From: Sasha Levin Date: Sun, 28 Mar 2021 03:51:21 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v5.11.11~56 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c63a0f853285131fa3aaf9dc9ae9192023307f1d;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/arm64-kdump-update-ppos-when-reading-elfcorehdr.patch b/queue-5.4/arm64-kdump-update-ppos-when-reading-elfcorehdr.patch new file mode 100644 index 00000000000..e53b1b44b8f --- /dev/null +++ b/queue-5.4/arm64-kdump-update-ppos-when-reading-elfcorehdr.patch @@ -0,0 +1,40 @@ +From e10f3db11a27f349e4b8709e8dab7c96d275d1a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 16:50:54 -0400 +Subject: arm64: kdump: update ppos when reading elfcorehdr + +From: Pavel Tatashin + +[ Upstream commit 141f8202cfa4192c3af79b6cbd68e7760bb01b5a ] + +The ppos points to a position in the old kernel memory (and in case of +arm64 in the crash kernel since elfcorehdr is passed as a segment). The +function should update the ppos by the amount that was read. This bug is +not exposed by accident, but other platforms update this value properly. +So, fix it in ARM64 version of elfcorehdr_read() as well. + +Signed-off-by: Pavel Tatashin +Fixes: e62aaeac426a ("arm64: kdump: provide /proc/vmcore file") +Reviewed-by: Tyler Hicks +Link: https://lore.kernel.org/r/20210319205054.743368-1-pasha.tatashin@soleen.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/crash_dump.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/kernel/crash_dump.c b/arch/arm64/kernel/crash_dump.c +index e6e284265f19..58303a9ec32c 100644 +--- a/arch/arm64/kernel/crash_dump.c ++++ b/arch/arm64/kernel/crash_dump.c +@@ -64,5 +64,7 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf, + ssize_t elfcorehdr_read(char *buf, size_t count, u64 *ppos) + { + memcpy(buf, phys_to_virt((phys_addr_t)*ppos), count); ++ *ppos += count; ++ + return count; + } +-- +2.30.1 + diff --git a/queue-5.4/bpf-don-t-do-bpf_cgroup_storage_set-for-kuprobe-tp-p.patch b/queue-5.4/bpf-don-t-do-bpf_cgroup_storage_set-for-kuprobe-tp-p.patch new file mode 100644 index 00000000000..a677e027cbf --- /dev/null +++ b/queue-5.4/bpf-don-t-do-bpf_cgroup_storage_set-for-kuprobe-tp-p.patch @@ -0,0 +1,87 @@ +From ac1f61b52a3ac5b2480dd3ca38137be966b26962 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Mar 2021 18:27:53 -0400 +Subject: bpf: Don't do bpf_cgroup_storage_set() for kuprobe/tp programs + +[ Upstream commit 05a68ce5fa51a83c360381630f823545c5757aa2 ] + +For kuprobe and tracepoint bpf programs, kernel calls +trace_call_bpf() which calls BPF_PROG_RUN_ARRAY_CHECK() +to run the program array. Currently, BPF_PROG_RUN_ARRAY_CHECK() +also calls bpf_cgroup_storage_set() to set percpu +cgroup local storage with NULL value. This is +due to Commit 394e40a29788 ("bpf: extend bpf_prog_array to store +pointers to the cgroup storage") which modified +__BPF_PROG_RUN_ARRAY() to call bpf_cgroup_storage_set() +and this macro is also used by BPF_PROG_RUN_ARRAY_CHECK(). + +kuprobe and tracepoint programs are not allowed to call +bpf_get_local_storage() helper hence does not +access percpu cgroup local storage. Let us +change BPF_PROG_RUN_ARRAY_CHECK() not to +modify percpu cgroup local storage. + +The issue is observed when I tried to debug [1] where +percpu data is overwritten due to + preempt_disable -> migration_disable +change. This patch does not completely fix the above issue, +which will be addressed separately, e.g., multiple cgroup +prog runs may preempt each other. But it does fix +any potential issue caused by tracing program +overwriting percpu cgroup storage: + - in a busy system, a tracing program is to run between + bpf_cgroup_storage_set() and the cgroup prog run. + - a kprobe program is triggered by a helper in cgroup prog + before bpf_get_local_storage() is called. + + [1] https://lore.kernel.org/bpf/CAKH8qBuXCfUz=w8L+Fj74OaUpbosO29niYwTki7e3Ag044_aww@mail.gmail.com/T + +Fixes: 394e40a29788 ("bpf: extend bpf_prog_array to store pointers to the cgroup storage") +Signed-off-by: Yonghong Song +Signed-off-by: Alexei Starovoitov +Acked-by: Roman Gushchin +Link: https://lore.kernel.org/bpf/20210309185028.3763817-1-yhs@fb.com +Signed-off-by: Sasha Levin +--- + include/linux/bpf.h | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/include/linux/bpf.h b/include/linux/bpf.h +index 007147f64390..66590ae89c97 100644 +--- a/include/linux/bpf.h ++++ b/include/linux/bpf.h +@@ -535,7 +535,7 @@ int bpf_prog_array_copy(struct bpf_prog_array *old_array, + struct bpf_prog *include_prog, + struct bpf_prog_array **new_array); + +-#define __BPF_PROG_RUN_ARRAY(array, ctx, func, check_non_null) \ ++#define __BPF_PROG_RUN_ARRAY(array, ctx, func, check_non_null, set_cg_storage) \ + ({ \ + struct bpf_prog_array_item *_item; \ + struct bpf_prog *_prog; \ +@@ -548,7 +548,8 @@ int bpf_prog_array_copy(struct bpf_prog_array *old_array, + goto _out; \ + _item = &_array->items[0]; \ + while ((_prog = READ_ONCE(_item->prog))) { \ +- bpf_cgroup_storage_set(_item->cgroup_storage); \ ++ if (set_cg_storage) \ ++ bpf_cgroup_storage_set(_item->cgroup_storage); \ + _ret &= func(_prog, ctx); \ + _item++; \ + } \ +@@ -609,10 +610,10 @@ _out: \ + }) + + #define BPF_PROG_RUN_ARRAY(array, ctx, func) \ +- __BPF_PROG_RUN_ARRAY(array, ctx, func, false) ++ __BPF_PROG_RUN_ARRAY(array, ctx, func, false, true) + + #define BPF_PROG_RUN_ARRAY_CHECK(array, ctx, func) \ +- __BPF_PROG_RUN_ARRAY(array, ctx, func, true) ++ __BPF_PROG_RUN_ARRAY(array, ctx, func, true, false) + + #ifdef CONFIG_BPF_SYSCALL + DECLARE_PER_CPU(int, bpf_prog_active); +-- +2.30.1 + diff --git a/queue-5.4/bus-omap_l3_noc-mark-l3-irqs-as-irqf_no_thread.patch b/queue-5.4/bus-omap_l3_noc-mark-l3-irqs-as-irqf_no_thread.patch new file mode 100644 index 00000000000..509e6c4ad35 --- /dev/null +++ b/queue-5.4/bus-omap_l3_noc-mark-l3-irqs-as-irqf_no_thread.patch @@ -0,0 +1,51 @@ +From 0cf113c3d1fd4f12a3b5cd78973ea66f9ec861e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Jan 2021 21:15:48 +0200 +Subject: bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD + +From: Grygorii Strashko + +[ Upstream commit 7d7275b3e866cf8092bd12553ec53ba26864f7bb ] + +The main purpose of l3 IRQs is to catch OCP bus access errors and identify +corresponding code places by showing call stack, so it's important to +handle L3 interconnect errors as fast as possible. On RT these IRQs will +became threaded and will be scheduled much more late from the moment actual +error occurred so showing completely useless information. + +Hence, mark l3 IRQs as IRQF_NO_THREAD so they will not be forced threaded +on RT or if force_irqthreads = true. + +Fixes: 0ee7261c9212 ("drivers: bus: Move the OMAP interconnect driver to drivers/bus/") +Signed-off-by: Grygorii Strashko +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + drivers/bus/omap_l3_noc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/bus/omap_l3_noc.c b/drivers/bus/omap_l3_noc.c +index b040447575ad..dcfb32ee5cb6 100644 +--- a/drivers/bus/omap_l3_noc.c ++++ b/drivers/bus/omap_l3_noc.c +@@ -285,7 +285,7 @@ static int omap_l3_probe(struct platform_device *pdev) + */ + l3->debug_irq = platform_get_irq(pdev, 0); + ret = devm_request_irq(l3->dev, l3->debug_irq, l3_interrupt_handler, +- 0x0, "l3-dbg-irq", l3); ++ IRQF_NO_THREAD, "l3-dbg-irq", l3); + if (ret) { + dev_err(l3->dev, "request_irq failed for %d\n", + l3->debug_irq); +@@ -294,7 +294,7 @@ static int omap_l3_probe(struct platform_device *pdev) + + l3->app_irq = platform_get_irq(pdev, 1); + ret = devm_request_irq(l3->dev, l3->app_irq, l3_interrupt_handler, +- 0x0, "l3-app-irq", l3); ++ IRQF_NO_THREAD, "l3-app-irq", l3); + if (ret) + dev_err(l3->dev, "request_irq failed for %d\n", l3->app_irq); + +-- +2.30.1 + diff --git a/queue-5.4/can-c_can-move-runtime-pm-enable-disable-to-c_can_pl.patch b/queue-5.4/can-c_can-move-runtime-pm-enable-disable-to-c_can_pl.patch new file mode 100644 index 00000000000..294604150d4 --- /dev/null +++ b/queue-5.4/can-c_can-move-runtime-pm-enable-disable-to-c_can_pl.patch @@ -0,0 +1,136 @@ +From 26cc864c72037a5166f2a0cb22821214b4db04a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Mar 2021 21:55:40 -0500 +Subject: can: c_can: move runtime PM enable/disable to c_can_platform +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tong Zhang + +[ Upstream commit 6e2fe01dd6f98da6cae8b07cd5cfa67abc70d97d ] + +Currently doing modprobe c_can_pci will make the kernel complain: + + Unbalanced pm_runtime_enable! + +this is caused by pm_runtime_enable() called before pm is initialized. + +This fix is similar to 227619c3ff7c, move those pm_enable/disable code +to c_can_platform. + +Fixes: 4cdd34b26826 ("can: c_can: Add runtime PM support to Bosch C_CAN/D_CAN controller") +Link: http://lore.kernel.org/r/20210302025542.987600-1-ztong0001@gmail.com +Signed-off-by: Tong Zhang +Tested-by: Uwe Kleine-König +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/c_can/c_can.c | 24 +----------------------- + drivers/net/can/c_can/c_can_platform.c | 6 +++++- + 2 files changed, 6 insertions(+), 24 deletions(-) + +diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c +index 8e9f5620c9a2..f14e739ba3f4 100644 +--- a/drivers/net/can/c_can/c_can.c ++++ b/drivers/net/can/c_can/c_can.c +@@ -212,18 +212,6 @@ static const struct can_bittiming_const c_can_bittiming_const = { + .brp_inc = 1, + }; + +-static inline void c_can_pm_runtime_enable(const struct c_can_priv *priv) +-{ +- if (priv->device) +- pm_runtime_enable(priv->device); +-} +- +-static inline void c_can_pm_runtime_disable(const struct c_can_priv *priv) +-{ +- if (priv->device) +- pm_runtime_disable(priv->device); +-} +- + static inline void c_can_pm_runtime_get_sync(const struct c_can_priv *priv) + { + if (priv->device) +@@ -1334,7 +1322,6 @@ static const struct net_device_ops c_can_netdev_ops = { + + int register_c_can_dev(struct net_device *dev) + { +- struct c_can_priv *priv = netdev_priv(dev); + int err; + + /* Deactivate pins to prevent DRA7 DCAN IP from being +@@ -1344,28 +1331,19 @@ int register_c_can_dev(struct net_device *dev) + */ + pinctrl_pm_select_sleep_state(dev->dev.parent); + +- c_can_pm_runtime_enable(priv); +- + dev->flags |= IFF_ECHO; /* we support local echo */ + dev->netdev_ops = &c_can_netdev_ops; + + err = register_candev(dev); +- if (err) +- c_can_pm_runtime_disable(priv); +- else ++ if (!err) + devm_can_led_init(dev); +- + return err; + } + EXPORT_SYMBOL_GPL(register_c_can_dev); + + void unregister_c_can_dev(struct net_device *dev) + { +- struct c_can_priv *priv = netdev_priv(dev); +- + unregister_candev(dev); +- +- c_can_pm_runtime_disable(priv); + } + EXPORT_SYMBOL_GPL(unregister_c_can_dev); + +diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c +index b5145a7f874c..f2b0408ce87d 100644 +--- a/drivers/net/can/c_can/c_can_platform.c ++++ b/drivers/net/can/c_can/c_can_platform.c +@@ -29,6 +29,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -385,6 +386,7 @@ static int c_can_plat_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, dev); + SET_NETDEV_DEV(dev, &pdev->dev); + ++ pm_runtime_enable(priv->device); + ret = register_c_can_dev(dev); + if (ret) { + dev_err(&pdev->dev, "registering %s failed (err=%d)\n", +@@ -397,6 +399,7 @@ static int c_can_plat_probe(struct platform_device *pdev) + return 0; + + exit_free_device: ++ pm_runtime_disable(priv->device); + free_c_can_dev(dev); + exit: + dev_err(&pdev->dev, "probe failed\n"); +@@ -407,9 +410,10 @@ exit: + static int c_can_plat_remove(struct platform_device *pdev) + { + struct net_device *dev = platform_get_drvdata(pdev); ++ struct c_can_priv *priv = netdev_priv(dev); + + unregister_c_can_dev(dev); +- ++ pm_runtime_disable(priv->device); + free_c_can_dev(dev); + + return 0; +-- +2.30.1 + diff --git a/queue-5.4/can-c_can_pci-c_can_pci_remove-fix-use-after-free.patch b/queue-5.4/can-c_can_pci-c_can_pci_remove-fix-use-after-free.patch new file mode 100644 index 00000000000..827d095c4eb --- /dev/null +++ b/queue-5.4/can-c_can_pci-c_can_pci_remove-fix-use-after-free.patch @@ -0,0 +1,44 @@ +From 7e20a8bd39676cf1a8e33d3c502470f78743cef5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Feb 2021 21:45:11 -0500 +Subject: can: c_can_pci: c_can_pci_remove(): fix use-after-free + +From: Tong Zhang + +[ Upstream commit 0429d6d89f97ebff4f17f13f5b5069c66bde8138 ] + +There is a UAF in c_can_pci_remove(). dev is released by +free_c_can_dev() and is used by pci_iounmap(pdev, priv->base) later. +To fix this issue, save the mmio address before releasing dev. + +Fixes: 5b92da0443c2 ("c_can_pci: generic module for C_CAN/D_CAN on PCI") +Link: https://lore.kernel.org/r/20210301024512.539039-1-ztong0001@gmail.com +Signed-off-by: Tong Zhang +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/c_can/c_can_pci.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/can/c_can/c_can_pci.c b/drivers/net/can/c_can/c_can_pci.c +index 406b4847e5dc..7efb60b50876 100644 +--- a/drivers/net/can/c_can/c_can_pci.c ++++ b/drivers/net/can/c_can/c_can_pci.c +@@ -239,12 +239,13 @@ static void c_can_pci_remove(struct pci_dev *pdev) + { + struct net_device *dev = pci_get_drvdata(pdev); + struct c_can_priv *priv = netdev_priv(dev); ++ void __iomem *addr = priv->base; + + unregister_c_can_dev(dev); + + free_c_can_dev(dev); + +- pci_iounmap(pdev, priv->base); ++ pci_iounmap(pdev, addr); + pci_disable_msi(pdev); + pci_clear_master(pdev); + pci_release_regions(pdev); +-- +2.30.1 + diff --git a/queue-5.4/can-flexcan-flexcan_chip_freeze-fix-chip-freeze-for-.patch b/queue-5.4/can-flexcan-flexcan_chip_freeze-fix-chip-freeze-for-.patch new file mode 100644 index 00000000000..1ed3c2fbb79 --- /dev/null +++ b/queue-5.4/can-flexcan-flexcan_chip_freeze-fix-chip-freeze-for-.patch @@ -0,0 +1,55 @@ +From fe910fb0f738d39af58f47ff59592effa58cea0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Mar 2021 00:15:10 +0100 +Subject: can: flexcan: flexcan_chip_freeze(): fix chip freeze for missing + bitrate + +From: Angelo Dureghello + +[ Upstream commit 47c5e474bc1e1061fb037d13b5000b38967eb070 ] + +For cases when flexcan is built-in, bitrate is still not set at +registering. So flexcan_chip_freeze() generates: + +[ 1.860000] *** ZERO DIVIDE *** FORMAT=4 +[ 1.860000] Current process id is 1 +[ 1.860000] BAD KERNEL TRAP: 00000000 +[ 1.860000] PC: [<402e70c8>] flexcan_chip_freeze+0x1a/0xa8 + +To allow chip freeze, using an hardcoded timeout when bitrate is still +not set. + +Fixes: ec15e27cc890 ("can: flexcan: enable RX FIFO after FRZ/HALT valid") +Link: https://lore.kernel.org/r/20210315231510.650593-1-angelo@kernel-space.org +Signed-off-by: Angelo Dureghello +[mkl: use if instead of ? operator] +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/flexcan.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c +index b6d00dfa8b8f..7ec15cb356c0 100644 +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -544,9 +544,15 @@ static int flexcan_chip_disable(struct flexcan_priv *priv) + static int flexcan_chip_freeze(struct flexcan_priv *priv) + { + struct flexcan_regs __iomem *regs = priv->regs; +- unsigned int timeout = 1000 * 1000 * 10 / priv->can.bittiming.bitrate; ++ unsigned int timeout; ++ u32 bitrate = priv->can.bittiming.bitrate; + u32 reg; + ++ if (bitrate) ++ timeout = 1000 * 1000 * 10 / bitrate; ++ else ++ timeout = FLEXCAN_TIMEOUT_US / 10; ++ + reg = priv->read(®s->mcr); + reg |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_HALT; + priv->write(reg, ®s->mcr); +-- +2.30.1 + diff --git a/queue-5.4/can-kvaser_pciefd-always-disable-bus-load-reporting.patch b/queue-5.4/can-kvaser_pciefd-always-disable-bus-load-reporting.patch new file mode 100644 index 00000000000..af2e04a24e0 --- /dev/null +++ b/queue-5.4/can-kvaser_pciefd-always-disable-bus-load-reporting.patch @@ -0,0 +1,56 @@ +From 9b97bf14434544e8a86faa0490f4815b8d99f3d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Mar 2021 10:17:23 +0100 +Subject: can: kvaser_pciefd: Always disable bus load reporting + +From: Jimmy Assarsson + +[ Upstream commit 7c6e6bce08f918b64459415f58061d4d6df44994 ] + +Under certain circumstances, when switching from Kvaser's linuxcan driver +(kvpciefd) to the SocketCAN driver (kvaser_pciefd), the bus load reporting +is not disabled. +This is flooding the kernel log with prints like: +[3485.574677] kvaser_pciefd 0000:02:00.0: Received unexpected packet type 0x00000009 + +Always put the controller in the expected state, instead of assuming that +bus load reporting is inactive. + +Note: If bus load reporting is enabled when the driver is loaded, you will + still get a number of bus load packages (and printouts), before it is + disabled. + +Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices") +Link: https://lore.kernel.org/r/20210309091724.31262-1-jimmyassarsson@gmail.com +Signed-off-by: Jimmy Assarsson +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/kvaser_pciefd.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/can/kvaser_pciefd.c b/drivers/net/can/kvaser_pciefd.c +index 72acd1ba162d..e7a26ec9bdc1 100644 +--- a/drivers/net/can/kvaser_pciefd.c ++++ b/drivers/net/can/kvaser_pciefd.c +@@ -57,6 +57,7 @@ MODULE_DESCRIPTION("CAN driver for Kvaser CAN/PCIe devices"); + #define KVASER_PCIEFD_KCAN_STAT_REG 0x418 + #define KVASER_PCIEFD_KCAN_MODE_REG 0x41c + #define KVASER_PCIEFD_KCAN_BTRN_REG 0x420 ++#define KVASER_PCIEFD_KCAN_BUS_LOAD_REG 0x424 + #define KVASER_PCIEFD_KCAN_BTRD_REG 0x428 + #define KVASER_PCIEFD_KCAN_PWM_REG 0x430 + /* Loopback control register */ +@@ -947,6 +948,9 @@ static int kvaser_pciefd_setup_can_ctrls(struct kvaser_pciefd *pcie) + timer_setup(&can->bec_poll_timer, kvaser_pciefd_bec_poll_timer, + 0); + ++ /* Disable Bus load reporting */ ++ iowrite32(0, can->reg_base + KVASER_PCIEFD_KCAN_BUS_LOAD_REG); ++ + tx_npackets = ioread32(can->reg_base + + KVASER_PCIEFD_KCAN_TX_NPACKETS_REG); + if (((tx_npackets >> KVASER_PCIEFD_KCAN_TX_NPACKETS_MAX_SHIFT) & +-- +2.30.1 + diff --git a/queue-5.4/can-m_can-m_can_do_rx_poll-fix-extraneous-msg-loss-w.patch b/queue-5.4/can-m_can-m_can_do_rx_poll-fix-extraneous-msg-loss-w.patch new file mode 100644 index 00000000000..b8b699dcac2 --- /dev/null +++ b/queue-5.4/can-m_can-m_can_do_rx_poll-fix-extraneous-msg-loss-w.patch @@ -0,0 +1,44 @@ +From d7599ac87e57e1e8ae79990fcbc2832912968761 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 10:31:52 +0000 +Subject: can: m_can: m_can_do_rx_poll(): fix extraneous msg loss warning + +From: Torin Cooper-Bennun + +[ Upstream commit c0e399f3baf42279f48991554240af8c457535d1 ] + +Message loss from RX FIFO 0 is already handled in +m_can_handle_lost_msg(), with netdev output included. + +Removing this warning also improves driver performance under heavy +load, where m_can_do_rx_poll() may be called many times before this +interrupt is cleared, causing this message to be output many +times (thanks Mariusz Madej for this report). + +Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support") +Link: https://lore.kernel.org/r/20210303103151.3760532-1-torin@maxiluxsystems.com +Reported-by: Mariusz Madej +Signed-off-by: Torin Cooper-Bennun +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index 8a842545e3f6..cf72a7e464ec 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -501,9 +501,6 @@ static int m_can_do_rx_poll(struct net_device *dev, int quota) + } + + while ((rxfs & RXFS_FFL_MASK) && (quota > 0)) { +- if (rxfs & RXFS_RFL) +- netdev_warn(dev, "Rx FIFO 0 Message Lost\n"); +- + m_can_read_fifo(dev, rxfs); + + quota--; +-- +2.30.1 + diff --git a/queue-5.4/can-m_can-m_can_rx_peripheral-fix-rx-being-blocked-b.patch b/queue-5.4/can-m_can-m_can_rx_peripheral-fix-rx-being-blocked-b.patch new file mode 100644 index 00000000000..d465948bfe2 --- /dev/null +++ b/queue-5.4/can-m_can-m_can_rx_peripheral-fix-rx-being-blocked-b.patch @@ -0,0 +1,42 @@ +From 86d00b7954d2f74aec10e616e97b97ec45d04846 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 14:43:51 +0000 +Subject: can: m_can: m_can_rx_peripheral(): fix RX being blocked by errors + +From: Torin Cooper-Bennun + +[ Upstream commit e98d9ee64ee2cc9b1d1a8e26610ec4d0392ebe50 ] + +For M_CAN peripherals, m_can_rx_handler() was called with quota = 1, +which caused any error handling to block RX from taking place until +the next time the IRQ handler is called. This had been observed to +cause RX to be blocked indefinitely in some cases. + +This is fixed by calling m_can_rx_handler with a sensibly high quota. + +Fixes: f524f829b75a ("can: m_can: Create a m_can platform framework") +Link: https://lore.kernel.org/r/20210303144350.4093750-1-torin@maxiluxsystems.com +Suggested-by: Marc Kleine-Budde +Signed-off-by: Torin Cooper-Bennun +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index cf72a7e464ec..b2224113987c 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -839,7 +839,7 @@ static int m_can_rx_peripheral(struct net_device *dev) + { + struct m_can_classdev *cdev = netdev_priv(dev); + +- m_can_rx_handler(dev, 1); ++ m_can_rx_handler(dev, M_CAN_NAPI_WEIGHT); + + m_can_enable_all_interrupts(cdev); + +-- +2.30.1 + diff --git a/queue-5.4/can-peak_usb-add-forgotten-supported-devices.patch b/queue-5.4/can-peak_usb-add-forgotten-supported-devices.patch new file mode 100644 index 00000000000..0e8e9808d9a --- /dev/null +++ b/queue-5.4/can-peak_usb-add-forgotten-supported-devices.patch @@ -0,0 +1,39 @@ +From 9737ec283fc23b88e652379c162114893df6257c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Mar 2021 09:21:27 +0100 +Subject: can: peak_usb: add forgotten supported devices + +From: Stephane Grosjean + +[ Upstream commit 59ec7b89ed3e921cd0625a8c83f31a30d485fdf8 ] + +Since the peak_usb driver also supports the CAN-USB interfaces +"PCAN-USB X6" and "PCAN-Chip USB" from PEAK-System GmbH, this patch adds +their names to the list of explicitly supported devices. + +Fixes: ea8b65b596d7 ("can: usb: Add support of PCAN-Chip USB stamp module") +Fixes: f00b534ded60 ("can: peak: Add support for PCAN-USB X6 USB interface") +Link: https://lore.kernel.org/r/20210309082128.23125-3-s.grosjean@peak-system.com +Signed-off-by: Stephane Grosjean +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c +index 96bbdef672bc..17a5641d81b3 100644 +--- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c ++++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c +@@ -18,6 +18,8 @@ + + MODULE_SUPPORTED_DEVICE("PEAK-System PCAN-USB FD adapter"); + MODULE_SUPPORTED_DEVICE("PEAK-System PCAN-USB Pro FD adapter"); ++MODULE_SUPPORTED_DEVICE("PEAK-System PCAN-Chip USB"); ++MODULE_SUPPORTED_DEVICE("PEAK-System PCAN-USB X6 adapter"); + + #define PCAN_USBPROFD_CHANNEL_COUNT 2 + #define PCAN_USBFD_CHANNEL_COUNT 1 +-- +2.30.1 + diff --git a/queue-5.4/drm-msm-fix-shutdown-hook-in-case-gpu-components-fai.patch b/queue-5.4/drm-msm-fix-shutdown-hook-in-case-gpu-components-fai.patch new file mode 100644 index 00000000000..7addcdba444 --- /dev/null +++ b/queue-5.4/drm-msm-fix-shutdown-hook-in-case-gpu-components-fai.patch @@ -0,0 +1,95 @@ +From 39f0b1ef2e2c59c8ee2699be07a13e3d06e0bc52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Mar 2021 08:56:02 -0300 +Subject: drm/msm: fix shutdown hook in case GPU components failed to bind + +From: Dmitry Baryshkov + +[ Upstream commit 623f279c77811475ac8fd5635cc4e4451aa71291 ] + +If GPU components have failed to bind, shutdown callback would fail with +the following backtrace. Add safeguard check to stop that oops from +happening and allow the board to reboot. + +[ 66.617046] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 +[ 66.626066] Mem abort info: +[ 66.628939] ESR = 0x96000006 +[ 66.632088] EC = 0x25: DABT (current EL), IL = 32 bits +[ 66.637542] SET = 0, FnV = 0 +[ 66.640688] EA = 0, S1PTW = 0 +[ 66.643924] Data abort info: +[ 66.646889] ISV = 0, ISS = 0x00000006 +[ 66.650832] CM = 0, WnR = 0 +[ 66.653890] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000107f81000 +[ 66.660505] [0000000000000000] pgd=0000000100bb2003, p4d=0000000100bb2003, pud=0000000100897003, pmd=0000000000000000 +[ 66.671398] Internal error: Oops: 96000006 [#1] PREEMPT SMP +[ 66.677115] Modules linked in: +[ 66.680261] CPU: 6 PID: 352 Comm: reboot Not tainted 5.11.0-rc2-00309-g79e3faa756b2 #38 +[ 66.688473] Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) +[ 66.695347] pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--) +[ 66.701507] pc : msm_atomic_commit_tail+0x78/0x4e0 +[ 66.706437] lr : commit_tail+0xa4/0x184 +[ 66.710381] sp : ffff8000108f3af0 +[ 66.713791] x29: ffff8000108f3af0 x28: ffff418c44337000 +[ 66.719242] x27: 0000000000000000 x26: ffff418c40a24490 +[ 66.724693] x25: ffffd3a842a4f1a0 x24: 0000000000000008 +[ 66.730146] x23: ffffd3a84313f030 x22: ffff418c444ce000 +[ 66.735598] x21: ffff418c408a4980 x20: 0000000000000000 +[ 66.741049] x19: 0000000000000000 x18: ffff800010710fbc +[ 66.746500] x17: 000000000000000c x16: 0000000000000001 +[ 66.751954] x15: 0000000000010008 x14: 0000000000000068 +[ 66.757405] x13: 0000000000000001 x12: 0000000000000000 +[ 66.762855] x11: 0000000000000001 x10: 00000000000009b0 +[ 66.768306] x9 : ffffd3a843192000 x8 : ffff418c44337000 +[ 66.773757] x7 : 0000000000000000 x6 : 00000000a401b34e +[ 66.779210] x5 : 00ffffffffffffff x4 : 0000000000000000 +[ 66.784660] x3 : 0000000000000000 x2 : ffff418c444ce000 +[ 66.790111] x1 : ffffd3a841dce530 x0 : ffff418c444cf000 +[ 66.795563] Call trace: +[ 66.798075] msm_atomic_commit_tail+0x78/0x4e0 +[ 66.802633] commit_tail+0xa4/0x184 +[ 66.806217] drm_atomic_helper_commit+0x160/0x390 +[ 66.811051] drm_atomic_commit+0x4c/0x60 +[ 66.815082] drm_atomic_helper_disable_all+0x1f4/0x210 +[ 66.820355] drm_atomic_helper_shutdown+0x80/0x130 +[ 66.825276] msm_pdev_shutdown+0x14/0x20 +[ 66.829303] platform_shutdown+0x28/0x40 +[ 66.833330] device_shutdown+0x158/0x330 +[ 66.837357] kernel_restart+0x40/0xa0 +[ 66.841122] __do_sys_reboot+0x228/0x250 +[ 66.845148] __arm64_sys_reboot+0x28/0x34 +[ 66.849264] el0_svc_common.constprop.0+0x74/0x190 +[ 66.854187] do_el0_svc+0x24/0x90 +[ 66.857595] el0_svc+0x14/0x20 +[ 66.860739] el0_sync_handler+0x1a4/0x1b0 +[ 66.864858] el0_sync+0x174/0x180 +[ 66.868269] Code: 1ac020a0 2a000273 eb02007f 54ffff01 (f9400285) +[ 66.874525] ---[ end trace 20dedb2a3229fec8 ]--- + +Fixes: 9d5cbf5fe46e ("drm/msm: add shutdown support for display platform_driver") +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Fabio Estevam +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/msm_drv.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c +index 8d9d86c76a4e..896d6f95a960 100644 +--- a/drivers/gpu/drm/msm/msm_drv.c ++++ b/drivers/gpu/drm/msm/msm_drv.c +@@ -1326,6 +1326,10 @@ static int msm_pdev_remove(struct platform_device *pdev) + static void msm_pdev_shutdown(struct platform_device *pdev) + { + struct drm_device *drm = platform_get_drvdata(pdev); ++ struct msm_drm_private *priv = drm ? drm->dev_private : NULL; ++ ++ if (!priv || !priv->kms) ++ return; + + drm_atomic_helper_shutdown(drm); + } +-- +2.30.1 + diff --git a/queue-5.4/e1000e-add-rtnl_lock-to-e1000_reset_task.patch b/queue-5.4/e1000e-add-rtnl_lock-to-e1000_reset_task.patch new file mode 100644 index 00000000000..027ed00ef53 --- /dev/null +++ b/queue-5.4/e1000e-add-rtnl_lock-to-e1000_reset_task.patch @@ -0,0 +1,54 @@ +From ea1c37f36e669161ea12d24186785fff8728b16a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Oct 2020 14:59:37 +0300 +Subject: e1000e: add rtnl_lock() to e1000_reset_task + +From: Vitaly Lifshits + +[ Upstream commit 21f857f0321d0d0ea9b1a758bd55dc63d1cb2437 ] + +A possible race condition was found in e1000_reset_task, +after discovering a similar issue in igb driver via +commit 024a8168b749 ("igb: reinit_locked() should be called +with rtnl_lock"). + +Added rtnl_lock() and rtnl_unlock() to avoid this. + +Fixes: bc7f75fa9788 ("[E1000E]: New pci-express e1000 driver (currently for ICH9 devices only)") +Suggested-by: Jakub Kicinski +Signed-off-by: Vitaly Lifshits +Tested-by: Dvora Fuxbrumer +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/e1000e/netdev.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c +index 4cb05a31e66d..c2feedfd321d 100644 +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -5953,15 +5953,19 @@ static void e1000_reset_task(struct work_struct *work) + struct e1000_adapter *adapter; + adapter = container_of(work, struct e1000_adapter, reset_task); + ++ rtnl_lock(); + /* don't run the task if already down */ +- if (test_bit(__E1000_DOWN, &adapter->state)) ++ if (test_bit(__E1000_DOWN, &adapter->state)) { ++ rtnl_unlock(); + return; ++ } + + if (!(adapter->flags & FLAG_RESTART_NOW)) { + e1000e_dump(adapter); + e_err("Reset adapter unexpectedly\n"); + } + e1000e_reinit_locked(adapter); ++ rtnl_unlock(); + } + + /** +-- +2.30.1 + diff --git a/queue-5.4/e1000e-fix-error-handling-in-e1000_set_d0_lplu_state.patch b/queue-5.4/e1000e-fix-error-handling-in-e1000_set_d0_lplu_state.patch new file mode 100644 index 00000000000..6c1c8afb12e --- /dev/null +++ b/queue-5.4/e1000e-fix-error-handling-in-e1000_set_d0_lplu_state.patch @@ -0,0 +1,40 @@ +From ef073dcdc4e7ad93d47b31b126caea09001392cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Feb 2021 17:44:23 +0800 +Subject: e1000e: Fix error handling in e1000_set_d0_lplu_state_82571 + +From: Dinghao Liu + +[ Upstream commit b52912b8293f2c496f42583e65599aee606a0c18 ] + +There is one e1e_wphy() call in e1000_set_d0_lplu_state_82571 +that we have caught its return value but lack further handling. +Check and terminate the execution flow just like other e1e_wphy() +in this function. + +Fixes: bc7f75fa9788 ("[E1000E]: New pci-express e1000 driver (currently for ICH9 devices only)") +Signed-off-by: Dinghao Liu +Acked-by: Sasha Neftin +Tested-by: Dvora Fuxbrumer +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/e1000e/82571.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/intel/e1000e/82571.c b/drivers/net/ethernet/intel/e1000e/82571.c +index 2c1bab377b2a..1fd4406173a8 100644 +--- a/drivers/net/ethernet/intel/e1000e/82571.c ++++ b/drivers/net/ethernet/intel/e1000e/82571.c +@@ -899,6 +899,8 @@ static s32 e1000_set_d0_lplu_state_82571(struct e1000_hw *hw, bool active) + } else { + data &= ~IGP02E1000_PM_D0_LPLU; + ret_val = e1e_wphy(hw, IGP02E1000_PHY_POWER_MGMT, data); ++ if (ret_val) ++ return ret_val; + /* LPLU and SmartSpeed are mutually exclusive. LPLU is used + * during Dx states where the power conservation is most + * important. During driver activity we should enable +-- +2.30.1 + diff --git a/queue-5.4/ftgmac100-restart-mac-hw-once.patch b/queue-5.4/ftgmac100-restart-mac-hw-once.patch new file mode 100644 index 00000000000..63ad3dda657 --- /dev/null +++ b/queue-5.4/ftgmac100-restart-mac-hw-once.patch @@ -0,0 +1,38 @@ +From 3d1c62e5752a2f6b1349ddcc78ffa60b3459acbf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Mar 2021 11:04:05 +1030 +Subject: ftgmac100: Restart MAC HW once + +From: Dylan Hung + +[ Upstream commit 6897087323a2fde46df32917462750c069668b2f ] + +The interrupt handler may set the flag to reset the mac in the future, +but that flag is not cleared once the reset has occurred. + +Fixes: 10cbd6407609 ("ftgmac100: Rework NAPI & interrupts handling") +Signed-off-by: Dylan Hung +Acked-by: Benjamin Herrenschmidt +Reviewed-by: Joel Stanley +Signed-off-by: Joel Stanley +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/faraday/ftgmac100.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c +index 1aea22d2540f..4050f81f788c 100644 +--- a/drivers/net/ethernet/faraday/ftgmac100.c ++++ b/drivers/net/ethernet/faraday/ftgmac100.c +@@ -1307,6 +1307,7 @@ static int ftgmac100_poll(struct napi_struct *napi, int budget) + */ + if (unlikely(priv->need_mac_restart)) { + ftgmac100_start_hw(priv); ++ priv->need_mac_restart = false; + + /* Re-enable "bad" interrupts */ + iowrite32(FTGMAC100_INT_BAD, +-- +2.30.1 + diff --git a/queue-5.4/igc-fix-pause-frame-advertising.patch b/queue-5.4/igc-fix-pause-frame-advertising.patch new file mode 100644 index 00000000000..b35a782fe8e --- /dev/null +++ b/queue-5.4/igc-fix-pause-frame-advertising.patch @@ -0,0 +1,48 @@ +From eb76c86f581165eb426923a8b0c22aaabcd86c8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Feb 2021 00:36:47 +0800 +Subject: igc: Fix Pause Frame Advertising + +From: Muhammad Husaini Zulkifli + +[ Upstream commit 8876529465c368beafd51a70f79d7a738f2aadf4 ] + +Fix Pause Frame Advertising when getting the advertisement via ethtool. +Remove setting the "advertising" bit in link_ksettings during default +case when Tx and Rx are in off state with Auto Negotiate off. + +Below is the original output of advertisement link during Tx and Rx off: +Advertised pause frame use: Symmetric Receive-only + +Expected output: +Advertised pause frame use: No + +Fixes: 8c5ad0dae93c ("igc: Add ethtool support") +Signed-off-by: Muhammad Husaini Zulkifli +Reviewed-by: Malli C +Acked-by: Sasha Neftin +Tested-by: Dvora Fuxbrumer +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc_ethtool.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igc/igc_ethtool.c b/drivers/net/ethernet/intel/igc/igc_ethtool.c +index 0365bf2b480e..d1a25d679b89 100644 +--- a/drivers/net/ethernet/intel/igc/igc_ethtool.c ++++ b/drivers/net/ethernet/intel/igc/igc_ethtool.c +@@ -1704,9 +1704,7 @@ static int igc_get_link_ksettings(struct net_device *netdev, + Asym_Pause); + break; + default: +- ethtool_link_ksettings_add_link_mode(cmd, advertising, Pause); +- ethtool_link_ksettings_add_link_mode(cmd, advertising, +- Asym_Pause); ++ break; + } + + status = pm_runtime_suspended(&adapter->pdev->dev) ? +-- +2.30.1 + diff --git a/queue-5.4/igc-fix-supported-pause-frame-link-setting.patch b/queue-5.4/igc-fix-supported-pause-frame-link-setting.patch new file mode 100644 index 00000000000..5593a5096f3 --- /dev/null +++ b/queue-5.4/igc-fix-supported-pause-frame-link-setting.patch @@ -0,0 +1,47 @@ +From 5bebcc300c94ca9f991fd1810ceb06cb1c47e3b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Feb 2021 00:36:48 +0800 +Subject: igc: Fix Supported Pause Frame Link Setting + +From: Muhammad Husaini Zulkifli + +[ Upstream commit 9a4a1cdc5ab52118c1f2b216f4240830b6528d32 ] + +The Supported Pause Frame always display "No" even though the Advertised +pause frame showing the correct setting based on the pause parameters via +ethtool. Set bit in link_ksettings to "Supported" for Pause Frame. + +Before output: +Supported pause frame use: No + +Expected output: +Supported pause frame use: Symmetric + +Fixes: 8c5ad0dae93c ("igc: Add ethtool support") +Signed-off-by: Muhammad Husaini Zulkifli +Reviewed-by: Malli C +Tested-by: Dvora Fuxbrumer +Acked-by: Sasha Neftin +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc_ethtool.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/intel/igc/igc_ethtool.c b/drivers/net/ethernet/intel/igc/igc_ethtool.c +index d1a25d679b89..cbcb8611ab50 100644 +--- a/drivers/net/ethernet/intel/igc/igc_ethtool.c ++++ b/drivers/net/ethernet/intel/igc/igc_ethtool.c +@@ -1690,6 +1690,9 @@ static int igc_get_link_ksettings(struct net_device *netdev, + Autoneg); + } + ++ /* Set pause flow control settings */ ++ ethtool_link_ksettings_add_link_mode(cmd, supported, Pause); ++ + switch (hw->fc.requested_mode) { + case igc_fc_full: + ethtool_link_ksettings_add_link_mode(cmd, advertising, Pause); +-- +2.30.1 + diff --git a/queue-5.4/ipv6-fix-suspecious-rcu-usage-warning.patch b/queue-5.4/ipv6-fix-suspecious-rcu-usage-warning.patch new file mode 100644 index 00000000000..a9a0d329c60 --- /dev/null +++ b/queue-5.4/ipv6-fix-suspecious-rcu-usage-warning.patch @@ -0,0 +1,127 @@ +From 435d59511170f39f9b9fe0bf1b4f8f7fad66a9c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Mar 2021 18:20:35 -0800 +Subject: ipv6: fix suspecious RCU usage warning + +From: Wei Wang + +[ Upstream commit 28259bac7f1dde06d8ba324e222bbec9d4e92f2b ] + +Syzbot reported the suspecious RCU usage in nexthop_fib6_nh() when +called from ipv6_route_seq_show(). The reason is ipv6_route_seq_start() +calls rcu_read_lock_bh(), while nexthop_fib6_nh() calls +rcu_dereference_rtnl(). +The fix proposed is to add a variant of nexthop_fib6_nh() to use +rcu_dereference_bh_rtnl() for ipv6_route_seq_show(). + +The reported trace is as follows: +./include/net/nexthop.h:416 suspicious rcu_dereference_check() usage! + +other info that might help us debug this: + +rcu_scheduler_active = 2, debug_locks = 1 +2 locks held by syz-executor.0/17895: + at: seq_read+0x71/0x12a0 fs/seq_file.c:169 + at: seq_file_net include/linux/seq_file_net.h:19 [inline] + at: ipv6_route_seq_start+0xaf/0x300 net/ipv6/ip6_fib.c:2616 + +stack backtrace: +CPU: 1 PID: 17895 Comm: syz-executor.0 Not tainted 4.15.0-syzkaller #0 +Call Trace: + [] __dump_stack lib/dump_stack.c:17 [inline] + [] dump_stack+0xd8/0x147 lib/dump_stack.c:53 + [] lockdep_rcu_suspicious+0x153/0x15d kernel/locking/lockdep.c:5745 + [] nexthop_fib6_nh include/net/nexthop.h:416 [inline] + [] ipv6_route_native_seq_show net/ipv6/ip6_fib.c:2488 [inline] + [] ipv6_route_seq_show+0x436/0x7a0 net/ipv6/ip6_fib.c:2673 + [] seq_read+0xccf/0x12a0 fs/seq_file.c:276 + [] proc_reg_read+0x10c/0x1d0 fs/proc/inode.c:231 + [] do_loop_readv_writev fs/read_write.c:714 [inline] + [] do_loop_readv_writev fs/read_write.c:701 [inline] + [] do_iter_read+0x49e/0x660 fs/read_write.c:935 + [] vfs_readv+0xfb/0x170 fs/read_write.c:997 + [] kernel_readv fs/splice.c:361 [inline] + [] default_file_splice_read+0x487/0x9c0 fs/splice.c:416 + [] do_splice_to+0x129/0x190 fs/splice.c:879 + [] splice_direct_to_actor+0x256/0x890 fs/splice.c:951 + [] do_splice_direct+0x1dd/0x2b0 fs/splice.c:1060 + [] do_sendfile+0x597/0xce0 fs/read_write.c:1459 + [] SYSC_sendfile64 fs/read_write.c:1520 [inline] + [] SyS_sendfile64+0x155/0x170 fs/read_write.c:1506 + [] do_syscall_64+0x1ff/0x310 arch/x86/entry/common.c:305 + [] entry_SYSCALL_64_after_hwframe+0x42/0xb7 + +Fixes: f88d8ea67fbdb ("ipv6: Plumb support for nexthop object in a fib6_info") +Reported-by: syzbot +Signed-off-by: Wei Wang +Cc: David Ahern +Cc: Ido Schimmel +Cc: Petr Machata +Cc: Eric Dumazet +Reviewed-by: Ido Schimmel +Reviewed-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/nexthop.h | 24 ++++++++++++++++++++++++ + net/ipv6/ip6_fib.c | 2 +- + 2 files changed, 25 insertions(+), 1 deletion(-) + +diff --git a/include/net/nexthop.h b/include/net/nexthop.h +index 3bb618e5ecf7..18a5aca26476 100644 +--- a/include/net/nexthop.h ++++ b/include/net/nexthop.h +@@ -291,6 +291,7 @@ static inline struct fib_nh *fib_info_nh(struct fib_info *fi, int nhsel) + int fib6_check_nexthop(struct nexthop *nh, struct fib6_config *cfg, + struct netlink_ext_ack *extack); + ++/* Caller should either hold rcu_read_lock(), or RTNL. */ + static inline struct fib6_nh *nexthop_fib6_nh(struct nexthop *nh) + { + struct nh_info *nhi; +@@ -311,6 +312,29 @@ static inline struct fib6_nh *nexthop_fib6_nh(struct nexthop *nh) + return NULL; + } + ++/* Variant of nexthop_fib6_nh(). ++ * Caller should either hold rcu_read_lock_bh(), or RTNL. ++ */ ++static inline struct fib6_nh *nexthop_fib6_nh_bh(struct nexthop *nh) ++{ ++ struct nh_info *nhi; ++ ++ if (nh->is_group) { ++ struct nh_group *nh_grp; ++ ++ nh_grp = rcu_dereference_bh_rtnl(nh->nh_grp); ++ nh = nexthop_mpath_select(nh_grp, 0); ++ if (!nh) ++ return NULL; ++ } ++ ++ nhi = rcu_dereference_bh_rtnl(nh->nh_info); ++ if (nhi->family == AF_INET6) ++ return &nhi->fib6_nh; ++ ++ return NULL; ++} ++ + static inline struct net_device *fib6_info_nh_dev(struct fib6_info *f6i) + { + struct fib6_nh *fib6_nh; +diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c +index 906ac5e6d96c..bb68290ad68d 100644 +--- a/net/ipv6/ip6_fib.c ++++ b/net/ipv6/ip6_fib.c +@@ -2382,7 +2382,7 @@ static int ipv6_route_seq_show(struct seq_file *seq, void *v) + const struct net_device *dev; + + if (rt->nh) +- fib6_nh = nexthop_fib6_nh(rt->nh); ++ fib6_nh = nexthop_fib6_nh_bh(rt->nh); + + seq_printf(seq, "%pi6 %02x ", &rt->fib6_dst.addr, rt->fib6_dst.plen); + +-- +2.30.1 + diff --git a/queue-5.4/libbpf-fix-btf-dump-of-pointer-to-array-of-struct.patch b/queue-5.4/libbpf-fix-btf-dump-of-pointer-to-array-of-struct.patch new file mode 100644 index 00000000000..fb5802446b7 --- /dev/null +++ b/queue-5.4/libbpf-fix-btf-dump-of-pointer-to-array-of-struct.patch @@ -0,0 +1,90 @@ +From f249ca11b47d82ab3b5b0f667b74ff68d2fd6ea8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 12:25:54 +0100 +Subject: libbpf: Fix BTF dump of pointer-to-array-of-struct +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jean-Philippe Brucker + +[ Upstream commit 901ee1d750f29a335423eeb9463c3ca461ca18c2 ] + +The vmlinux.h generated from BTF is invalid when building +drivers/phy/ti/phy-gmii-sel.c with clang: + +vmlinux.h:61702:27: error: array type has incomplete element type ‘struct reg_field’ +61702 | const struct reg_field (*regfields)[3]; + | ^~~~~~~~~ + +bpftool generates a forward declaration for this struct regfield, which +compilers aren't happy about. Here's a simplified reproducer: + + struct inner { + int val; + }; + struct outer { + struct inner (*ptr_to_array)[2]; + } A; + +After build with clang -> bpftool btf dump c -> clang/gcc: +./def-clang.h:11:23: error: array has incomplete element type 'struct inner' + struct inner (*ptr_to_array)[2]; + +Member ptr_to_array of struct outer is a pointer to an array of struct +inner. In the DWARF generated by clang, struct outer appears before +struct inner, so when converting BTF of struct outer into C, bpftool +issues a forward declaration to struct inner. With GCC the DWARF info is +reversed so struct inner gets fully defined. + +That forward declaration is not sufficient when compilers handle an +array of the struct, even when it's only used through a pointer. Note +that we can trigger the same issue with an intermediate typedef: + + struct inner { + int val; + }; + typedef struct inner inner2_t[2]; + struct outer { + inner2_t *ptr_to_array; + } A; + +Becomes: + + struct inner; + typedef struct inner inner2_t[2]; + +And causes: + +./def-clang.h:10:30: error: array has incomplete element type 'struct inner' + typedef struct inner inner2_t[2]; + +To fix this, clear through_ptr whenever we encounter an intermediate +array, to make the inner struct part of a strong link and force full +declaration. + +Fixes: 351131b51c7a ("libbpf: add btf_dump API for BTF-to-C conversion") +Signed-off-by: Jean-Philippe Brucker +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20210319112554.794552-2-jean-philippe@linaro.org +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/btf_dump.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c +index d9e386b8f47e..b2fc45250450 100644 +--- a/tools/lib/bpf/btf_dump.c ++++ b/tools/lib/bpf/btf_dump.c +@@ -443,7 +443,7 @@ static int btf_dump_order_type(struct btf_dump *d, __u32 id, bool through_ptr) + return err; + + case BTF_KIND_ARRAY: +- return btf_dump_order_type(d, btf_array(t)->type, through_ptr); ++ return btf_dump_order_type(d, btf_array(t)->type, false); + + case BTF_KIND_STRUCT: + case BTF_KIND_UNION: { +-- +2.30.1 + diff --git a/queue-5.4/libbpf-fix-install-flag-order.patch b/queue-5.4/libbpf-fix-install-flag-order.patch new file mode 100644 index 00000000000..fabb4727ee0 --- /dev/null +++ b/queue-5.4/libbpf-fix-install-flag-order.patch @@ -0,0 +1,41 @@ +From 77184d898c5dba166bea998fc488b37ed62a83be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 10:30:38 -0800 +Subject: libbpf: Fix INSTALL flag order + +From: Georgi Valkov + +[ Upstream commit e7fb6465d4c8e767e39cbee72464e0060ab3d20c ] + +It was reported ([0]) that having optional -m flag between source and +destination arguments in install command breaks bpftools cross-build +on MacOS. Move -m to the front to fix this issue. + + [0] https://github.com/openwrt/openwrt/pull/3959 + +Fixes: 7110d80d53f4 ("libbpf: Makefile set specified permission mode") +Signed-off-by: Georgi Valkov +Signed-off-by: Andrii Nakryiko +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20210308183038.613432-1-andrii@kernel.org +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile +index 283caeaaffc3..9758bfa59232 100644 +--- a/tools/lib/bpf/Makefile ++++ b/tools/lib/bpf/Makefile +@@ -241,7 +241,7 @@ define do_install + if [ ! -d '$(DESTDIR_SQ)$2' ]; then \ + $(INSTALL) -d -m 755 '$(DESTDIR_SQ)$2'; \ + fi; \ +- $(INSTALL) $1 $(if $3,-m $3,) '$(DESTDIR_SQ)$2' ++ $(INSTALL) $(if $3,-m $3,) $1 '$(DESTDIR_SQ)$2' + endef + + install_lib: all_cmd +-- +2.30.1 + diff --git a/queue-5.4/libbpf-use-sock_cloexec-when-opening-the-netlink-soc.patch b/queue-5.4/libbpf-use-sock_cloexec-when-opening-the-netlink-soc.patch new file mode 100644 index 00000000000..57c7b133248 --- /dev/null +++ b/queue-5.4/libbpf-use-sock_cloexec-when-opening-the-netlink-soc.patch @@ -0,0 +1,42 @@ +From 68e0010c1df71e51a6ddcff934f51f2b3d65b6f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Mar 2021 17:28:58 +0530 +Subject: libbpf: Use SOCK_CLOEXEC when opening the netlink socket +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kumar Kartikeya Dwivedi + +[ Upstream commit 58bfd95b554f1a23d01228672f86bb489bdbf4ba ] + +Otherwise, there exists a small window between the opening and closing +of the socket fd where it may leak into processes launched by some other +thread. + +Fixes: 949abbe88436 ("libbpf: add function to setup XDP") +Signed-off-by: Kumar Kartikeya Dwivedi +Signed-off-by: Daniel Borkmann +Acked-by: Toke Høiland-Jørgensen +Link: https://lore.kernel.org/bpf/20210317115857.6536-1-memxor@gmail.com +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/netlink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/bpf/netlink.c b/tools/lib/bpf/netlink.c +index 88416be2bf99..5ec8043c71bc 100644 +--- a/tools/lib/bpf/netlink.c ++++ b/tools/lib/bpf/netlink.c +@@ -37,7 +37,7 @@ int libbpf_netlink_open(__u32 *nl_pid) + memset(&sa, 0, sizeof(sa)); + sa.nl_family = AF_NETLINK; + +- sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); ++ sock = socket(AF_NETLINK, SOCK_RAW | SOCK_CLOEXEC, NETLINK_ROUTE); + if (sock < 0) + return -errno; + +-- +2.30.1 + diff --git a/queue-5.4/mac80211-fix-rate-mask-reset.patch b/queue-5.4/mac80211-fix-rate-mask-reset.patch new file mode 100644 index 00000000000..740011f0bca --- /dev/null +++ b/queue-5.4/mac80211-fix-rate-mask-reset.patch @@ -0,0 +1,57 @@ +From 2426de080c0ba5e7d0728ba86bd8571edbb60eef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Feb 2021 11:22:14 +0100 +Subject: mac80211: fix rate mask reset + +From: Johannes Berg + +[ Upstream commit 1944015fe9c1d9fa5e9eb7ffbbb5ef8954d6753b ] + +Coverity reported the strange "if (~...)" condition that's +always true. It suggested that ! was intended instead of ~, +but upon further analysis I'm convinced that what really was +intended was a comparison to 0xff/0xffff (in HT/VHT cases +respectively), since this indicates that all of the rates +are enabled. + +Change the comparison accordingly. + +I'm guessing this never really mattered because a reset to +not having a rate mask is basically equivalent to having a +mask that enables all rates. + +Reported-by: Colin Ian King +Fixes: 2ffbe6d33366 ("mac80211: fix and optimize MCS mask handling") +Fixes: b119ad6e726c ("mac80211: add rate mask logic for vht rates") +Reviewed-by: Colin Ian King +Link: https://lore.kernel.org/r/20210212112213.36b38078f569.I8546a20c80bc1669058eb453e213630b846e107b@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/cfg.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index fa293feef935..677928bf13d1 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -2906,14 +2906,14 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy, + continue; + + for (j = 0; j < IEEE80211_HT_MCS_MASK_LEN; j++) { +- if (~sdata->rc_rateidx_mcs_mask[i][j]) { ++ if (sdata->rc_rateidx_mcs_mask[i][j] != 0xff) { + sdata->rc_has_mcs_mask[i] = true; + break; + } + } + + for (j = 0; j < NL80211_VHT_NSS_MAX; j++) { +- if (~sdata->rc_rateidx_vht_mcs_mask[i][j]) { ++ if (sdata->rc_rateidx_vht_mcs_mask[i][j] != 0xffff) { + sdata->rc_has_vht_mcs_mask[i] = true; + break; + } +-- +2.30.1 + diff --git a/queue-5.4/macvlan-macvlan_count_rx-needs-to-be-aware-of-preemp.patch b/queue-5.4/macvlan-macvlan_count_rx-needs-to-be-aware-of-preemp.patch new file mode 100644 index 00000000000..6f9c9ac487e --- /dev/null +++ b/queue-5.4/macvlan-macvlan_count_rx-needs-to-be-aware-of-preemp.patch @@ -0,0 +1,89 @@ +From ace7a6a409f6c5c8fb8e8aa8fdbadd11a54dbc3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 01:56:36 -0800 +Subject: macvlan: macvlan_count_rx() needs to be aware of preemption + +From: Eric Dumazet + +[ Upstream commit dd4fa1dae9f4847cc1fd78ca468ad69e16e5db3e ] + +macvlan_count_rx() can be called from process context, it is thus +necessary to disable preemption before calling u64_stats_update_begin() + +syzbot was able to spot this on 32bit arch: + +WARNING: CPU: 1 PID: 4632 at include/linux/seqlock.h:271 __seqprop_assert include/linux/seqlock.h:271 [inline] +WARNING: CPU: 1 PID: 4632 at include/linux/seqlock.h:271 __seqprop_assert.constprop.0+0xf0/0x11c include/linux/seqlock.h:269 +Modules linked in: +Kernel panic - not syncing: panic_on_warn set ... +CPU: 1 PID: 4632 Comm: kworker/1:3 Not tainted 5.12.0-rc2-syzkaller #0 +Hardware name: ARM-Versatile Express +Workqueue: events macvlan_process_broadcast +Backtrace: +[<82740468>] (dump_backtrace) from [<827406dc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:252) + r7:00000080 r6:60000093 r5:00000000 r4:8422a3c4 +[<827406c4>] (show_stack) from [<82751b58>] (__dump_stack lib/dump_stack.c:79 [inline]) +[<827406c4>] (show_stack) from [<82751b58>] (dump_stack+0xb8/0xe8 lib/dump_stack.c:120) +[<82751aa0>] (dump_stack) from [<82741270>] (panic+0x130/0x378 kernel/panic.c:231) + r7:830209b4 r6:84069ea4 r5:00000000 r4:844350d0 +[<82741140>] (panic) from [<80244924>] (__warn+0xb0/0x164 kernel/panic.c:605) + r3:8404ec8c r2:00000000 r1:00000000 r0:830209b4 + r7:0000010f +[<80244874>] (__warn) from [<82741520>] (warn_slowpath_fmt+0x68/0xd4 kernel/panic.c:628) + r7:81363f70 r6:0000010f r5:83018e50 r4:00000000 +[<827414bc>] (warn_slowpath_fmt) from [<81363f70>] (__seqprop_assert include/linux/seqlock.h:271 [inline]) +[<827414bc>] (warn_slowpath_fmt) from [<81363f70>] (__seqprop_assert.constprop.0+0xf0/0x11c include/linux/seqlock.h:269) + r8:5a109000 r7:0000000f r6:a568dac0 r5:89802300 r4:00000001 +[<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (u64_stats_update_begin include/linux/u64_stats_sync.h:128 [inline]) +[<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (macvlan_count_rx include/linux/if_macvlan.h:47 [inline]) +[<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (macvlan_broadcast+0x154/0x26c drivers/net/macvlan.c:291) + r5:89802300 r4:8a927740 +[<8136499c>] (macvlan_broadcast) from [<81365020>] (macvlan_process_broadcast+0x258/0x2d0 drivers/net/macvlan.c:317) + r10:81364f78 r9:8a86d000 r8:8a9c7e7c r7:8413aa5c r6:00000000 r5:00000000 + r4:89802840 +[<81364dc8>] (macvlan_process_broadcast) from [<802696a4>] (process_one_work+0x2d4/0x998 kernel/workqueue.c:2275) + r10:00000008 r9:8404ec98 r8:84367a02 r7:ddfe6400 r6:ddfe2d40 r5:898dac80 + r4:8a86d43c +[<802693d0>] (process_one_work) from [<80269dcc>] (worker_thread+0x64/0x54c kernel/workqueue.c:2421) + r10:00000008 r9:8a9c6000 r8:84006d00 r7:ddfe2d78 r6:898dac94 r5:ddfe2d40 + r4:898dac80 +[<80269d68>] (worker_thread) from [<80271f40>] (kthread+0x184/0x1a4 kernel/kthread.c:292) + r10:85247e64 r9:898dac80 r8:80269d68 r7:00000000 r6:8a9c6000 r5:89a2ee40 + r4:8a97bd00 +[<80271dbc>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:158) +Exception stack(0x8a9c7fb0 to 0x8a9c7ff8) + +Fixes: 412ca1550cbe ("macvlan: Move broadcasts into a work queue") +Signed-off-by: Eric Dumazet +Cc: Herbert Xu +Reported-by: syzbot +Acked-by: Herbert Xu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/linux/if_macvlan.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/linux/if_macvlan.h b/include/linux/if_macvlan.h +index a367ead4bf4b..e11555989090 100644 +--- a/include/linux/if_macvlan.h ++++ b/include/linux/if_macvlan.h +@@ -42,13 +42,14 @@ static inline void macvlan_count_rx(const struct macvlan_dev *vlan, + if (likely(success)) { + struct vlan_pcpu_stats *pcpu_stats; + +- pcpu_stats = this_cpu_ptr(vlan->pcpu_stats); ++ pcpu_stats = get_cpu_ptr(vlan->pcpu_stats); + u64_stats_update_begin(&pcpu_stats->syncp); + pcpu_stats->rx_packets++; + pcpu_stats->rx_bytes += len; + if (multicast) + pcpu_stats->rx_multicast++; + u64_stats_update_end(&pcpu_stats->syncp); ++ put_cpu_ptr(vlan->pcpu_stats); + } else { + this_cpu_inc(vlan->pcpu_stats->rx_errors); + } +-- +2.30.1 + diff --git a/queue-5.4/net-cdc-phonet-fix-data-interface-release-on-probe-f.patch b/queue-5.4/net-cdc-phonet-fix-data-interface-release-on-probe-f.patch new file mode 100644 index 00000000000..c2f4d4efee9 --- /dev/null +++ b/queue-5.4/net-cdc-phonet-fix-data-interface-release-on-probe-f.patch @@ -0,0 +1,37 @@ +From 33d720ea6850b07ea73cfb4c6a44c3728a6be7d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Mar 2021 16:57:49 +0100 +Subject: net: cdc-phonet: fix data-interface release on probe failure + +From: Johan Hovold + +[ Upstream commit c79a707072fe3fea0e3c92edee6ca85c1e53c29f ] + +Set the disconnected flag before releasing the data interface in case +netdev registration fails to avoid having the disconnect callback try to +deregister the never registered netdev (and trigger a WARN_ON()). + +Fixes: 87cf65601e17 ("USB host CDC Phonet network interface driver") +Signed-off-by: Johan Hovold +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/cdc-phonet.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/usb/cdc-phonet.c b/drivers/net/usb/cdc-phonet.c +index bcabd39d136a..f778172356e6 100644 +--- a/drivers/net/usb/cdc-phonet.c ++++ b/drivers/net/usb/cdc-phonet.c +@@ -387,6 +387,8 @@ static int usbpn_probe(struct usb_interface *intf, const struct usb_device_id *i + + err = register_netdev(dev); + if (err) { ++ /* Set disconnected flag so that disconnect() returns early. */ ++ pnd->disconnected = 1; + usb_driver_release_interface(&usbpn_driver, data_intf); + goto out; + } +-- +2.30.1 + diff --git a/queue-5.4/net-dsa-bcm_sf2-qualify-phydev-dev_flags-based-on-po.patch b/queue-5.4/net-dsa-bcm_sf2-qualify-phydev-dev_flags-based-on-po.patch new file mode 100644 index 00000000000..2534fe7d07f --- /dev/null +++ b/queue-5.4/net-dsa-bcm_sf2-qualify-phydev-dev_flags-based-on-po.patch @@ -0,0 +1,43 @@ +From cf9c783fd8fe8eddb181e4a3eaa30296951d3ac7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 14:17:58 -0800 +Subject: net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port + +From: Florian Fainelli + +[ Upstream commit 47142ed6c34d544ae9f0463e58d482289cbe0d46 ] + +Similar to commit 92696286f3bb37ba50e4bd8d1beb24afb759a799 ("net: +bcmgenet: Set phydev->dev_flags only for internal PHYs") we need to +qualify the phydev->dev_flags based on whether the port is connected to +an internal or external PHY otherwise we risk having a flags collision +with a completely different interpretation depending on the driver. + +Fixes: aa9aef77c761 ("net: dsa: bcm_sf2: communicate integrated PHY revision to PHY driver") +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/bcm_sf2.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c +index ca425c15953b..0ee1c0a7b165 100644 +--- a/drivers/net/dsa/bcm_sf2.c ++++ b/drivers/net/dsa/bcm_sf2.c +@@ -479,8 +479,10 @@ static u32 bcm_sf2_sw_get_phy_flags(struct dsa_switch *ds, int port) + * in bits 15:8 and the patch level in bits 7:0 which is exactly what + * the REG_PHY_REVISION register layout is. + */ +- +- return priv->hw_params.gphy_rev; ++ if (priv->int_phy_mask & BIT(port)) ++ return priv->hw_params.gphy_rev; ++ else ++ return 0; + } + + static void bcm_sf2_sw_validate(struct dsa_switch *ds, int port, +-- +2.30.1 + diff --git a/queue-5.4/net-mlx5e-don-t-match-on-geneve-options-in-case-opti.patch b/queue-5.4/net-mlx5e-don-t-match-on-geneve-options-in-case-opti.patch new file mode 100644 index 00000000000..b9d540a1602 --- /dev/null +++ b/queue-5.4/net-mlx5e-don-t-match-on-geneve-options-in-case-opti.patch @@ -0,0 +1,46 @@ +From b9db375851244cf3c3e1925e5ebe8dec4f0f23a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Feb 2021 13:39:18 +0200 +Subject: net/mlx5e: Don't match on Geneve options in case option masks are all + zero + +From: Maor Dickman + +[ Upstream commit 385d40b042e60aa0b677d7b400a0fefb44bcbaf4 ] + +The cited change added offload support for Geneve options without verifying +the validity of the options masks, this caused offload of rules with match +on Geneve options with class,type and data masks which are zero to fail. + +Fix by ignoring the match on Geneve options in case option masks are +all zero. + +Fixes: 9272e3df3023 ("net/mlx5e: Geneve, Add support for encap/decap flows offload") +Signed-off-by: Maor Dickman +Reviewed-by: Roi Dayan +Reviewed-by: Oz Shlomo +Reviewed-by: Yevgeny Kliteynik +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c +index 951ea26d96bc..6d27f69cc7fc 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c +@@ -227,6 +227,10 @@ static int mlx5e_tc_tun_parse_geneve_options(struct mlx5e_priv *priv, + option_key = (struct geneve_opt *)&enc_opts.key->data[0]; + option_mask = (struct geneve_opt *)&enc_opts.mask->data[0]; + ++ if (option_mask->opt_class == 0 && option_mask->type == 0 && ++ !memchr_inv(option_mask->opt_data, 0, option_mask->length * 4)) ++ return 0; ++ + if (option_key->length > max_tlv_option_data_len) { + NL_SET_ERR_MSG_MOD(extack, + "Matching on GENEVE options: unsupported option len"); +-- +2.30.1 + diff --git a/queue-5.4/net-mlx5e-fix-error-path-for-ethtool-set-priv-flag.patch b/queue-5.4/net-mlx5e-fix-error-path-for-ethtool-set-priv-flag.patch new file mode 100644 index 00000000000..1a4c469c76f --- /dev/null +++ b/queue-5.4/net-mlx5e-fix-error-path-for-ethtool-set-priv-flag.patch @@ -0,0 +1,48 @@ +From 5fc82e11e119a7d317e2842ffc75e040731377a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Mar 2021 17:46:35 +0200 +Subject: net/mlx5e: Fix error path for ethtool set-priv-flag + +From: Aya Levin + +[ Upstream commit 4eacfe72e3e037e3fc019113df32c39a705148c2 ] + +Expose error value when failing to comply to command: +$ ethtool --set-priv-flags eth2 rx_cqe_compress [on/off] + +Fixes: be7e87f92b58 ("net/mlx5e: Fail safe cqe compressing/moderation mode setting") +Signed-off-by: Aya Levin +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +index 01089c2283d7..e09b4a96a1d5 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +@@ -1811,6 +1811,7 @@ static int set_pflag_rx_cqe_compress(struct net_device *netdev, + { + struct mlx5e_priv *priv = netdev_priv(netdev); + struct mlx5_core_dev *mdev = priv->mdev; ++ int err; + + if (!MLX5_CAP_GEN(mdev, cqe_compression)) + return -EOPNOTSUPP; +@@ -1820,7 +1821,10 @@ static int set_pflag_rx_cqe_compress(struct net_device *netdev, + return -EINVAL; + } + +- mlx5e_modify_rx_cqe_compression_locked(priv, enable); ++ err = mlx5e_modify_rx_cqe_compression_locked(priv, enable); ++ if (err) ++ return err; ++ + priv->channels.params.rx_cqe_compress_def = enable; + + return 0; +-- +2.30.1 + diff --git a/queue-5.4/net-qlcnic-fix-a-use-after-free-in-qlcnic_83xx_get_m.patch b/queue-5.4/net-qlcnic-fix-a-use-after-free-in-qlcnic_83xx_get_m.patch new file mode 100644 index 00000000000..b0b35e521c2 --- /dev/null +++ b/queue-5.4/net-qlcnic-fix-a-use-after-free-in-qlcnic_83xx_get_m.patch @@ -0,0 +1,44 @@ +From 5b2ea4c5b1f9f2f99b1f1bc618f1c59ec64d8eea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 20:01:40 -0800 +Subject: net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template + +From: Lv Yunlong + +[ Upstream commit db74623a3850db99cb9692fda9e836a56b74198d ] + +In qlcnic_83xx_get_minidump_template, fw_dump->tmpl_hdr was freed by +vfree(). But unfortunately, it is used when extended is true. + +Fixes: 7061b2bdd620e ("qlogic: Deletion of unnecessary checks before two function calls") +Signed-off-by: Lv Yunlong +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c +index f34ae8c75bc5..61a39d167c8b 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c +@@ -1426,6 +1426,7 @@ void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter) + + if (fw_dump->tmpl_hdr == NULL || current_version > prev_version) { + vfree(fw_dump->tmpl_hdr); ++ fw_dump->tmpl_hdr = NULL; + + if (qlcnic_83xx_md_check_extended_dump_capability(adapter)) + extended = !qlcnic_83xx_extend_md_capab(adapter); +@@ -1444,6 +1445,8 @@ void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter) + struct qlcnic_83xx_dump_template_hdr *hdr; + + hdr = fw_dump->tmpl_hdr; ++ if (!hdr) ++ return; + hdr->drv_cap_mask = 0x1f; + fw_dump->cap_mask = 0x1f; + dev_info(&pdev->dev, +-- +2.30.1 + diff --git a/queue-5.4/net-sched-validate-stab-values.patch b/queue-5.4/net-sched-validate-stab-values.patch new file mode 100644 index 00000000000..e9143029cd4 --- /dev/null +++ b/queue-5.4/net-sched-validate-stab-values.patch @@ -0,0 +1,191 @@ +From 04566660492161f561456008f411b0c1a3e2d656 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 08:26:41 -0800 +Subject: net: sched: validate stab values + +From: Eric Dumazet + +[ Upstream commit e323d865b36134e8c5c82c834df89109a5c60dab ] + +iproute2 package is well behaved, but malicious user space can +provide illegal shift values and trigger UBSAN reports. + +Add stab parameter to red_check_params() to validate user input. + +syzbot reported: + +UBSAN: shift-out-of-bounds in ./include/net/red.h:312:18 +shift exponent 111 is too large for 64-bit type 'long unsigned int' +CPU: 1 PID: 14662 Comm: syz-executor.3 Not tainted 5.12.0-rc2-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +Call Trace: + __dump_stack lib/dump_stack.c:79 [inline] + dump_stack+0x141/0x1d7 lib/dump_stack.c:120 + ubsan_epilogue+0xb/0x5a lib/ubsan.c:148 + __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327 + red_calc_qavg_from_idle_time include/net/red.h:312 [inline] + red_calc_qavg include/net/red.h:353 [inline] + choke_enqueue.cold+0x18/0x3dd net/sched/sch_choke.c:221 + __dev_xmit_skb net/core/dev.c:3837 [inline] + __dev_queue_xmit+0x1943/0x2e00 net/core/dev.c:4150 + neigh_hh_output include/net/neighbour.h:499 [inline] + neigh_output include/net/neighbour.h:508 [inline] + ip6_finish_output2+0x911/0x1700 net/ipv6/ip6_output.c:117 + __ip6_finish_output net/ipv6/ip6_output.c:182 [inline] + __ip6_finish_output+0x4c1/0xe10 net/ipv6/ip6_output.c:161 + ip6_finish_output+0x35/0x200 net/ipv6/ip6_output.c:192 + NF_HOOK_COND include/linux/netfilter.h:290 [inline] + ip6_output+0x1e4/0x530 net/ipv6/ip6_output.c:215 + dst_output include/net/dst.h:448 [inline] + NF_HOOK include/linux/netfilter.h:301 [inline] + NF_HOOK include/linux/netfilter.h:295 [inline] + ip6_xmit+0x127e/0x1eb0 net/ipv6/ip6_output.c:320 + inet6_csk_xmit+0x358/0x630 net/ipv6/inet6_connection_sock.c:135 + dccp_transmit_skb+0x973/0x12c0 net/dccp/output.c:138 + dccp_send_reset+0x21b/0x2b0 net/dccp/output.c:535 + dccp_finish_passive_close net/dccp/proto.c:123 [inline] + dccp_finish_passive_close+0xed/0x140 net/dccp/proto.c:118 + dccp_terminate_connection net/dccp/proto.c:958 [inline] + dccp_close+0xb3c/0xe60 net/dccp/proto.c:1028 + inet_release+0x12e/0x280 net/ipv4/af_inet.c:431 + inet6_release+0x4c/0x70 net/ipv6/af_inet6.c:478 + __sock_release+0xcd/0x280 net/socket.c:599 + sock_close+0x18/0x20 net/socket.c:1258 + __fput+0x288/0x920 fs/file_table.c:280 + task_work_run+0xdd/0x1a0 kernel/task_work.c:140 + tracehook_notify_resume include/linux/tracehook.h:189 [inline] + +Fixes: 8afa10cbe281 ("net_sched: red: Avoid illegal values") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/red.h | 10 +++++++++- + net/sched/sch_choke.c | 7 ++++--- + net/sched/sch_gred.c | 2 +- + net/sched/sch_red.c | 7 +++++-- + net/sched/sch_sfq.c | 2 +- + 5 files changed, 20 insertions(+), 8 deletions(-) + +diff --git a/include/net/red.h b/include/net/red.h +index e21e7fd4fe07..8fe55b8b2fb8 100644 +--- a/include/net/red.h ++++ b/include/net/red.h +@@ -168,7 +168,8 @@ static inline void red_set_vars(struct red_vars *v) + v->qcount = -1; + } + +-static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, u8 Scell_log) ++static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, ++ u8 Scell_log, u8 *stab) + { + if (fls(qth_min) + Wlog > 32) + return false; +@@ -178,6 +179,13 @@ static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, u8 Scell_ + return false; + if (qth_max < qth_min) + return false; ++ if (stab) { ++ int i; ++ ++ for (i = 0; i < RED_STAB_SIZE; i++) ++ if (stab[i] >= 32) ++ return false; ++ } + return true; + } + +diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c +index d856b395ee8e..e54f6eabfa0c 100644 +--- a/net/sched/sch_choke.c ++++ b/net/sched/sch_choke.c +@@ -351,6 +351,7 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt, + struct sk_buff **old = NULL; + unsigned int mask; + u32 max_P; ++ u8 *stab; + + if (opt == NULL) + return -EINVAL; +@@ -367,8 +368,8 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt, + max_P = tb[TCA_CHOKE_MAX_P] ? nla_get_u32(tb[TCA_CHOKE_MAX_P]) : 0; + + ctl = nla_data(tb[TCA_CHOKE_PARMS]); +- +- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) ++ stab = nla_data(tb[TCA_CHOKE_STAB]); ++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log, stab)) + return -EINVAL; + + if (ctl->limit > CHOKE_MAX_QUEUE) +@@ -418,7 +419,7 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt, + + red_set_parms(&q->parms, ctl->qth_min, ctl->qth_max, ctl->Wlog, + ctl->Plog, ctl->Scell_log, +- nla_data(tb[TCA_CHOKE_STAB]), ++ stab, + max_P); + red_set_vars(&q->vars); + +diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c +index e0bc77533acc..f4132dc25ac0 100644 +--- a/net/sched/sch_gred.c ++++ b/net/sched/sch_gred.c +@@ -480,7 +480,7 @@ static inline int gred_change_vq(struct Qdisc *sch, int dp, + struct gred_sched *table = qdisc_priv(sch); + struct gred_sched_data *q = table->tab[dp]; + +- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) { ++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log, stab)) { + NL_SET_ERR_MSG_MOD(extack, "invalid RED parameters"); + return -EINVAL; + } +diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c +index 71e167e91a48..7741f102be4a 100644 +--- a/net/sched/sch_red.c ++++ b/net/sched/sch_red.c +@@ -197,6 +197,7 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt, + struct tc_red_qopt *ctl; + int err; + u32 max_P; ++ u8 *stab; + + if (opt == NULL) + return -EINVAL; +@@ -213,7 +214,9 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt, + max_P = tb[TCA_RED_MAX_P] ? nla_get_u32(tb[TCA_RED_MAX_P]) : 0; + + ctl = nla_data(tb[TCA_RED_PARMS]); +- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) ++ stab = nla_data(tb[TCA_RED_STAB]); ++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ++ ctl->Scell_log, stab)) + return -EINVAL; + + if (ctl->limit > 0) { +@@ -238,7 +241,7 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt, + red_set_parms(&q->parms, + ctl->qth_min, ctl->qth_max, ctl->Wlog, + ctl->Plog, ctl->Scell_log, +- nla_data(tb[TCA_RED_STAB]), ++ stab, + max_P); + red_set_vars(&q->vars); + +diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c +index 6e13e137883c..b92bafaf83f3 100644 +--- a/net/sched/sch_sfq.c ++++ b/net/sched/sch_sfq.c +@@ -647,7 +647,7 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt) + } + + if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max, +- ctl_v1->Wlog, ctl_v1->Scell_log)) ++ ctl_v1->Wlog, ctl_v1->Scell_log, NULL)) + return -EINVAL; + if (ctl_v1 && ctl_v1->qth_min) { + p = kmalloc(sizeof(*p), GFP_KERNEL); +-- +2.30.1 + diff --git a/queue-5.4/net-stmmac-dwmac-sun8i-provide-tx-and-rx-fifo-sizes.patch b/queue-5.4/net-stmmac-dwmac-sun8i-provide-tx-and-rx-fifo-sizes.patch new file mode 100644 index 00000000000..7c7c2508957 --- /dev/null +++ b/queue-5.4/net-stmmac-dwmac-sun8i-provide-tx-and-rx-fifo-sizes.patch @@ -0,0 +1,47 @@ +From 268de2637e654fe642a7e619f7d1108f1026bf12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 13:44:22 +0000 +Subject: net: stmmac: dwmac-sun8i: Provide TX and RX fifo sizes + +From: Corentin Labbe + +[ Upstream commit 014dfa26ce1c647af09bf506285ef67e0e3f0a6b ] + +MTU cannot be changed on dwmac-sun8i. (ip link set eth0 mtu xxx returning EINVAL) +This is due to tx_fifo_size being 0, since this value is used to compute valid +MTU range. +Like dwmac-sunxi (with commit 806fd188ce2a ("net: stmmac: dwmac-sunxi: Provide TX and RX fifo sizes")) +dwmac-sun8i need to have tx and rx fifo sizes set. +I have used values from datasheets. +After this patch, setting a non-default MTU (like 1000) value works and network is still useable. + +Tested-on: sun8i-h3-orangepi-pc +Tested-on: sun8i-r40-bananapi-m2-ultra +Tested-on: sun50i-a64-bananapi-m64 +Tested-on: sun50i-h5-nanopi-neo-plus2 +Tested-on: sun50i-h6-pine-h64 +Fixes: 9f93ac8d408 ("net-next: stmmac: Add dwmac-sun8i") +Reported-by: Belisko Marek +Signed-off-by: Corentin Labbe +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c +index c4c9cbdeb601..2f6258ca9515 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c +@@ -1206,6 +1206,8 @@ static int sun8i_dwmac_probe(struct platform_device *pdev) + plat_dat->init = sun8i_dwmac_init; + plat_dat->exit = sun8i_dwmac_exit; + plat_dat->setup = sun8i_dwmac_setup; ++ plat_dat->tx_fifo_size = 4096; ++ plat_dat->rx_fifo_size = 16384; + + ret = sun8i_dwmac_init(pdev, plat_dat->bsp_priv); + if (ret) +-- +2.30.1 + diff --git a/queue-5.4/netfilter-ctnetlink-fix-dump-of-the-expect-mask-attr.patch b/queue-5.4/netfilter-ctnetlink-fix-dump-of-the-expect-mask-attr.patch new file mode 100644 index 00000000000..a8fde8d2acc --- /dev/null +++ b/queue-5.4/netfilter-ctnetlink-fix-dump-of-the-expect-mask-attr.patch @@ -0,0 +1,41 @@ +From 85e9b7db9824d5fc307ef470437d535c7a4bc834 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Mar 2021 11:31:09 +0100 +Subject: netfilter: ctnetlink: fix dump of the expect mask attribute + +From: Florian Westphal + +[ Upstream commit b58f33d49e426dc66e98ed73afb5d97b15a25f2d ] + +Before this change, the mask is never included in the netlink message, so +"conntrack -E expect" always prints 0.0.0.0. + +In older kernels the l3num callback struct was passed as argument, based +on tuple->src.l3num. After the l3num indirection got removed, the call +chain is based on m.src.l3num, but this value is 0xffff. + +Init l3num to the correct value. + +Fixes: f957be9d349a3 ("netfilter: conntrack: remove ctnetlink callbacks from l3 protocol trackers") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_netlink.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index b7f0d52e5f1b..783af451a832 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -2680,6 +2680,7 @@ static int ctnetlink_exp_dump_mask(struct sk_buff *skb, + memset(&m, 0xFF, sizeof(m)); + memcpy(&m.src.u3, &mask->src.u3, sizeof(m.src.u3)); + m.src.u.all = mask->src.u.all; ++ m.src.l3num = tuple->src.l3num; + m.dst.protonum = tuple->dst.protonum; + + nest_parms = nla_nest_start(skb, CTA_EXPECT_MASK); +-- +2.30.1 + diff --git a/queue-5.4/netfilter-x_tables-use-correct-memory-barriers.patch b/queue-5.4/netfilter-x_tables-use-correct-memory-barriers.patch new file mode 100644 index 00000000000..b3bdc18a63d --- /dev/null +++ b/queue-5.4/netfilter-x_tables-use-correct-memory-barriers.patch @@ -0,0 +1,63 @@ +From 66e90b984e6aff1e9839341804084d5ec8d38331 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 14:24:13 +1300 +Subject: netfilter: x_tables: Use correct memory barriers. + +From: Mark Tomlinson + +[ Upstream commit 175e476b8cdf2a4de7432583b49c871345e4f8a1 ] + +When a new table value was assigned, it was followed by a write memory +barrier. This ensured that all writes before this point would complete +before any writes after this point. However, to determine whether the +rules are unused, the sequence counter is read. To ensure that all +writes have been done before these reads, a full memory barrier is +needed, not just a write memory barrier. The same argument applies when +incrementing the counter, before the rules are read. + +Changing to using smp_mb() instead of smp_wmb() fixes the kernel panic +reported in cc00bcaa5899 (which is still present), while still +maintaining the same speed of replacing tables. + +The smb_mb() barriers potentially slow the packet path, however testing +has shown no measurable change in performance on a 4-core MIPS64 +platform. + +Fixes: 7f5c6d4f665b ("netfilter: get rid of atomic ops in fast path") +Signed-off-by: Mark Tomlinson +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/linux/netfilter/x_tables.h | 2 +- + net/netfilter/x_tables.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h +index 1b261c51b3a3..04e7f5630509 100644 +--- a/include/linux/netfilter/x_tables.h ++++ b/include/linux/netfilter/x_tables.h +@@ -376,7 +376,7 @@ static inline unsigned int xt_write_recseq_begin(void) + * since addend is most likely 1 + */ + __this_cpu_add(xt_recseq.sequence, addend); +- smp_wmb(); ++ smp_mb(); + + return addend; + } +diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c +index ef6d51a3798b..5c35d64d1f34 100644 +--- a/net/netfilter/x_tables.c ++++ b/net/netfilter/x_tables.c +@@ -1389,7 +1389,7 @@ xt_replace_table(struct xt_table *table, + table->private = newinfo; + + /* make sure all cpus see new ->private value */ +- smp_wmb(); ++ smp_mb(); + + /* + * Even though table entries have now been swapped, other CPU's +-- +2.30.1 + diff --git a/queue-5.4/nfp-flower-fix-pre_tun-mask-id-allocation.patch b/queue-5.4/nfp-flower-fix-pre_tun-mask-id-allocation.patch new file mode 100644 index 00000000000..9aae9416b0e --- /dev/null +++ b/queue-5.4/nfp-flower-fix-pre_tun-mask-id-allocation.patch @@ -0,0 +1,85 @@ +From d025fe8c02678f2afff2ba1472c3a5e0e614191f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Mar 2021 19:13:10 +0100 +Subject: nfp: flower: fix pre_tun mask id allocation + +From: Louis Peens + +[ Upstream commit d8ce0275e45ec809a33f98fc080fe7921b720dfb ] + +pre_tun_rule flows does not follow the usual add-flow path, instead +they are used to update the pre_tun table on the firmware. This means +that if the mask-id gets allocated here the firmware will never see the +"NFP_FL_META_FLAG_MANAGE_MASK" flag for the specific mask id, which +triggers the allocation on the firmware side. This leads to the firmware +mask being corrupted and causing all sorts of strange behaviour. + +Fixes: f12725d98cbe ("nfp: flower: offload pre-tunnel rules") +Signed-off-by: Louis Peens +Signed-off-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../ethernet/netronome/nfp/flower/metadata.c | 24 +++++++++++++------ + 1 file changed, 17 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/netronome/nfp/flower/metadata.c b/drivers/net/ethernet/netronome/nfp/flower/metadata.c +index 5defd31d481c..aa06fcb38f8b 100644 +--- a/drivers/net/ethernet/netronome/nfp/flower/metadata.c ++++ b/drivers/net/ethernet/netronome/nfp/flower/metadata.c +@@ -327,8 +327,14 @@ int nfp_compile_flow_metadata(struct nfp_app *app, + goto err_free_ctx_entry; + } + ++ /* Do net allocate a mask-id for pre_tun_rules. These flows are used to ++ * configure the pre_tun table and are never actually send to the ++ * firmware as an add-flow message. This causes the mask-id allocation ++ * on the firmware to get out of sync if allocated here. ++ */ + new_mask_id = 0; +- if (!nfp_check_mask_add(app, nfp_flow->mask_data, ++ if (!nfp_flow->pre_tun_rule.dev && ++ !nfp_check_mask_add(app, nfp_flow->mask_data, + nfp_flow->meta.mask_len, + &nfp_flow->meta.flags, &new_mask_id)) { + NL_SET_ERR_MSG_MOD(extack, "invalid entry: cannot allocate a new mask id"); +@@ -359,7 +365,8 @@ int nfp_compile_flow_metadata(struct nfp_app *app, + goto err_remove_mask; + } + +- if (!nfp_check_mask_remove(app, nfp_flow->mask_data, ++ if (!nfp_flow->pre_tun_rule.dev && ++ !nfp_check_mask_remove(app, nfp_flow->mask_data, + nfp_flow->meta.mask_len, + NULL, &new_mask_id)) { + NL_SET_ERR_MSG_MOD(extack, "invalid entry: cannot release mask id"); +@@ -374,8 +381,10 @@ int nfp_compile_flow_metadata(struct nfp_app *app, + return 0; + + err_remove_mask: +- nfp_check_mask_remove(app, nfp_flow->mask_data, nfp_flow->meta.mask_len, +- NULL, &new_mask_id); ++ if (!nfp_flow->pre_tun_rule.dev) ++ nfp_check_mask_remove(app, nfp_flow->mask_data, ++ nfp_flow->meta.mask_len, ++ NULL, &new_mask_id); + err_remove_rhash: + WARN_ON_ONCE(rhashtable_remove_fast(&priv->stats_ctx_table, + &ctx_entry->ht_node, +@@ -406,9 +415,10 @@ int nfp_modify_flow_metadata(struct nfp_app *app, + + __nfp_modify_flow_metadata(priv, nfp_flow); + +- nfp_check_mask_remove(app, nfp_flow->mask_data, +- nfp_flow->meta.mask_len, &nfp_flow->meta.flags, +- &new_mask_id); ++ if (!nfp_flow->pre_tun_rule.dev) ++ nfp_check_mask_remove(app, nfp_flow->mask_data, ++ nfp_flow->meta.mask_len, &nfp_flow->meta.flags, ++ &new_mask_id); + + /* Update flow payload with mask ids. */ + nfp_flow->unmasked_data[NFP_FL_MASK_ID_LOCATION] = new_mask_id; +-- +2.30.1 + diff --git a/queue-5.4/octeontx2-af-fix-infinite-loop-in-unmapping-npc-coun.patch b/queue-5.4/octeontx2-af-fix-infinite-loop-in-unmapping-npc-coun.patch new file mode 100644 index 00000000000..a3ce23f99fc --- /dev/null +++ b/queue-5.4/octeontx2-af-fix-infinite-loop-in-unmapping-npc-coun.patch @@ -0,0 +1,47 @@ +From 09862ed309ef9688ba8e841c7cc858a48b98954e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Mar 2021 19:45:48 +0530 +Subject: octeontx2-af: fix infinite loop in unmapping NPC counter + +From: Hariprasad Kelam + +[ Upstream commit 64451b98306bf1334a62bcd020ec92bdb4cb68db ] + +unmapping npc counter works in a way by traversing all mcam +entries to find which mcam rule is associated with counter. +But loop cursor variable 'entry' is not incremented before +checking next mcam entry which resulting in infinite loop. + +This in turn hogs the kworker thread forever and no other +mbox message is processed by AF driver after that. +Fix this by updating entry value before checking next +mcam entry. + +Fixes: a958dd59f9ce ("octeontx2-af: Map or unmap NPC MCAM entry and counter") +Signed-off-by: Hariprasad Kelam +Signed-off-by: Sunil Kovvuri Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +index 15f70273e29c..d82a519a0cd9 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +@@ -1967,10 +1967,10 @@ int rvu_mbox_handler_npc_mcam_free_counter(struct rvu *rvu, + index = find_next_bit(mcam->bmap, mcam->bmap_entries, entry); + if (index >= mcam->bmap_entries) + break; ++ entry = index + 1; + if (mcam->entry2cntr_map[index] != req->cntr) + continue; + +- entry = index + 1; + npc_unmap_mcam_entry_and_cntr(rvu, mcam, blkaddr, + index, req->cntr); + } +-- +2.30.1 + diff --git a/queue-5.4/octeontx2-af-fix-irq-free-in-rvu-teardown.patch b/queue-5.4/octeontx2-af-fix-irq-free-in-rvu-teardown.patch new file mode 100644 index 00000000000..8241343c58c --- /dev/null +++ b/queue-5.4/octeontx2-af-fix-irq-free-in-rvu-teardown.patch @@ -0,0 +1,43 @@ +From bf70bffcec990f5bc3d909a6cbc866a89b640a5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Mar 2021 19:45:46 +0530 +Subject: octeontx2-af: Fix irq free in rvu teardown + +From: Geetha sowjanya + +[ Upstream commit ae2619dd4fccdad9876aa5f900bd85484179c50f ] + +Current devlink code try to free already freed irqs as the +irq_allocate flag is not cleared after free leading to kernel +crash while removing rvu driver. The patch fixes the irq free +sequence and clears the irq_allocate flag on free. + +Fixes: 7304ac4567bc ("octeontx2-af: Add mailbox IRQ and msg handlers") +Signed-off-by: Geetha sowjanya +Signed-off-by: Hariprasad Kelam +Signed-off-by: Sunil Kovvuri Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c +index e581091c09c4..02b4620f7368 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c +@@ -1980,8 +1980,10 @@ static void rvu_unregister_interrupts(struct rvu *rvu) + INTR_MASK(rvu->hw->total_pfs) & ~1ULL); + + for (irq = 0; irq < rvu->num_vec; irq++) { +- if (rvu->irq_allocated[irq]) ++ if (rvu->irq_allocated[irq]) { + free_irq(pci_irq_vector(rvu->pdev, irq), rvu); ++ rvu->irq_allocated[irq] = false; ++ } + } + + pci_free_irq_vectors(rvu->pdev); +-- +2.30.1 + diff --git a/queue-5.4/pm-em-postpone-creating-the-debugfs-dir-till-fs_init.patch b/queue-5.4/pm-em-postpone-creating-the-debugfs-dir-till-fs_init.patch new file mode 100644 index 00000000000..1aa7eb38b8a --- /dev/null +++ b/queue-5.4/pm-em-postpone-creating-the-debugfs-dir-till-fs_init.patch @@ -0,0 +1,52 @@ +From 4719a1e186a52bcfcfd6915b1144056ab3a4c8a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Mar 2021 14:56:08 +0000 +Subject: PM: EM: postpone creating the debugfs dir till fs_initcall + +From: Lukasz Luba + +[ Upstream commit fb9d62b27ab1e07d625591549c314b7d406d21df ] + +The debugfs directory '/sys/kernel/debug/energy_model' is needed before +the Energy Model registration can happen. With the recent change in +debugfs subsystem it's not allowed to create this directory at early +stage (core_initcall). Thus creating this directory would fail. + +Postpone the creation of the EM debug dir to later stage: fs_initcall. + +It should be safe since all clients: CPUFreq drivers, Devfreq drivers +will be initialized in later stages. + +The custom debug log below prints the time of creation the EM debug dir +at fs_initcall and successful registration of EMs at later stages. + +[ 1.505717] energy_model: creating rootdir +[ 3.698307] cpu cpu0: EM: created perf domain +[ 3.709022] cpu cpu1: EM: created perf domain + +Fixes: 56348560d495 ("debugfs: do not attempt to create a new file before the filesystem is initalized") +Reported-by: Ionela Voinescu +Signed-off-by: Lukasz Luba +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + kernel/power/energy_model.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/power/energy_model.c b/kernel/power/energy_model.c +index 0a9326f5f421..8dac32bd9089 100644 +--- a/kernel/power/energy_model.c ++++ b/kernel/power/energy_model.c +@@ -74,7 +74,7 @@ static int __init em_debug_init(void) + + return 0; + } +-core_initcall(em_debug_init); ++fs_initcall(em_debug_init); + #else /* CONFIG_DEBUG_FS */ + static void em_debug_create_pd(struct em_perf_domain *pd, int cpu) {} + #endif +-- +2.30.1 + diff --git a/queue-5.4/pm-runtime-defer-suspending-suppliers.patch b/queue-5.4/pm-runtime-defer-suspending-suppliers.patch new file mode 100644 index 00000000000..b69b6cc8d6a --- /dev/null +++ b/queue-5.4/pm-runtime-defer-suspending-suppliers.patch @@ -0,0 +1,131 @@ +From 06fd5a0493e6dbc131bd2009086cd6e6ded5f7aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 15:47:31 +0100 +Subject: PM: runtime: Defer suspending suppliers + +From: Rafael J. Wysocki + +[ Upstream commit 5244f5e2d801259af877ee759e8c22364c607072 ] + +Because the PM-runtime status of the device is not updated in +__rpm_callback(), attempts to suspend the suppliers of the given +device triggered by the rpm_put_suppliers() call in there may +cause a supplier to be suspended completely before the status of +the consumer is updated to RPM_SUSPENDED, which is confusing. + +To avoid that (1) modify __rpm_callback() to only decrease the +PM-runtime usage counter of each supplier and (2) make rpm_suspend() +try to suspend the suppliers after changing the consumer's status to +RPM_SUSPENDED, in analogy with the device's parent. + +Link: https://lore.kernel.org/linux-pm/CAPDyKFqm06KDw_p8WXsM4dijDbho4bb6T4k50UqqvR1_COsp8g@mail.gmail.com/ +Fixes: 21d5c57b3726 ("PM / runtime: Use device links") +Reported-by: elaine.zhang +Diagnosed-by: Ulf Hansson +Reviewed-by: Ulf Hansson +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/base/power/runtime.c | 45 +++++++++++++++++++++++++++++++----- + 1 file changed, 39 insertions(+), 6 deletions(-) + +diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c +index 137a7ba053d7..e0c4ef06ca91 100644 +--- a/drivers/base/power/runtime.c ++++ b/drivers/base/power/runtime.c +@@ -305,7 +305,7 @@ static int rpm_get_suppliers(struct device *dev) + return 0; + } + +-static void rpm_put_suppliers(struct device *dev) ++static void __rpm_put_suppliers(struct device *dev, bool try_to_suspend) + { + struct device_link *link; + +@@ -313,10 +313,30 @@ static void rpm_put_suppliers(struct device *dev) + device_links_read_lock_held()) { + + while (refcount_dec_not_one(&link->rpm_active)) +- pm_runtime_put(link->supplier); ++ pm_runtime_put_noidle(link->supplier); ++ ++ if (try_to_suspend) ++ pm_request_idle(link->supplier); + } + } + ++static void rpm_put_suppliers(struct device *dev) ++{ ++ __rpm_put_suppliers(dev, true); ++} ++ ++static void rpm_suspend_suppliers(struct device *dev) ++{ ++ struct device_link *link; ++ int idx = device_links_read_lock(); ++ ++ list_for_each_entry_rcu(link, &dev->links.suppliers, c_node, ++ device_links_read_lock_held()) ++ pm_request_idle(link->supplier); ++ ++ device_links_read_unlock(idx); ++} ++ + /** + * __rpm_callback - Run a given runtime PM callback for a given device. + * @cb: Runtime PM callback to run. +@@ -344,8 +364,10 @@ static int __rpm_callback(int (*cb)(struct device *), struct device *dev) + idx = device_links_read_lock(); + + retval = rpm_get_suppliers(dev); +- if (retval) ++ if (retval) { ++ rpm_put_suppliers(dev); + goto fail; ++ } + + device_links_read_unlock(idx); + } +@@ -368,9 +390,9 @@ static int __rpm_callback(int (*cb)(struct device *), struct device *dev) + || (dev->power.runtime_status == RPM_RESUMING && retval))) { + idx = device_links_read_lock(); + +- fail: +- rpm_put_suppliers(dev); ++ __rpm_put_suppliers(dev, false); + ++fail: + device_links_read_unlock(idx); + } + +@@ -644,8 +666,11 @@ static int rpm_suspend(struct device *dev, int rpmflags) + goto out; + } + ++ if (dev->power.irq_safe) ++ goto out; ++ + /* Maybe the parent is now able to suspend. */ +- if (parent && !parent->power.ignore_children && !dev->power.irq_safe) { ++ if (parent && !parent->power.ignore_children) { + spin_unlock(&dev->power.lock); + + spin_lock(&parent->power.lock); +@@ -654,6 +679,14 @@ static int rpm_suspend(struct device *dev, int rpmflags) + + spin_lock(&dev->power.lock); + } ++ /* Maybe the suppliers are now able to suspend. */ ++ if (dev->power.links_count > 0) { ++ spin_unlock_irq(&dev->power.lock); ++ ++ rpm_suspend_suppliers(dev); ++ ++ spin_lock_irq(&dev->power.lock); ++ } + + out: + trace_rpm_return_int_rcuidle(dev, _THIS_IP_, retval); +-- +2.30.1 + diff --git a/queue-5.4/r8152-limit-the-rx-buffer-size-of-rtl8153a-for-usb-2.patch b/queue-5.4/r8152-limit-the-rx-buffer-size-of-rtl8153a-for-usb-2.patch new file mode 100644 index 00000000000..4635dfe1044 --- /dev/null +++ b/queue-5.4/r8152-limit-the-rx-buffer-size-of-rtl8153a-for-usb-2.patch @@ -0,0 +1,50 @@ +From dcc4bf80a82a5b852b841e26db465692b0090651 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 15:37:21 +0800 +Subject: r8152: limit the RX buffer size of RTL8153A for USB 2.0 + +From: Hayes Wang + +[ Upstream commit f91a50d8b51b5c8ef1cfb08115a005bba4250507 ] + +If the USB host controller is EHCI, the throughput is reduced from +300Mb/s to 60Mb/s, when the rx buffer size is modified from 16K to +32K. + +According to the EHCI spec, the maximum size of the qTD is 20K. +Therefore, when the driver uses more than 20K buffer, the latency +time of EHCI would be increased. And, it let the RTL8153A get worse +throughput. + +However, the driver uses alloc_pages() for rx buffer, so I limit +the rx buffer to 16K rather than 20K. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=205923 +Fixes: ec5791c202ac ("r8152: separate the rx buffer size") +Reported-by: Robert Davies +Signed-off-by: Hayes Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 486cf511d2bf..f6d643ecaf39 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -5529,7 +5529,10 @@ static int rtl_ops_init(struct r8152 *tp) + ops->in_nway = rtl8153_in_nway; + ops->hw_phy_cfg = r8153_hw_phy_cfg; + ops->autosuspend_en = rtl8153_runtime_enable; +- tp->rx_buf_sz = 32 * 1024; ++ if (tp->udev->speed < USB_SPEED_SUPER) ++ tp->rx_buf_sz = 16 * 1024; ++ else ++ tp->rx_buf_sz = 32 * 1024; + tp->eee_en = true; + tp->eee_adv = MDIO_EEE_1000T | MDIO_EEE_100TX; + break; +-- +2.30.1 + diff --git a/queue-5.4/rdma-cxgb4-fix-adapter-le-hash-errors-while-destroyi.patch b/queue-5.4/rdma-cxgb4-fix-adapter-le-hash-errors-while-destroyi.patch new file mode 100644 index 00000000000..610a7936f9c --- /dev/null +++ b/queue-5.4/rdma-cxgb4-fix-adapter-le-hash-errors-while-destroyi.patch @@ -0,0 +1,48 @@ +From 31879d2147006ed05d2177ab94cb1a06345a4df4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 00:34:53 +0530 +Subject: RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 + listening server + +From: Potnuri Bharat Teja + +[ Upstream commit 3408be145a5d6418ff955fe5badde652be90e700 ] + +Not setting the ipv6 bit while destroying ipv6 listening servers may +result in potential fatal adapter errors due to lookup engine memory hash +errors. Therefore always set ipv6 field while destroying ipv6 listening +servers. + +Fixes: 830662f6f032 ("RDMA/cxgb4: Add support for active and passive open connection with IPv6 address") +Link: https://lore.kernel.org/r/20210324190453.8171-1-bharat@chelsio.com +Signed-off-by: Potnuri Bharat Teja +Reviewed-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/cxgb4/cm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c +index 30e08bcc9afb..3c78f8c32d12 100644 +--- a/drivers/infiniband/hw/cxgb4/cm.c ++++ b/drivers/infiniband/hw/cxgb4/cm.c +@@ -3610,13 +3610,13 @@ int c4iw_destroy_listen(struct iw_cm_id *cm_id) + ep->com.local_addr.ss_family == AF_INET) { + err = cxgb4_remove_server_filter( + ep->com.dev->rdev.lldi.ports[0], ep->stid, +- ep->com.dev->rdev.lldi.rxq_ids[0], 0); ++ ep->com.dev->rdev.lldi.rxq_ids[0], false); + } else { + struct sockaddr_in6 *sin6; + c4iw_init_wr_wait(ep->com.wr_waitp); + err = cxgb4_remove_server( + ep->com.dev->rdev.lldi.ports[0], ep->stid, +- ep->com.dev->rdev.lldi.rxq_ids[0], 0); ++ ep->com.dev->rdev.lldi.rxq_ids[0], true); + if (err) + goto done; + err = c4iw_wait_for_reply(&ep->com.dev->rdev, ep->com.wr_waitp, +-- +2.30.1 + diff --git a/queue-5.4/revert-netfilter-x_tables-switch-synchronization-to-.patch b/queue-5.4/revert-netfilter-x_tables-switch-synchronization-to-.patch new file mode 100644 index 00000000000..ba15ca365fd --- /dev/null +++ b/queue-5.4/revert-netfilter-x_tables-switch-synchronization-to-.patch @@ -0,0 +1,363 @@ +From b5e7dd081fbf80e812ff336c73c9d473ffe8038b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 14:24:12 +1300 +Subject: Revert "netfilter: x_tables: Switch synchronization to RCU" + +From: Mark Tomlinson + +[ Upstream commit d3d40f237480abf3268956daf18cdc56edd32834 ] + +This reverts commit cc00bcaa589914096edef7fb87ca5cee4a166b5c. + +This (and the preceding) patch basically re-implemented the RCU +mechanisms of patch 784544739a25. That patch was replaced because of the +performance problems that it created when replacing tables. Now, we have +the same issue: the call to synchronize_rcu() makes replacing tables +slower by as much as an order of magnitude. + +Prior to using RCU a script calling "iptables" approx. 200 times was +taking 1.16s. With RCU this increased to 11.59s. + +Revert these patches and fix the issue in a different way. + +Signed-off-by: Mark Tomlinson +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/linux/netfilter/x_tables.h | 5 +-- + net/ipv4/netfilter/arp_tables.c | 14 ++++----- + net/ipv4/netfilter/ip_tables.c | 14 ++++----- + net/ipv6/netfilter/ip6_tables.c | 14 ++++----- + net/netfilter/x_tables.c | 49 +++++++++++++++++++++--------- + 5 files changed, 56 insertions(+), 40 deletions(-) + +diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h +index f5c21b7d2974..1b261c51b3a3 100644 +--- a/include/linux/netfilter/x_tables.h ++++ b/include/linux/netfilter/x_tables.h +@@ -227,7 +227,7 @@ struct xt_table { + unsigned int valid_hooks; + + /* Man behind the curtain... */ +- struct xt_table_info __rcu *private; ++ struct xt_table_info *private; + + /* Set this to THIS_MODULE if you are a module, otherwise NULL */ + struct module *me; +@@ -448,9 +448,6 @@ xt_get_per_cpu_counter(struct xt_counters *cnt, unsigned int cpu) + + struct nf_hook_ops *xt_hook_ops_alloc(const struct xt_table *, nf_hookfn *); + +-struct xt_table_info +-*xt_table_get_private_protected(const struct xt_table *table); +- + #ifdef CONFIG_COMPAT + #include + +diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c +index 12d242fedffd..680a1320399d 100644 +--- a/net/ipv4/netfilter/arp_tables.c ++++ b/net/ipv4/netfilter/arp_tables.c +@@ -203,7 +203,7 @@ unsigned int arpt_do_table(struct sk_buff *skb, + + local_bh_disable(); + addend = xt_write_recseq_begin(); +- private = rcu_access_pointer(table->private); ++ private = READ_ONCE(table->private); /* Address dependency. */ + cpu = smp_processor_id(); + table_base = private->entries; + jumpstack = (struct arpt_entry **)private->jumpstack[cpu]; +@@ -649,7 +649,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table) + { + unsigned int countersize; + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + + /* We need atomic snapshot of counters: rest doesn't change + * (other than comefrom, which userspace doesn't care +@@ -673,7 +673,7 @@ static int copy_entries_to_user(unsigned int total_size, + unsigned int off, num; + const struct arpt_entry *e; + struct xt_counters *counters; +- struct xt_table_info *private = xt_table_get_private_protected(table); ++ struct xt_table_info *private = table->private; + int ret = 0; + void *loc_cpu_entry; + +@@ -808,7 +808,7 @@ static int get_info(struct net *net, void __user *user, + t = xt_request_find_table_lock(net, NFPROTO_ARP, name); + if (!IS_ERR(t)) { + struct arpt_getinfo info; +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + #ifdef CONFIG_COMPAT + struct xt_table_info tmp; + +@@ -861,7 +861,7 @@ static int get_entries(struct net *net, struct arpt_get_entries __user *uptr, + + t = xt_find_table_lock(net, NFPROTO_ARP, get.name); + if (!IS_ERR(t)) { +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + + if (get.size == private->size) + ret = copy_entries_to_user(private->size, +@@ -1020,7 +1020,7 @@ static int do_add_counters(struct net *net, const void __user *user, + } + + local_bh_disable(); +- private = xt_table_get_private_protected(t); ++ private = t->private; + if (private->number != tmp.num_counters) { + ret = -EINVAL; + goto unlock_up_free; +@@ -1357,7 +1357,7 @@ static int compat_copy_entries_to_user(unsigned int total_size, + void __user *userptr) + { + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + void __user *pos; + unsigned int size; + int ret = 0; +diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c +index cbbc8a7b8278..8c320b7a423c 100644 +--- a/net/ipv4/netfilter/ip_tables.c ++++ b/net/ipv4/netfilter/ip_tables.c +@@ -258,7 +258,7 @@ ipt_do_table(struct sk_buff *skb, + WARN_ON(!(table->valid_hooks & (1 << hook))); + local_bh_disable(); + addend = xt_write_recseq_begin(); +- private = rcu_access_pointer(table->private); ++ private = READ_ONCE(table->private); /* Address dependency. */ + cpu = smp_processor_id(); + table_base = private->entries; + jumpstack = (struct ipt_entry **)private->jumpstack[cpu]; +@@ -791,7 +791,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table) + { + unsigned int countersize; + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + + /* We need atomic snapshot of counters: rest doesn't change + (other than comefrom, which userspace doesn't care +@@ -815,7 +815,7 @@ copy_entries_to_user(unsigned int total_size, + unsigned int off, num; + const struct ipt_entry *e; + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + int ret = 0; + const void *loc_cpu_entry; + +@@ -965,7 +965,7 @@ static int get_info(struct net *net, void __user *user, + t = xt_request_find_table_lock(net, AF_INET, name); + if (!IS_ERR(t)) { + struct ipt_getinfo info; +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + #ifdef CONFIG_COMPAT + struct xt_table_info tmp; + +@@ -1019,7 +1019,7 @@ get_entries(struct net *net, struct ipt_get_entries __user *uptr, + + t = xt_find_table_lock(net, AF_INET, get.name); + if (!IS_ERR(t)) { +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + if (get.size == private->size) + ret = copy_entries_to_user(private->size, + t, uptr->entrytable); +@@ -1175,7 +1175,7 @@ do_add_counters(struct net *net, const void __user *user, + } + + local_bh_disable(); +- private = xt_table_get_private_protected(t); ++ private = t->private; + if (private->number != tmp.num_counters) { + ret = -EINVAL; + goto unlock_up_free; +@@ -1570,7 +1570,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table, + void __user *userptr) + { + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + void __user *pos; + unsigned int size; + int ret = 0; +diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c +index 01cdde25eb16..85d8ed970cdc 100644 +--- a/net/ipv6/netfilter/ip6_tables.c ++++ b/net/ipv6/netfilter/ip6_tables.c +@@ -280,7 +280,7 @@ ip6t_do_table(struct sk_buff *skb, + + local_bh_disable(); + addend = xt_write_recseq_begin(); +- private = rcu_access_pointer(table->private); ++ private = READ_ONCE(table->private); /* Address dependency. */ + cpu = smp_processor_id(); + table_base = private->entries; + jumpstack = (struct ip6t_entry **)private->jumpstack[cpu]; +@@ -807,7 +807,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table) + { + unsigned int countersize; + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + + /* We need atomic snapshot of counters: rest doesn't change + (other than comefrom, which userspace doesn't care +@@ -831,7 +831,7 @@ copy_entries_to_user(unsigned int total_size, + unsigned int off, num; + const struct ip6t_entry *e; + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + int ret = 0; + const void *loc_cpu_entry; + +@@ -981,7 +981,7 @@ static int get_info(struct net *net, void __user *user, + t = xt_request_find_table_lock(net, AF_INET6, name); + if (!IS_ERR(t)) { + struct ip6t_getinfo info; +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + #ifdef CONFIG_COMPAT + struct xt_table_info tmp; + +@@ -1036,7 +1036,7 @@ get_entries(struct net *net, struct ip6t_get_entries __user *uptr, + + t = xt_find_table_lock(net, AF_INET6, get.name); + if (!IS_ERR(t)) { +- struct xt_table_info *private = xt_table_get_private_protected(t); ++ struct xt_table_info *private = t->private; + if (get.size == private->size) + ret = copy_entries_to_user(private->size, + t, uptr->entrytable); +@@ -1191,7 +1191,7 @@ do_add_counters(struct net *net, const void __user *user, unsigned int len, + } + + local_bh_disable(); +- private = xt_table_get_private_protected(t); ++ private = t->private; + if (private->number != tmp.num_counters) { + ret = -EINVAL; + goto unlock_up_free; +@@ -1579,7 +1579,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table, + void __user *userptr) + { + struct xt_counters *counters; +- const struct xt_table_info *private = xt_table_get_private_protected(table); ++ const struct xt_table_info *private = table->private; + void __user *pos; + unsigned int size; + int ret = 0; +diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c +index 8b60fc04c67c..ef6d51a3798b 100644 +--- a/net/netfilter/x_tables.c ++++ b/net/netfilter/x_tables.c +@@ -1351,14 +1351,6 @@ struct xt_counters *xt_counters_alloc(unsigned int counters) + } + EXPORT_SYMBOL(xt_counters_alloc); + +-struct xt_table_info +-*xt_table_get_private_protected(const struct xt_table *table) +-{ +- return rcu_dereference_protected(table->private, +- mutex_is_locked(&xt[table->af].mutex)); +-} +-EXPORT_SYMBOL(xt_table_get_private_protected); +- + struct xt_table_info * + xt_replace_table(struct xt_table *table, + unsigned int num_counters, +@@ -1366,6 +1358,7 @@ xt_replace_table(struct xt_table *table, + int *error) + { + struct xt_table_info *private; ++ unsigned int cpu; + int ret; + + ret = xt_jumpstack_alloc(newinfo); +@@ -1375,20 +1368,47 @@ xt_replace_table(struct xt_table *table, + } + + /* Do the substitution. */ +- private = xt_table_get_private_protected(table); ++ local_bh_disable(); ++ private = table->private; + + /* Check inside lock: is the old number correct? */ + if (num_counters != private->number) { + pr_debug("num_counters != table->private->number (%u/%u)\n", + num_counters, private->number); ++ local_bh_enable(); + *error = -EAGAIN; + return NULL; + } + + newinfo->initial_entries = private->initial_entries; ++ /* ++ * Ensure contents of newinfo are visible before assigning to ++ * private. ++ */ ++ smp_wmb(); ++ table->private = newinfo; ++ ++ /* make sure all cpus see new ->private value */ ++ smp_wmb(); + +- rcu_assign_pointer(table->private, newinfo); +- synchronize_rcu(); ++ /* ++ * Even though table entries have now been swapped, other CPU's ++ * may still be using the old entries... ++ */ ++ local_bh_enable(); ++ ++ /* ... so wait for even xt_recseq on all cpus */ ++ for_each_possible_cpu(cpu) { ++ seqcount_t *s = &per_cpu(xt_recseq, cpu); ++ u32 seq = raw_read_seqcount(s); ++ ++ if (seq & 1) { ++ do { ++ cond_resched(); ++ cpu_relax(); ++ } while (seq == raw_read_seqcount(s)); ++ } ++ } + + #ifdef CONFIG_AUDIT + if (audit_enabled) { +@@ -1429,12 +1449,12 @@ struct xt_table *xt_register_table(struct net *net, + } + + /* Simplifies replace_table code. */ +- rcu_assign_pointer(table->private, bootstrap); ++ table->private = bootstrap; + + if (!xt_replace_table(table, 0, newinfo, &ret)) + goto unlock; + +- private = xt_table_get_private_protected(table); ++ private = table->private; + pr_debug("table->private->number = %u\n", private->number); + + /* save number of initial entries */ +@@ -1457,8 +1477,7 @@ void *xt_unregister_table(struct xt_table *table) + struct xt_table_info *private; + + mutex_lock(&xt[table->af].mutex); +- private = xt_table_get_private_protected(table); +- RCU_INIT_POINTER(table->private, NULL); ++ private = table->private; + list_del(&table->list); + mutex_unlock(&xt[table->af].mutex); + kfree(table); +-- +2.30.1 + diff --git a/queue-5.4/revert-netfilter-x_tables-update-remaining-dereferen.patch b/queue-5.4/revert-netfilter-x_tables-update-remaining-dereferen.patch new file mode 100644 index 00000000000..06ddf7d72c9 --- /dev/null +++ b/queue-5.4/revert-netfilter-x_tables-update-remaining-dereferen.patch @@ -0,0 +1,70 @@ +From 02b5b2240c6dd1f9a3599d6fe022befac53bed7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 14:24:11 +1300 +Subject: Revert "netfilter: x_tables: Update remaining dereference to RCU" + +From: Mark Tomlinson + +[ Upstream commit abe7034b9a8d57737e80cc16d60ed3666990bdbf ] + +This reverts commit 443d6e86f821a165fae3fc3fc13086d27ac140b1. + +This (and the following) patch basically re-implemented the RCU +mechanisms of patch 784544739a25. That patch was replaced because of the +performance problems that it created when replacing tables. Now, we have +the same issue: the call to synchronize_rcu() makes replacing tables +slower by as much as an order of magnitude. + +Revert these patches and fix the issue in a different way. + +Signed-off-by: Mark Tomlinson +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/ipv4/netfilter/arp_tables.c | 2 +- + net/ipv4/netfilter/ip_tables.c | 2 +- + net/ipv6/netfilter/ip6_tables.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c +index 680a1320399d..f1f78a742b36 100644 +--- a/net/ipv4/netfilter/arp_tables.c ++++ b/net/ipv4/netfilter/arp_tables.c +@@ -1406,7 +1406,7 @@ static int compat_get_entries(struct net *net, + xt_compat_lock(NFPROTO_ARP); + t = xt_find_table_lock(net, NFPROTO_ARP, get.name); + if (!IS_ERR(t)) { +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + struct xt_table_info info; + + ret = compat_table_info(private, &info); +diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c +index 8c320b7a423c..10b91ebdf213 100644 +--- a/net/ipv4/netfilter/ip_tables.c ++++ b/net/ipv4/netfilter/ip_tables.c +@@ -1616,7 +1616,7 @@ compat_get_entries(struct net *net, struct compat_ipt_get_entries __user *uptr, + xt_compat_lock(AF_INET); + t = xt_find_table_lock(net, AF_INET, get.name); + if (!IS_ERR(t)) { +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + struct xt_table_info info; + ret = compat_table_info(private, &info); + if (!ret && get.size == info.size) +diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c +index 85d8ed970cdc..c973ace208c5 100644 +--- a/net/ipv6/netfilter/ip6_tables.c ++++ b/net/ipv6/netfilter/ip6_tables.c +@@ -1625,7 +1625,7 @@ compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr, + xt_compat_lock(AF_INET6); + t = xt_find_table_lock(net, AF_INET6, get.name); + if (!IS_ERR(t)) { +- const struct xt_table_info *private = xt_table_get_private_protected(t); ++ const struct xt_table_info *private = t->private; + struct xt_table_info info; + ret = compat_table_info(private, &info); + if (!ret && get.size == info.size) +-- +2.30.1 + diff --git a/queue-5.4/selftests-bpf-set-gopt-opt_class-to-0-if-get-tunnel-.patch b/queue-5.4/selftests-bpf-set-gopt-opt_class-to-0-if-get-tunnel-.patch new file mode 100644 index 00000000000..ca4235cc4ff --- /dev/null +++ b/queue-5.4/selftests-bpf-set-gopt-opt_class-to-0-if-get-tunnel-.patch @@ -0,0 +1,47 @@ +From 824b3a8c7948f8a28103c1207f426d31478d2aae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Mar 2021 11:22:14 +0800 +Subject: selftests/bpf: Set gopt opt_class to 0 if get tunnel opt failed + +From: Hangbin Liu + +[ Upstream commit 31254dc9566221429d2cfb45fd5737985d70f2b6 ] + +When fixing the bpf test_tunnel.sh geneve failure. I only fixed the IPv4 +part but forgot the IPv6 issue. Similar with the IPv4 fixes 557c223b643a +("selftests/bpf: No need to drop the packet when there is no geneve opt"), +when there is no tunnel option and bpf_skb_get_tunnel_opt() returns error, +there is no need to drop the packets and break all geneve rx traffic. +Just set opt_class to 0 and keep returning TC_ACT_OK at the end. + +Fixes: 557c223b643a ("selftests/bpf: No need to drop the packet when there is no geneve opt") +Fixes: 933a741e3b82 ("selftests/bpf: bpf tunnel test.") +Signed-off-by: Hangbin Liu +Signed-off-by: Daniel Borkmann +Acked-by: William Tu +Link: https://lore.kernel.org/bpf/20210309032214.2112438-1-liuhangbin@gmail.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/progs/test_tunnel_kern.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c +index b4e9a1d8c6cd..141670ab4e67 100644 +--- a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c ++++ b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c +@@ -508,10 +508,8 @@ int _ip6geneve_get_tunnel(struct __sk_buff *skb) + } + + ret = bpf_skb_get_tunnel_opt(skb, &gopt, sizeof(gopt)); +- if (ret < 0) { +- ERROR(ret); +- return TC_ACT_SHOT; +- } ++ if (ret < 0) ++ gopt.opt_class = 0; + + bpf_trace_printk(fmt, sizeof(fmt), + key.tunnel_id, key.remote_ipv4, gopt.opt_class); +-- +2.30.1 + diff --git a/queue-5.4/selftests-forwarding-vxlan_bridge_1d-fix-vxlan-ecn-d.patch b/queue-5.4/selftests-forwarding-vxlan_bridge_1d-fix-vxlan-ecn-d.patch new file mode 100644 index 00000000000..fbb8df89c35 --- /dev/null +++ b/queue-5.4/selftests-forwarding-vxlan_bridge_1d-fix-vxlan-ecn-d.patch @@ -0,0 +1,46 @@ +From b9a555e4312a96a8b6a5d727eebfc0af14d133a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 22:33:14 +0800 +Subject: selftests: forwarding: vxlan_bridge_1d: Fix vxlan ecn decapsulate + value + +From: Hangbin Liu + +[ Upstream commit 5aa3c334a449bab24519c4967f5ac2b3304c8dcf ] + +The ECN bit defines ECT(1) = 1, ECT(0) = 2. So inner 0x02 + outer 0x01 +should be inner ECT(0) + outer ECT(1). Based on the description of +__INET_ECN_decapsulate, the final decapsulate value should be +ECT(1). So fix the test expect value to 0x01. + +Before the fix: +TEST: VXLAN: ECN decap: 01/02->0x02 [FAIL] + Expected to capture 10 packets, got 0. + +After the fix: +TEST: VXLAN: ECN decap: 01/02->0x01 [ OK ] + +Fixes: a0b61f3d8ebf ("selftests: forwarding: vxlan_bridge_1d: Add an ECN decap test") +Signed-off-by: Hangbin Liu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh b/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh +index ce6bea9675c0..0ccb1dda099a 100755 +--- a/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh ++++ b/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh +@@ -658,7 +658,7 @@ test_ecn_decap() + # In accordance with INET_ECN_decapsulate() + __test_ecn_decap 00 00 0x00 + __test_ecn_decap 01 01 0x01 +- __test_ecn_decap 02 01 0x02 ++ __test_ecn_decap 02 01 0x01 + __test_ecn_decap 01 03 0x03 + __test_ecn_decap 02 03 0x03 + test_ecn_decap_error +-- +2.30.1 + diff --git a/queue-5.4/series b/queue-5.4/series index e2253e6c334..cd923884e68 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -50,3 +50,47 @@ arm-dts-at91-sama5d27_som1-fix-phy-address-to-7.patch integrity-double-check-iint_cache-was-initialized.patch dm-verity-fix-dm_verity_opts_max-value.patch dm-ioctl-fix-out-of-bounds-array-access-when-no-devices.patch +bus-omap_l3_noc-mark-l3-irqs-as-irqf_no_thread.patch +veth-store-queue_mapping-independently-of-xdp-prog-p.patch +libbpf-fix-install-flag-order.patch +net-mlx5e-don-t-match-on-geneve-options-in-case-opti.patch +ipv6-fix-suspecious-rcu-usage-warning.patch +macvlan-macvlan_count_rx-needs-to-be-aware-of-preemp.patch +net-sched-validate-stab-values.patch +net-dsa-bcm_sf2-qualify-phydev-dev_flags-based-on-po.patch +igc-fix-pause-frame-advertising.patch +igc-fix-supported-pause-frame-link-setting.patch +e1000e-add-rtnl_lock-to-e1000_reset_task.patch +e1000e-fix-error-handling-in-e1000_set_d0_lplu_state.patch +net-qlcnic-fix-a-use-after-free-in-qlcnic_83xx_get_m.patch +ftgmac100-restart-mac-hw-once.patch +selftests-bpf-set-gopt-opt_class-to-0-if-get-tunnel-.patch +netfilter-ctnetlink-fix-dump-of-the-expect-mask-attr.patch +tcp-relookup-sock-for-rst-ack-packets-handled-by-obs.patch +can-peak_usb-add-forgotten-supported-devices.patch +can-flexcan-flexcan_chip_freeze-fix-chip-freeze-for-.patch +can-kvaser_pciefd-always-disable-bus-load-reporting.patch +can-c_can_pci-c_can_pci_remove-fix-use-after-free.patch +can-c_can-move-runtime-pm-enable-disable-to-c_can_pl.patch +can-m_can-m_can_do_rx_poll-fix-extraneous-msg-loss-w.patch +can-m_can-m_can_rx_peripheral-fix-rx-being-blocked-b.patch +mac80211-fix-rate-mask-reset.patch +nfp-flower-fix-pre_tun-mask-id-allocation.patch +libbpf-use-sock_cloexec-when-opening-the-netlink-soc.patch +octeontx2-af-fix-irq-free-in-rvu-teardown.patch +octeontx2-af-fix-infinite-loop-in-unmapping-npc-coun.patch +net-cdc-phonet-fix-data-interface-release-on-probe-f.patch +r8152-limit-the-rx-buffer-size-of-rtl8153a-for-usb-2.patch +net-stmmac-dwmac-sun8i-provide-tx-and-rx-fifo-sizes.patch +selftests-forwarding-vxlan_bridge_1d-fix-vxlan-ecn-d.patch +libbpf-fix-btf-dump-of-pointer-to-array-of-struct.patch +drm-msm-fix-shutdown-hook-in-case-gpu-components-fai.patch +arm64-kdump-update-ppos-when-reading-elfcorehdr.patch +pm-runtime-defer-suspending-suppliers.patch +net-mlx5e-fix-error-path-for-ethtool-set-priv-flag.patch +pm-em-postpone-creating-the-debugfs-dir-till-fs_init.patch +rdma-cxgb4-fix-adapter-le-hash-errors-while-destroyi.patch +bpf-don-t-do-bpf_cgroup_storage_set-for-kuprobe-tp-p.patch +revert-netfilter-x_tables-switch-synchronization-to-.patch +netfilter-x_tables-use-correct-memory-barriers.patch +revert-netfilter-x_tables-update-remaining-dereferen.patch diff --git a/queue-5.4/tcp-relookup-sock-for-rst-ack-packets-handled-by-obs.patch b/queue-5.4/tcp-relookup-sock-for-rst-ack-packets-handled-by-obs.patch new file mode 100644 index 00000000000..0e67ac790b7 --- /dev/null +++ b/queue-5.4/tcp-relookup-sock-for-rst-ack-packets-handled-by-obs.patch @@ -0,0 +1,88 @@ +From c4b414179ee59e1e22dc70eab79ba9bfaa042fb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Mar 2021 14:05:45 +0300 +Subject: tcp: relookup sock for RST+ACK packets handled by obsolete req sock + +From: Alexander Ovechkin + +[ Upstream commit 7233da86697efef41288f8b713c10c2499cffe85 ] + +Currently tcp_check_req can be called with obsolete req socket for which big +socket have been already created (because of CPU race or early demux +assigning req socket to multiple packets in gro batch). + +Commit e0f9759f530bf789e984 ("tcp: try to keep packet if SYN_RCV race +is lost") added retry in case when tcp_check_req is called for PSH|ACK packet. +But if client sends RST+ACK immediatly after connection being +established (it is performing healthcheck, for example) retry does not +occur. In that case tcp_check_req tries to close req socket, +leaving big socket active. + +Fixes: e0f9759f530 ("tcp: try to keep packet if SYN_RCV race is lost") +Signed-off-by: Alexander Ovechkin +Reported-by: Oleg Senin +Reviewed-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/inet_connection_sock.h | 2 +- + net/ipv4/inet_connection_sock.c | 7 +++++-- + net/ipv4/tcp_minisocks.c | 7 +++++-- + 3 files changed, 11 insertions(+), 5 deletions(-) + +diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h +index 6c8f8e5e33c3..13792c0ef46e 100644 +--- a/include/net/inet_connection_sock.h ++++ b/include/net/inet_connection_sock.h +@@ -287,7 +287,7 @@ static inline int inet_csk_reqsk_queue_is_full(const struct sock *sk) + return inet_csk_reqsk_queue_len(sk) >= sk->sk_max_ack_backlog; + } + +-void inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req); ++bool inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req); + void inet_csk_reqsk_queue_drop_and_put(struct sock *sk, struct request_sock *req); + + void inet_csk_destroy_sock(struct sock *sk); +diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c +index ac5c4f6cdefe..85a88425edc4 100644 +--- a/net/ipv4/inet_connection_sock.c ++++ b/net/ipv4/inet_connection_sock.c +@@ -700,12 +700,15 @@ static bool reqsk_queue_unlink(struct request_sock *req) + return found; + } + +-void inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req) ++bool inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req) + { +- if (reqsk_queue_unlink(req)) { ++ bool unlinked = reqsk_queue_unlink(req); ++ ++ if (unlinked) { + reqsk_queue_removed(&inet_csk(sk)->icsk_accept_queue, req); + reqsk_put(req); + } ++ return unlinked; + } + EXPORT_SYMBOL(inet_csk_reqsk_queue_drop); + +diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c +index c802bc80c400..194743bd3fc1 100644 +--- a/net/ipv4/tcp_minisocks.c ++++ b/net/ipv4/tcp_minisocks.c +@@ -796,8 +796,11 @@ embryonic_reset: + tcp_reset(sk); + } + if (!fastopen) { +- inet_csk_reqsk_queue_drop(sk, req); +- __NET_INC_STATS(sock_net(sk), LINUX_MIB_EMBRYONICRSTS); ++ bool unlinked = inet_csk_reqsk_queue_drop(sk, req); ++ ++ if (unlinked) ++ __NET_INC_STATS(sock_net(sk), LINUX_MIB_EMBRYONICRSTS); ++ *req_stolen = !unlinked; + } + return NULL; + } +-- +2.30.1 + diff --git a/queue-5.4/veth-store-queue_mapping-independently-of-xdp-prog-p.patch b/queue-5.4/veth-store-queue_mapping-independently-of-xdp-prog-p.patch new file mode 100644 index 00000000000..78a603f7cd8 --- /dev/null +++ b/queue-5.4/veth-store-queue_mapping-independently-of-xdp-prog-p.patch @@ -0,0 +1,46 @@ +From eed1b91bb228087e5499ebb333d35b284bbb36c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 16:29:03 +0100 +Subject: veth: Store queue_mapping independently of XDP prog presence + +From: Maciej Fijalkowski + +[ Upstream commit edbea922025169c0e5cdca5ebf7bf5374cc5566c ] + +Currently, veth_xmit() would call the skb_record_rx_queue() only when +there is XDP program loaded on peer interface in native mode. + +If peer has XDP prog in generic mode, then netif_receive_generic_xdp() +has a call to netif_get_rxqueue(skb), so for multi-queue veth it will +not be possible to grab a correct rxq. + +To fix that, store queue_mapping independently of XDP prog presence on +peer interface. + +Fixes: 638264dc9022 ("veth: Support per queue XDP ring") +Signed-off-by: Maciej Fijalkowski +Signed-off-by: Daniel Borkmann +Acked-by: Toshiaki Makita +Link: https://lore.kernel.org/bpf/20210303152903.11172-1-maciej.fijalkowski@intel.com +Signed-off-by: Sasha Levin +--- + drivers/net/veth.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/veth.c b/drivers/net/veth.c +index 88cfd63f08a6..44ad412f9a06 100644 +--- a/drivers/net/veth.c ++++ b/drivers/net/veth.c +@@ -254,8 +254,7 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev) + if (rxq < rcv->real_num_rx_queues) { + rq = &rcv_priv->rq[rxq]; + rcv_xdp = rcu_access_pointer(rq->xdp_prog); +- if (rcv_xdp) +- skb_record_rx_queue(skb, rxq); ++ skb_record_rx_queue(skb, rxq); + } + + skb_tx_timestamp(skb); +-- +2.30.1 +