From bb0dea5ca6a2ca94f24b335fc587978988fc94db Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sat, 28 Dec 2019 05:59:43 -0500 Subject: [PATCH] 5.4-stable patches added patches: af_packet-set-defaule-value-for-tmo.patch bonding-fix-bond_neigh_init.patch dpaa2-ptp-fix-double-free-of-the-ptp_qoriq-irq.patch fjes-fix-missed-check-in-fjes_acpi_add.patch mlxsw-spectrum_router-remove-unlikely-user-triggerable-warning.patch mod_devicetable-fix-phy-module-format.patch neighbour-remove-neigh_cleanup-method.patch net-dsa-b53-fix-egress-flooding-settings.patch net-dst-force-4-byte-alignment-of-dst_metrics.patch net-ena-fix-default-tx-interrupt-moderation-interval.patch net-ena-fix-issues-in-setting-interrupt-moderation-params-in-ethtool.patch net-ethernet-ti-davinci_cpdma-fix-warning-device-driver-frees-dma-memory-with-different-size.patch net-gemini-fix-memory-leak-in-gmac_setup_txqs.patch net-hisilicon-fix-a-bug-trigered-by-wrong-bytes_compl.patch net-nfc-nci-fix-a-possible-sleep-in-atomic-context-bug-in-nci_uart_tty_receive.patch net-phy-ensure-that-phy-ids-are-correctly-typed.patch net-qlogic-fix-error-paths-in-ql_alloc_large_buffers.patch net-stmmac-platform-fix-mdio-init-for-platforms-without-phy.patch net-sysfs-call-dev_hold-always-in-rx_queue_add_kobject.patch net-usb-lan78xx-fix-suspend-resume-phy-register-access-error.patch nfc-nxp-nci-fix-probing-without-acpi.patch nfp-flower-fix-stats-id-allocation.patch qede-disable-hardware-gro-when-xdp-prog-is-installed.patch qede-fix-multicast-mac-configuration.patch sctp-fix-memleak-on-err-handling-of-stream-initialization.patch sctp-fully-initialize-v4-addr-in-some-functions.patch selftests-forwarding-delete-ipv6-address-at-the-end.patch --- .../af_packet-set-defaule-value-for-tmo.patch | 54 ++++++ queue-5.4/bonding-fix-bond_neigh_init.patch | 171 ++++++++++++++++++ ...fix-double-free-of-the-ptp_qoriq-irq.patch | 88 +++++++++ ...es-fix-missed-check-in-fjes_acpi_add.patch | 32 ++++ ...ve-unlikely-user-triggerable-warning.patch | 42 +++++ ...od_devicetable-fix-phy-module-format.patch | 43 +++++ ...eighbour-remove-neigh_cleanup-method.patch | 69 +++++++ ...dsa-b53-fix-egress-flooding-settings.patch | 89 +++++++++ ...orce-4-byte-alignment-of-dst_metrics.patch | 60 ++++++ ...ult-tx-interrupt-moderation-interval.patch | 40 ++++ ...terrupt-moderation-params-in-ethtool.patch | 114 ++++++++++++ ...frees-dma-memory-with-different-size.patch | 84 +++++++++ ...i-fix-memory-leak-in-gmac_setup_txqs.patch | 33 ++++ ...-a-bug-trigered-by-wrong-bytes_compl.patch | 90 +++++++++ ...-context-bug-in-nci_uart_tty_receive.patch | 45 +++++ ...ure-that-phy-ids-are-correctly-typed.patch | 64 +++++++ ...rror-paths-in-ql_alloc_large_buffers.patch | 76 ++++++++ ...-mdio-init-for-platforms-without-phy.patch | 34 ++++ ..._hold-always-in-rx_queue_add_kobject.patch | 47 +++++ ...end-resume-phy-register-access-error.patch | 34 ++++ ...nfc-nxp-nci-fix-probing-without-acpi.patch | 38 ++++ .../nfp-flower-fix-stats-id-allocation.patch | 58 ++++++ ...dware-gro-when-xdp-prog-is-installed.patch | 51 ++++++ ...qede-fix-multicast-mac-configuration.patch | 33 ++++ ...rr-handling-of-stream-initialization.patch | 55 ++++++ ...initialize-v4-addr-in-some-functions.patch | 107 +++++++++++ ...rding-delete-ipv6-address-at-the-end.patch | 44 +++++ queue-5.4/series | 27 +++ 28 files changed, 1722 insertions(+) create mode 100644 queue-5.4/af_packet-set-defaule-value-for-tmo.patch create mode 100644 queue-5.4/bonding-fix-bond_neigh_init.patch create mode 100644 queue-5.4/dpaa2-ptp-fix-double-free-of-the-ptp_qoriq-irq.patch create mode 100644 queue-5.4/fjes-fix-missed-check-in-fjes_acpi_add.patch create mode 100644 queue-5.4/mlxsw-spectrum_router-remove-unlikely-user-triggerable-warning.patch create mode 100644 queue-5.4/mod_devicetable-fix-phy-module-format.patch create mode 100644 queue-5.4/neighbour-remove-neigh_cleanup-method.patch create mode 100644 queue-5.4/net-dsa-b53-fix-egress-flooding-settings.patch create mode 100644 queue-5.4/net-dst-force-4-byte-alignment-of-dst_metrics.patch create mode 100644 queue-5.4/net-ena-fix-default-tx-interrupt-moderation-interval.patch create mode 100644 queue-5.4/net-ena-fix-issues-in-setting-interrupt-moderation-params-in-ethtool.patch create mode 100644 queue-5.4/net-ethernet-ti-davinci_cpdma-fix-warning-device-driver-frees-dma-memory-with-different-size.patch create mode 100644 queue-5.4/net-gemini-fix-memory-leak-in-gmac_setup_txqs.patch create mode 100644 queue-5.4/net-hisilicon-fix-a-bug-trigered-by-wrong-bytes_compl.patch create mode 100644 queue-5.4/net-nfc-nci-fix-a-possible-sleep-in-atomic-context-bug-in-nci_uart_tty_receive.patch create mode 100644 queue-5.4/net-phy-ensure-that-phy-ids-are-correctly-typed.patch create mode 100644 queue-5.4/net-qlogic-fix-error-paths-in-ql_alloc_large_buffers.patch create mode 100644 queue-5.4/net-stmmac-platform-fix-mdio-init-for-platforms-without-phy.patch create mode 100644 queue-5.4/net-sysfs-call-dev_hold-always-in-rx_queue_add_kobject.patch create mode 100644 queue-5.4/net-usb-lan78xx-fix-suspend-resume-phy-register-access-error.patch create mode 100644 queue-5.4/nfc-nxp-nci-fix-probing-without-acpi.patch create mode 100644 queue-5.4/nfp-flower-fix-stats-id-allocation.patch create mode 100644 queue-5.4/qede-disable-hardware-gro-when-xdp-prog-is-installed.patch create mode 100644 queue-5.4/qede-fix-multicast-mac-configuration.patch create mode 100644 queue-5.4/sctp-fix-memleak-on-err-handling-of-stream-initialization.patch create mode 100644 queue-5.4/sctp-fully-initialize-v4-addr-in-some-functions.patch create mode 100644 queue-5.4/selftests-forwarding-delete-ipv6-address-at-the-end.patch diff --git a/queue-5.4/af_packet-set-defaule-value-for-tmo.patch b/queue-5.4/af_packet-set-defaule-value-for-tmo.patch new file mode 100644 index 00000000000..cbc7772311d --- /dev/null +++ b/queue-5.4/af_packet-set-defaule-value-for-tmo.patch @@ -0,0 +1,54 @@ +From foo@baz Sat 28 Dec 2019 05:57:33 AM EST +From: Mao Wenan +Date: Mon, 9 Dec 2019 21:31:25 +0800 +Subject: af_packet: set defaule value for tmo + +From: Mao Wenan + +[ Upstream commit b43d1f9f7067c6759b1051e8ecb84e82cef569fe ] + +There is softlockup when using TPACKET_V3: +... +NMI watchdog: BUG: soft lockup - CPU#2 stuck for 60010ms! +(__irq_svc) from [] (_raw_spin_unlock_irqrestore+0x44/0x54) +(_raw_spin_unlock_irqrestore) from [] (mod_timer+0x210/0x25c) +(mod_timer) from [] +(prb_retire_rx_blk_timer_expired+0x68/0x11c) +(prb_retire_rx_blk_timer_expired) from [] +(call_timer_fn+0x90/0x17c) +(call_timer_fn) from [] (run_timer_softirq+0x2d4/0x2fc) +(run_timer_softirq) from [] (__do_softirq+0x218/0x318) +(__do_softirq) from [] (irq_exit+0x88/0xac) +(irq_exit) from [] (msa_irq_exit+0x11c/0x1d4) +(msa_irq_exit) from [] (handle_IPI+0x650/0x7f4) +(handle_IPI) from [] (gic_handle_irq+0x108/0x118) +(gic_handle_irq) from [] (__irq_usr+0x44/0x5c) +... + +If __ethtool_get_link_ksettings() is failed in +prb_calc_retire_blk_tmo(), msec and tmo will be zero, so tov_in_jiffies +is zero and the timer expire for retire_blk_timer is turn to +mod_timer(&pkc->retire_blk_timer, jiffies + 0), +which will trigger cpu usage of softirq is 100%. + +Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.") +Tested-by: Xiao Jiangfeng +Signed-off-by: Mao Wenan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/packet/af_packet.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -544,7 +544,8 @@ static int prb_calc_retire_blk_tmo(struc + msec = 1; + div = ecmd.base.speed / 1000; + } +- } ++ } else ++ return DEFAULT_PRB_RETIRE_TOV; + + mbits = (blk_size_in_bytes * 8) / (1024 * 1024); + diff --git a/queue-5.4/bonding-fix-bond_neigh_init.patch b/queue-5.4/bonding-fix-bond_neigh_init.patch new file mode 100644 index 00000000000..9c89aa5a215 --- /dev/null +++ b/queue-5.4/bonding-fix-bond_neigh_init.patch @@ -0,0 +1,171 @@ +From foo@baz Sat 28 Dec 2019 05:57:33 AM EST +From: Eric Dumazet +Date: Sat, 7 Dec 2019 14:10:34 -0800 +Subject: bonding: fix bond_neigh_init() + +From: Eric Dumazet + +[ Upstream commit 9e99bfefdbce2e23ef37487a3bcb4adf90a791d1 ] + +1) syzbot reported an uninit-value in bond_neigh_setup() [1] + + bond_neigh_setup() uses a temporary on-stack 'struct neigh_parms parms', + but only clears parms.neigh_setup field. + + A stacked bonding device would then enter bond_neigh_setup() + and read garbage from parms->dev. + + If we get really unlucky and garbage is matching @dev, then we + could recurse and eventually crash. + + Let's make sure the whole structure is cleared to avoid surprises. + +2) bond_neigh_setup() can be called while another cpu manipulates + the master device, removing or adding a slave. + We need at least rcu protection to prevent use-after-free. + +Note: Prior code does not support a stack of bonding devices, + this patch does not attempt to fix this, and leave a comment instead. + +[1] + +BUG: KMSAN: uninit-value in bond_neigh_setup+0xa4/0x110 drivers/net/bonding/bond_main.c:3655 +CPU: 0 PID: 11256 Comm: syz-executor.0 Not tainted 5.4.0-rc8-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +Call Trace: + + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0x1c9/0x220 lib/dump_stack.c:118 + kmsan_report+0x128/0x220 mm/kmsan/kmsan_report.c:108 + __msan_warning+0x57/0xa0 mm/kmsan/kmsan_instr.c:245 + bond_neigh_setup+0xa4/0x110 drivers/net/bonding/bond_main.c:3655 + bond_neigh_init+0x216/0x4b0 drivers/net/bonding/bond_main.c:3626 + ___neigh_create+0x169e/0x2c40 net/core/neighbour.c:613 + __neigh_create+0xbd/0xd0 net/core/neighbour.c:674 + ip6_finish_output2+0x149a/0x2670 net/ipv6/ip6_output.c:113 + __ip6_finish_output+0x83d/0x8f0 net/ipv6/ip6_output.c:142 + ip6_finish_output+0x2db/0x420 net/ipv6/ip6_output.c:152 + NF_HOOK_COND include/linux/netfilter.h:294 [inline] + ip6_output+0x5d3/0x720 net/ipv6/ip6_output.c:175 + dst_output include/net/dst.h:436 [inline] + NF_HOOK include/linux/netfilter.h:305 [inline] + mld_sendpack+0xebd/0x13d0 net/ipv6/mcast.c:1682 + mld_send_cr net/ipv6/mcast.c:1978 [inline] + mld_ifc_timer_expire+0x116b/0x1680 net/ipv6/mcast.c:2477 + call_timer_fn+0x232/0x530 kernel/time/timer.c:1404 + expire_timers kernel/time/timer.c:1449 [inline] + __run_timers+0xd60/0x1270 kernel/time/timer.c:1773 + run_timer_softirq+0x2d/0x50 kernel/time/timer.c:1786 + __do_softirq+0x4a1/0x83a kernel/softirq.c:293 + invoke_softirq kernel/softirq.c:375 [inline] + irq_exit+0x230/0x280 kernel/softirq.c:416 + exiting_irq+0xe/0x10 arch/x86/include/asm/apic.h:536 + smp_apic_timer_interrupt+0x48/0x70 arch/x86/kernel/apic/apic.c:1138 + apic_timer_interrupt+0x2e/0x40 arch/x86/entry/entry_64.S:835 + +RIP: 0010:kmsan_free_page+0x18d/0x1c0 mm/kmsan/kmsan_shadow.c:439 +Code: 4c 89 ff 44 89 f6 e8 82 0d ee ff 65 ff 0d 9f 26 3b 60 65 8b 05 98 26 3b 60 85 c0 75 24 e8 5b f6 35 ff 4c 89 6d d0 ff 75 d0 9d <48> 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 0b 0f 0b 0f 0b 0f +RSP: 0018:ffffb328034af818 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 +RAX: 0000000000000000 RBX: ffffe2d7471f8360 RCX: 0000000000000000 +RDX: ffffffffadea7000 RSI: 0000000000000004 RDI: ffff93496fcda104 +RBP: ffffb328034af850 R08: ffff934a47e86d00 R09: ffff93496fc41900 +R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 +R13: 0000000000000246 R14: 0000000000000000 R15: ffffe2d7472225c0 + free_pages_prepare mm/page_alloc.c:1138 [inline] + free_pcp_prepare mm/page_alloc.c:1230 [inline] + free_unref_page_prepare+0x1d9/0x770 mm/page_alloc.c:3025 + free_unref_page mm/page_alloc.c:3074 [inline] + free_the_page mm/page_alloc.c:4832 [inline] + __free_pages+0x154/0x230 mm/page_alloc.c:4840 + __vunmap+0xdac/0xf20 mm/vmalloc.c:2277 + __vfree mm/vmalloc.c:2325 [inline] + vfree+0x7c/0x170 mm/vmalloc.c:2355 + copy_entries_to_user net/ipv6/netfilter/ip6_tables.c:883 [inline] + get_entries net/ipv6/netfilter/ip6_tables.c:1041 [inline] + do_ip6t_get_ctl+0xfa4/0x1030 net/ipv6/netfilter/ip6_tables.c:1709 + nf_sockopt net/netfilter/nf_sockopt.c:104 [inline] + nf_getsockopt+0x481/0x4e0 net/netfilter/nf_sockopt.c:122 + ipv6_getsockopt+0x264/0x510 net/ipv6/ipv6_sockglue.c:1400 + tcp_getsockopt+0x1c6/0x1f0 net/ipv4/tcp.c:3688 + sock_common_getsockopt+0x13f/0x180 net/core/sock.c:3110 + __sys_getsockopt+0x533/0x7b0 net/socket.c:2129 + __do_sys_getsockopt net/socket.c:2144 [inline] + __se_sys_getsockopt+0xe1/0x100 net/socket.c:2141 + __x64_sys_getsockopt+0x62/0x80 net/socket.c:2141 + do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:291 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 +RIP: 0033:0x45d20a +Code: b8 34 01 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 8d 8b fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 37 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 6a 8b fb ff c3 66 0f 1f 84 00 00 00 00 00 +RSP: 002b:0000000000a6f618 EFLAGS: 00000212 ORIG_RAX: 0000000000000037 +RAX: ffffffffffffffda RBX: 0000000000a6f640 RCX: 000000000045d20a +RDX: 0000000000000041 RSI: 0000000000000029 RDI: 0000000000000003 +RBP: 0000000000717cc0 R08: 0000000000a6f63c R09: 0000000000004000 +R10: 0000000000a6f740 R11: 0000000000000212 R12: 0000000000000003 +R13: 0000000000000000 R14: 0000000000000029 R15: 0000000000715b00 + +Local variable description: ----parms@bond_neigh_init +Variable was created at: + bond_neigh_init+0x8c/0x4b0 drivers/net/bonding/bond_main.c:3617 + bond_neigh_init+0x8c/0x4b0 drivers/net/bonding/bond_main.c:3617 + +Fixes: 9918d5bf329d ("bonding: modify only neigh_parms owned by us") +Fixes: 234bcf8a499e ("net/bonding: correctly proxy slave neigh param setup ndo function") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Cc: Jay Vosburgh +Cc: Veaceslav Falico +Cc: Andy Gospodarek +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/bonding/bond_main.c | 31 +++++++++++++++++++++---------- + 1 file changed, 21 insertions(+), 10 deletions(-) + +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -3612,24 +3612,35 @@ static int bond_neigh_init(struct neighb + const struct net_device_ops *slave_ops; + struct neigh_parms parms; + struct slave *slave; +- int ret; ++ int ret = 0; + +- slave = bond_first_slave(bond); ++ rcu_read_lock(); ++ slave = bond_first_slave_rcu(bond); + if (!slave) +- return 0; ++ goto out; + slave_ops = slave->dev->netdev_ops; + if (!slave_ops->ndo_neigh_setup) +- return 0; ++ goto out; + +- parms.neigh_setup = NULL; ++ /* TODO: find another way [1] to implement this. ++ * Passing a zeroed structure is fragile, ++ * but at least we do not pass garbage. ++ * ++ * [1] One way would be that ndo_neigh_setup() never touch ++ * struct neigh_parms, but propagate the new neigh_setup() ++ * back to ___neigh_create() / neigh_parms_alloc() ++ */ ++ memset(&parms, 0, sizeof(parms)); + ret = slave_ops->ndo_neigh_setup(slave->dev, &parms); +- if (ret) +- return ret; + +- if (!parms.neigh_setup) +- return 0; ++ if (ret) ++ goto out; + +- return parms.neigh_setup(n); ++ if (parms.neigh_setup) ++ ret = parms.neigh_setup(n); ++out: ++ rcu_read_unlock(); ++ return ret; + } + + /* The bonding ndo_neigh_setup is called at init time beofre any diff --git a/queue-5.4/dpaa2-ptp-fix-double-free-of-the-ptp_qoriq-irq.patch b/queue-5.4/dpaa2-ptp-fix-double-free-of-the-ptp_qoriq-irq.patch new file mode 100644 index 00000000000..0a34a51fb57 --- /dev/null +++ b/queue-5.4/dpaa2-ptp-fix-double-free-of-the-ptp_qoriq-irq.patch @@ -0,0 +1,88 @@ +From foo@baz Sat 28 Dec 2019 05:57:33 AM EST +From: Ioana Ciornei +Date: Mon, 16 Dec 2019 17:32:30 +0200 +Subject: dpaa2-ptp: fix double free of the ptp_qoriq IRQ + +From: Ioana Ciornei + +[ Upstream commit daa6eb5a149519583c8a8cb31945f06417d21902 ] + +Upon reusing the ptp_qoriq driver, the ptp_qoriq_free() function was +used on the remove path to free any allocated resources. +The ptp_qoriq IRQ is among these resources that are freed in +ptp_qoriq_free() even though it is also a managed one (allocated using +devm_request_threaded_irq). + +Drop the resource managed version of requesting the IRQ in order to not +trigger a double free of the interrupt as below: + +[ 226.731005] Trying to free already-free IRQ 126 +[ 226.735533] WARNING: CPU: 6 PID: 749 at kernel/irq/manage.c:1707 +__free_irq+0x9c/0x2b8 +[ 226.743435] Modules linked in: +[ 226.746480] CPU: 6 PID: 749 Comm: bash Tainted: G W +5.4.0-03629-gfd7102c32b2c-dirty #912 +[ 226.755857] Hardware name: NXP Layerscape LX2160ARDB (DT) +[ 226.761244] pstate: 40000085 (nZcv daIf -PAN -UAO) +[ 226.766022] pc : __free_irq+0x9c/0x2b8 +[ 226.769758] lr : __free_irq+0x9c/0x2b8 +[ 226.773493] sp : ffff8000125039f0 +(...) +[ 226.856275] Call trace: +[ 226.858710] __free_irq+0x9c/0x2b8 +[ 226.862098] free_irq+0x30/0x70 +[ 226.865229] devm_irq_release+0x14/0x20 +[ 226.869054] release_nodes+0x1b0/0x220 +[ 226.872790] devres_release_all+0x34/0x50 +[ 226.876790] device_release_driver_internal+0x100/0x1c0 + +Fixes: d346c9e86d86 ("dpaa2-ptp: reuse ptp_qoriq driver") +Cc: Yangbo Lu +Signed-off-by: Ioana Ciornei +Reviewed-by: Yangbo Lu +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c +@@ -160,10 +160,10 @@ static int dpaa2_ptp_probe(struct fsl_mc + irq = mc_dev->irqs[0]; + ptp_qoriq->irq = irq->msi_desc->irq; + +- err = devm_request_threaded_irq(dev, ptp_qoriq->irq, NULL, +- dpaa2_ptp_irq_handler_thread, +- IRQF_NO_SUSPEND | IRQF_ONESHOT, +- dev_name(dev), ptp_qoriq); ++ err = request_threaded_irq(ptp_qoriq->irq, NULL, ++ dpaa2_ptp_irq_handler_thread, ++ IRQF_NO_SUSPEND | IRQF_ONESHOT, ++ dev_name(dev), ptp_qoriq); + if (err < 0) { + dev_err(dev, "devm_request_threaded_irq(): %d\n", err); + goto err_free_mc_irq; +@@ -173,18 +173,20 @@ static int dpaa2_ptp_probe(struct fsl_mc + DPRTC_IRQ_INDEX, 1); + if (err < 0) { + dev_err(dev, "dprtc_set_irq_enable(): %d\n", err); +- goto err_free_mc_irq; ++ goto err_free_threaded_irq; + } + + err = ptp_qoriq_init(ptp_qoriq, base, &dpaa2_ptp_caps); + if (err) +- goto err_free_mc_irq; ++ goto err_free_threaded_irq; + + dpaa2_phc_index = ptp_qoriq->phc_index; + dev_set_drvdata(dev, ptp_qoriq); + + return 0; + ++err_free_threaded_irq: ++ free_irq(ptp_qoriq->irq, ptp_qoriq); + err_free_mc_irq: + fsl_mc_free_irqs(mc_dev); + err_unmap: diff --git a/queue-5.4/fjes-fix-missed-check-in-fjes_acpi_add.patch b/queue-5.4/fjes-fix-missed-check-in-fjes_acpi_add.patch new file mode 100644 index 00000000000..6c8930356fa --- /dev/null +++ b/queue-5.4/fjes-fix-missed-check-in-fjes_acpi_add.patch @@ -0,0 +1,32 @@ +From foo@baz Sat 28 Dec 2019 05:57:33 AM EST +From: Chuhong Yuan +Date: Tue, 10 Dec 2019 00:22:07 +0800 +Subject: fjes: fix missed check in fjes_acpi_add + +From: Chuhong Yuan + +[ Upstream commit a288f105a03a7e0e629a8da2b31f34ebf0343ee2 ] + +fjes_acpi_add() misses a check for platform_device_register_simple(). +Add a check to fix it. + +Fixes: 658d439b2292 ("fjes: Introduce FUJITSU Extended Socket Network Device driver") +Signed-off-by: Chuhong Yuan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/fjes/fjes_main.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/fjes/fjes_main.c ++++ b/drivers/net/fjes/fjes_main.c +@@ -166,6 +166,9 @@ static int fjes_acpi_add(struct acpi_dev + /* create platform_device */ + plat_dev = platform_device_register_simple(DRV_NAME, 0, fjes_resource, + ARRAY_SIZE(fjes_resource)); ++ if (IS_ERR(plat_dev)) ++ return PTR_ERR(plat_dev); ++ + device->driver_data = plat_dev; + + return 0; diff --git a/queue-5.4/mlxsw-spectrum_router-remove-unlikely-user-triggerable-warning.patch b/queue-5.4/mlxsw-spectrum_router-remove-unlikely-user-triggerable-warning.patch new file mode 100644 index 00000000000..a03b1161e3f --- /dev/null +++ b/queue-5.4/mlxsw-spectrum_router-remove-unlikely-user-triggerable-warning.patch @@ -0,0 +1,42 @@ +From foo@baz Sat 28 Dec 2019 05:57:33 AM EST +From: Ido Schimmel +Date: Mon, 9 Dec 2019 08:55:20 +0200 +Subject: mlxsw: spectrum_router: Remove unlikely user-triggerable warning + +From: Ido Schimmel + +[ Upstream commit 62201c00c4679ad8f0730d6d925a5d23651dfad2 ] + +In case the driver vetoes the addition of an IPv6 multipath route, the +IPv6 stack will emit delete notifications for the sibling routes that +were already added to the FIB trie. Since these siblings are not present +in hardware, a warning will be generated. + +Have the driver ignore notifications for routes it does not have. + +Fixes: ebee3cad835f ("ipv6: Add IPv6 multipath notifications for add / replace") +Signed-off-by: Ido Schimmel +Acked-by: Jiri Pirko +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +@@ -5637,8 +5637,13 @@ static void mlxsw_sp_router_fib6_del(str + if (mlxsw_sp_fib6_rt_should_ignore(rt)) + return; + ++ /* Multipath routes are first added to the FIB trie and only then ++ * notified. If we vetoed the addition, we will get a delete ++ * notification for a route we do not have. Therefore, do not warn if ++ * route was not found. ++ */ + fib6_entry = mlxsw_sp_fib6_entry_lookup(mlxsw_sp, rt); +- if (WARN_ON(!fib6_entry)) ++ if (!fib6_entry) + return; + + /* If not all the nexthops are deleted, then only reduce the nexthop diff --git a/queue-5.4/mod_devicetable-fix-phy-module-format.patch b/queue-5.4/mod_devicetable-fix-phy-module-format.patch new file mode 100644 index 00000000000..484c597d79a --- /dev/null +++ b/queue-5.4/mod_devicetable-fix-phy-module-format.patch @@ -0,0 +1,43 @@ +From foo@baz Sat 28 Dec 2019 05:57:33 AM EST +From: Russell King +Date: Thu, 19 Dec 2019 23:24:47 +0000 +Subject: mod_devicetable: fix PHY module format + +From: Russell King + +[ Upstream commit d2ed49cf6c13e379c5819aa5ac20e1f9674ebc89 ] + +When a PHY is probed, if the top bit is set, we end up requesting a +module with the string "mdio:-10101110000000100101000101010001" - +the top bit is printed to a signed -1 value. This leads to the module +not being loaded. + +Fix the module format string and the macro generating the values for +it to ensure that we only print unsigned types and the top bit is +always 0/1. We correctly end up with +"mdio:10101110000000100101000101010001". + +Fixes: 8626d3b43280 ("phylib: Support phy module autoloading") +Reviewed-by: Andrew Lunn +Signed-off-by: Russell King +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/mod_devicetable.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/include/linux/mod_devicetable.h ++++ b/include/linux/mod_devicetable.h +@@ -587,9 +587,9 @@ struct platform_device_id { + #define MDIO_NAME_SIZE 32 + #define MDIO_MODULE_PREFIX "mdio:" + +-#define MDIO_ID_FMT "%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d" ++#define MDIO_ID_FMT "%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u" + #define MDIO_ID_ARGS(_id) \ +- (_id)>>31, ((_id)>>30) & 1, ((_id)>>29) & 1, ((_id)>>28) & 1, \ ++ ((_id)>>31) & 1, ((_id)>>30) & 1, ((_id)>>29) & 1, ((_id)>>28) & 1, \ + ((_id)>>27) & 1, ((_id)>>26) & 1, ((_id)>>25) & 1, ((_id)>>24) & 1, \ + ((_id)>>23) & 1, ((_id)>>22) & 1, ((_id)>>21) & 1, ((_id)>>20) & 1, \ + ((_id)>>19) & 1, ((_id)>>18) & 1, ((_id)>>17) & 1, ((_id)>>16) & 1, \ diff --git a/queue-5.4/neighbour-remove-neigh_cleanup-method.patch b/queue-5.4/neighbour-remove-neigh_cleanup-method.patch new file mode 100644 index 00000000000..21da58f415f --- /dev/null +++ b/queue-5.4/neighbour-remove-neigh_cleanup-method.patch @@ -0,0 +1,69 @@ +From foo@baz Sat 28 Dec 2019 05:57:33 AM EST +From: Eric Dumazet +Date: Sat, 7 Dec 2019 12:23:21 -0800 +Subject: neighbour: remove neigh_cleanup() method + +From: Eric Dumazet + +[ Upstream commit f394722fb0d0f701119368959d7cd0ecbc46363a ] + +neigh_cleanup() has not been used for seven years, and was a wrong design. + +Messing with shared pointer in bond_neigh_init() without proper +memory barriers would at least trigger syzbot complains eventually. + +It is time to remove this stuff. + +Fixes: b63b70d87741 ("IPoIB: Use a private hash table for path lookup in xmit path") +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/bonding/bond_main.c | 8 -------- + include/net/neighbour.h | 1 - + net/core/neighbour.c | 3 --- + 3 files changed, 12 deletions(-) + +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -3622,18 +3622,10 @@ static int bond_neigh_init(struct neighb + return 0; + + parms.neigh_setup = NULL; +- parms.neigh_cleanup = NULL; + ret = slave_ops->ndo_neigh_setup(slave->dev, &parms); + if (ret) + return ret; + +- /* Assign slave's neigh_cleanup to neighbour in case cleanup is called +- * after the last slave has been detached. Assumes that all slaves +- * utilize the same neigh_cleanup (true at this writing as only user +- * is ipoib). +- */ +- n->parms->neigh_cleanup = parms.neigh_cleanup; +- + if (!parms.neigh_setup) + return 0; + +--- a/include/net/neighbour.h ++++ b/include/net/neighbour.h +@@ -72,7 +72,6 @@ struct neigh_parms { + struct net_device *dev; + struct list_head list; + int (*neigh_setup)(struct neighbour *); +- void (*neigh_cleanup)(struct neighbour *); + struct neigh_table *tbl; + + void *sysctl_table; +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -98,9 +98,6 @@ static int neigh_blackhole(struct neighb + + static void neigh_cleanup_and_release(struct neighbour *neigh) + { +- if (neigh->parms->neigh_cleanup) +- neigh->parms->neigh_cleanup(neigh); +- + trace_neigh_cleanup_and_release(neigh, 0); + __neigh_notify(neigh, RTM_DELNEIGH, 0, 0); + call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh); diff --git a/queue-5.4/net-dsa-b53-fix-egress-flooding-settings.patch b/queue-5.4/net-dsa-b53-fix-egress-flooding-settings.patch new file mode 100644 index 00000000000..4c78fa3ed87 --- /dev/null +++ b/queue-5.4/net-dsa-b53-fix-egress-flooding-settings.patch @@ -0,0 +1,89 @@ +From foo@baz Sat 28 Dec 2019 05:57:33 AM EST +From: Florian Fainelli +Date: Fri, 13 Dec 2019 12:00:27 -0800 +Subject: net: dsa: b53: Fix egress flooding settings + +From: Florian Fainelli + +[ Upstream commit 63cc54a6f0736a432b04308a74677ab0ba8a58ee ] + +There were several issues with 53568438e381 ("net: dsa: b53: Add support for port_egress_floods callback") that resulted in breaking connectivity for standalone ports: + +- both user and CPU ports must allow unicast and multicast forwarding by + default otherwise this just flat out breaks connectivity for + standalone DSA ports +- IP multicast is treated similarly as multicast, but has separate + control registers +- the UC, MC and IPMC lookup failure register offsets were wrong, and + instead used bit values that are meaningful for the + B53_IP_MULTICAST_CTRL register + +Fixes: 53568438e381 ("net: dsa: b53: Add support for port_egress_floods callback") +Signed-off-by: Florian Fainelli +Reviewed-by: Vivien Didelot +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/b53/b53_common.c | 21 ++++++++++++++++----- + 1 file changed, 16 insertions(+), 5 deletions(-) + +--- a/drivers/net/dsa/b53/b53_common.c ++++ b/drivers/net/dsa/b53/b53_common.c +@@ -347,7 +347,7 @@ static void b53_set_forwarding(struct b5 + * frames should be flooded or not. + */ + b53_read8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, &mgmt); +- mgmt |= B53_UC_FWD_EN | B53_MC_FWD_EN; ++ mgmt |= B53_UC_FWD_EN | B53_MC_FWD_EN | B53_IPMC_FWD_EN; + b53_write8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, mgmt); + } + +@@ -526,6 +526,8 @@ int b53_enable_port(struct dsa_switch *d + + cpu_port = ds->ports[port].cpu_dp->index; + ++ b53_br_egress_floods(ds, port, true, true); ++ + if (dev->ops->irq_enable) + ret = dev->ops->irq_enable(dev, port); + if (ret) +@@ -641,6 +643,8 @@ static void b53_enable_cpu_port(struct b + b53_write8(dev, B53_CTRL_PAGE, B53_PORT_CTRL(port), port_ctrl); + + b53_brcm_hdr_setup(dev->ds, port); ++ ++ b53_br_egress_floods(dev->ds, port, true, true); + } + + static void b53_enable_mib(struct b53_device *dev) +@@ -1766,19 +1770,26 @@ int b53_br_egress_floods(struct dsa_swit + struct b53_device *dev = ds->priv; + u16 uc, mc; + +- b53_read16(dev, B53_CTRL_PAGE, B53_UC_FWD_EN, &uc); ++ b53_read16(dev, B53_CTRL_PAGE, B53_UC_FLOOD_MASK, &uc); + if (unicast) + uc |= BIT(port); + else + uc &= ~BIT(port); +- b53_write16(dev, B53_CTRL_PAGE, B53_UC_FWD_EN, uc); ++ b53_write16(dev, B53_CTRL_PAGE, B53_UC_FLOOD_MASK, uc); ++ ++ b53_read16(dev, B53_CTRL_PAGE, B53_MC_FLOOD_MASK, &mc); ++ if (multicast) ++ mc |= BIT(port); ++ else ++ mc &= ~BIT(port); ++ b53_write16(dev, B53_CTRL_PAGE, B53_MC_FLOOD_MASK, mc); + +- b53_read16(dev, B53_CTRL_PAGE, B53_MC_FWD_EN, &mc); ++ b53_read16(dev, B53_CTRL_PAGE, B53_IPMC_FLOOD_MASK, &mc); + if (multicast) + mc |= BIT(port); + else + mc &= ~BIT(port); +- b53_write16(dev, B53_CTRL_PAGE, B53_MC_FWD_EN, mc); ++ b53_write16(dev, B53_CTRL_PAGE, B53_IPMC_FLOOD_MASK, mc); + + return 0; + diff --git a/queue-5.4/net-dst-force-4-byte-alignment-of-dst_metrics.patch b/queue-5.4/net-dst-force-4-byte-alignment-of-dst_metrics.patch new file mode 100644 index 00000000000..9b1b40ac1a9 --- /dev/null +++ b/queue-5.4/net-dst-force-4-byte-alignment-of-dst_metrics.patch @@ -0,0 +1,60 @@ +From foo@baz Sat 28 Dec 2019 05:57:33 AM EST +From: Geert Uytterhoeven +Date: Fri, 20 Dec 2019 14:31:40 +0100 +Subject: net: dst: Force 4-byte alignment of dst_metrics + +From: Geert Uytterhoeven + +[ Upstream commit 258a980d1ec23e2c786e9536a7dd260bea74bae6 ] + +When storing a pointer to a dst_metrics structure in dst_entry._metrics, +two flags are added in the least significant bits of the pointer value. +Hence this assumes all pointers to dst_metrics structures have at least +4-byte alignment. + +However, on m68k, the minimum alignment of 32-bit values is 2 bytes, not +4 bytes. Hence in some kernel builds, dst_default_metrics may be only +2-byte aligned, leading to obscure boot warnings like: + + WARNING: CPU: 0 PID: 7 at lib/refcount.c:28 refcount_warn_saturate+0x44/0x9a + refcount_t: underflow; use-after-free. + Modules linked in: + CPU: 0 PID: 7 Comm: ksoftirqd/0 Tainted: G W 5.5.0-rc2-atari-01448-g114a1a1038af891d-dirty #261 + Stack from 10835e6c: + 10835e6c 0038134f 00023fa6 00394b0f 0000001c 00000009 00321560 00023fea + 00394b0f 0000001c 001a70f8 00000009 00000000 10835eb4 00000001 00000000 + 04208040 0000000a 00394b4a 10835ed4 00043aa8 001a70f8 00394b0f 0000001c + 00000009 00394b4a 0026aba8 003215a4 00000003 00000000 0026d5a8 00000001 + 003215a4 003a4361 003238d6 000001f0 00000000 003215a4 10aa3b00 00025e84 + 003ddb00 10834000 002416a8 10aa3b00 00000000 00000080 000aa038 0004854a + Call Trace: [<00023fa6>] __warn+0xb2/0xb4 + [<00023fea>] warn_slowpath_fmt+0x42/0x64 + [<001a70f8>] refcount_warn_saturate+0x44/0x9a + [<00043aa8>] printk+0x0/0x18 + [<001a70f8>] refcount_warn_saturate+0x44/0x9a + [<0026aba8>] refcount_sub_and_test.constprop.73+0x38/0x3e + [<0026d5a8>] ipv4_dst_destroy+0x5e/0x7e + [<00025e84>] __local_bh_enable_ip+0x0/0x8e + [<002416a8>] dst_destroy+0x40/0xae + +Fix this by forcing 4-byte alignment of all dst_metrics structures. + +Fixes: e5fd387ad5b30ca3 ("ipv6: do not overwrite inetpeer metrics prematurely") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/net/dst.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/net/dst.h ++++ b/include/net/dst.h +@@ -82,7 +82,7 @@ struct dst_entry { + struct dst_metrics { + u32 metrics[RTAX_MAX]; + refcount_t refcnt; +-}; ++} __aligned(4); /* Low pointer bits contain DST_METRICS_FLAGS */ + extern const struct dst_metrics dst_default_metrics; + + u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old); diff --git a/queue-5.4/net-ena-fix-default-tx-interrupt-moderation-interval.patch b/queue-5.4/net-ena-fix-default-tx-interrupt-moderation-interval.patch new file mode 100644 index 00000000000..bc75c618d04 --- /dev/null +++ b/queue-5.4/net-ena-fix-default-tx-interrupt-moderation-interval.patch @@ -0,0 +1,40 @@ +From foo@baz Sat 28 Dec 2019 05:57:33 AM EST +From: Arthur Kiyanovski +Date: Thu, 19 Dec 2019 17:40:55 +0200 +Subject: net: ena: fix default tx interrupt moderation interval + +From: Arthur Kiyanovski + +[ Upstream commit 05785adf6e570a068adf0502b61fe2b521d7f0ca ] + +Current default non-adaptive tx interrupt moderation interval is 196 us. +This value is too high and might cause the tx queue to fill up. + +In this commit we set the default non-adaptive tx interrupt moderation +interval to 64 us in order to: +1. Reduce the probability of the queue filling-up (when compared to the + current default value of 196 us). +2. Reduce unnecessary tx interrupt overhead (which happens if we set the + default tx interval to 0). + We determined experimentally that 64 us is an optimal value that + reduces interrupt rate by more than 20% without affecting performance. + +Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") +Signed-off-by: Arthur Kiyanovski +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/amazon/ena/ena_com.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/amazon/ena/ena_com.h ++++ b/drivers/net/ethernet/amazon/ena/ena_com.h +@@ -72,7 +72,7 @@ + /*****************************************************************************/ + /* ENA adaptive interrupt moderation settings */ + +-#define ENA_INTR_INITIAL_TX_INTERVAL_USECS 196 ++#define ENA_INTR_INITIAL_TX_INTERVAL_USECS 64 + #define ENA_INTR_INITIAL_RX_INTERVAL_USECS 0 + #define ENA_DEFAULT_INTR_DELAY_RESOLUTION 1 + diff --git a/queue-5.4/net-ena-fix-issues-in-setting-interrupt-moderation-params-in-ethtool.patch b/queue-5.4/net-ena-fix-issues-in-setting-interrupt-moderation-params-in-ethtool.patch new file mode 100644 index 00000000000..9b9771d2af3 --- /dev/null +++ b/queue-5.4/net-ena-fix-issues-in-setting-interrupt-moderation-params-in-ethtool.patch @@ -0,0 +1,114 @@ +From foo@baz Sat 28 Dec 2019 05:57:33 AM EST +From: Arthur Kiyanovski +Date: Thu, 19 Dec 2019 17:40:56 +0200 +Subject: net: ena: fix issues in setting interrupt moderation params in ethtool + +From: Arthur Kiyanovski + +[ Upstream commit 41c53caa5a61ebc9221b71cc37f4a90549f1121d ] + +Issue 1: +-------- +Reproduction steps: +1. sudo ethtool -C eth0 rx-usecs 128 +2. sudo ethtool -C eth0 adaptive-rx on +3. sudo ethtool -C eth0 adaptive-rx off +4. ethtool -c eth0 + +expected output: rx-usecs 128 +actual output: rx-usecs 0 + +Reason for issue: +In stage 3, ethtool userspace calls first the ena_get_coalesce() handler +to get the current value of all properties, and then the ena_set_coalesce() +handler. When ena_get_coalesce() is called the adaptive interrupt +moderation is still on. There is an if in the code that returns the +rx_coalesce_usecs only if the adaptive interrupt moderation is off. +And since it is still on, rx_coalesce_usecs is not set, meaning it +stays 0. + +Solution to issue: +Remove this if static interrupt moderation intervals have nothing to do +with dynamic ones. + +Issue 2: +-------- +Reproduction steps: +1. sudo ethtool -C eth0 adaptive-rx on +2. sudo ethtool -C eth0 rx-usecs 128 +3. ethtool -c eth0 + +expected output: rx-usecs 128 +actual output: rx-usecs 0 + +Reason for issue: +In stage 2, when ena_set_coalesce() is called, the handler tests if +rx adaptive interrupt moderation is on, and if it is, it returns before +getting to the part in the function that sets the rx non-adaptive +interrupt moderation interval. + +Solution to issue: +Remove the return from the function when rx adaptive interrupt moderation +is on. + +Also cleaned up the fixed code in ena_set_coalesce by grouping together +adaptive interrupt moderation toggling, and using && instead of nested +ifs. + +Fixes: b3db86dc4b82 ("net: ena: reimplement set/get_coalesce()") +Fixes: 0eda847953d8 ("net: ena: fix retrieval of nonadaptive interrupt moderation intervals") +Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") +Signed-off-by: Arthur Kiyanovski +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/amazon/ena/ena_ethtool.c | 24 ++++++++++-------------- + 1 file changed, 10 insertions(+), 14 deletions(-) + +--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c ++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c +@@ -315,10 +315,9 @@ static int ena_get_coalesce(struct net_d + ena_com_get_nonadaptive_moderation_interval_tx(ena_dev) * + ena_dev->intr_delay_resolution; + +- if (!ena_com_get_adaptive_moderation_enabled(ena_dev)) +- coalesce->rx_coalesce_usecs = +- ena_com_get_nonadaptive_moderation_interval_rx(ena_dev) +- * ena_dev->intr_delay_resolution; ++ coalesce->rx_coalesce_usecs = ++ ena_com_get_nonadaptive_moderation_interval_rx(ena_dev) ++ * ena_dev->intr_delay_resolution; + + coalesce->use_adaptive_rx_coalesce = + ena_com_get_adaptive_moderation_enabled(ena_dev); +@@ -367,12 +366,6 @@ static int ena_set_coalesce(struct net_d + + ena_update_tx_rings_intr_moderation(adapter); + +- if (coalesce->use_adaptive_rx_coalesce) { +- if (!ena_com_get_adaptive_moderation_enabled(ena_dev)) +- ena_com_enable_adaptive_moderation(ena_dev); +- return 0; +- } +- + rc = ena_com_update_nonadaptive_moderation_interval_rx(ena_dev, + coalesce->rx_coalesce_usecs); + if (rc) +@@ -380,10 +373,13 @@ static int ena_set_coalesce(struct net_d + + ena_update_rx_rings_intr_moderation(adapter); + +- if (!coalesce->use_adaptive_rx_coalesce) { +- if (ena_com_get_adaptive_moderation_enabled(ena_dev)) +- ena_com_disable_adaptive_moderation(ena_dev); +- } ++ if (coalesce->use_adaptive_rx_coalesce && ++ !ena_com_get_adaptive_moderation_enabled(ena_dev)) ++ ena_com_enable_adaptive_moderation(ena_dev); ++ ++ if (!coalesce->use_adaptive_rx_coalesce && ++ ena_com_get_adaptive_moderation_enabled(ena_dev)) ++ ena_com_disable_adaptive_moderation(ena_dev); + + return 0; + } diff --git a/queue-5.4/net-ethernet-ti-davinci_cpdma-fix-warning-device-driver-frees-dma-memory-with-different-size.patch b/queue-5.4/net-ethernet-ti-davinci_cpdma-fix-warning-device-driver-frees-dma-memory-with-different-size.patch new file mode 100644 index 00000000000..1169c52f65c --- /dev/null +++ b/queue-5.4/net-ethernet-ti-davinci_cpdma-fix-warning-device-driver-frees-dma-memory-with-different-size.patch @@ -0,0 +1,84 @@ +From foo@baz Sat 28 Dec 2019 05:57:33 AM EST +From: Grygorii Strashko +Date: Mon, 9 Dec 2019 13:19:24 +0200 +Subject: net: ethernet: ti: davinci_cpdma: fix warning "device driver frees DMA memory with different size" + +From: Grygorii Strashko + +[ Upstream commit 8a2b22203f8596729c54eba221b4044351bfe167 ] + +The TI CPSW(s) driver produces warning with DMA API debug options enabled: + +WARNING: CPU: 0 PID: 1033 at kernel/dma/debug.c:1025 check_unmap+0x4a8/0x968 +DMA-API: cpsw 48484000.ethernet: device driver frees DMA memory with different size + [device address=0x00000000abc6aa02] [map size=64 bytes] [unmap size=42 bytes] +CPU: 0 PID: 1033 Comm: ping Not tainted 5.3.0-dirty #41 +Hardware name: Generic DRA72X (Flattened Device Tree) +[] (unwind_backtrace) from [] (show_stack+0x10/0x14) +[] (show_stack) from [] (dump_stack+0xd8/0x110) +[] (dump_stack) from [] (__warn+0xe0/0x10c) +[] (__warn) from [] (warn_slowpath_fmt+0x44/0x6c) +[] (warn_slowpath_fmt) from [] (check_unmap+0x4a8/0x968) +[] (check_unmap) from [] (debug_dma_unmap_page+0x80/0x90) +[] (debug_dma_unmap_page) from [] (__cpdma_chan_free+0x114/0x16c) +[] (__cpdma_chan_free) from [] (__cpdma_chan_process+0x158/0x17c) +[] (__cpdma_chan_process) from [] (cpdma_chan_process+0x3c/0x5c) +[] (cpdma_chan_process) from [] (cpsw_tx_mq_poll+0x48/0x94) +[] (cpsw_tx_mq_poll) from [] (net_rx_action+0x108/0x4e4) +[] (net_rx_action) from [] (__do_softirq+0xec/0x598) +[] (__do_softirq) from [] (do_softirq.part.4+0x68/0x74) +[] (do_softirq.part.4) from [] (__local_bh_enable_ip+0x124/0x17c) +[] (__local_bh_enable_ip) from [] (ip_finish_output2+0x294/0xb7c) +[] (ip_finish_output2) from [] (ip_output+0x210/0x364) +[] (ip_output) from [] (ip_send_skb+0x1c/0xf8) +[] (ip_send_skb) from [] (raw_sendmsg+0x9a8/0xc74) +[] (raw_sendmsg) from [] (sock_sendmsg+0x14/0x24) +[] (sock_sendmsg) from [] (__sys_sendto+0xbc/0x100) +[] (__sys_sendto) from [] (__sys_trace_return+0x0/0x14) +Exception stack(0xea9a7fa8 to 0xea9a7ff0) +... + +The reason is that cpdma_chan_submit_si() now stores original buffer length +(sw_len) in CPDMA descriptor instead of adjusted buffer length (hw_len) +used to map the buffer. + +Hence, fix an issue by passing correct buffer length in CPDMA descriptor. + +Cc: Ivan Khoronzhuk +Fixes: 6670acacd59e ("net: ethernet: ti: davinci_cpdma: add dma mapped submit") +Signed-off-by: Grygorii Strashko +Reviewed-by: Ivan Khoronzhuk +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ti/davinci_cpdma.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/ti/davinci_cpdma.c ++++ b/drivers/net/ethernet/ti/davinci_cpdma.c +@@ -1018,7 +1018,6 @@ static int cpdma_chan_submit_si(struct s + struct cpdma_chan *chan = si->chan; + struct cpdma_ctlr *ctlr = chan->ctlr; + int len = si->len; +- int swlen = len; + struct cpdma_desc __iomem *desc; + dma_addr_t buffer; + u32 mode; +@@ -1046,7 +1045,6 @@ static int cpdma_chan_submit_si(struct s + if (si->data_dma) { + buffer = si->data_dma; + dma_sync_single_for_device(ctlr->dev, buffer, len, chan->dir); +- swlen |= CPDMA_DMA_EXT_MAP; + } else { + buffer = dma_map_single(ctlr->dev, si->data_virt, len, chan->dir); + ret = dma_mapping_error(ctlr->dev, buffer); +@@ -1065,7 +1063,8 @@ static int cpdma_chan_submit_si(struct s + writel_relaxed(mode | len, &desc->hw_mode); + writel_relaxed((uintptr_t)si->token, &desc->sw_token); + writel_relaxed(buffer, &desc->sw_buffer); +- writel_relaxed(swlen, &desc->sw_len); ++ writel_relaxed(si->data_dma ? len | CPDMA_DMA_EXT_MAP : len, ++ &desc->sw_len); + desc_read(desc, sw_len); + + __cpdma_chan_submit(chan, desc); diff --git a/queue-5.4/net-gemini-fix-memory-leak-in-gmac_setup_txqs.patch b/queue-5.4/net-gemini-fix-memory-leak-in-gmac_setup_txqs.patch new file mode 100644 index 00000000000..6d5f6a77d6a --- /dev/null +++ b/queue-5.4/net-gemini-fix-memory-leak-in-gmac_setup_txqs.patch @@ -0,0 +1,33 @@ +From foo@baz Sat 28 Dec 2019 05:57:33 AM EST +From: Navid Emamdoost +Date: Sat, 14 Dec 2019 19:10:44 -0600 +Subject: net: gemini: Fix memory leak in gmac_setup_txqs + +From: Navid Emamdoost + +[ Upstream commit f37f710353677639bc5d37ee785335994adf2529 ] + +In the implementation of gmac_setup_txqs() the allocated desc_ring is +leaked if TX queue base is not aligned. Release it via +dma_free_coherent. + +Fixes: 4d5ae32f5e1e ("net: ethernet: Add a driver for Gemini gigabit ethernet") +Signed-off-by: Navid Emamdoost +Reviewed-by: Linus Walleij +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/cortina/gemini.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/ethernet/cortina/gemini.c ++++ b/drivers/net/ethernet/cortina/gemini.c +@@ -576,6 +576,8 @@ static int gmac_setup_txqs(struct net_de + + if (port->txq_dma_base & ~DMA_Q_BASE_MASK) { + dev_warn(geth->dev, "TX queue base is not aligned\n"); ++ dma_free_coherent(geth->dev, len * sizeof(*desc_ring), ++ desc_ring, port->txq_dma_base); + kfree(skb_tab); + return -ENOMEM; + } diff --git a/queue-5.4/net-hisilicon-fix-a-bug-trigered-by-wrong-bytes_compl.patch b/queue-5.4/net-hisilicon-fix-a-bug-trigered-by-wrong-bytes_compl.patch new file mode 100644 index 00000000000..e7c5be8c567 --- /dev/null +++ b/queue-5.4/net-hisilicon-fix-a-bug-trigered-by-wrong-bytes_compl.patch @@ -0,0 +1,90 @@ +From foo@baz Sat 28 Dec 2019 05:57:33 AM EST +From: Jiangfeng Xiao +Date: Thu, 19 Dec 2019 10:08:07 +0800 +Subject: net: hisilicon: Fix a BUG trigered by wrong bytes_compl + +From: Jiangfeng Xiao + +[ Upstream commit 90b3b339364c76baa2436445401ea9ade040c216 ] + +When doing stress test, we get the following trace: +kernel BUG at lib/dynamic_queue_limits.c:26! +Internal error: Oops - BUG: 0 [#1] SMP ARM +Modules linked in: hip04_eth +CPU: 0 PID: 2003 Comm: tDblStackPcap0 Tainted: G O L 4.4.197 #1 +Hardware name: Hisilicon A15 +task: c3637668 task.stack: de3bc000 +PC is at dql_completed+0x18/0x154 +LR is at hip04_tx_reclaim+0x110/0x174 [hip04_eth] +pc : [] lr : [] psr: 800f0313 +sp : de3bdc2c ip : 00000000 fp : c020fb10 +r10: 00000000 r9 : c39b4224 r8 : 00000001 +r7 : 00000046 r6 : c39b4000 r5 : 0078f392 r4 : 0078f392 +r3 : 00000047 r2 : 00000000 r1 : 00000046 r0 : df5d5c80 +Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user +Control: 32c5387d Table: 1e189b80 DAC: 55555555 +Process tDblStackPcap0 (pid: 2003, stack limit = 0xde3bc190) +Stack: (0xde3bdc2c to 0xde3be000) +[] (dql_completed) from [] (hip04_tx_reclaim+0x110/0x174 [hip04_eth]) +[] (hip04_tx_reclaim [hip04_eth]) from [] (hip04_rx_poll+0x20/0x388 [hip04_eth]) +[] (hip04_rx_poll [hip04_eth]) from [] (net_rx_action+0x120/0x374) +[] (net_rx_action) from [] (__do_softirq+0x218/0x318) +[] (__do_softirq) from [] (irq_exit+0x88/0xac) +[] (irq_exit) from [] (msa_irq_exit+0x11c/0x1d4) +[] (msa_irq_exit) from [] (__handle_domain_irq+0x110/0x148) +[] (__handle_domain_irq) from [] (gic_handle_irq+0xd4/0x118) +[] (gic_handle_irq) from [] (__irq_svc+0x40/0x58) +Exception stack(0xde3bdde0 to 0xde3bde28) +dde0: 00000000 00008001 c3637668 00000000 00000000 a00f0213 dd3627a0 c0af6380 +de00: c086d380 a00f0213 c0a22a50 de3bde6c 00000002 de3bde30 c0558138 c055813c +de20: 600f0213 ffffffff +[] (__irq_svc) from [] (_raw_spin_unlock_irqrestore+0x44/0x54) +Kernel panic - not syncing: Fatal exception in interrupt + +Pre-modification code: +int hip04_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev) +{ +[...] +[1] priv->tx_head = TX_NEXT(tx_head); +[2] count++; +[3] netdev_sent_queue(ndev, skb->len); +[...] +} +An rx interrupt occurs if hip04_mac_start_xmit just executes to the line 2, +tx_head has been updated, but corresponding 'skb->len' has not been +added to dql_queue. + +And then +hip04_mac_interrupt->__napi_schedule->hip04_rx_poll->hip04_tx_reclaim + +In hip04_tx_reclaim, because tx_head has been updated, +bytes_compl will plus an additional "skb-> len" +which has not been added to dql_queue. And then +trigger the BUG_ON(bytes_compl > num_queued - dql->num_completed). + +To solve the problem described above, we put +"netdev_sent_queue(ndev, skb->len);" +before +"priv->tx_head = TX_NEXT(tx_head);" + +Fixes: a41ea46a9a12 ("net: hisilicon: new hip04 ethernet driver") +Signed-off-by: Jiangfeng Xiao +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hip04_eth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/hisilicon/hip04_eth.c ++++ b/drivers/net/ethernet/hisilicon/hip04_eth.c +@@ -543,9 +543,9 @@ hip04_mac_start_xmit(struct sk_buff *skb + skb_tx_timestamp(skb); + + hip04_set_xmit_desc(priv, phys); +- priv->tx_head = TX_NEXT(tx_head); + count++; + netdev_sent_queue(ndev, skb->len); ++ priv->tx_head = TX_NEXT(tx_head); + + stats->tx_bytes += skb->len; + stats->tx_packets++; diff --git a/queue-5.4/net-nfc-nci-fix-a-possible-sleep-in-atomic-context-bug-in-nci_uart_tty_receive.patch b/queue-5.4/net-nfc-nci-fix-a-possible-sleep-in-atomic-context-bug-in-nci_uart_tty_receive.patch new file mode 100644 index 00000000000..7f4f9ee2e27 --- /dev/null +++ b/queue-5.4/net-nfc-nci-fix-a-possible-sleep-in-atomic-context-bug-in-nci_uart_tty_receive.patch @@ -0,0 +1,45 @@ +From foo@baz Sat 28 Dec 2019 05:57:33 AM EST +From: Jia-Ju Bai +Date: Wed, 18 Dec 2019 17:21:55 +0800 +Subject: net: nfc: nci: fix a possible sleep-in-atomic-context bug in nci_uart_tty_receive() + +From: Jia-Ju Bai + +[ Upstream commit b7ac893652cafadcf669f78452329727e4e255cc ] + +The kernel may sleep while holding a spinlock. +The function call path (from bottom to top) in Linux 4.19 is: + +net/nfc/nci/uart.c, 349: + nci_skb_alloc in nci_uart_default_recv_buf +net/nfc/nci/uart.c, 255: + (FUNC_PTR)nci_uart_default_recv_buf in nci_uart_tty_receive +net/nfc/nci/uart.c, 254: + spin_lock in nci_uart_tty_receive + +nci_skb_alloc(GFP_KERNEL) can sleep at runtime. +(FUNC_PTR) means a function pointer is called. + +To fix this bug, GFP_KERNEL is replaced with GFP_ATOMIC for +nci_skb_alloc(). + +This bug is found by a static analysis tool STCheck written by myself. + +Signed-off-by: Jia-Ju Bai +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/nfc/nci/uart.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/nfc/nci/uart.c ++++ b/net/nfc/nci/uart.c +@@ -346,7 +346,7 @@ static int nci_uart_default_recv_buf(str + nu->rx_packet_len = -1; + nu->rx_skb = nci_skb_alloc(nu->ndev, + NCI_MAX_PACKET_SIZE, +- GFP_KERNEL); ++ GFP_ATOMIC); + if (!nu->rx_skb) + return -ENOMEM; + } diff --git a/queue-5.4/net-phy-ensure-that-phy-ids-are-correctly-typed.patch b/queue-5.4/net-phy-ensure-that-phy-ids-are-correctly-typed.patch new file mode 100644 index 00000000000..f93274d2148 --- /dev/null +++ b/queue-5.4/net-phy-ensure-that-phy-ids-are-correctly-typed.patch @@ -0,0 +1,64 @@ +From foo@baz Sat 28 Dec 2019 05:57:33 AM EST +From: Russell King +Date: Thu, 19 Dec 2019 23:24:52 +0000 +Subject: net: phy: ensure that phy IDs are correctly typed + +From: Russell King + +[ Upstream commit 7d49a32a66d2215c5b3bf9bc67c9036ea9904111 ] + +PHY IDs are 32-bit unsigned quantities. Ensure that they are always +treated as such, and not passed around as "int"s. + +Fixes: 13d0ab6750b2 ("net: phy: check return code when requesting PHY driver module") +Signed-off-by: Russell King +Reviewed-by: Florian Fainelli +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/phy_device.c | 8 ++++---- + include/linux/phy.h | 2 +- + 2 files changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/net/phy/phy_device.c ++++ b/drivers/net/phy/phy_device.c +@@ -552,7 +552,7 @@ static const struct device_type mdio_bus + .pm = MDIO_BUS_PHY_PM_OPS, + }; + +-static int phy_request_driver_module(struct phy_device *dev, int phy_id) ++static int phy_request_driver_module(struct phy_device *dev, u32 phy_id) + { + int ret; + +@@ -564,15 +564,15 @@ static int phy_request_driver_module(str + * then modprobe isn't available. + */ + if (IS_ENABLED(CONFIG_MODULES) && ret < 0 && ret != -ENOENT) { +- phydev_err(dev, "error %d loading PHY driver module for ID 0x%08x\n", +- ret, phy_id); ++ phydev_err(dev, "error %d loading PHY driver module for ID 0x%08lx\n", ++ ret, (unsigned long)phy_id); + return ret; + } + + return 0; + } + +-struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id, ++struct phy_device *phy_device_create(struct mii_bus *bus, int addr, u32 phy_id, + bool is_c45, + struct phy_c45_device_ids *c45_ids) + { +--- a/include/linux/phy.h ++++ b/include/linux/phy.h +@@ -993,7 +993,7 @@ int phy_modify_paged_changed(struct phy_ + int phy_modify_paged(struct phy_device *phydev, int page, u32 regnum, + u16 mask, u16 set); + +-struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id, ++struct phy_device *phy_device_create(struct mii_bus *bus, int addr, u32 phy_id, + bool is_c45, + struct phy_c45_device_ids *c45_ids); + #if IS_ENABLED(CONFIG_PHYLIB) diff --git a/queue-5.4/net-qlogic-fix-error-paths-in-ql_alloc_large_buffers.patch b/queue-5.4/net-qlogic-fix-error-paths-in-ql_alloc_large_buffers.patch new file mode 100644 index 00000000000..16ed7733bdd --- /dev/null +++ b/queue-5.4/net-qlogic-fix-error-paths-in-ql_alloc_large_buffers.patch @@ -0,0 +1,76 @@ +From foo@baz Sat 28 Dec 2019 05:57:33 AM EST +From: Ben Hutchings +Date: Tue, 17 Dec 2019 01:57:40 +0000 +Subject: net: qlogic: Fix error paths in ql_alloc_large_buffers() + +From: Ben Hutchings + +[ Upstream commit cad46039e4c99812db067c8ac22a864960e7acc4 ] + +ql_alloc_large_buffers() has the usual RX buffer allocation +loop where it allocates skbs and maps them for DMA. It also +treats failure as a fatal error. + +There are (at least) three bugs in the error paths: + +1. ql_free_large_buffers() assumes that the lrg_buf[] entry for the +first buffer that couldn't be allocated will have .skb == NULL. +But the qla_buf[] array is not zero-initialised. + +2. ql_free_large_buffers() DMA-unmaps all skbs in lrg_buf[]. This is +incorrect for the last allocated skb, if DMA mapping failed. + +3. Commit 1acb8f2a7a9f ("net: qlogic: Fix memory leak in +ql_alloc_large_buffers") added a direct call to dev_kfree_skb_any() +after the skb is recorded in lrg_buf[], so ql_free_large_buffers() +will double-free it. + +The bugs are somewhat inter-twined, so fix them all at once: + +* Clear each entry in qla_buf[] before attempting to allocate + an skb for it. This goes half-way to fixing bug 1. +* Set the .skb field only after the skb is DMA-mapped. This + fixes the rest. + +Fixes: 1357bfcf7106 ("qla3xxx: Dynamically size the rx buffer queue ...") +Fixes: 0f8ab89e825f ("qla3xxx: Check return code from pci_map_single() ...") +Fixes: 1acb8f2a7a9f ("net: qlogic: Fix memory leak in ql_alloc_large_buffers") +Signed-off-by: Ben Hutchings +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qla3xxx.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/net/ethernet/qlogic/qla3xxx.c ++++ b/drivers/net/ethernet/qlogic/qla3xxx.c +@@ -2756,6 +2756,9 @@ static int ql_alloc_large_buffers(struct + int err; + + for (i = 0; i < qdev->num_large_buffers; i++) { ++ lrg_buf_cb = &qdev->lrg_buf[i]; ++ memset(lrg_buf_cb, 0, sizeof(struct ql_rcv_buf_cb)); ++ + skb = netdev_alloc_skb(qdev->ndev, + qdev->lrg_buffer_len); + if (unlikely(!skb)) { +@@ -2766,11 +2769,7 @@ static int ql_alloc_large_buffers(struct + ql_free_large_buffers(qdev); + return -ENOMEM; + } else { +- +- lrg_buf_cb = &qdev->lrg_buf[i]; +- memset(lrg_buf_cb, 0, sizeof(struct ql_rcv_buf_cb)); + lrg_buf_cb->index = i; +- lrg_buf_cb->skb = skb; + /* + * We save some space to copy the ethhdr from first + * buffer +@@ -2792,6 +2791,7 @@ static int ql_alloc_large_buffers(struct + return -ENOMEM; + } + ++ lrg_buf_cb->skb = skb; + dma_unmap_addr_set(lrg_buf_cb, mapaddr, map); + dma_unmap_len_set(lrg_buf_cb, maplen, + qdev->lrg_buffer_len - diff --git a/queue-5.4/net-stmmac-platform-fix-mdio-init-for-platforms-without-phy.patch b/queue-5.4/net-stmmac-platform-fix-mdio-init-for-platforms-without-phy.patch new file mode 100644 index 00000000000..5446d1a5867 --- /dev/null +++ b/queue-5.4/net-stmmac-platform-fix-mdio-init-for-platforms-without-phy.patch @@ -0,0 +1,34 @@ +From foo@baz Sat 28 Dec 2019 05:57:33 AM EST +From: Padmanabhan Rajanbabu +Date: Thu, 19 Dec 2019 15:47:01 +0530 +Subject: net: stmmac: platform: Fix MDIO init for platforms without PHY + +From: Padmanabhan Rajanbabu + +[ Upstream commit d3e014ec7d5ebe9644b5486bc530b91e62bbf624 ] + +The current implementation of "stmmac_dt_phy" function initializes +the MDIO platform bus data, even in the absence of PHY. This fix +will skip MDIO initialization if there is no PHY present. + +Fixes: 7437127 ("net: stmmac: Convert to phylink and remove phylib logic") +Acked-by: Jayati Sahu +Signed-off-by: Sriram Dash +Signed-off-by: Padmanabhan Rajanbabu +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +@@ -320,7 +320,7 @@ out: + static int stmmac_dt_phy(struct plat_stmmacenet_data *plat, + struct device_node *np, struct device *dev) + { +- bool mdio = true; ++ bool mdio = false; + static const struct of_device_id need_mdio_ids[] = { + { .compatible = "snps,dwc-qos-ethernet-4.10" }, + {}, diff --git a/queue-5.4/net-sysfs-call-dev_hold-always-in-rx_queue_add_kobject.patch b/queue-5.4/net-sysfs-call-dev_hold-always-in-rx_queue_add_kobject.patch new file mode 100644 index 00000000000..b75edfec6eb --- /dev/null +++ b/queue-5.4/net-sysfs-call-dev_hold-always-in-rx_queue_add_kobject.patch @@ -0,0 +1,47 @@ +From foo@baz Sat 28 Dec 2019 05:57:33 AM EST +From: Jouni Hogander +Date: Tue, 17 Dec 2019 13:46:34 +0200 +Subject: net-sysfs: Call dev_hold always in rx_queue_add_kobject + +From: Jouni Hogander + +[ Upstream commit ddd9b5e3e765d8ed5a35786a6cb00111713fe161 ] + +Dev_hold has to be called always in rx_queue_add_kobject. +Otherwise usage count drops below 0 in case of failure in +kobject_init_and_add. + +Fixes: b8eb718348b8 ("net-sysfs: Fix reference count leak in rx|netdev_queue_add_kobject") +Reported-by: syzbot +Cc: Tetsuo Handa +Cc: David Miller +Cc: Lukas Bulwahn +Signed-off-by: Jouni Hogander +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/core/net-sysfs.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/net/core/net-sysfs.c ++++ b/net/core/net-sysfs.c +@@ -919,14 +919,17 @@ static int rx_queue_add_kobject(struct n + struct kobject *kobj = &queue->kobj; + int error = 0; + ++ /* Kobject_put later will trigger rx_queue_release call which ++ * decreases dev refcount: Take that reference here ++ */ ++ dev_hold(queue->dev); ++ + kobj->kset = dev->queues_kset; + error = kobject_init_and_add(kobj, &rx_queue_ktype, NULL, + "rx-%u", index); + if (error) + goto err; + +- dev_hold(queue->dev); +- + if (dev->sysfs_rx_queue_group) { + error = sysfs_create_group(kobj, dev->sysfs_rx_queue_group); + if (error) diff --git a/queue-5.4/net-usb-lan78xx-fix-suspend-resume-phy-register-access-error.patch b/queue-5.4/net-usb-lan78xx-fix-suspend-resume-phy-register-access-error.patch new file mode 100644 index 00000000000..60061e77158 --- /dev/null +++ b/queue-5.4/net-usb-lan78xx-fix-suspend-resume-phy-register-access-error.patch @@ -0,0 +1,34 @@ +From foo@baz Sat 28 Dec 2019 05:57:33 AM EST +From: Cristian Birsan +Date: Thu, 12 Dec 2019 13:52:47 +0200 +Subject: net: usb: lan78xx: Fix suspend/resume PHY register access error + +From: Cristian Birsan + +[ Upstream commit 20032b63586ac6c28c936dff696981159913a13f ] + +Lan78xx driver accesses the PHY registers through MDIO bus over USB +connection. When performing a suspend/resume, the PHY registers can be +accessed before the USB connection is resumed. This will generate an +error and will prevent the device to resume correctly. +This patch adds the dependency between the MDIO bus and USB device to +allow correct handling of suspend/resume. + +Fixes: ce85e13ad6ef ("lan78xx: Update to use phylib instead of mii_if_info.") +Signed-off-by: Cristian Birsan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/lan78xx.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -1808,6 +1808,7 @@ static int lan78xx_mdio_init(struct lan7 + dev->mdiobus->read = lan78xx_mdiobus_read; + dev->mdiobus->write = lan78xx_mdiobus_write; + dev->mdiobus->name = "lan78xx-mdiobus"; ++ dev->mdiobus->parent = &dev->udev->dev; + + snprintf(dev->mdiobus->id, MII_BUS_ID_SIZE, "usb-%03d:%03d", + dev->udev->bus->busnum, dev->udev->devnum); diff --git a/queue-5.4/nfc-nxp-nci-fix-probing-without-acpi.patch b/queue-5.4/nfc-nxp-nci-fix-probing-without-acpi.patch new file mode 100644 index 00000000000..8b4cad07948 --- /dev/null +++ b/queue-5.4/nfc-nxp-nci-fix-probing-without-acpi.patch @@ -0,0 +1,38 @@ +From foo@baz Sat 28 Dec 2019 05:57:33 AM EST +From: Stephan Gerhold +Date: Mon, 9 Dec 2019 19:53:43 +0100 +Subject: NFC: nxp-nci: Fix probing without ACPI + +From: Stephan Gerhold + +[ Upstream commit 868afbaca1e2a7923e48b5e8c07be34660525db5 ] + +devm_acpi_dev_add_driver_gpios() returns -ENXIO if CONFIG_ACPI +is disabled (e.g. on device tree platforms). +In this case, nxp-nci will silently fail to probe. + +The other NFC drivers only log a debug message if +devm_acpi_dev_add_driver_gpios() fails. +Do the same in nxp-nci to fix this problem. + +Fixes: ad0acfd69add ("NFC: nxp-nci: Get rid of code duplication in ->probe()") +Cc: Andy Shevchenko +Signed-off-by: Stephan Gerhold +Acked-by: Andy Shevchenko +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nfc/nxp-nci/i2c.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/nfc/nxp-nci/i2c.c ++++ b/drivers/nfc/nxp-nci/i2c.c +@@ -278,7 +278,7 @@ static int nxp_nci_i2c_probe(struct i2c_ + + r = devm_acpi_dev_add_driver_gpios(dev, acpi_nxp_nci_gpios); + if (r) +- return r; ++ dev_dbg(dev, "Unable to add GPIO mapping table\n"); + + phy->gpiod_en = devm_gpiod_get(dev, "enable", GPIOD_OUT_LOW); + if (IS_ERR(phy->gpiod_en)) { diff --git a/queue-5.4/nfp-flower-fix-stats-id-allocation.patch b/queue-5.4/nfp-flower-fix-stats-id-allocation.patch new file mode 100644 index 00000000000..7938f9d7453 --- /dev/null +++ b/queue-5.4/nfp-flower-fix-stats-id-allocation.patch @@ -0,0 +1,58 @@ +From foo@baz Sat 28 Dec 2019 05:57:33 AM EST +From: John Hurley +Date: Tue, 17 Dec 2019 11:28:56 +0000 +Subject: nfp: flower: fix stats id allocation + +From: John Hurley + +[ Upstream commit 39f14c00b13c47186739a4cbc7a16e04d7fdbb60 ] + +As flower rules are added, they are given a stats ID based on the number +of rules that can be supported in firmware. Only after the initial +allocation of all available IDs does the driver begin to reuse those that +have been released. + +The initial allocation of IDs was modified to account for multiple memory +units on the offloaded device. However, this introduced a bug whereby the +counter that controls the IDs could be decremented before the ID was +assigned (where it is further decremented). This means that the stats ID +could be assigned as -1/0xfffffff which is out of range. + +Fix this by only decrementing the main counter after the current ID has +been assigned. + +Fixes: 467322e2627f ("nfp: flower: support multiple memory units for filter offloads") +Signed-off-by: John Hurley +Reviewed-by: Jakub Kicinski +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/netronome/nfp/flower/metadata.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/netronome/nfp/flower/metadata.c ++++ b/drivers/net/ethernet/netronome/nfp/flower/metadata.c +@@ -65,17 +65,17 @@ static int nfp_get_stats_entry(struct nf + freed_stats_id = priv->stats_ring_size; + /* Check for unallocated entries first. */ + if (priv->stats_ids.init_unalloc > 0) { +- if (priv->active_mem_unit == priv->total_mem_units) { +- priv->stats_ids.init_unalloc--; +- priv->active_mem_unit = 0; +- } +- + *stats_context_id = + FIELD_PREP(NFP_FL_STAT_ID_STAT, + priv->stats_ids.init_unalloc - 1) | + FIELD_PREP(NFP_FL_STAT_ID_MU_NUM, + priv->active_mem_unit); +- priv->active_mem_unit++; ++ ++ if (++priv->active_mem_unit == priv->total_mem_units) { ++ priv->stats_ids.init_unalloc--; ++ priv->active_mem_unit = 0; ++ } ++ + return 0; + } + diff --git a/queue-5.4/qede-disable-hardware-gro-when-xdp-prog-is-installed.patch b/queue-5.4/qede-disable-hardware-gro-when-xdp-prog-is-installed.patch new file mode 100644 index 00000000000..faa19079bee --- /dev/null +++ b/queue-5.4/qede-disable-hardware-gro-when-xdp-prog-is-installed.patch @@ -0,0 +1,51 @@ +From foo@baz Sat 28 Dec 2019 05:57:33 AM EST +From: Manish Chopra +Date: Thu, 19 Dec 2019 10:35:16 -0800 +Subject: qede: Disable hardware gro when xdp prog is installed + +From: Manish Chopra + +[ Upstream commit 4c8dc00503db24deaf0b89dddfa84b7cba7cd4ce ] + +commit 18c602dee472 ("qede: Use NETIF_F_GRO_HW.") introduced +a regression in driver that when xdp program is installed on +qede device, device's aggregation feature (hardware GRO) is not +getting disabled, which is unexpected with xdp. + +Fixes: 18c602dee472 ("qede: Use NETIF_F_GRO_HW.") +Signed-off-by: Manish Chopra +Signed-off-by: Ariel Elior +Reviewed-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qede/qede_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/qlogic/qede/qede_main.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_main.c +@@ -1406,6 +1406,7 @@ static int qede_alloc_mem_rxq(struct qed + rxq->rx_buf_seg_size = roundup_pow_of_two(size); + } else { + rxq->rx_buf_seg_size = PAGE_SIZE; ++ edev->ndev->features &= ~NETIF_F_GRO_HW; + } + + /* Allocate the parallel driver ring for Rx buffers */ +@@ -1450,6 +1451,7 @@ static int qede_alloc_mem_rxq(struct qed + } + } + ++ edev->gro_disable = !(edev->ndev->features & NETIF_F_GRO_HW); + if (!edev->gro_disable) + qede_set_tpa_param(rxq); + err: +@@ -1702,8 +1704,6 @@ static void qede_init_fp(struct qede_dev + snprintf(fp->name, sizeof(fp->name), "%s-fp-%d", + edev->ndev->name, queue_id); + } +- +- edev->gro_disable = !(edev->ndev->features & NETIF_F_GRO_HW); + } + + static int qede_set_real_num_queues(struct qede_dev *edev) diff --git a/queue-5.4/qede-fix-multicast-mac-configuration.patch b/queue-5.4/qede-fix-multicast-mac-configuration.patch new file mode 100644 index 00000000000..bbde2442a93 --- /dev/null +++ b/queue-5.4/qede-fix-multicast-mac-configuration.patch @@ -0,0 +1,33 @@ +From foo@baz Sat 28 Dec 2019 05:57:33 AM EST +From: Manish Chopra +Date: Thu, 12 Dec 2019 06:49:28 -0800 +Subject: qede: Fix multicast mac configuration + +From: Manish Chopra + +[ Upstream commit 0af67e49b018e7280a4227bfe7b6005bc9d3e442 ] + +Driver doesn't accommodate the configuration for max number +of multicast mac addresses, in such particular case it leaves +the device with improper/invalid multicast configuration state, +causing connectivity issues (in lacp bonding like scenarios). + +Signed-off-by: Manish Chopra +Signed-off-by: Ariel Elior +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qede/qede_filter.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/qlogic/qede/qede_filter.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_filter.c +@@ -1230,7 +1230,7 @@ qede_configure_mcast_filtering(struct ne + netif_addr_lock_bh(ndev); + + mc_count = netdev_mc_count(ndev); +- if (mc_count < 64) { ++ if (mc_count <= 64) { + netdev_for_each_mc_addr(ha, ndev) { + ether_addr_copy(temp, ha->addr); + temp += ETH_ALEN; diff --git a/queue-5.4/sctp-fix-memleak-on-err-handling-of-stream-initialization.patch b/queue-5.4/sctp-fix-memleak-on-err-handling-of-stream-initialization.patch new file mode 100644 index 00000000000..a9e7386f619 --- /dev/null +++ b/queue-5.4/sctp-fix-memleak-on-err-handling-of-stream-initialization.patch @@ -0,0 +1,55 @@ +From foo@baz Sat 28 Dec 2019 05:57:33 AM EST +From: Marcelo Ricardo Leitner +Date: Mon, 16 Dec 2019 22:01:16 -0300 +Subject: sctp: fix memleak on err handling of stream initialization + +From: Marcelo Ricardo Leitner + +[ Upstream commit 951c6db954a1adefab492f6da805decacabbd1a7 ] + +syzbot reported a memory leak when an allocation fails within +genradix_prealloc() for output streams. That's because +genradix_prealloc() leaves initialized members initialized when the +issue happens and SCTP stack will abort the current initialization but +without cleaning up such members. + +The fix here is to always call genradix_free() when genradix_prealloc() +fails, for output and also input streams, as it suffers from the same +issue. + +Reported-by: syzbot+772d9e36c490b18d51d1@syzkaller.appspotmail.com +Fixes: 2075e50caf5e ("sctp: convert to genradix") +Signed-off-by: Marcelo Ricardo Leitner +Tested-by: Xin Long +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/stream.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/net/sctp/stream.c ++++ b/net/sctp/stream.c +@@ -84,8 +84,10 @@ static int sctp_stream_alloc_out(struct + return 0; + + ret = genradix_prealloc(&stream->out, outcnt, gfp); +- if (ret) ++ if (ret) { ++ genradix_free(&stream->out); + return ret; ++ } + + stream->outcnt = outcnt; + return 0; +@@ -100,8 +102,10 @@ static int sctp_stream_alloc_in(struct s + return 0; + + ret = genradix_prealloc(&stream->in, incnt, gfp); +- if (ret) ++ if (ret) { ++ genradix_free(&stream->in); + return ret; ++ } + + stream->incnt = incnt; + return 0; diff --git a/queue-5.4/sctp-fully-initialize-v4-addr-in-some-functions.patch b/queue-5.4/sctp-fully-initialize-v4-addr-in-some-functions.patch new file mode 100644 index 00000000000..7fa54868730 --- /dev/null +++ b/queue-5.4/sctp-fully-initialize-v4-addr-in-some-functions.patch @@ -0,0 +1,107 @@ +From foo@baz Sat 28 Dec 2019 05:57:33 AM EST +From: Xin Long +Date: Mon, 9 Dec 2019 13:45:54 +0800 +Subject: sctp: fully initialize v4 addr in some functions + +From: Xin Long + +[ Upstream commit b6f3320b1d5267e7b583a6d0c88dda518101740c ] + +Syzbot found a crash: + + BUG: KMSAN: uninit-value in crc32_body lib/crc32.c:112 [inline] + BUG: KMSAN: uninit-value in crc32_le_generic lib/crc32.c:179 [inline] + BUG: KMSAN: uninit-value in __crc32c_le_base+0x4fa/0xd30 lib/crc32.c:202 + Call Trace: + crc32_body lib/crc32.c:112 [inline] + crc32_le_generic lib/crc32.c:179 [inline] + __crc32c_le_base+0x4fa/0xd30 lib/crc32.c:202 + chksum_update+0xb2/0x110 crypto/crc32c_generic.c:90 + crypto_shash_update+0x4c5/0x530 crypto/shash.c:107 + crc32c+0x150/0x220 lib/libcrc32c.c:47 + sctp_csum_update+0x89/0xa0 include/net/sctp/checksum.h:36 + __skb_checksum+0x1297/0x12a0 net/core/skbuff.c:2640 + sctp_compute_cksum include/net/sctp/checksum.h:59 [inline] + sctp_packet_pack net/sctp/output.c:528 [inline] + sctp_packet_transmit+0x40fb/0x4250 net/sctp/output.c:597 + sctp_outq_flush_transports net/sctp/outqueue.c:1146 [inline] + sctp_outq_flush+0x1823/0x5d80 net/sctp/outqueue.c:1194 + sctp_outq_uncork+0xd0/0xf0 net/sctp/outqueue.c:757 + sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1781 [inline] + sctp_side_effects net/sctp/sm_sideeffect.c:1184 [inline] + sctp_do_sm+0x8fe1/0x9720 net/sctp/sm_sideeffect.c:1155 + sctp_primitive_REQUESTHEARTBEAT+0x175/0x1a0 net/sctp/primitive.c:185 + sctp_apply_peer_addr_params+0x212/0x1d40 net/sctp/socket.c:2433 + sctp_setsockopt_peer_addr_params net/sctp/socket.c:2686 [inline] + sctp_setsockopt+0x189bb/0x19090 net/sctp/socket.c:4672 + +The issue was caused by transport->ipaddr set with uninit addr param, which +was passed by: + + sctp_transport_init net/sctp/transport.c:47 [inline] + sctp_transport_new+0x248/0xa00 net/sctp/transport.c:100 + sctp_assoc_add_peer+0x5ba/0x2030 net/sctp/associola.c:611 + sctp_process_param net/sctp/sm_make_chunk.c:2524 [inline] + +where 'addr' is set by sctp_v4_from_addr_param(), and it doesn't initialize +the padding of addr->v4. + +Later when calling sctp_make_heartbeat(), hbinfo.daddr(=transport->ipaddr) +will become the part of skb, and the issue occurs. + +This patch is to fix it by initializing the padding of addr->v4 in +sctp_v4_from_addr_param(), as well as other functions that do the similar +thing, and these functions shouldn't trust that the caller initializes the +memory, as Marcelo suggested. + +Reported-by: syzbot+6dcbfea81cd3d4dd0b02@syzkaller.appspotmail.com +Signed-off-by: Xin Long +Acked-by: Neil Horman +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/protocol.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/net/sctp/protocol.c ++++ b/net/sctp/protocol.c +@@ -227,6 +227,7 @@ static void sctp_v4_from_skb(union sctp_ + sa->sin_port = sh->dest; + sa->sin_addr.s_addr = ip_hdr(skb)->daddr; + } ++ memset(sa->sin_zero, 0, sizeof(sa->sin_zero)); + } + + /* Initialize an sctp_addr from a socket. */ +@@ -235,6 +236,7 @@ static void sctp_v4_from_sk(union sctp_a + addr->v4.sin_family = AF_INET; + addr->v4.sin_port = 0; + addr->v4.sin_addr.s_addr = inet_sk(sk)->inet_rcv_saddr; ++ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero)); + } + + /* Initialize sk->sk_rcv_saddr from sctp_addr. */ +@@ -257,6 +259,7 @@ static void sctp_v4_from_addr_param(unio + addr->v4.sin_family = AF_INET; + addr->v4.sin_port = port; + addr->v4.sin_addr.s_addr = param->v4.addr.s_addr; ++ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero)); + } + + /* Initialize an address parameter from a sctp_addr and return the length +@@ -281,6 +284,7 @@ static void sctp_v4_dst_saddr(union sctp + saddr->v4.sin_family = AF_INET; + saddr->v4.sin_port = port; + saddr->v4.sin_addr.s_addr = fl4->saddr; ++ memset(saddr->v4.sin_zero, 0, sizeof(saddr->v4.sin_zero)); + } + + /* Compare two addresses exactly. */ +@@ -303,6 +307,7 @@ static void sctp_v4_inaddr_any(union sct + addr->v4.sin_family = AF_INET; + addr->v4.sin_addr.s_addr = htonl(INADDR_ANY); + addr->v4.sin_port = port; ++ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero)); + } + + /* Is this a wildcard address? */ diff --git a/queue-5.4/selftests-forwarding-delete-ipv6-address-at-the-end.patch b/queue-5.4/selftests-forwarding-delete-ipv6-address-at-the-end.patch new file mode 100644 index 00000000000..7ff12caaa28 --- /dev/null +++ b/queue-5.4/selftests-forwarding-delete-ipv6-address-at-the-end.patch @@ -0,0 +1,44 @@ +From foo@baz Sat 28 Dec 2019 05:57:33 AM EST +From: Ido Schimmel +Date: Mon, 9 Dec 2019 08:56:34 +0200 +Subject: selftests: forwarding: Delete IPv6 address at the end + +From: Ido Schimmel + +[ Upstream commit 65cb13986229cec02635a1ecbcd1e2dd18353201 ] + +When creating the second host in h2_create(), two addresses are assigned +to the interface, but only one is deleted. When running the test twice +in a row the following error is observed: + +$ ./router_bridge_vlan.sh +TEST: ping [ OK ] +TEST: ping6 [ OK ] +TEST: vlan [ OK ] +$ ./router_bridge_vlan.sh +RTNETLINK answers: File exists +TEST: ping [ OK ] +TEST: ping6 [ OK ] +TEST: vlan [ OK ] + +Fix this by deleting the address during cleanup. + +Fixes: 5b1e7f9ebd56 ("selftests: forwarding: Test routed bridge interface") +Signed-off-by: Ido Schimmel +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/net/forwarding/router_bridge_vlan.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/testing/selftests/net/forwarding/router_bridge_vlan.sh ++++ b/tools/testing/selftests/net/forwarding/router_bridge_vlan.sh +@@ -36,7 +36,7 @@ h2_destroy() + { + ip -6 route del 2001:db8:1::/64 vrf v$h2 + ip -4 route del 192.0.2.0/28 vrf v$h2 +- simple_if_fini $h2 192.0.2.130/28 ++ simple_if_fini $h2 192.0.2.130/28 2001:db8:2::2/64 + } + + router_create() diff --git a/queue-5.4/series b/queue-5.4/series index 08f8957e8ca..ee2eacf0cca 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -1,3 +1,30 @@ +af_packet-set-defaule-value-for-tmo.patch +fjes-fix-missed-check-in-fjes_acpi_add.patch +mod_devicetable-fix-phy-module-format.patch +net-dst-force-4-byte-alignment-of-dst_metrics.patch +net-gemini-fix-memory-leak-in-gmac_setup_txqs.patch +net-hisilicon-fix-a-bug-trigered-by-wrong-bytes_compl.patch +net-nfc-nci-fix-a-possible-sleep-in-atomic-context-bug-in-nci_uart_tty_receive.patch +net-phy-ensure-that-phy-ids-are-correctly-typed.patch +net-qlogic-fix-error-paths-in-ql_alloc_large_buffers.patch +net-sysfs-call-dev_hold-always-in-rx_queue_add_kobject.patch +net-usb-lan78xx-fix-suspend-resume-phy-register-access-error.patch +nfp-flower-fix-stats-id-allocation.patch +qede-disable-hardware-gro-when-xdp-prog-is-installed.patch +qede-fix-multicast-mac-configuration.patch +sctp-fix-memleak-on-err-handling-of-stream-initialization.patch +sctp-fully-initialize-v4-addr-in-some-functions.patch +selftests-forwarding-delete-ipv6-address-at-the-end.patch +neighbour-remove-neigh_cleanup-method.patch +bonding-fix-bond_neigh_init.patch +net-ena-fix-default-tx-interrupt-moderation-interval.patch +net-ena-fix-issues-in-setting-interrupt-moderation-params-in-ethtool.patch +dpaa2-ptp-fix-double-free-of-the-ptp_qoriq-irq.patch +mlxsw-spectrum_router-remove-unlikely-user-triggerable-warning.patch +net-ethernet-ti-davinci_cpdma-fix-warning-device-driver-frees-dma-memory-with-different-size.patch +net-stmmac-platform-fix-mdio-init-for-platforms-without-phy.patch +net-dsa-b53-fix-egress-flooding-settings.patch +nfc-nxp-nci-fix-probing-without-acpi.patch btrfs-don-t-double-lock-the-subvol_sem-for-rename-exchange.patch btrfs-do-not-call-synchronize_srcu-in-inode_tree_del.patch btrfs-make-tree-checker-detect-checksum-items-with-overlapping-ranges.patch -- 2.47.3