From: Sasha Levin Date: Sun, 28 Mar 2021 03:51:23 +0000 (-0400) Subject: Fixes for 4.14 X-Git-Tag: v5.11.11~54 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b93a2080ce0863011e6c29442b2b42f4c84b7067;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.14 Signed-off-by: Sasha Levin --- diff --git a/queue-4.14/arm64-kdump-update-ppos-when-reading-elfcorehdr.patch b/queue-4.14/arm64-kdump-update-ppos-when-reading-elfcorehdr.patch new file mode 100644 index 00000000000..f3172713220 --- /dev/null +++ b/queue-4.14/arm64-kdump-update-ppos-when-reading-elfcorehdr.patch @@ -0,0 +1,40 @@ +From 841d3bd5bcc26bb5e84996749f58aa3b7041114f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 16:50:54 -0400 +Subject: arm64: kdump: update ppos when reading elfcorehdr + +From: Pavel Tatashin + +[ Upstream commit 141f8202cfa4192c3af79b6cbd68e7760bb01b5a ] + +The ppos points to a position in the old kernel memory (and in case of +arm64 in the crash kernel since elfcorehdr is passed as a segment). The +function should update the ppos by the amount that was read. This bug is +not exposed by accident, but other platforms update this value properly. +So, fix it in ARM64 version of elfcorehdr_read() as well. + +Signed-off-by: Pavel Tatashin +Fixes: e62aaeac426a ("arm64: kdump: provide /proc/vmcore file") +Reviewed-by: Tyler Hicks +Link: https://lore.kernel.org/r/20210319205054.743368-1-pasha.tatashin@soleen.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/crash_dump.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/kernel/crash_dump.c b/arch/arm64/kernel/crash_dump.c +index f46d57c31443..76905a258550 100644 +--- a/arch/arm64/kernel/crash_dump.c ++++ b/arch/arm64/kernel/crash_dump.c +@@ -67,5 +67,7 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf, + ssize_t elfcorehdr_read(char *buf, size_t count, u64 *ppos) + { + memcpy(buf, phys_to_virt((phys_addr_t)*ppos), count); ++ *ppos += count; ++ + return count; + } +-- +2.30.1 + diff --git a/queue-4.14/bus-omap_l3_noc-mark-l3-irqs-as-irqf_no_thread.patch b/queue-4.14/bus-omap_l3_noc-mark-l3-irqs-as-irqf_no_thread.patch new file mode 100644 index 00000000000..4fcd67dc606 --- /dev/null +++ b/queue-4.14/bus-omap_l3_noc-mark-l3-irqs-as-irqf_no_thread.patch @@ -0,0 +1,51 @@ +From fbb78c2fd17bce75529d8e9209ddbd3fe3b3d5a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Jan 2021 21:15:48 +0200 +Subject: bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD + +From: Grygorii Strashko + +[ Upstream commit 7d7275b3e866cf8092bd12553ec53ba26864f7bb ] + +The main purpose of l3 IRQs is to catch OCP bus access errors and identify +corresponding code places by showing call stack, so it's important to +handle L3 interconnect errors as fast as possible. On RT these IRQs will +became threaded and will be scheduled much more late from the moment actual +error occurred so showing completely useless information. + +Hence, mark l3 IRQs as IRQF_NO_THREAD so they will not be forced threaded +on RT or if force_irqthreads = true. + +Fixes: 0ee7261c9212 ("drivers: bus: Move the OMAP interconnect driver to drivers/bus/") +Signed-off-by: Grygorii Strashko +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + drivers/bus/omap_l3_noc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/bus/omap_l3_noc.c b/drivers/bus/omap_l3_noc.c +index 5012e3ad1225..624f74d03a83 100644 +--- a/drivers/bus/omap_l3_noc.c ++++ b/drivers/bus/omap_l3_noc.c +@@ -285,7 +285,7 @@ static int omap_l3_probe(struct platform_device *pdev) + */ + l3->debug_irq = platform_get_irq(pdev, 0); + ret = devm_request_irq(l3->dev, l3->debug_irq, l3_interrupt_handler, +- 0x0, "l3-dbg-irq", l3); ++ IRQF_NO_THREAD, "l3-dbg-irq", l3); + if (ret) { + dev_err(l3->dev, "request_irq failed for %d\n", + l3->debug_irq); +@@ -294,7 +294,7 @@ static int omap_l3_probe(struct platform_device *pdev) + + l3->app_irq = platform_get_irq(pdev, 1); + ret = devm_request_irq(l3->dev, l3->app_irq, l3_interrupt_handler, +- 0x0, "l3-app-irq", l3); ++ IRQF_NO_THREAD, "l3-app-irq", l3); + if (ret) + dev_err(l3->dev, "request_irq failed for %d\n", l3->app_irq); + +-- +2.30.1 + diff --git a/queue-4.14/can-c_can-move-runtime-pm-enable-disable-to-c_can_pl.patch b/queue-4.14/can-c_can-move-runtime-pm-enable-disable-to-c_can_pl.patch new file mode 100644 index 00000000000..04a78a4aa98 --- /dev/null +++ b/queue-4.14/can-c_can-move-runtime-pm-enable-disable-to-c_can_pl.patch @@ -0,0 +1,136 @@ +From 0a943cb5d61f54dd7a543a4d0da8abdb61a204a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Mar 2021 21:55:40 -0500 +Subject: can: c_can: move runtime PM enable/disable to c_can_platform +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tong Zhang + +[ Upstream commit 6e2fe01dd6f98da6cae8b07cd5cfa67abc70d97d ] + +Currently doing modprobe c_can_pci will make the kernel complain: + + Unbalanced pm_runtime_enable! + +this is caused by pm_runtime_enable() called before pm is initialized. + +This fix is similar to 227619c3ff7c, move those pm_enable/disable code +to c_can_platform. + +Fixes: 4cdd34b26826 ("can: c_can: Add runtime PM support to Bosch C_CAN/D_CAN controller") +Link: http://lore.kernel.org/r/20210302025542.987600-1-ztong0001@gmail.com +Signed-off-by: Tong Zhang +Tested-by: Uwe Kleine-König +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/c_can/c_can.c | 24 +----------------------- + drivers/net/can/c_can/c_can_platform.c | 6 +++++- + 2 files changed, 6 insertions(+), 24 deletions(-) + +diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c +index 24c6015f6c92..2278c5fff5c6 100644 +--- a/drivers/net/can/c_can/c_can.c ++++ b/drivers/net/can/c_can/c_can.c +@@ -212,18 +212,6 @@ static const struct can_bittiming_const c_can_bittiming_const = { + .brp_inc = 1, + }; + +-static inline void c_can_pm_runtime_enable(const struct c_can_priv *priv) +-{ +- if (priv->device) +- pm_runtime_enable(priv->device); +-} +- +-static inline void c_can_pm_runtime_disable(const struct c_can_priv *priv) +-{ +- if (priv->device) +- pm_runtime_disable(priv->device); +-} +- + static inline void c_can_pm_runtime_get_sync(const struct c_can_priv *priv) + { + if (priv->device) +@@ -1318,7 +1306,6 @@ static const struct net_device_ops c_can_netdev_ops = { + + int register_c_can_dev(struct net_device *dev) + { +- struct c_can_priv *priv = netdev_priv(dev); + int err; + + /* Deactivate pins to prevent DRA7 DCAN IP from being +@@ -1328,28 +1315,19 @@ int register_c_can_dev(struct net_device *dev) + */ + pinctrl_pm_select_sleep_state(dev->dev.parent); + +- c_can_pm_runtime_enable(priv); +- + dev->flags |= IFF_ECHO; /* we support local echo */ + dev->netdev_ops = &c_can_netdev_ops; + + err = register_candev(dev); +- if (err) +- c_can_pm_runtime_disable(priv); +- else ++ if (!err) + devm_can_led_init(dev); +- + return err; + } + EXPORT_SYMBOL_GPL(register_c_can_dev); + + void unregister_c_can_dev(struct net_device *dev) + { +- struct c_can_priv *priv = netdev_priv(dev); +- + unregister_candev(dev); +- +- c_can_pm_runtime_disable(priv); + } + EXPORT_SYMBOL_GPL(unregister_c_can_dev); + +diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c +index b5145a7f874c..f2b0408ce87d 100644 +--- a/drivers/net/can/c_can/c_can_platform.c ++++ b/drivers/net/can/c_can/c_can_platform.c +@@ -29,6 +29,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -385,6 +386,7 @@ static int c_can_plat_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, dev); + SET_NETDEV_DEV(dev, &pdev->dev); + ++ pm_runtime_enable(priv->device); + ret = register_c_can_dev(dev); + if (ret) { + dev_err(&pdev->dev, "registering %s failed (err=%d)\n", +@@ -397,6 +399,7 @@ static int c_can_plat_probe(struct platform_device *pdev) + return 0; + + exit_free_device: ++ pm_runtime_disable(priv->device); + free_c_can_dev(dev); + exit: + dev_err(&pdev->dev, "probe failed\n"); +@@ -407,9 +410,10 @@ exit: + static int c_can_plat_remove(struct platform_device *pdev) + { + struct net_device *dev = platform_get_drvdata(pdev); ++ struct c_can_priv *priv = netdev_priv(dev); + + unregister_c_can_dev(dev); +- ++ pm_runtime_disable(priv->device); + free_c_can_dev(dev); + + return 0; +-- +2.30.1 + diff --git a/queue-4.14/can-c_can_pci-c_can_pci_remove-fix-use-after-free.patch b/queue-4.14/can-c_can_pci-c_can_pci_remove-fix-use-after-free.patch new file mode 100644 index 00000000000..cda19f937d0 --- /dev/null +++ b/queue-4.14/can-c_can_pci-c_can_pci_remove-fix-use-after-free.patch @@ -0,0 +1,44 @@ +From a3c176c42b0a0a9b1b5b903e3af8d5e24a1a00cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Feb 2021 21:45:11 -0500 +Subject: can: c_can_pci: c_can_pci_remove(): fix use-after-free + +From: Tong Zhang + +[ Upstream commit 0429d6d89f97ebff4f17f13f5b5069c66bde8138 ] + +There is a UAF in c_can_pci_remove(). dev is released by +free_c_can_dev() and is used by pci_iounmap(pdev, priv->base) later. +To fix this issue, save the mmio address before releasing dev. + +Fixes: 5b92da0443c2 ("c_can_pci: generic module for C_CAN/D_CAN on PCI") +Link: https://lore.kernel.org/r/20210301024512.539039-1-ztong0001@gmail.com +Signed-off-by: Tong Zhang +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/c_can/c_can_pci.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/can/c_can/c_can_pci.c b/drivers/net/can/c_can/c_can_pci.c +index d065c0e2d18e..f3e0b2124a37 100644 +--- a/drivers/net/can/c_can/c_can_pci.c ++++ b/drivers/net/can/c_can/c_can_pci.c +@@ -239,12 +239,13 @@ static void c_can_pci_remove(struct pci_dev *pdev) + { + struct net_device *dev = pci_get_drvdata(pdev); + struct c_can_priv *priv = netdev_priv(dev); ++ void __iomem *addr = priv->base; + + unregister_c_can_dev(dev); + + free_c_can_dev(dev); + +- pci_iounmap(pdev, priv->base); ++ pci_iounmap(pdev, addr); + pci_disable_msi(pdev); + pci_clear_master(pdev); + pci_release_regions(pdev); +-- +2.30.1 + diff --git a/queue-4.14/can-m_can-m_can_do_rx_poll-fix-extraneous-msg-loss-w.patch b/queue-4.14/can-m_can-m_can_do_rx_poll-fix-extraneous-msg-loss-w.patch new file mode 100644 index 00000000000..09448276887 --- /dev/null +++ b/queue-4.14/can-m_can-m_can_do_rx_poll-fix-extraneous-msg-loss-w.patch @@ -0,0 +1,44 @@ +From e636f5db21809e63dd43ae3e9e0100ce2a1e0aa5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 10:31:52 +0000 +Subject: can: m_can: m_can_do_rx_poll(): fix extraneous msg loss warning + +From: Torin Cooper-Bennun + +[ Upstream commit c0e399f3baf42279f48991554240af8c457535d1 ] + +Message loss from RX FIFO 0 is already handled in +m_can_handle_lost_msg(), with netdev output included. + +Removing this warning also improves driver performance under heavy +load, where m_can_do_rx_poll() may be called many times before this +interrupt is cleared, causing this message to be output many +times (thanks Mariusz Madej for this report). + +Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support") +Link: https://lore.kernel.org/r/20210303103151.3760532-1-torin@maxiluxsystems.com +Reported-by: Mariusz Madej +Signed-off-by: Torin Cooper-Bennun +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index a3f2548c5548..8751bd3e5789 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -513,9 +513,6 @@ static int m_can_do_rx_poll(struct net_device *dev, int quota) + } + + while ((rxfs & RXFS_FFL_MASK) && (quota > 0)) { +- if (rxfs & RXFS_RFL) +- netdev_warn(dev, "Rx FIFO 0 Message Lost\n"); +- + m_can_read_fifo(dev, rxfs); + + quota--; +-- +2.30.1 + diff --git a/queue-4.14/can-peak_usb-add-forgotten-supported-devices.patch b/queue-4.14/can-peak_usb-add-forgotten-supported-devices.patch new file mode 100644 index 00000000000..747646418ca --- /dev/null +++ b/queue-4.14/can-peak_usb-add-forgotten-supported-devices.patch @@ -0,0 +1,39 @@ +From 7eda39bf62998103d43bc4658ed163598facf1cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Mar 2021 09:21:27 +0100 +Subject: can: peak_usb: add forgotten supported devices + +From: Stephane Grosjean + +[ Upstream commit 59ec7b89ed3e921cd0625a8c83f31a30d485fdf8 ] + +Since the peak_usb driver also supports the CAN-USB interfaces +"PCAN-USB X6" and "PCAN-Chip USB" from PEAK-System GmbH, this patch adds +their names to the list of explicitly supported devices. + +Fixes: ea8b65b596d7 ("can: usb: Add support of PCAN-Chip USB stamp module") +Fixes: f00b534ded60 ("can: peak: Add support for PCAN-USB X6 USB interface") +Link: https://lore.kernel.org/r/20210309082128.23125-3-s.grosjean@peak-system.com +Signed-off-by: Stephane Grosjean +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c +index 0d762bdac4f8..56280a28e135 100644 +--- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c ++++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c +@@ -26,6 +26,8 @@ + + MODULE_SUPPORTED_DEVICE("PEAK-System PCAN-USB FD adapter"); + MODULE_SUPPORTED_DEVICE("PEAK-System PCAN-USB Pro FD adapter"); ++MODULE_SUPPORTED_DEVICE("PEAK-System PCAN-Chip USB"); ++MODULE_SUPPORTED_DEVICE("PEAK-System PCAN-USB X6 adapter"); + + #define PCAN_USBPROFD_CHANNEL_COUNT 2 + #define PCAN_USBFD_CHANNEL_COUNT 1 +-- +2.30.1 + diff --git a/queue-4.14/drm-msm-fix-shutdown-hook-in-case-gpu-components-fai.patch b/queue-4.14/drm-msm-fix-shutdown-hook-in-case-gpu-components-fai.patch new file mode 100644 index 00000000000..757ac46012a --- /dev/null +++ b/queue-4.14/drm-msm-fix-shutdown-hook-in-case-gpu-components-fai.patch @@ -0,0 +1,95 @@ +From f5223044af8211b713282c7f355d26be0a2e00ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Mar 2021 08:56:02 -0300 +Subject: drm/msm: fix shutdown hook in case GPU components failed to bind + +From: Dmitry Baryshkov + +[ Upstream commit 623f279c77811475ac8fd5635cc4e4451aa71291 ] + +If GPU components have failed to bind, shutdown callback would fail with +the following backtrace. Add safeguard check to stop that oops from +happening and allow the board to reboot. + +[ 66.617046] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 +[ 66.626066] Mem abort info: +[ 66.628939] ESR = 0x96000006 +[ 66.632088] EC = 0x25: DABT (current EL), IL = 32 bits +[ 66.637542] SET = 0, FnV = 0 +[ 66.640688] EA = 0, S1PTW = 0 +[ 66.643924] Data abort info: +[ 66.646889] ISV = 0, ISS = 0x00000006 +[ 66.650832] CM = 0, WnR = 0 +[ 66.653890] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000107f81000 +[ 66.660505] [0000000000000000] pgd=0000000100bb2003, p4d=0000000100bb2003, pud=0000000100897003, pmd=0000000000000000 +[ 66.671398] Internal error: Oops: 96000006 [#1] PREEMPT SMP +[ 66.677115] Modules linked in: +[ 66.680261] CPU: 6 PID: 352 Comm: reboot Not tainted 5.11.0-rc2-00309-g79e3faa756b2 #38 +[ 66.688473] Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) +[ 66.695347] pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--) +[ 66.701507] pc : msm_atomic_commit_tail+0x78/0x4e0 +[ 66.706437] lr : commit_tail+0xa4/0x184 +[ 66.710381] sp : ffff8000108f3af0 +[ 66.713791] x29: ffff8000108f3af0 x28: ffff418c44337000 +[ 66.719242] x27: 0000000000000000 x26: ffff418c40a24490 +[ 66.724693] x25: ffffd3a842a4f1a0 x24: 0000000000000008 +[ 66.730146] x23: ffffd3a84313f030 x22: ffff418c444ce000 +[ 66.735598] x21: ffff418c408a4980 x20: 0000000000000000 +[ 66.741049] x19: 0000000000000000 x18: ffff800010710fbc +[ 66.746500] x17: 000000000000000c x16: 0000000000000001 +[ 66.751954] x15: 0000000000010008 x14: 0000000000000068 +[ 66.757405] x13: 0000000000000001 x12: 0000000000000000 +[ 66.762855] x11: 0000000000000001 x10: 00000000000009b0 +[ 66.768306] x9 : ffffd3a843192000 x8 : ffff418c44337000 +[ 66.773757] x7 : 0000000000000000 x6 : 00000000a401b34e +[ 66.779210] x5 : 00ffffffffffffff x4 : 0000000000000000 +[ 66.784660] x3 : 0000000000000000 x2 : ffff418c444ce000 +[ 66.790111] x1 : ffffd3a841dce530 x0 : ffff418c444cf000 +[ 66.795563] Call trace: +[ 66.798075] msm_atomic_commit_tail+0x78/0x4e0 +[ 66.802633] commit_tail+0xa4/0x184 +[ 66.806217] drm_atomic_helper_commit+0x160/0x390 +[ 66.811051] drm_atomic_commit+0x4c/0x60 +[ 66.815082] drm_atomic_helper_disable_all+0x1f4/0x210 +[ 66.820355] drm_atomic_helper_shutdown+0x80/0x130 +[ 66.825276] msm_pdev_shutdown+0x14/0x20 +[ 66.829303] platform_shutdown+0x28/0x40 +[ 66.833330] device_shutdown+0x158/0x330 +[ 66.837357] kernel_restart+0x40/0xa0 +[ 66.841122] __do_sys_reboot+0x228/0x250 +[ 66.845148] __arm64_sys_reboot+0x28/0x34 +[ 66.849264] el0_svc_common.constprop.0+0x74/0x190 +[ 66.854187] do_el0_svc+0x24/0x90 +[ 66.857595] el0_svc+0x14/0x20 +[ 66.860739] el0_sync_handler+0x1a4/0x1b0 +[ 66.864858] el0_sync+0x174/0x180 +[ 66.868269] Code: 1ac020a0 2a000273 eb02007f 54ffff01 (f9400285) +[ 66.874525] ---[ end trace 20dedb2a3229fec8 ]--- + +Fixes: 9d5cbf5fe46e ("drm/msm: add shutdown support for display platform_driver") +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Fabio Estevam +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/msm_drv.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c +index c59240b566d8..3dad4687d3dd 100644 +--- a/drivers/gpu/drm/msm/msm_drv.c ++++ b/drivers/gpu/drm/msm/msm_drv.c +@@ -1137,6 +1137,10 @@ static int msm_pdev_remove(struct platform_device *pdev) + static void msm_pdev_shutdown(struct platform_device *pdev) + { + struct drm_device *drm = platform_get_drvdata(pdev); ++ struct msm_drm_private *priv = drm ? drm->dev_private : NULL; ++ ++ if (!priv || !priv->kms) ++ return; + + drm_atomic_helper_shutdown(drm); + } +-- +2.30.1 + diff --git a/queue-4.14/e1000e-add-rtnl_lock-to-e1000_reset_task.patch b/queue-4.14/e1000e-add-rtnl_lock-to-e1000_reset_task.patch new file mode 100644 index 00000000000..d64387a54b3 --- /dev/null +++ b/queue-4.14/e1000e-add-rtnl_lock-to-e1000_reset_task.patch @@ -0,0 +1,54 @@ +From 4726c1a07caec0afd9c9f281b4ca1daf6b76ad97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Oct 2020 14:59:37 +0300 +Subject: e1000e: add rtnl_lock() to e1000_reset_task + +From: Vitaly Lifshits + +[ Upstream commit 21f857f0321d0d0ea9b1a758bd55dc63d1cb2437 ] + +A possible race condition was found in e1000_reset_task, +after discovering a similar issue in igb driver via +commit 024a8168b749 ("igb: reinit_locked() should be called +with rtnl_lock"). + +Added rtnl_lock() and rtnl_unlock() to avoid this. + +Fixes: bc7f75fa9788 ("[E1000E]: New pci-express e1000 driver (currently for ICH9 devices only)") +Suggested-by: Jakub Kicinski +Signed-off-by: Vitaly Lifshits +Tested-by: Dvora Fuxbrumer +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/e1000e/netdev.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c +index fff55f0bed30..f50d0da8fefe 100644 +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -5942,15 +5942,19 @@ static void e1000_reset_task(struct work_struct *work) + struct e1000_adapter *adapter; + adapter = container_of(work, struct e1000_adapter, reset_task); + ++ rtnl_lock(); + /* don't run the task if already down */ +- if (test_bit(__E1000_DOWN, &adapter->state)) ++ if (test_bit(__E1000_DOWN, &adapter->state)) { ++ rtnl_unlock(); + return; ++ } + + if (!(adapter->flags & FLAG_RESTART_NOW)) { + e1000e_dump(adapter); + e_err("Reset adapter unexpectedly\n"); + } + e1000e_reinit_locked(adapter); ++ rtnl_unlock(); + } + + /** +-- +2.30.1 + diff --git a/queue-4.14/e1000e-fix-error-handling-in-e1000_set_d0_lplu_state.patch b/queue-4.14/e1000e-fix-error-handling-in-e1000_set_d0_lplu_state.patch new file mode 100644 index 00000000000..1f92adb45cc --- /dev/null +++ b/queue-4.14/e1000e-fix-error-handling-in-e1000_set_d0_lplu_state.patch @@ -0,0 +1,40 @@ +From f87dc492e8f98bd1299adeb9b5a97f8ae3af7ec1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Feb 2021 17:44:23 +0800 +Subject: e1000e: Fix error handling in e1000_set_d0_lplu_state_82571 + +From: Dinghao Liu + +[ Upstream commit b52912b8293f2c496f42583e65599aee606a0c18 ] + +There is one e1e_wphy() call in e1000_set_d0_lplu_state_82571 +that we have caught its return value but lack further handling. +Check and terminate the execution flow just like other e1e_wphy() +in this function. + +Fixes: bc7f75fa9788 ("[E1000E]: New pci-express e1000 driver (currently for ICH9 devices only)") +Signed-off-by: Dinghao Liu +Acked-by: Sasha Neftin +Tested-by: Dvora Fuxbrumer +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/e1000e/82571.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/intel/e1000e/82571.c b/drivers/net/ethernet/intel/e1000e/82571.c +index 6b03c8553e59..65deaf8f3004 100644 +--- a/drivers/net/ethernet/intel/e1000e/82571.c ++++ b/drivers/net/ethernet/intel/e1000e/82571.c +@@ -917,6 +917,8 @@ static s32 e1000_set_d0_lplu_state_82571(struct e1000_hw *hw, bool active) + } else { + data &= ~IGP02E1000_PM_D0_LPLU; + ret_val = e1e_wphy(hw, IGP02E1000_PHY_POWER_MGMT, data); ++ if (ret_val) ++ return ret_val; + /* LPLU and SmartSpeed are mutually exclusive. LPLU is used + * during Dx states where the power conservation is most + * important. During driver activity we should enable +-- +2.30.1 + diff --git a/queue-4.14/ftgmac100-restart-mac-hw-once.patch b/queue-4.14/ftgmac100-restart-mac-hw-once.patch new file mode 100644 index 00000000000..55d7c1de6d7 --- /dev/null +++ b/queue-4.14/ftgmac100-restart-mac-hw-once.patch @@ -0,0 +1,38 @@ +From 286f5c2fbe67967bcfe1ff6428cf4e8ee3dbab11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Mar 2021 11:04:05 +1030 +Subject: ftgmac100: Restart MAC HW once + +From: Dylan Hung + +[ Upstream commit 6897087323a2fde46df32917462750c069668b2f ] + +The interrupt handler may set the flag to reset the mac in the future, +but that flag is not cleared once the reset has occurred. + +Fixes: 10cbd6407609 ("ftgmac100: Rework NAPI & interrupts handling") +Signed-off-by: Dylan Hung +Acked-by: Benjamin Herrenschmidt +Reviewed-by: Joel Stanley +Signed-off-by: Joel Stanley +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/faraday/ftgmac100.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c +index b28425f4cfac..f35c5dbe54ee 100644 +--- a/drivers/net/ethernet/faraday/ftgmac100.c ++++ b/drivers/net/ethernet/faraday/ftgmac100.c +@@ -1328,6 +1328,7 @@ static int ftgmac100_poll(struct napi_struct *napi, int budget) + */ + if (unlikely(priv->need_mac_restart)) { + ftgmac100_start_hw(priv); ++ priv->need_mac_restart = false; + + /* Re-enable "bad" interrupts */ + iowrite32(FTGMAC100_INT_BAD, +-- +2.30.1 + diff --git a/queue-4.14/libbpf-fix-install-flag-order.patch b/queue-4.14/libbpf-fix-install-flag-order.patch new file mode 100644 index 00000000000..8c3f45da8ad --- /dev/null +++ b/queue-4.14/libbpf-fix-install-flag-order.patch @@ -0,0 +1,41 @@ +From d22fb4c2b462e87305cb0b81c4b4a163aab1972d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 10:30:38 -0800 +Subject: libbpf: Fix INSTALL flag order + +From: Georgi Valkov + +[ Upstream commit e7fb6465d4c8e767e39cbee72464e0060ab3d20c ] + +It was reported ([0]) that having optional -m flag between source and +destination arguments in install command breaks bpftools cross-build +on MacOS. Move -m to the front to fix this issue. + + [0] https://github.com/openwrt/openwrt/pull/3959 + +Fixes: 7110d80d53f4 ("libbpf: Makefile set specified permission mode") +Signed-off-by: Georgi Valkov +Signed-off-by: Andrii Nakryiko +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20210308183038.613432-1-andrii@kernel.org +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile +index f02448e86d38..9fa466d4417b 100644 +--- a/tools/lib/bpf/Makefile ++++ b/tools/lib/bpf/Makefile +@@ -183,7 +183,7 @@ define do_install + if [ ! -d '$(DESTDIR_SQ)$2' ]; then \ + $(INSTALL) -d -m 755 '$(DESTDIR_SQ)$2'; \ + fi; \ +- $(INSTALL) $1 $(if $3,-m $3,) '$(DESTDIR_SQ)$2' ++ $(INSTALL) $(if $3,-m $3,) $1 '$(DESTDIR_SQ)$2' + endef + + install_lib: all_cmd +-- +2.30.1 + diff --git a/queue-4.14/mac80211-fix-rate-mask-reset.patch b/queue-4.14/mac80211-fix-rate-mask-reset.patch new file mode 100644 index 00000000000..b9b2c61e253 --- /dev/null +++ b/queue-4.14/mac80211-fix-rate-mask-reset.patch @@ -0,0 +1,57 @@ +From fe6ccf5ded93841672d46c72bccb56e4d0ead788 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Feb 2021 11:22:14 +0100 +Subject: mac80211: fix rate mask reset + +From: Johannes Berg + +[ Upstream commit 1944015fe9c1d9fa5e9eb7ffbbb5ef8954d6753b ] + +Coverity reported the strange "if (~...)" condition that's +always true. It suggested that ! was intended instead of ~, +but upon further analysis I'm convinced that what really was +intended was a comparison to 0xff/0xffff (in HT/VHT cases +respectively), since this indicates that all of the rates +are enabled. + +Change the comparison accordingly. + +I'm guessing this never really mattered because a reset to +not having a rate mask is basically equivalent to having a +mask that enables all rates. + +Reported-by: Colin Ian King +Fixes: 2ffbe6d33366 ("mac80211: fix and optimize MCS mask handling") +Fixes: b119ad6e726c ("mac80211: add rate mask logic for vht rates") +Reviewed-by: Colin Ian King +Link: https://lore.kernel.org/r/20210212112213.36b38078f569.I8546a20c80bc1669058eb453e213630b846e107b@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/cfg.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index 0b82d8da4ab0..0563bde0c285 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -2752,14 +2752,14 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy, + continue; + + for (j = 0; j < IEEE80211_HT_MCS_MASK_LEN; j++) { +- if (~sdata->rc_rateidx_mcs_mask[i][j]) { ++ if (sdata->rc_rateidx_mcs_mask[i][j] != 0xff) { + sdata->rc_has_mcs_mask[i] = true; + break; + } + } + + for (j = 0; j < NL80211_VHT_NSS_MAX; j++) { +- if (~sdata->rc_rateidx_vht_mcs_mask[i][j]) { ++ if (sdata->rc_rateidx_vht_mcs_mask[i][j] != 0xffff) { + sdata->rc_has_vht_mcs_mask[i] = true; + break; + } +-- +2.30.1 + diff --git a/queue-4.14/macvlan-macvlan_count_rx-needs-to-be-aware-of-preemp.patch b/queue-4.14/macvlan-macvlan_count_rx-needs-to-be-aware-of-preemp.patch new file mode 100644 index 00000000000..ff8ef0f8194 --- /dev/null +++ b/queue-4.14/macvlan-macvlan_count_rx-needs-to-be-aware-of-preemp.patch @@ -0,0 +1,89 @@ +From 3f7d51dfae4e6d2ca239b87f2d92de960babc52b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 01:56:36 -0800 +Subject: macvlan: macvlan_count_rx() needs to be aware of preemption + +From: Eric Dumazet + +[ Upstream commit dd4fa1dae9f4847cc1fd78ca468ad69e16e5db3e ] + +macvlan_count_rx() can be called from process context, it is thus +necessary to disable preemption before calling u64_stats_update_begin() + +syzbot was able to spot this on 32bit arch: + +WARNING: CPU: 1 PID: 4632 at include/linux/seqlock.h:271 __seqprop_assert include/linux/seqlock.h:271 [inline] +WARNING: CPU: 1 PID: 4632 at include/linux/seqlock.h:271 __seqprop_assert.constprop.0+0xf0/0x11c include/linux/seqlock.h:269 +Modules linked in: +Kernel panic - not syncing: panic_on_warn set ... +CPU: 1 PID: 4632 Comm: kworker/1:3 Not tainted 5.12.0-rc2-syzkaller #0 +Hardware name: ARM-Versatile Express +Workqueue: events macvlan_process_broadcast +Backtrace: +[<82740468>] (dump_backtrace) from [<827406dc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:252) + r7:00000080 r6:60000093 r5:00000000 r4:8422a3c4 +[<827406c4>] (show_stack) from [<82751b58>] (__dump_stack lib/dump_stack.c:79 [inline]) +[<827406c4>] (show_stack) from [<82751b58>] (dump_stack+0xb8/0xe8 lib/dump_stack.c:120) +[<82751aa0>] (dump_stack) from [<82741270>] (panic+0x130/0x378 kernel/panic.c:231) + r7:830209b4 r6:84069ea4 r5:00000000 r4:844350d0 +[<82741140>] (panic) from [<80244924>] (__warn+0xb0/0x164 kernel/panic.c:605) + r3:8404ec8c r2:00000000 r1:00000000 r0:830209b4 + r7:0000010f +[<80244874>] (__warn) from [<82741520>] (warn_slowpath_fmt+0x68/0xd4 kernel/panic.c:628) + r7:81363f70 r6:0000010f r5:83018e50 r4:00000000 +[<827414bc>] (warn_slowpath_fmt) from [<81363f70>] (__seqprop_assert include/linux/seqlock.h:271 [inline]) +[<827414bc>] (warn_slowpath_fmt) from [<81363f70>] (__seqprop_assert.constprop.0+0xf0/0x11c include/linux/seqlock.h:269) + r8:5a109000 r7:0000000f r6:a568dac0 r5:89802300 r4:00000001 +[<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (u64_stats_update_begin include/linux/u64_stats_sync.h:128 [inline]) +[<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (macvlan_count_rx include/linux/if_macvlan.h:47 [inline]) +[<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (macvlan_broadcast+0x154/0x26c drivers/net/macvlan.c:291) + r5:89802300 r4:8a927740 +[<8136499c>] (macvlan_broadcast) from [<81365020>] (macvlan_process_broadcast+0x258/0x2d0 drivers/net/macvlan.c:317) + r10:81364f78 r9:8a86d000 r8:8a9c7e7c r7:8413aa5c r6:00000000 r5:00000000 + r4:89802840 +[<81364dc8>] (macvlan_process_broadcast) from [<802696a4>] (process_one_work+0x2d4/0x998 kernel/workqueue.c:2275) + r10:00000008 r9:8404ec98 r8:84367a02 r7:ddfe6400 r6:ddfe2d40 r5:898dac80 + r4:8a86d43c +[<802693d0>] (process_one_work) from [<80269dcc>] (worker_thread+0x64/0x54c kernel/workqueue.c:2421) + r10:00000008 r9:8a9c6000 r8:84006d00 r7:ddfe2d78 r6:898dac94 r5:ddfe2d40 + r4:898dac80 +[<80269d68>] (worker_thread) from [<80271f40>] (kthread+0x184/0x1a4 kernel/kthread.c:292) + r10:85247e64 r9:898dac80 r8:80269d68 r7:00000000 r6:8a9c6000 r5:89a2ee40 + r4:8a97bd00 +[<80271dbc>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:158) +Exception stack(0x8a9c7fb0 to 0x8a9c7ff8) + +Fixes: 412ca1550cbe ("macvlan: Move broadcasts into a work queue") +Signed-off-by: Eric Dumazet +Cc: Herbert Xu +Reported-by: syzbot +Acked-by: Herbert Xu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/linux/if_macvlan.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/linux/if_macvlan.h b/include/linux/if_macvlan.h +index 0e2c60efad2d..55a1d3260589 100644 +--- a/include/linux/if_macvlan.h ++++ b/include/linux/if_macvlan.h +@@ -58,13 +58,14 @@ static inline void macvlan_count_rx(const struct macvlan_dev *vlan, + if (likely(success)) { + struct vlan_pcpu_stats *pcpu_stats; + +- pcpu_stats = this_cpu_ptr(vlan->pcpu_stats); ++ pcpu_stats = get_cpu_ptr(vlan->pcpu_stats); + u64_stats_update_begin(&pcpu_stats->syncp); + pcpu_stats->rx_packets++; + pcpu_stats->rx_bytes += len; + if (multicast) + pcpu_stats->rx_multicast++; + u64_stats_update_end(&pcpu_stats->syncp); ++ put_cpu_ptr(vlan->pcpu_stats); + } else { + this_cpu_inc(vlan->pcpu_stats->rx_errors); + } +-- +2.30.1 + diff --git a/queue-4.14/net-cdc-phonet-fix-data-interface-release-on-probe-f.patch b/queue-4.14/net-cdc-phonet-fix-data-interface-release-on-probe-f.patch new file mode 100644 index 00000000000..50b76f9f9c8 --- /dev/null +++ b/queue-4.14/net-cdc-phonet-fix-data-interface-release-on-probe-f.patch @@ -0,0 +1,37 @@ +From 12782b450256c82f9b20dedd84c5bc270667444b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Mar 2021 16:57:49 +0100 +Subject: net: cdc-phonet: fix data-interface release on probe failure + +From: Johan Hovold + +[ Upstream commit c79a707072fe3fea0e3c92edee6ca85c1e53c29f ] + +Set the disconnected flag before releasing the data interface in case +netdev registration fails to avoid having the disconnect callback try to +deregister the never registered netdev (and trigger a WARN_ON()). + +Fixes: 87cf65601e17 ("USB host CDC Phonet network interface driver") +Signed-off-by: Johan Hovold +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/cdc-phonet.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/usb/cdc-phonet.c b/drivers/net/usb/cdc-phonet.c +index 288ecd999171..7a18eb0784f3 100644 +--- a/drivers/net/usb/cdc-phonet.c ++++ b/drivers/net/usb/cdc-phonet.c +@@ -398,6 +398,8 @@ static int usbpn_probe(struct usb_interface *intf, const struct usb_device_id *i + + err = register_netdev(dev); + if (err) { ++ /* Set disconnected flag so that disconnect() returns early. */ ++ pnd->disconnected = 1; + usb_driver_release_interface(&usbpn_driver, data_intf); + goto out; + } +-- +2.30.1 + diff --git a/queue-4.14/net-dsa-bcm_sf2-qualify-phydev-dev_flags-based-on-po.patch b/queue-4.14/net-dsa-bcm_sf2-qualify-phydev-dev_flags-based-on-po.patch new file mode 100644 index 00000000000..be0e9bdd661 --- /dev/null +++ b/queue-4.14/net-dsa-bcm_sf2-qualify-phydev-dev_flags-based-on-po.patch @@ -0,0 +1,43 @@ +From a1642aa61502bc08ca94d612fd365a6717db0682 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 14:17:58 -0800 +Subject: net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port + +From: Florian Fainelli + +[ Upstream commit 47142ed6c34d544ae9f0463e58d482289cbe0d46 ] + +Similar to commit 92696286f3bb37ba50e4bd8d1beb24afb759a799 ("net: +bcmgenet: Set phydev->dev_flags only for internal PHYs") we need to +qualify the phydev->dev_flags based on whether the port is connected to +an internal or external PHY otherwise we risk having a flags collision +with a completely different interpretation depending on the driver. + +Fixes: aa9aef77c761 ("net: dsa: bcm_sf2: communicate integrated PHY revision to PHY driver") +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/bcm_sf2.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c +index 7fc84ae562a2..11a72c4cbb92 100644 +--- a/drivers/net/dsa/bcm_sf2.c ++++ b/drivers/net/dsa/bcm_sf2.c +@@ -613,8 +613,10 @@ static u32 bcm_sf2_sw_get_phy_flags(struct dsa_switch *ds, int port) + * in bits 15:8 and the patch level in bits 7:0 which is exactly what + * the REG_PHY_REVISION register layout is. + */ +- +- return priv->hw_params.gphy_rev; ++ if (priv->int_phy_mask & BIT(port)) ++ return priv->hw_params.gphy_rev; ++ else ++ return 0; + } + + static void bcm_sf2_sw_adjust_link(struct dsa_switch *ds, int port, +-- +2.30.1 + diff --git a/queue-4.14/net-mlx5e-fix-error-path-for-ethtool-set-priv-flag.patch b/queue-4.14/net-mlx5e-fix-error-path-for-ethtool-set-priv-flag.patch new file mode 100644 index 00000000000..983d42f040b --- /dev/null +++ b/queue-4.14/net-mlx5e-fix-error-path-for-ethtool-set-priv-flag.patch @@ -0,0 +1,48 @@ +From b0796e68653a95b941f9cacdb3d3ab125f7ddabf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Mar 2021 17:46:35 +0200 +Subject: net/mlx5e: Fix error path for ethtool set-priv-flag + +From: Aya Levin + +[ Upstream commit 4eacfe72e3e037e3fc019113df32c39a705148c2 ] + +Expose error value when failing to comply to command: +$ ethtool --set-priv-flags eth2 rx_cqe_compress [on/off] + +Fixes: be7e87f92b58 ("net/mlx5e: Fail safe cqe compressing/moderation mode setting") +Signed-off-by: Aya Levin +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +index c3f1e2d76a46..377f91885bda 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +@@ -1747,6 +1747,7 @@ static int set_pflag_rx_cqe_compress(struct net_device *netdev, + { + struct mlx5e_priv *priv = netdev_priv(netdev); + struct mlx5_core_dev *mdev = priv->mdev; ++ int err; + + if (!MLX5_CAP_GEN(mdev, cqe_compression)) + return -EOPNOTSUPP; +@@ -1756,7 +1757,10 @@ static int set_pflag_rx_cqe_compress(struct net_device *netdev, + return -EINVAL; + } + +- mlx5e_modify_rx_cqe_compression_locked(priv, enable); ++ err = mlx5e_modify_rx_cqe_compression_locked(priv, enable); ++ if (err) ++ return err; ++ + priv->channels.params.rx_cqe_compress_def = enable; + + return 0; +-- +2.30.1 + diff --git a/queue-4.14/net-qlcnic-fix-a-use-after-free-in-qlcnic_83xx_get_m.patch b/queue-4.14/net-qlcnic-fix-a-use-after-free-in-qlcnic_83xx_get_m.patch new file mode 100644 index 00000000000..efb2dcd4d02 --- /dev/null +++ b/queue-4.14/net-qlcnic-fix-a-use-after-free-in-qlcnic_83xx_get_m.patch @@ -0,0 +1,44 @@ +From a18f1d439b2f0fe18053f62886aa16a80ad576fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 20:01:40 -0800 +Subject: net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template + +From: Lv Yunlong + +[ Upstream commit db74623a3850db99cb9692fda9e836a56b74198d ] + +In qlcnic_83xx_get_minidump_template, fw_dump->tmpl_hdr was freed by +vfree(). But unfortunately, it is used when extended is true. + +Fixes: 7061b2bdd620e ("qlogic: Deletion of unnecessary checks before two function calls") +Signed-off-by: Lv Yunlong +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c +index f34ae8c75bc5..61a39d167c8b 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c +@@ -1426,6 +1426,7 @@ void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter) + + if (fw_dump->tmpl_hdr == NULL || current_version > prev_version) { + vfree(fw_dump->tmpl_hdr); ++ fw_dump->tmpl_hdr = NULL; + + if (qlcnic_83xx_md_check_extended_dump_capability(adapter)) + extended = !qlcnic_83xx_extend_md_capab(adapter); +@@ -1444,6 +1445,8 @@ void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter) + struct qlcnic_83xx_dump_template_hdr *hdr; + + hdr = fw_dump->tmpl_hdr; ++ if (!hdr) ++ return; + hdr->drv_cap_mask = 0x1f; + fw_dump->cap_mask = 0x1f; + dev_info(&pdev->dev, +-- +2.30.1 + diff --git a/queue-4.14/net-stmmac-dwmac-sun8i-provide-tx-and-rx-fifo-sizes.patch b/queue-4.14/net-stmmac-dwmac-sun8i-provide-tx-and-rx-fifo-sizes.patch new file mode 100644 index 00000000000..a3d6bf9103e --- /dev/null +++ b/queue-4.14/net-stmmac-dwmac-sun8i-provide-tx-and-rx-fifo-sizes.patch @@ -0,0 +1,47 @@ +From c4bb071e5a081de9db2dcf80abe026abe101d801 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 13:44:22 +0000 +Subject: net: stmmac: dwmac-sun8i: Provide TX and RX fifo sizes + +From: Corentin Labbe + +[ Upstream commit 014dfa26ce1c647af09bf506285ef67e0e3f0a6b ] + +MTU cannot be changed on dwmac-sun8i. (ip link set eth0 mtu xxx returning EINVAL) +This is due to tx_fifo_size being 0, since this value is used to compute valid +MTU range. +Like dwmac-sunxi (with commit 806fd188ce2a ("net: stmmac: dwmac-sunxi: Provide TX and RX fifo sizes")) +dwmac-sun8i need to have tx and rx fifo sizes set. +I have used values from datasheets. +After this patch, setting a non-default MTU (like 1000) value works and network is still useable. + +Tested-on: sun8i-h3-orangepi-pc +Tested-on: sun8i-r40-bananapi-m2-ultra +Tested-on: sun50i-a64-bananapi-m64 +Tested-on: sun50i-h5-nanopi-neo-plus2 +Tested-on: sun50i-h6-pine-h64 +Fixes: 9f93ac8d408 ("net-next: stmmac: Add dwmac-sun8i") +Reported-by: Belisko Marek +Signed-off-by: Corentin Labbe +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c +index 149fd0d5e069..8e60315a087c 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c +@@ -972,6 +972,8 @@ static int sun8i_dwmac_probe(struct platform_device *pdev) + plat_dat->init = sun8i_dwmac_init; + plat_dat->exit = sun8i_dwmac_exit; + plat_dat->setup = sun8i_dwmac_setup; ++ plat_dat->tx_fifo_size = 4096; ++ plat_dat->rx_fifo_size = 16384; + + ret = sun8i_dwmac_init(pdev, plat_dat->bsp_priv); + if (ret) +-- +2.30.1 + diff --git a/queue-4.14/rdma-cxgb4-fix-adapter-le-hash-errors-while-destroyi.patch b/queue-4.14/rdma-cxgb4-fix-adapter-le-hash-errors-while-destroyi.patch new file mode 100644 index 00000000000..a82d229d84b --- /dev/null +++ b/queue-4.14/rdma-cxgb4-fix-adapter-le-hash-errors-while-destroyi.patch @@ -0,0 +1,48 @@ +From b73ccc08f635d256dc105b6d81be22688eaed550 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 00:34:53 +0530 +Subject: RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 + listening server + +From: Potnuri Bharat Teja + +[ Upstream commit 3408be145a5d6418ff955fe5badde652be90e700 ] + +Not setting the ipv6 bit while destroying ipv6 listening servers may +result in potential fatal adapter errors due to lookup engine memory hash +errors. Therefore always set ipv6 field while destroying ipv6 listening +servers. + +Fixes: 830662f6f032 ("RDMA/cxgb4: Add support for active and passive open connection with IPv6 address") +Link: https://lore.kernel.org/r/20210324190453.8171-1-bharat@chelsio.com +Signed-off-by: Potnuri Bharat Teja +Reviewed-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/cxgb4/cm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c +index 5aa545f9a423..72e2031993fb 100644 +--- a/drivers/infiniband/hw/cxgb4/cm.c ++++ b/drivers/infiniband/hw/cxgb4/cm.c +@@ -3492,13 +3492,13 @@ int c4iw_destroy_listen(struct iw_cm_id *cm_id) + ep->com.local_addr.ss_family == AF_INET) { + err = cxgb4_remove_server_filter( + ep->com.dev->rdev.lldi.ports[0], ep->stid, +- ep->com.dev->rdev.lldi.rxq_ids[0], 0); ++ ep->com.dev->rdev.lldi.rxq_ids[0], false); + } else { + struct sockaddr_in6 *sin6; + c4iw_init_wr_wait(&ep->com.wr_wait); + err = cxgb4_remove_server( + ep->com.dev->rdev.lldi.ports[0], ep->stid, +- ep->com.dev->rdev.lldi.rxq_ids[0], 0); ++ ep->com.dev->rdev.lldi.rxq_ids[0], true); + if (err) + goto done; + err = c4iw_wait_for_reply(&ep->com.dev->rdev, &ep->com.wr_wait, +-- +2.30.1 + diff --git a/queue-4.14/series b/queue-4.14/series index 309606d0664..bde186dacd5 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -26,3 +26,22 @@ arm64-dts-ls1012a-mark-crypto-engine-dma-coherent.patch arm64-dts-ls1043a-mark-crypto-engine-dma-coherent.patch arm-dts-at91-sama5d27_som1-fix-phy-address-to-7.patch dm-ioctl-fix-out-of-bounds-array-access-when-no-devices.patch +bus-omap_l3_noc-mark-l3-irqs-as-irqf_no_thread.patch +libbpf-fix-install-flag-order.patch +macvlan-macvlan_count_rx-needs-to-be-aware-of-preemp.patch +net-dsa-bcm_sf2-qualify-phydev-dev_flags-based-on-po.patch +e1000e-add-rtnl_lock-to-e1000_reset_task.patch +e1000e-fix-error-handling-in-e1000_set_d0_lplu_state.patch +net-qlcnic-fix-a-use-after-free-in-qlcnic_83xx_get_m.patch +ftgmac100-restart-mac-hw-once.patch +can-peak_usb-add-forgotten-supported-devices.patch +can-c_can_pci-c_can_pci_remove-fix-use-after-free.patch +can-c_can-move-runtime-pm-enable-disable-to-c_can_pl.patch +can-m_can-m_can_do_rx_poll-fix-extraneous-msg-loss-w.patch +mac80211-fix-rate-mask-reset.patch +net-cdc-phonet-fix-data-interface-release-on-probe-f.patch +net-stmmac-dwmac-sun8i-provide-tx-and-rx-fifo-sizes.patch +drm-msm-fix-shutdown-hook-in-case-gpu-components-fai.patch +arm64-kdump-update-ppos-when-reading-elfcorehdr.patch +net-mlx5e-fix-error-path-for-ethtool-set-priv-flag.patch +rdma-cxgb4-fix-adapter-le-hash-errors-while-destroyi.patch