -457,7 +457,7 @@ static unsigned int smsc95xx_hash(char addr[ETH_ALEN]) + static void smsc95xx_set_multicast(struct net_device *netdev) + { + struct usbnet *dev = netdev_priv(netdev); +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + unsigned long flags; + int ret; + +@@ -552,7 +552,7 @@ static int smsc95xx_phy_update_flowcontrol(struct usbnet *dev, u8 duplex, + + static int smsc95xx_link_reset(struct usbnet *dev) + { +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + struct mii_if_info *mii = &dev->mii; + struct ethtool_cmd ecmd = { .cmd = ETHTOOL_GSET }; + unsigned long flags; +@@ -620,7 +620,7 @@ static void smsc95xx_status(struct usbnet *dev, struct urb *urb) + + static void set_carrier(struct usbnet *dev, bool link) + { +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + + if (pdata->link_ok == link) + return; +@@ -749,7 +749,7 @@ static void smsc95xx_ethtool_get_wol(struct net_device *net, + struct ethtool_wolinfo *wolinfo) + { + struct usbnet *dev = netdev_priv(net); +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + + wolinfo->supported = SUPPORTED_WAKE; + wolinfo->wolopts = pdata->wolopts; +@@ -759,7 +759,7 @@ static int smsc95xx_ethtool_set_wol(struct net_device *net, + struct ethtool_wolinfo *wolinfo) + { + struct usbnet *dev = netdev_priv(net); +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + int ret; + + if (wolinfo->wolopts & ~SUPPORTED_WAKE) +@@ -798,7 +798,7 @@ static int get_mdix_status(struct net_device *net) + static void set_mdix_status(struct net_device *net, __u8 mdix_ctrl) + { + struct usbnet *dev = netdev_priv(net); +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + int buf; + + if ((pdata->chip_id == ID_REV_CHIP_ID_9500A_) || +@@ -847,7 +847,7 @@ static int smsc95xx_get_link_ksettings(struct net_device *net, + struct ethtool_link_ksettings *cmd) + { + struct usbnet *dev = netdev_priv(net); +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + int retval; + + retval = usbnet_get_link_ksettings(net, cmd); +@@ -862,7 +862,7 @@ static int smsc95xx_set_link_ksettings(struct net_device *net, + const struct ethtool_link_ksettings *cmd) + { + struct usbnet *dev = netdev_priv(net); +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + int retval; + + if (pdata->mdix_ctrl != cmd->base.eth_tp_mdix_ctrl) +@@ -944,7 +944,7 @@ static int smsc95xx_set_mac_address(struct usbnet *dev) + /* starts the TX path */ + static int smsc95xx_start_tx_path(struct usbnet *dev) + { +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + unsigned long flags; + int ret; + +@@ -964,7 +964,7 @@ static int smsc95xx_start_tx_path(struct usbnet *dev) + /* Starts the Receive path */ + static int smsc95xx_start_rx_path(struct usbnet *dev, int in_pm) + { +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + unsigned long flags; + + spin_lock_irqsave(&pdata->mac_cr_lock, flags); +@@ -1021,7 +1021,7 @@ static int smsc95xx_phy_initialize(struct usbnet *dev) + + static int smsc95xx_reset(struct usbnet *dev) + { +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + u32 read_buf, write_buf, burst_cap; + int ret = 0, timeout; + +@@ -1249,7 +1249,7 @@ static const struct net_device_ops smsc95xx_netdev_ops = { + + static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf) + { +- struct smsc95xx_priv *pdata = NULL; ++ struct smsc95xx_priv *pdata; + u32 val; + int ret; + +@@ -1261,13 +1261,12 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf) + return ret; + } + +- dev->data[0] = (unsigned long)kzalloc(sizeof(struct smsc95xx_priv), +- GFP_KERNEL); +- +- pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ pdata = kzalloc(sizeof(*pdata), GFP_KERNEL); + if (!pdata) + return -ENOMEM; + ++ dev->driver_priv = pdata; ++ + spin_lock_init(&pdata->mac_cr_lock); + + /* LAN95xx devices do not alter the computed checksum of 0 to 0xffff. +@@ -1330,15 +1329,11 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf) + + static void smsc95xx_unbind(struct usbnet *dev, struct usb_interface *intf) + { +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); +- +- if (pdata) { +- cancel_delayed_work_sync(&pdata->carrier_check); +- netif_dbg(dev, ifdown, dev->net, "free pdata\n"); +- kfree(pdata); +- pdata = NULL; +- dev->data[0] = 0; +- } ++ struct smsc95xx_priv *pdata = dev->driver_priv; ++ ++ cancel_delayed_work_sync(&pdata->carrier_check); ++ netif_dbg(dev, ifdown, dev->net, "free pdata\n"); ++ kfree(pdata); + } + + static u32 smsc_crc(const u8 *buffer, size_t len, int filter) +@@ -1388,7 +1383,7 @@ static int smsc95xx_link_ok_nopm(struct usbnet *dev) + + static int smsc95xx_enter_suspend0(struct usbnet *dev) + { +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + u32 val; + int ret; + +@@ -1427,7 +1422,7 @@ static int smsc95xx_enter_suspend0(struct usbnet *dev) + + static int smsc95xx_enter_suspend1(struct usbnet *dev) + { +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + u32 val; + int ret; + +@@ -1474,7 +1469,7 @@ static int smsc95xx_enter_suspend1(struct usbnet *dev) + + static int smsc95xx_enter_suspend2(struct usbnet *dev) + { +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + u32 val; + int ret; + +@@ -1496,7 +1491,7 @@ static int smsc95xx_enter_suspend2(struct usbnet *dev) + + static int smsc95xx_enter_suspend3(struct usbnet *dev) + { +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + u32 val; + int ret; + +@@ -1535,7 +1530,7 @@ static int smsc95xx_enter_suspend3(struct usbnet *dev) + + static int smsc95xx_autosuspend(struct usbnet *dev, u32 link_up) + { +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + int ret; + + if (!netif_running(dev->net)) { +@@ -1583,7 +1578,7 @@ static int smsc95xx_autosuspend(struct usbnet *dev, u32 link_up) + static int smsc95xx_suspend(struct usb_interface *intf, pm_message_t message) + { + struct usbnet *dev = usb_get_intfdata(intf); +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + u32 val, link_up; + int ret; + +@@ -1854,7 +1849,7 @@ static int smsc95xx_resume(struct usb_interface *intf) + u32 val; + + BUG_ON(!dev); +- pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ pdata = dev->driver_priv; + suspend_flags = pdata->suspend_flags; + + netdev_dbg(dev->net, "resume suspend_flags=0x%02x\n", suspend_flags); +@@ -2079,7 +2074,7 @@ static struct sk_buff *smsc95xx_tx_fixup(struct usbnet *dev, + + static int smsc95xx_manage_power(struct usbnet *dev, int on) + { +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + + dev->intf->needs_remote_wakeup = on; + +-- +2.43.0 + diff --git a/queue-5.4/spi-don-t-mark-message-dma-mapped-when-no-transfer-i.patch b/queue-5.4/spi-don-t-mark-message-dma-mapped-when-no-transfer-i.patch new file mode 100644 index 00000000000..f77ceaa96ed --- /dev/null +++ b/queue-5.4/spi-don-t-mark-message-dma-mapped-when-no-transfer-i.patch @@ -0,0 +1,48 @@ +From d88499bc76cd8e7cf8809b55860473f672c3e483 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 May 2024 20:09:49 +0300 +Subject: spi: Don't mark message DMA mapped when no transfer in it is + +From: Andy Shevchenko + +[ Upstream commit 9f788ba457b45b0ce422943fcec9fa35c4587764 ] + +There is no need to set the DMA mapped flag of the message if it has +no mapped transfers. Moreover, it may give the code a chance to take +the wrong paths, i.e. to exercise DMA related APIs on unmapped data. +Make __spi_map_msg() to bail earlier on the above mentioned cases. + +Fixes: 99adef310f68 ("spi: Provide core support for DMA mapping transfers") +Signed-off-by: Andy Shevchenko +Link: https://msgid.link/r/20240522171018.3362521-2-andriy.shevchenko@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index b18ae50db1f52..0f9410ed48290 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -931,6 +931,7 @@ static int __spi_map_msg(struct spi_controller *ctlr, struct spi_message *msg) + else + rx_dev = ctlr->dev.parent; + ++ ret = -ENOMSG; + list_for_each_entry(xfer, &msg->transfers, transfer_list) { + if (!ctlr->can_dma(ctlr, msg->spi, xfer)) + continue; +@@ -954,6 +955,9 @@ static int __spi_map_msg(struct spi_controller *ctlr, struct spi_message *msg) + } + } + } ++ /* No transfer has been mapped, bail out with success */ ++ if (ret) ++ return 0; + + ctlr->cur_msg_mapped = true; + +-- +2.43.0 + diff --git a/queue-5.4/spi-stm32-don-t-warn-about-spurious-interrupts.patch b/queue-5.4/spi-stm32-don-t-warn-about-spurious-interrupts.patch new file mode 100644 index 00000000000..06e7c854564 --- /dev/null +++ b/queue-5.4/spi-stm32-don-t-warn-about-spurious-interrupts.patch @@ -0,0 +1,43 @@ +From 71bb14d7bfa69791b9a69a47f1633df1d9fe820d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 12:52:42 +0200 +Subject: spi: stm32: Don't warn about spurious interrupts +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 95d7c452a26564ef0c427f2806761b857106d8c4 ] + +The dev_warn to notify about a spurious interrupt was introduced with +the reasoning that these are unexpected. However spurious interrupts +tend to trigger continously and the error message on the serial console +prevents that the core's detection of spurious interrupts kicks in +(which disables the irq) and just floods the console. + +Fixes: c64e7efe46b7 ("spi: stm32: make spurious and overrun interrupts visible") +Signed-off-by: Uwe Kleine-König +Link: https://msgid.link/r/20240521105241.62400-2-u.kleine-koenig@pengutronix.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-stm32.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index e843e9453c71c..759c502b094da 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -927,7 +927,7 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id) + mask |= STM32H7_SPI_SR_TXP | STM32H7_SPI_SR_RXP; + + if (!(sr & mask)) { +- dev_warn(spi->dev, "spurious IT (sr=0x%08x, ier=0x%08x)\n", ++ dev_vdbg(spi->dev, "spurious IT (sr=0x%08x, ier=0x%08x)\n", + sr, ier); + spin_unlock_irqrestore(&spi->lock, flags); + return IRQ_NONE; +-- +2.43.0 +