From: Sasha Levin Date: Mon, 26 Feb 2024 22:21:34 +0000 (-0500) Subject: Fixes for 5.4 X-Git-Tag: v4.19.308~30 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=cdd1b40386b90feb08f3197b50547e2b86b3c565;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/afs-increase-buffer-size-in-afs_update_volume_status.patch b/queue-5.4/afs-increase-buffer-size-in-afs_update_volume_status.patch new file mode 100644 index 00000000000..19ec2a06565 --- /dev/null +++ b/queue-5.4/afs-increase-buffer-size-in-afs_update_volume_status.patch @@ -0,0 +1,53 @@ +From 535128158bbef07e3322a274054c670a384146c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Feb 2024 14:39:03 +0000 +Subject: afs: Increase buffer size in afs_update_volume_status() + +From: Daniil Dulov + +[ Upstream commit 6ea38e2aeb72349cad50e38899b0ba6fbcb2af3d ] + +The max length of volume->vid value is 20 characters. +So increase idbuf[] size up to 24 to avoid overflow. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +[DH: Actually, it's 20 + NUL, so increase it to 24 and use snprintf()] + +Fixes: d2ddc776a458 ("afs: Overhaul volume and server record caching and fileserver rotation") +Signed-off-by: Daniil Dulov +Signed-off-by: David Howells +Link: https://lore.kernel.org/r/20240211150442.3416-1-d.dulov@aladdin.ru/ # v1 +Link: https://lore.kernel.org/r/20240212083347.10742-1-d.dulov@aladdin.ru/ # v2 +Link: https://lore.kernel.org/r/20240219143906.138346-3-dhowells@redhat.com +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/afs/volume.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/afs/volume.c b/fs/afs/volume.c +index 4310336b9bb8c..4225bc766d464 100644 +--- a/fs/afs/volume.c ++++ b/fs/afs/volume.c +@@ -221,7 +221,7 @@ static int afs_update_volume_status(struct afs_volume *volume, struct key *key) + { + struct afs_server_list *new, *old, *discard; + struct afs_vldb_entry *vldb; +- char idbuf[16]; ++ char idbuf[24]; + int ret, idsz; + + _enter(""); +@@ -229,7 +229,7 @@ static int afs_update_volume_status(struct afs_volume *volume, struct key *key) + /* We look up an ID by passing it as a decimal string in the + * operation's name parameter. + */ +- idsz = sprintf(idbuf, "%llu", volume->vid); ++ idsz = snprintf(idbuf, sizeof(idbuf), "%llu", volume->vid); + + vldb = afs_vl_lookup_vldb(volume->cell, key, idbuf, idsz); + if (IS_ERR(vldb)) { +-- +2.43.0 + diff --git a/queue-5.4/bpf-scripts-correct-gpl-license-name.patch b/queue-5.4/bpf-scripts-correct-gpl-license-name.patch new file mode 100644 index 00000000000..a97d2016e77 --- /dev/null +++ b/queue-5.4/bpf-scripts-correct-gpl-license-name.patch @@ -0,0 +1,41 @@ +From c0f22ec08dac9a066e66d1d6b2bb51b9d8b794cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 23:05:46 +0000 +Subject: bpf, scripts: Correct GPL license name + +From: Gianmarco Lusvardi + +[ Upstream commit e37243b65d528a8a9f8b9a57a43885f8e8dfc15c ] + +The bpf_doc script refers to the GPL as the "GNU Privacy License". +I strongly suspect that the author wanted to refer to the GNU General +Public License, under which the Linux kernel is released, as, to the +best of my knowledge, there is no license named "GNU Privacy License". +This patch corrects the license name in the script accordingly. + +Fixes: 56a092c89505 ("bpf: add script and prepare bpf.h for new helpers documentation") +Signed-off-by: Gianmarco Lusvardi +Signed-off-by: Daniel Borkmann +Reviewed-by: Quentin Monnet +Link: https://lore.kernel.org/bpf/20240213230544.930018-3-glusvardi@posteo.net +Signed-off-by: Sasha Levin +--- + scripts/bpf_helpers_doc.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/bpf_helpers_doc.py b/scripts/bpf_helpers_doc.py +index 15d3d83d6297c..78b7194a05521 100755 +--- a/scripts/bpf_helpers_doc.py ++++ b/scripts/bpf_helpers_doc.py +@@ -286,7 +286,7 @@ eBPF programs can have an associated license, passed along with the bytecode + instructions to the kernel when the programs are loaded. The format for that + string is identical to the one in use for kernel modules (Dual licenses, such + as "Dual BSD/GPL", may be used). Some helper functions are only accessible to +-programs that are compatible with the GNU Privacy License (GPL). ++programs that are compatible with the GNU General Public License (GNU GPL). + + In order to use such helpers, the eBPF program must be loaded with the correct + license string passed (via **attr**) to the **bpf**\ () system call, and this +-- +2.43.0 + diff --git a/queue-5.4/drm-syncobj-call-drm_syncobj_fence_add_wait-when-wai.patch b/queue-5.4/drm-syncobj-call-drm_syncobj_fence_add_wait-when-wai.patch new file mode 100644 index 00000000000..aefd2d6b2c7 --- /dev/null +++ b/queue-5.4/drm-syncobj-call-drm_syncobj_fence_add_wait-when-wai.patch @@ -0,0 +1,75 @@ +From 27e50dab93123b63f044d5cc5cd5cd615a12e82b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jan 2024 08:32:06 -0800 +Subject: drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag + is set + +From: Erik Kurzinger + +[ Upstream commit 3c43177ffb54ea5be97505eb8e2690e99ac96bc9 ] + +When waiting for a syncobj timeline point whose fence has not yet been +submitted with the WAIT_FOR_SUBMIT flag, a callback is registered using +drm_syncobj_fence_add_wait and the thread is put to sleep until the +timeout expires. If the fence is submitted before then, +drm_syncobj_add_point will wake up the sleeping thread immediately which +will proceed to wait for the fence to be signaled. + +However, if the WAIT_AVAILABLE flag is used instead, +drm_syncobj_fence_add_wait won't get called, meaning the waiting thread +will always sleep for the full timeout duration, even if the fence gets +submitted earlier. If it turns out that the fence *has* been submitted +by the time it eventually wakes up, it will still indicate to userspace +that the wait completed successfully (it won't return -ETIME), but it +will have taken much longer than it should have. + +To fix this, we must call drm_syncobj_fence_add_wait if *either* the +WAIT_FOR_SUBMIT flag or the WAIT_AVAILABLE flag is set. The only +difference being that with WAIT_FOR_SUBMIT we will also wait for the +fence to be signaled after it has been submitted while with +WAIT_AVAILABLE we will return immediately. + +IGT test patch: https://lists.freedesktop.org/archives/igt-dev/2024-January/067537.html + +v1 -> v2: adjust lockdep_assert_none_held_once condition + +(cherry picked from commit 8c44ea81634a4a337df70a32621a5f3791be23df) + +Fixes: 01d6c3578379 ("drm/syncobj: add support for timeline point wait v8") +Signed-off-by: Erik Kurzinger +Signed-off-by: Simon Ser +Reviewed-by: Daniel Vetter +Reviewed-by: Simon Ser +Link: https://patchwork.freedesktop.org/patch/msgid/20240119163208.3723457-1-ekurzinger@nvidia.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_syncobj.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c +index a1d2a3dc00768..9baf95a4fc9ff 100644 +--- a/drivers/gpu/drm/drm_syncobj.c ++++ b/drivers/gpu/drm/drm_syncobj.c +@@ -898,7 +898,8 @@ static signed long drm_syncobj_array_wait_timeout(struct drm_syncobj **syncobjs, + uint64_t *points; + uint32_t signaled_count, i; + +- if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT) ++ if (flags & (DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT | ++ DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE)) + lockdep_assert_none_held_once(); + + points = kmalloc_array(count, sizeof(*points), GFP_KERNEL); +@@ -967,7 +968,8 @@ static signed long drm_syncobj_array_wait_timeout(struct drm_syncobj **syncobjs, + * fallthough and try a 0 timeout wait! + */ + +- if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT) { ++ if (flags & (DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT | ++ DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE)) { + for (i = 0; i < count; ++i) + drm_syncobj_fence_add_wait(syncobjs[i], &entries[i]); + } +-- +2.43.0 + diff --git a/queue-5.4/drm-syncobj-make-lockdep-complain-on-wait_for_submit.patch b/queue-5.4/drm-syncobj-make-lockdep-complain-on-wait_for_submit.patch new file mode 100644 index 00000000000..9fb2e00669b --- /dev/null +++ b/queue-5.4/drm-syncobj-make-lockdep-complain-on-wait_for_submit.patch @@ -0,0 +1,91 @@ +From 2bccb12dcf11d8630ee133110a88ae6c28ffba89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jan 2021 14:32:39 +0100 +Subject: drm/syncobj: make lockdep complain on WAIT_FOR_SUBMIT v3 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian König + +[ Upstream commit 7621350c6bb20fb6ab7eb988833ab96eac3dcbef ] + +DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT can't be used when we hold locks +since we are basically waiting for userspace to do something. + +Holding a lock while doing so can trivial deadlock with page faults +etc... + +So make lockdep complain when a driver tries to do this. + +v2: Add lockdep_assert_none_held() macro. +v3: Add might_sleep() and also use lockdep_assert_none_held() in the + IOCTL path. + +Signed-off-by: Christian König +Reviewed-by: Daniel Vetter +Acked-by: Peter Zijlstra (Intel) +Link: https://patchwork.freedesktop.org/patch/414944/ +Stable-dep-of: 3c43177ffb54 ("drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_syncobj.c | 12 ++++++++++++ + include/linux/lockdep.h | 5 +++++ + 2 files changed, 17 insertions(+) + +diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c +index 8b155e3377cfe..a1d2a3dc00768 100644 +--- a/drivers/gpu/drm/drm_syncobj.c ++++ b/drivers/gpu/drm/drm_syncobj.c +@@ -325,6 +325,15 @@ int drm_syncobj_find_fence(struct drm_file *file_private, + if (!syncobj) + return -ENOENT; + ++ /* Waiting for userspace with locks help is illegal cause that can ++ * trivial deadlock with page faults for example. Make lockdep complain ++ * about it early on. ++ */ ++ if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT) { ++ might_sleep(); ++ lockdep_assert_none_held_once(); ++ } ++ + *fence = drm_syncobj_fence_get(syncobj); + + if (*fence) { +@@ -889,6 +898,9 @@ static signed long drm_syncobj_array_wait_timeout(struct drm_syncobj **syncobjs, + uint64_t *points; + uint32_t signaled_count, i; + ++ if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT) ++ lockdep_assert_none_held_once(); ++ + points = kmalloc_array(count, sizeof(*points), GFP_KERNEL); + if (points == NULL) + return -ENOMEM; +diff --git a/include/linux/lockdep.h b/include/linux/lockdep.h +index b8a835fd611b2..15d92abb3f2d8 100644 +--- a/include/linux/lockdep.h ++++ b/include/linux/lockdep.h +@@ -403,6 +403,10 @@ extern void lock_unpin_lock(struct lockdep_map *lock, struct pin_cookie); + WARN_ON_ONCE(debug_locks && !lockdep_is_held(l)); \ + } while (0) + ++#define lockdep_assert_none_held_once() do { \ ++ WARN_ON_ONCE(debug_locks && current->lockdep_depth); \ ++ } while (0) ++ + #define lockdep_recursing(tsk) ((tsk)->lockdep_recursion) + + #define lockdep_pin_lock(l) lock_pin_lock(&(l)->dep_map) +@@ -479,6 +483,7 @@ struct lockdep_map { }; + #define lockdep_assert_held_write(l) do { (void)(l); } while (0) + #define lockdep_assert_held_read(l) do { (void)(l); } while (0) + #define lockdep_assert_held_once(l) do { (void)(l); } while (0) ++#define lockdep_assert_none_held_once() do { } while (0) + + #define lockdep_recursing(tsk) (0) + +-- +2.43.0 + diff --git a/queue-5.4/ib-hfi1-fix-a-memleak-in-init_credit_return.patch b/queue-5.4/ib-hfi1-fix-a-memleak-in-init_credit_return.patch new file mode 100644 index 00000000000..7d1e9ee6b04 --- /dev/null +++ b/queue-5.4/ib-hfi1-fix-a-memleak-in-init_credit_return.patch @@ -0,0 +1,51 @@ +From 095d487307322dc10f1754522afa38eefc6ed7d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Jan 2024 16:55:23 +0800 +Subject: IB/hfi1: Fix a memleak in init_credit_return + +From: Zhipeng Lu + +[ Upstream commit 809aa64ebff51eb170ee31a95f83b2d21efa32e2 ] + +When dma_alloc_coherent fails to allocate dd->cr_base[i].va, +init_credit_return should deallocate dd->cr_base and +dd->cr_base[i] that allocated before. Or those resources +would be never freed and a memleak is triggered. + +Fixes: 7724105686e7 ("IB/hfi1: add driver files") +Signed-off-by: Zhipeng Lu +Link: https://lore.kernel.org/r/20240112085523.3731720-1-alexious@zju.edu.cn +Acked-by: Dennis Dalessandro +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/pio.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hfi1/pio.c b/drivers/infiniband/hw/hfi1/pio.c +index fa5de362010f2..8303c506733cc 100644 +--- a/drivers/infiniband/hw/hfi1/pio.c ++++ b/drivers/infiniband/hw/hfi1/pio.c +@@ -2131,7 +2131,7 @@ int init_credit_return(struct hfi1_devdata *dd) + "Unable to allocate credit return DMA range for NUMA %d\n", + i); + ret = -ENOMEM; +- goto done; ++ goto free_cr_base; + } + } + set_dev_node(&dd->pcidev->dev, dd->node); +@@ -2139,6 +2139,10 @@ int init_credit_return(struct hfi1_devdata *dd) + ret = 0; + done: + return ret; ++ ++free_cr_base: ++ free_credit_return(dd); ++ goto done; + } + + void free_credit_return(struct hfi1_devdata *dd) +-- +2.43.0 + diff --git a/queue-5.4/ipv4-properly-combine-dev_base_seq-and-ipv4.dev_addr.patch b/queue-5.4/ipv4-properly-combine-dev_base_seq-and-ipv4.dev_addr.patch new file mode 100644 index 00000000000..1100a2bc79f --- /dev/null +++ b/queue-5.4/ipv4-properly-combine-dev_base_seq-and-ipv4.dev_addr.patch @@ -0,0 +1,73 @@ +From b0ed70e21c32a070603125f355487f65a1f97763 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Feb 2024 17:21:06 +0000 +Subject: ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid + +From: Eric Dumazet + +[ Upstream commit 081a0e3b0d4c061419d3f4679dec9f68725b17e4 ] + +net->dev_base_seq and ipv4.dev_addr_genid are monotonically increasing. + +If we XOR their values, we could miss to detect if both values +were changed with the same amount. + +Fixes: 0465277f6b3f ("ipv4: provide addr and netconf dump consistency info") +Signed-off-by: Eric Dumazet +Cc: Nicolas Dichtel +Acked-by: Nicolas Dichtel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/devinet.c | 21 +++++++++++++++++---- + 1 file changed, 17 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c +index 4c013f8800f0c..ed00b233cee2e 100644 +--- a/net/ipv4/devinet.c ++++ b/net/ipv4/devinet.c +@@ -1798,6 +1798,21 @@ static int in_dev_dump_addr(struct in_device *in_dev, struct sk_buff *skb, + return err; + } + ++/* Combine dev_addr_genid and dev_base_seq to detect changes. ++ */ ++static u32 inet_base_seq(const struct net *net) ++{ ++ u32 res = atomic_read(&net->ipv4.dev_addr_genid) + ++ net->dev_base_seq; ++ ++ /* Must not return 0 (see nl_dump_check_consistent()). ++ * Chose a value far away from 0. ++ */ ++ if (!res) ++ res = 0x80000000; ++ return res; ++} ++ + static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb) + { + const struct nlmsghdr *nlh = cb->nlh; +@@ -1849,8 +1864,7 @@ static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb) + idx = 0; + head = &tgt_net->dev_index_head[h]; + rcu_read_lock(); +- cb->seq = atomic_read(&tgt_net->ipv4.dev_addr_genid) ^ +- tgt_net->dev_base_seq; ++ cb->seq = inet_base_seq(tgt_net); + hlist_for_each_entry_rcu(dev, head, index_hlist) { + if (idx < s_idx) + goto cont; +@@ -2249,8 +2263,7 @@ static int inet_netconf_dump_devconf(struct sk_buff *skb, + idx = 0; + head = &net->dev_index_head[h]; + rcu_read_lock(); +- cb->seq = atomic_read(&net->ipv4.dev_addr_genid) ^ +- net->dev_base_seq; ++ cb->seq = inet_base_seq(net); + hlist_for_each_entry_rcu(dev, head, index_hlist) { + if (idx < s_idx) + goto cont; +-- +2.43.0 + diff --git a/queue-5.4/ipv6-properly-combine-dev_base_seq-and-ipv6.dev_addr.patch b/queue-5.4/ipv6-properly-combine-dev_base_seq-and-ipv6.dev_addr.patch new file mode 100644 index 00000000000..8900ba7772b --- /dev/null +++ b/queue-5.4/ipv6-properly-combine-dev_base_seq-and-ipv6.dev_addr.patch @@ -0,0 +1,75 @@ +From 7c70e1a8d25bf36ecd3d0ebfdc64300a19128aea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Feb 2024 17:21:07 +0000 +Subject: ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid + +From: Eric Dumazet + +[ Upstream commit e898e4cd1aab271ca414f9ac6e08e4c761f6913c ] + +net->dev_base_seq and ipv6.dev_addr_genid are monotonically increasing. + +If we XOR their values, we could miss to detect if both values +were changed with the same amount. + +Fixes: 63998ac24f83 ("ipv6: provide addr and netconf dump consistency info") +Signed-off-by: Eric Dumazet +Cc: Nicolas Dichtel + +Signed-off-by: Eric Dumazet +Acked-by: Nicolas Dichtel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv6/addrconf.c | 21 ++++++++++++++++++--- + 1 file changed, 18 insertions(+), 3 deletions(-) + +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index 4bec4c0617412..6fcbe8912b431 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -696,6 +696,22 @@ static int inet6_netconf_get_devconf(struct sk_buff *in_skb, + return err; + } + ++/* Combine dev_addr_genid and dev_base_seq to detect changes. ++ */ ++static u32 inet6_base_seq(const struct net *net) ++{ ++ u32 res = atomic_read(&net->ipv6.dev_addr_genid) + ++ net->dev_base_seq; ++ ++ /* Must not return 0 (see nl_dump_check_consistent()). ++ * Chose a value far away from 0. ++ */ ++ if (!res) ++ res = 0x80000000; ++ return res; ++} ++ ++ + static int inet6_netconf_dump_devconf(struct sk_buff *skb, + struct netlink_callback *cb) + { +@@ -729,8 +745,7 @@ static int inet6_netconf_dump_devconf(struct sk_buff *skb, + idx = 0; + head = &net->dev_index_head[h]; + rcu_read_lock(); +- cb->seq = atomic_read(&net->ipv6.dev_addr_genid) ^ +- net->dev_base_seq; ++ cb->seq = inet6_base_seq(net); + hlist_for_each_entry_rcu(dev, head, index_hlist) { + if (idx < s_idx) + goto cont; +@@ -5232,7 +5247,7 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb, + } + + rcu_read_lock(); +- cb->seq = atomic_read(&tgt_net->ipv6.dev_addr_genid) ^ tgt_net->dev_base_seq; ++ cb->seq = inet6_base_seq(tgt_net); + for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) { + idx = 0; + head = &tgt_net->dev_index_head[h]; +-- +2.43.0 + diff --git a/queue-5.4/ipv6-sr-fix-possible-use-after-free-and-null-ptr-der.patch b/queue-5.4/ipv6-sr-fix-possible-use-after-free-and-null-ptr-der.patch new file mode 100644 index 00000000000..54c9d07c9c2 --- /dev/null +++ b/queue-5.4/ipv6-sr-fix-possible-use-after-free-and-null-ptr-der.patch @@ -0,0 +1,74 @@ +From 641284a9b6f46dde8ce8fb29c677e9a3b26c6d86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Feb 2024 23:27:17 +0300 +Subject: ipv6: sr: fix possible use-after-free and null-ptr-deref + +From: Vasiliy Kovalev + +[ Upstream commit 5559cea2d5aa3018a5f00dd2aca3427ba09b386b ] + +The pernet operations structure for the subsystem must be registered +before registering the generic netlink family. + +Fixes: 915d7e5e5930 ("ipv6: sr: add code base for control plane support of SR-IPv6") +Signed-off-by: Vasiliy Kovalev +Link: https://lore.kernel.org/r/20240215202717.29815-1-kovalev@altlinux.org +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv6/seg6.c | 20 +++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c +index f5c448c276fef..7094f8691ac68 100644 +--- a/net/ipv6/seg6.c ++++ b/net/ipv6/seg6.c +@@ -441,22 +441,24 @@ int __init seg6_init(void) + { + int err = -ENOMEM; + +- err = genl_register_family(&seg6_genl_family); ++ err = register_pernet_subsys(&ip6_segments_ops); + if (err) + goto out; + +- err = register_pernet_subsys(&ip6_segments_ops); ++ err = genl_register_family(&seg6_genl_family); + if (err) +- goto out_unregister_genl; ++ goto out_unregister_pernet; + + #ifdef CONFIG_IPV6_SEG6_LWTUNNEL + err = seg6_iptunnel_init(); + if (err) +- goto out_unregister_pernet; ++ goto out_unregister_genl; + + err = seg6_local_init(); +- if (err) +- goto out_unregister_pernet; ++ if (err) { ++ seg6_iptunnel_exit(); ++ goto out_unregister_genl; ++ } + #endif + + #ifdef CONFIG_IPV6_SEG6_HMAC +@@ -477,11 +479,11 @@ int __init seg6_init(void) + #endif + #endif + #ifdef CONFIG_IPV6_SEG6_LWTUNNEL +-out_unregister_pernet: +- unregister_pernet_subsys(&ip6_segments_ops); +-#endif + out_unregister_genl: + genl_unregister_family(&seg6_genl_family); ++#endif ++out_unregister_pernet: ++ unregister_pernet_subsys(&ip6_segments_ops); + goto out; + } + +-- +2.43.0 + diff --git a/queue-5.4/netfilter-nf_tables-set-dormant-flag-on-hook-registe.patch b/queue-5.4/netfilter-nf_tables-set-dormant-flag-on-hook-registe.patch new file mode 100644 index 00000000000..118e29571c8 --- /dev/null +++ b/queue-5.4/netfilter-nf_tables-set-dormant-flag-on-hook-registe.patch @@ -0,0 +1,42 @@ +From 8c4fb0854a2c3807a25adf02eb262c56f0ed429b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Feb 2024 16:58:04 +0100 +Subject: netfilter: nf_tables: set dormant flag on hook register failure + +From: Florian Westphal + +[ Upstream commit bccebf64701735533c8db37773eeacc6566cc8ec ] + +We need to set the dormant flag again if we fail to register +the hooks. + +During memory pressure hook registration can fail and we end up +with a table marked as active but no registered hooks. + +On table/base chain deletion, nf_tables will attempt to unregister +the hook again which yields a warn splat from the nftables core. + +Reported-and-tested-by: syzbot+de4025c006ec68ac56fc@syzkaller.appspotmail.com +Fixes: 179d9ba5559a ("netfilter: nf_tables: fix table flag updates") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 6c83d3e169c9c..c5dbb950822fd 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -951,6 +951,7 @@ static int nf_tables_updtable(struct nft_ctx *ctx) + return 0; + + err_register_hooks: ++ ctx->table->flags |= NFT_TABLE_F_DORMANT; + nft_trans_destroy(trans); + return ret; + } +-- +2.43.0 + diff --git a/queue-5.4/nouveau-fix-function-cast-warnings.patch b/queue-5.4/nouveau-fix-function-cast-warnings.patch new file mode 100644 index 00000000000..4abc1af49a6 --- /dev/null +++ b/queue-5.4/nouveau-fix-function-cast-warnings.patch @@ -0,0 +1,54 @@ +From 66ad66ace65e4e4da1191fa62d1501936386b7d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 10:57:37 +0100 +Subject: nouveau: fix function cast warnings + +From: Arnd Bergmann + +[ Upstream commit 0affdba22aca5573f9d989bcb1d71d32a6a03efe ] + +clang-16 warns about casting between incompatible function types: + +drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c:161:10: error: cast from 'void (*)(const struct firmware *)' to 'void (*)(void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict] + 161 | .fini = (void(*)(void *))release_firmware, + +This one was done to use the generic shadow_fw_release() function as a +callback for struct nvbios_source. Change it to use the same prototype +as the other five instances, with a trivial helper function that actually +calls release_firmware. + +Fixes: 70c0f263cc2e ("drm/nouveau/bios: pull in basic vbios subdev, more to come later") +Signed-off-by: Arnd Bergmann +Signed-off-by: Danilo Krummrich +Link: https://patchwork.freedesktop.org/patch/msgid/20240213095753.455062-1-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c +index 4b571cc6bc70f..6597def18627e 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c +@@ -154,11 +154,17 @@ shadow_fw_init(struct nvkm_bios *bios, const char *name) + return (void *)fw; + } + ++static void ++shadow_fw_release(void *fw) ++{ ++ release_firmware(fw); ++} ++ + static const struct nvbios_source + shadow_fw = { + .name = "firmware", + .init = shadow_fw_init, +- .fini = (void(*)(void *))release_firmware, ++ .fini = shadow_fw_release, + .read = shadow_fw_read, + .rw = false, + }; +-- +2.43.0 + diff --git a/queue-5.4/packet-move-from-strlcpy-with-unused-retval-to-strsc.patch b/queue-5.4/packet-move-from-strlcpy-with-unused-retval-to-strsc.patch new file mode 100644 index 00000000000..7e2ea197d6d --- /dev/null +++ b/queue-5.4/packet-move-from-strlcpy-with-unused-retval-to-strsc.patch @@ -0,0 +1,48 @@ +From 66789dfe4fc040c7a0a222734292fa2389d9b9da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Aug 2022 23:02:27 +0200 +Subject: packet: move from strlcpy with unused retval to strscpy + +From: Wolfram Sang + +[ Upstream commit 8fc9d51ea2d32a05f7d7cf86a25cc86ecc57eb45 ] + +Follow the advice of the below link and prefer 'strscpy' in this +subsystem. Conversion is 1:1 because the return value is not used. +Generated by a coccinelle script. + +Link: https://lore.kernel.org/r/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmknw@mail.gmail.com/ +Signed-off-by: Wolfram Sang +Link: https://lore.kernel.org/r/20220818210227.8611-1-wsa+renesas@sang-engineering.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: a7d6027790ac ("arp: Prevent overflow in arp_req_get().") +Signed-off-by: Sasha Levin +--- + net/packet/af_packet.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 600a84a5c582a..451f9c43b34b8 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -1850,7 +1850,7 @@ static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev, + */ + + spkt->spkt_family = dev->type; +- strlcpy(spkt->spkt_device, dev->name, sizeof(spkt->spkt_device)); ++ strscpy(spkt->spkt_device, dev->name, sizeof(spkt->spkt_device)); + spkt->spkt_protocol = skb->protocol; + + /* +@@ -3511,7 +3511,7 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr, + rcu_read_lock(); + dev = dev_get_by_index_rcu(sock_net(sk), READ_ONCE(pkt_sk(sk)->ifindex)); + if (dev) +- strlcpy(uaddr->sa_data, dev->name, sizeof(uaddr->sa_data)); ++ strscpy(uaddr->sa_data, dev->name, sizeof(uaddr->sa_data)); + rcu_read_unlock(); + + return sizeof(*uaddr); +-- +2.43.0 + diff --git a/queue-5.4/rdma-bnxt_re-return-error-for-srq-resize.patch b/queue-5.4/rdma-bnxt_re-return-error-for-srq-resize.patch new file mode 100644 index 00000000000..a4c4eb63058 --- /dev/null +++ b/queue-5.4/rdma-bnxt_re-return-error-for-srq-resize.patch @@ -0,0 +1,53 @@ +From 1f3e2128daaef2423f20e5e7cf093358b6b1f4d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jan 2024 20:54:36 -0800 +Subject: RDMA/bnxt_re: Return error for SRQ resize + +From: Kalesh AP + +[ Upstream commit 3687b450c5f32e80f179ce4b09e0454da1449eac ] + +SRQ resize is not supported in the driver. But driver is not +returning error from bnxt_re_modify_srq() for SRQ resize. + +Fixes: 37cb11acf1f7 ("RDMA/bnxt_re: Add SRQ support for Broadcom adapters") +Signed-off-by: Kalesh AP +Signed-off-by: Selvin Xavier +Link: https://lore.kernel.org/r/1705985677-15551-5-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +index 183f1c3c1f5ef..c9a7c03403ac0 100644 +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +@@ -1623,7 +1623,7 @@ int bnxt_re_modify_srq(struct ib_srq *ib_srq, struct ib_srq_attr *srq_attr, + switch (srq_attr_mask) { + case IB_SRQ_MAX_WR: + /* SRQ resize is not supported */ +- break; ++ return -EINVAL; + case IB_SRQ_LIMIT: + /* Change the SRQ threshold */ + if (srq_attr->srq_limit > srq->qplib_srq.max_wqe) +@@ -1638,13 +1638,12 @@ int bnxt_re_modify_srq(struct ib_srq *ib_srq, struct ib_srq_attr *srq_attr, + /* On success, update the shadow */ + srq->srq_limit = srq_attr->srq_limit; + /* No need to Build and send response back to udata */ +- break; ++ return 0; + default: + dev_err(rdev_to_dev(rdev), + "Unsupported srq_attr_mask 0x%x", srq_attr_mask); + return -EINVAL; + } +- return 0; + } + + int bnxt_re_query_srq(struct ib_srq *ib_srq, struct ib_srq_attr *srq_attr) +-- +2.43.0 + diff --git a/queue-5.4/rdma-srpt-fix-function-pointer-cast-warnings.patch b/queue-5.4/rdma-srpt-fix-function-pointer-cast-warnings.patch new file mode 100644 index 00000000000..729efdd00c8 --- /dev/null +++ b/queue-5.4/rdma-srpt-fix-function-pointer-cast-warnings.patch @@ -0,0 +1,60 @@ +From 27be4d398dbcb400f954b4ed2801dd82fd198f0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 11:07:13 +0100 +Subject: RDMA/srpt: fix function pointer cast warnings + +From: Arnd Bergmann + +[ Upstream commit eb5c7465c3240151cd42a55c7ace9da0026308a1 ] + +clang-16 notices that srpt_qp_event() gets called through an incompatible +pointer here: + +drivers/infiniband/ulp/srpt/ib_srpt.c:1815:5: error: cast from 'void (*)(struct ib_event *, struct srpt_rdma_ch *)' to 'void (*)(struct ib_event *, void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict] + 1815 | = (void(*)(struct ib_event *, void*))srpt_qp_event; + +Change srpt_qp_event() to use the correct prototype and adjust the +argument inside of it. + +Fixes: a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20240213100728.458348-1-arnd@kernel.org +Reviewed-by: Bart Van Assche +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/srpt/ib_srpt.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c +index ccd9811c6c1e2..d03a4f2e006fb 100644 +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -213,10 +213,12 @@ static const char *get_ch_state_name(enum rdma_ch_state s) + /** + * srpt_qp_event - QP event callback function + * @event: Description of the event that occurred. +- * @ch: SRPT RDMA channel. ++ * @ptr: SRPT RDMA channel. + */ +-static void srpt_qp_event(struct ib_event *event, struct srpt_rdma_ch *ch) ++static void srpt_qp_event(struct ib_event *event, void *ptr) + { ++ struct srpt_rdma_ch *ch = ptr; ++ + pr_debug("QP event %d on ch=%p sess_name=%s-%d state=%s\n", + event->event, ch, ch->sess_name, ch->qp->qp_num, + get_ch_state_name(ch->state)); +@@ -1802,8 +1804,7 @@ static int srpt_create_ch_ib(struct srpt_rdma_ch *ch) + } + + qp_init->qp_context = (void *)ch; +- qp_init->event_handler +- = (void(*)(struct ib_event *, void*))srpt_qp_event; ++ qp_init->event_handler = srpt_qp_event; + qp_init->send_cq = ch->cq; + qp_init->recv_cq = ch->cq; + qp_init->sq_sig_type = IB_SIGNAL_REQ_WR; +-- +2.43.0 + diff --git a/queue-5.4/rdma-srpt-make-debug-output-more-detailed.patch b/queue-5.4/rdma-srpt-make-debug-output-more-detailed.patch new file mode 100644 index 00000000000..6aa00a4cad9 --- /dev/null +++ b/queue-5.4/rdma-srpt-make-debug-output-more-detailed.patch @@ -0,0 +1,53 @@ +From a70716a39f2c4bf1af379a8b794c2f960a232901 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 May 2020 10:22:10 -0700 +Subject: RDMA/srpt: Make debug output more detailed + +From: Bart Van Assche + +[ Upstream commit d4ee7f3a4445ec1b0b88af216f4032c4d30abf5a ] + +Since the session name by itself is not sufficient to uniquely identify a +queue pair, include the queue pair number. Show the ASCII channel state +name instead of the numeric value. This change makes the ib_srpt debug +output more consistent. + +Link: https://lore.kernel.org/r/20200525172212.14413-3-bvanassche@acm.org +Signed-off-by: Bart Van Assche +Signed-off-by: Jason Gunthorpe +Stable-dep-of: eb5c7465c324 ("RDMA/srpt: fix function pointer cast warnings") +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/srpt/ib_srpt.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c +index 2822ca5e82779..ccd9811c6c1e2 100644 +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -217,8 +217,9 @@ static const char *get_ch_state_name(enum rdma_ch_state s) + */ + static void srpt_qp_event(struct ib_event *event, struct srpt_rdma_ch *ch) + { +- pr_debug("QP event %d on ch=%p sess_name=%s state=%d\n", +- event->event, ch, ch->sess_name, ch->state); ++ pr_debug("QP event %d on ch=%p sess_name=%s-%d state=%s\n", ++ event->event, ch, ch->sess_name, ch->qp->qp_num, ++ get_ch_state_name(ch->state)); + + switch (event->event) { + case IB_EVENT_COMM_EST: +@@ -2005,8 +2006,8 @@ static void __srpt_close_all_ch(struct srpt_port *sport) + list_for_each_entry(nexus, &sport->nexus_list, entry) { + list_for_each_entry(ch, &nexus->ch_list, list) { + if (srpt_disconnect_ch(ch) >= 0) +- pr_info("Closing channel %s because target %s_%d has been disabled\n", +- ch->sess_name, ++ pr_info("Closing channel %s-%d because target %s_%d has been disabled\n", ++ ch->sess_name, ch->qp->qp_num, + dev_name(&sport->sdev->device->dev), + sport->port); + srpt_close_ch(ch); +-- +2.43.0 + diff --git a/queue-5.4/s390-use-the-correct-count-for-__iowrite64_copy.patch b/queue-5.4/s390-use-the-correct-count-for-__iowrite64_copy.patch new file mode 100644 index 00000000000..d1aa8449056 --- /dev/null +++ b/queue-5.4/s390-use-the-correct-count-for-__iowrite64_copy.patch @@ -0,0 +1,39 @@ +From 422f78d1080194c9bfe6d9449cb97456658e10f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 20:48:14 -0400 +Subject: s390: use the correct count for __iowrite64_copy() + +From: Jason Gunthorpe + +[ Upstream commit 723a2cc8d69d4342b47dfddbfe6c19f1b135f09b ] + +The signature for __iowrite64_copy() requires the number of 64 bit +quantities, not bytes. Multiple by 8 to get to a byte length before +invoking zpci_memcpy_toio() + +Fixes: 87bc359b9822 ("s390/pci: speed up __iowrite64_copy by using pci store block insn") +Acked-by: Niklas Schnelle +Signed-off-by: Jason Gunthorpe +Link: https://lore.kernel.org/r/0-v1-9223d11a7662+1d7785-s390_iowrite64_jgg@nvidia.com +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/pci/pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c +index b8ddacf1efe11..8d241f3c3b78b 100644 +--- a/arch/s390/pci/pci.c ++++ b/arch/s390/pci/pci.c +@@ -223,7 +223,7 @@ resource_size_t pcibios_align_resource(void *data, const struct resource *res, + /* combine single writes by using store-block insn */ + void __iowrite64_copy(void __iomem *to, const void *from, size_t count) + { +- zpci_memcpy_toio(to, from, count); ++ zpci_memcpy_toio(to, from, count * 8); + } + + void __iomem *ioremap(unsigned long ioaddr, unsigned long size) +-- +2.43.0 + diff --git a/queue-5.4/scripts-bpf-teach-bpf_helpers_doc.py-to-dump-bpf-hel.patch b/queue-5.4/scripts-bpf-teach-bpf_helpers_doc.py-to-dump-bpf-hel.patch new file mode 100644 index 00000000000..d7074c28579 --- /dev/null +++ b/queue-5.4/scripts-bpf-teach-bpf_helpers_doc.py-to-dump-bpf-hel.patch @@ -0,0 +1,201 @@ +From 3b32be33273af19784c071482fbd0b3755701a4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Oct 2019 20:07:37 -0700 +Subject: scripts/bpf: teach bpf_helpers_doc.py to dump BPF helper definitions + +From: Andrii Nakryiko + +[ Upstream commit 7a387bed47f7e80e257d966cd64a3e92a63e26a1 ] + +Enhance scripts/bpf_helpers_doc.py to emit C header with BPF helper +definitions (to be included from libbpf's bpf_helpers.h). + +Signed-off-by: Andrii Nakryiko +Signed-off-by: Alexei Starovoitov +Stable-dep-of: e37243b65d52 ("bpf, scripts: Correct GPL license name") +Signed-off-by: Sasha Levin +--- + scripts/bpf_helpers_doc.py | 155 ++++++++++++++++++++++++++++++++++++- + 1 file changed, 154 insertions(+), 1 deletion(-) + +diff --git a/scripts/bpf_helpers_doc.py b/scripts/bpf_helpers_doc.py +index 894cc58c1a034..15d3d83d6297c 100755 +--- a/scripts/bpf_helpers_doc.py ++++ b/scripts/bpf_helpers_doc.py +@@ -391,6 +391,154 @@ SEE ALSO + + print('') + ++class PrinterHelpers(Printer): ++ """ ++ A printer for dumping collected information about helpers as C header to ++ be included from BPF program. ++ @helpers: array of Helper objects to print to standard output ++ """ ++ ++ type_fwds = [ ++ 'struct bpf_fib_lookup', ++ 'struct bpf_perf_event_data', ++ 'struct bpf_perf_event_value', ++ 'struct bpf_sock', ++ 'struct bpf_sock_addr', ++ 'struct bpf_sock_ops', ++ 'struct bpf_sock_tuple', ++ 'struct bpf_spin_lock', ++ 'struct bpf_sysctl', ++ 'struct bpf_tcp_sock', ++ 'struct bpf_tunnel_key', ++ 'struct bpf_xfrm_state', ++ 'struct pt_regs', ++ 'struct sk_reuseport_md', ++ 'struct sockaddr', ++ 'struct tcphdr', ++ ++ 'struct __sk_buff', ++ 'struct sk_msg_md', ++ 'struct xpd_md', ++ ] ++ known_types = { ++ '...', ++ 'void', ++ 'const void', ++ 'char', ++ 'const char', ++ 'int', ++ 'long', ++ 'unsigned long', ++ ++ '__be16', ++ '__be32', ++ '__wsum', ++ ++ 'struct bpf_fib_lookup', ++ 'struct bpf_perf_event_data', ++ 'struct bpf_perf_event_value', ++ 'struct bpf_sock', ++ 'struct bpf_sock_addr', ++ 'struct bpf_sock_ops', ++ 'struct bpf_sock_tuple', ++ 'struct bpf_spin_lock', ++ 'struct bpf_sysctl', ++ 'struct bpf_tcp_sock', ++ 'struct bpf_tunnel_key', ++ 'struct bpf_xfrm_state', ++ 'struct pt_regs', ++ 'struct sk_reuseport_md', ++ 'struct sockaddr', ++ 'struct tcphdr', ++ } ++ mapped_types = { ++ 'u8': '__u8', ++ 'u16': '__u16', ++ 'u32': '__u32', ++ 'u64': '__u64', ++ 's8': '__s8', ++ 's16': '__s16', ++ 's32': '__s32', ++ 's64': '__s64', ++ 'size_t': 'unsigned long', ++ 'struct bpf_map': 'void', ++ 'struct sk_buff': 'struct __sk_buff', ++ 'const struct sk_buff': 'const struct __sk_buff', ++ 'struct sk_msg_buff': 'struct sk_msg_md', ++ 'struct xdp_buff': 'struct xdp_md', ++ } ++ ++ def print_header(self): ++ header = '''\ ++/* This is auto-generated file. See bpf_helpers_doc.py for details. */ ++ ++/* Forward declarations of BPF structs */''' ++ ++ print(header) ++ for fwd in self.type_fwds: ++ print('%s;' % fwd) ++ print('') ++ ++ def print_footer(self): ++ footer = '' ++ print(footer) ++ ++ def map_type(self, t): ++ if t in self.known_types: ++ return t ++ if t in self.mapped_types: ++ return self.mapped_types[t] ++ print("") ++ print("Unrecognized type '%s', please add it to known types!" % t) ++ sys.exit(1) ++ ++ seen_helpers = set() ++ ++ def print_one(self, helper): ++ proto = helper.proto_break_down() ++ ++ if proto['name'] in self.seen_helpers: ++ return ++ self.seen_helpers.add(proto['name']) ++ ++ print('/*') ++ print(" * %s" % proto['name']) ++ print(" *") ++ if (helper.desc): ++ # Do not strip all newline characters: formatted code at the end of ++ # a section must be followed by a blank line. ++ for line in re.sub('\n$', '', helper.desc, count=1).split('\n'): ++ print(' *{}{}'.format(' \t' if line else '', line)) ++ ++ if (helper.ret): ++ print(' *') ++ print(' * Returns') ++ for line in helper.ret.rstrip().split('\n'): ++ print(' *{}{}'.format(' \t' if line else '', line)) ++ ++ print(' */') ++ print('static %s %s(*%s)(' % (self.map_type(proto['ret_type']), ++ proto['ret_star'], proto['name']), end='') ++ comma = '' ++ for i, a in enumerate(proto['args']): ++ t = a['type'] ++ n = a['name'] ++ if proto['name'] == 'bpf_get_socket_cookie' and i == 0: ++ t = 'void' ++ n = 'ctx' ++ one_arg = '{}{}'.format(comma, self.map_type(t)) ++ if n: ++ if a['star']: ++ one_arg += ' {}'.format(a['star']) ++ else: ++ one_arg += ' ' ++ one_arg += '{}'.format(n) ++ comma = ', ' ++ print(one_arg, end='') ++ ++ print(') = (void *) %d;' % len(self.seen_helpers)) ++ print('') ++ + ############################################################################### + + # If script is launched from scripts/ from kernel tree and can access +@@ -405,6 +553,8 @@ Parse eBPF header file and generate documentation for eBPF helper functions. + The RST-formatted output produced can be turned into a manual page with the + rst2man utility. + """) ++argParser.add_argument('--header', action='store_true', ++ help='generate C header file') + if (os.path.isfile(bpfh)): + argParser.add_argument('--filename', help='path to include/uapi/linux/bpf.h', + default=bpfh) +@@ -417,5 +567,8 @@ headerParser = HeaderParser(args.filename) + headerParser.run() + + # Print formatted output to standard output. +-printer = PrinterRST(headerParser.helpers) ++if args.header: ++ printer = PrinterHelpers(headerParser.helpers) ++else: ++ printer = PrinterRST(headerParser.helpers) + printer.print_all() +-- +2.43.0 + diff --git a/queue-5.4/scsi-jazz_esp-only-build-if-scsi-core-is-builtin.patch b/queue-5.4/scsi-jazz_esp-only-build-if-scsi-core-is-builtin.patch new file mode 100644 index 00000000000..1b45d20f601 --- /dev/null +++ b/queue-5.4/scsi-jazz_esp-only-build-if-scsi-core-is-builtin.patch @@ -0,0 +1,54 @@ +From a20baf2ebc056e9a4d2e356c1dffe5c2e626d158 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 21:59:53 -0800 +Subject: scsi: jazz_esp: Only build if SCSI core is builtin + +From: Randy Dunlap + +[ Upstream commit 9ddf190a7df77b77817f955fdb9c2ae9d1c9c9a3 ] + +JAZZ_ESP is a bool kconfig symbol that selects SCSI_SPI_ATTRS. When +CONFIG_SCSI=m, this results in SCSI_SPI_ATTRS=m while JAZZ_ESP=y, which +causes many undefined symbol linker errors. + +Fix this by only offering to build this driver when CONFIG_SCSI=y. + +[mkp: JAZZ_ESP is unique in that it does not support being compiled as a +module unlike the remaining SPI SCSI HBA drivers] + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Randy Dunlap +Link: https://lore.kernel.org/r/20240214055953.9612-1-rdunlap@infradead.org +Cc: Thomas Bogendoerfer +Cc: linux-mips@vger.kernel.org +Cc: Arnd Bergmann +Cc: Masahiro Yamada +Cc: Nicolas Schier +Cc: James E.J. Bottomley +Cc: Martin K. Petersen +Cc: linux-scsi@vger.kernel.org +Cc: Geert Uytterhoeven +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202402112222.Gl0udKyU-lkp@intel.com/ +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig +index 51bbc858a944c..cab6e67ea606b 100644 +--- a/drivers/scsi/Kconfig ++++ b/drivers/scsi/Kconfig +@@ -1286,7 +1286,7 @@ source "drivers/scsi/arm/Kconfig" + + config JAZZ_ESP + bool "MIPS JAZZ FAS216 SCSI support" +- depends on MACH_JAZZ && SCSI ++ depends on MACH_JAZZ && SCSI=y + select SCSI_SPI_ATTRS + help + This is the driver for the onboard SCSI host adapter of MIPS Magnum +-- +2.43.0 + diff --git a/queue-5.4/series b/queue-5.4/series index cf5e88155ef..ffc3cb2022b 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -58,3 +58,23 @@ usb-cdns3-fixed-memory-use-after-free-at-cdns3_gadget_ep_disable.patch usb-cdns3-fix-memory-double-free-when-handle-zero-packet.patch usb-gadget-ncm-avoid-dropping-datagrams-of-properly-parsed-ntbs.patch usb-roles-don-t-get-set_role-when-usb_role_switch-is-unregistered.patch +ib-hfi1-fix-a-memleak-in-init_credit_return.patch +rdma-bnxt_re-return-error-for-srq-resize.patch +rdma-srpt-make-debug-output-more-detailed.patch +rdma-srpt-fix-function-pointer-cast-warnings.patch +scripts-bpf-teach-bpf_helpers_doc.py-to-dump-bpf-hel.patch +bpf-scripts-correct-gpl-license-name.patch +scsi-jazz_esp-only-build-if-scsi-core-is-builtin.patch +nouveau-fix-function-cast-warnings.patch +ipv4-properly-combine-dev_base_seq-and-ipv4.dev_addr.patch +ipv6-properly-combine-dev_base_seq-and-ipv6.dev_addr.patch +afs-increase-buffer-size-in-afs_update_volume_status.patch +ipv6-sr-fix-possible-use-after-free-and-null-ptr-der.patch +packet-move-from-strlcpy-with-unused-retval-to-strsc.patch +s390-use-the-correct-count-for-__iowrite64_copy.patch +tls-rx-jump-to-a-more-appropriate-label.patch +tls-rx-drop-pointless-else-after-goto.patch +tls-stop-recv-if-initial-process_rx_list-gave-us-non.patch +netfilter-nf_tables-set-dormant-flag-on-hook-registe.patch +drm-syncobj-make-lockdep-complain-on-wait_for_submit.patch +drm-syncobj-call-drm_syncobj_fence_add_wait-when-wai.patch diff --git a/queue-5.4/tls-rx-drop-pointless-else-after-goto.patch b/queue-5.4/tls-rx-drop-pointless-else-after-goto.patch new file mode 100644 index 00000000000..9e2492f17bb --- /dev/null +++ b/queue-5.4/tls-rx-drop-pointless-else-after-goto.patch @@ -0,0 +1,39 @@ +From dc67caebe13b0c9ef56e3fe7420c91aa26ae9ec2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 20:38:15 -0700 +Subject: tls: rx: drop pointless else after goto + +From: Jakub Kicinski + +[ Upstream commit d5123edd10cf9d324fcb88e276bdc7375f3c5321 ] + +Pointless else branch after goto makes the code harder to refactor +down the line. + +Signed-off-by: Jakub Kicinski +Signed-off-by: David S. Miller +Stable-dep-of: fdfbaec5923d ("tls: stop recv() if initial process_rx_list gave us non-DATA") +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 606a51237c50f..fb7428f222a8f 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1777,10 +1777,9 @@ int tls_sw_recvmsg(struct sock *sk, + if (err < 0) { + tls_err_abort(sk, err); + goto end; +- } else { +- copied = err; + } + ++ copied = err; + if (len <= copied) + goto end; + +-- +2.43.0 + diff --git a/queue-5.4/tls-rx-jump-to-a-more-appropriate-label.patch b/queue-5.4/tls-rx-jump-to-a-more-appropriate-label.patch new file mode 100644 index 00000000000..be43158173d --- /dev/null +++ b/queue-5.4/tls-rx-jump-to-a-more-appropriate-label.patch @@ -0,0 +1,64 @@ +From c1198c25292d4bca2ce28a60f827c879408613d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 20:38:14 -0700 +Subject: tls: rx: jump to a more appropriate label + +From: Jakub Kicinski + +[ Upstream commit bfc06e1aaa130b86a81ce3c41ec71a2f5e191690 ] + +'recv_end:' checks num_async and decrypted, and is then followed +by the 'end' label. Since we know that decrypted and num_async +are 0 at the start we can jump to 'end'. + +Move the init of decrypted and num_async to let the compiler +catch if I'm wrong. + +Signed-off-by: Jakub Kicinski +Signed-off-by: David S. Miller +Stable-dep-of: fdfbaec5923d ("tls: stop recv() if initial process_rx_list gave us non-DATA") +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 38592d0871a3f..606a51237c50f 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1748,6 +1748,7 @@ int tls_sw_recvmsg(struct sock *sk, + struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx); + struct tls_prot_info *prot = &tls_ctx->prot_info; + struct sk_psock *psock; ++ int num_async, pending; + unsigned char control = 0; + ssize_t decrypted = 0; + struct strp_msg *rxm; +@@ -1760,8 +1761,6 @@ int tls_sw_recvmsg(struct sock *sk, + bool is_kvec = iov_iter_is_kvec(&msg->msg_iter); + bool is_peek = flags & MSG_PEEK; + bool bpf_strp_enabled; +- int num_async = 0; +- int pending; + + flags |= nonblock; + +@@ -1783,12 +1782,14 @@ int tls_sw_recvmsg(struct sock *sk, + } + + if (len <= copied) +- goto recv_end; ++ goto end; + + target = sock_rcvlowat(sk, flags & MSG_WAITALL, len); + len = len - copied; + timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT); + ++ decrypted = 0; ++ num_async = 0; + while (len && (decrypted + copied < target || ctx->recv_pkt)) { + bool retain_skb = false; + bool zc = false; +-- +2.43.0 + diff --git a/queue-5.4/tls-stop-recv-if-initial-process_rx_list-gave-us-non.patch b/queue-5.4/tls-stop-recv-if-initial-process_rx_list-gave-us-non.patch new file mode 100644 index 00000000000..c5d283f4ef0 --- /dev/null +++ b/queue-5.4/tls-stop-recv-if-initial-process_rx_list-gave-us-non.patch @@ -0,0 +1,44 @@ +From 1cf42821be21152e5b6e0f3847c439ffec22c3bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Feb 2024 17:17:30 +0100 +Subject: tls: stop recv() if initial process_rx_list gave us non-DATA + +From: Sabrina Dubroca + +[ Upstream commit fdfbaec5923d9359698cbb286bc0deadbb717504 ] + +If we have a non-DATA record on the rx_list and another record of the +same type still on the queue, we will end up merging them: + - process_rx_list copies the non-DATA record + - we start the loop and process the first available record since it's + of the same type + - we break out of the loop since the record was not DATA + +Just check the record type and jump to the end in case process_rx_list +did some work. + +Fixes: 692d7b5d1f91 ("tls: Fix recvmsg() to be able to peek across multiple records") +Signed-off-by: Sabrina Dubroca +Link: https://lore.kernel.org/r/bd31449e43bd4b6ff546f5c51cf958c31c511deb.1708007371.git.sd@queasysnail.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index fb7428f222a8f..910da98d6bfb3 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1780,7 +1780,7 @@ int tls_sw_recvmsg(struct sock *sk, + } + + copied = err; +- if (len <= copied) ++ if (len <= copied || (copied && control != TLS_RECORD_TYPE_DATA)) + goto end; + + target = sock_rcvlowat(sk, flags & MSG_WAITALL, len); +-- +2.43.0 +