From: Sasha Levin Date: Mon, 27 Jun 2022 03:09:31 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v5.10.126~7 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=dbac12b8401d36fc20a053e0ecc2001760d21a36;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/afs-fix-dynamic-root-getattr.patch b/queue-5.4/afs-fix-dynamic-root-getattr.patch new file mode 100644 index 00000000000..d80cf3eaa79 --- /dev/null +++ b/queue-5.4/afs-fix-dynamic-root-getattr.patch @@ -0,0 +1,59 @@ +From e6b94a0c967a03017efa1ba9611ab01c0b55e035 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jun 2022 15:59:57 +0100 +Subject: afs: Fix dynamic root getattr + +From: David Howells + +[ Upstream commit cb78d1b5efffe4cf97e16766329dd7358aed3deb ] + +The recent patch to make afs_getattr consult the server didn't account +for the pseudo-inodes employed by the dynamic root-type afs superblock +not having a volume or a server to access, and thus an oops occurs if +such a directory is stat'd. + +Fix this by checking to see if the vnode->volume pointer actually points +anywhere before following it in afs_getattr(). + +This can be tested by stat'ing a directory in /afs. It may be +sufficient just to do "ls /afs" and the oops looks something like: + + BUG: kernel NULL pointer dereference, address: 0000000000000020 + ... + RIP: 0010:afs_getattr+0x8b/0x14b + ... + Call Trace: + + vfs_statx+0x79/0xf5 + vfs_fstatat+0x49/0x62 + +Fixes: 2aeb8c86d499 ("afs: Fix afs_getattr() to refetch file status if callback break occurred") +Reported-by: Marc Dionne +Signed-off-by: David Howells +Reviewed-by: Marc Dionne +Tested-by: Marc Dionne +cc: linux-afs@lists.infradead.org +Link: https://lore.kernel.org/r/165408450783.1031787.7941404776393751186.stgit@warthog.procyon.org.uk/ +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/afs/inode.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/afs/inode.c b/fs/afs/inode.c +index 90eac3ec01cb..622363af4c1b 100644 +--- a/fs/afs/inode.c ++++ b/fs/afs/inode.c +@@ -739,7 +739,8 @@ int afs_getattr(const struct path *path, struct kstat *stat, + + _enter("{ ino=%lu v=%u }", inode->i_ino, inode->i_generation); + +- if (!(query_flags & AT_STATX_DONT_SYNC) && ++ if (vnode->volume && ++ !(query_flags & AT_STATX_DONT_SYNC) && + !test_bit(AFS_VNODE_CB_PROMISED, &vnode->flags)) { + key = afs_request_key(vnode->volume->cell); + if (IS_ERR(key)) +-- +2.35.1 + diff --git a/queue-5.4/bonding-arp-monitor-spams-netdev_notify_peers-notifi.patch b/queue-5.4/bonding-arp-monitor-spams-netdev_notify_peers-notifi.patch new file mode 100644 index 00000000000..122d7028f4e --- /dev/null +++ b/queue-5.4/bonding-arp-monitor-spams-netdev_notify_peers-notifi.patch @@ -0,0 +1,48 @@ +From 278c13c1b8d6f3472f25015c7654213c6bc6277a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jun 2022 12:32:40 -0700 +Subject: bonding: ARP monitor spams NETDEV_NOTIFY_PEERS notifiers + +From: Jay Vosburgh + +[ Upstream commit 7a9214f3d88cfdb099f3896e102a306b316d8707 ] + +The bonding ARP monitor fails to decrement send_peer_notif, the +number of peer notifications (gratuitous ARP or ND) to be sent. This +results in a continuous series of notifications. + +Correct this by decrementing the counter for each notification. + +Reported-by: Jonathan Toppins +Signed-off-by: Jay Vosburgh +Fixes: b0929915e035 ("bonding: Fix RTNL: assertion failed at net/core/rtnetlink.c for ab arp monitor") +Link: https://lore.kernel.org/netdev/b2fd4147-8f50-bebd-963a-1a3e8d1d9715@redhat.com/ +Tested-by: Jonathan Toppins +Reviewed-by: Jonathan Toppins +Link: https://lore.kernel.org/r/9400.1655407960@famine +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index d6ecd03b6045..246bcbd650b4 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -3071,9 +3071,11 @@ static void bond_activebackup_arp_mon(struct bonding *bond) + if (!rtnl_trylock()) + return; + +- if (should_notify_peers) ++ if (should_notify_peers) { ++ bond->send_peer_notif--; + call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, + bond->dev); ++ } + if (should_notify_rtnl) { + bond_slave_state_notify(bond); + bond_slave_link_notify(bond); +-- +2.35.1 + diff --git a/queue-5.4/bpf-fix-request_sock-leak-in-sk-lookup-helpers.patch b/queue-5.4/bpf-fix-request_sock-leak-in-sk-lookup-helpers.patch new file mode 100644 index 00000000000..a80b3d31c5f --- /dev/null +++ b/queue-5.4/bpf-fix-request_sock-leak-in-sk-lookup-helpers.patch @@ -0,0 +1,98 @@ +From 778b984da1dae0addee51864ad4f3c2806016365 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jun 2022 11:15:40 +1000 +Subject: bpf: Fix request_sock leak in sk lookup helpers + +From: Jon Maxwell + +[ Upstream commit 3046a827316c0e55fc563b4fb78c93b9ca5c7c37 ] + +A customer reported a request_socket leak in a Calico cloud environment. We +found that a BPF program was doing a socket lookup with takes a refcnt on +the socket and that it was finding the request_socket but returning the parent +LISTEN socket via sk_to_full_sk() without decrementing the child request socket +1st, resulting in request_sock slab object leak. This patch retains the +existing behaviour of returning full socks to the caller but it also decrements +the child request_socket if one is present before doing so to prevent the leak. + +Thanks to Curtis Taylor for all the help in diagnosing and testing this. And +thanks to Antoine Tenart for the reproducer and patch input. + +v2 of this patch contains, refactor as per Daniel Borkmann's suggestions to +validate RCU flags on the listen socket so that it balances with bpf_sk_release() +and update comments as per Martin KaFai Lau's suggestion. One small change to +Daniels suggestion, put "sk = sk2" under "if (sk2 != sk)" to avoid an extra +instruction. + +Fixes: f7355a6c0497 ("bpf: Check sk_fullsock() before returning from bpf_sk_lookup()") +Fixes: edbf8c01de5a ("bpf: add skc_lookup_tcp helper") +Co-developed-by: Antoine Tenart +Signed-off-by: Antoine Tenart +Signed-off-by: Jon Maxwell +Signed-off-by: Daniel Borkmann +Tested-by: Curtis Taylor +Cc: Martin KaFai Lau +Link: https://lore.kernel.org/bpf/56d6f898-bde0-bb25-3427-12a330b29fb8@iogearbox.net +Link: https://lore.kernel.org/bpf/20220615011540.813025-1-jmaxwell37@gmail.com +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 34 ++++++++++++++++++++++++++++------ + 1 file changed, 28 insertions(+), 6 deletions(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index b0df4ddbe30c..eba96343c7af 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -5313,10 +5313,21 @@ __bpf_sk_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len, + ifindex, proto, netns_id, flags); + + if (sk) { +- sk = sk_to_full_sk(sk); +- if (!sk_fullsock(sk)) { ++ struct sock *sk2 = sk_to_full_sk(sk); ++ ++ /* sk_to_full_sk() may return (sk)->rsk_listener, so make sure the original sk ++ * sock refcnt is decremented to prevent a request_sock leak. ++ */ ++ if (!sk_fullsock(sk2)) ++ sk2 = NULL; ++ if (sk2 != sk) { + sock_gen_put(sk); +- return NULL; ++ /* Ensure there is no need to bump sk2 refcnt */ ++ if (unlikely(sk2 && !sock_flag(sk2, SOCK_RCU_FREE))) { ++ WARN_ONCE(1, "Found non-RCU, unreferenced socket!"); ++ return NULL; ++ } ++ sk = sk2; + } + } + +@@ -5350,10 +5361,21 @@ bpf_sk_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len, + flags); + + if (sk) { +- sk = sk_to_full_sk(sk); +- if (!sk_fullsock(sk)) { ++ struct sock *sk2 = sk_to_full_sk(sk); ++ ++ /* sk_to_full_sk() may return (sk)->rsk_listener, so make sure the original sk ++ * sock refcnt is decremented to prevent a request_sock leak. ++ */ ++ if (!sk_fullsock(sk2)) ++ sk2 = NULL; ++ if (sk2 != sk) { + sock_gen_put(sk); +- return NULL; ++ /* Ensure there is no need to bump sk2 refcnt */ ++ if (unlikely(sk2 && !sock_flag(sk2, SOCK_RCU_FREE))) { ++ WARN_ONCE(1, "Found non-RCU, unreferenced socket!"); ++ return NULL; ++ } ++ sk = sk2; + } + } + +-- +2.35.1 + diff --git a/queue-5.4/drm-msm-mdp4-fix-refcount-leak-in-mdp4_modeset_init_.patch b/queue-5.4/drm-msm-mdp4-fix-refcount-leak-in-mdp4_modeset_init_.patch new file mode 100644 index 00000000000..132b1a89670 --- /dev/null +++ b/queue-5.4/drm-msm-mdp4-fix-refcount-leak-in-mdp4_modeset_init_.patch @@ -0,0 +1,50 @@ +From 72c0d0ac35aebb827c7ef930db373e04b1b3bab4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jun 2022 15:08:38 +0400 +Subject: drm/msm/mdp4: Fix refcount leak in mdp4_modeset_init_intf + +From: Miaoqian Lin + +[ Upstream commit b9cc4598607cb7f7eae5c75fc1e3209cd52ff5e0 ] + +of_graph_get_remote_node() returns remote device node pointer with +refcount incremented, we should use of_node_put() on it +when not need anymore. +Add missing of_node_put() to avoid refcount leak. + +Fixes: 86418f90a4c1 ("drm: convert drivers to use of_graph_get_remote_node") +Signed-off-by: Miaoqian Lin +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Stephen Boyd +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/488473/ +Link: https://lore.kernel.org/r/20220607110841.53889-1-linmq006@gmail.com +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c +index 4f0c6d58e06f..f0a5767b69f5 100644 +--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c ++++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c +@@ -245,6 +245,7 @@ static int mdp4_modeset_init_intf(struct mdp4_kms *mdp4_kms, + encoder = mdp4_lcdc_encoder_init(dev, panel_node); + if (IS_ERR(encoder)) { + DRM_DEV_ERROR(dev->dev, "failed to construct LCDC encoder\n"); ++ of_node_put(panel_node); + return PTR_ERR(encoder); + } + +@@ -254,6 +255,7 @@ static int mdp4_modeset_init_intf(struct mdp4_kms *mdp4_kms, + connector = mdp4_lvds_connector_init(dev, panel_node, encoder); + if (IS_ERR(connector)) { + DRM_DEV_ERROR(dev->dev, "failed to initialize LVDS connector\n"); ++ of_node_put(panel_node); + return PTR_ERR(connector); + } + +-- +2.35.1 + diff --git a/queue-5.4/erspan-do-not-assume-transport-header-is-always-set.patch b/queue-5.4/erspan-do-not-assume-transport-header-is-always-set.patch new file mode 100644 index 00000000000..691cdfcd2a6 --- /dev/null +++ b/queue-5.4/erspan-do-not-assume-transport-header-is-always-set.patch @@ -0,0 +1,127 @@ +From 51fd64b529bade07b7b59cd44f5db47b62bbd589 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jun 2022 01:35:06 -0700 +Subject: erspan: do not assume transport header is always set + +From: Eric Dumazet + +[ Upstream commit 301bd140ed0b24f0da660874c7e8a47dad8c8222 ] + +Rewrite tests in ip6erspan_tunnel_xmit() and +erspan_fb_xmit() to not assume transport header is set. + +syzbot reported: + +WARNING: CPU: 0 PID: 1350 at include/linux/skbuff.h:2911 skb_transport_header include/linux/skbuff.h:2911 [inline] +WARNING: CPU: 0 PID: 1350 at include/linux/skbuff.h:2911 ip6erspan_tunnel_xmit+0x15af/0x2eb0 net/ipv6/ip6_gre.c:963 +Modules linked in: +CPU: 0 PID: 1350 Comm: aoe_tx0 Not tainted 5.19.0-rc2-syzkaller-00160-g274295c6e53f #0 +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 +RIP: 0010:skb_transport_header include/linux/skbuff.h:2911 [inline] +RIP: 0010:ip6erspan_tunnel_xmit+0x15af/0x2eb0 net/ipv6/ip6_gre.c:963 +Code: 0f 47 f0 40 88 b5 7f fe ff ff e8 8c 16 4b f9 89 de bf ff ff ff ff e8 a0 12 4b f9 66 83 fb ff 0f 85 1d f1 ff ff e8 71 16 4b f9 <0f> 0b e9 43 f0 ff ff e8 65 16 4b f9 48 8d 85 30 ff ff ff ba 60 00 +RSP: 0018:ffffc90005daf910 EFLAGS: 00010293 +RAX: 0000000000000000 RBX: 000000000000ffff RCX: 0000000000000000 +RDX: ffff88801f032100 RSI: ffffffff882e8d3f RDI: 0000000000000003 +RBP: ffffc90005dafab8 R08: 0000000000000003 R09: 000000000000ffff +R10: 000000000000ffff R11: 0000000000000000 R12: ffff888024f21d40 +R13: 000000000000a288 R14: 00000000000000b0 R15: ffff888025a2e000 +FS: 0000000000000000(0000) GS:ffff88802c800000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000001b2e425000 CR3: 000000006d099000 CR4: 0000000000152ef0 +Call Trace: + +__netdev_start_xmit include/linux/netdevice.h:4805 [inline] +netdev_start_xmit include/linux/netdevice.h:4819 [inline] +xmit_one net/core/dev.c:3588 [inline] +dev_hard_start_xmit+0x188/0x880 net/core/dev.c:3604 +sch_direct_xmit+0x19f/0xbe0 net/sched/sch_generic.c:342 +__dev_xmit_skb net/core/dev.c:3815 [inline] +__dev_queue_xmit+0x14a1/0x3900 net/core/dev.c:4219 +dev_queue_xmit include/linux/netdevice.h:2994 [inline] +tx+0x6a/0xc0 drivers/block/aoe/aoenet.c:63 +kthread+0x1e7/0x3b0 drivers/block/aoe/aoecmd.c:1229 +kthread+0x2e9/0x3a0 kernel/kthread.c:376 +ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 + + +Fixes: d5db21a3e697 ("erspan: auto detect truncated ipv6 packets.") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Cc: William Tu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/ip_gre.c | 15 ++++++++++----- + net/ipv6/ip6_gre.c | 15 ++++++++++----- + 2 files changed, 20 insertions(+), 10 deletions(-) + +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index 614410a6db44..52dbffb7bc2f 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -497,7 +497,6 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev) + int tunnel_hlen; + int version; + int nhoff; +- int thoff; + + tun_info = skb_tunnel_info(skb); + if (unlikely(!tun_info || !(tun_info->mode & IP_TUNNEL_INFO_TX) || +@@ -531,10 +530,16 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev) + (ntohs(ip_hdr(skb)->tot_len) > skb->len - nhoff)) + truncate = true; + +- thoff = skb_transport_header(skb) - skb_mac_header(skb); +- if (skb->protocol == htons(ETH_P_IPV6) && +- (ntohs(ipv6_hdr(skb)->payload_len) > skb->len - thoff)) +- truncate = true; ++ if (skb->protocol == htons(ETH_P_IPV6)) { ++ int thoff; ++ ++ if (skb_transport_header_was_set(skb)) ++ thoff = skb_transport_header(skb) - skb_mac_header(skb); ++ else ++ thoff = nhoff + sizeof(struct ipv6hdr); ++ if (ntohs(ipv6_hdr(skb)->payload_len) > skb->len - thoff) ++ truncate = true; ++ } + + if (version == 1) { + erspan_build_header(skb, ntohl(tunnel_id_to_key32(key->tun_id)), +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c +index e550db28aabb..4a6396d574a0 100644 +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -927,7 +927,6 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb, + __be16 proto; + __u32 mtu; + int nhoff; +- int thoff; + + if (!pskb_inet_may_pull(skb)) + goto tx_err; +@@ -948,10 +947,16 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb, + (ntohs(ip_hdr(skb)->tot_len) > skb->len - nhoff)) + truncate = true; + +- thoff = skb_transport_header(skb) - skb_mac_header(skb); +- if (skb->protocol == htons(ETH_P_IPV6) && +- (ntohs(ipv6_hdr(skb)->payload_len) > skb->len - thoff)) +- truncate = true; ++ if (skb->protocol == htons(ETH_P_IPV6)) { ++ int thoff; ++ ++ if (skb_transport_header_was_set(skb)) ++ thoff = skb_transport_header(skb) - skb_mac_header(skb); ++ else ++ thoff = nhoff + sizeof(struct ipv6hdr); ++ if (ntohs(ipv6_hdr(skb)->payload_len) > skb->len - thoff) ++ truncate = true; ++ } + + if (skb_cow_head(skb, dev->needed_headroom ?: t->hlen)) + goto tx_err; +-- +2.35.1 + diff --git a/queue-5.4/gpio-winbond-fix-error-code-in-winbond_gpio_get.patch b/queue-5.4/gpio-winbond-fix-error-code-in-winbond_gpio_get.patch new file mode 100644 index 00000000000..337d070d850 --- /dev/null +++ b/queue-5.4/gpio-winbond-fix-error-code-in-winbond_gpio_get.patch @@ -0,0 +1,45 @@ +From 99cb557cf526b99586fe91e5843c86fe873c6318 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jun 2022 11:29:48 +0300 +Subject: gpio: winbond: Fix error code in winbond_gpio_get() + +From: Dan Carpenter + +[ Upstream commit 9ca766eaea2e87b8b773bff04ee56c055cb76d4e ] + +This error path returns 1, but it should instead propagate the negative +error code from winbond_sio_enter(). + +Fixes: a0d65009411c ("gpio: winbond: Add driver") +Signed-off-by: Dan Carpenter +Reviewed-by: Andy Shevchenko +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-winbond.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpio/gpio-winbond.c b/drivers/gpio/gpio-winbond.c +index 7f8f5b02e31d..4b61d975cc0e 100644 +--- a/drivers/gpio/gpio-winbond.c ++++ b/drivers/gpio/gpio-winbond.c +@@ -385,12 +385,13 @@ static int winbond_gpio_get(struct gpio_chip *gc, unsigned int offset) + unsigned long *base = gpiochip_get_data(gc); + const struct winbond_gpio_info *info; + bool val; ++ int ret; + + winbond_gpio_get_info(&offset, &info); + +- val = winbond_sio_enter(*base); +- if (val) +- return val; ++ ret = winbond_sio_enter(*base); ++ if (ret) ++ return ret; + + winbond_sio_select_logical(*base, info->dev); + +-- +2.35.1 + diff --git a/queue-5.4/ice-ethtool-advertise-1000m-speeds-properly.patch b/queue-5.4/ice-ethtool-advertise-1000m-speeds-properly.patch new file mode 100644 index 00000000000..efe7c6f811c --- /dev/null +++ b/queue-5.4/ice-ethtool-advertise-1000m-speeds-properly.patch @@ -0,0 +1,86 @@ +From 6715c325abd787f26ff5f942ec9c79805afbea11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jun 2022 09:47:05 +0200 +Subject: ice: ethtool: advertise 1000M speeds properly + +From: Anatolii Gerasymenko + +[ Upstream commit c3d184c83ff4b80167e34edfc3d21df424bf27ff ] + +In current implementation ice_update_phy_type enables all link modes +for selected speed. This approach doesn't work for 1000M speeds, +because both copper (1000baseT) and optical (1000baseX) standards +cannot be enabled at once. + +Fix this, by adding the function `ice_set_phy_type_from_speed()` +for 1000M speeds. + +Fixes: 48cb27f2fd18 ("ice: Implement handlers for ethtool PHY/link operations") +Signed-off-by: Anatolii Gerasymenko +Tested-by: Gurucharan (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_ethtool.c | 39 +++++++++++++++++++- + 1 file changed, 38 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c +index fc9ff985a62b..b297a3ca22fc 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c ++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c +@@ -2337,6 +2337,42 @@ ice_setup_autoneg(struct ice_port_info *p, struct ethtool_link_ksettings *ks, + return err; + } + ++/** ++ * ice_set_phy_type_from_speed - set phy_types based on speeds ++ * and advertised modes ++ * @ks: ethtool link ksettings struct ++ * @phy_type_low: pointer to the lower part of phy_type ++ * @phy_type_high: pointer to the higher part of phy_type ++ * @adv_link_speed: targeted link speeds bitmap ++ */ ++static void ++ice_set_phy_type_from_speed(const struct ethtool_link_ksettings *ks, ++ u64 *phy_type_low, u64 *phy_type_high, ++ u16 adv_link_speed) ++{ ++ /* Handle 1000M speed in a special way because ice_update_phy_type ++ * enables all link modes, but having mixed copper and optical ++ * standards is not supported. ++ */ ++ adv_link_speed &= ~ICE_AQ_LINK_SPEED_1000MB; ++ ++ if (ethtool_link_ksettings_test_link_mode(ks, advertising, ++ 1000baseT_Full)) ++ *phy_type_low |= ICE_PHY_TYPE_LOW_1000BASE_T | ++ ICE_PHY_TYPE_LOW_1G_SGMII; ++ ++ if (ethtool_link_ksettings_test_link_mode(ks, advertising, ++ 1000baseKX_Full)) ++ *phy_type_low |= ICE_PHY_TYPE_LOW_1000BASE_KX; ++ ++ if (ethtool_link_ksettings_test_link_mode(ks, advertising, ++ 1000baseX_Full)) ++ *phy_type_low |= ICE_PHY_TYPE_LOW_1000BASE_SX | ++ ICE_PHY_TYPE_LOW_1000BASE_LX; ++ ++ ice_update_phy_type(phy_type_low, phy_type_high, adv_link_speed); ++} ++ + /** + * ice_set_link_ksettings - Set Speed and Duplex + * @netdev: network interface device structure +@@ -2472,7 +2508,8 @@ ice_set_link_ksettings(struct net_device *netdev, + adv_link_speed = curr_link_speed; + + /* Convert the advertise link speeds to their corresponded PHY_TYPE */ +- ice_update_phy_type(&phy_type_low, &phy_type_high, adv_link_speed); ++ ice_set_phy_type_from_speed(ks, &phy_type_low, &phy_type_high, ++ adv_link_speed); + + if (!autoneg_changed && adv_link_speed == curr_link_speed) { + netdev_info(netdev, "Nothing changed, exiting without setting anything.\n"); +-- +2.35.1 + diff --git a/queue-5.4/igb-make-dma-faster-when-cpu-is-active-on-the-pcie-l.patch b/queue-5.4/igb-make-dma-faster-when-cpu-is-active-on-the-pcie-l.patch new file mode 100644 index 00000000000..aae028a6074 --- /dev/null +++ b/queue-5.4/igb-make-dma-faster-when-cpu-is-active-on-the-pcie-l.patch @@ -0,0 +1,83 @@ +From 23b3291ddd3ce0c682486198c535624ec543d334 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jun 2022 15:10:56 -0700 +Subject: igb: Make DMA faster when CPU is active on the PCIe link + +From: Kai-Heng Feng + +[ Upstream commit 4e0effd9007ea0be31f7488611eb3824b4541554 ] + +Intel I210 on some Intel Alder Lake platforms can only achieve ~750Mbps +Tx speed via iperf. The RR2DCDELAY shows around 0x2xxx DMA delay, which +will be significantly lower when 1) ASPM is disabled or 2) SoC package +c-state stays above PC3. When the RR2DCDELAY is around 0x1xxx the Tx +speed can reach to ~950Mbps. + +According to the I210 datasheet "8.26.1 PCIe Misc. Register - PCIEMISC", +"DMA Idle Indication" doesn't seem to tie to DMA coalesce anymore, so +set it to 1b for "DMA is considered idle when there is no Rx or Tx AND +when there are no TLPs indicating that CPU is active detected on the +PCIe link (such as the host executes CSR or Configuration register read +or write operation)" and performing Tx should also fall under "active +CPU on PCIe link" case. + +In addition to that, commit b6e0c419f040 ("igb: Move DMA Coalescing init +code to separate function.") seems to wrongly changed from enabling +E1000_PCIEMISC_LX_DECISION to disabling it, also fix that. + +Fixes: b6e0c419f040 ("igb: Move DMA Coalescing init code to separate function.") +Signed-off-by: Kai-Heng Feng +Tested-by: Gurucharan (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Link: https://lore.kernel.org/r/20220621221056.604304-1-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igb/igb_main.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c +index 26c8d09ad4dd..8734dfd001bb 100644 +--- a/drivers/net/ethernet/intel/igb/igb_main.c ++++ b/drivers/net/ethernet/intel/igb/igb_main.c +@@ -9404,11 +9404,10 @@ static void igb_init_dmac(struct igb_adapter *adapter, u32 pba) + struct e1000_hw *hw = &adapter->hw; + u32 dmac_thr; + u16 hwm; ++ u32 reg; + + if (hw->mac.type > e1000_82580) { + if (adapter->flags & IGB_FLAG_DMAC) { +- u32 reg; +- + /* force threshold to 0. */ + wr32(E1000_DMCTXTH, 0); + +@@ -9441,7 +9440,6 @@ static void igb_init_dmac(struct igb_adapter *adapter, u32 pba) + /* Disable BMC-to-OS Watchdog Enable */ + if (hw->mac.type != e1000_i354) + reg &= ~E1000_DMACR_DC_BMC2OSW_EN; +- + wr32(E1000_DMACR, reg); + + /* no lower threshold to disable +@@ -9458,12 +9456,12 @@ static void igb_init_dmac(struct igb_adapter *adapter, u32 pba) + */ + wr32(E1000_DMCTXTH, (IGB_MIN_TXPBSIZE - + (IGB_TX_BUF_4096 + adapter->max_frame_size)) >> 6); ++ } + +- /* make low power state decision controlled +- * by DMA coal +- */ ++ if (hw->mac.type >= e1000_i210 || ++ (adapter->flags & IGB_FLAG_DMAC)) { + reg = rd32(E1000_PCIEMISC); +- reg &= ~E1000_PCIEMISC_LX_DECISION; ++ reg |= E1000_PCIEMISC_LX_DECISION; + wr32(E1000_PCIEMISC, reg); + } /* endif adapter->dmac is not disabled */ + } else if (hw->mac.type == e1000_82580) { +-- +2.35.1 + diff --git a/queue-5.4/iio-adc-vf610-fix-conversion-mode-sysfs-node-name.patch b/queue-5.4/iio-adc-vf610-fix-conversion-mode-sysfs-node-name.patch new file mode 100644 index 00000000000..5fc91927226 --- /dev/null +++ b/queue-5.4/iio-adc-vf610-fix-conversion-mode-sysfs-node-name.patch @@ -0,0 +1,35 @@ +From ec8095251471b53b23726038a9f82ed916b3f437 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 May 2022 11:50:26 +0300 +Subject: iio: adc: vf610: fix conversion mode sysfs node name + +From: Baruch Siach + +[ Upstream commit f1a633b15cd5371a2a83f02c513984e51132dd68 ] + +The documentation missed the "in_" prefix for this IIO_SHARED_BY_DIR +entry. + +Fixes: bf04c1a367e3 ("iio: adc: vf610: implement configurable conversion modes") +Signed-off-by: Baruch Siach +Acked-by: Haibo Chen +Link: https://lore.kernel.org/r/560dc93fafe5ef7e9a409885fd20b6beac3973d8.1653900626.git.baruch@tkos.co.il +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + Documentation/ABI/testing/sysfs-bus-iio-vf610 | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Documentation/ABI/testing/sysfs-bus-iio-vf610 b/Documentation/ABI/testing/sysfs-bus-iio-vf610 +index 308a6756d3bf..491ead804488 100644 +--- a/Documentation/ABI/testing/sysfs-bus-iio-vf610 ++++ b/Documentation/ABI/testing/sysfs-bus-iio-vf610 +@@ -1,4 +1,4 @@ +-What: /sys/bus/iio/devices/iio:deviceX/conversion_mode ++What: /sys/bus/iio/devices/iio:deviceX/in_conversion_mode + KernelVersion: 4.2 + Contact: linux-iio@vger.kernel.org + Description: +-- +2.35.1 + diff --git a/queue-5.4/mips-remove-repetitive-increase-irq_err_count.patch b/queue-5.4/mips-remove-repetitive-increase-irq_err_count.patch new file mode 100644 index 00000000000..366ee94d3c2 --- /dev/null +++ b/queue-5.4/mips-remove-repetitive-increase-irq_err_count.patch @@ -0,0 +1,61 @@ +From e35ce02b9127c910f164dba72d73645aaa362f86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jun 2022 19:14:20 +0800 +Subject: MIPS: Remove repetitive increase irq_err_count + +From: huhai + +[ Upstream commit c81aba8fde2aee4f5778ebab3a1d51bd2ef48e4c ] + +commit 979934da9e7a ("[PATCH] mips: update IRQ handling for vr41xx") added +a function irq_dispatch, and it'll increase irq_err_count when the get_irq +callback returns a negative value, but increase irq_err_count in get_irq +was not removed. + +And also, modpost complains once gpio-vr41xx drivers become modules. + ERROR: modpost: "irq_err_count" [drivers/gpio/gpio-vr41xx.ko] undefined! + +So it would be a good idea to remove repetitive increase irq_err_count in +get_irq callback. + +Fixes: 27fdd325dace ("MIPS: Update VR41xx GPIO driver to use gpiolib") +Fixes: 979934da9e7a ("[PATCH] mips: update IRQ handling for vr41xx") +Reported-by: k2ci +Signed-off-by: huhai +Signed-off-by: Genjian Zhang +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/vr41xx/common/icu.c | 2 -- + drivers/gpio/gpio-vr41xx.c | 2 -- + 2 files changed, 4 deletions(-) + +diff --git a/arch/mips/vr41xx/common/icu.c b/arch/mips/vr41xx/common/icu.c +index 7b7f25b4b057..9240bcdbe74e 100644 +--- a/arch/mips/vr41xx/common/icu.c ++++ b/arch/mips/vr41xx/common/icu.c +@@ -640,8 +640,6 @@ static int icu_get_irq(unsigned int irq) + + printk(KERN_ERR "spurious ICU interrupt: %04x,%04x\n", pend1, pend2); + +- atomic_inc(&irq_err_count); +- + return -1; + } + +diff --git a/drivers/gpio/gpio-vr41xx.c b/drivers/gpio/gpio-vr41xx.c +index 98cd715ccc33..8d09b619c166 100644 +--- a/drivers/gpio/gpio-vr41xx.c ++++ b/drivers/gpio/gpio-vr41xx.c +@@ -217,8 +217,6 @@ static int giu_get_irq(unsigned int irq) + printk(KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n", + maskl, pendl, maskh, pendh); + +- atomic_inc(&irq_err_count); +- + return -EINVAL; + } + +-- +2.35.1 + diff --git a/queue-5.4/net-sched-sch_netem-fix-arithmetic-in-netem_dump-for.patch b/queue-5.4/net-sched-sch_netem-fix-arithmetic-in-netem_dump-for.patch new file mode 100644 index 00000000000..1533bc7f312 --- /dev/null +++ b/queue-5.4/net-sched-sch_netem-fix-arithmetic-in-netem_dump-for.patch @@ -0,0 +1,73 @@ +From 9bc1c69969008a593faf298de1df9ae17c21eedc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jun 2022 16:43:36 -0700 +Subject: net/sched: sch_netem: Fix arithmetic in netem_dump() for 32-bit + platforms + +From: Peilin Ye + +[ Upstream commit a2b1a5d40bd12b44322c2ccd40bb0ec1699708b6 ] + +As reported by Yuming, currently tc always show a latency of UINT_MAX +for netem Qdisc's on 32-bit platforms: + + $ tc qdisc add dev dummy0 root netem latency 100ms + $ tc qdisc show dev dummy0 + qdisc netem 8001: root refcnt 2 limit 1000 delay 275s 275s + ^^^^^^^^^^^^^^^^ + +Let us take a closer look at netem_dump(): + + qopt.latency = min_t(psched_tdiff_t, PSCHED_NS2TICKS(q->latency, + UINT_MAX); + +qopt.latency is __u32, psched_tdiff_t is signed long, +(psched_tdiff_t)(UINT_MAX) is negative for 32-bit platforms, so +qopt.latency is always UINT_MAX. + +Fix it by using psched_time_t (u64) instead. + +Note: confusingly, users have two ways to specify 'latency': + + 1. normally, via '__u32 latency' in struct tc_netem_qopt; + 2. via the TCA_NETEM_LATENCY64 attribute, which is s64. + +For the second case, theoretically 'latency' could be negative. This +patch ignores that corner case, since it is broken (i.e. assigning a +negative s64 to __u32) anyways, and should be handled separately. + +Thanks Ted Lin for the analysis [1] . + +[1] https://github.com/raspberrypi/linux/issues/3512 + +Reported-by: Yuming Chen +Fixes: 112f9cb65643 ("netem: convert to qdisc_watchdog_schedule_ns") +Reviewed-by: Cong Wang +Signed-off-by: Peilin Ye +Acked-by: Stephen Hemminger +Link: https://lore.kernel.org/r/20220616234336.2443-1-yepeilin.cs@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/sch_netem.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c +index f4101a920d1f..1802f134aa40 100644 +--- a/net/sched/sch_netem.c ++++ b/net/sched/sch_netem.c +@@ -1146,9 +1146,9 @@ static int netem_dump(struct Qdisc *sch, struct sk_buff *skb) + struct tc_netem_rate rate; + struct tc_netem_slot slot; + +- qopt.latency = min_t(psched_tdiff_t, PSCHED_NS2TICKS(q->latency), ++ qopt.latency = min_t(psched_time_t, PSCHED_NS2TICKS(q->latency), + UINT_MAX); +- qopt.jitter = min_t(psched_tdiff_t, PSCHED_NS2TICKS(q->jitter), ++ qopt.jitter = min_t(psched_time_t, PSCHED_NS2TICKS(q->jitter), + UINT_MAX); + qopt.limit = q->limit; + qopt.loss = q->loss; +-- +2.35.1 + diff --git a/queue-5.4/net-tls-fix-tls_sk_proto_close-executed-repeatedly.patch b/queue-5.4/net-tls-fix-tls_sk_proto_close-executed-repeatedly.patch new file mode 100644 index 00000000000..419524c3071 --- /dev/null +++ b/queue-5.4/net-tls-fix-tls_sk_proto_close-executed-repeatedly.patch @@ -0,0 +1,55 @@ +From 57172a0711d1002ec506f2a96ac3ab4ebe09aa60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jun 2022 12:35:08 +0800 +Subject: net/tls: fix tls_sk_proto_close executed repeatedly + +From: Ziyang Xuan + +[ Upstream commit 69135c572d1f84261a6de2a1268513a7e71753e2 ] + +After setting the sock ktls, update ctx->sk_proto to sock->sk_prot by +tls_update(), so now ctx->sk_proto->close is tls_sk_proto_close(). When +close the sock, tls_sk_proto_close() is called for sock->sk_prot->close +is tls_sk_proto_close(). But ctx->sk_proto->close() will be executed later +in tls_sk_proto_close(). Thus tls_sk_proto_close() executed repeatedly +occurred. That will trigger the following bug. + +================================================================= +KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] +RIP: 0010:tls_sk_proto_close+0xd8/0xaf0 net/tls/tls_main.c:306 +Call Trace: + + tls_sk_proto_close+0x356/0xaf0 net/tls/tls_main.c:329 + inet_release+0x12e/0x280 net/ipv4/af_inet.c:428 + __sock_release+0xcd/0x280 net/socket.c:650 + sock_close+0x18/0x20 net/socket.c:1365 + +Updating a proto which is same with sock->sk_prot is incorrect. Add proto +and sock->sk_prot equality check at the head of tls_update() to fix it. + +Fixes: 95fa145479fb ("bpf: sockmap/tls, close can race with map free") +Reported-by: syzbot+29c3c12f3214b85ad081@syzkaller.appspotmail.com +Signed-off-by: Ziyang Xuan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/tls/tls_main.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c +index 7aba4ee77aba..df9177d96f7f 100644 +--- a/net/tls/tls_main.c ++++ b/net/tls/tls_main.c +@@ -803,6 +803,9 @@ static void tls_update(struct sock *sk, struct proto *p, + { + struct tls_context *ctx; + ++ if (sk->sk_prot == p) ++ return; ++ + ctx = tls_get_ctx(sk); + if (likely(ctx)) { + ctx->sk_write_space = write_space; +-- +2.35.1 + diff --git a/queue-5.4/phy-aquantia-fix-an-when-higher-speeds-than-1g-are-n.patch b/queue-5.4/phy-aquantia-fix-an-when-higher-speeds-than-1g-are-n.patch new file mode 100644 index 00000000000..44ccdc094fb --- /dev/null +++ b/queue-5.4/phy-aquantia-fix-an-when-higher-speeds-than-1g-are-n.patch @@ -0,0 +1,63 @@ +From 937194f71e10cd0e6f1cfa55c2b810dc9b3ada4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jun 2022 11:40:37 +0300 +Subject: phy: aquantia: Fix AN when higher speeds than 1G are not advertised + +From: Claudiu Manoil + +[ Upstream commit 9b7fd1670a94a57d974795acebde843a5c1a354e ] + +Even when the eth port is resticted to work with speeds not higher than 1G, +and so the eth driver is requesting the phy (via phylink) to advertise up +to 1000BASET support, the aquantia phy device is still advertising for 2.5G +and 5G speeds. +Clear these advertising defaults when requested. + +Cc: Ondrej Spacek +Fixes: 09c4c57f7bc41 ("net: phy: aquantia: add support for auto-negotiation configuration") +Signed-off-by: Claudiu Manoil +Link: https://lore.kernel.org/r/20220610084037.7625-1-claudiu.manoil@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/aquantia_main.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/phy/aquantia_main.c b/drivers/net/phy/aquantia_main.c +index 975789d9349d..75d8351ee250 100644 +--- a/drivers/net/phy/aquantia_main.c ++++ b/drivers/net/phy/aquantia_main.c +@@ -34,6 +34,8 @@ + #define MDIO_AN_VEND_PROV 0xc400 + #define MDIO_AN_VEND_PROV_1000BASET_FULL BIT(15) + #define MDIO_AN_VEND_PROV_1000BASET_HALF BIT(14) ++#define MDIO_AN_VEND_PROV_5000BASET_FULL BIT(11) ++#define MDIO_AN_VEND_PROV_2500BASET_FULL BIT(10) + #define MDIO_AN_VEND_PROV_DOWNSHIFT_EN BIT(4) + #define MDIO_AN_VEND_PROV_DOWNSHIFT_MASK GENMASK(3, 0) + #define MDIO_AN_VEND_PROV_DOWNSHIFT_DFLT 4 +@@ -230,9 +232,20 @@ static int aqr_config_aneg(struct phy_device *phydev) + phydev->advertising)) + reg |= MDIO_AN_VEND_PROV_1000BASET_HALF; + ++ /* Handle the case when the 2.5G and 5G speeds are not advertised */ ++ if (linkmode_test_bit(ETHTOOL_LINK_MODE_2500baseT_Full_BIT, ++ phydev->advertising)) ++ reg |= MDIO_AN_VEND_PROV_2500BASET_FULL; ++ ++ if (linkmode_test_bit(ETHTOOL_LINK_MODE_5000baseT_Full_BIT, ++ phydev->advertising)) ++ reg |= MDIO_AN_VEND_PROV_5000BASET_FULL; ++ + ret = phy_modify_mmd_changed(phydev, MDIO_MMD_AN, MDIO_AN_VEND_PROV, + MDIO_AN_VEND_PROV_1000BASET_HALF | +- MDIO_AN_VEND_PROV_1000BASET_FULL, reg); ++ MDIO_AN_VEND_PROV_1000BASET_FULL | ++ MDIO_AN_VEND_PROV_2500BASET_FULL | ++ MDIO_AN_VEND_PROV_5000BASET_FULL, reg); + if (ret < 0) + return ret; + if (ret > 0) +-- +2.35.1 + diff --git a/queue-5.4/regmap-irq-fix-a-bug-in-regmap_irq_enable-for-type_i.patch b/queue-5.4/regmap-irq-fix-a-bug-in-regmap_irq_enable-for-type_i.patch new file mode 100644 index 00000000000..a1f83d1673f --- /dev/null +++ b/queue-5.4/regmap-irq-fix-a-bug-in-regmap_irq_enable-for-type_i.patch @@ -0,0 +1,55 @@ +From 0fac5c3ad7d46b800aa9a0178511982785972e08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jun 2022 21:05:56 +0100 +Subject: regmap-irq: Fix a bug in regmap_irq_enable() for type_in_mask chips + +From: Aidan MacDonald + +[ Upstream commit 485037ae9a095491beb7f893c909a76cc4f9d1e7 ] + +When enabling a type_in_mask irq, the type_buf contents must be +AND'd with the mask of the IRQ we're enabling to avoid enabling +other IRQs by accident, which can happen if several type_in_mask +irqs share a mask register. + +Fixes: bc998a730367 ("regmap: irq: handle HW using separate rising/falling edge interrupts") +Signed-off-by: Aidan MacDonald +Link: https://lore.kernel.org/r/20220620200644.1961936-2-aidanmacdonald.0x0@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap-irq.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/base/regmap/regmap-irq.c b/drivers/base/regmap/regmap-irq.c +index 3d64c9331a82..3c1e554df4eb 100644 +--- a/drivers/base/regmap/regmap-irq.c ++++ b/drivers/base/regmap/regmap-irq.c +@@ -214,6 +214,7 @@ static void regmap_irq_enable(struct irq_data *data) + struct regmap_irq_chip_data *d = irq_data_get_irq_chip_data(data); + struct regmap *map = d->map; + const struct regmap_irq *irq_data = irq_to_regmap_irq(d, data->hwirq); ++ unsigned int reg = irq_data->reg_offset / map->reg_stride; + unsigned int mask, type; + + type = irq_data->type.type_falling_val | irq_data->type.type_rising_val; +@@ -230,14 +231,14 @@ static void regmap_irq_enable(struct irq_data *data) + * at the corresponding offset in regmap_irq_set_type(). + */ + if (d->chip->type_in_mask && type) +- mask = d->type_buf[irq_data->reg_offset / map->reg_stride]; ++ mask = d->type_buf[reg] & irq_data->mask; + else + mask = irq_data->mask; + + if (d->chip->clear_on_unmask) + d->clear_status = true; + +- d->mask_buf[irq_data->reg_offset / map->reg_stride] &= ~mask; ++ d->mask_buf[reg] &= ~mask; + } + + static void regmap_irq_disable(struct irq_data *data) +-- +2.35.1 + diff --git a/queue-5.4/revert-net-tls-fix-tls_sk_proto_close-executed-repea.patch b/queue-5.4/revert-net-tls-fix-tls_sk_proto_close-executed-repea.patch new file mode 100644 index 00000000000..0f8309ce1d5 --- /dev/null +++ b/queue-5.4/revert-net-tls-fix-tls_sk_proto_close-executed-repea.patch @@ -0,0 +1,42 @@ +From d4da188db74460d3f746a6b5831ec6b4dcd0d50b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jun 2022 12:13:52 -0700 +Subject: Revert "net/tls: fix tls_sk_proto_close executed repeatedly" + +From: Jakub Kicinski + +[ Upstream commit 1b205d948fbb06a7613d87dcea0ff5fd8a08ed91 ] + +This reverts commit 69135c572d1f84261a6de2a1268513a7e71753e2. + +This commit was just papering over the issue, ULP should not +get ->update() called with its own sk_prot. Each ULP would +need to add this check. + +Fixes: 69135c572d1f ("net/tls: fix tls_sk_proto_close executed repeatedly") +Signed-off-by: Jakub Kicinski +Reviewed-by: John Fastabend +Link: https://lore.kernel.org/r/20220620191353.1184629-1-kuba@kernel.org +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/tls/tls_main.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c +index df9177d96f7f..7aba4ee77aba 100644 +--- a/net/tls/tls_main.c ++++ b/net/tls/tls_main.c +@@ -803,9 +803,6 @@ static void tls_update(struct sock *sk, struct proto *p, + { + struct tls_context *ctx; + +- if (sk->sk_prot == p) +- return; +- + ctx = tls_get_ctx(sk); + if (likely(ctx)) { + ctx->sk_write_space = write_space; +-- +2.35.1 + diff --git a/queue-5.4/s390-cpumf-handle-events-cycles-and-instructions-ide.patch b/queue-5.4/s390-cpumf-handle-events-cycles-and-instructions-ide.patch new file mode 100644 index 00000000000..9c91db238a0 --- /dev/null +++ b/queue-5.4/s390-cpumf-handle-events-cycles-and-instructions-ide.patch @@ -0,0 +1,102 @@ +From 357e39b0a4b29119c7e45d2c9ba89f2c9063dc08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jun 2022 15:19:00 +0200 +Subject: s390/cpumf: Handle events cycles and instructions identical + +From: Thomas Richter + +[ Upstream commit be857b7f77d130dbbd47c91fc35198b040f35865 ] + +Events CPU_CYCLES and INSTRUCTIONS can be submitted with two different +perf_event attribute::type values: + - PERF_TYPE_HARDWARE: when invoked via perf tool predefined events name + cycles or cpu-cycles or instructions. + - pmu->type: when invoked via perf tool event name cpu_cf/CPU_CYLCES/ or + cpu_cf/INSTRUCTIONS/. This invocation also selects the PMU to which + the event belongs. +Handle both type of invocations identical for events CPU_CYLCES and +INSTRUCTIONS. They address the same hardware. +The result is different when event modifier exclude_kernel is also set. +Invocation with event modifier for user space event counting fails. + +Output before: + + # perf stat -e cpum_cf/cpu_cycles/u -- true + + Performance counter stats for 'true': + + cpum_cf/cpu_cycles/u + + 0.000761033 seconds time elapsed + + 0.000076000 seconds user + 0.000725000 seconds sys + + # + +Output after: + # perf stat -e cpum_cf/cpu_cycles/u -- true + + Performance counter stats for 'true': + + 349,613 cpum_cf/cpu_cycles/u + + 0.000844143 seconds time elapsed + + 0.000079000 seconds user + 0.000800000 seconds sys + # + +Fixes: 6a82e23f45fe ("s390/cpumf: Adjust registration of s390 PMU device drivers") +Signed-off-by: Thomas Richter +Acked-by: Sumanth Korikkar +[agordeev@linux.ibm.com corrected commit ID of Fixes commit] +Signed-off-by: Alexander Gordeev +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/perf_cpum_cf.c | 22 +++++++++++++++++++++- + 1 file changed, 21 insertions(+), 1 deletion(-) + +diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c +index 0eb1d1cc53a8..dddb32e53db8 100644 +--- a/arch/s390/kernel/perf_cpum_cf.c ++++ b/arch/s390/kernel/perf_cpum_cf.c +@@ -292,6 +292,26 @@ static int __hw_perf_event_init(struct perf_event *event, unsigned int type) + return err; + } + ++/* Events CPU_CYLCES and INSTRUCTIONS can be submitted with two different ++ * attribute::type values: ++ * - PERF_TYPE_HARDWARE: ++ * - pmu->type: ++ * Handle both type of invocations identical. They address the same hardware. ++ * The result is different when event modifiers exclude_kernel and/or ++ * exclude_user are also set. ++ */ ++static int cpumf_pmu_event_type(struct perf_event *event) ++{ ++ u64 ev = event->attr.config; ++ ++ if (cpumf_generic_events_basic[PERF_COUNT_HW_CPU_CYCLES] == ev || ++ cpumf_generic_events_basic[PERF_COUNT_HW_INSTRUCTIONS] == ev || ++ cpumf_generic_events_user[PERF_COUNT_HW_CPU_CYCLES] == ev || ++ cpumf_generic_events_user[PERF_COUNT_HW_INSTRUCTIONS] == ev) ++ return PERF_TYPE_HARDWARE; ++ return PERF_TYPE_RAW; ++} ++ + static int cpumf_pmu_event_init(struct perf_event *event) + { + unsigned int type = event->attr.type; +@@ -301,7 +321,7 @@ static int cpumf_pmu_event_init(struct perf_event *event) + err = __hw_perf_event_init(event, type); + else if (event->pmu->type == type) + /* Registered as unknown PMU */ +- err = __hw_perf_event_init(event, PERF_TYPE_RAW); ++ err = __hw_perf_event_init(event, cpumf_pmu_event_type(event)); + else + return -ENOENT; + +-- +2.35.1 + diff --git a/queue-5.4/series b/queue-5.4/series index cd2eef416dc..6f491efdbd6 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -14,3 +14,22 @@ random-quiet-urandom-warning-ratelimit-suppression-message.patch usb-serial-option-add-telit-le910cx-0x1250-composition.patch usb-serial-option-add-quectel-em05-g-modem.patch usb-serial-option-add-quectel-rm500k-module-support.patch +bpf-fix-request_sock-leak-in-sk-lookup-helpers.patch +phy-aquantia-fix-an-when-higher-speeds-than-1g-are-n.patch +bonding-arp-monitor-spams-netdev_notify_peers-notifi.patch +net-sched-sch_netem-fix-arithmetic-in-netem_dump-for.patch +drm-msm-mdp4-fix-refcount-leak-in-mdp4_modeset_init_.patch +erspan-do-not-assume-transport-header-is-always-set.patch +net-tls-fix-tls_sk_proto_close-executed-repeatedly.patch +udmabuf-add-back-sanity-check.patch +x86-xen-remove-undefined-behavior-in-setup_features.patch +mips-remove-repetitive-increase-irq_err_count.patch +afs-fix-dynamic-root-getattr.patch +ice-ethtool-advertise-1000m-speeds-properly.patch +regmap-irq-fix-a-bug-in-regmap_irq_enable-for-type_i.patch +igb-make-dma-faster-when-cpu-is-active-on-the-pcie-l.patch +virtio_net-fix-xdp_rxq_info-bug-after-suspend-resume.patch +revert-net-tls-fix-tls_sk_proto_close-executed-repea.patch +gpio-winbond-fix-error-code-in-winbond_gpio_get.patch +s390-cpumf-handle-events-cycles-and-instructions-ide.patch +iio-adc-vf610-fix-conversion-mode-sysfs-node-name.patch diff --git a/queue-5.4/udmabuf-add-back-sanity-check.patch b/queue-5.4/udmabuf-add-back-sanity-check.patch new file mode 100644 index 00000000000..b77c30e0892 --- /dev/null +++ b/queue-5.4/udmabuf-add-back-sanity-check.patch @@ -0,0 +1,42 @@ +From 4b0f96a4648d232d4e11ebc5b7bfdadb6d2bde21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jun 2022 09:15:47 +0200 +Subject: udmabuf: add back sanity check + +From: Gerd Hoffmann + +[ Upstream commit 05b252cccb2e5c3f56119d25de684b4f810ba40a ] + +Check vm_fault->pgoff before using it. When we removed the warning, we +also removed the check. + +Fixes: 7b26e4e2119d ("udmabuf: drop WARN_ON() check.") +Reported-by: zdi-disclosures@trendmicro.com +Suggested-by: Linus Torvalds +Signed-off-by: Gerd Hoffmann +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + drivers/dma-buf/udmabuf.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c +index e553c6a937f6..c6e9b7bd7618 100644 +--- a/drivers/dma-buf/udmabuf.c ++++ b/drivers/dma-buf/udmabuf.c +@@ -24,8 +24,11 @@ static vm_fault_t udmabuf_vm_fault(struct vm_fault *vmf) + { + struct vm_area_struct *vma = vmf->vma; + struct udmabuf *ubuf = vma->vm_private_data; ++ pgoff_t pgoff = vmf->pgoff; + +- vmf->page = ubuf->pages[vmf->pgoff]; ++ if (pgoff >= ubuf->pagecount) ++ return VM_FAULT_SIGBUS; ++ vmf->page = ubuf->pages[pgoff]; + get_page(vmf->page); + return 0; + } +-- +2.35.1 + diff --git a/queue-5.4/virtio_net-fix-xdp_rxq_info-bug-after-suspend-resume.patch b/queue-5.4/virtio_net-fix-xdp_rxq_info-bug-after-suspend-resume.patch new file mode 100644 index 00000000000..e430e51b5fe --- /dev/null +++ b/queue-5.4/virtio_net-fix-xdp_rxq_info-bug-after-suspend-resume.patch @@ -0,0 +1,115 @@ +From 8da5b17a33d2c9562a329b5ff0987c36b26d553a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jun 2022 13:48:44 +0200 +Subject: virtio_net: fix xdp_rxq_info bug after suspend/resume + +From: Stephan Gerhold + +[ Upstream commit 8af52fe9fd3bf5e7478da99193c0632276e1dfce ] + +The following sequence currently causes a driver bug warning +when using virtio_net: + + # ip link set eth0 up + # echo mem > /sys/power/state (or e.g. # rtcwake -s 10 -m mem) + + # ip link set eth0 down + + Missing register, driver bug + WARNING: CPU: 0 PID: 375 at net/core/xdp.c:138 xdp_rxq_info_unreg+0x58/0x60 + Call trace: + xdp_rxq_info_unreg+0x58/0x60 + virtnet_close+0x58/0xac + __dev_close_many+0xac/0x140 + __dev_change_flags+0xd8/0x210 + dev_change_flags+0x24/0x64 + do_setlink+0x230/0xdd0 + ... + +This happens because virtnet_freeze() frees the receive_queue +completely (including struct xdp_rxq_info) but does not call +xdp_rxq_info_unreg(). Similarly, virtnet_restore() sets up the +receive_queue again but does not call xdp_rxq_info_reg(). + +Actually, parts of virtnet_freeze_down() and virtnet_restore_up() +are almost identical to virtnet_close() and virtnet_open(): only +the calls to xdp_rxq_info_(un)reg() are missing. This means that +we can fix this easily and avoid such problems in the future by +just calling virtnet_close()/open() from the freeze/restore handlers. + +Aside from adding the missing xdp_rxq_info calls the only difference +is that the refill work is only cancelled if netif_running(). However, +this should not make any functional difference since the refill work +should only be active if the network interface is actually up. + +Fixes: 754b8a21a96d ("virtio_net: setup xdp_rxq_info") +Signed-off-by: Stephan Gerhold +Acked-by: Jesper Dangaard Brouer +Acked-by: Jason Wang +Link: https://lore.kernel.org/r/20220621114845.3650258-1-stephan.gerhold@kernkonzept.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/virtio_net.c | 25 ++++++------------------- + 1 file changed, 6 insertions(+), 19 deletions(-) + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 37c2cecd1e50..f4c03518d7d2 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -2393,7 +2393,6 @@ static const struct ethtool_ops virtnet_ethtool_ops = { + static void virtnet_freeze_down(struct virtio_device *vdev) + { + struct virtnet_info *vi = vdev->priv; +- int i; + + /* Make sure no work handler is accessing the device */ + flush_work(&vi->config_work); +@@ -2401,14 +2400,8 @@ static void virtnet_freeze_down(struct virtio_device *vdev) + netif_tx_lock_bh(vi->dev); + netif_device_detach(vi->dev); + netif_tx_unlock_bh(vi->dev); +- cancel_delayed_work_sync(&vi->refill); +- +- if (netif_running(vi->dev)) { +- for (i = 0; i < vi->max_queue_pairs; i++) { +- napi_disable(&vi->rq[i].napi); +- virtnet_napi_tx_disable(&vi->sq[i].napi); +- } +- } ++ if (netif_running(vi->dev)) ++ virtnet_close(vi->dev); + } + + static int init_vqs(struct virtnet_info *vi); +@@ -2416,7 +2409,7 @@ static int init_vqs(struct virtnet_info *vi); + static int virtnet_restore_up(struct virtio_device *vdev) + { + struct virtnet_info *vi = vdev->priv; +- int err, i; ++ int err; + + err = init_vqs(vi); + if (err) +@@ -2425,15 +2418,9 @@ static int virtnet_restore_up(struct virtio_device *vdev) + virtio_device_ready(vdev); + + if (netif_running(vi->dev)) { +- for (i = 0; i < vi->curr_queue_pairs; i++) +- if (!try_fill_recv(vi, &vi->rq[i], GFP_KERNEL)) +- schedule_delayed_work(&vi->refill, 0); +- +- for (i = 0; i < vi->max_queue_pairs; i++) { +- virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi); +- virtnet_napi_tx_enable(vi, vi->sq[i].vq, +- &vi->sq[i].napi); +- } ++ err = virtnet_open(vi->dev); ++ if (err) ++ return err; + } + + netif_tx_lock_bh(vi->dev); +-- +2.35.1 + diff --git a/queue-5.4/x86-xen-remove-undefined-behavior-in-setup_features.patch b/queue-5.4/x86-xen-remove-undefined-behavior-in-setup_features.patch new file mode 100644 index 00000000000..cffb4a46c8a --- /dev/null +++ b/queue-5.4/x86-xen-remove-undefined-behavior-in-setup_features.patch @@ -0,0 +1,36 @@ +From ba436deabb14e44293713d8993a88a990856af4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jun 2022 11:30:37 +0100 +Subject: x86/xen: Remove undefined behavior in setup_features() + +From: Julien Grall + +[ Upstream commit ecb6237fa397b7b810d798ad19322eca466dbab1 ] + +1 << 31 is undefined. So switch to 1U << 31. + +Fixes: 5ead97c84fa7 ("xen: Core Xen implementation") +Signed-off-by: Julien Grall +Reviewed-by: Juergen Gross +Link: https://lore.kernel.org/r/20220617103037.57828-1-julien@xen.org +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + drivers/xen/features.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/xen/features.c b/drivers/xen/features.c +index 25c053b09605..2c306de228db 100644 +--- a/drivers/xen/features.c ++++ b/drivers/xen/features.c +@@ -29,6 +29,6 @@ void xen_setup_features(void) + if (HYPERVISOR_xen_version(XENVER_get_features, &fi) < 0) + break; + for (j = 0; j < 32; j++) +- xen_features[i * 32 + j] = !!(fi.submap & 1<