From 930439f7195588d1756415de9e31fcdf4bd5a3f2 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 23 Jul 2023 21:25:07 -0400 Subject: [PATCH] Fixes for 5.15 Signed-off-by: Sasha Levin --- ...l-up-loops-in-dsp-setup-code-for-aud.patch | 155 +++ ...g-idx-logic-in-check_max_stack_depth.patch | 75 ++ ...k-warning-when-enabling-stp-in-netns.patch | 71 ++ ...nteger-overflow-in-radeon_cs_parser_.patch | 43 + ..._hw_addr_set-instead-of-ether_addr_c.patch | 999 ++++++++++++++++++ .../ethernet-use-of_get_ethdev_address.patch | 504 +++++++++ ...ix-missing-irq-check-in-au1200fb_drv.patch | 40 + ...warn-about-invalid-left-right-margin.patch | 43 + ...-read-only-mounted-filesystem-in-txb.patch | 41 + ...s-fix-null-ptr-deref-read-in-txbegin.patch | 45 + ...-array-index-out-of-bounds-in-dballo.patch | 88 ++ ...bounds-when-setting-channels-on-remo.patch | 160 +++ ...vf-fix-use-after-free-in-free_netdev.patch | 215 ++++ ...avoid-transmit-queue-timeout-for-xdp.patch | 61 ++ ...t-garbled-tx-queue-with-xdp-zerocopy.patch | 79 ++ ...on-t-drop-packet-from-non-root-netns.patch | 50 + ...c-prom-address-warray-bounds-warning.patch | 56 + ...notate-accesses-to-queue-trans_start.patch | 285 +++++ ...et-mtk_eth_soc-handle-probe-deferral.patch | 86 ++ ...cpsw_ale-fix-cpsw_ale_get_field-cpsw.patch | 78 ++ ...use-kfree_sensitive-instead-of-kfree.patch | 38 + ...ipv6-check-return-value-of-pskb_trim.patch | 39 + ...stale-pointer-dereference-in-phy_ini.patch | 74 ++ ...f-undo-tcf_bind_filter-in-case-of-an.patch | 165 +++ ...les-fix-spurious-set-element-inserti.patch | 49 + ...les-skip-bound-chain-in-netns-releas.patch | 37 + ...ables-skip-bound-chain-on-rule-flush.patch | 43 + ...t_pipapo-fix-improper-element-remova.patch | 63 ++ ...nt-allocate-bpids-for-lbk-interfaces.patch | 43 + ...a-helper-for-loading-netdev-dev_addr.patch | 91 ++ ...ibrary-not-found-error-when-using-cs.patch | 94 ++ ...amd_pinconf_set-for-all-config-optio.patch | 108 ++ queue-5.15/quota-fix-warning-in-dqgrab.patch | 105 ++ ...isable-quotas-when-add_dquot_ref-fai.patch | 45 + ...-the-lookup-process-failing-to-get-s.patch | 113 ++ ...keys-modify-mismatched-function-name.patch | 40 + queue-5.15/series | 49 + .../spi-bcm63xx-fix-max-prepend-length.patch | 47 + ...data-races-around-fastopenq.max_qlen.patch | 77 ++ ...a-races-around-icsk-icsk_syn_retries.patch | 69 ++ ...a-races-around-icsk-icsk_user_timeou.patch | 54 + ...-data-races-around-rskq_defer_accept.patch | 53 + ...a-races-around-tcp_rsk-req-ts_recent.patch | 184 ++++ ...data-races-around-tp-keepalive_intvl.patch | 68 ++ ...ata-races-around-tp-keepalive_probes.patch | 69 ++ ...-data-races-around-tp-keepalive_time.patch | 58 + ...nnotate-data-races-around-tp-linger2.patch | 52 + ...e-data-races-around-tp-notsent_lowat.patch | 64 ++ ...te-data-races-around-tp-tcp_tx_delay.patch | 46 + ...lized-array-access-for-some-pathname.patch | 41 + 50 files changed, 5252 insertions(+) create mode 100644 queue-5.15/alsa-emu10k1-roll-up-loops-in-dsp-setup-code-for-aud.patch create mode 100644 queue-5.15/bpf-fix-subprog-idx-logic-in-check_max_stack_depth.patch create mode 100644 queue-5.15/bridge-add-extack-warning-when-enabling-stp-in-netns.patch create mode 100644 queue-5.15/drm-radeon-fix-integer-overflow-in-radeon_cs_parser_.patch create mode 100644 queue-5.15/ethernet-use-eth_hw_addr_set-instead-of-ether_addr_c.patch create mode 100644 queue-5.15/ethernet-use-of_get_ethdev_address.patch create mode 100644 queue-5.15/fbdev-au1200fb-fix-missing-irq-check-in-au1200fb_drv.patch create mode 100644 queue-5.15/fbdev-imxfb-warn-about-invalid-left-right-margin.patch create mode 100644 queue-5.15/fs-jfs-check-for-read-only-mounted-filesystem-in-txb.patch create mode 100644 queue-5.15/fs-jfs-fix-null-ptr-deref-read-in-txbegin.patch create mode 100644 queue-5.15/fs-jfs-fix-ubsan-array-index-out-of-bounds-in-dballo.patch create mode 100644 queue-5.15/iavf-fix-out-of-bounds-when-setting-channels-on-remo.patch create mode 100644 queue-5.15/iavf-fix-use-after-free-in-free_netdev.patch create mode 100644 queue-5.15/igc-avoid-transmit-queue-timeout-for-xdp.patch create mode 100644 queue-5.15/igc-prevent-garbled-tx-queue-with-xdp-zerocopy.patch create mode 100644 queue-5.15/llc-don-t-drop-packet-from-non-root-netns.patch create mode 100644 queue-5.15/mips-dec-prom-address-warray-bounds-warning.patch create mode 100644 queue-5.15/net-annotate-accesses-to-queue-trans_start.patch create mode 100644 queue-5.15/net-ethernet-mtk_eth_soc-handle-probe-deferral.patch create mode 100644 queue-5.15/net-ethernet-ti-cpsw_ale-fix-cpsw_ale_get_field-cpsw.patch create mode 100644 queue-5.15/net-ipv4-use-kfree_sensitive-instead-of-kfree.patch create mode 100644 queue-5.15/net-ipv6-check-return-value-of-pskb_trim.patch create mode 100644 queue-5.15/net-phy-prevent-stale-pointer-dereference-in-phy_ini.patch create mode 100644 queue-5.15/net-sched-cls_bpf-undo-tcf_bind_filter-in-case-of-an.patch create mode 100644 queue-5.15/netfilter-nf_tables-fix-spurious-set-element-inserti.patch create mode 100644 queue-5.15/netfilter-nf_tables-skip-bound-chain-in-netns-releas.patch create mode 100644 queue-5.15/netfilter-nf_tables-skip-bound-chain-on-rule-flush.patch create mode 100644 queue-5.15/netfilter-nft_set_pipapo-fix-improper-element-remova.patch create mode 100644 queue-5.15/octeontx2-pf-dont-allocate-bpids-for-lbk-interfaces.patch create mode 100644 queue-5.15/of-net-add-a-helper-for-loading-netdev-dev_addr.patch create mode 100644 queue-5.15/perf-build-fix-library-not-found-error-when-using-cs.patch create mode 100644 queue-5.15/pinctrl-amd-use-amd_pinconf_set-for-all-config-optio.patch create mode 100644 queue-5.15/quota-fix-warning-in-dqgrab.patch create mode 100644 queue-5.15/quota-properly-disable-quotas-when-add_dquot_ref-fai.patch create mode 100644 queue-5.15/revert-tcp-avoid-the-lookup-process-failing-to-get-s.patch create mode 100644 queue-5.15/security-keys-modify-mismatched-function-name.patch create mode 100644 queue-5.15/spi-bcm63xx-fix-max-prepend-length.patch create mode 100644 queue-5.15/tcp-annotate-data-races-around-fastopenq.max_qlen.patch create mode 100644 queue-5.15/tcp-annotate-data-races-around-icsk-icsk_syn_retries.patch create mode 100644 queue-5.15/tcp-annotate-data-races-around-icsk-icsk_user_timeou.patch create mode 100644 queue-5.15/tcp-annotate-data-races-around-rskq_defer_accept.patch create mode 100644 queue-5.15/tcp-annotate-data-races-around-tcp_rsk-req-ts_recent.patch create mode 100644 queue-5.15/tcp-annotate-data-races-around-tp-keepalive_intvl.patch create mode 100644 queue-5.15/tcp-annotate-data-races-around-tp-keepalive_probes.patch create mode 100644 queue-5.15/tcp-annotate-data-races-around-tp-keepalive_time.patch create mode 100644 queue-5.15/tcp-annotate-data-races-around-tp-linger2.patch create mode 100644 queue-5.15/tcp-annotate-data-races-around-tp-notsent_lowat.patch create mode 100644 queue-5.15/tcp-annotate-data-races-around-tp-tcp_tx_delay.patch create mode 100644 queue-5.15/udf-fix-uninitialized-array-access-for-some-pathname.patch diff --git a/queue-5.15/alsa-emu10k1-roll-up-loops-in-dsp-setup-code-for-aud.patch b/queue-5.15/alsa-emu10k1-roll-up-loops-in-dsp-setup-code-for-aud.patch new file mode 100644 index 00000000000..2aa553ed58a --- /dev/null +++ b/queue-5.15/alsa-emu10k1-roll-up-loops-in-dsp-setup-code-for-aud.patch @@ -0,0 +1,155 @@ +From 94faffdcc73e679db09c8c47b4adc0c0a00201dd Mon Sep 17 00:00:00 2001 +From: Oswald Buddenhagen +Date: Wed, 10 May 2023 19:39:05 +0200 +Subject: [PATCH AUTOSEL 4.14 2/9] ALSA: emu10k1: roll up loops in DSP setup + code for Audigy +X-stable: review +X-Patchwork-Hint: Ignore +X-stable-base: Linux 4.14.320 + +[ Upstream commit 8cabf83c7aa54530e699be56249fb44f9505c4f3 ] + +There is no apparent reason for the massive code duplication. + +Signed-off-by: Oswald Buddenhagen +Link: https://lore.kernel.org/r/20230510173917.3073107-3-oswald.buddenhagen@gmx.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/emu10k1/emufx.c | 112 +++----------------------------------- + 1 file changed, 9 insertions(+), 103 deletions(-) + +diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c +index 5c00e35367675..dc4b30d1b7168 100644 +--- a/sound/pci/emu10k1/emufx.c ++++ b/sound/pci/emu10k1/emufx.c +@@ -1557,14 +1557,8 @@ A_OP(icode, &ptr, iMAC0, A_GPR(var), A_GPR(var), A_GPR(vol), A_EXTIN(input)) + gpr += 2; + + /* Master volume (will be renamed later) */ +- A_OP(icode, &ptr, iMAC0, A_GPR(playback+0+SND_EMU10K1_PLAYBACK_CHANNELS), A_C_00000000, A_GPR(gpr), A_GPR(playback+0+SND_EMU10K1_PLAYBACK_CHANNELS)); +- A_OP(icode, &ptr, iMAC0, A_GPR(playback+1+SND_EMU10K1_PLAYBACK_CHANNELS), A_C_00000000, A_GPR(gpr), A_GPR(playback+1+SND_EMU10K1_PLAYBACK_CHANNELS)); +- A_OP(icode, &ptr, iMAC0, A_GPR(playback+2+SND_EMU10K1_PLAYBACK_CHANNELS), A_C_00000000, A_GPR(gpr), A_GPR(playback+2+SND_EMU10K1_PLAYBACK_CHANNELS)); +- A_OP(icode, &ptr, iMAC0, A_GPR(playback+3+SND_EMU10K1_PLAYBACK_CHANNELS), A_C_00000000, A_GPR(gpr), A_GPR(playback+3+SND_EMU10K1_PLAYBACK_CHANNELS)); +- A_OP(icode, &ptr, iMAC0, A_GPR(playback+4+SND_EMU10K1_PLAYBACK_CHANNELS), A_C_00000000, A_GPR(gpr), A_GPR(playback+4+SND_EMU10K1_PLAYBACK_CHANNELS)); +- A_OP(icode, &ptr, iMAC0, A_GPR(playback+5+SND_EMU10K1_PLAYBACK_CHANNELS), A_C_00000000, A_GPR(gpr), A_GPR(playback+5+SND_EMU10K1_PLAYBACK_CHANNELS)); +- A_OP(icode, &ptr, iMAC0, A_GPR(playback+6+SND_EMU10K1_PLAYBACK_CHANNELS), A_C_00000000, A_GPR(gpr), A_GPR(playback+6+SND_EMU10K1_PLAYBACK_CHANNELS)); +- A_OP(icode, &ptr, iMAC0, A_GPR(playback+7+SND_EMU10K1_PLAYBACK_CHANNELS), A_C_00000000, A_GPR(gpr), A_GPR(playback+7+SND_EMU10K1_PLAYBACK_CHANNELS)); ++ for (z = 0; z < 8; z++) ++ A_OP(icode, &ptr, iMAC0, A_GPR(playback+z+SND_EMU10K1_PLAYBACK_CHANNELS), A_C_00000000, A_GPR(gpr), A_GPR(playback+z+SND_EMU10K1_PLAYBACK_CHANNELS)); + snd_emu10k1_init_mono_control(&controls[nctl++], "Wave Master Playback Volume", gpr, 0); + gpr += 2; + +@@ -1648,102 +1642,14 @@ A_OP(icode, &ptr, iMAC0, A_GPR(var), A_GPR(var), A_GPR(vol), A_EXTIN(input)) + dev_dbg(emu->card->dev, "emufx.c: gpr=0x%x, tmp=0x%x\n", + gpr, tmp); + */ +- /* For the EMU1010: How to get 32bit values from the DSP. High 16bits into L, low 16bits into R. */ +- /* A_P16VIN(0) is delayed by one sample, +- * so all other A_P16VIN channels will need to also be delayed +- */ +- /* Left ADC in. 1 of 2 */ + snd_emu10k1_audigy_dsp_convert_32_to_2x16( icode, &ptr, tmp, bit_shifter16, A_P16VIN(0x0), A_FXBUS2(0) ); +- /* Right ADC in 1 of 2 */ +- gpr_map[gpr++] = 0x00000000; +- /* Delaying by one sample: instead of copying the input +- * value A_P16VIN to output A_FXBUS2 as in the first channel, +- * we use an auxiliary register, delaying the value by one +- * sample +- */ +- snd_emu10k1_audigy_dsp_convert_32_to_2x16( icode, &ptr, tmp, bit_shifter16, A_GPR(gpr - 1), A_FXBUS2(2) ); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0x1), A_C_00000000, A_C_00000000); +- gpr_map[gpr++] = 0x00000000; +- snd_emu10k1_audigy_dsp_convert_32_to_2x16( icode, &ptr, tmp, bit_shifter16, A_GPR(gpr - 1), A_FXBUS2(4) ); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0x2), A_C_00000000, A_C_00000000); +- gpr_map[gpr++] = 0x00000000; +- snd_emu10k1_audigy_dsp_convert_32_to_2x16( icode, &ptr, tmp, bit_shifter16, A_GPR(gpr - 1), A_FXBUS2(6) ); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0x3), A_C_00000000, A_C_00000000); +- /* For 96kHz mode */ +- /* Left ADC in. 2 of 2 */ +- gpr_map[gpr++] = 0x00000000; +- snd_emu10k1_audigy_dsp_convert_32_to_2x16( icode, &ptr, tmp, bit_shifter16, A_GPR(gpr - 1), A_FXBUS2(0x8) ); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0x4), A_C_00000000, A_C_00000000); +- /* Right ADC in 2 of 2 */ +- gpr_map[gpr++] = 0x00000000; +- snd_emu10k1_audigy_dsp_convert_32_to_2x16( icode, &ptr, tmp, bit_shifter16, A_GPR(gpr - 1), A_FXBUS2(0xa) ); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0x5), A_C_00000000, A_C_00000000); +- gpr_map[gpr++] = 0x00000000; +- snd_emu10k1_audigy_dsp_convert_32_to_2x16( icode, &ptr, tmp, bit_shifter16, A_GPR(gpr - 1), A_FXBUS2(0xc) ); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0x6), A_C_00000000, A_C_00000000); +- gpr_map[gpr++] = 0x00000000; +- snd_emu10k1_audigy_dsp_convert_32_to_2x16( icode, &ptr, tmp, bit_shifter16, A_GPR(gpr - 1), A_FXBUS2(0xe) ); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0x7), A_C_00000000, A_C_00000000); +- /* Pavel Hofman - we still have voices, A_FXBUS2s, and +- * A_P16VINs available - +- * let's add 8 more capture channels - total of 16 +- */ +- gpr_map[gpr++] = 0x00000000; +- snd_emu10k1_audigy_dsp_convert_32_to_2x16(icode, &ptr, tmp, +- bit_shifter16, +- A_GPR(gpr - 1), +- A_FXBUS2(0x10)); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0x8), +- A_C_00000000, A_C_00000000); +- gpr_map[gpr++] = 0x00000000; +- snd_emu10k1_audigy_dsp_convert_32_to_2x16(icode, &ptr, tmp, +- bit_shifter16, +- A_GPR(gpr - 1), +- A_FXBUS2(0x12)); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0x9), +- A_C_00000000, A_C_00000000); +- gpr_map[gpr++] = 0x00000000; +- snd_emu10k1_audigy_dsp_convert_32_to_2x16(icode, &ptr, tmp, +- bit_shifter16, +- A_GPR(gpr - 1), +- A_FXBUS2(0x14)); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0xa), +- A_C_00000000, A_C_00000000); +- gpr_map[gpr++] = 0x00000000; +- snd_emu10k1_audigy_dsp_convert_32_to_2x16(icode, &ptr, tmp, +- bit_shifter16, +- A_GPR(gpr - 1), +- A_FXBUS2(0x16)); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0xb), +- A_C_00000000, A_C_00000000); +- gpr_map[gpr++] = 0x00000000; +- snd_emu10k1_audigy_dsp_convert_32_to_2x16(icode, &ptr, tmp, +- bit_shifter16, +- A_GPR(gpr - 1), +- A_FXBUS2(0x18)); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0xc), +- A_C_00000000, A_C_00000000); +- gpr_map[gpr++] = 0x00000000; +- snd_emu10k1_audigy_dsp_convert_32_to_2x16(icode, &ptr, tmp, +- bit_shifter16, +- A_GPR(gpr - 1), +- A_FXBUS2(0x1a)); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0xd), +- A_C_00000000, A_C_00000000); +- gpr_map[gpr++] = 0x00000000; +- snd_emu10k1_audigy_dsp_convert_32_to_2x16(icode, &ptr, tmp, +- bit_shifter16, +- A_GPR(gpr - 1), +- A_FXBUS2(0x1c)); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0xe), +- A_C_00000000, A_C_00000000); +- gpr_map[gpr++] = 0x00000000; +- snd_emu10k1_audigy_dsp_convert_32_to_2x16(icode, &ptr, tmp, +- bit_shifter16, +- A_GPR(gpr - 1), +- A_FXBUS2(0x1e)); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0xf), +- A_C_00000000, A_C_00000000); ++ /* A_P16VIN(0) is delayed by one sample, so all other A_P16VIN channels ++ * will need to also be delayed; we use an auxiliary register for that. */ ++ for (z = 1; z < 0x10; z++) { ++ snd_emu10k1_audigy_dsp_convert_32_to_2x16( icode, &ptr, tmp, bit_shifter16, A_GPR(gpr), A_FXBUS2(z * 2) ); ++ A_OP(icode, &ptr, iACC3, A_GPR(gpr), A_P16VIN(z), A_C_00000000, A_C_00000000); ++ gpr_map[gpr++] = 0x00000000; ++ } + } + + #if 0 +-- +2.39.2 + diff --git a/queue-5.15/bpf-fix-subprog-idx-logic-in-check_max_stack_depth.patch b/queue-5.15/bpf-fix-subprog-idx-logic-in-check_max_stack_depth.patch new file mode 100644 index 00000000000..5939098ebe4 --- /dev/null +++ b/queue-5.15/bpf-fix-subprog-idx-logic-in-check_max_stack_depth.patch @@ -0,0 +1,75 @@ +From 5d878bc46d91efb344edfb4d4c2cb618fdc3711b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 21:45:28 +0530 +Subject: bpf: Fix subprog idx logic in check_max_stack_depth + +From: Kumar Kartikeya Dwivedi + +[ Upstream commit ba7b3e7d5f9014be65879ede8fd599cb222901c9 ] + +The assignment to idx in check_max_stack_depth happens once we see a +bpf_pseudo_call or bpf_pseudo_func. This is not an issue as the rest of +the code performs a few checks and then pushes the frame to the frame +stack, except the case of async callbacks. If the async callback case +causes the loop iteration to be skipped, the idx assignment will be +incorrect on the next iteration of the loop. The value stored in the +frame stack (as the subprogno of the current subprog) will be incorrect. + +This leads to incorrect checks and incorrect tail_call_reachable +marking. Save the target subprog in a new variable and only assign to +idx once we are done with the is_async_cb check which may skip pushing +of frame to the frame stack and subsequent stack depth checks and tail +call markings. + +Fixes: 7ddc80a476c2 ("bpf: Teach stack depth check about async callbacks.") +Signed-off-by: Kumar Kartikeya Dwivedi +Link: https://lore.kernel.org/r/20230717161530.1238-2-memxor@gmail.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index bd31aa6407a78..e1848a2a7230a 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -3744,7 +3744,7 @@ static int check_max_stack_depth(struct bpf_verifier_env *env) + continue_func: + subprog_end = subprog[idx + 1].start; + for (; i < subprog_end; i++) { +- int next_insn; ++ int next_insn, sidx; + + if (!bpf_pseudo_call(insn + i) && !bpf_pseudo_func(insn + i)) + continue; +@@ -3754,14 +3754,14 @@ static int check_max_stack_depth(struct bpf_verifier_env *env) + + /* find the callee */ + next_insn = i + insn[i].imm + 1; +- idx = find_subprog(env, next_insn); +- if (idx < 0) { ++ sidx = find_subprog(env, next_insn); ++ if (sidx < 0) { + WARN_ONCE(1, "verifier bug. No program starts at insn %d\n", + next_insn); + return -EFAULT; + } +- if (subprog[idx].is_async_cb) { +- if (subprog[idx].has_tail_call) { ++ if (subprog[sidx].is_async_cb) { ++ if (subprog[sidx].has_tail_call) { + verbose(env, "verifier bug. subprog has tail_call and async cb\n"); + return -EFAULT; + } +@@ -3770,6 +3770,7 @@ static int check_max_stack_depth(struct bpf_verifier_env *env) + continue; + } + i = next_insn; ++ idx = sidx; + + if (subprog[idx].has_tail_call) + tail_call_reachable = true; +-- +2.39.2 + diff --git a/queue-5.15/bridge-add-extack-warning-when-enabling-stp-in-netns.patch b/queue-5.15/bridge-add-extack-warning-when-enabling-stp-in-netns.patch new file mode 100644 index 00000000000..8b5caa663a0 --- /dev/null +++ b/queue-5.15/bridge-add-extack-warning-when-enabling-stp-in-netns.patch @@ -0,0 +1,71 @@ +From 03d3dddbbcfa6e8eebf8989e2fda7ab701b7ee4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jul 2023 08:44:49 -0700 +Subject: bridge: Add extack warning when enabling STP in netns. + +From: Kuniyuki Iwashima + +[ Upstream commit 56a16035bb6effb37177867cea94c13a8382f745 ] + +When we create an L2 loop on a bridge in netns, we will see packets storm +even if STP is enabled. + + # unshare -n + # ip link add br0 type bridge + # ip link add veth0 type veth peer name veth1 + # ip link set veth0 master br0 up + # ip link set veth1 master br0 up + # ip link set br0 type bridge stp_state 1 + # ip link set br0 up + # sleep 30 + # ip -s link show br0 + 2: br0: mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000 + link/ether b6:61:98:1c:1c:b5 brd ff:ff:ff:ff:ff:ff + RX: bytes packets errors dropped missed mcast + 956553768 12861249 0 0 0 12861249 <-. Keep + TX: bytes packets errors dropped carrier collsns | increasing + 1027834 11951 0 0 0 0 <-' rapidly + +This is because llc_rcv() drops all packets in non-root netns and BPDU +is dropped. + +Let's add extack warning when enabling STP in netns. + + # unshare -n + # ip link add br0 type bridge + # ip link set br0 type bridge stp_state 1 + Warning: bridge: STP does not work in non-root netns. + +Note this commit will be reverted later when we namespacify the whole LLC +infra. + +Fixes: e730c15519d0 ("[NET]: Make packet reception network namespace safe") +Suggested-by: Harry Coin +Link: https://lore.kernel.org/netdev/0f531295-e289-022d-5add-5ceffa0df9bc@quietfountain.com/ +Suggested-by: Ido Schimmel +Signed-off-by: Kuniyuki Iwashima +Acked-by: Nikolay Aleksandrov +Reviewed-by: Ido Schimmel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/bridge/br_stp_if.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c +index ba55851fe132c..3326dfced68ab 100644 +--- a/net/bridge/br_stp_if.c ++++ b/net/bridge/br_stp_if.c +@@ -201,6 +201,9 @@ int br_stp_set_enabled(struct net_bridge *br, unsigned long val, + { + ASSERT_RTNL(); + ++ if (!net_eq(dev_net(br->dev), &init_net)) ++ NL_SET_ERR_MSG_MOD(extack, "STP does not work in non-root netns"); ++ + if (br_mrp_enabled(br)) { + NL_SET_ERR_MSG_MOD(extack, + "STP can't be enabled if MRP is already enabled"); +-- +2.39.2 + diff --git a/queue-5.15/drm-radeon-fix-integer-overflow-in-radeon_cs_parser_.patch b/queue-5.15/drm-radeon-fix-integer-overflow-in-radeon_cs_parser_.patch new file mode 100644 index 00000000000..433cc7d0acb --- /dev/null +++ b/queue-5.15/drm-radeon-fix-integer-overflow-in-radeon_cs_parser_.patch @@ -0,0 +1,43 @@ +From cb9a1518ded05453d730ce932ab36776f662cc91 Mon Sep 17 00:00:00 2001 +From: hackyzh002 +Date: Wed, 19 Apr 2023 20:20:58 +0800 +Subject: [PATCH AUTOSEL 4.14 1/9] drm/radeon: Fix integer overflow in + radeon_cs_parser_init +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +X-stable: review +X-Patchwork-Hint: Ignore +X-stable-base: Linux 4.14.320 + +[ Upstream commit f828b681d0cd566f86351c0b913e6cb6ed8c7b9c ] + +The type of size is unsigned, if size is 0x40000000, there will be an +integer overflow, size will be zero after size *= sizeof(uint32_t), +will cause uninitialized memory to be referenced later + +Reviewed-by: Christian König +Signed-off-by: hackyzh002 +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/radeon_cs.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c +index 1ae31dbc61c64..5e61abb3dce5c 100644 +--- a/drivers/gpu/drm/radeon/radeon_cs.c ++++ b/drivers/gpu/drm/radeon/radeon_cs.c +@@ -265,7 +265,8 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data) + { + struct drm_radeon_cs *cs = data; + uint64_t *chunk_array_ptr; +- unsigned size, i; ++ u64 size; ++ unsigned i; + u32 ring = RADEON_CS_RING_GFX; + s32 priority = 0; + +-- +2.39.2 + diff --git a/queue-5.15/ethernet-use-eth_hw_addr_set-instead-of-ether_addr_c.patch b/queue-5.15/ethernet-use-eth_hw_addr_set-instead-of-ether_addr_c.patch new file mode 100644 index 00000000000..aad2b56b05e --- /dev/null +++ b/queue-5.15/ethernet-use-eth_hw_addr_set-instead-of-ether_addr_c.patch @@ -0,0 +1,999 @@ +From cd12ac0a14bf764802f5e3677c05dff1639bb7c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Oct 2021 14:32:23 -0700 +Subject: ethernet: use eth_hw_addr_set() instead of ether_addr_copy() + +From: Jakub Kicinski + +[ Upstream commit f3956ebb3bf06ab2266ad5ee2214aed46405810c ] + +Convert Ethernet from ether_addr_copy() to eth_hw_addr_set(): + + @@ + expression dev, np; + @@ + - ether_addr_copy(dev->dev_addr, np) + + eth_hw_addr_set(dev, np) + +Signed-off-by: Jakub Kicinski +Signed-off-by: David S. Miller +Stable-dep-of: 1d6d537dc55d ("net: ethernet: mtk_eth_soc: handle probe deferral") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/agere/et131x.c | 4 ++-- + drivers/net/ethernet/alacritech/slicoss.c | 2 +- + drivers/net/ethernet/amazon/ena/ena_netdev.c | 2 +- + drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 2 +- + drivers/net/ethernet/broadcom/bgmac-bcma.c | 2 +- + drivers/net/ethernet/broadcom/bgmac.c | 2 +- + drivers/net/ethernet/broadcom/bnxt/bnxt_vfr.c | 2 +- + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 4 ++-- + drivers/net/ethernet/brocade/bna/bnad.c | 4 ++-- + drivers/net/ethernet/cavium/liquidio/lio_core.c | 2 +- + drivers/net/ethernet/cavium/liquidio/lio_main.c | 2 +- + drivers/net/ethernet/cavium/liquidio/lio_vf_main.c | 2 +- + drivers/net/ethernet/cavium/thunder/nicvf_main.c | 3 +-- + drivers/net/ethernet/emulex/benet/be_main.c | 2 +- + drivers/net/ethernet/ethoc.c | 2 +- + drivers/net/ethernet/ezchip/nps_enet.c | 2 +- + drivers/net/ethernet/faraday/ftgmac100.c | 4 ++-- + drivers/net/ethernet/google/gve/gve_adminq.c | 2 +- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 4 ++-- + drivers/net/ethernet/ibm/ibmveth.c | 2 +- + drivers/net/ethernet/ibm/ibmvnic.c | 5 ++--- + drivers/net/ethernet/intel/fm10k/fm10k_netdev.c | 2 +- + drivers/net/ethernet/intel/fm10k/fm10k_pci.c | 4 ++-- + drivers/net/ethernet/intel/i40e/i40e_main.c | 4 ++-- + drivers/net/ethernet/intel/iavf/iavf_main.c | 2 +- + drivers/net/ethernet/intel/iavf/iavf_virtchnl.c | 4 ++-- + drivers/net/ethernet/intel/ice/ice_main.c | 4 ++-- + drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 6 +++--- + drivers/net/ethernet/korina.c | 2 +- + drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 4 ++-- + drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c | 2 +- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c | 2 +- + drivers/net/ethernet/marvell/prestera/prestera_main.c | 2 +- + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 2 +- + drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c | 2 +- + drivers/net/ethernet/microchip/enc28j60.c | 4 ++-- + drivers/net/ethernet/microchip/lan743x_main.c | 4 ++-- + drivers/net/ethernet/microchip/sparx5/sparx5_netdev.c | 2 +- + drivers/net/ethernet/microsoft/mana/mana_en.c | 2 +- + drivers/net/ethernet/mscc/ocelot_net.c | 2 +- + drivers/net/ethernet/netronome/nfp/abm/main.c | 2 +- + drivers/net/ethernet/netronome/nfp/nfp_net_main.c | 2 +- + drivers/net/ethernet/netronome/nfp/nfp_netvf_main.c | 2 +- + drivers/net/ethernet/ni/nixge.c | 2 +- + drivers/net/ethernet/qlogic/qede/qede_filter.c | 4 ++-- + drivers/net/ethernet/qlogic/qede/qede_main.c | 2 +- + drivers/net/ethernet/qualcomm/emac/emac.c | 2 +- + drivers/net/ethernet/sfc/ef10_sriov.c | 2 +- + drivers/net/ethernet/sfc/efx.c | 2 +- + drivers/net/ethernet/sfc/efx_common.c | 4 ++-- + drivers/net/ethernet/sfc/falcon/efx.c | 6 +++--- + drivers/net/ethernet/socionext/netsec.c | 2 +- + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 +- + drivers/net/ethernet/ti/cpsw_new.c | 4 ++-- + drivers/net/ethernet/ti/davinci_emac.c | 2 +- + drivers/net/ethernet/ti/netcp_core.c | 2 +- + include/linux/etherdevice.h | 2 +- + 57 files changed, 77 insertions(+), 79 deletions(-) + +diff --git a/drivers/net/ethernet/agere/et131x.c b/drivers/net/ethernet/agere/et131x.c +index 920633161174d..f4edc616388c0 100644 +--- a/drivers/net/ethernet/agere/et131x.c ++++ b/drivers/net/ethernet/agere/et131x.c +@@ -3863,7 +3863,7 @@ static int et131x_change_mtu(struct net_device *netdev, int new_mtu) + + et131x_init_send(adapter); + et131x_hwaddr_init(adapter); +- ether_addr_copy(netdev->dev_addr, adapter->addr); ++ eth_hw_addr_set(netdev, adapter->addr); + + /* Init the device with the new settings */ + et131x_adapter_setup(adapter); +@@ -3966,7 +3966,7 @@ static int et131x_pci_setup(struct pci_dev *pdev, + + netif_napi_add(netdev, &adapter->napi, et131x_poll, 64); + +- ether_addr_copy(netdev->dev_addr, adapter->addr); ++ eth_hw_addr_set(netdev, adapter->addr); + + rc = -ENOMEM; + +diff --git a/drivers/net/ethernet/alacritech/slicoss.c b/drivers/net/ethernet/alacritech/slicoss.c +index 696517eae77f0..82f4f26081021 100644 +--- a/drivers/net/ethernet/alacritech/slicoss.c ++++ b/drivers/net/ethernet/alacritech/slicoss.c +@@ -1660,7 +1660,7 @@ static int slic_read_eeprom(struct slic_device *sdev) + goto free_eeprom; + } + /* set mac address */ +- ether_addr_copy(sdev->netdev->dev_addr, mac[devfn]); ++ eth_hw_addr_set(sdev->netdev, mac[devfn]); + free_eeprom: + dma_free_coherent(&sdev->pdev->dev, SLIC_EEPROM_SIZE, eeprom, paddr); + +diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c +index 23c9750850e98..f3673be4fc087 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c +@@ -4119,7 +4119,7 @@ static void ena_set_conf_feat_params(struct ena_adapter *adapter, + ether_addr_copy(adapter->mac_addr, netdev->dev_addr); + } else { + ether_addr_copy(adapter->mac_addr, feat->dev_attr.mac_addr); +- ether_addr_copy(netdev->dev_addr, adapter->mac_addr); ++ eth_hw_addr_set(netdev, adapter->mac_addr); + } + + /* Set offload features */ +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +index ea2e7cd8946da..c52093589d7cf 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +@@ -330,7 +330,7 @@ int aq_nic_ndev_register(struct aq_nic_s *self) + { + static u8 mac_addr_permanent[] = AQ_CFG_MAC_ADDR_PERMANENT; + +- ether_addr_copy(self->ndev->dev_addr, mac_addr_permanent); ++ eth_hw_addr_set(self->ndev, mac_addr_permanent); + } + #endif + +diff --git a/drivers/net/ethernet/broadcom/bgmac-bcma.c b/drivers/net/ethernet/broadcom/bgmac-bcma.c +index 92453e68d381b..bdb1b8053b69f 100644 +--- a/drivers/net/ethernet/broadcom/bgmac-bcma.c ++++ b/drivers/net/ethernet/broadcom/bgmac-bcma.c +@@ -150,7 +150,7 @@ static int bgmac_probe(struct bcma_device *core) + err = -ENOTSUPP; + goto err; + } +- ether_addr_copy(bgmac->net_dev->dev_addr, mac); ++ eth_hw_addr_set(bgmac->net_dev, mac); + } + + /* On BCM4706 we need common core to access PHY */ +diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c +index 54ff28c9b2148..a9c99ac81730a 100644 +--- a/drivers/net/ethernet/broadcom/bgmac.c ++++ b/drivers/net/ethernet/broadcom/bgmac.c +@@ -1241,7 +1241,7 @@ static int bgmac_set_mac_address(struct net_device *net_dev, void *addr) + if (ret < 0) + return ret; + +- ether_addr_copy(net_dev->dev_addr, sa->sa_data); ++ eth_hw_addr_set(net_dev, sa->sa_data); + bgmac_write_mac_address(bgmac, net_dev->dev_addr); + + eth_commit_mac_addr_change(net_dev, addr); +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_vfr.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_vfr.c +index 9401936b74fa2..8eb28e0885820 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_vfr.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_vfr.c +@@ -475,7 +475,7 @@ static void bnxt_vf_rep_netdev_init(struct bnxt *bp, struct bnxt_vf_rep *vf_rep, + dev->features |= pf_dev->features; + bnxt_vf_rep_eth_addr_gen(bp->pf.mac_addr, vf_rep->vf_idx, + dev->perm_addr); +- ether_addr_copy(dev->dev_addr, dev->perm_addr); ++ eth_hw_addr_set(dev, dev->perm_addr); + /* Set VF-Rep's max-mtu to the corresponding VF's max-mtu */ + if (!bnxt_hwrm_vfr_qcfg(bp, vf_rep, &max_mtu)) + dev->max_mtu = max_mtu; +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index 9d4f406408c9d..e036a244b78bf 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -3610,7 +3610,7 @@ static int bcmgenet_set_mac_addr(struct net_device *dev, void *p) + if (netif_running(dev)) + return -EBUSY; + +- ether_addr_copy(dev->dev_addr, addr->sa_data); ++ eth_hw_addr_set(dev, addr->sa_data); + + return 0; + } +@@ -4060,7 +4060,7 @@ static int bcmgenet_probe(struct platform_device *pdev) + bcmgenet_power_up(priv, GENET_POWER_PASSIVE); + + if (pd && !IS_ERR_OR_NULL(pd->mac_address)) +- ether_addr_copy(dev->dev_addr, pd->mac_address); ++ eth_hw_addr_set(dev, pd->mac_address); + else + if (!device_get_mac_address(&pdev->dev, dev->dev_addr, ETH_ALEN)) + if (has_acpi_companion(&pdev->dev)) +diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c +index ba47777d9cff7..b1947fd9a07cc 100644 +--- a/drivers/net/ethernet/brocade/bna/bnad.c ++++ b/drivers/net/ethernet/brocade/bna/bnad.c +@@ -875,7 +875,7 @@ bnad_set_netdev_perm_addr(struct bnad *bnad) + + ether_addr_copy(netdev->perm_addr, bnad->perm_addr); + if (is_zero_ether_addr(netdev->dev_addr)) +- ether_addr_copy(netdev->dev_addr, bnad->perm_addr); ++ eth_hw_addr_set(netdev, bnad->perm_addr); + } + + /* Control Path Handlers */ +@@ -3249,7 +3249,7 @@ bnad_set_mac_address(struct net_device *netdev, void *addr) + + err = bnad_mac_addr_set_locked(bnad, sa->sa_data); + if (!err) +- ether_addr_copy(netdev->dev_addr, sa->sa_data); ++ eth_hw_addr_set(netdev, sa->sa_data); + + spin_unlock_irqrestore(&bnad->bna_lock, flags); + +diff --git a/drivers/net/ethernet/cavium/liquidio/lio_core.c b/drivers/net/ethernet/cavium/liquidio/lio_core.c +index 2a0d64e5797c8..ec7928b54e4a7 100644 +--- a/drivers/net/ethernet/cavium/liquidio/lio_core.c ++++ b/drivers/net/ethernet/cavium/liquidio/lio_core.c +@@ -411,7 +411,7 @@ void octeon_pf_changed_vf_macaddr(struct octeon_device *oct, u8 *mac) + + if (!ether_addr_equal(netdev->dev_addr, mac)) { + macaddr_changed = true; +- ether_addr_copy(netdev->dev_addr, mac); ++ eth_hw_addr_set(netdev, mac); + ether_addr_copy(((u8 *)&lio->linfo.hw_addr) + 2, mac); + call_netdevice_notifiers(NETDEV_CHANGEADDR, netdev); + } +diff --git a/drivers/net/ethernet/cavium/liquidio/lio_main.c b/drivers/net/ethernet/cavium/liquidio/lio_main.c +index ae68821dd56d5..443755729d793 100644 +--- a/drivers/net/ethernet/cavium/liquidio/lio_main.c ++++ b/drivers/net/ethernet/cavium/liquidio/lio_main.c +@@ -3650,7 +3650,7 @@ static int setup_nic_devices(struct octeon_device *octeon_dev) + + /* Copy MAC Address to OS network device structure */ + +- ether_addr_copy(netdev->dev_addr, mac); ++ eth_hw_addr_set(netdev, mac); + + /* By default all interfaces on a single Octeon uses the same + * tx and rx queues +diff --git a/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c b/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c +index f6396ac64006c..8a969a9d4b637 100644 +--- a/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c ++++ b/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c +@@ -2148,7 +2148,7 @@ static int setup_nic_devices(struct octeon_device *octeon_dev) + mac[j] = *((u8 *)(((u8 *)&lio->linfo.hw_addr) + 2 + j)); + + /* Copy MAC Address to OS network device structure */ +- ether_addr_copy(netdev->dev_addr, mac); ++ eth_hw_addr_set(netdev, mac); + + if (liquidio_setup_io_queues(octeon_dev, i, + lio->linfo.num_txpciq, +diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c +index b43b97e15a6f0..8418797be205e 100644 +--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c ++++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c +@@ -221,8 +221,7 @@ static void nicvf_handle_mbx_intr(struct nicvf *nic) + nic->tns_mode = mbx.nic_cfg.tns_mode & 0x7F; + nic->node = mbx.nic_cfg.node_id; + if (!nic->set_mac_pending) +- ether_addr_copy(nic->netdev->dev_addr, +- mbx.nic_cfg.mac_addr); ++ eth_hw_addr_set(nic->netdev, mbx.nic_cfg.mac_addr); + nic->sqs_mode = mbx.nic_cfg.sqs_mode; + nic->loopback_supported = mbx.nic_cfg.loopback_supported; + nic->link_up = false; +diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c +index e874b907bfbdf..3ccb955eb6f23 100644 +--- a/drivers/net/ethernet/emulex/benet/be_main.c ++++ b/drivers/net/ethernet/emulex/benet/be_main.c +@@ -369,7 +369,7 @@ static int be_mac_addr_set(struct net_device *netdev, void *p) + /* Remember currently programmed MAC */ + ether_addr_copy(adapter->dev_mac, addr->sa_data); + done: +- ether_addr_copy(netdev->dev_addr, addr->sa_data); ++ eth_hw_addr_set(netdev, addr->sa_data); + dev_info(dev, "MAC address changed to %pM\n", addr->sa_data); + return 0; + err: +diff --git a/drivers/net/ethernet/ethoc.c b/drivers/net/ethernet/ethoc.c +index ed1ed48e74838..e63aef6a9e33a 100644 +--- a/drivers/net/ethernet/ethoc.c ++++ b/drivers/net/ethernet/ethoc.c +@@ -1148,7 +1148,7 @@ static int ethoc_probe(struct platform_device *pdev) + + /* Allow the platform setup code to pass in a MAC address. */ + if (pdata) { +- ether_addr_copy(netdev->dev_addr, pdata->hwaddr); ++ eth_hw_addr_set(netdev, pdata->hwaddr); + priv->phy_id = pdata->phy_id; + } else { + of_get_mac_address(pdev->dev.of_node, netdev->dev_addr); +diff --git a/drivers/net/ethernet/ezchip/nps_enet.c b/drivers/net/ethernet/ezchip/nps_enet.c +index f9a288a6ec8cc..f5935eb5a791c 100644 +--- a/drivers/net/ethernet/ezchip/nps_enet.c ++++ b/drivers/net/ethernet/ezchip/nps_enet.c +@@ -421,7 +421,7 @@ static s32 nps_enet_set_mac_address(struct net_device *ndev, void *p) + + res = eth_mac_addr(ndev, p); + if (!res) { +- ether_addr_copy(ndev->dev_addr, addr->sa_data); ++ eth_hw_addr_set(ndev, addr->sa_data); + nps_enet_set_hw_mac_address(ndev); + } + +diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c +index 4a2dadb91f024..11f76e56d0316 100644 +--- a/drivers/net/ethernet/faraday/ftgmac100.c ++++ b/drivers/net/ethernet/faraday/ftgmac100.c +@@ -186,7 +186,7 @@ static void ftgmac100_initial_mac(struct ftgmac100 *priv) + + addr = device_get_mac_address(priv->dev, mac, ETH_ALEN); + if (addr) { +- ether_addr_copy(priv->netdev->dev_addr, mac); ++ eth_hw_addr_set(priv->netdev, mac); + dev_info(priv->dev, "Read MAC address %pM from device tree\n", + mac); + return; +@@ -203,7 +203,7 @@ static void ftgmac100_initial_mac(struct ftgmac100 *priv) + mac[5] = l & 0xff; + + if (is_valid_ether_addr(mac)) { +- ether_addr_copy(priv->netdev->dev_addr, mac); ++ eth_hw_addr_set(priv->netdev, mac); + dev_info(priv->dev, "Read MAC address %pM from chip\n", mac); + } else { + eth_hw_addr_random(priv->netdev); +diff --git a/drivers/net/ethernet/google/gve/gve_adminq.c b/drivers/net/ethernet/google/gve/gve_adminq.c +index ce507464f3d62..54d649e5ee65b 100644 +--- a/drivers/net/ethernet/google/gve/gve_adminq.c ++++ b/drivers/net/ethernet/google/gve/gve_adminq.c +@@ -733,7 +733,7 @@ int gve_adminq_describe_device(struct gve_priv *priv) + } + priv->dev->max_mtu = mtu; + priv->num_event_counters = be16_to_cpu(descriptor->counters); +- ether_addr_copy(priv->dev->dev_addr, descriptor->mac); ++ eth_hw_addr_set(priv->dev, descriptor->mac); + mac = descriptor->mac; + dev_info(&priv->pdev->dev, "MAC addr: %pM\n", mac); + priv->tx_pages_per_qpl = be16_to_cpu(descriptor->tx_pages_per_qpl); +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +index dc835f316d471..2acf50ed6025a 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -2251,7 +2251,7 @@ static int hns3_nic_net_set_mac_address(struct net_device *netdev, void *p) + return ret; + } + +- ether_addr_copy(netdev->dev_addr, mac_addr->sa_data); ++ eth_hw_addr_set(netdev, mac_addr->sa_data); + + return 0; + } +@@ -4921,7 +4921,7 @@ static int hns3_init_mac_addr(struct net_device *netdev) + dev_warn(priv->dev, "using random MAC address %s\n", + format_mac_addr); + } else if (!ether_addr_equal(netdev->dev_addr, mac_addr_temp)) { +- ether_addr_copy(netdev->dev_addr, mac_addr_temp); ++ eth_hw_addr_set(netdev, mac_addr_temp); + ether_addr_copy(netdev->perm_addr, mac_addr_temp); + } else { + return 0; +diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c +index 3d9b4f99d357f..77d8db9b8a1d8 100644 +--- a/drivers/net/ethernet/ibm/ibmveth.c ++++ b/drivers/net/ethernet/ibm/ibmveth.c +@@ -1620,7 +1620,7 @@ static int ibmveth_set_mac_addr(struct net_device *dev, void *p) + return rc; + } + +- ether_addr_copy(dev->dev_addr, addr->sa_data); ++ eth_hw_addr_set(dev, addr->sa_data); + + return 0; + } +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 765dee2e4882e..450b4fd9aa7f7 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -4689,8 +4689,7 @@ static int handle_change_mac_rsp(union ibmvnic_crq *crq, + /* crq->change_mac_addr.mac_addr is the requested one + * crq->change_mac_addr_rsp.mac_addr is the returned valid one. + */ +- ether_addr_copy(netdev->dev_addr, +- &crq->change_mac_addr_rsp.mac_addr[0]); ++ eth_hw_addr_set(netdev, &crq->change_mac_addr_rsp.mac_addr[0]); + ether_addr_copy(adapter->mac_addr, + &crq->change_mac_addr_rsp.mac_addr[0]); + out: +@@ -5658,7 +5657,7 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id) + adapter->login_pending = false; + + ether_addr_copy(adapter->mac_addr, mac_addr_p); +- ether_addr_copy(netdev->dev_addr, adapter->mac_addr); ++ eth_hw_addr_set(netdev, adapter->mac_addr); + netdev->irq = dev->irq; + netdev->netdev_ops = &ibmvnic_netdev_ops; + netdev->ethtool_ops = &ibmvnic_ethtool_ops; +diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c b/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c +index 2fb52bd6fc0e1..2cca9e84e31e1 100644 +--- a/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c ++++ b/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c +@@ -990,7 +990,7 @@ static int fm10k_set_mac(struct net_device *dev, void *p) + } + + if (!err) { +- ether_addr_copy(dev->dev_addr, addr->sa_data); ++ eth_hw_addr_set(dev, addr->sa_data); + ether_addr_copy(hw->mac.addr, addr->sa_data); + dev->addr_assign_type &= ~NET_ADDR_RANDOM; + } +diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_pci.c b/drivers/net/ethernet/intel/fm10k/fm10k_pci.c +index adfa2768f024d..b473cb7d7c575 100644 +--- a/drivers/net/ethernet/intel/fm10k/fm10k_pci.c ++++ b/drivers/net/ethernet/intel/fm10k/fm10k_pci.c +@@ -300,7 +300,7 @@ static int fm10k_handle_reset(struct fm10k_intfc *interface) + if (is_valid_ether_addr(hw->mac.perm_addr)) { + ether_addr_copy(hw->mac.addr, hw->mac.perm_addr); + ether_addr_copy(netdev->perm_addr, hw->mac.perm_addr); +- ether_addr_copy(netdev->dev_addr, hw->mac.perm_addr); ++ eth_hw_addr_set(netdev, hw->mac.perm_addr); + netdev->addr_assign_type &= ~NET_ADDR_RANDOM; + } + +@@ -2045,7 +2045,7 @@ static int fm10k_sw_init(struct fm10k_intfc *interface, + netdev->addr_assign_type |= NET_ADDR_RANDOM; + } + +- ether_addr_copy(netdev->dev_addr, hw->mac.addr); ++ eth_hw_addr_set(netdev, hw->mac.addr); + ether_addr_copy(netdev->perm_addr, hw->mac.addr); + + if (!is_valid_ether_addr(netdev->perm_addr)) { +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 8411f277d1355..d3f3874220a31 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -1686,7 +1686,7 @@ static int i40e_set_mac(struct net_device *netdev, void *p) + */ + spin_lock_bh(&vsi->mac_filter_hash_lock); + i40e_del_mac_filter(vsi, netdev->dev_addr); +- ether_addr_copy(netdev->dev_addr, addr->sa_data); ++ eth_hw_addr_set(netdev, addr->sa_data); + i40e_add_mac_filter(vsi, netdev->dev_addr); + spin_unlock_bh(&vsi->mac_filter_hash_lock); + +@@ -13659,7 +13659,7 @@ static int i40e_config_netdev(struct i40e_vsi *vsi) + i40e_add_mac_filter(vsi, broadcast); + spin_unlock_bh(&vsi->mac_filter_hash_lock); + +- ether_addr_copy(netdev->dev_addr, mac_addr); ++ eth_hw_addr_set(netdev, mac_addr); + ether_addr_copy(netdev->perm_addr, mac_addr); + + /* i40iw_net_event() reads 16 bytes from neigh->primary_key */ +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index a3caab0b6fa2a..3e45ca40288ad 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -1963,7 +1963,7 @@ static void iavf_init_get_resources(struct iavf_adapter *adapter) + eth_hw_addr_random(netdev); + ether_addr_copy(adapter->hw.mac.addr, netdev->dev_addr); + } else { +- ether_addr_copy(netdev->dev_addr, adapter->hw.mac.addr); ++ eth_hw_addr_set(netdev, adapter->hw.mac.addr); + ether_addr_copy(netdev->perm_addr, adapter->hw.mac.addr); + } + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +index c6eb0d0748ea9..262482c694587 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +@@ -1726,7 +1726,7 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, + if (!v_retval) + iavf_mac_add_ok(adapter); + if (!ether_addr_equal(netdev->dev_addr, adapter->hw.mac.addr)) +- ether_addr_copy(netdev->dev_addr, adapter->hw.mac.addr); ++ eth_hw_addr_set(netdev, adapter->hw.mac.addr); + break; + case VIRTCHNL_OP_GET_STATS: { + struct iavf_eth_stats *stats = +@@ -1757,7 +1757,7 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, + ether_addr_copy(adapter->hw.mac.addr, netdev->dev_addr); + } else { + /* refresh current mac address if changed */ +- ether_addr_copy(netdev->dev_addr, adapter->hw.mac.addr); ++ eth_hw_addr_set(netdev, adapter->hw.mac.addr); + ether_addr_copy(netdev->perm_addr, + adapter->hw.mac.addr); + } +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index bf9fe385274e1..a18fa054b4fae 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -3183,7 +3183,7 @@ static int ice_cfg_netdev(struct ice_vsi *vsi) + if (vsi->type == ICE_VSI_PF) { + SET_NETDEV_DEV(netdev, ice_pf_to_dev(vsi->back)); + ether_addr_copy(mac_addr, vsi->port_info->mac.perm_addr); +- ether_addr_copy(netdev->dev_addr, mac_addr); ++ eth_hw_addr_set(netdev, mac_addr); + ether_addr_copy(netdev->perm_addr, mac_addr); + } + +@@ -5225,7 +5225,7 @@ static int ice_set_mac_address(struct net_device *netdev, void *pi) + netdev_err(netdev, "can't set MAC %pM. filter update failed\n", + mac); + netif_addr_lock_bh(netdev); +- ether_addr_copy(netdev->dev_addr, old_mac); ++ eth_hw_addr_set(netdev, old_mac); + netif_addr_unlock_bh(netdev); + return err; + } +diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +index 0e7ff15af9687..3a05e458ded2f 100644 +--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c ++++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +@@ -2541,7 +2541,7 @@ void ixgbevf_reset(struct ixgbevf_adapter *adapter) + } + + if (is_valid_ether_addr(adapter->hw.mac.addr)) { +- ether_addr_copy(netdev->dev_addr, adapter->hw.mac.addr); ++ eth_hw_addr_set(netdev, adapter->hw.mac.addr); + ether_addr_copy(netdev->perm_addr, adapter->hw.mac.addr); + } + +@@ -3055,7 +3055,7 @@ static int ixgbevf_sw_init(struct ixgbevf_adapter *adapter) + else if (is_zero_ether_addr(adapter->hw.mac.addr)) + dev_info(&pdev->dev, + "MAC address not assigned by administrator.\n"); +- ether_addr_copy(netdev->dev_addr, hw->mac.addr); ++ eth_hw_addr_set(netdev, hw->mac.addr); + } + + if (!is_valid_ether_addr(netdev->dev_addr)) { +@@ -4232,7 +4232,7 @@ static int ixgbevf_set_mac(struct net_device *netdev, void *p) + + ether_addr_copy(hw->mac.addr, addr->sa_data); + ether_addr_copy(hw->mac.perm_addr, addr->sa_data); +- ether_addr_copy(netdev->dev_addr, addr->sa_data); ++ eth_hw_addr_set(netdev, addr->sa_data); + + return 0; + } +diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c +index 3e9f324f1061f..097516af43256 100644 +--- a/drivers/net/ethernet/korina.c ++++ b/drivers/net/ethernet/korina.c +@@ -1297,7 +1297,7 @@ static int korina_probe(struct platform_device *pdev) + lp = netdev_priv(dev); + + if (mac_addr) +- ether_addr_copy(dev->dev_addr, mac_addr); ++ eth_hw_addr_set(dev, mac_addr); + else if (of_get_mac_address(pdev->dev.of_node, dev->dev_addr) < 0) + eth_hw_addr_random(dev); + +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +index 524913c28f3b6..ddd4ed34b0f20 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +@@ -6087,7 +6087,7 @@ static void mvpp2_port_copy_mac_addr(struct net_device *dev, struct mvpp2 *priv, + + if (fwnode_get_mac_address(fwnode, fw_mac_addr, ETH_ALEN)) { + *mac_from = "firmware node"; +- ether_addr_copy(dev->dev_addr, fw_mac_addr); ++ eth_hw_addr_set(dev, fw_mac_addr); + return; + } + +@@ -6095,7 +6095,7 @@ static void mvpp2_port_copy_mac_addr(struct net_device *dev, struct mvpp2 *priv, + mvpp21_get_mac_address(port, hw_mac_addr); + if (is_valid_ether_addr(hw_mac_addr)) { + *mac_from = "hardware"; +- ether_addr_copy(dev->dev_addr, hw_mac_addr); ++ eth_hw_addr_set(dev, hw_mac_addr); + return; + } + } +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c +index a8188b972ccbc..9af22f497a40f 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c +@@ -2333,7 +2333,7 @@ int mvpp2_prs_update_mac_da(struct net_device *dev, const u8 *da) + return err; + + /* Set addr in the device */ +- ether_addr_copy(dev->dev_addr, da); ++ eth_hw_addr_set(dev, da); + + return 0; + } +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +index 2e225309de9ca..b743646993ca2 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +@@ -188,7 +188,7 @@ static int otx2_hw_get_mac_addr(struct otx2_nic *pfvf, + return PTR_ERR(msghdr); + } + rsp = (struct nix_get_mac_addr_rsp *)msghdr; +- ether_addr_copy(netdev->dev_addr, rsp->mac_addr); ++ eth_hw_addr_set(netdev, rsp->mac_addr); + mutex_unlock(&pfvf->mbox.lock); + + return 0; +diff --git a/drivers/net/ethernet/marvell/prestera/prestera_main.c b/drivers/net/ethernet/marvell/prestera/prestera_main.c +index 656c68cfd7ec6..912759ea6ec59 100644 +--- a/drivers/net/ethernet/marvell/prestera/prestera_main.c ++++ b/drivers/net/ethernet/marvell/prestera/prestera_main.c +@@ -141,7 +141,7 @@ static int prestera_port_set_mac_address(struct net_device *dev, void *p) + if (err) + return err; + +- ether_addr_copy(dev->dev_addr, addr->sa_data); ++ eth_hw_addr_set(dev, addr->sa_data); + + return 0; + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 82849bed27f4c..fdc4a5a80da41 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -3224,7 +3224,7 @@ static int mlx5e_set_mac(struct net_device *netdev, void *addr) + return -EADDRNOTAVAIL; + + netif_addr_lock_bh(netdev); +- ether_addr_copy(netdev->dev_addr, saddr->sa_data); ++ eth_hw_addr_set(netdev, saddr->sa_data); + netif_addr_unlock_bh(netdev); + + mlx5e_nic_set_rx_mode(priv); +diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c +index 6704f5c1aa32e..b990782c1eb1f 100644 +--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c ++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c +@@ -75,7 +75,7 @@ static void mlxbf_gige_initial_mac(struct mlxbf_gige *priv) + u64_to_ether_addr(local_mac, mac); + + if (is_valid_ether_addr(mac)) { +- ether_addr_copy(priv->netdev->dev_addr, mac); ++ eth_hw_addr_set(priv->netdev, mac); + } else { + /* Provide a random MAC if for some reason the device has + * not been configured with a valid MAC address already. +diff --git a/drivers/net/ethernet/microchip/enc28j60.c b/drivers/net/ethernet/microchip/enc28j60.c +index 09cdc2f2e7ffb..bf77e8adffbf3 100644 +--- a/drivers/net/ethernet/microchip/enc28j60.c ++++ b/drivers/net/ethernet/microchip/enc28j60.c +@@ -517,7 +517,7 @@ static int enc28j60_set_mac_address(struct net_device *dev, void *addr) + if (!is_valid_ether_addr(address->sa_data)) + return -EADDRNOTAVAIL; + +- ether_addr_copy(dev->dev_addr, address->sa_data); ++ eth_hw_addr_set(dev, address->sa_data); + return enc28j60_set_hw_macaddr(dev); + } + +@@ -1573,7 +1573,7 @@ static int enc28j60_probe(struct spi_device *spi) + } + + if (device_get_mac_address(&spi->dev, macaddr, sizeof(macaddr))) +- ether_addr_copy(dev->dev_addr, macaddr); ++ eth_hw_addr_set(dev, macaddr); + else + eth_hw_addr_random(dev); + enc28j60_set_hw_macaddr(dev); +diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c +index d66ee9bf5558c..a3392c74372a8 100644 +--- a/drivers/net/ethernet/microchip/lan743x_main.c ++++ b/drivers/net/ethernet/microchip/lan743x_main.c +@@ -829,7 +829,7 @@ static int lan743x_mac_init(struct lan743x_adapter *adapter) + eth_random_addr(adapter->mac_address); + } + lan743x_mac_set_address(adapter, adapter->mac_address); +- ether_addr_copy(netdev->dev_addr, adapter->mac_address); ++ eth_hw_addr_set(netdev, adapter->mac_address); + + return 0; + } +@@ -2677,7 +2677,7 @@ static int lan743x_netdev_set_mac_address(struct net_device *netdev, + ret = eth_prepare_mac_addr_change(netdev, sock_addr); + if (ret) + return ret; +- ether_addr_copy(netdev->dev_addr, sock_addr->sa_data); ++ eth_hw_addr_set(netdev, sock_addr->sa_data); + lan743x_mac_set_address(adapter, sock_addr->sa_data); + lan743x_rfe_update_mac_address(adapter); + return 0; +diff --git a/drivers/net/ethernet/microchip/sparx5/sparx5_netdev.c b/drivers/net/ethernet/microchip/sparx5/sparx5_netdev.c +index 5c7b21ce64edb..a84038db8e1ad 100644 +--- a/drivers/net/ethernet/microchip/sparx5/sparx5_netdev.c ++++ b/drivers/net/ethernet/microchip/sparx5/sparx5_netdev.c +@@ -172,7 +172,7 @@ static int sparx5_set_mac_address(struct net_device *dev, void *p) + sparx5_mact_learn(sparx5, PGID_CPU, addr->sa_data, port->pvid); + + /* Record the address */ +- ether_addr_copy(dev->dev_addr, addr->sa_data); ++ eth_hw_addr_set(dev, addr->sa_data); + + return 0; + } +diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c +index 4b8c239932178..6224b7c21e0af 100644 +--- a/drivers/net/ethernet/microsoft/mana/mana_en.c ++++ b/drivers/net/ethernet/microsoft/mana/mana_en.c +@@ -1619,7 +1619,7 @@ static int mana_init_port(struct net_device *ndev) + if (apc->num_queues > apc->max_queues) + apc->num_queues = apc->max_queues; + +- ether_addr_copy(ndev->dev_addr, apc->mac_addr); ++ eth_hw_addr_set(ndev, apc->mac_addr); + + return 0; + +diff --git a/drivers/net/ethernet/mscc/ocelot_net.c b/drivers/net/ethernet/mscc/ocelot_net.c +index c08c56e07b1d3..da8a4e01d4be3 100644 +--- a/drivers/net/ethernet/mscc/ocelot_net.c ++++ b/drivers/net/ethernet/mscc/ocelot_net.c +@@ -606,7 +606,7 @@ static int ocelot_port_set_mac_address(struct net_device *dev, void *p) + /* Then forget the previous one. */ + ocelot_mact_forget(ocelot, dev->dev_addr, ocelot_port->pvid_vlan.vid); + +- ether_addr_copy(dev->dev_addr, addr->sa_data); ++ eth_hw_addr_set(dev, addr->sa_data); + return 0; + } + +diff --git a/drivers/net/ethernet/netronome/nfp/abm/main.c b/drivers/net/ethernet/netronome/nfp/abm/main.c +index 605a1617b195e..5d3df28c648ff 100644 +--- a/drivers/net/ethernet/netronome/nfp/abm/main.c ++++ b/drivers/net/ethernet/netronome/nfp/abm/main.c +@@ -305,7 +305,7 @@ nfp_abm_vnic_set_mac(struct nfp_pf *pf, struct nfp_abm *abm, struct nfp_net *nn, + return; + } + +- ether_addr_copy(nn->dp.netdev->dev_addr, mac_addr); ++ eth_hw_addr_set(nn->dp.netdev, mac_addr); + ether_addr_copy(nn->dp.netdev->perm_addr, mac_addr); + } + +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_main.c b/drivers/net/ethernet/netronome/nfp/nfp_net_main.c +index d10a938013445..74c4bf4d397d8 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_main.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_main.c +@@ -55,7 +55,7 @@ nfp_net_get_mac_addr(struct nfp_pf *pf, struct net_device *netdev, + return; + } + +- ether_addr_copy(netdev->dev_addr, eth_port->mac_addr); ++ eth_hw_addr_set(netdev, eth_port->mac_addr); + ether_addr_copy(netdev->perm_addr, eth_port->mac_addr); + } + +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_netvf_main.c b/drivers/net/ethernet/netronome/nfp/nfp_netvf_main.c +index c0e2f4394aef8..87f2268b16d6e 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_netvf_main.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_netvf_main.c +@@ -58,7 +58,7 @@ static void nfp_netvf_get_mac_addr(struct nfp_net *nn) + return; + } + +- ether_addr_copy(nn->dp.netdev->dev_addr, mac_addr); ++ eth_hw_addr_set(nn->dp.netdev, mac_addr); + ether_addr_copy(nn->dp.netdev->perm_addr, mac_addr); + } + +diff --git a/drivers/net/ethernet/ni/nixge.c b/drivers/net/ethernet/ni/nixge.c +index 5d0cecf80b380..486fa794b6c7a 100644 +--- a/drivers/net/ethernet/ni/nixge.c ++++ b/drivers/net/ethernet/ni/nixge.c +@@ -1285,7 +1285,7 @@ static int nixge_probe(struct platform_device *pdev) + + mac_addr = nixge_get_nvmem_address(&pdev->dev); + if (mac_addr && is_valid_ether_addr(mac_addr)) { +- ether_addr_copy(ndev->dev_addr, mac_addr); ++ eth_hw_addr_set(ndev, mac_addr); + kfree(mac_addr); + } else { + eth_hw_addr_random(ndev); +diff --git a/drivers/net/ethernet/qlogic/qede/qede_filter.c b/drivers/net/ethernet/qlogic/qede/qede_filter.c +index f99b085b56a54..03c51dd37e1f3 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede_filter.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_filter.c +@@ -557,7 +557,7 @@ void qede_force_mac(void *dev, u8 *mac, bool forced) + return; + } + +- ether_addr_copy(edev->ndev->dev_addr, mac); ++ eth_hw_addr_set(edev->ndev, mac); + __qede_unlock(edev); + } + +@@ -1101,7 +1101,7 @@ int qede_set_mac_addr(struct net_device *ndev, void *p) + goto out; + } + +- ether_addr_copy(ndev->dev_addr, addr->sa_data); ++ eth_hw_addr_set(ndev, addr->sa_data); + DP_INFO(edev, "Setting device MAC to %pM\n", addr->sa_data); + + if (edev->state != QEDE_STATE_OPEN) { +diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c +index 41f0a3433c3a2..6c22bfc16ee6b 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede_main.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_main.c +@@ -843,7 +843,7 @@ static void qede_init_ndev(struct qede_dev *edev) + ndev->max_mtu = QEDE_MAX_JUMBO_PACKET_SIZE; + + /* Set network device HW mac */ +- ether_addr_copy(edev->ndev->dev_addr, edev->dev_info.common.hw_mac); ++ eth_hw_addr_set(edev->ndev, edev->dev_info.common.hw_mac); + + ndev->mtu = edev->dev_info.common.mtu; + } +diff --git a/drivers/net/ethernet/qualcomm/emac/emac.c b/drivers/net/ethernet/qualcomm/emac/emac.c +index bb7f3286824f4..94090856cf3a9 100644 +--- a/drivers/net/ethernet/qualcomm/emac/emac.c ++++ b/drivers/net/ethernet/qualcomm/emac/emac.c +@@ -550,7 +550,7 @@ static int emac_probe_resources(struct platform_device *pdev, + + /* get mac address */ + if (device_get_mac_address(&pdev->dev, maddr, ETH_ALEN)) +- ether_addr_copy(netdev->dev_addr, maddr); ++ eth_hw_addr_set(netdev, maddr); + else + eth_hw_addr_random(netdev); + +diff --git a/drivers/net/ethernet/sfc/ef10_sriov.c b/drivers/net/ethernet/sfc/ef10_sriov.c +index f488461a23d1c..eeaecea77cb83 100644 +--- a/drivers/net/ethernet/sfc/ef10_sriov.c ++++ b/drivers/net/ethernet/sfc/ef10_sriov.c +@@ -527,7 +527,7 @@ int efx_ef10_sriov_set_vf_mac(struct efx_nic *efx, int vf_i, u8 *mac) + goto fail; + + if (vf->efx) +- ether_addr_copy(vf->efx->net_dev->dev_addr, mac); ++ eth_hw_addr_set(vf->efx->net_dev, mac); + } + + ether_addr_copy(vf->mac, mac); +diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c +index 41eb6f9f5596e..bc1f4350360bc 100644 +--- a/drivers/net/ethernet/sfc/efx.c ++++ b/drivers/net/ethernet/sfc/efx.c +@@ -128,7 +128,7 @@ static int efx_probe_port(struct efx_nic *efx) + return rc; + + /* Initialise MAC address to permanent address */ +- ether_addr_copy(efx->net_dev->dev_addr, efx->net_dev->perm_addr); ++ eth_hw_addr_set(efx->net_dev, efx->net_dev->perm_addr); + + return 0; + } +diff --git a/drivers/net/ethernet/sfc/efx_common.c b/drivers/net/ethernet/sfc/efx_common.c +index 6038b7e3e8236..7249ea594b31d 100644 +--- a/drivers/net/ethernet/sfc/efx_common.c ++++ b/drivers/net/ethernet/sfc/efx_common.c +@@ -181,11 +181,11 @@ int efx_set_mac_address(struct net_device *net_dev, void *data) + + /* save old address */ + ether_addr_copy(old_addr, net_dev->dev_addr); +- ether_addr_copy(net_dev->dev_addr, new_addr); ++ eth_hw_addr_set(net_dev, new_addr); + if (efx->type->set_mac_address) { + rc = efx->type->set_mac_address(efx); + if (rc) { +- ether_addr_copy(net_dev->dev_addr, old_addr); ++ eth_hw_addr_set(net_dev, old_addr); + return rc; + } + } +diff --git a/drivers/net/ethernet/sfc/falcon/efx.c b/drivers/net/ethernet/sfc/falcon/efx.c +index 423bdf81200fd..c68837a951f47 100644 +--- a/drivers/net/ethernet/sfc/falcon/efx.c ++++ b/drivers/net/ethernet/sfc/falcon/efx.c +@@ -1044,7 +1044,7 @@ static int ef4_probe_port(struct ef4_nic *efx) + return rc; + + /* Initialise MAC address to permanent address */ +- ether_addr_copy(efx->net_dev->dev_addr, efx->net_dev->perm_addr); ++ eth_hw_addr_set(efx->net_dev, efx->net_dev->perm_addr); + + return 0; + } +@@ -2162,11 +2162,11 @@ static int ef4_set_mac_address(struct net_device *net_dev, void *data) + + /* save old address */ + ether_addr_copy(old_addr, net_dev->dev_addr); +- ether_addr_copy(net_dev->dev_addr, new_addr); ++ eth_hw_addr_set(net_dev, new_addr); + if (efx->type->set_mac_address) { + rc = efx->type->set_mac_address(efx); + if (rc) { +- ether_addr_copy(net_dev->dev_addr, old_addr); ++ eth_hw_addr_set(net_dev, old_addr); + return rc; + } + } +diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c +index f0451911ab8f6..6b8013fb17c38 100644 +--- a/drivers/net/ethernet/socionext/netsec.c ++++ b/drivers/net/ethernet/socionext/netsec.c +@@ -2041,7 +2041,7 @@ static int netsec_probe(struct platform_device *pdev) + + mac = device_get_mac_address(&pdev->dev, macbuf, sizeof(macbuf)); + if (mac) +- ether_addr_copy(ndev->dev_addr, mac); ++ eth_hw_addr_set(ndev, mac); + + if (priv->eeprom_base && + (!mac || !is_valid_ether_addr(ndev->dev_addr))) { +diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +index 692c291d9a01a..daf0779261f3e 100644 +--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c ++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +@@ -1981,7 +1981,7 @@ am65_cpsw_nuss_init_port_ndev(struct am65_cpsw_common *common, u32 port_idx) + ndev_priv->msg_enable = AM65_CPSW_DEBUG; + SET_NETDEV_DEV(port->ndev, dev); + +- ether_addr_copy(port->ndev->dev_addr, port->slave.mac_addr); ++ eth_hw_addr_set(port->ndev, port->slave.mac_addr); + + port->ndev->min_mtu = AM65_CPSW_MIN_PACKET_SIZE; + port->ndev->max_mtu = AM65_CPSW_MAX_PACKET_SIZE; +diff --git a/drivers/net/ethernet/ti/cpsw_new.c b/drivers/net/ethernet/ti/cpsw_new.c +index 277c91d135708..0d921f6542d6f 100644 +--- a/drivers/net/ethernet/ti/cpsw_new.c ++++ b/drivers/net/ethernet/ti/cpsw_new.c +@@ -1000,7 +1000,7 @@ static int cpsw_ndo_set_mac_address(struct net_device *ndev, void *p) + flags, vid); + + ether_addr_copy(priv->mac_addr, addr->sa_data); +- ether_addr_copy(ndev->dev_addr, priv->mac_addr); ++ eth_hw_addr_set(ndev, priv->mac_addr); + cpsw_set_slave_mac(&cpsw->slaves[slave_no], priv); + + pm_runtime_put(cpsw->dev); +@@ -1404,7 +1404,7 @@ static int cpsw_create_ports(struct cpsw_common *cpsw) + dev_info(cpsw->dev, "Random MACID = %pM\n", + priv->mac_addr); + } +- ether_addr_copy(ndev->dev_addr, slave_data->mac_addr); ++ eth_hw_addr_set(ndev, slave_data->mac_addr); + ether_addr_copy(priv->mac_addr, slave_data->mac_addr); + + cpsw->slaves[i].ndev = ndev; +diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c +index d243ca5dfde00..fbd6bd80f51f4 100644 +--- a/drivers/net/ethernet/ti/davinci_emac.c ++++ b/drivers/net/ethernet/ti/davinci_emac.c +@@ -1911,7 +1911,7 @@ static int davinci_emac_probe(struct platform_device *pdev) + + rc = davinci_emac_try_get_mac(pdev, res_ctrl ? 0 : 1, priv->mac_addr); + if (!rc) +- ether_addr_copy(ndev->dev_addr, priv->mac_addr); ++ eth_hw_addr_set(ndev, priv->mac_addr); + + if (!is_valid_ether_addr(priv->mac_addr)) { + /* Use random MAC if still none obtained. */ +diff --git a/drivers/net/ethernet/ti/netcp_core.c b/drivers/net/ethernet/ti/netcp_core.c +index 07bdeece1723d..0cd47348890db 100644 +--- a/drivers/net/ethernet/ti/netcp_core.c ++++ b/drivers/net/ethernet/ti/netcp_core.c +@@ -2028,7 +2028,7 @@ static int netcp_create_interface(struct netcp_device *netcp_device, + + emac_arch_get_mac_addr(efuse_mac_addr, efuse, efuse_mac); + if (is_valid_ether_addr(efuse_mac_addr)) +- ether_addr_copy(ndev->dev_addr, efuse_mac_addr); ++ eth_hw_addr_set(ndev, efuse_mac_addr); + else + eth_random_addr(ndev->dev_addr); + +diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h +index 7f28fa702bb72..ca0e26a858bee 100644 +--- a/include/linux/etherdevice.h ++++ b/include/linux/etherdevice.h +@@ -323,7 +323,7 @@ static inline void eth_hw_addr_inherit(struct net_device *dst, + struct net_device *src) + { + dst->addr_assign_type = src->addr_assign_type; +- ether_addr_copy(dst->dev_addr, src->dev_addr); ++ eth_hw_addr_set(dst, src->dev_addr); + } + + /** +-- +2.39.2 + diff --git a/queue-5.15/ethernet-use-of_get_ethdev_address.patch b/queue-5.15/ethernet-use-of_get_ethdev_address.patch new file mode 100644 index 00000000000..49998acc84d --- /dev/null +++ b/queue-5.15/ethernet-use-of_get_ethdev_address.patch @@ -0,0 +1,504 @@ +From b1e4ade005154d6ebbab3737b1ef857da763a9ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Oct 2021 18:06:56 -0700 +Subject: ethernet: use of_get_ethdev_address() + +From: Jakub Kicinski + +[ Upstream commit 9ca01b25dffffecf6c59339aad6b4736680e9fa3 ] + +Use the new of_get_ethdev_address() helper for the cases +where dev->dev_addr is passed in directly as the destination. + + @@ + expression dev, np; + @@ + - of_get_mac_address(np, dev->dev_addr) + + of_get_ethdev_address(np, dev) + +Signed-off-by: Jakub Kicinski +Signed-off-by: David S. Miller +Stable-dep-of: 1d6d537dc55d ("net: ethernet: mtk_eth_soc: handle probe deferral") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/allwinner/sun4i-emac.c | 2 +- + drivers/net/ethernet/altera/altera_tse_main.c | 2 +- + drivers/net/ethernet/arc/emac_main.c | 2 +- + drivers/net/ethernet/atheros/ag71xx.c | 2 +- + drivers/net/ethernet/broadcom/bcm4908_enet.c | 2 +- + drivers/net/ethernet/broadcom/bcmsysport.c | 2 +- + drivers/net/ethernet/broadcom/bgmac-bcma.c | 2 +- + drivers/net/ethernet/broadcom/bgmac-platform.c | 2 +- + drivers/net/ethernet/cadence/macb_main.c | 2 +- + drivers/net/ethernet/cavium/octeon/octeon_mgmt.c | 2 +- + drivers/net/ethernet/ethoc.c | 2 +- + drivers/net/ethernet/ezchip/nps_enet.c | 2 +- + drivers/net/ethernet/freescale/fec_mpc52xx.c | 2 +- + drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c | 2 +- + drivers/net/ethernet/freescale/gianfar.c | 2 +- + drivers/net/ethernet/freescale/ucc_geth.c | 2 +- + drivers/net/ethernet/hisilicon/hisi_femac.c | 2 +- + drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 2 +- + drivers/net/ethernet/korina.c | 2 +- + drivers/net/ethernet/lantiq_xrx200.c | 2 +- + drivers/net/ethernet/litex/litex_liteeth.c | 2 +- + drivers/net/ethernet/marvell/mvneta.c | 2 +- + drivers/net/ethernet/marvell/pxa168_eth.c | 2 +- + drivers/net/ethernet/marvell/sky2.c | 2 +- + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +- + drivers/net/ethernet/micrel/ks8851_common.c | 2 +- + drivers/net/ethernet/nxp/lpc_eth.c | 2 +- + drivers/net/ethernet/qualcomm/qca_spi.c | 2 +- + drivers/net/ethernet/qualcomm/qca_uart.c | 2 +- + drivers/net/ethernet/renesas/ravb_main.c | 2 +- + drivers/net/ethernet/samsung/sxgbe/sxgbe_platform.c | 2 +- + drivers/net/ethernet/socionext/sni_ave.c | 2 +- + drivers/net/ethernet/ti/netcp_core.c | 2 +- + drivers/net/ethernet/xilinx/xilinx_emaclite.c | 2 +- + 34 files changed, 34 insertions(+), 34 deletions(-) + +diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c +index 037baea1c7388..ef218a6d477cc 100644 +--- a/drivers/net/ethernet/allwinner/sun4i-emac.c ++++ b/drivers/net/ethernet/allwinner/sun4i-emac.c +@@ -852,7 +852,7 @@ static int emac_probe(struct platform_device *pdev) + } + + /* Read MAC-address from DT */ +- ret = of_get_mac_address(np, ndev->dev_addr); ++ ret = of_get_ethdev_address(np, ndev); + if (ret) { + /* if the MAC address is invalid get a random one */ + eth_hw_addr_random(ndev); +diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c +index b51f5b9577e0a..9e721436f06fa 100644 +--- a/drivers/net/ethernet/altera/altera_tse_main.c ++++ b/drivers/net/ethernet/altera/altera_tse_main.c +@@ -1531,7 +1531,7 @@ static int altera_tse_probe(struct platform_device *pdev) + priv->rx_dma_buf_sz = ALTERA_RXDMABUFFER_SIZE; + + /* get default MAC address from device tree */ +- ret = of_get_mac_address(pdev->dev.of_node, ndev->dev_addr); ++ ret = of_get_ethdev_address(pdev->dev.of_node, ndev); + if (ret) + eth_hw_addr_random(ndev); + +diff --git a/drivers/net/ethernet/arc/emac_main.c b/drivers/net/ethernet/arc/emac_main.c +index 38c288ec90590..333333692caa5 100644 +--- a/drivers/net/ethernet/arc/emac_main.c ++++ b/drivers/net/ethernet/arc/emac_main.c +@@ -941,7 +941,7 @@ int arc_emac_probe(struct net_device *ndev, int interface) + } + + /* Get MAC address from device tree */ +- err = of_get_mac_address(dev->of_node, ndev->dev_addr); ++ err = of_get_ethdev_address(dev->of_node, ndev); + if (err) + eth_hw_addr_random(ndev); + +diff --git a/drivers/net/ethernet/atheros/ag71xx.c b/drivers/net/ethernet/atheros/ag71xx.c +index 7295244b78d07..9d8b214c129d2 100644 +--- a/drivers/net/ethernet/atheros/ag71xx.c ++++ b/drivers/net/ethernet/atheros/ag71xx.c +@@ -1964,7 +1964,7 @@ static int ag71xx_probe(struct platform_device *pdev) + ag->stop_desc->ctrl = 0; + ag->stop_desc->next = (u32)ag->stop_desc_dma; + +- err = of_get_mac_address(np, ndev->dev_addr); ++ err = of_get_ethdev_address(np, ndev); + if (err) { + netif_err(ag, probe, ndev, "invalid MAC address, using random address\n"); + eth_random_addr(ndev->dev_addr); +diff --git a/drivers/net/ethernet/broadcom/bcm4908_enet.c b/drivers/net/ethernet/broadcom/bcm4908_enet.c +index 7e89664943ceb..ba48ddff5e7cd 100644 +--- a/drivers/net/ethernet/broadcom/bcm4908_enet.c ++++ b/drivers/net/ethernet/broadcom/bcm4908_enet.c +@@ -719,7 +719,7 @@ static int bcm4908_enet_probe(struct platform_device *pdev) + return err; + + SET_NETDEV_DEV(netdev, &pdev->dev); +- err = of_get_mac_address(dev->of_node, netdev->dev_addr); ++ err = of_get_ethdev_address(dev->of_node, netdev); + if (err) + eth_hw_addr_random(netdev); + netdev->netdev_ops = &bcm4908_enet_netdev_ops; +diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c +index 4c7f828c69c6b..25466d73b432a 100644 +--- a/drivers/net/ethernet/broadcom/bcmsysport.c ++++ b/drivers/net/ethernet/broadcom/bcmsysport.c +@@ -2561,7 +2561,7 @@ static int bcm_sysport_probe(struct platform_device *pdev) + } + + /* Initialize netdevice members */ +- ret = of_get_mac_address(dn, dev->dev_addr); ++ ret = of_get_ethdev_address(dn, dev); + if (ret) { + dev_warn(&pdev->dev, "using random Ethernet MAC\n"); + eth_hw_addr_random(dev); +diff --git a/drivers/net/ethernet/broadcom/bgmac-bcma.c b/drivers/net/ethernet/broadcom/bgmac-bcma.c +index bdb1b8053b69f..678cc6a3617c3 100644 +--- a/drivers/net/ethernet/broadcom/bgmac-bcma.c ++++ b/drivers/net/ethernet/broadcom/bgmac-bcma.c +@@ -128,7 +128,7 @@ static int bgmac_probe(struct bcma_device *core) + + bcma_set_drvdata(core, bgmac); + +- err = of_get_mac_address(bgmac->dev->of_node, bgmac->net_dev->dev_addr); ++ err = of_get_ethdev_address(bgmac->dev->of_node, bgmac->net_dev); + if (err == -EPROBE_DEFER) + return err; + +diff --git a/drivers/net/ethernet/broadcom/bgmac-platform.c b/drivers/net/ethernet/broadcom/bgmac-platform.c +index 94eb3a42158e9..b4381cd419792 100644 +--- a/drivers/net/ethernet/broadcom/bgmac-platform.c ++++ b/drivers/net/ethernet/broadcom/bgmac-platform.c +@@ -192,7 +192,7 @@ static int bgmac_probe(struct platform_device *pdev) + bgmac->dev = &pdev->dev; + bgmac->dma_dev = &pdev->dev; + +- ret = of_get_mac_address(np, bgmac->net_dev->dev_addr); ++ ret = of_get_ethdev_address(np, bgmac->net_dev); + if (ret == -EPROBE_DEFER) + return ret; + +diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c +index ddadb1822d897..dac56169851a2 100644 +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -4835,7 +4835,7 @@ static int macb_probe(struct platform_device *pdev) + if (bp->caps & MACB_CAPS_NEEDS_RSTONUBR) + bp->rx_intr_mask |= MACB_BIT(RXUBR); + +- err = of_get_mac_address(np, bp->dev->dev_addr); ++ err = of_get_ethdev_address(np, bp->dev); + if (err == -EPROBE_DEFER) + goto err_out_free_netdev; + else if (err) +diff --git a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c +index 30463a6d1f8c9..4e39d712e121e 100644 +--- a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c ++++ b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c +@@ -1501,7 +1501,7 @@ static int octeon_mgmt_probe(struct platform_device *pdev) + netdev->min_mtu = 64 - OCTEON_MGMT_RX_HEADROOM; + netdev->max_mtu = 16383 - OCTEON_MGMT_RX_HEADROOM - VLAN_HLEN; + +- result = of_get_mac_address(pdev->dev.of_node, netdev->dev_addr); ++ result = of_get_ethdev_address(pdev->dev.of_node, netdev); + if (result) + eth_hw_addr_random(netdev); + +diff --git a/drivers/net/ethernet/ethoc.c b/drivers/net/ethernet/ethoc.c +index e63aef6a9e33a..7f456297fc458 100644 +--- a/drivers/net/ethernet/ethoc.c ++++ b/drivers/net/ethernet/ethoc.c +@@ -1151,7 +1151,7 @@ static int ethoc_probe(struct platform_device *pdev) + eth_hw_addr_set(netdev, pdata->hwaddr); + priv->phy_id = pdata->phy_id; + } else { +- of_get_mac_address(pdev->dev.of_node, netdev->dev_addr); ++ of_get_ethdev_address(pdev->dev.of_node, netdev); + priv->phy_id = -1; + } + +diff --git a/drivers/net/ethernet/ezchip/nps_enet.c b/drivers/net/ethernet/ezchip/nps_enet.c +index f5935eb5a791c..323340826dabd 100644 +--- a/drivers/net/ethernet/ezchip/nps_enet.c ++++ b/drivers/net/ethernet/ezchip/nps_enet.c +@@ -601,7 +601,7 @@ static s32 nps_enet_probe(struct platform_device *pdev) + dev_dbg(dev, "Registers base address is 0x%p\n", priv->regs_base); + + /* set kernel MAC address to dev */ +- err = of_get_mac_address(dev->of_node, ndev->dev_addr); ++ err = of_get_ethdev_address(dev->of_node, ndev); + if (err) + eth_hw_addr_random(ndev); + +diff --git a/drivers/net/ethernet/freescale/fec_mpc52xx.c b/drivers/net/ethernet/freescale/fec_mpc52xx.c +index 73ff359a15f1a..2777dd2b4dd78 100644 +--- a/drivers/net/ethernet/freescale/fec_mpc52xx.c ++++ b/drivers/net/ethernet/freescale/fec_mpc52xx.c +@@ -890,7 +890,7 @@ static int mpc52xx_fec_probe(struct platform_device *op) + * + * First try to read MAC address from DT + */ +- rv = of_get_mac_address(np, ndev->dev_addr); ++ rv = of_get_ethdev_address(np, ndev); + if (rv) { + struct mpc52xx_fec __iomem *fec = priv->fec; + +diff --git a/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c b/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c +index 2db6e38a772e7..bacf25318f87a 100644 +--- a/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c ++++ b/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c +@@ -1005,7 +1005,7 @@ static int fs_enet_probe(struct platform_device *ofdev) + spin_lock_init(&fep->lock); + spin_lock_init(&fep->tx_lock); + +- of_get_mac_address(ofdev->dev.of_node, ndev->dev_addr); ++ of_get_ethdev_address(ofdev->dev.of_node, ndev); + + ret = fep->ops->allocate_bd(ndev); + if (ret) +diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c +index af6ad94bf24a4..acab58fd3db38 100644 +--- a/drivers/net/ethernet/freescale/gianfar.c ++++ b/drivers/net/ethernet/freescale/gianfar.c +@@ -753,7 +753,7 @@ static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev) + if (stash_len || stash_idx) + priv->device_flags |= FSL_GIANFAR_DEV_HAS_BUF_STASHING; + +- err = of_get_mac_address(np, dev->dev_addr); ++ err = of_get_ethdev_address(np, dev); + if (err) { + eth_hw_addr_random(dev); + dev_info(&ofdev->dev, "Using random MAC address: %pM\n", dev->dev_addr); +diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c +index 3eb288d10b0c3..e0036fd2b56c7 100644 +--- a/drivers/net/ethernet/freescale/ucc_geth.c ++++ b/drivers/net/ethernet/freescale/ucc_geth.c +@@ -3731,7 +3731,7 @@ static int ucc_geth_probe(struct platform_device* ofdev) + goto err_free_netdev; + } + +- of_get_mac_address(np, dev->dev_addr); ++ of_get_ethdev_address(np, dev); + + ugeth->ug_info = ug_info; + ugeth->dev = device; +diff --git a/drivers/net/ethernet/hisilicon/hisi_femac.c b/drivers/net/ethernet/hisilicon/hisi_femac.c +index ea3e67cf5ffa1..05cb4582a58d5 100644 +--- a/drivers/net/ethernet/hisilicon/hisi_femac.c ++++ b/drivers/net/ethernet/hisilicon/hisi_femac.c +@@ -841,7 +841,7 @@ static int hisi_femac_drv_probe(struct platform_device *pdev) + (unsigned long)phy->phy_id, + phy_modes(phy->interface)); + +- ret = of_get_mac_address(node, ndev->dev_addr); ++ ret = of_get_ethdev_address(node, ndev); + if (ret) { + eth_hw_addr_random(ndev); + dev_warn(dev, "using random MAC address %pM\n", +diff --git a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c +index 0a70fb979f0c3..923191b9a87d4 100644 +--- a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c ++++ b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c +@@ -1219,7 +1219,7 @@ static int hix5hd2_dev_probe(struct platform_device *pdev) + goto out_phy_node; + } + +- ret = of_get_mac_address(node, ndev->dev_addr); ++ ret = of_get_ethdev_address(node, ndev); + if (ret) { + eth_hw_addr_random(ndev); + netdev_warn(ndev, "using random MAC address %pM\n", +diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c +index 097516af43256..df9a8eefa007a 100644 +--- a/drivers/net/ethernet/korina.c ++++ b/drivers/net/ethernet/korina.c +@@ -1298,7 +1298,7 @@ static int korina_probe(struct platform_device *pdev) + + if (mac_addr) + eth_hw_addr_set(dev, mac_addr); +- else if (of_get_mac_address(pdev->dev.of_node, dev->dev_addr) < 0) ++ else if (of_get_ethdev_address(pdev->dev.of_node, dev) < 0) + eth_hw_addr_random(dev); + + clk = devm_clk_get_optional(&pdev->dev, "mdioclk"); +diff --git a/drivers/net/ethernet/lantiq_xrx200.c b/drivers/net/ethernet/lantiq_xrx200.c +index b02f796b5422f..fa0ef1852fb76 100644 +--- a/drivers/net/ethernet/lantiq_xrx200.c ++++ b/drivers/net/ethernet/lantiq_xrx200.c +@@ -474,7 +474,7 @@ static int xrx200_probe(struct platform_device *pdev) + return PTR_ERR(priv->clk); + } + +- err = of_get_mac_address(np, net_dev->dev_addr); ++ err = of_get_ethdev_address(np, net_dev); + if (err) + eth_hw_addr_random(net_dev); + +diff --git a/drivers/net/ethernet/litex/litex_liteeth.c b/drivers/net/ethernet/litex/litex_liteeth.c +index 7b39b910e4a14..3abcc02fe0e45 100644 +--- a/drivers/net/ethernet/litex/litex_liteeth.c ++++ b/drivers/net/ethernet/litex/litex_liteeth.c +@@ -277,7 +277,7 @@ static int liteeth_probe(struct platform_device *pdev) + priv->tx_base = buf_base + priv->num_rx_slots * priv->slot_size; + priv->tx_slot = 0; + +- err = of_get_mac_address(pdev->dev.of_node, netdev->dev_addr); ++ err = of_get_ethdev_address(pdev->dev.of_node, netdev); + if (err) + eth_hw_addr_random(netdev); + +diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c +index f5b5ae58c2691..5fa81322a44be 100644 +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -5242,7 +5242,7 @@ static int mvneta_probe(struct platform_device *pdev) + goto err_free_ports; + } + +- err = of_get_mac_address(dn, dev->dev_addr); ++ err = of_get_ethdev_address(dn, dev); + if (!err) { + mac_from = "device tree"; + } else { +diff --git a/drivers/net/ethernet/marvell/pxa168_eth.c b/drivers/net/ethernet/marvell/pxa168_eth.c +index fab53c9b8380c..8ebd13f089db2 100644 +--- a/drivers/net/ethernet/marvell/pxa168_eth.c ++++ b/drivers/net/ethernet/marvell/pxa168_eth.c +@@ -1434,7 +1434,7 @@ static int pxa168_eth_probe(struct platform_device *pdev) + + INIT_WORK(&pep->tx_timeout_task, pxa168_eth_tx_timeout_task); + +- err = of_get_mac_address(pdev->dev.of_node, dev->dev_addr); ++ err = of_get_ethdev_address(pdev->dev.of_node, dev); + if (err) { + /* try reading the mac address, if set by the bootloader */ + pxa168_eth_get_mac_address(dev, dev->dev_addr); +diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c +index e9fc74e54b22e..ac0dbf1b97437 100644 +--- a/drivers/net/ethernet/marvell/sky2.c ++++ b/drivers/net/ethernet/marvell/sky2.c +@@ -4802,7 +4802,7 @@ static struct net_device *sky2_init_netdev(struct sky2_hw *hw, unsigned port, + * 1) from device tree data + * 2) from internal registers set by bootloader + */ +- ret = of_get_mac_address(hw->pdev->dev.of_node, dev->dev_addr); ++ ret = of_get_ethdev_address(hw->pdev->dev.of_node, dev); + if (ret) + memcpy_fromio(dev->dev_addr, hw->regs + B2_MAC_1 + port * 8, + ETH_ALEN); +diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +index bb1acdb0c62b3..c55ba1d085e5b 100644 +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +@@ -2618,7 +2618,7 @@ static int __init mtk_init(struct net_device *dev) + struct mtk_eth *eth = mac->hw; + int ret; + +- ret = of_get_mac_address(mac->of_node, dev->dev_addr); ++ ret = of_get_ethdev_address(mac->of_node, dev); + if (ret) { + /* If the mac address is invalid, use random mac address */ + eth_hw_addr_random(dev); +diff --git a/drivers/net/ethernet/micrel/ks8851_common.c b/drivers/net/ethernet/micrel/ks8851_common.c +index a6db1a8156e1a..2c80dba2606cd 100644 +--- a/drivers/net/ethernet/micrel/ks8851_common.c ++++ b/drivers/net/ethernet/micrel/ks8851_common.c +@@ -195,7 +195,7 @@ static void ks8851_init_mac(struct ks8851_net *ks, struct device_node *np) + struct net_device *dev = ks->netdev; + int ret; + +- ret = of_get_mac_address(np, dev->dev_addr); ++ ret = of_get_ethdev_address(np, dev); + if (!ret) { + ks8851_write_mac_addr(dev); + return; +diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c +index 919140522885d..b42b65fb034ed 100644 +--- a/drivers/net/ethernet/nxp/lpc_eth.c ++++ b/drivers/net/ethernet/nxp/lpc_eth.c +@@ -1349,7 +1349,7 @@ static int lpc_eth_drv_probe(struct platform_device *pdev) + __lpc_get_mac(pldat, ndev->dev_addr); + + if (!is_valid_ether_addr(ndev->dev_addr)) { +- of_get_mac_address(np, ndev->dev_addr); ++ of_get_ethdev_address(np, ndev); + } + if (!is_valid_ether_addr(ndev->dev_addr)) + eth_hw_addr_random(ndev); +diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c +index 2205bb437e680..a047bab1d7c7e 100644 +--- a/drivers/net/ethernet/qualcomm/qca_spi.c ++++ b/drivers/net/ethernet/qualcomm/qca_spi.c +@@ -967,7 +967,7 @@ qca_spi_probe(struct spi_device *spi) + + spi_set_drvdata(spi, qcaspi_devs); + +- ret = of_get_mac_address(spi->dev.of_node, qca->net_dev->dev_addr); ++ ret = of_get_ethdev_address(spi->dev.of_node, qca->net_dev); + if (ret) { + eth_hw_addr_random(qca->net_dev); + dev_info(&spi->dev, "Using random MAC address: %pM\n", +diff --git a/drivers/net/ethernet/qualcomm/qca_uart.c b/drivers/net/ethernet/qualcomm/qca_uart.c +index ce3f7ce31adc1..27c4f43176aaa 100644 +--- a/drivers/net/ethernet/qualcomm/qca_uart.c ++++ b/drivers/net/ethernet/qualcomm/qca_uart.c +@@ -347,7 +347,7 @@ static int qca_uart_probe(struct serdev_device *serdev) + + of_property_read_u32(serdev->dev.of_node, "current-speed", &speed); + +- ret = of_get_mac_address(serdev->dev.of_node, qca->net_dev->dev_addr); ++ ret = of_get_ethdev_address(serdev->dev.of_node, qca->net_dev); + if (ret) { + eth_hw_addr_random(qca->net_dev); + dev_info(&serdev->dev, "Using random MAC address: %pM\n", +diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c +index 12548eeef4f8a..4ee72d33e9cb7 100644 +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -114,7 +114,7 @@ static void ravb_read_mac_address(struct device_node *np, + { + int ret; + +- ret = of_get_mac_address(np, ndev->dev_addr); ++ ret = of_get_ethdev_address(np, ndev); + if (ret) { + u32 mahr = ravb_read(ndev, MAHR); + u32 malr = ravb_read(ndev, MALR); +diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_platform.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_platform.c +index 4639ed9438a3f..9265324666911 100644 +--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_platform.c ++++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_platform.c +@@ -118,7 +118,7 @@ static int sxgbe_platform_probe(struct platform_device *pdev) + } + + /* Get MAC address if available (DT) */ +- of_get_mac_address(node, priv->dev->dev_addr); ++ of_get_ethdev_address(node, priv->dev); + + /* Get the TX/RX IRQ numbers */ + for (i = 0, chan = 1; i < SXGBE_TX_QUEUES; i++) { +diff --git a/drivers/net/ethernet/socionext/sni_ave.c b/drivers/net/ethernet/socionext/sni_ave.c +index 57dc9680ad50a..8ff56e2c87746 100644 +--- a/drivers/net/ethernet/socionext/sni_ave.c ++++ b/drivers/net/ethernet/socionext/sni_ave.c +@@ -1601,7 +1601,7 @@ static int ave_probe(struct platform_device *pdev) + + ndev->max_mtu = AVE_MAX_ETHFRAME - (ETH_HLEN + ETH_FCS_LEN); + +- ret = of_get_mac_address(np, ndev->dev_addr); ++ ret = of_get_ethdev_address(np, ndev); + if (ret) { + /* if the mac address is invalid, use random mac address */ + eth_hw_addr_random(ndev); +diff --git a/drivers/net/ethernet/ti/netcp_core.c b/drivers/net/ethernet/ti/netcp_core.c +index 0cd47348890db..a6450055908db 100644 +--- a/drivers/net/ethernet/ti/netcp_core.c ++++ b/drivers/net/ethernet/ti/netcp_core.c +@@ -2035,7 +2035,7 @@ static int netcp_create_interface(struct netcp_device *netcp_device, + devm_iounmap(dev, efuse); + devm_release_mem_region(dev, res.start, size); + } else { +- ret = of_get_mac_address(node_interface, ndev->dev_addr); ++ ret = of_get_ethdev_address(node_interface, ndev); + if (ret) + eth_random_addr(ndev->dev_addr); + } +diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c +index b1971c4d5313e..093c75da38c47 100644 +--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c ++++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c +@@ -1151,7 +1151,7 @@ static int xemaclite_of_probe(struct platform_device *ofdev) + lp->tx_ping_pong = get_bool(ofdev, "xlnx,tx-ping-pong"); + lp->rx_ping_pong = get_bool(ofdev, "xlnx,rx-ping-pong"); + +- rc = of_get_mac_address(ofdev->dev.of_node, ndev->dev_addr); ++ rc = of_get_ethdev_address(ofdev->dev.of_node, ndev); + if (rc) { + dev_warn(dev, "No MAC address found, using random\n"); + eth_hw_addr_random(ndev); +-- +2.39.2 + diff --git a/queue-5.15/fbdev-au1200fb-fix-missing-irq-check-in-au1200fb_drv.patch b/queue-5.15/fbdev-au1200fb-fix-missing-irq-check-in-au1200fb_drv.patch new file mode 100644 index 00000000000..e9f9bf5ec36 --- /dev/null +++ b/queue-5.15/fbdev-au1200fb-fix-missing-irq-check-in-au1200fb_drv.patch @@ -0,0 +1,40 @@ +From 09ba291b1a43d05b5c6559901594b1ae4c7a1d7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Jul 2023 16:16:56 +0800 +Subject: fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe + +From: Zhang Shurong + +[ Upstream commit 4e88761f5f8c7869f15a2046b1a1116f4fab4ac8 ] + +This func misses checking for platform_get_irq()'s call and may passes the +negative error codes to request_irq(), which takes unsigned IRQ #, +causing it to fail with -EINVAL, overriding an original error code. + +Fix this by stop calling request_irq() with invalid IRQ #s. + +Fixes: 1630d85a8312 ("au1200fb: fix hardcoded IRQ") +Signed-off-by: Zhang Shurong +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/au1200fb.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/video/fbdev/au1200fb.c b/drivers/video/fbdev/au1200fb.c +index a8a0a448cdb5e..80f54111baec1 100644 +--- a/drivers/video/fbdev/au1200fb.c ++++ b/drivers/video/fbdev/au1200fb.c +@@ -1732,6 +1732,9 @@ static int au1200fb_drv_probe(struct platform_device *dev) + + /* Now hook interrupt too */ + irq = platform_get_irq(dev, 0); ++ if (irq < 0) ++ return irq; ++ + ret = request_irq(irq, au1200fb_handle_irq, + IRQF_SHARED, "lcd", (void *)dev); + if (ret) { +-- +2.39.2 + diff --git a/queue-5.15/fbdev-imxfb-warn-about-invalid-left-right-margin.patch b/queue-5.15/fbdev-imxfb-warn-about-invalid-left-right-margin.patch new file mode 100644 index 00000000000..f9ab0de4040 --- /dev/null +++ b/queue-5.15/fbdev-imxfb-warn-about-invalid-left-right-margin.patch @@ -0,0 +1,43 @@ +From 4221c1d46a5ba8e42b284534336a9f71c98095fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jun 2023 15:24:37 +0200 +Subject: fbdev: imxfb: warn about invalid left/right margin + +From: Martin Kaiser + +[ Upstream commit 4e47382fbca916d7db95cbf9e2d7ca2e9d1ca3fe ] + +Warn about invalid var->left_margin or var->right_margin. Their values +are read from the device tree. + +We store var->left_margin-3 and var->right_margin-1 in register +fields. These fields should be >= 0. + +Fixes: 7e8549bcee00 ("imxfb: Fix margin settings") +Signed-off-by: Martin Kaiser +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/imxfb.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/video/fbdev/imxfb.c b/drivers/video/fbdev/imxfb.c +index ad598257ab386..cd376a9bfe1b7 100644 +--- a/drivers/video/fbdev/imxfb.c ++++ b/drivers/video/fbdev/imxfb.c +@@ -602,10 +602,10 @@ static int imxfb_activate_var(struct fb_var_screeninfo *var, struct fb_info *inf + if (var->hsync_len < 1 || var->hsync_len > 64) + printk(KERN_ERR "%s: invalid hsync_len %d\n", + info->fix.id, var->hsync_len); +- if (var->left_margin > 255) ++ if (var->left_margin < 3 || var->left_margin > 255) + printk(KERN_ERR "%s: invalid left_margin %d\n", + info->fix.id, var->left_margin); +- if (var->right_margin > 255) ++ if (var->right_margin < 1 || var->right_margin > 255) + printk(KERN_ERR "%s: invalid right_margin %d\n", + info->fix.id, var->right_margin); + if (var->yres < 1 || var->yres > ymax_mask) +-- +2.39.2 + diff --git a/queue-5.15/fs-jfs-check-for-read-only-mounted-filesystem-in-txb.patch b/queue-5.15/fs-jfs-check-for-read-only-mounted-filesystem-in-txb.patch new file mode 100644 index 00000000000..29087f9182d --- /dev/null +++ b/queue-5.15/fs-jfs-check-for-read-only-mounted-filesystem-in-txb.patch @@ -0,0 +1,41 @@ +From 02b146546b30cc6dc399a184fa7e4c3751ac0676 Mon Sep 17 00:00:00 2001 +From: Immad Mir +Date: Fri, 23 Jun 2023 19:17:08 +0530 +Subject: [PATCH AUTOSEL 4.14 9/9] FS: JFS: Check for read-only mounted + filesystem in txBegin +X-stable: review +X-Patchwork-Hint: Ignore +X-stable-base: Linux 4.14.320 + +[ Upstream commit 95e2b352c03b0a86c5717ba1d24ea20969abcacc ] + + This patch adds a check for read-only mounted filesystem + in txBegin before starting a transaction potentially saving + from NULL pointer deref. + +Signed-off-by: Immad Mir +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_txnmgr.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c +index 224ef034004b7..2cb460912468e 100644 +--- a/fs/jfs/jfs_txnmgr.c ++++ b/fs/jfs/jfs_txnmgr.c +@@ -367,6 +367,11 @@ tid_t txBegin(struct super_block *sb, int flag) + jfs_info("txBegin: flag = 0x%x", flag); + log = JFS_SBI(sb)->log; + ++ if (!log) { ++ jfs_error(sb, "read-only filesystem\n"); ++ return 0; ++ } ++ + TXN_LOCK(); + + INCREMENT(TxStat.txBegin); +-- +2.39.2 + diff --git a/queue-5.15/fs-jfs-fix-null-ptr-deref-read-in-txbegin.patch b/queue-5.15/fs-jfs-fix-null-ptr-deref-read-in-txbegin.patch new file mode 100644 index 00000000000..35a95c307b6 --- /dev/null +++ b/queue-5.15/fs-jfs-fix-null-ptr-deref-read-in-txbegin.patch @@ -0,0 +1,45 @@ +From 4eae87f4bcf394c701b5e0627338b507007ebd56 Mon Sep 17 00:00:00 2001 +From: Immad Mir +Date: Fri, 23 Jun 2023 19:14:01 +0530 +Subject: [PATCH AUTOSEL 4.14 8/9] FS: JFS: Fix null-ptr-deref Read in txBegin +X-stable: review +X-Patchwork-Hint: Ignore +X-stable-base: Linux 4.14.320 + +[ Upstream commit 47cfdc338d674d38f4b2f22b7612cc6a2763ba27 ] + + Syzkaller reported an issue where txBegin may be called + on a superblock in a read-only mounted filesystem which leads + to NULL pointer deref. This could be solved by checking if + the filesystem is read-only before calling txBegin, and returning + with appropiate error code. + +Reported-By: syzbot+f1faa20eec55e0c8644c@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?id=be7e52c50c5182cc09a09ea6fc456446b2039de3 + +Signed-off-by: Immad Mir +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/namei.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c +index 56c3fcbfe80ed..6726dcddd6f86 100644 +--- a/fs/jfs/namei.c ++++ b/fs/jfs/namei.c +@@ -813,6 +813,11 @@ static int jfs_link(struct dentry *old_dentry, + if (rc) + goto out; + ++ if (isReadOnly(ip)) { ++ jfs_error(ip->i_sb, "read-only filesystem\n"); ++ return -EROFS; ++ } ++ + tid = txBegin(ip->i_sb, 0); + + mutex_lock_nested(&JFS_IP(dir)->commit_mutex, COMMIT_MUTEX_PARENT); +-- +2.39.2 + diff --git a/queue-5.15/fs-jfs-fix-ubsan-array-index-out-of-bounds-in-dballo.patch b/queue-5.15/fs-jfs-fix-ubsan-array-index-out-of-bounds-in-dballo.patch new file mode 100644 index 00000000000..870b91b80bf --- /dev/null +++ b/queue-5.15/fs-jfs-fix-ubsan-array-index-out-of-bounds-in-dballo.patch @@ -0,0 +1,88 @@ +From 3a311ae0bb5b7f141cfab45fc7bcc0df9e2c6c0a Mon Sep 17 00:00:00 2001 +From: Yogesh +Date: Thu, 22 Jun 2023 00:07:03 +0530 +Subject: [PATCH AUTOSEL 4.14 6/9] fs: jfs: Fix UBSAN: + array-index-out-of-bounds in dbAllocDmapLev +X-stable: review +X-Patchwork-Hint: Ignore +X-stable-base: Linux 4.14.320 + +[ Upstream commit 4e302336d5ca1767a06beee7596a72d3bdc8d983 ] + +Syzkaller reported the following issue: + +UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:1965:6 +index -84 is out of range for type 's8[341]' (aka 'signed char[341]') +CPU: 1 PID: 4995 Comm: syz-executor146 Not tainted 6.4.0-rc6-syzkaller-00037-gb6dad5178cea #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 + ubsan_epilogue lib/ubsan.c:217 [inline] + __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 + dbAllocDmapLev+0x3e5/0x430 fs/jfs/jfs_dmap.c:1965 + dbAllocCtl+0x113/0x920 fs/jfs/jfs_dmap.c:1809 + dbAllocAG+0x28f/0x10b0 fs/jfs/jfs_dmap.c:1350 + dbAlloc+0x658/0xca0 fs/jfs/jfs_dmap.c:874 + dtSplitUp fs/jfs/jfs_dtree.c:974 [inline] + dtInsert+0xda7/0x6b00 fs/jfs/jfs_dtree.c:863 + jfs_create+0x7b6/0xbb0 fs/jfs/namei.c:137 + lookup_open fs/namei.c:3492 [inline] + open_last_lookups fs/namei.c:3560 [inline] + path_openat+0x13df/0x3170 fs/namei.c:3788 + do_filp_open+0x234/0x490 fs/namei.c:3818 + do_sys_openat2+0x13f/0x500 fs/open.c:1356 + do_sys_open fs/open.c:1372 [inline] + __do_sys_openat fs/open.c:1388 [inline] + __se_sys_openat fs/open.c:1383 [inline] + __x64_sys_openat+0x247/0x290 fs/open.c:1383 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd +RIP: 0033:0x7f1f4e33f7e9 +Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007ffc21129578 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 +RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1f4e33f7e9 +RDX: 000000000000275a RSI: 0000000020000040 RDI: 00000000ffffff9c +RBP: 00007f1f4e2ff080 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1f4e2ff110 +R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 + + +The bug occurs when the dbAllocDmapLev()function attempts to access +dp->tree.stree[leafidx + LEAFIND] while the leafidx value is negative. + +To rectify this, the patch introduces a safeguard within the +dbAllocDmapLev() function. A check has been added to verify if leafidx is +negative. If it is, the function immediately returns an I/O error, preventing +any further execution that could potentially cause harm. + +Tested via syzbot. + +Reported-by: syzbot+853a6f4dfa3cf37d3aea@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?extid=ae2f5a27a07ae44b0f17 +Signed-off-by: Yogesh +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_dmap.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c +index 6a0f564e58ddb..c21d6566da096 100644 +--- a/fs/jfs/jfs_dmap.c ++++ b/fs/jfs/jfs_dmap.c +@@ -2034,6 +2034,9 @@ dbAllocDmapLev(struct bmap * bmp, + if (dbFindLeaf((dmtree_t *) & dp->tree, l2nb, &leafidx)) + return -ENOSPC; + ++ if (leafidx < 0) ++ return -EIO; ++ + /* determine the block number within the file system corresponding + * to the leaf at which free space was found. + */ +-- +2.39.2 + diff --git a/queue-5.15/iavf-fix-out-of-bounds-when-setting-channels-on-remo.patch b/queue-5.15/iavf-fix-out-of-bounds-when-setting-channels-on-remo.patch new file mode 100644 index 00000000000..deca42c33c6 --- /dev/null +++ b/queue-5.15/iavf-fix-out-of-bounds-when-setting-channels-on-remo.patch @@ -0,0 +1,160 @@ +From ed0e0733668b671eb74aa3597cfb6e1322ce544c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 May 2023 19:11:48 +0800 +Subject: iavf: Fix out-of-bounds when setting channels on remove + +From: Ding Hui + +[ Upstream commit 7c4bced3caa749ce468b0c5de711c98476b23a52 ] + +If we set channels greater during iavf_remove(), and waiting reset done +would be timeout, then returned with error but changed num_active_queues +directly, that will lead to OOB like the following logs. Because the +num_active_queues is greater than tx/rx_rings[] allocated actually. + +Reproducer: + + [root@host ~]# cat repro.sh + #!/bin/bash + + pf_dbsf="0000:41:00.0" + vf0_dbsf="0000:41:02.0" + g_pids=() + + function do_set_numvf() + { + echo 2 >/sys/bus/pci/devices/${pf_dbsf}/sriov_numvfs + sleep $((RANDOM%3+1)) + echo 0 >/sys/bus/pci/devices/${pf_dbsf}/sriov_numvfs + sleep $((RANDOM%3+1)) + } + + function do_set_channel() + { + local nic=$(ls -1 --indicator-style=none /sys/bus/pci/devices/${vf0_dbsf}/net/) + [ -z "$nic" ] && { sleep $((RANDOM%3)) ; return 1; } + ifconfig $nic 192.168.18.5 netmask 255.255.255.0 + ifconfig $nic up + ethtool -L $nic combined 1 + ethtool -L $nic combined 4 + sleep $((RANDOM%3)) + } + + function on_exit() + { + local pid + for pid in "${g_pids[@]}"; do + kill -0 "$pid" &>/dev/null && kill "$pid" &>/dev/null + done + g_pids=() + } + + trap "on_exit; exit" EXIT + + while :; do do_set_numvf ; done & + g_pids+=($!) + while :; do do_set_channel ; done & + g_pids+=($!) + + wait + +Result: + +[ 3506.152887] iavf 0000:41:02.0: Removing device +[ 3510.400799] ================================================================== +[ 3510.400820] BUG: KASAN: slab-out-of-bounds in iavf_free_all_tx_resources+0x156/0x160 [iavf] +[ 3510.400823] Read of size 8 at addr ffff88b6f9311008 by task repro.sh/55536 +[ 3510.400823] +[ 3510.400830] CPU: 101 PID: 55536 Comm: repro.sh Kdump: loaded Tainted: G O --------- -t - 4.18.0 #1 +[ 3510.400832] Hardware name: Powerleader PR2008AL/H12DSi-N6, BIOS 2.0 04/09/2021 +[ 3510.400835] Call Trace: +[ 3510.400851] dump_stack+0x71/0xab +[ 3510.400860] print_address_description+0x6b/0x290 +[ 3510.400865] ? iavf_free_all_tx_resources+0x156/0x160 [iavf] +[ 3510.400868] kasan_report+0x14a/0x2b0 +[ 3510.400873] iavf_free_all_tx_resources+0x156/0x160 [iavf] +[ 3510.400880] iavf_remove+0x2b6/0xc70 [iavf] +[ 3510.400884] ? iavf_free_all_rx_resources+0x160/0x160 [iavf] +[ 3510.400891] ? wait_woken+0x1d0/0x1d0 +[ 3510.400895] ? notifier_call_chain+0xc1/0x130 +[ 3510.400903] pci_device_remove+0xa8/0x1f0 +[ 3510.400910] device_release_driver_internal+0x1c6/0x460 +[ 3510.400916] pci_stop_bus_device+0x101/0x150 +[ 3510.400919] pci_stop_and_remove_bus_device+0xe/0x20 +[ 3510.400924] pci_iov_remove_virtfn+0x187/0x420 +[ 3510.400927] ? pci_iov_add_virtfn+0xe10/0xe10 +[ 3510.400929] ? pci_get_subsys+0x90/0x90 +[ 3510.400932] sriov_disable+0xed/0x3e0 +[ 3510.400936] ? bus_find_device+0x12d/0x1a0 +[ 3510.400953] i40e_free_vfs+0x754/0x1210 [i40e] +[ 3510.400966] ? i40e_reset_all_vfs+0x880/0x880 [i40e] +[ 3510.400968] ? pci_get_device+0x7c/0x90 +[ 3510.400970] ? pci_get_subsys+0x90/0x90 +[ 3510.400982] ? pci_vfs_assigned.part.7+0x144/0x210 +[ 3510.400987] ? __mutex_lock_slowpath+0x10/0x10 +[ 3510.400996] i40e_pci_sriov_configure+0x1fa/0x2e0 [i40e] +[ 3510.401001] sriov_numvfs_store+0x214/0x290 +[ 3510.401005] ? sriov_totalvfs_show+0x30/0x30 +[ 3510.401007] ? __mutex_lock_slowpath+0x10/0x10 +[ 3510.401011] ? __check_object_size+0x15a/0x350 +[ 3510.401018] kernfs_fop_write+0x280/0x3f0 +[ 3510.401022] vfs_write+0x145/0x440 +[ 3510.401025] ksys_write+0xab/0x160 +[ 3510.401028] ? __ia32_sys_read+0xb0/0xb0 +[ 3510.401031] ? fput_many+0x1a/0x120 +[ 3510.401032] ? filp_close+0xf0/0x130 +[ 3510.401038] do_syscall_64+0xa0/0x370 +[ 3510.401041] ? page_fault+0x8/0x30 +[ 3510.401043] entry_SYSCALL_64_after_hwframe+0x65/0xca +[ 3510.401073] RIP: 0033:0x7f3a9bb842c0 +[ 3510.401079] Code: 73 01 c3 48 8b 0d d8 cb 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 89 24 2d 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 fe dd 01 00 48 89 04 24 +[ 3510.401080] RSP: 002b:00007ffc05f1fe18 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 +[ 3510.401083] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f3a9bb842c0 +[ 3510.401085] RDX: 0000000000000002 RSI: 0000000002327408 RDI: 0000000000000001 +[ 3510.401086] RBP: 0000000002327408 R08: 00007f3a9be53780 R09: 00007f3a9c8a4700 +[ 3510.401086] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000002 +[ 3510.401087] R13: 0000000000000001 R14: 00007f3a9be52620 R15: 0000000000000001 +[ 3510.401090] +[ 3510.401093] Allocated by task 76795: +[ 3510.401098] kasan_kmalloc+0xa6/0xd0 +[ 3510.401099] __kmalloc+0xfb/0x200 +[ 3510.401104] iavf_init_interrupt_scheme+0x26f/0x1310 [iavf] +[ 3510.401108] iavf_watchdog_task+0x1d58/0x4050 [iavf] +[ 3510.401114] process_one_work+0x56a/0x11f0 +[ 3510.401115] worker_thread+0x8f/0xf40 +[ 3510.401117] kthread+0x2a0/0x390 +[ 3510.401119] ret_from_fork+0x1f/0x40 +[ 3510.401122] 0xffffffffffffffff +[ 3510.401123] + +In timeout handling, we should keep the original num_active_queues +and reset num_req_queues to 0. + +Fixes: 4e5e6b5d9d13 ("iavf: Fix return of set the new channel count") +Signed-off-by: Ding Hui +Cc: Donglin Peng +Cc: Huang Cun +Reviewed-by: Leon Romanovsky +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c +index 461f5237a2f88..5af3ae68b7a14 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c +@@ -1855,7 +1855,7 @@ static int iavf_set_channels(struct net_device *netdev, + } + if (i == IAVF_RESET_WAIT_COMPLETE_COUNT) { + adapter->flags &= ~IAVF_FLAG_REINIT_ITR_NEEDED; +- adapter->num_active_queues = num_req; ++ adapter->num_req_queues = 0; + return -EOPNOTSUPP; + } + +-- +2.39.2 + diff --git a/queue-5.15/iavf-fix-use-after-free-in-free_netdev.patch b/queue-5.15/iavf-fix-use-after-free-in-free_netdev.patch new file mode 100644 index 00000000000..f28f3a6cae6 --- /dev/null +++ b/queue-5.15/iavf-fix-use-after-free-in-free_netdev.patch @@ -0,0 +1,215 @@ +From 793fb034d0f828d800cd51aaeae5467a813d0bd2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 May 2023 19:11:47 +0800 +Subject: iavf: Fix use-after-free in free_netdev + +From: Ding Hui + +[ Upstream commit 5f4fa1672d98fe99d2297b03add35346f1685d6b ] + +We do netif_napi_add() for all allocated q_vectors[], but potentially +do netif_napi_del() for part of them, then kfree q_vectors and leave +invalid pointers at dev->napi_list. + +Reproducer: + + [root@host ~]# cat repro.sh + #!/bin/bash + + pf_dbsf="0000:41:00.0" + vf0_dbsf="0000:41:02.0" + g_pids=() + + function do_set_numvf() + { + echo 2 >/sys/bus/pci/devices/${pf_dbsf}/sriov_numvfs + sleep $((RANDOM%3+1)) + echo 0 >/sys/bus/pci/devices/${pf_dbsf}/sriov_numvfs + sleep $((RANDOM%3+1)) + } + + function do_set_channel() + { + local nic=$(ls -1 --indicator-style=none /sys/bus/pci/devices/${vf0_dbsf}/net/) + [ -z "$nic" ] && { sleep $((RANDOM%3)) ; return 1; } + ifconfig $nic 192.168.18.5 netmask 255.255.255.0 + ifconfig $nic up + ethtool -L $nic combined 1 + ethtool -L $nic combined 4 + sleep $((RANDOM%3)) + } + + function on_exit() + { + local pid + for pid in "${g_pids[@]}"; do + kill -0 "$pid" &>/dev/null && kill "$pid" &>/dev/null + done + g_pids=() + } + + trap "on_exit; exit" EXIT + + while :; do do_set_numvf ; done & + g_pids+=($!) + while :; do do_set_channel ; done & + g_pids+=($!) + + wait + +Result: + +[ 4093.900222] ================================================================== +[ 4093.900230] BUG: KASAN: use-after-free in free_netdev+0x308/0x390 +[ 4093.900232] Read of size 8 at addr ffff88b4dc145640 by task repro.sh/6699 +[ 4093.900233] +[ 4093.900236] CPU: 10 PID: 6699 Comm: repro.sh Kdump: loaded Tainted: G O --------- -t - 4.18.0 #1 +[ 4093.900238] Hardware name: Powerleader PR2008AL/H12DSi-N6, BIOS 2.0 04/09/2021 +[ 4093.900239] Call Trace: +[ 4093.900244] dump_stack+0x71/0xab +[ 4093.900249] print_address_description+0x6b/0x290 +[ 4093.900251] ? free_netdev+0x308/0x390 +[ 4093.900252] kasan_report+0x14a/0x2b0 +[ 4093.900254] free_netdev+0x308/0x390 +[ 4093.900261] iavf_remove+0x825/0xd20 [iavf] +[ 4093.900265] pci_device_remove+0xa8/0x1f0 +[ 4093.900268] device_release_driver_internal+0x1c6/0x460 +[ 4093.900271] pci_stop_bus_device+0x101/0x150 +[ 4093.900273] pci_stop_and_remove_bus_device+0xe/0x20 +[ 4093.900275] pci_iov_remove_virtfn+0x187/0x420 +[ 4093.900277] ? pci_iov_add_virtfn+0xe10/0xe10 +[ 4093.900278] ? pci_get_subsys+0x90/0x90 +[ 4093.900280] sriov_disable+0xed/0x3e0 +[ 4093.900282] ? bus_find_device+0x12d/0x1a0 +[ 4093.900290] i40e_free_vfs+0x754/0x1210 [i40e] +[ 4093.900298] ? i40e_reset_all_vfs+0x880/0x880 [i40e] +[ 4093.900299] ? pci_get_device+0x7c/0x90 +[ 4093.900300] ? pci_get_subsys+0x90/0x90 +[ 4093.900306] ? pci_vfs_assigned.part.7+0x144/0x210 +[ 4093.900309] ? __mutex_lock_slowpath+0x10/0x10 +[ 4093.900315] i40e_pci_sriov_configure+0x1fa/0x2e0 [i40e] +[ 4093.900318] sriov_numvfs_store+0x214/0x290 +[ 4093.900320] ? sriov_totalvfs_show+0x30/0x30 +[ 4093.900321] ? __mutex_lock_slowpath+0x10/0x10 +[ 4093.900323] ? __check_object_size+0x15a/0x350 +[ 4093.900326] kernfs_fop_write+0x280/0x3f0 +[ 4093.900329] vfs_write+0x145/0x440 +[ 4093.900330] ksys_write+0xab/0x160 +[ 4093.900332] ? __ia32_sys_read+0xb0/0xb0 +[ 4093.900334] ? fput_many+0x1a/0x120 +[ 4093.900335] ? filp_close+0xf0/0x130 +[ 4093.900338] do_syscall_64+0xa0/0x370 +[ 4093.900339] ? page_fault+0x8/0x30 +[ 4093.900341] entry_SYSCALL_64_after_hwframe+0x65/0xca +[ 4093.900357] RIP: 0033:0x7f16ad4d22c0 +[ 4093.900359] Code: 73 01 c3 48 8b 0d d8 cb 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 89 24 2d 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 fe dd 01 00 48 89 04 24 +[ 4093.900360] RSP: 002b:00007ffd6491b7f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 +[ 4093.900362] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f16ad4d22c0 +[ 4093.900363] RDX: 0000000000000002 RSI: 0000000001a41408 RDI: 0000000000000001 +[ 4093.900364] RBP: 0000000001a41408 R08: 00007f16ad7a1780 R09: 00007f16ae1f2700 +[ 4093.900364] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000002 +[ 4093.900365] R13: 0000000000000001 R14: 00007f16ad7a0620 R15: 0000000000000001 +[ 4093.900367] +[ 4093.900368] Allocated by task 820: +[ 4093.900371] kasan_kmalloc+0xa6/0xd0 +[ 4093.900373] __kmalloc+0xfb/0x200 +[ 4093.900376] iavf_init_interrupt_scheme+0x63b/0x1320 [iavf] +[ 4093.900380] iavf_watchdog_task+0x3d51/0x52c0 [iavf] +[ 4093.900382] process_one_work+0x56a/0x11f0 +[ 4093.900383] worker_thread+0x8f/0xf40 +[ 4093.900384] kthread+0x2a0/0x390 +[ 4093.900385] ret_from_fork+0x1f/0x40 +[ 4093.900387] 0xffffffffffffffff +[ 4093.900387] +[ 4093.900388] Freed by task 6699: +[ 4093.900390] __kasan_slab_free+0x137/0x190 +[ 4093.900391] kfree+0x8b/0x1b0 +[ 4093.900394] iavf_free_q_vectors+0x11d/0x1a0 [iavf] +[ 4093.900397] iavf_remove+0x35a/0xd20 [iavf] +[ 4093.900399] pci_device_remove+0xa8/0x1f0 +[ 4093.900400] device_release_driver_internal+0x1c6/0x460 +[ 4093.900401] pci_stop_bus_device+0x101/0x150 +[ 4093.900402] pci_stop_and_remove_bus_device+0xe/0x20 +[ 4093.900403] pci_iov_remove_virtfn+0x187/0x420 +[ 4093.900404] sriov_disable+0xed/0x3e0 +[ 4093.900409] i40e_free_vfs+0x754/0x1210 [i40e] +[ 4093.900415] i40e_pci_sriov_configure+0x1fa/0x2e0 [i40e] +[ 4093.900416] sriov_numvfs_store+0x214/0x290 +[ 4093.900417] kernfs_fop_write+0x280/0x3f0 +[ 4093.900418] vfs_write+0x145/0x440 +[ 4093.900419] ksys_write+0xab/0x160 +[ 4093.900420] do_syscall_64+0xa0/0x370 +[ 4093.900421] entry_SYSCALL_64_after_hwframe+0x65/0xca +[ 4093.900422] 0xffffffffffffffff +[ 4093.900422] +[ 4093.900424] The buggy address belongs to the object at ffff88b4dc144200 + which belongs to the cache kmalloc-8k of size 8192 +[ 4093.900425] The buggy address is located 5184 bytes inside of + 8192-byte region [ffff88b4dc144200, ffff88b4dc146200) +[ 4093.900425] The buggy address belongs to the page: +[ 4093.900427] page:ffffea00d3705000 refcount:1 mapcount:0 mapping:ffff88bf04415c80 index:0x0 compound_mapcount: 0 +[ 4093.900430] flags: 0x10000000008100(slab|head) +[ 4093.900433] raw: 0010000000008100 dead000000000100 dead000000000200 ffff88bf04415c80 +[ 4093.900434] raw: 0000000000000000 0000000000030003 00000001ffffffff 0000000000000000 +[ 4093.900434] page dumped because: kasan: bad access detected +[ 4093.900435] +[ 4093.900435] Memory state around the buggy address: +[ 4093.900436] ffff88b4dc145500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 4093.900437] ffff88b4dc145580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 4093.900438] >ffff88b4dc145600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 4093.900438] ^ +[ 4093.900439] ffff88b4dc145680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 4093.900440] ffff88b4dc145700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 4093.900440] ================================================================== + +Although the patch #2 (of 2) can avoid the issue triggered by this +repro.sh, there still are other potential risks that if num_active_queues +is changed to less than allocated q_vectors[] by unexpected, the +mismatched netif_napi_add/del() can also cause UAF. + +Since we actually call netif_napi_add() for all allocated q_vectors +unconditionally in iavf_alloc_q_vectors(), so we should fix it by +letting netif_napi_del() match to netif_napi_add(). + +Fixes: 5eae00c57f5e ("i40evf: main driver core") +Signed-off-by: Ding Hui +Cc: Donglin Peng +Cc: Huang Cun +Reviewed-by: Simon Horman +Reviewed-by: Madhu Chittim +Reviewed-by: Leon Romanovsky +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_main.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index 3e45ca40288ad..bcceb2ddfea63 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -1507,19 +1507,16 @@ static int iavf_alloc_q_vectors(struct iavf_adapter *adapter) + static void iavf_free_q_vectors(struct iavf_adapter *adapter) + { + int q_idx, num_q_vectors; +- int napi_vectors; + + if (!adapter->q_vectors) + return; + + num_q_vectors = adapter->num_msix_vectors - NONQ_VECS; +- napi_vectors = adapter->num_active_queues; + + for (q_idx = 0; q_idx < num_q_vectors; q_idx++) { + struct iavf_q_vector *q_vector = &adapter->q_vectors[q_idx]; + +- if (q_idx < napi_vectors) +- netif_napi_del(&q_vector->napi); ++ netif_napi_del(&q_vector->napi); + } + kfree(adapter->q_vectors); + adapter->q_vectors = NULL; +-- +2.39.2 + diff --git a/queue-5.15/igc-avoid-transmit-queue-timeout-for-xdp.patch b/queue-5.15/igc-avoid-transmit-queue-timeout-for-xdp.patch new file mode 100644 index 00000000000..43e6062d000 --- /dev/null +++ b/queue-5.15/igc-avoid-transmit-queue-timeout-for-xdp.patch @@ -0,0 +1,61 @@ +From fe08aa05703e772edfc3ad7fd2b01451a397da62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 09:36:11 +0200 +Subject: igc: Avoid transmit queue timeout for XDP + +From: Kurt Kanzenbach + +[ Upstream commit 95b681485563c64585de78662ee52d06b7fa47d9 ] + +High XDP load triggers the netdev watchdog: + +|NETDEV WATCHDOG: enp3s0 (igc): transmit queue 2 timed out + +The reason is the Tx queue transmission start (txq->trans_start) is not updated +in XDP code path. Therefore, add it for all XDP transmission functions. + +Signed-off-by: Kurt Kanzenbach +Tested-by: Naama Meir +Signed-off-by: Tony Nguyen +Stable-dep-of: 78adb4bcf99e ("igc: Prevent garbled TX queue with XDP ZEROCOPY") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc_main.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c +index db48979cdecbc..6b747c7dc935f 100644 +--- a/drivers/net/ethernet/intel/igc/igc_main.c ++++ b/drivers/net/ethernet/intel/igc/igc_main.c +@@ -2357,6 +2357,8 @@ static int igc_xdp_xmit_back(struct igc_adapter *adapter, struct xdp_buff *xdp) + nq = txring_txq(ring); + + __netif_tx_lock(nq, cpu); ++ /* Avoid transmit queue timeout since we share it with the slow path */ ++ txq_trans_cond_update(nq); + res = igc_xdp_init_tx_descriptor(ring, xdpf); + __netif_tx_unlock(nq); + return res; +@@ -2757,6 +2759,9 @@ static void igc_xdp_xmit_zc(struct igc_ring *ring) + + __netif_tx_lock(nq, cpu); + ++ /* Avoid transmit queue timeout since we share it with the slow path */ ++ txq_trans_cond_update(nq); ++ + budget = igc_desc_unused(ring); + + while (xsk_tx_peek_desc(pool, &xdp_desc) && budget--) { +@@ -6251,6 +6256,9 @@ static int igc_xdp_xmit(struct net_device *dev, int num_frames, + + __netif_tx_lock(nq, cpu); + ++ /* Avoid transmit queue timeout since we share it with the slow path */ ++ txq_trans_cond_update(nq); ++ + drops = 0; + for (i = 0; i < num_frames; i++) { + int err; +-- +2.39.2 + diff --git a/queue-5.15/igc-prevent-garbled-tx-queue-with-xdp-zerocopy.patch b/queue-5.15/igc-prevent-garbled-tx-queue-with-xdp-zerocopy.patch new file mode 100644 index 00000000000..2a64de3d262 --- /dev/null +++ b/queue-5.15/igc-prevent-garbled-tx-queue-with-xdp-zerocopy.patch @@ -0,0 +1,79 @@ +From bb43210055434ee1927664f677efc3176833d9d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 10:54:44 -0700 +Subject: igc: Prevent garbled TX queue with XDP ZEROCOPY + +From: Florian Kauer + +[ Upstream commit 78adb4bcf99effbb960c5f9091e2e062509d1030 ] + +In normal operation, each populated queue item has +next_to_watch pointing to the last TX desc of the packet, +while each cleaned item has it set to 0. In particular, +next_to_use that points to the next (necessarily clean) +item to use has next_to_watch set to 0. + +When the TX queue is used both by an application using +AF_XDP with ZEROCOPY as well as a second non-XDP application +generating high traffic, the queue pointers can get in +an invalid state where next_to_use points to an item +where next_to_watch is NOT set to 0. + +However, the implementation assumes at several places +that this is never the case, so if it does hold, +bad things happen. In particular, within the loop inside +of igc_clean_tx_irq(), next_to_clean can overtake next_to_use. +Finally, this prevents any further transmission via +this queue and it never gets unblocked or signaled. +Secondly, if the queue is in this garbled state, +the inner loop of igc_clean_tx_ring() will never terminate, +completely hogging a CPU core. + +The reason is that igc_xdp_xmit_zc() reads next_to_use +before acquiring the lock, and writing it back +(potentially unmodified) later. If it got modified +before locking, the outdated next_to_use is written +pointing to an item that was already used elsewhere +(and thus next_to_watch got written). + +Fixes: 9acf59a752d4 ("igc: Enable TX via AF_XDP zero-copy") +Signed-off-by: Florian Kauer +Reviewed-by: Kurt Kanzenbach +Tested-by: Kurt Kanzenbach +Acked-by: Vinicius Costa Gomes +Reviewed-by: Simon Horman +Tested-by: Naama Meir +Signed-off-by: Tony Nguyen +Link: https://lore.kernel.org/r/20230717175444.3217831-1-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c +index 6b747c7dc935f..67b77effb3409 100644 +--- a/drivers/net/ethernet/intel/igc/igc_main.c ++++ b/drivers/net/ethernet/intel/igc/igc_main.c +@@ -2750,9 +2750,8 @@ static void igc_xdp_xmit_zc(struct igc_ring *ring) + struct netdev_queue *nq = txring_txq(ring); + union igc_adv_tx_desc *tx_desc = NULL; + int cpu = smp_processor_id(); +- u16 ntu = ring->next_to_use; + struct xdp_desc xdp_desc; +- u16 budget; ++ u16 budget, ntu; + + if (!netif_carrier_ok(ring->netdev)) + return; +@@ -2762,6 +2761,7 @@ static void igc_xdp_xmit_zc(struct igc_ring *ring) + /* Avoid transmit queue timeout since we share it with the slow path */ + txq_trans_cond_update(nq); + ++ ntu = ring->next_to_use; + budget = igc_desc_unused(ring); + + while (xsk_tx_peek_desc(pool, &xdp_desc) && budget--) { +-- +2.39.2 + diff --git a/queue-5.15/llc-don-t-drop-packet-from-non-root-netns.patch b/queue-5.15/llc-don-t-drop-packet-from-non-root-netns.patch new file mode 100644 index 00000000000..5d939ebb6fd --- /dev/null +++ b/queue-5.15/llc-don-t-drop-packet-from-non-root-netns.patch @@ -0,0 +1,50 @@ +From 89b30c37fc08137056e1e5b35d0ee92268ef0b78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jul 2023 10:41:51 -0700 +Subject: llc: Don't drop packet from non-root netns. + +From: Kuniyuki Iwashima + +[ Upstream commit 6631463b6e6673916d2481f692938f393148aa82 ] + +Now these upper layer protocol handlers can be called from llc_rcv() +as sap->rcv_func(), which is registered by llc_sap_open(). + + * function which is passed to register_8022_client() + -> no in-kernel user calls register_8022_client(). + + * snap_rcv() + `- proto->rcvfunc() : registered by register_snap_client() + -> aarp_rcv() and atalk_rcv() drop packets from non-root netns + + * stp_pdu_rcv() + `- garp_protos[]->rcv() : registered by stp_proto_register() + -> garp_pdu_rcv() and br_stp_rcv() are netns-aware + +So, we can safely remove the netns restriction in llc_rcv(). + +Fixes: e730c15519d0 ("[NET]: Make packet reception network namespace safe") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/llc/llc_input.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/net/llc/llc_input.c b/net/llc/llc_input.c +index c309b72a58779..7cac441862e21 100644 +--- a/net/llc/llc_input.c ++++ b/net/llc/llc_input.c +@@ -163,9 +163,6 @@ int llc_rcv(struct sk_buff *skb, struct net_device *dev, + void (*sta_handler)(struct sk_buff *skb); + void (*sap_handler)(struct llc_sap *sap, struct sk_buff *skb); + +- if (!net_eq(dev_net(dev), &init_net)) +- goto drop; +- + /* + * When the interface is in promisc. mode, drop all the crap that it + * receives, do not try to analyse it. +-- +2.39.2 + diff --git a/queue-5.15/mips-dec-prom-address-warray-bounds-warning.patch b/queue-5.15/mips-dec-prom-address-warray-bounds-warning.patch new file mode 100644 index 00000000000..b8138a805fd --- /dev/null +++ b/queue-5.15/mips-dec-prom-address-warray-bounds-warning.patch @@ -0,0 +1,56 @@ +From 9cd6870b3a886b304a46f07e941ddfb43069cbad Mon Sep 17 00:00:00 2001 +From: "Gustavo A. R. Silva" +Date: Thu, 22 Jun 2023 17:43:57 -0600 +Subject: [PATCH AUTOSEL 4.14 7/9] MIPS: dec: prom: Address -Warray-bounds + warning +X-stable: review +X-Patchwork-Hint: Ignore +X-stable-base: Linux 4.14.320 + +[ Upstream commit 7b191b9b55df2a844bd32d1d380f47a7df1c2896 ] + +Zero-length arrays are deprecated, and we are replacing them with flexible +array members instead. So, replace zero-length array with flexible-array +member in struct memmap. + +Address the following warning found after building (with GCC-13) mips64 +with decstation_64_defconfig: +In function 'rex_setup_memory_region', + inlined from 'prom_meminit' at arch/mips/dec/prom/memory.c:91:3: +arch/mips/dec/prom/memory.c:72:31: error: array subscript i is outside array bounds of 'unsigned char[0]' [-Werror=array-bounds=] + 72 | if (bm->bitmap[i] == 0xff) + | ~~~~~~~~~~^~~ +In file included from arch/mips/dec/prom/memory.c:16: +./arch/mips/include/asm/dec/prom.h: In function 'prom_meminit': +./arch/mips/include/asm/dec/prom.h:73:23: note: while referencing 'bitmap' + 73 | unsigned char bitmap[0]; + +This helps with the ongoing efforts to globally enable -Warray-bounds. + +This results in no differences in binary output. + +Link: https://github.com/KSPP/linux/issues/79 +Link: https://github.com/KSPP/linux/issues/323 +Signed-off-by: Gustavo A. R. Silva +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/dec/prom.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/include/asm/dec/prom.h b/arch/mips/include/asm/dec/prom.h +index 09538ff5e9245..6f0405ba27d6d 100644 +--- a/arch/mips/include/asm/dec/prom.h ++++ b/arch/mips/include/asm/dec/prom.h +@@ -74,7 +74,7 @@ static inline bool prom_is_rex(u32 magic) + */ + typedef struct { + int pagesize; +- unsigned char bitmap[0]; ++ unsigned char bitmap[]; + } memmap; + + +-- +2.39.2 + diff --git a/queue-5.15/net-annotate-accesses-to-queue-trans_start.patch b/queue-5.15/net-annotate-accesses-to-queue-trans_start.patch new file mode 100644 index 00000000000..84ffc870486 --- /dev/null +++ b/queue-5.15/net-annotate-accesses-to-queue-trans_start.patch @@ -0,0 +1,285 @@ +From f24b5ff2bb0ef5ddbf058c64ef96bf2739be7a1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Nov 2021 19:29:22 -0800 +Subject: net: annotate accesses to queue->trans_start + +From: Eric Dumazet + +[ Upstream commit 5337824f4dc4bb26f38fbbba4ffb425a92803f15 ] + +In following patches, dev_watchdog() will no longer stop all queues. +It will read queue->trans_start locklessly. + +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Stable-dep-of: 78adb4bcf99e ("igc: Prevent garbled TX queue with XDP ZEROCOPY") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/apm/xgene/xgene_enet_main.c | 2 +- + drivers/net/ethernet/atheros/ag71xx.c | 2 +- + drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 4 ++-- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 +- + drivers/net/ethernet/ibm/ibmvnic.c | 2 +- + drivers/net/ethernet/intel/igb/igb_main.c | 4 ++-- + .../ethernet/mellanox/mlx5/core/en/reporter_tx.c | 2 +- + .../net/ethernet/stmicro/stmmac/stmmac_main.c | 6 +++--- + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 +- + drivers/net/wireless/marvell/mwifiex/init.c | 2 +- + drivers/staging/rtl8192e/rtllib_softmac.c | 2 +- + include/linux/netdevice.h | 16 +++++++++++++--- + net/sched/sch_generic.c | 8 ++++---- + 13 files changed, 32 insertions(+), 22 deletions(-) + +diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c +index 71151f675a498..292c2ce16672f 100644 +--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c ++++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c +@@ -871,7 +871,7 @@ static void xgene_enet_timeout(struct net_device *ndev, unsigned int txqueue) + + for (i = 0; i < pdata->txq_cnt; i++) { + txq = netdev_get_tx_queue(ndev, i); +- txq->trans_start = jiffies; ++ txq_trans_cond_update(txq); + netif_tx_start_queue(txq); + } + } +diff --git a/drivers/net/ethernet/atheros/ag71xx.c b/drivers/net/ethernet/atheros/ag71xx.c +index 9d8b214c129d2..7e83319b26c14 100644 +--- a/drivers/net/ethernet/atheros/ag71xx.c ++++ b/drivers/net/ethernet/atheros/ag71xx.c +@@ -766,7 +766,7 @@ static bool ag71xx_check_dma_stuck(struct ag71xx *ag) + unsigned long timestamp; + u32 rx_sm, tx_sm, rx_fd; + +- timestamp = netdev_get_tx_queue(ag->ndev, 0)->trans_start; ++ timestamp = READ_ONCE(netdev_get_tx_queue(ag->ndev, 0)->trans_start); + if (likely(time_before(jiffies, timestamp + HZ / 10))) + return false; + +diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +index fe5fc2b3406f9..5f5392e6d096a 100644 +--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c ++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +@@ -2325,7 +2325,7 @@ dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev) + txq = netdev_get_tx_queue(net_dev, queue_mapping); + + /* LLTX requires to do our own update of trans_start */ +- txq->trans_start = jiffies; ++ txq_trans_cond_update(txq); + + if (priv->tx_tstamp && skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) { + fd.cmd |= cpu_to_be32(FM_FD_CMD_UPD); +@@ -2531,7 +2531,7 @@ static int dpaa_xdp_xmit_frame(struct net_device *net_dev, + + /* Bump the trans_start */ + txq = netdev_get_tx_queue(net_dev, smp_processor_id()); +- txq->trans_start = jiffies; ++ txq_trans_cond_update(txq); + + err = dpaa_xmit(priv, percpu_stats, smp_processor_id(), &fd); + if (err) { +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +index 2acf50ed6025a..90314a4adcfd9 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -2645,7 +2645,7 @@ static bool hns3_get_tx_timeo_queue_info(struct net_device *ndev) + unsigned long trans_start; + + q = netdev_get_tx_queue(ndev, i); +- trans_start = q->trans_start; ++ trans_start = READ_ONCE(q->trans_start); + if (netif_xmit_stopped(q) && + time_after(jiffies, + (trans_start + ndev->watchdog_timeo))) { +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 450b4fd9aa7f7..ad45158651ddf 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -1910,7 +1910,7 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev) + + tx_packets++; + tx_bytes += skb->len; +- txq->trans_start = jiffies; ++ txq_trans_cond_update(txq); + ret = NETDEV_TX_OK; + goto out; + +diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c +index 3d380dfff7783..606ac667b8ec6 100644 +--- a/drivers/net/ethernet/intel/igb/igb_main.c ++++ b/drivers/net/ethernet/intel/igb/igb_main.c +@@ -2933,7 +2933,7 @@ static int igb_xdp_xmit_back(struct igb_adapter *adapter, struct xdp_buff *xdp) + nq = txring_txq(tx_ring); + __netif_tx_lock(nq, cpu); + /* Avoid transmit queue timeout since we share it with the slow path */ +- nq->trans_start = jiffies; ++ txq_trans_cond_update(nq); + ret = igb_xmit_xdp_ring(adapter, tx_ring, xdpf); + __netif_tx_unlock(nq); + +@@ -2967,7 +2967,7 @@ static int igb_xdp_xmit(struct net_device *dev, int n, + __netif_tx_lock(nq, cpu); + + /* Avoid transmit queue timeout since we share it with the slow path */ +- nq->trans_start = jiffies; ++ txq_trans_cond_update(nq); + + for (i = 0; i < n; i++) { + struct xdp_frame *xdpf = frames[i]; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c +index 8024599994642..f7fc3c2fa100e 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c +@@ -570,7 +570,7 @@ int mlx5e_reporter_tx_timeout(struct mlx5e_txqsq *sq) + snprintf(err_str, sizeof(err_str), + "TX timeout on queue: %d, SQ: 0x%x, CQ: 0x%x, SQ Cons: 0x%x SQ Prod: 0x%x, usecs since last trans: %u", + sq->ch_ix, sq->sqn, sq->cq.mcq.cqn, sq->cc, sq->pc, +- jiffies_to_usecs(jiffies - sq->txq->trans_start)); ++ jiffies_to_usecs(jiffies - READ_ONCE(sq->txq->trans_start))); + + mlx5e_health_report(priv, priv->tx_reporter, err_str, &err_ctx); + return to_ctx.status; +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index a43628dd1f4c2..f2dd8c4deb44d 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -2416,7 +2416,7 @@ static bool stmmac_xdp_xmit_zc(struct stmmac_priv *priv, u32 queue, u32 budget) + bool work_done = true; + + /* Avoids TX time-out as we are sharing with slow path */ +- nq->trans_start = jiffies; ++ txq_trans_cond_update(nq->trans_start); + + budget = min(budget, stmmac_tx_avail(priv, queue)); + +@@ -4731,7 +4731,7 @@ static int stmmac_xdp_xmit_back(struct stmmac_priv *priv, + + __netif_tx_lock(nq, cpu); + /* Avoids TX time-out as we are sharing with slow path */ +- nq->trans_start = jiffies; ++ txq_trans_cond_update(nq->trans_start); + + res = stmmac_xdp_xmit_xdpf(priv, queue, xdpf, false); + if (res == STMMAC_XDP_TX) +@@ -6374,7 +6374,7 @@ static int stmmac_xdp_xmit(struct net_device *dev, int num_frames, + + __netif_tx_lock(nq, cpu); + /* Avoids TX time-out as we are sharing with slow path */ +- nq->trans_start = jiffies; ++ txq_trans_cond_update(nq); + + for (i = 0; i < num_frames; i++) { + int res; +diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +index daf0779261f3e..934d110ea351d 100644 +--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c ++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +@@ -345,7 +345,7 @@ static void am65_cpsw_nuss_ndo_host_tx_timeout(struct net_device *ndev, + + netif_txq = netdev_get_tx_queue(ndev, txqueue); + tx_chn = &common->tx_chns[txqueue]; +- trans_start = netif_txq->trans_start; ++ trans_start = READ_ONCE(netif_txq->trans_start); + + netdev_err(ndev, "txq:%d DRV_XOFF:%d tmo:%u dql_avail:%d free_desc:%zu\n", + txqueue, +diff --git a/drivers/net/wireless/marvell/mwifiex/init.c b/drivers/net/wireless/marvell/mwifiex/init.c +index f006a3d72b404..88c72d1827a00 100644 +--- a/drivers/net/wireless/marvell/mwifiex/init.c ++++ b/drivers/net/wireless/marvell/mwifiex/init.c +@@ -332,7 +332,7 @@ void mwifiex_set_trans_start(struct net_device *dev) + int i; + + for (i = 0; i < dev->num_tx_queues; i++) +- netdev_get_tx_queue(dev, i)->trans_start = jiffies; ++ txq_trans_cond_update(netdev_get_tx_queue(dev, i)); + + netif_trans_update(dev); + } +diff --git a/drivers/staging/rtl8192e/rtllib_softmac.c b/drivers/staging/rtl8192e/rtllib_softmac.c +index ea8bc27fce494..b5a38f0a8d79b 100644 +--- a/drivers/staging/rtl8192e/rtllib_softmac.c ++++ b/drivers/staging/rtl8192e/rtllib_softmac.c +@@ -2515,7 +2515,7 @@ void rtllib_stop_all_queues(struct rtllib_device *ieee) + unsigned int i; + + for (i = 0; i < ieee->dev->num_tx_queues; i++) +- netdev_get_tx_queue(ieee->dev, i)->trans_start = jiffies; ++ txq_trans_cond_update(netdev_get_tx_queue(ieee->dev, i)); + + netif_tx_stop_all_queues(ieee->dev); + } +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index b5df2e59a51d3..f1dd4c102e9af 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -4473,10 +4473,21 @@ static inline void __netif_tx_unlock_bh(struct netdev_queue *txq) + spin_unlock_bh(&txq->_xmit_lock); + } + ++/* ++ * txq->trans_start can be read locklessly from dev_watchdog() ++ */ + static inline void txq_trans_update(struct netdev_queue *txq) + { + if (txq->xmit_lock_owner != -1) +- txq->trans_start = jiffies; ++ WRITE_ONCE(txq->trans_start, jiffies); ++} ++ ++static inline void txq_trans_cond_update(struct netdev_queue *txq) ++{ ++ unsigned long now = jiffies; ++ ++ if (READ_ONCE(txq->trans_start) != now) ++ WRITE_ONCE(txq->trans_start, now); + } + + /* legacy drivers only, netdev_start_xmit() sets txq->trans_start */ +@@ -4484,8 +4495,7 @@ static inline void netif_trans_update(struct net_device *dev) + { + struct netdev_queue *txq = netdev_get_tx_queue(dev, 0); + +- if (txq->trans_start != jiffies) +- txq->trans_start = jiffies; ++ txq_trans_cond_update(txq); + } + + /** +diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c +index 02299785209c1..76ed401af066b 100644 +--- a/net/sched/sch_generic.c ++++ b/net/sched/sch_generic.c +@@ -434,9 +434,9 @@ unsigned long dev_trans_start(struct net_device *dev) + dev = vlan_dev_real_dev(dev); + else if (netif_is_macvlan(dev)) + dev = macvlan_dev_real_dev(dev); +- res = netdev_get_tx_queue(dev, 0)->trans_start; ++ res = READ_ONCE(netdev_get_tx_queue(dev, 0)->trans_start); + for (i = 1; i < dev->num_tx_queues; i++) { +- val = netdev_get_tx_queue(dev, i)->trans_start; ++ val = READ_ONCE(netdev_get_tx_queue(dev, i)->trans_start); + if (val && time_after(val, res)) + res = val; + } +@@ -462,7 +462,7 @@ static void dev_watchdog(struct timer_list *t) + struct netdev_queue *txq; + + txq = netdev_get_tx_queue(dev, i); +- trans_start = txq->trans_start; ++ trans_start = READ_ONCE(txq->trans_start); + if (netif_xmit_stopped(txq) && + time_after(jiffies, (trans_start + + dev->watchdog_timeo))) { +@@ -1172,7 +1172,7 @@ static void transition_one_qdisc(struct net_device *dev, + + rcu_assign_pointer(dev_queue->qdisc, new_qdisc); + if (need_watchdog_p) { +- dev_queue->trans_start = 0; ++ WRITE_ONCE(dev_queue->trans_start, 0); + *need_watchdog_p = 1; + } + } +-- +2.39.2 + diff --git a/queue-5.15/net-ethernet-mtk_eth_soc-handle-probe-deferral.patch b/queue-5.15/net-ethernet-mtk_eth_soc-handle-probe-deferral.patch new file mode 100644 index 00000000000..55cc9262a92 --- /dev/null +++ b/queue-5.15/net-ethernet-mtk_eth_soc-handle-probe-deferral.patch @@ -0,0 +1,86 @@ +From b23396ba46fea961466d9c753063ef3f69673c03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jul 2023 03:42:29 +0100 +Subject: net: ethernet: mtk_eth_soc: handle probe deferral + +From: Daniel Golle + +[ Upstream commit 1d6d537dc55d1f42d16290f00157ac387985b95b ] + +Move the call to of_get_ethdev_address to mtk_add_mac which is part of +the probe function and can hence itself return -EPROBE_DEFER should +of_get_ethdev_address return -EPROBE_DEFER. This allows us to entirely +get rid of the mtk_init function. + +The problem of of_get_ethdev_address returning -EPROBE_DEFER surfaced +in situations in which the NVMEM provider holding the MAC address has +not yet be loaded at the time mtk_eth_soc is initially probed. In this +case probing of mtk_eth_soc should be deferred instead of falling back +to use a random MAC address, so once the NVMEM provider becomes +available probing can be repeated. + +Fixes: 656e705243fd ("net-next: mediatek: add support for MT7623 ethernet") +Signed-off-by: Daniel Golle +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 29 ++++++++------------- + 1 file changed, 11 insertions(+), 18 deletions(-) + +diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +index c55ba1d085e5b..50ee9d3d4c841 100644 +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +@@ -2612,23 +2612,6 @@ static int mtk_hw_deinit(struct mtk_eth *eth) + return 0; + } + +-static int __init mtk_init(struct net_device *dev) +-{ +- struct mtk_mac *mac = netdev_priv(dev); +- struct mtk_eth *eth = mac->hw; +- int ret; +- +- ret = of_get_ethdev_address(mac->of_node, dev); +- if (ret) { +- /* If the mac address is invalid, use random mac address */ +- eth_hw_addr_random(dev); +- dev_err(eth->dev, "generated random MAC address %pM\n", +- dev->dev_addr); +- } +- +- return 0; +-} +- + static void mtk_uninit(struct net_device *dev) + { + struct mtk_mac *mac = netdev_priv(dev); +@@ -2956,7 +2939,6 @@ static const struct ethtool_ops mtk_ethtool_ops = { + }; + + static const struct net_device_ops mtk_netdev_ops = { +- .ndo_init = mtk_init, + .ndo_uninit = mtk_uninit, + .ndo_open = mtk_open, + .ndo_stop = mtk_stop, +@@ -3010,6 +2992,17 @@ static int mtk_add_mac(struct mtk_eth *eth, struct device_node *np) + mac->hw = eth; + mac->of_node = np; + ++ err = of_get_ethdev_address(mac->of_node, eth->netdev[id]); ++ if (err == -EPROBE_DEFER) ++ return err; ++ ++ if (err) { ++ /* If the mac address is invalid, use random mac address */ ++ eth_hw_addr_random(eth->netdev[id]); ++ dev_err(eth->dev, "generated random MAC address %pM\n", ++ eth->netdev[id]->dev_addr); ++ } ++ + memset(mac->hwlro_ip, 0, sizeof(mac->hwlro_ip)); + mac->hwlro_ip_cnt = 0; + +-- +2.39.2 + diff --git a/queue-5.15/net-ethernet-ti-cpsw_ale-fix-cpsw_ale_get_field-cpsw.patch b/queue-5.15/net-ethernet-ti-cpsw_ale-fix-cpsw_ale_get_field-cpsw.patch new file mode 100644 index 00000000000..aa02245b6bd --- /dev/null +++ b/queue-5.15/net-ethernet-ti-cpsw_ale-fix-cpsw_ale_get_field-cpsw.patch @@ -0,0 +1,78 @@ +From 5450103b6d7a14e4d67a13632e7a20c440666660 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jul 2023 16:36:57 +0530 +Subject: net: ethernet: ti: cpsw_ale: Fix + cpsw_ale_get_field()/cpsw_ale_set_field() + +From: Tanmay Patil + +[ Upstream commit b685f1a58956fa36cc01123f253351b25bfacfda ] + +CPSW ALE has 75 bit ALE entries which are stored within three 32 bit words. +The cpsw_ale_get_field() and cpsw_ale_set_field() functions assume that the +field will be strictly contained within one word. However, this is not +guaranteed to be the case and it is possible for ALE field entries to span +across up to two words at the most. + +Fix the methods to handle getting/setting fields spanning up to two words. + +Fixes: db82173f23c5 ("netdev: driver: ethernet: add cpsw address lookup engine support") +Signed-off-by: Tanmay Patil +[s-vadapalli@ti.com: rephrased commit message and added Fixes tag] +Signed-off-by: Siddharth Vadapalli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/cpsw_ale.c | 24 +++++++++++++++++++----- + 1 file changed, 19 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/ti/cpsw_ale.c b/drivers/net/ethernet/ti/cpsw_ale.c +index 1ef0aaef5c61c..8c59e34d8bcaf 100644 +--- a/drivers/net/ethernet/ti/cpsw_ale.c ++++ b/drivers/net/ethernet/ti/cpsw_ale.c +@@ -104,23 +104,37 @@ struct cpsw_ale_dev_id { + + static inline int cpsw_ale_get_field(u32 *ale_entry, u32 start, u32 bits) + { +- int idx; ++ int idx, idx2; ++ u32 hi_val = 0; + + idx = start / 32; ++ idx2 = (start + bits - 1) / 32; ++ /* Check if bits to be fetched exceed a word */ ++ if (idx != idx2) { ++ idx2 = 2 - idx2; /* flip */ ++ hi_val = ale_entry[idx2] << ((idx2 * 32) - start); ++ } + start -= idx * 32; + idx = 2 - idx; /* flip */ +- return (ale_entry[idx] >> start) & BITMASK(bits); ++ return (hi_val + (ale_entry[idx] >> start)) & BITMASK(bits); + } + + static inline void cpsw_ale_set_field(u32 *ale_entry, u32 start, u32 bits, + u32 value) + { +- int idx; ++ int idx, idx2; + + value &= BITMASK(bits); +- idx = start / 32; ++ idx = start / 32; ++ idx2 = (start + bits - 1) / 32; ++ /* Check if bits to be set exceed a word */ ++ if (idx != idx2) { ++ idx2 = 2 - idx2; /* flip */ ++ ale_entry[idx2] &= ~(BITMASK(bits + start - (idx2 * 32))); ++ ale_entry[idx2] |= (value >> ((idx2 * 32) - start)); ++ } + start -= idx * 32; +- idx = 2 - idx; /* flip */ ++ idx = 2 - idx; /* flip */ + ale_entry[idx] &= ~(BITMASK(bits) << start); + ale_entry[idx] |= (value << start); + } +-- +2.39.2 + diff --git a/queue-5.15/net-ipv4-use-kfree_sensitive-instead-of-kfree.patch b/queue-5.15/net-ipv4-use-kfree_sensitive-instead-of-kfree.patch new file mode 100644 index 00000000000..e040a0a2343 --- /dev/null +++ b/queue-5.15/net-ipv4-use-kfree_sensitive-instead-of-kfree.patch @@ -0,0 +1,38 @@ +From 4c5cfad570615aaea94ab3da1e15d7f4a773562f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 17:59:19 +0800 +Subject: net: ipv4: Use kfree_sensitive instead of kfree + +From: Wang Ming + +[ Upstream commit daa751444fd9d4184270b1479d8af49aaf1a1ee6 ] + +key might contain private part of the key, so better use +kfree_sensitive to free it. + +Fixes: 38320c70d282 ("[IPSEC]: Use crypto_aead and authenc in ESP") +Signed-off-by: Wang Ming +Reviewed-by: Tariq Toukan +Reviewed-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/esp4.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c +index d747166bb291c..386e9875e5b80 100644 +--- a/net/ipv4/esp4.c ++++ b/net/ipv4/esp4.c +@@ -1133,7 +1133,7 @@ static int esp_init_authenc(struct xfrm_state *x) + err = crypto_aead_setkey(aead, key, keylen); + + free_key: +- kfree(key); ++ kfree_sensitive(key); + + error: + return err; +-- +2.39.2 + diff --git a/queue-5.15/net-ipv6-check-return-value-of-pskb_trim.patch b/queue-5.15/net-ipv6-check-return-value-of-pskb_trim.patch new file mode 100644 index 00000000000..00474b305b6 --- /dev/null +++ b/queue-5.15/net-ipv6-check-return-value-of-pskb_trim.patch @@ -0,0 +1,39 @@ +From 6c25c6fe0ea61f9a7879b09a7f088b0eaf8f4906 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 22:45:19 +0800 +Subject: net:ipv6: check return value of pskb_trim() + +From: Yuanjun Gong + +[ Upstream commit 4258faa130be4ea43e5e2d839467da421b8ff274 ] + +goto tx_err if an unexpected result is returned by pskb_tirm() +in ip6erspan_tunnel_xmit(). + +Fixes: 5a963eb61b7c ("ip6_gre: Add ERSPAN native tunnel support") +Signed-off-by: Yuanjun Gong +Reviewed-by: David Ahern +Reviewed-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv6/ip6_gre.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c +index 0b041ab79ad90..0efd5b4346b09 100644 +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -955,7 +955,8 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb, + goto tx_err; + + if (skb->len > dev->mtu + dev->hard_header_len) { +- pskb_trim(skb, dev->mtu + dev->hard_header_len); ++ if (pskb_trim(skb, dev->mtu + dev->hard_header_len)) ++ goto tx_err; + truncate = true; + } + +-- +2.39.2 + diff --git a/queue-5.15/net-phy-prevent-stale-pointer-dereference-in-phy_ini.patch b/queue-5.15/net-phy-prevent-stale-pointer-dereference-in-phy_ini.patch new file mode 100644 index 00000000000..18c64c3df4a --- /dev/null +++ b/queue-5.15/net-phy-prevent-stale-pointer-dereference-in-phy_ini.patch @@ -0,0 +1,74 @@ +From 2a9973bb55fd9bdd01399a399a2f85f45da84b70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 03:02:31 +0300 +Subject: net: phy: prevent stale pointer dereference in phy_init() + +From: Vladimir Oltean + +[ Upstream commit 1c613beaf877c0c0d755853dc62687e2013e55c4 ] + +mdio_bus_init() and phy_driver_register() both have error paths, and if +those are ever hit, ethtool will have a stale pointer to the +phy_ethtool_phy_ops stub structure, which references memory from a +module that failed to load (phylib). + +It is probably hard to force an error in this code path even manually, +but the error teardown path of phy_init() should be the same as +phy_exit(), which is now simply not the case. + +Fixes: 55d8f053ce1b ("net: phy: Register ethtool PHY operations") +Link: https://lore.kernel.org/netdev/ZLaiJ4G6TaJYGJyU@shell.armlinux.org.uk/ +Suggested-by: Russell King (Oracle) +Signed-off-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20230720000231.1939689-1-vladimir.oltean@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/phy_device.c | 21 ++++++++++++++------- + 1 file changed, 14 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c +index 73485383db4ef..6085a28cae3d2 100644 +--- a/drivers/net/phy/phy_device.c ++++ b/drivers/net/phy/phy_device.c +@@ -3253,23 +3253,30 @@ static int __init phy_init(void) + { + int rc; + ++ ethtool_set_ethtool_phy_ops(&phy_ethtool_phy_ops); ++ + rc = mdio_bus_init(); + if (rc) +- return rc; ++ goto err_ethtool_phy_ops; + +- ethtool_set_ethtool_phy_ops(&phy_ethtool_phy_ops); + features_init(); + + rc = phy_driver_register(&genphy_c45_driver, THIS_MODULE); + if (rc) +- goto err_c45; ++ goto err_mdio_bus; + + rc = phy_driver_register(&genphy_driver, THIS_MODULE); +- if (rc) { +- phy_driver_unregister(&genphy_c45_driver); ++ if (rc) ++ goto err_c45; ++ ++ return 0; ++ + err_c45: +- mdio_bus_exit(); +- } ++ phy_driver_unregister(&genphy_c45_driver); ++err_mdio_bus: ++ mdio_bus_exit(); ++err_ethtool_phy_ops: ++ ethtool_set_ethtool_phy_ops(NULL); + + return rc; + } +-- +2.39.2 + diff --git a/queue-5.15/net-sched-cls_bpf-undo-tcf_bind_filter-in-case-of-an.patch b/queue-5.15/net-sched-cls_bpf-undo-tcf_bind_filter-in-case-of-an.patch new file mode 100644 index 00000000000..418fac68395 --- /dev/null +++ b/queue-5.15/net-sched-cls_bpf-undo-tcf_bind_filter-in-case-of-an.patch @@ -0,0 +1,165 @@ +From 47289a7215d6ead9241d435f91da4355ec346001 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jul 2023 15:05:13 -0300 +Subject: net: sched: cls_bpf: Undo tcf_bind_filter in case of an error + +From: Victor Nogueira + +[ Upstream commit 26a22194927e8521e304ed75c2f38d8068d55fc7 ] + +If cls_bpf_offload errors out, we must also undo tcf_bind_filter that +was done before the error. + +Fix that by calling tcf_unbind_filter in errout_parms. + +Fixes: eadb41489fd2 ("net: cls_bpf: add support for marking filters as hardware-only") +Signed-off-by: Victor Nogueira +Acked-by: Jamal Hadi Salim +Reviewed-by: Pedro Tammela +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/cls_bpf.c | 99 +++++++++++++++++++++------------------------ + 1 file changed, 47 insertions(+), 52 deletions(-) + +diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c +index df19a847829e8..b7c46a93a4121 100644 +--- a/net/sched/cls_bpf.c ++++ b/net/sched/cls_bpf.c +@@ -402,56 +402,6 @@ static int cls_bpf_prog_from_efd(struct nlattr **tb, struct cls_bpf_prog *prog, + return 0; + } + +-static int cls_bpf_set_parms(struct net *net, struct tcf_proto *tp, +- struct cls_bpf_prog *prog, unsigned long base, +- struct nlattr **tb, struct nlattr *est, u32 flags, +- struct netlink_ext_ack *extack) +-{ +- bool is_bpf, is_ebpf, have_exts = false; +- u32 gen_flags = 0; +- int ret; +- +- is_bpf = tb[TCA_BPF_OPS_LEN] && tb[TCA_BPF_OPS]; +- is_ebpf = tb[TCA_BPF_FD]; +- if ((!is_bpf && !is_ebpf) || (is_bpf && is_ebpf)) +- return -EINVAL; +- +- ret = tcf_exts_validate(net, tp, tb, est, &prog->exts, flags, +- extack); +- if (ret < 0) +- return ret; +- +- if (tb[TCA_BPF_FLAGS]) { +- u32 bpf_flags = nla_get_u32(tb[TCA_BPF_FLAGS]); +- +- if (bpf_flags & ~TCA_BPF_FLAG_ACT_DIRECT) +- return -EINVAL; +- +- have_exts = bpf_flags & TCA_BPF_FLAG_ACT_DIRECT; +- } +- if (tb[TCA_BPF_FLAGS_GEN]) { +- gen_flags = nla_get_u32(tb[TCA_BPF_FLAGS_GEN]); +- if (gen_flags & ~CLS_BPF_SUPPORTED_GEN_FLAGS || +- !tc_flags_valid(gen_flags)) +- return -EINVAL; +- } +- +- prog->exts_integrated = have_exts; +- prog->gen_flags = gen_flags; +- +- ret = is_bpf ? cls_bpf_prog_from_ops(tb, prog) : +- cls_bpf_prog_from_efd(tb, prog, gen_flags, tp); +- if (ret < 0) +- return ret; +- +- if (tb[TCA_BPF_CLASSID]) { +- prog->res.classid = nla_get_u32(tb[TCA_BPF_CLASSID]); +- tcf_bind_filter(tp, &prog->res, base); +- } +- +- return 0; +-} +- + static int cls_bpf_change(struct net *net, struct sk_buff *in_skb, + struct tcf_proto *tp, unsigned long base, + u32 handle, struct nlattr **tca, +@@ -459,9 +409,12 @@ static int cls_bpf_change(struct net *net, struct sk_buff *in_skb, + struct netlink_ext_ack *extack) + { + struct cls_bpf_head *head = rtnl_dereference(tp->root); ++ bool is_bpf, is_ebpf, have_exts = false; + struct cls_bpf_prog *oldprog = *arg; + struct nlattr *tb[TCA_BPF_MAX + 1]; ++ bool bound_to_filter = false; + struct cls_bpf_prog *prog; ++ u32 gen_flags = 0; + int ret; + + if (tca[TCA_OPTIONS] == NULL) +@@ -500,11 +453,51 @@ static int cls_bpf_change(struct net *net, struct sk_buff *in_skb, + goto errout; + prog->handle = handle; + +- ret = cls_bpf_set_parms(net, tp, prog, base, tb, tca[TCA_RATE], flags, +- extack); ++ is_bpf = tb[TCA_BPF_OPS_LEN] && tb[TCA_BPF_OPS]; ++ is_ebpf = tb[TCA_BPF_FD]; ++ if ((!is_bpf && !is_ebpf) || (is_bpf && is_ebpf)) { ++ ret = -EINVAL; ++ goto errout_idr; ++ } ++ ++ ret = tcf_exts_validate(net, tp, tb, tca[TCA_RATE], &prog->exts, ++ flags, extack); ++ if (ret < 0) ++ goto errout_idr; ++ ++ if (tb[TCA_BPF_FLAGS]) { ++ u32 bpf_flags = nla_get_u32(tb[TCA_BPF_FLAGS]); ++ ++ if (bpf_flags & ~TCA_BPF_FLAG_ACT_DIRECT) { ++ ret = -EINVAL; ++ goto errout_idr; ++ } ++ ++ have_exts = bpf_flags & TCA_BPF_FLAG_ACT_DIRECT; ++ } ++ if (tb[TCA_BPF_FLAGS_GEN]) { ++ gen_flags = nla_get_u32(tb[TCA_BPF_FLAGS_GEN]); ++ if (gen_flags & ~CLS_BPF_SUPPORTED_GEN_FLAGS || ++ !tc_flags_valid(gen_flags)) { ++ ret = -EINVAL; ++ goto errout_idr; ++ } ++ } ++ ++ prog->exts_integrated = have_exts; ++ prog->gen_flags = gen_flags; ++ ++ ret = is_bpf ? cls_bpf_prog_from_ops(tb, prog) : ++ cls_bpf_prog_from_efd(tb, prog, gen_flags, tp); + if (ret < 0) + goto errout_idr; + ++ if (tb[TCA_BPF_CLASSID]) { ++ prog->res.classid = nla_get_u32(tb[TCA_BPF_CLASSID]); ++ tcf_bind_filter(tp, &prog->res, base); ++ bound_to_filter = true; ++ } ++ + ret = cls_bpf_offload(tp, prog, oldprog, extack); + if (ret) + goto errout_parms; +@@ -526,6 +519,8 @@ static int cls_bpf_change(struct net *net, struct sk_buff *in_skb, + return 0; + + errout_parms: ++ if (bound_to_filter) ++ tcf_unbind_filter(tp, &prog->res); + cls_bpf_free_parms(prog); + errout_idr: + if (!oldprog) +-- +2.39.2 + diff --git a/queue-5.15/netfilter-nf_tables-fix-spurious-set-element-inserti.patch b/queue-5.15/netfilter-nf_tables-fix-spurious-set-element-inserti.patch new file mode 100644 index 00000000000..df140106d8b --- /dev/null +++ b/queue-5.15/netfilter-nf_tables-fix-spurious-set-element-inserti.patch @@ -0,0 +1,49 @@ +From e3c699e52733ef6d37df0f0688989d4f24069806 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 00:29:58 +0200 +Subject: netfilter: nf_tables: fix spurious set element insertion failure + +From: Florian Westphal + +[ Upstream commit ddbd8be68941985f166f5107109a90ce13147c44 ] + +On some platforms there is a padding hole in the nft_verdict +structure, between the verdict code and the chain pointer. + +On element insertion, if the new element clashes with an existing one and +NLM_F_EXCL flag isn't set, we want to ignore the -EEXIST error as long as +the data associated with duplicated element is the same as the existing +one. The data equality check uses memcmp. + +For normal data (NFT_DATA_VALUE) this works fine, but for NFT_DATA_VERDICT +padding area leads to spurious failure even if the verdict data is the +same. + +This then makes the insertion fail with 'already exists' error, even +though the new "key : data" matches an existing entry and userspace +told the kernel that it doesn't want to receive an error indication. + +Fixes: c016c7e45ddf ("netfilter: nf_tables: honor NLM_F_EXCL flag in set element insertion") +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 04b7c4e595200..f04a69d74cb23 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -9908,6 +9908,9 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, + + if (!tb[NFTA_VERDICT_CODE]) + return -EINVAL; ++ ++ /* zero padding hole for memcmp */ ++ memset(data, 0, sizeof(*data)); + data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE])); + + switch (data->verdict.code) { +-- +2.39.2 + diff --git a/queue-5.15/netfilter-nf_tables-skip-bound-chain-in-netns-releas.patch b/queue-5.15/netfilter-nf_tables-skip-bound-chain-in-netns-releas.patch new file mode 100644 index 00000000000..68becb2b21d --- /dev/null +++ b/queue-5.15/netfilter-nf_tables-skip-bound-chain-in-netns-releas.patch @@ -0,0 +1,37 @@ +From c55ce5a713fe4bb402b4ae74cbbce31ca4e8d0ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 20:19:43 +0200 +Subject: netfilter: nf_tables: skip bound chain in netns release path + +From: Pablo Neira Ayuso + +[ Upstream commit 751d460ccff3137212f47d876221534bf0490996 ] + +Skip bound chain from netns release path, the rule that owns this chain +releases these objects. + +Fixes: d0e2c7de92c7 ("netfilter: nf_tables: add NFT_CHAIN_BINDING") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index f04a69d74cb23..1cf075a4269a4 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -10192,6 +10192,9 @@ static void __nft_release_table(struct net *net, struct nft_table *table) + ctx.family = table->family; + ctx.table = table; + list_for_each_entry(chain, &table->chains, list) { ++ if (nft_chain_is_bound(chain)) ++ continue; ++ + ctx.chain = chain; + list_for_each_entry_safe(rule, nr, &chain->rules, list) { + list_del(&rule->list); +-- +2.39.2 + diff --git a/queue-5.15/netfilter-nf_tables-skip-bound-chain-on-rule-flush.patch b/queue-5.15/netfilter-nf_tables-skip-bound-chain-on-rule-flush.patch new file mode 100644 index 00000000000..2c6be25e3f6 --- /dev/null +++ b/queue-5.15/netfilter-nf_tables-skip-bound-chain-on-rule-flush.patch @@ -0,0 +1,43 @@ +From e2ce29044f79ecf611ac31ba29f979a22cf906d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 09:17:21 +0200 +Subject: netfilter: nf_tables: skip bound chain on rule flush + +From: Pablo Neira Ayuso + +[ Upstream commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8 ] + +Skip bound chain when flushing table rules, the rule that owns this +chain releases these objects. + +Otherwise, the following warning is triggered: + + WARNING: CPU: 2 PID: 1217 at net/netfilter/nf_tables_api.c:2013 nf_tables_chain_destroy+0x1f7/0x210 [nf_tables] + CPU: 2 PID: 1217 Comm: chain-flush Not tainted 6.1.39 #1 + RIP: 0010:nf_tables_chain_destroy+0x1f7/0x210 [nf_tables] + +Fixes: d0e2c7de92c7 ("netfilter: nf_tables: add NFT_CHAIN_BINDING") +Reported-by: Kevin Rich +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 1cf075a4269a4..e0e675313d8e1 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -3795,6 +3795,8 @@ static int nf_tables_delrule(struct sk_buff *skb, const struct nfnl_info *info, + list_for_each_entry(chain, &table->chains, list) { + if (!nft_is_active_next(net, chain)) + continue; ++ if (nft_chain_is_bound(chain)) ++ continue; + + ctx.chain = chain; + err = nft_delrule_by_chain(&ctx); +-- +2.39.2 + diff --git a/queue-5.15/netfilter-nft_set_pipapo-fix-improper-element-remova.patch b/queue-5.15/netfilter-nft_set_pipapo-fix-improper-element-remova.patch new file mode 100644 index 00000000000..252ded12061 --- /dev/null +++ b/queue-5.15/netfilter-nft_set_pipapo-fix-improper-element-remova.patch @@ -0,0 +1,63 @@ +From 40c5fc80a3383520d1b05dcb1adfd950f5060fd3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 21:08:21 +0200 +Subject: netfilter: nft_set_pipapo: fix improper element removal + +From: Florian Westphal + +[ Upstream commit 87b5a5c209405cb6b57424cdfa226a6dbd349232 ] + +end key should be equal to start unless NFT_SET_EXT_KEY_END is present. + +Its possible to add elements that only have a start key +("{ 1.0.0.0 . 2.0.0.0 }") without an internval end. + +Insertion treats this via: + +if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END)) + end = (const u8 *)nft_set_ext_key_end(ext)->data; +else + end = start; + +but removal side always uses nft_set_ext_key_end(). +This is wrong and leads to garbage remaining in the set after removal +next lookup/insert attempt will give: + +BUG: KASAN: slab-use-after-free in pipapo_get+0x8eb/0xb90 +Read of size 1 at addr ffff888100d50586 by task nft-pipapo_uaf_/1399 +Call Trace: + kasan_report+0x105/0x140 + pipapo_get+0x8eb/0xb90 + nft_pipapo_insert+0x1dc/0x1710 + nf_tables_newsetelem+0x31f5/0x4e00 + .. + +Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") +Reported-by: lonial con +Reviewed-by: Stefano Brivio +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_set_pipapo.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c +index 0452ee586c1cc..a81829c10feab 100644 +--- a/net/netfilter/nft_set_pipapo.c ++++ b/net/netfilter/nft_set_pipapo.c +@@ -1930,7 +1930,11 @@ static void nft_pipapo_remove(const struct net *net, const struct nft_set *set, + int i, start, rules_fx; + + match_start = data; +- match_end = (const u8 *)nft_set_ext_key_end(&e->ext)->data; ++ ++ if (nft_set_ext_exists(&e->ext, NFT_SET_EXT_KEY_END)) ++ match_end = (const u8 *)nft_set_ext_key_end(&e->ext)->data; ++ else ++ match_end = data; + + start = first_rule; + rules_fx = rules_f0; +-- +2.39.2 + diff --git a/queue-5.15/octeontx2-pf-dont-allocate-bpids-for-lbk-interfaces.patch b/queue-5.15/octeontx2-pf-dont-allocate-bpids-for-lbk-interfaces.patch new file mode 100644 index 00000000000..208f3fe0f33 --- /dev/null +++ b/queue-5.15/octeontx2-pf-dont-allocate-bpids-for-lbk-interfaces.patch @@ -0,0 +1,43 @@ +From 627d0c0e3899b4fcbe54008a0cdf5eaaef1633d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Jul 2023 15:07:41 +0530 +Subject: octeontx2-pf: Dont allocate BPIDs for LBK interfaces + +From: Geetha sowjanya + +[ Upstream commit 8fcd7c7b3a38ab5e452f542fda8f7940e77e479a ] + +Current driver enables backpressure for LBK interfaces. +But these interfaces do not support this feature. +Hence, this patch fixes the issue by skipping the +backpressure configuration for these interfaces. + +Fixes: 75f36270990c ("octeontx2-pf: Support to enable/disable pause frames via ethtool"). +Signed-off-by: Geetha sowjanya +Signed-off-by: Sunil Goutham +Link: https://lore.kernel.org/r/20230716093741.28063-1-gakula@marvell.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +index a987ae9d6a285..8fc4ecc4f7140 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +@@ -1430,8 +1430,9 @@ static int otx2_init_hw_resources(struct otx2_nic *pf) + if (err) + goto err_free_npa_lf; + +- /* Enable backpressure */ +- otx2_nix_config_bp(pf, true); ++ /* Enable backpressure for CGX mapped PF/VFs */ ++ if (!is_otx2_lbkvf(pf->pdev)) ++ otx2_nix_config_bp(pf, true); + + /* Init Auras and pools used by NIX RQ, for free buffer ptrs */ + err = otx2_rq_aura_pool_init(pf); +-- +2.39.2 + diff --git a/queue-5.15/of-net-add-a-helper-for-loading-netdev-dev_addr.patch b/queue-5.15/of-net-add-a-helper-for-loading-netdev-dev_addr.patch new file mode 100644 index 00000000000..e278f1493a9 --- /dev/null +++ b/queue-5.15/of-net-add-a-helper-for-loading-netdev-dev_addr.patch @@ -0,0 +1,91 @@ +From 7fdd227d5d07e585d16f0bf5cc66bef00028e9c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Oct 2021 18:06:55 -0700 +Subject: of: net: add a helper for loading netdev->dev_addr + +From: Jakub Kicinski + +[ Upstream commit d466effe282ddbab6acb6c3120c1de0ee1b86d57 ] + +Commit 406f42fa0d3c ("net-next: When a bond have a massive amount +of VLANs...") introduced a rbtree for faster Ethernet address look +up. To maintain netdev->dev_addr in this tree we need to make all +the writes to it got through appropriate helpers. + +There are roughly 40 places where netdev->dev_addr is passed +as the destination to a of_get_mac_address() call. Add a helper +which takes a dev pointer instead, so it can call an appropriate +helper. + +Note that of_get_mac_address() already assumes the address is +6 bytes long (ETH_ALEN) so use eth_hw_addr_set(). + +Signed-off-by: Jakub Kicinski +Signed-off-by: David S. Miller +Stable-dep-of: 1d6d537dc55d ("net: ethernet: mtk_eth_soc: handle probe deferral") +Signed-off-by: Sasha Levin +--- + include/linux/of_net.h | 6 ++++++ + net/core/of_net.c | 25 +++++++++++++++++++++++++ + 2 files changed, 31 insertions(+) + +diff --git a/include/linux/of_net.h b/include/linux/of_net.h +index 55460ecfa50ad..0484b613ca647 100644 +--- a/include/linux/of_net.h ++++ b/include/linux/of_net.h +@@ -14,6 +14,7 @@ + struct net_device; + extern int of_get_phy_mode(struct device_node *np, phy_interface_t *interface); + extern int of_get_mac_address(struct device_node *np, u8 *mac); ++int of_get_ethdev_address(struct device_node *np, struct net_device *dev); + extern struct net_device *of_find_net_device_by_node(struct device_node *np); + #else + static inline int of_get_phy_mode(struct device_node *np, +@@ -27,6 +28,11 @@ static inline int of_get_mac_address(struct device_node *np, u8 *mac) + return -ENODEV; + } + ++static inline int of_get_ethdev_address(struct device_node *np, struct net_device *dev) ++{ ++ return -ENODEV; ++} ++ + static inline struct net_device *of_find_net_device_by_node(struct device_node *np) + { + return NULL; +diff --git a/net/core/of_net.c b/net/core/of_net.c +index dbac3a172a11e..f1a9bf7578e7a 100644 +--- a/net/core/of_net.c ++++ b/net/core/of_net.c +@@ -143,3 +143,28 @@ int of_get_mac_address(struct device_node *np, u8 *addr) + return of_get_mac_addr_nvmem(np, addr); + } + EXPORT_SYMBOL(of_get_mac_address); ++ ++/** ++ * of_get_ethdev_address() ++ * @np: Caller's Device Node ++ * @dev: Pointer to netdevice which address will be updated ++ * ++ * Search the device tree for the best MAC address to use. ++ * If found set @dev->dev_addr to that address. ++ * ++ * See documentation of of_get_mac_address() for more information on how ++ * the best address is determined. ++ * ++ * Return: 0 on success and errno in case of error. ++ */ ++int of_get_ethdev_address(struct device_node *np, struct net_device *dev) ++{ ++ u8 addr[ETH_ALEN]; ++ int ret; ++ ++ ret = of_get_mac_address(np, addr); ++ if (!ret) ++ eth_hw_addr_set(dev, addr); ++ return ret; ++} ++EXPORT_SYMBOL(of_get_ethdev_address); +-- +2.39.2 + diff --git a/queue-5.15/perf-build-fix-library-not-found-error-when-using-cs.patch b/queue-5.15/perf-build-fix-library-not-found-error-when-using-cs.patch new file mode 100644 index 00000000000..a1bb23375ef --- /dev/null +++ b/queue-5.15/perf-build-fix-library-not-found-error-when-using-cs.patch @@ -0,0 +1,94 @@ +From 87c936a214ba46bb1429ffc8ea41a5fc504c6ace Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 16:45:46 +0100 +Subject: perf build: Fix library not found error when using CSLIBS +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: James Clark + +[ Upstream commit 1feece2780ac2f8de45177fe53979726cee4b3d1 ] + +-L only specifies the search path for libraries directly provided in the +link line with -l. Because -lopencsd isn't specified, it's only linked +because it's a dependency of -lopencsd_c_api. Dependencies like this are +resolved using the default system search paths or -rpath-link=... rather +than -L. This means that compilation only works if OpenCSD is installed +to the system rather than provided with the CSLIBS (-L) option. + +This could be fixed by adding -Wl,-rpath-link=$(CSLIBS) but that is less +conventional than just adding -lopencsd to the link line so that it uses +-L. -lopencsd seems to have been removed in commit ed17b1914978eddb +("perf tools: Drop requirement for libstdc++.so for libopencsd check") +because it was thought that there was a chance compilation would work +even if it didn't exist, but I think that only applies to libstdc++ so +there is no harm to add it back. libopencsd.so and libopencsd_c_api.so +would always exist together. + +Testing +======= + +The following scenarios now all work: + + * Cross build with OpenCSD installed + * Cross build using CSLIBS=... + * Native build with OpenCSD installed + * Native build using CSLIBS=... + * Static cross build with OpenCSD installed + * Static cross build with CSLIBS=... + +Committer testing: + + ⬢[acme@toolbox perf-tools]$ alias m + alias m='make -k BUILD_BPF_SKEL=1 CORESIGHT=1 O=/tmp/build/perf-tools -C tools/perf install-bin && git status && perf test python ; perf record -o /dev/null sleep 0.01 ; perf stat --null sleep 0.01' + ⬢[acme@toolbox perf-tools]$ ldd ~/bin/perf | grep csd + libopencsd_c_api.so.1 => /lib64/libopencsd_c_api.so.1 (0x00007fd49c44e000) + libopencsd.so.1 => /lib64/libopencsd.so.1 (0x00007fd49bd56000) + ⬢[acme@toolbox perf-tools]$ cat /etc/redhat-release + Fedora release 36 (Thirty Six) + ⬢[acme@toolbox perf-tools]$ + +Fixes: ed17b1914978eddb ("perf tools: Drop requirement for libstdc++.so for libopencsd check") +Reported-by: Radhey Shyam Pandey +Signed-off-by: James Clark +Tested-by: Arnaldo Carvalho de Melo +Tested-by: Radhey Shyam Pandey +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Uwe Kleine-König +Cc: coresight@lists.linaro.org +Closes: https://lore.kernel.org/linux-arm-kernel/56905d7a-a91e-883a-b707-9d5f686ba5f1@arm.com/ +Link: https://lore.kernel.org/all/36cc4dc6-bf4b-1093-1c0a-876e368af183@kleine-koenig.org/ +Link: https://lore.kernel.org/r/20230707154546.456720-1-james.clark@arm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/Makefile.config | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config +index 2c30a2b577d3e..973c0d5ed8d8b 100644 +--- a/tools/perf/Makefile.config ++++ b/tools/perf/Makefile.config +@@ -143,9 +143,9 @@ FEATURE_CHECK_LDFLAGS-libcrypto = -lcrypto + ifdef CSINCLUDES + LIBOPENCSD_CFLAGS := -I$(CSINCLUDES) + endif +-OPENCSDLIBS := -lopencsd_c_api ++OPENCSDLIBS := -lopencsd_c_api -lopencsd + ifeq ($(findstring -static,${LDFLAGS}),-static) +- OPENCSDLIBS += -lopencsd -lstdc++ ++ OPENCSDLIBS += -lstdc++ + endif + ifdef CSLIBS + LIBOPENCSD_LDFLAGS := -L$(CSLIBS) +-- +2.39.2 + diff --git a/queue-5.15/pinctrl-amd-use-amd_pinconf_set-for-all-config-optio.patch b/queue-5.15/pinctrl-amd-use-amd_pinconf_set-for-all-config-optio.patch new file mode 100644 index 00000000000..3d820d3b68a --- /dev/null +++ b/queue-5.15/pinctrl-amd-use-amd_pinconf_set-for-all-config-optio.patch @@ -0,0 +1,108 @@ +From 8780aebd01afeac769cc853162b8329c5aca3c56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jul 2023 08:30:03 -0500 +Subject: pinctrl: amd: Use amd_pinconf_set() for all config options + +From: Mario Limonciello + +[ Upstream commit 635a750d958e158e17af0f524bedc484b27fbb93 ] + +On ASUS TUF A16 it is reported that the ITE5570 ACPI device connected to +GPIO 7 is causing an interrupt storm. This issue doesn't happen on +Windows. + +Comparing the GPIO register configuration between Windows and Linux +bit 20 has been configured as a pull up on Windows, but not on Linux. +Checking GPIO declaration from the firmware it is clear it *should* have +been a pull up on Linux as well. + +``` +GpioInt (Level, ActiveLow, Exclusive, PullUp, 0x0000, + "\\_SB.GPIO", 0x00, ResourceConsumer, ,) +{ // Pin list +0x0007 +} +``` + +On Linux amd_gpio_set_config() is currently only used for programming +the debounce. Actually the GPIO core calls it with all the arguments +that are supported by a GPIO, pinctrl-amd just responds `-ENOTSUPP`. + +To solve this issue expand amd_gpio_set_config() to support the other +arguments amd_pinconf_set() supports, namely `PIN_CONFIG_BIAS_PULL_DOWN`, +`PIN_CONFIG_BIAS_PULL_UP`, and `PIN_CONFIG_DRIVE_STRENGTH`. + +Reported-by: Nik P +Reported-by: Nathan Schulte +Reported-by: Friedrich Vock +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217336 +Reported-by: dridri85@gmail.com +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217493 +Link: https://lore.kernel.org/linux-input/20230530154058.17594-1-friedrich.vock@gmx.de/ +Tested-by: Jan Visser +Fixes: 2956b5d94a76 ("pinctrl / gpio: Introduce .set_config() callback for GPIO chips") +Signed-off-by: Mario Limonciello +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20230705133005.577-3-mario.limonciello@amd.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-amd.c | 28 +++++++++++++++------------- + 1 file changed, 15 insertions(+), 13 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c +index 9dff866614d40..384d93146e1f5 100644 +--- a/drivers/pinctrl/pinctrl-amd.c ++++ b/drivers/pinctrl/pinctrl-amd.c +@@ -189,18 +189,6 @@ static int amd_gpio_set_debounce(struct gpio_chip *gc, unsigned offset, + return ret; + } + +-static int amd_gpio_set_config(struct gpio_chip *gc, unsigned offset, +- unsigned long config) +-{ +- u32 debounce; +- +- if (pinconf_to_config_param(config) != PIN_CONFIG_INPUT_DEBOUNCE) +- return -ENOTSUPP; +- +- debounce = pinconf_to_config_argument(config); +- return amd_gpio_set_debounce(gc, offset, debounce); +-} +- + #ifdef CONFIG_DEBUG_FS + static void amd_gpio_dbg_show(struct seq_file *s, struct gpio_chip *gc) + { +@@ -775,7 +763,7 @@ static int amd_pinconf_get(struct pinctrl_dev *pctldev, + } + + static int amd_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin, +- unsigned long *configs, unsigned num_configs) ++ unsigned long *configs, unsigned int num_configs) + { + int i; + u32 arg; +@@ -865,6 +853,20 @@ static int amd_pinconf_group_set(struct pinctrl_dev *pctldev, + return 0; + } + ++static int amd_gpio_set_config(struct gpio_chip *gc, unsigned int pin, ++ unsigned long config) ++{ ++ struct amd_gpio *gpio_dev = gpiochip_get_data(gc); ++ ++ if (pinconf_to_config_param(config) == PIN_CONFIG_INPUT_DEBOUNCE) { ++ u32 debounce = pinconf_to_config_argument(config); ++ ++ return amd_gpio_set_debounce(gc, pin, debounce); ++ } ++ ++ return amd_pinconf_set(gpio_dev->pctrl, pin, &config, 1); ++} ++ + static const struct pinconf_ops amd_pinconf_ops = { + .pin_config_get = amd_pinconf_get, + .pin_config_set = amd_pinconf_set, +-- +2.39.2 + diff --git a/queue-5.15/quota-fix-warning-in-dqgrab.patch b/queue-5.15/quota-fix-warning-in-dqgrab.patch new file mode 100644 index 00000000000..bc0d0df4219 --- /dev/null +++ b/queue-5.15/quota-fix-warning-in-dqgrab.patch @@ -0,0 +1,105 @@ +From e7a8a784521984ae7156036131ea2c7eaa8acb7a Mon Sep 17 00:00:00 2001 +From: Ye Bin +Date: Mon, 5 Jun 2023 22:07:31 +0800 +Subject: [PATCH AUTOSEL 4.14 4/9] quota: fix warning in dqgrab() +X-stable: review +X-Patchwork-Hint: Ignore +X-stable-base: Linux 4.14.320 + +[ Upstream commit d6a95db3c7ad160bc16b89e36449705309b52bcb ] + +There's issue as follows when do fault injection: +WARNING: CPU: 1 PID: 14870 at include/linux/quotaops.h:51 dquot_disable+0x13b7/0x18c0 +Modules linked in: +CPU: 1 PID: 14870 Comm: fsconfig Not tainted 6.3.0-next-20230505-00006-g5107a9c821af-dirty #541 +RIP: 0010:dquot_disable+0x13b7/0x18c0 +RSP: 0018:ffffc9000acc79e0 EFLAGS: 00010246 +RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88825e41b980 +RDX: 0000000000000000 RSI: ffff88825e41b980 RDI: 0000000000000002 +RBP: ffff888179f68000 R08: ffffffff82087ca7 R09: 0000000000000000 +R10: 0000000000000001 R11: ffffed102f3ed026 R12: ffff888179f68130 +R13: ffff888179f68110 R14: dffffc0000000000 R15: ffff888179f68118 +FS: 00007f450a073740(0000) GS:ffff88882fc00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007ffe96f2efd8 CR3: 000000025c8ad000 CR4: 00000000000006e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + dquot_load_quota_sb+0xd53/0x1060 + dquot_resume+0x172/0x230 + ext4_reconfigure+0x1dc6/0x27b0 + reconfigure_super+0x515/0xa90 + __x64_sys_fsconfig+0xb19/0xd20 + do_syscall_64+0x39/0xb0 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Above issue may happens as follows: +ProcessA ProcessB ProcessC +sys_fsconfig + vfs_fsconfig_locked + reconfigure_super + ext4_remount + dquot_suspend -> suspend all type quota + + sys_fsconfig + vfs_fsconfig_locked + reconfigure_super + ext4_remount + dquot_resume + ret = dquot_load_quota_sb + add_dquot_ref + do_open -> open file O_RDWR + vfs_open + do_dentry_open + get_write_access + atomic_inc_unless_negative(&inode->i_writecount) + ext4_file_open + dquot_file_open + dquot_initialize + __dquot_initialize + dqget + atomic_inc(&dquot->dq_count); + + __dquot_initialize + __dquot_initialize + dqget + if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) + ext4_acquire_dquot + -> Return error DQ_ACTIVE_B flag isn't set + dquot_disable + invalidate_dquots + if (atomic_read(&dquot->dq_count)) + dqgrab + WARN_ON_ONCE(!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) + -> Trigger warning + +In the above scenario, 'dquot->dq_flags' has no DQ_ACTIVE_B is normal when +dqgrab(). +To solve above issue just replace the dqgrab() use in invalidate_dquots() with +atomic_inc(&dquot->dq_count). + +Signed-off-by: Ye Bin +Signed-off-by: Jan Kara +Message-Id: <20230605140731.2427629-3-yebin10@huawei.com> +Signed-off-by: Sasha Levin +--- + fs/quota/dquot.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c +index 1cbec5dde5830..1629d50782bf9 100644 +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -540,7 +540,7 @@ static void invalidate_dquots(struct super_block *sb, int type) + continue; + /* Wait for dquot users */ + if (atomic_read(&dquot->dq_count)) { +- dqgrab(dquot); ++ atomic_inc(&dquot->dq_count); + spin_unlock(&dq_list_lock); + /* + * Once dqput() wakes us up, we know it's time to free +-- +2.39.2 + diff --git a/queue-5.15/quota-properly-disable-quotas-when-add_dquot_ref-fai.patch b/queue-5.15/quota-properly-disable-quotas-when-add_dquot_ref-fai.patch new file mode 100644 index 00000000000..477eae0be2a --- /dev/null +++ b/queue-5.15/quota-properly-disable-quotas-when-add_dquot_ref-fai.patch @@ -0,0 +1,45 @@ +From f301753d111db16bc1a3c2df05ddfc769ea5ae66 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Mon, 5 Jun 2023 22:07:30 +0800 +Subject: [PATCH AUTOSEL 4.14 3/9] quota: Properly disable quotas when + add_dquot_ref() fails +X-stable: review +X-Patchwork-Hint: Ignore +X-stable-base: Linux 4.14.320 + +[ Upstream commit 6a4e3363792e30177cc3965697e34ddcea8b900b ] + +When add_dquot_ref() fails (usually due to IO error or ENOMEM), we want +to disable quotas we are trying to enable. However dquot_disable() call +was passed just the flags we are enabling so in case flags == +DQUOT_USAGE_ENABLED dquot_disable() call will just fail with EINVAL +instead of properly disabling quotas. Fix the problem by always passing +DQUOT_LIMITS_ENABLED | DQUOT_USAGE_ENABLED to dquot_disable() in this +case. + +Reported-and-tested-by: Ye Bin +Reported-by: syzbot+e633c79ceaecbf479854@syzkaller.appspotmail.com +Signed-off-by: Jan Kara +Message-Id: <20230605140731.2427629-2-yebin10@huawei.com> +Signed-off-by: Sasha Levin +--- + fs/quota/dquot.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c +index 7c364cda8daac..1cbec5dde5830 100644 +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -2387,7 +2387,8 @@ static int vfs_load_quota_inode(struct inode *inode, int type, int format_id, + + error = add_dquot_ref(sb, type); + if (error) +- dquot_disable(sb, type, flags); ++ dquot_disable(sb, type, ++ DQUOT_USAGE_ENABLED | DQUOT_LIMITS_ENABLED); + + return error; + out_file_init: +-- +2.39.2 + diff --git a/queue-5.15/revert-tcp-avoid-the-lookup-process-failing-to-get-s.patch b/queue-5.15/revert-tcp-avoid-the-lookup-process-failing-to-get-s.patch new file mode 100644 index 00000000000..eb95f2e3c93 --- /dev/null +++ b/queue-5.15/revert-tcp-avoid-the-lookup-process-failing-to-get-s.patch @@ -0,0 +1,113 @@ +From b8c38854ea450db75e988f2003336172f1c482b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 14:59:18 -0700 +Subject: Revert "tcp: avoid the lookup process failing to get sk in ehash + table" + +From: Kuniyuki Iwashima + +[ Upstream commit 81b3ade5d2b98ad6e0a473b0e1e420a801275592 ] + +This reverts commit 3f4ca5fafc08881d7a57daa20449d171f2887043. + +Commit 3f4ca5fafc08 ("tcp: avoid the lookup process failing to get sk in +ehash table") reversed the order in how a socket is inserted into ehash +to fix an issue that ehash-lookup could fail when reqsk/full sk/twsk are +swapped. However, it introduced another lookup failure. + +The full socket in ehash is allocated from a slab with SLAB_TYPESAFE_BY_RCU +and does not have SOCK_RCU_FREE, so the socket could be reused even while +it is being referenced on another CPU doing RCU lookup. + +Let's say a socket is reused and inserted into the same hash bucket during +lookup. After the blamed commit, a new socket is inserted at the end of +the list. If that happens, we will skip sockets placed after the previous +position of the reused socket, resulting in ehash lookup failure. + +As described in Documentation/RCU/rculist_nulls.rst, we should insert a +new socket at the head of the list to avoid such an issue. + +This issue, the swap-lookup-failure, and another variant reported in [0] +can all be handled properly by adding a locked ehash lookup suggested by +Eric Dumazet [1]. + +However, this issue could occur for every packet, thus more likely than +the other two races, so let's revert the change for now. + +Link: https://lore.kernel.org/netdev/20230606064306.9192-1-duanmuquan@baidu.com/ [0] +Link: https://lore.kernel.org/netdev/CANn89iK8snOz8TYOhhwfimC7ykYA78GA3Nyv8x06SZYa1nKdyA@mail.gmail.com/ [1] +Fixes: 3f4ca5fafc08 ("tcp: avoid the lookup process failing to get sk in ehash table") +Signed-off-by: Kuniyuki Iwashima +Link: https://lore.kernel.org/r/20230717215918.15723-1-kuniyu@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/inet_hashtables.c | 17 ++--------------- + net/ipv4/inet_timewait_sock.c | 8 ++++---- + 2 files changed, 6 insertions(+), 19 deletions(-) + +diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c +index 39b3db5b61190..2936676f86eb8 100644 +--- a/net/ipv4/inet_hashtables.c ++++ b/net/ipv4/inet_hashtables.c +@@ -571,20 +571,8 @@ bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk) + spin_lock(lock); + if (osk) { + WARN_ON_ONCE(sk->sk_hash != osk->sk_hash); +- ret = sk_hashed(osk); +- if (ret) { +- /* Before deleting the node, we insert a new one to make +- * sure that the look-up-sk process would not miss either +- * of them and that at least one node would exist in ehash +- * table all the time. Otherwise there's a tiny chance +- * that lookup process could find nothing in ehash table. +- */ +- __sk_nulls_add_node_tail_rcu(sk, list); +- sk_nulls_del_node_init_rcu(osk); +- } +- goto unlock; +- } +- if (found_dup_sk) { ++ ret = sk_nulls_del_node_init_rcu(osk); ++ } else if (found_dup_sk) { + *found_dup_sk = inet_ehash_lookup_by_sk(sk, list); + if (*found_dup_sk) + ret = false; +@@ -593,7 +581,6 @@ bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk) + if (ret) + __sk_nulls_add_node_rcu(sk, list); + +-unlock: + spin_unlock(lock); + + return ret; +diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c +index fe6340c363b43..437afe392e667 100644 +--- a/net/ipv4/inet_timewait_sock.c ++++ b/net/ipv4/inet_timewait_sock.c +@@ -81,10 +81,10 @@ void inet_twsk_put(struct inet_timewait_sock *tw) + } + EXPORT_SYMBOL_GPL(inet_twsk_put); + +-static void inet_twsk_add_node_tail_rcu(struct inet_timewait_sock *tw, +- struct hlist_nulls_head *list) ++static void inet_twsk_add_node_rcu(struct inet_timewait_sock *tw, ++ struct hlist_nulls_head *list) + { +- hlist_nulls_add_tail_rcu(&tw->tw_node, list); ++ hlist_nulls_add_head_rcu(&tw->tw_node, list); + } + + static void inet_twsk_add_bind_node(struct inet_timewait_sock *tw, +@@ -120,7 +120,7 @@ void inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk, + + spin_lock(lock); + +- inet_twsk_add_node_tail_rcu(tw, &ehead->chain); ++ inet_twsk_add_node_rcu(tw, &ehead->chain); + + /* Step 3: Remove SK from hash chain */ + if (__sk_nulls_del_node_init_rcu(sk)) +-- +2.39.2 + diff --git a/queue-5.15/security-keys-modify-mismatched-function-name.patch b/queue-5.15/security-keys-modify-mismatched-function-name.patch new file mode 100644 index 00000000000..2722a9f7bd6 --- /dev/null +++ b/queue-5.15/security-keys-modify-mismatched-function-name.patch @@ -0,0 +1,40 @@ +From 05011b1bd2dcdc82edf4f77f9e954e125c577e98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 10:18:25 +0800 +Subject: security: keys: Modify mismatched function name + +From: Jiapeng Chong + +[ Upstream commit 2a4152742025c5f21482e8cebc581702a0fa5b01 ] + +No functional modification involved. + +security/keys/trusted-keys/trusted_tpm2.c:203: warning: expecting prototype for tpm_buf_append_auth(). Prototype was for tpm2_buf_append_auth() instead. + +Fixes: 2e19e10131a0 ("KEYS: trusted: Move TPM2 trusted keys code") +Reported-by: Abaci Robot +Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=5524 +Signed-off-by: Jiapeng Chong +Reviewed-by: Paul Moore +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + security/keys/trusted-keys/trusted_tpm2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/security/keys/trusted-keys/trusted_tpm2.c b/security/keys/trusted-keys/trusted_tpm2.c +index 2b2c8eb258d5b..bc700f85f80be 100644 +--- a/security/keys/trusted-keys/trusted_tpm2.c ++++ b/security/keys/trusted-keys/trusted_tpm2.c +@@ -186,7 +186,7 @@ int tpm2_key_priv(void *context, size_t hdrlen, + } + + /** +- * tpm_buf_append_auth() - append TPMS_AUTH_COMMAND to the buffer. ++ * tpm2_buf_append_auth() - append TPMS_AUTH_COMMAND to the buffer. + * + * @buf: an allocated tpm_buf instance + * @session_handle: session handle +-- +2.39.2 + diff --git a/queue-5.15/series b/queue-5.15/series index d351e6a1634..20782ab7949 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -27,3 +27,52 @@ asoc-codecs-wcd934x-fix-resource-leaks-on-component-remove.patch asoc-codecs-wcd938x-fix-codec-initialisation-race.patch asoc-codecs-wcd938x-fix-soundwire-initialisation-race.patch ext4-correct-inline-offset-when-handling-xattrs-in-inode-body.patch +drm-radeon-fix-integer-overflow-in-radeon_cs_parser_.patch +alsa-emu10k1-roll-up-loops-in-dsp-setup-code-for-aud.patch +quota-properly-disable-quotas-when-add_dquot_ref-fai.patch +quota-fix-warning-in-dqgrab.patch +udf-fix-uninitialized-array-access-for-some-pathname.patch +fs-jfs-fix-ubsan-array-index-out-of-bounds-in-dballo.patch +mips-dec-prom-address-warray-bounds-warning.patch +fs-jfs-fix-null-ptr-deref-read-in-txbegin.patch +fs-jfs-check-for-read-only-mounted-filesystem-in-txb.patch +spi-bcm63xx-fix-max-prepend-length.patch +fbdev-imxfb-warn-about-invalid-left-right-margin.patch +perf-build-fix-library-not-found-error-when-using-cs.patch +pinctrl-amd-use-amd_pinconf_set-for-all-config-optio.patch +net-ethernet-ti-cpsw_ale-fix-cpsw_ale_get_field-cpsw.patch +bridge-add-extack-warning-when-enabling-stp-in-netns.patch +ethernet-use-eth_hw_addr_set-instead-of-ether_addr_c.patch +of-net-add-a-helper-for-loading-netdev-dev_addr.patch +ethernet-use-of_get_ethdev_address.patch +net-ethernet-mtk_eth_soc-handle-probe-deferral.patch +net-sched-cls_bpf-undo-tcf_bind_filter-in-case-of-an.patch +iavf-fix-use-after-free-in-free_netdev.patch +iavf-fix-out-of-bounds-when-setting-channels-on-remo.patch +security-keys-modify-mismatched-function-name.patch +octeontx2-pf-dont-allocate-bpids-for-lbk-interfaces.patch +bpf-fix-subprog-idx-logic-in-check_max_stack_depth.patch +net-annotate-accesses-to-queue-trans_start.patch +igc-avoid-transmit-queue-timeout-for-xdp.patch +igc-prevent-garbled-tx-queue-with-xdp-zerocopy.patch +tcp-annotate-data-races-around-tcp_rsk-req-ts_recent.patch +net-ipv4-use-kfree_sensitive-instead-of-kfree.patch +net-ipv6-check-return-value-of-pskb_trim.patch +revert-tcp-avoid-the-lookup-process-failing-to-get-s.patch +fbdev-au1200fb-fix-missing-irq-check-in-au1200fb_drv.patch +llc-don-t-drop-packet-from-non-root-netns.patch +netfilter-nf_tables-fix-spurious-set-element-inserti.patch +netfilter-nft_set_pipapo-fix-improper-element-remova.patch +netfilter-nf_tables-skip-bound-chain-in-netns-releas.patch +netfilter-nf_tables-skip-bound-chain-on-rule-flush.patch +tcp-annotate-data-races-around-tp-tcp_tx_delay.patch +tcp-annotate-data-races-around-tp-keepalive_time.patch +tcp-annotate-data-races-around-tp-keepalive_intvl.patch +tcp-annotate-data-races-around-tp-keepalive_probes.patch +tcp-annotate-data-races-around-icsk-icsk_syn_retries.patch +tcp-annotate-data-races-around-tp-linger2.patch +tcp-annotate-data-races-around-rskq_defer_accept.patch +tcp-annotate-data-races-around-tp-notsent_lowat.patch +tcp-annotate-data-races-around-icsk-icsk_user_timeou.patch +tcp-annotate-data-races-around-fastopenq.max_qlen.patch +net-phy-prevent-stale-pointer-dereference-in-phy_ini.patch diff --git a/queue-5.15/spi-bcm63xx-fix-max-prepend-length.patch b/queue-5.15/spi-bcm63xx-fix-max-prepend-length.patch new file mode 100644 index 00000000000..44702d1006b --- /dev/null +++ b/queue-5.15/spi-bcm63xx-fix-max-prepend-length.patch @@ -0,0 +1,47 @@ +From 9fbcf2bf0230640f0ce7744450128a11ddbdc689 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jun 2023 09:14:52 +0200 +Subject: spi: bcm63xx: fix max prepend length + +From: Jonas Gorski + +[ Upstream commit 5158814cbb37bbb38344b3ecddc24ba2ed0365f2 ] + +The command word is defined as following: + + /* Command */ + #define SPI_CMD_COMMAND_SHIFT 0 + #define SPI_CMD_DEVICE_ID_SHIFT 4 + #define SPI_CMD_PREPEND_BYTE_CNT_SHIFT 8 + #define SPI_CMD_ONE_BYTE_SHIFT 11 + #define SPI_CMD_ONE_WIRE_SHIFT 12 + +If the prepend byte count field starts at bit 8, and the next defined +bit is SPI_CMD_ONE_BYTE at bit 11, it can be at most 3 bits wide, and +thus the max value is 7, not 15. + +Fixes: b17de076062a ("spi/bcm63xx: work around inability to keep CS up") +Signed-off-by: Jonas Gorski +Link: https://lore.kernel.org/r/20230629071453.62024-1-jonas.gorski@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-bcm63xx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c +index 80fa0ef8909ca..147199002df1e 100644 +--- a/drivers/spi/spi-bcm63xx.c ++++ b/drivers/spi/spi-bcm63xx.c +@@ -126,7 +126,7 @@ enum bcm63xx_regs_spi { + SPI_MSG_DATA_SIZE, + }; + +-#define BCM63XX_SPI_MAX_PREPEND 15 ++#define BCM63XX_SPI_MAX_PREPEND 7 + + #define BCM63XX_SPI_MAX_CS 8 + #define BCM63XX_SPI_BUS_NUM 0 +-- +2.39.2 + diff --git a/queue-5.15/tcp-annotate-data-races-around-fastopenq.max_qlen.patch b/queue-5.15/tcp-annotate-data-races-around-fastopenq.max_qlen.patch new file mode 100644 index 00000000000..268ee78d7d7 --- /dev/null +++ b/queue-5.15/tcp-annotate-data-races-around-fastopenq.max_qlen.patch @@ -0,0 +1,77 @@ +From 504873f1d236bd53ef78e9b9b2a3ac77426d3932 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 21:28:57 +0000 +Subject: tcp: annotate data-races around fastopenq.max_qlen + +From: Eric Dumazet + +[ Upstream commit 70f360dd7042cb843635ece9d28335a4addff9eb ] + +This field can be read locklessly. + +Fixes: 1536e2857bd3 ("tcp: Add a TCP_FASTOPEN socket option to get a max backlog on its listner") +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20230719212857.3943972-12-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/linux/tcp.h | 2 +- + net/ipv4/tcp.c | 2 +- + net/ipv4/tcp_fastopen.c | 6 ++++-- + 3 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/include/linux/tcp.h b/include/linux/tcp.h +index a7ebadf83c681..07a84ae6bf81c 100644 +--- a/include/linux/tcp.h ++++ b/include/linux/tcp.h +@@ -473,7 +473,7 @@ static inline void fastopen_queue_tune(struct sock *sk, int backlog) + struct request_sock_queue *queue = &inet_csk(sk)->icsk_accept_queue; + int somaxconn = READ_ONCE(sock_net(sk)->core.sysctl_somaxconn); + +- queue->fastopenq.max_qlen = min_t(unsigned int, backlog, somaxconn); ++ WRITE_ONCE(queue->fastopenq.max_qlen, min_t(unsigned int, backlog, somaxconn)); + } + + static inline void tcp_move_syn(struct tcp_sock *tp, +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index cf486d75da836..a91cf000bb61b 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -4142,7 +4142,7 @@ static int do_tcp_getsockopt(struct sock *sk, int level, + break; + + case TCP_FASTOPEN: +- val = icsk->icsk_accept_queue.fastopenq.max_qlen; ++ val = READ_ONCE(icsk->icsk_accept_queue.fastopenq.max_qlen); + break; + + case TCP_FASTOPEN_CONNECT: +diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c +index 6e0a8ef5e816f..e9b5d6f10c56d 100644 +--- a/net/ipv4/tcp_fastopen.c ++++ b/net/ipv4/tcp_fastopen.c +@@ -301,6 +301,7 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk, + static bool tcp_fastopen_queue_check(struct sock *sk) + { + struct fastopen_queue *fastopenq; ++ int max_qlen; + + /* Make sure the listener has enabled fastopen, and we don't + * exceed the max # of pending TFO requests allowed before trying +@@ -313,10 +314,11 @@ static bool tcp_fastopen_queue_check(struct sock *sk) + * temporarily vs a server not supporting Fast Open at all. + */ + fastopenq = &inet_csk(sk)->icsk_accept_queue.fastopenq; +- if (fastopenq->max_qlen == 0) ++ max_qlen = READ_ONCE(fastopenq->max_qlen); ++ if (max_qlen == 0) + return false; + +- if (fastopenq->qlen >= fastopenq->max_qlen) { ++ if (fastopenq->qlen >= max_qlen) { + struct request_sock *req1; + spin_lock(&fastopenq->lock); + req1 = fastopenq->rskq_rst_head; +-- +2.39.2 + diff --git a/queue-5.15/tcp-annotate-data-races-around-icsk-icsk_syn_retries.patch b/queue-5.15/tcp-annotate-data-races-around-icsk-icsk_syn_retries.patch new file mode 100644 index 00000000000..b4365f34dd7 --- /dev/null +++ b/queue-5.15/tcp-annotate-data-races-around-icsk-icsk_syn_retries.patch @@ -0,0 +1,69 @@ +From b2ddd787ef0c1df81069273cd907f7e4e71ce306 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 21:28:52 +0000 +Subject: tcp: annotate data-races around icsk->icsk_syn_retries + +From: Eric Dumazet + +[ Upstream commit 3a037f0f3c4bfe44518f2fbb478aa2f99a9cd8bb ] + +do_tcp_getsockopt() and reqsk_timer_handler() read +icsk->icsk_syn_retries while another cpu might change its value. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20230719212857.3943972-7-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/inet_connection_sock.c | 2 +- + net/ipv4/tcp.c | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c +index 4fb0506430774..c770719797e12 100644 +--- a/net/ipv4/inet_connection_sock.c ++++ b/net/ipv4/inet_connection_sock.c +@@ -833,7 +833,7 @@ static void reqsk_timer_handler(struct timer_list *t) + + icsk = inet_csk(sk_listener); + net = sock_net(sk_listener); +- max_syn_ack_retries = icsk->icsk_syn_retries ? : ++ max_syn_ack_retries = READ_ONCE(icsk->icsk_syn_retries) ? : + READ_ONCE(net->ipv4.sysctl_tcp_synack_retries); + /* Normally all the openreqs are young and become mature + * (i.e. converted to established socket) for first timeout. +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 994ac3cd50e1d..4077b456e3838 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -3296,7 +3296,7 @@ int tcp_sock_set_syncnt(struct sock *sk, int val) + return -EINVAL; + + lock_sock(sk); +- inet_csk(sk)->icsk_syn_retries = val; ++ WRITE_ONCE(inet_csk(sk)->icsk_syn_retries, val); + release_sock(sk); + return 0; + } +@@ -3577,7 +3577,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level, int optname, + if (val < 1 || val > MAX_TCP_SYNCNT) + err = -EINVAL; + else +- icsk->icsk_syn_retries = val; ++ WRITE_ONCE(icsk->icsk_syn_retries, val); + break; + + case TCP_SAVE_SYN: +@@ -3991,7 +3991,7 @@ static int do_tcp_getsockopt(struct sock *sk, int level, + val = keepalive_probes(tp); + break; + case TCP_SYNCNT: +- val = icsk->icsk_syn_retries ? : ++ val = READ_ONCE(icsk->icsk_syn_retries) ? : + READ_ONCE(net->ipv4.sysctl_tcp_syn_retries); + break; + case TCP_LINGER2: +-- +2.39.2 + diff --git a/queue-5.15/tcp-annotate-data-races-around-icsk-icsk_user_timeou.patch b/queue-5.15/tcp-annotate-data-races-around-icsk-icsk_user_timeou.patch new file mode 100644 index 00000000000..f9520fdf8ff --- /dev/null +++ b/queue-5.15/tcp-annotate-data-races-around-icsk-icsk_user_timeou.patch @@ -0,0 +1,54 @@ +From f279d65abef9beb12c4b3a8e38d9551fa94e1462 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 21:28:56 +0000 +Subject: tcp: annotate data-races around icsk->icsk_user_timeout + +From: Eric Dumazet + +[ Upstream commit 26023e91e12c68669db416b97234328a03d8e499 ] + +This field can be read locklessly from do_tcp_getsockopt() + +Fixes: dca43c75e7e5 ("tcp: Add TCP_USER_TIMEOUT socket option.") +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20230719212857.3943972-11-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 95e3e32d211a7..cf486d75da836 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -3305,7 +3305,7 @@ EXPORT_SYMBOL(tcp_sock_set_syncnt); + void tcp_sock_set_user_timeout(struct sock *sk, u32 val) + { + lock_sock(sk); +- inet_csk(sk)->icsk_user_timeout = val; ++ WRITE_ONCE(inet_csk(sk)->icsk_user_timeout, val); + release_sock(sk); + } + EXPORT_SYMBOL(tcp_sock_set_user_timeout); +@@ -3625,7 +3625,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level, int optname, + if (val < 0) + err = -EINVAL; + else +- icsk->icsk_user_timeout = val; ++ WRITE_ONCE(icsk->icsk_user_timeout, val); + break; + + case TCP_FASTOPEN: +@@ -4138,7 +4138,7 @@ static int do_tcp_getsockopt(struct sock *sk, int level, + break; + + case TCP_USER_TIMEOUT: +- val = icsk->icsk_user_timeout; ++ val = READ_ONCE(icsk->icsk_user_timeout); + break; + + case TCP_FASTOPEN: +-- +2.39.2 + diff --git a/queue-5.15/tcp-annotate-data-races-around-rskq_defer_accept.patch b/queue-5.15/tcp-annotate-data-races-around-rskq_defer_accept.patch new file mode 100644 index 00000000000..9fdfb32b1fd --- /dev/null +++ b/queue-5.15/tcp-annotate-data-races-around-rskq_defer_accept.patch @@ -0,0 +1,53 @@ +From f771690722227ddf46e211314d1db050e9d8c24a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 21:28:54 +0000 +Subject: tcp: annotate data-races around rskq_defer_accept + +From: Eric Dumazet + +[ Upstream commit ae488c74422fb1dcd807c0201804b3b5e8a322a3 ] + +do_tcp_getsockopt() reads rskq_defer_accept while another cpu +might change its value. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20230719212857.3943972-9-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 58f202fd6f269..29661f7e372d9 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -3599,9 +3599,9 @@ static int do_tcp_setsockopt(struct sock *sk, int level, int optname, + + case TCP_DEFER_ACCEPT: + /* Translate value in seconds to number of retransmits */ +- icsk->icsk_accept_queue.rskq_defer_accept = +- secs_to_retrans(val, TCP_TIMEOUT_INIT / HZ, +- TCP_RTO_MAX / HZ); ++ WRITE_ONCE(icsk->icsk_accept_queue.rskq_defer_accept, ++ secs_to_retrans(val, TCP_TIMEOUT_INIT / HZ, ++ TCP_RTO_MAX / HZ)); + break; + + case TCP_WINDOW_CLAMP: +@@ -4000,8 +4000,9 @@ static int do_tcp_getsockopt(struct sock *sk, int level, + val = (val ? : READ_ONCE(net->ipv4.sysctl_tcp_fin_timeout)) / HZ; + break; + case TCP_DEFER_ACCEPT: +- val = retrans_to_secs(icsk->icsk_accept_queue.rskq_defer_accept, +- TCP_TIMEOUT_INIT / HZ, TCP_RTO_MAX / HZ); ++ val = READ_ONCE(icsk->icsk_accept_queue.rskq_defer_accept); ++ val = retrans_to_secs(val, TCP_TIMEOUT_INIT / HZ, ++ TCP_RTO_MAX / HZ); + break; + case TCP_WINDOW_CLAMP: + val = tp->window_clamp; +-- +2.39.2 + diff --git a/queue-5.15/tcp-annotate-data-races-around-tcp_rsk-req-ts_recent.patch b/queue-5.15/tcp-annotate-data-races-around-tcp_rsk-req-ts_recent.patch new file mode 100644 index 00000000000..1132c32bc92 --- /dev/null +++ b/queue-5.15/tcp-annotate-data-races-around-tcp_rsk-req-ts_recent.patch @@ -0,0 +1,184 @@ +From 2c32fb0c394d7eab02829f481a3f9b49b806dd70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 14:44:45 +0000 +Subject: tcp: annotate data-races around tcp_rsk(req)->ts_recent + +From: Eric Dumazet + +[ Upstream commit eba20811f32652bc1a52d5e7cc403859b86390d9 ] + +TCP request sockets are lockless, tcp_rsk(req)->ts_recent +can change while being read by another cpu as syzbot noticed. + +This is harmless, but we should annotate the known races. + +Note that tcp_check_req() changes req->ts_recent a bit early, +we might change this in the future. + +BUG: KCSAN: data-race in tcp_check_req / tcp_check_req + +write to 0xffff88813c8afb84 of 4 bytes by interrupt on cpu 1: +tcp_check_req+0x694/0xc70 net/ipv4/tcp_minisocks.c:762 +tcp_v4_rcv+0x12db/0x1b70 net/ipv4/tcp_ipv4.c:2071 +ip_protocol_deliver_rcu+0x356/0x6d0 net/ipv4/ip_input.c:205 +ip_local_deliver_finish+0x13c/0x1a0 net/ipv4/ip_input.c:233 +NF_HOOK include/linux/netfilter.h:303 [inline] +ip_local_deliver+0xec/0x1c0 net/ipv4/ip_input.c:254 +dst_input include/net/dst.h:468 [inline] +ip_rcv_finish net/ipv4/ip_input.c:449 [inline] +NF_HOOK include/linux/netfilter.h:303 [inline] +ip_rcv+0x197/0x270 net/ipv4/ip_input.c:569 +__netif_receive_skb_one_core net/core/dev.c:5493 [inline] +__netif_receive_skb+0x90/0x1b0 net/core/dev.c:5607 +process_backlog+0x21f/0x380 net/core/dev.c:5935 +__napi_poll+0x60/0x3b0 net/core/dev.c:6498 +napi_poll net/core/dev.c:6565 [inline] +net_rx_action+0x32b/0x750 net/core/dev.c:6698 +__do_softirq+0xc1/0x265 kernel/softirq.c:571 +do_softirq+0x7e/0xb0 kernel/softirq.c:472 +__local_bh_enable_ip+0x64/0x70 kernel/softirq.c:396 +local_bh_enable+0x1f/0x20 include/linux/bottom_half.h:33 +rcu_read_unlock_bh include/linux/rcupdate.h:843 [inline] +__dev_queue_xmit+0xabb/0x1d10 net/core/dev.c:4271 +dev_queue_xmit include/linux/netdevice.h:3088 [inline] +neigh_hh_output include/net/neighbour.h:528 [inline] +neigh_output include/net/neighbour.h:542 [inline] +ip_finish_output2+0x700/0x840 net/ipv4/ip_output.c:229 +ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:317 +NF_HOOK_COND include/linux/netfilter.h:292 [inline] +ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:431 +dst_output include/net/dst.h:458 [inline] +ip_local_out net/ipv4/ip_output.c:126 [inline] +__ip_queue_xmit+0xa4d/0xa70 net/ipv4/ip_output.c:533 +ip_queue_xmit+0x38/0x40 net/ipv4/ip_output.c:547 +__tcp_transmit_skb+0x1194/0x16e0 net/ipv4/tcp_output.c:1399 +tcp_transmit_skb net/ipv4/tcp_output.c:1417 [inline] +tcp_write_xmit+0x13ff/0x2fd0 net/ipv4/tcp_output.c:2693 +__tcp_push_pending_frames+0x6a/0x1a0 net/ipv4/tcp_output.c:2877 +tcp_push_pending_frames include/net/tcp.h:1952 [inline] +__tcp_sock_set_cork net/ipv4/tcp.c:3336 [inline] +tcp_sock_set_cork+0xe8/0x100 net/ipv4/tcp.c:3343 +rds_tcp_xmit_path_complete+0x3b/0x40 net/rds/tcp_send.c:52 +rds_send_xmit+0xf8d/0x1420 net/rds/send.c:422 +rds_send_worker+0x42/0x1d0 net/rds/threads.c:200 +process_one_work+0x3e6/0x750 kernel/workqueue.c:2408 +worker_thread+0x5f2/0xa10 kernel/workqueue.c:2555 +kthread+0x1d7/0x210 kernel/kthread.c:379 +ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 + +read to 0xffff88813c8afb84 of 4 bytes by interrupt on cpu 0: +tcp_check_req+0x32a/0xc70 net/ipv4/tcp_minisocks.c:622 +tcp_v4_rcv+0x12db/0x1b70 net/ipv4/tcp_ipv4.c:2071 +ip_protocol_deliver_rcu+0x356/0x6d0 net/ipv4/ip_input.c:205 +ip_local_deliver_finish+0x13c/0x1a0 net/ipv4/ip_input.c:233 +NF_HOOK include/linux/netfilter.h:303 [inline] +ip_local_deliver+0xec/0x1c0 net/ipv4/ip_input.c:254 +dst_input include/net/dst.h:468 [inline] +ip_rcv_finish net/ipv4/ip_input.c:449 [inline] +NF_HOOK include/linux/netfilter.h:303 [inline] +ip_rcv+0x197/0x270 net/ipv4/ip_input.c:569 +__netif_receive_skb_one_core net/core/dev.c:5493 [inline] +__netif_receive_skb+0x90/0x1b0 net/core/dev.c:5607 +process_backlog+0x21f/0x380 net/core/dev.c:5935 +__napi_poll+0x60/0x3b0 net/core/dev.c:6498 +napi_poll net/core/dev.c:6565 [inline] +net_rx_action+0x32b/0x750 net/core/dev.c:6698 +__do_softirq+0xc1/0x265 kernel/softirq.c:571 +run_ksoftirqd+0x17/0x20 kernel/softirq.c:939 +smpboot_thread_fn+0x30a/0x4a0 kernel/smpboot.c:164 +kthread+0x1d7/0x210 kernel/kthread.c:379 +ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 + +value changed: 0x1cd237f1 -> 0x1cd237f2 + +Fixes: 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Reviewed-by: Kuniyuki Iwashima +Link: https://lore.kernel.org/r/20230717144445.653164-3-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_ipv4.c | 2 +- + net/ipv4/tcp_minisocks.c | 9 ++++++--- + net/ipv4/tcp_output.c | 2 +- + net/ipv6/tcp_ipv6.c | 2 +- + 4 files changed, 9 insertions(+), 6 deletions(-) + +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index 9ac6bca83fadb..87bdbb527930f 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -975,7 +975,7 @@ static void tcp_v4_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb, + tcp_rsk(req)->rcv_nxt, + req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale, + tcp_time_stamp_raw() + tcp_rsk(req)->ts_off, +- req->ts_recent, ++ READ_ONCE(req->ts_recent), + 0, + tcp_md5_do_lookup(sk, l3index, addr, AF_INET), + inet_rsk(req)->no_srccheck ? IP_REPLY_ARG_NOSRCCHECK : 0, +diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c +index aa67d5adcbca9..2606a5571116a 100644 +--- a/net/ipv4/tcp_minisocks.c ++++ b/net/ipv4/tcp_minisocks.c +@@ -523,7 +523,7 @@ struct sock *tcp_create_openreq_child(const struct sock *sk, + newtp->max_window = newtp->snd_wnd; + + if (newtp->rx_opt.tstamp_ok) { +- newtp->rx_opt.ts_recent = req->ts_recent; ++ newtp->rx_opt.ts_recent = READ_ONCE(req->ts_recent); + newtp->rx_opt.ts_recent_stamp = ktime_get_seconds(); + newtp->tcp_header_len = sizeof(struct tcphdr) + TCPOLEN_TSTAMP_ALIGNED; + } else { +@@ -586,7 +586,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb, + tcp_parse_options(sock_net(sk), skb, &tmp_opt, 0, NULL); + + if (tmp_opt.saw_tstamp) { +- tmp_opt.ts_recent = req->ts_recent; ++ tmp_opt.ts_recent = READ_ONCE(req->ts_recent); + if (tmp_opt.rcv_tsecr) + tmp_opt.rcv_tsecr -= tcp_rsk(req)->ts_off; + /* We do not store true stamp, but it is not required, +@@ -726,8 +726,11 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb, + + /* In sequence, PAWS is OK. */ + ++ /* TODO: We probably should defer ts_recent change once ++ * we take ownership of @req. ++ */ + if (tmp_opt.saw_tstamp && !after(TCP_SKB_CB(skb)->seq, tcp_rsk(req)->rcv_nxt)) +- req->ts_recent = tmp_opt.rcv_tsval; ++ WRITE_ONCE(req->ts_recent, tmp_opt.rcv_tsval); + + if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn) { + /* Truncate SYN, it is out of window starting +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 1f39b56bbab32..d46fb6d7057bd 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -875,7 +875,7 @@ static unsigned int tcp_synack_options(const struct sock *sk, + if (likely(ireq->tstamp_ok)) { + opts->options |= OPTION_TS; + opts->tsval = tcp_skb_timestamp(skb) + tcp_rsk(req)->ts_off; +- opts->tsecr = req->ts_recent; ++ opts->tsecr = READ_ONCE(req->ts_recent); + remaining -= TCPOLEN_TSTAMP_ALIGNED; + } + if (likely(ireq->sack_ok)) { +diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c +index b6f5a4474d8bc..c18fdddbfa09d 100644 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -1171,7 +1171,7 @@ static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb, + tcp_rsk(req)->rcv_nxt, + req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale, + tcp_time_stamp_raw() + tcp_rsk(req)->ts_off, +- req->ts_recent, sk->sk_bound_dev_if, ++ READ_ONCE(req->ts_recent), sk->sk_bound_dev_if, + tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr, l3index), + ipv6_get_dsfield(ipv6_hdr(skb)), 0, sk->sk_priority); + } +-- +2.39.2 + diff --git a/queue-5.15/tcp-annotate-data-races-around-tp-keepalive_intvl.patch b/queue-5.15/tcp-annotate-data-races-around-tp-keepalive_intvl.patch new file mode 100644 index 00000000000..32165d94ab7 --- /dev/null +++ b/queue-5.15/tcp-annotate-data-races-around-tp-keepalive_intvl.patch @@ -0,0 +1,68 @@ +From 396d0b4b004741b9e95e46d9e2d7c928e0659942 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 21:28:50 +0000 +Subject: tcp: annotate data-races around tp->keepalive_intvl + +From: Eric Dumazet + +[ Upstream commit 5ecf9d4f52ff2f1d4d44c9b68bc75688e82f13b4 ] + +do_tcp_getsockopt() reads tp->keepalive_intvl while another cpu +might change its value. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20230719212857.3943972-5-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/tcp.h | 9 +++++++-- + net/ipv4/tcp.c | 4 ++-- + 2 files changed, 9 insertions(+), 4 deletions(-) + +diff --git a/include/net/tcp.h b/include/net/tcp.h +index f9a24f48fa986..b737ce77f7062 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -1473,9 +1473,14 @@ void tcp_leave_memory_pressure(struct sock *sk); + static inline int keepalive_intvl_when(const struct tcp_sock *tp) + { + struct net *net = sock_net((struct sock *)tp); ++ int val; ++ ++ /* Paired with WRITE_ONCE() in tcp_sock_set_keepintvl() ++ * and do_tcp_setsockopt(). ++ */ ++ val = READ_ONCE(tp->keepalive_intvl); + +- return tp->keepalive_intvl ? : +- READ_ONCE(net->ipv4.sysctl_tcp_keepalive_intvl); ++ return val ? : READ_ONCE(net->ipv4.sysctl_tcp_keepalive_intvl); + } + + static inline int keepalive_time_when(const struct tcp_sock *tp) +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 54219e2080019..8fe1098b183d0 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -3350,7 +3350,7 @@ int tcp_sock_set_keepintvl(struct sock *sk, int val) + return -EINVAL; + + lock_sock(sk); +- tcp_sk(sk)->keepalive_intvl = val * HZ; ++ WRITE_ONCE(tcp_sk(sk)->keepalive_intvl, val * HZ); + release_sock(sk); + return 0; + } +@@ -3564,7 +3564,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level, int optname, + if (val < 1 || val > MAX_TCP_KEEPINTVL) + err = -EINVAL; + else +- tp->keepalive_intvl = val * HZ; ++ WRITE_ONCE(tp->keepalive_intvl, val * HZ); + break; + case TCP_KEEPCNT: + if (val < 1 || val > MAX_TCP_KEEPCNT) +-- +2.39.2 + diff --git a/queue-5.15/tcp-annotate-data-races-around-tp-keepalive_probes.patch b/queue-5.15/tcp-annotate-data-races-around-tp-keepalive_probes.patch new file mode 100644 index 00000000000..745e3bbd3fd --- /dev/null +++ b/queue-5.15/tcp-annotate-data-races-around-tp-keepalive_probes.patch @@ -0,0 +1,69 @@ +From ff4700cef1f60666493b4b6ab12310a59a844e3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 21:28:51 +0000 +Subject: tcp: annotate data-races around tp->keepalive_probes + +From: Eric Dumazet + +[ Upstream commit 6e5e1de616bf5f3df1769abc9292191dfad9110a ] + +do_tcp_getsockopt() reads tp->keepalive_probes while another cpu +might change its value. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20230719212857.3943972-6-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/tcp.h | 9 +++++++-- + net/ipv4/tcp.c | 5 +++-- + 2 files changed, 10 insertions(+), 4 deletions(-) + +diff --git a/include/net/tcp.h b/include/net/tcp.h +index b737ce77f7062..fe58b089f0b16 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -1497,9 +1497,14 @@ static inline int keepalive_time_when(const struct tcp_sock *tp) + static inline int keepalive_probes(const struct tcp_sock *tp) + { + struct net *net = sock_net((struct sock *)tp); ++ int val; ++ ++ /* Paired with WRITE_ONCE() in tcp_sock_set_keepcnt() ++ * and do_tcp_setsockopt(). ++ */ ++ val = READ_ONCE(tp->keepalive_probes); + +- return tp->keepalive_probes ? : +- READ_ONCE(net->ipv4.sysctl_tcp_keepalive_probes); ++ return val ? : READ_ONCE(net->ipv4.sysctl_tcp_keepalive_probes); + } + + static inline u32 keepalive_time_elapsed(const struct tcp_sock *tp) +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 8fe1098b183d0..994ac3cd50e1d 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -3362,7 +3362,8 @@ int tcp_sock_set_keepcnt(struct sock *sk, int val) + return -EINVAL; + + lock_sock(sk); +- tcp_sk(sk)->keepalive_probes = val; ++ /* Paired with READ_ONCE() in keepalive_probes() */ ++ WRITE_ONCE(tcp_sk(sk)->keepalive_probes, val); + release_sock(sk); + return 0; + } +@@ -3570,7 +3571,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level, int optname, + if (val < 1 || val > MAX_TCP_KEEPCNT) + err = -EINVAL; + else +- tp->keepalive_probes = val; ++ WRITE_ONCE(tp->keepalive_probes, val); + break; + case TCP_SYNCNT: + if (val < 1 || val > MAX_TCP_SYNCNT) +-- +2.39.2 + diff --git a/queue-5.15/tcp-annotate-data-races-around-tp-keepalive_time.patch b/queue-5.15/tcp-annotate-data-races-around-tp-keepalive_time.patch new file mode 100644 index 00000000000..ffcf7a9d4dc --- /dev/null +++ b/queue-5.15/tcp-annotate-data-races-around-tp-keepalive_time.patch @@ -0,0 +1,58 @@ +From cffe2e189f82c424c3b454a7c55cd419107b1469 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 21:28:49 +0000 +Subject: tcp: annotate data-races around tp->keepalive_time + +From: Eric Dumazet + +[ Upstream commit 4164245c76ff906c9086758e1c3f87082a7f5ef5 ] + +do_tcp_getsockopt() reads tp->keepalive_time while another cpu +might change its value. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20230719212857.3943972-4-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/tcp.h | 7 +++++-- + net/ipv4/tcp.c | 3 ++- + 2 files changed, 7 insertions(+), 3 deletions(-) + +diff --git a/include/net/tcp.h b/include/net/tcp.h +index fdac6913b6c8f..f9a24f48fa986 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -1481,9 +1481,12 @@ static inline int keepalive_intvl_when(const struct tcp_sock *tp) + static inline int keepalive_time_when(const struct tcp_sock *tp) + { + struct net *net = sock_net((struct sock *)tp); ++ int val; + +- return tp->keepalive_time ? : +- READ_ONCE(net->ipv4.sysctl_tcp_keepalive_time); ++ /* Paired with WRITE_ONCE() in tcp_sock_set_keepidle_locked() */ ++ val = READ_ONCE(tp->keepalive_time); ++ ++ return val ? : READ_ONCE(net->ipv4.sysctl_tcp_keepalive_time); + } + + static inline int keepalive_probes(const struct tcp_sock *tp) +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 8ff86431f44b4..54219e2080019 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -3317,7 +3317,8 @@ int tcp_sock_set_keepidle_locked(struct sock *sk, int val) + if (val < 1 || val > MAX_TCP_KEEPIDLE) + return -EINVAL; + +- tp->keepalive_time = val * HZ; ++ /* Paired with WRITE_ONCE() in keepalive_time_when() */ ++ WRITE_ONCE(tp->keepalive_time, val * HZ); + if (sock_flag(sk, SOCK_KEEPOPEN) && + !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) { + u32 elapsed = keepalive_time_elapsed(tp); +-- +2.39.2 + diff --git a/queue-5.15/tcp-annotate-data-races-around-tp-linger2.patch b/queue-5.15/tcp-annotate-data-races-around-tp-linger2.patch new file mode 100644 index 00000000000..f4e69d16c71 --- /dev/null +++ b/queue-5.15/tcp-annotate-data-races-around-tp-linger2.patch @@ -0,0 +1,52 @@ +From 480941945887e8588a3503e00b21babff9e15aa2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 21:28:53 +0000 +Subject: tcp: annotate data-races around tp->linger2 + +From: Eric Dumazet + +[ Upstream commit 9df5335ca974e688389c875546e5819778a80d59 ] + +do_tcp_getsockopt() reads tp->linger2 while another cpu +might change its value. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20230719212857.3943972-8-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 4077b456e3838..58f202fd6f269 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -3590,11 +3590,11 @@ static int do_tcp_setsockopt(struct sock *sk, int level, int optname, + + case TCP_LINGER2: + if (val < 0) +- tp->linger2 = -1; ++ WRITE_ONCE(tp->linger2, -1); + else if (val > TCP_FIN_TIMEOUT_MAX / HZ) +- tp->linger2 = TCP_FIN_TIMEOUT_MAX; ++ WRITE_ONCE(tp->linger2, TCP_FIN_TIMEOUT_MAX); + else +- tp->linger2 = val * HZ; ++ WRITE_ONCE(tp->linger2, val * HZ); + break; + + case TCP_DEFER_ACCEPT: +@@ -3995,7 +3995,7 @@ static int do_tcp_getsockopt(struct sock *sk, int level, + READ_ONCE(net->ipv4.sysctl_tcp_syn_retries); + break; + case TCP_LINGER2: +- val = tp->linger2; ++ val = READ_ONCE(tp->linger2); + if (val >= 0) + val = (val ? : READ_ONCE(net->ipv4.sysctl_tcp_fin_timeout)) / HZ; + break; +-- +2.39.2 + diff --git a/queue-5.15/tcp-annotate-data-races-around-tp-notsent_lowat.patch b/queue-5.15/tcp-annotate-data-races-around-tp-notsent_lowat.patch new file mode 100644 index 00000000000..1fe1cdc1475 --- /dev/null +++ b/queue-5.15/tcp-annotate-data-races-around-tp-notsent_lowat.patch @@ -0,0 +1,64 @@ +From a99b9155cd25e74550057ab7c9289b551a9ddf6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 21:28:55 +0000 +Subject: tcp: annotate data-races around tp->notsent_lowat + +From: Eric Dumazet + +[ Upstream commit 1aeb87bc1440c5447a7fa2d6e3c2cca52cbd206b ] + +tp->notsent_lowat can be read locklessly from do_tcp_getsockopt() +and tcp_poll(). + +Fixes: c9bee3b7fdec ("tcp: TCP_NOTSENT_LOWAT socket option") +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20230719212857.3943972-10-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/tcp.h | 6 +++++- + net/ipv4/tcp.c | 4 ++-- + 2 files changed, 7 insertions(+), 3 deletions(-) + +diff --git a/include/net/tcp.h b/include/net/tcp.h +index fe58b089f0b16..d8920f84f0a8d 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -2012,7 +2012,11 @@ void __tcp_v4_send_check(struct sk_buff *skb, __be32 saddr, __be32 daddr); + static inline u32 tcp_notsent_lowat(const struct tcp_sock *tp) + { + struct net *net = sock_net((struct sock *)tp); +- return tp->notsent_lowat ?: READ_ONCE(net->ipv4.sysctl_tcp_notsent_lowat); ++ u32 val; ++ ++ val = READ_ONCE(tp->notsent_lowat); ++ ++ return val ?: READ_ONCE(net->ipv4.sysctl_tcp_notsent_lowat); + } + + bool tcp_stream_memory_free(const struct sock *sk, int wake); +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 29661f7e372d9..95e3e32d211a7 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -3669,7 +3669,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level, int optname, + err = tcp_repair_set_window(tp, optval, optlen); + break; + case TCP_NOTSENT_LOWAT: +- tp->notsent_lowat = val; ++ WRITE_ONCE(tp->notsent_lowat, val); + sk->sk_write_space(sk); + break; + case TCP_INQ: +@@ -4161,7 +4161,7 @@ static int do_tcp_getsockopt(struct sock *sk, int level, + val = tcp_time_stamp_raw() + tp->tsoffset; + break; + case TCP_NOTSENT_LOWAT: +- val = tp->notsent_lowat; ++ val = READ_ONCE(tp->notsent_lowat); + break; + case TCP_INQ: + val = tp->recvmsg_inq; +-- +2.39.2 + diff --git a/queue-5.15/tcp-annotate-data-races-around-tp-tcp_tx_delay.patch b/queue-5.15/tcp-annotate-data-races-around-tp-tcp_tx_delay.patch new file mode 100644 index 00000000000..de65384496e --- /dev/null +++ b/queue-5.15/tcp-annotate-data-races-around-tp-tcp_tx_delay.patch @@ -0,0 +1,46 @@ +From 2baf574dc716b3442b179f7f42d1697046266fae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 21:28:47 +0000 +Subject: tcp: annotate data-races around tp->tcp_tx_delay + +From: Eric Dumazet + +[ Upstream commit 348b81b68b13ebd489a3e6a46aa1c384c731c919 ] + +do_tcp_getsockopt() reads tp->tcp_tx_delay while another cpu +might change its value. + +Fixes: a842fe1425cb ("tcp: add optional per socket transmit delay") +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20230719212857.3943972-2-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index fc0fa1f2ca9b1..8ff86431f44b4 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -3679,7 +3679,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level, int optname, + case TCP_TX_DELAY: + if (val) + tcp_enable_tx_delay(); +- tp->tcp_tx_delay = val; ++ WRITE_ONCE(tp->tcp_tx_delay, val); + break; + default: + err = -ENOPROTOOPT; +@@ -4151,7 +4151,7 @@ static int do_tcp_getsockopt(struct sock *sk, int level, + break; + + case TCP_TX_DELAY: +- val = tp->tcp_tx_delay; ++ val = READ_ONCE(tp->tcp_tx_delay); + break; + + case TCP_TIMESTAMP: +-- +2.39.2 + diff --git a/queue-5.15/udf-fix-uninitialized-array-access-for-some-pathname.patch b/queue-5.15/udf-fix-uninitialized-array-access-for-some-pathname.patch new file mode 100644 index 00000000000..79313272372 --- /dev/null +++ b/queue-5.15/udf-fix-uninitialized-array-access-for-some-pathname.patch @@ -0,0 +1,41 @@ +From 9da03b3b3c1b0c6a5cbb8a71990085e53fd1d7d9 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Wed, 21 Jun 2023 11:32:35 +0200 +Subject: [PATCH AUTOSEL 4.14 5/9] udf: Fix uninitialized array access for some + pathnames +X-stable: review +X-Patchwork-Hint: Ignore +X-stable-base: Linux 4.14.320 + +[ Upstream commit 028f6055c912588e6f72722d89c30b401bbcf013 ] + +For filenames that begin with . and are between 2 and 5 characters long, +UDF charset conversion code would read uninitialized memory in the +output buffer. The only practical impact is that the name may be prepended a +"unification hash" when it is not actually needed but still it is good +to fix this. + +Reported-by: syzbot+cd311b1e43cc25f90d18@syzkaller.appspotmail.com +Link: https://lore.kernel.org/all/000000000000e2638a05fe9dc8f9@google.com +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/udf/unicode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c +index 61a1738895b7a..ad04dc2278339 100644 +--- a/fs/udf/unicode.c ++++ b/fs/udf/unicode.c +@@ -268,7 +268,7 @@ static int udf_name_from_CS0(uint8_t *str_o, int str_max_len, + } + + if (translate) { +- if (str_o_len <= 2 && str_o[0] == '.' && ++ if (str_o_len > 0 && str_o_len <= 2 && str_o[0] == '.' && + (str_o_len == 1 || str_o[1] == '.')) + needsCRC = 1; + if (needsCRC) { +-- +2.39.2 + -- 2.47.3