From fa794dd14d9d10e7e150a8e07ba07aba5625e38e Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sat, 12 Mar 2022 03:51:00 -0500 Subject: [PATCH] Fixes for 5.10 Signed-off-by: Sasha Levin --- ...t-dts-bcm2711-fix-hvs-register-range.patch | 41 +++ ...ts-aspeed-fix-ast2600-quad-spi-group.patch | 62 +++++ ...-3720-turris-mox-add-missing-etherne.patch | 39 +++ ...inter-dereference-in-ax25_kill_by_de.patch | 65 +++++ ...d-support-to-update-gdsc-transition-.patch | 119 +++++++++ ...xer-fix-p010-and-p210-format-numbers.patch | 46 ++++ ...e-inter-address-family-tunneling-on-.patch | 53 ++++ ...error-handling-in-xemaclite_of_probe.patch | 48 ++++ ...fix-refcount-leak-in-gfar_get_ts_inf.patch | 39 +++ ...rn-eprobe_defer-if-gc-to_irq-is-null.patch | 72 ++++++ ...s4900-do-not-set-dat-and-oe-together.patch | 82 ++++++ ...id-vivaldi-fix-sysfs-attributes-leak.patch | 43 ++++ ...r-pmbus-fault-warning-bits-after-rea.patch | 42 ++++ ...abling-vfs-due-to-pf-error-responses.patch | 238 ++++++++++++++++++ ...ign-macro-names-to-the-specification.patch | 216 ++++++++++++++++ ...fix-curr_link_speed-advertised-speed.patch | 43 ++++ .../ice-remove-unnecessary-checker-loop.patch | 53 ++++ .../ice-rename-a-couple-of-variables.patch | 163 ++++++++++++ ...abling-vfs-due-to-pf-error-responses.patch | 108 ++++++++ ...ossible-race-condition-with-lifetime.patch | 47 ++++ ...k-the-return-value-of-dma_set_mask-i.patch | 41 +++ ...ix-memory-leak-in-dsp_pipeline_build.patch | 52 ++++ ...olete-pipeline_debug-debugging-infor.patch | 164 ++++++++++++ ...n-t-claim-wol-when-its-not-available.patch | 58 +++++ ...ix-incorrect-test-in-mt753x_phylink_.patch | 37 +++ ...-lpc_eth-handle-error-for-clk_enable.patch | 47 ++++ ...-ti-cpts-handle-error-for-clk_enable.patch | 39 +++ ...lx5-fix-a-race-on-command-flush-flow.patch | 92 +++++++ ...fix-size-field-in-bufferx_reg-struct.patch | 39 +++ ...ly-handle-events-from-highest-priori.patch | 59 +++++ ...clear-misr2-register-to-disable-inte.patch | 43 ++++ ...-the-return-value-of-dma_alloc_coher.patch | 50 ++++ ...eck-for-netdevice-being-present-to-s.patch | 78 ++++++ ...use-after-free-in-port100_send_compl.patch | 86 +++++++ ...ed-return-status-of-qed_iov_get_link.patch | 87 +++++++ ...ck-check-for-hotplug-status-existenc.patch | 68 +++++ ...ck-remove-hotplug-status-once-it-has.patch | 66 +++++ ...fix-kernel-infoleak-for-sctp-sockets.patch | 128 ++++++++++ ...fix-map_fixed_noreplace-test-failure.patch | 181 +++++++++++++ ...d-test-for-bpf_timer-overwriting-cra.patch | 125 +++++++++ ...d-clean-up-mapping-in-mfd_fail_write.patch | 57 +++++ ...h-kill-tcpdump-processes-launched-by.patch | 95 +++++++ queue-5.10/series | 48 ++++ ...fix-error-in-getting-num-cs-property.patch | 47 ++++ ...minate-dma-transmission-when-slave-a.patch | 40 +++ ...ct-order-of-state-message-data-sanit.patch | 59 +++++ ...ix-kernel-panic-when-enabling-bearer.patch | 106 ++++++++ ...race-buffer-is-at-least-4096-bytes-l.patch | 58 +++++ ...-use-max_discard_segments-if-max_dis.patch | 49 ++++ 49 files changed, 3718 insertions(+) create mode 100644 queue-5.10/arm-boot-dts-bcm2711-fix-hvs-register-range.patch create mode 100644 queue-5.10/arm-dts-aspeed-fix-ast2600-quad-spi-group.patch create mode 100644 queue-5.10/arm64-dts-armada-3720-turris-mox-add-missing-etherne.patch create mode 100644 queue-5.10/ax25-fix-null-pointer-dereference-in-ax25_kill_by_de.patch create mode 100644 queue-5.10/clk-qcom-gdsc-add-support-to-update-gdsc-transition-.patch create mode 100644 queue-5.10/drm-sun4i-mixer-fix-p010-and-p210-format-numbers.patch create mode 100644 queue-5.10/esp-fix-beet-mode-inter-address-family-tunneling-on-.patch create mode 100644 queue-5.10/ethernet-fix-error-handling-in-xemaclite_of_probe.patch create mode 100644 queue-5.10/gianfar-ethtool-fix-refcount-leak-in-gfar_get_ts_inf.patch create mode 100644 queue-5.10/gpio-return-eprobe_defer-if-gc-to_irq-is-null.patch create mode 100644 queue-5.10/gpio-ts4900-do-not-set-dat-and-oe-together.patch create mode 100644 queue-5.10/hid-vivaldi-fix-sysfs-attributes-leak.patch create mode 100644 queue-5.10/hwmon-pmbus-clear-pmbus-fault-warning-bits-after-rea.patch create mode 100644 queue-5.10/i40e-stop-disabling-vfs-due-to-pf-error-responses.patch create mode 100644 queue-5.10/ice-align-macro-names-to-the-specification.patch create mode 100644 queue-5.10/ice-fix-curr_link_speed-advertised-speed.patch create mode 100644 queue-5.10/ice-remove-unnecessary-checker-loop.patch create mode 100644 queue-5.10/ice-rename-a-couple-of-variables.patch create mode 100644 queue-5.10/ice-stop-disabling-vfs-due-to-pf-error-responses.patch create mode 100644 queue-5.10/ipv6-prevent-a-possible-race-condition-with-lifetime.patch create mode 100644 queue-5.10/isdn-hfcpci-check-the-return-value-of-dma_set_mask-i.patch create mode 100644 queue-5.10/misdn-fix-memory-leak-in-dsp_pipeline_build.patch create mode 100644 queue-5.10/misdn-remove-obsolete-pipeline_debug-debugging-infor.patch create mode 100644 queue-5.10/net-bcmgenet-don-t-claim-wol-when-its-not-available.patch create mode 100644 queue-5.10/net-dsa-mt7530-fix-incorrect-test-in-mt753x_phylink_.patch create mode 100644 queue-5.10/net-ethernet-lpc_eth-handle-error-for-clk_enable.patch create mode 100644 queue-5.10/net-ethernet-ti-cpts-handle-error-for-clk_enable.patch create mode 100644 queue-5.10/net-mlx5-fix-a-race-on-command-flush-flow.patch create mode 100644 queue-5.10/net-mlx5-fix-size-field-in-bufferx_reg-struct.patch create mode 100644 queue-5.10/net-mlx5e-lag-only-handle-events-from-highest-priori.patch create mode 100644 queue-5.10/net-phy-dp83822-clear-misr2-register-to-disable-inte.patch create mode 100644 queue-5.10/net-qlogic-check-the-return-value-of-dma_alloc_coher.patch create mode 100644 queue-5.10/net-sysfs-add-check-for-netdevice-being-present-to-s.patch create mode 100644 queue-5.10/nfc-port100-fix-use-after-free-in-port100_send_compl.patch create mode 100644 queue-5.10/qed-return-status-of-qed_iov_get_link.patch create mode 100644 queue-5.10/revert-xen-netback-check-for-hotplug-status-existenc.patch create mode 100644 queue-5.10/revert-xen-netback-remove-hotplug-status-once-it-has.patch create mode 100644 queue-5.10/sctp-fix-kernel-infoleak-for-sctp-sockets.patch create mode 100644 queue-5.10/selftest-vm-fix-map_fixed_noreplace-test-failure.patch create mode 100644 queue-5.10/selftests-bpf-add-test-for-bpf_timer-overwriting-cra.patch create mode 100644 queue-5.10/selftests-memfd-clean-up-mapping-in-mfd_fail_write.patch create mode 100644 queue-5.10/selftests-pmtu.sh-kill-tcpdump-processes-launched-by.patch create mode 100644 queue-5.10/series create mode 100644 queue-5.10/spi-rockchip-fix-error-in-getting-num-cs-property.patch create mode 100644 queue-5.10/spi-rockchip-terminate-dma-transmission-when-slave-a.patch create mode 100644 queue-5.10/tipc-fix-incorrect-order-of-state-message-data-sanit.patch create mode 100644 queue-5.10/tipc-fix-kernel-panic-when-enabling-bearer.patch create mode 100644 queue-5.10/tracing-ensure-trace-buffer-is-at-least-4096-bytes-l.patch create mode 100644 queue-5.10/virtio-blk-don-t-use-max_discard_segments-if-max_dis.patch diff --git a/queue-5.10/arm-boot-dts-bcm2711-fix-hvs-register-range.patch b/queue-5.10/arm-boot-dts-bcm2711-fix-hvs-register-range.patch new file mode 100644 index 00000000000..0c0774b8008 --- /dev/null +++ b/queue-5.10/arm-boot-dts-bcm2711-fix-hvs-register-range.patch @@ -0,0 +1,41 @@ +From 48636f6c0c40f78d2c3ed4265a36a6ad07b7838e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Feb 2022 13:07:55 +0100 +Subject: ARM: boot: dts: bcm2711: Fix HVS register range + +From: Maxime Ripard + +[ Upstream commit 515415d316168c6521d74ea8280287e28d7303e6 ] + +While the HVS has the same context memory size in the BCM2711 than in +the previous SoCs, the range allocated to the registers doubled and it +now takes 16k + 16k, compared to 8k + 16k before. + +The KMS driver will use the whole context RAM though, eventually +resulting in a pointer dereference error when we access the higher half +of the context memory since it hasn't been mapped. + +Fixes: 4564363351e2 ("ARM: dts: bcm2711: Enable the display pipeline") +Signed-off-by: Maxime Ripard +Signed-off-by: Stefan Wahren +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm2711.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/bcm2711.dtsi b/arch/arm/boot/dts/bcm2711.dtsi +index 55ec83bde5a6..e46a3f4ad350 100644 +--- a/arch/arm/boot/dts/bcm2711.dtsi ++++ b/arch/arm/boot/dts/bcm2711.dtsi +@@ -290,6 +290,7 @@ pixelvalve4: pixelvalve@7e216000 { + + hvs: hvs@7e400000 { + compatible = "brcm,bcm2711-hvs"; ++ reg = <0x7e400000 0x8000>; + interrupts = ; + }; + +-- +2.34.1 + diff --git a/queue-5.10/arm-dts-aspeed-fix-ast2600-quad-spi-group.patch b/queue-5.10/arm-dts-aspeed-fix-ast2600-quad-spi-group.patch new file mode 100644 index 00000000000..243d3e390f3 --- /dev/null +++ b/queue-5.10/arm-dts-aspeed-fix-ast2600-quad-spi-group.patch @@ -0,0 +1,62 @@ +From 6d5e920bc5e809616d57c6acc5bfd882a87d2691 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Mar 2022 10:36:31 +1030 +Subject: ARM: dts: aspeed: Fix AST2600 quad spi group +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Joel Stanley + +[ Upstream commit 2f6edb6bcb2f3f41d876e0eba2ba97f87a0296ea ] + +Requesting quad mode for the FMC resulted in an error: + + &fmc { + status = "okay"; + + pinctrl-names = "default"; + + pinctrl-0 = <&pinctrl_fwqspi_default>' + +[ 0.742963] aspeed-g6-pinctrl 1e6e2000.syscon:pinctrl: invalid function FWQSPID in map table + + +This is because the quad mode pins are a group of pins, not a function. + +After applying this patch we can request the pins and the QSPI data +lines are muxed: + + # cat /sys/kernel/debug/pinctrl/1e6e2000.syscon\:pinctrl-aspeed-g6-pinctrl/pinmux-pins |grep 1e620000.spi + pin 196 (AE12): device 1e620000.spi function FWSPID group FWQSPID + pin 197 (AF12): device 1e620000.spi function FWSPID group FWQSPID + pin 240 (Y1): device 1e620000.spi function FWSPID group FWQSPID + pin 241 (Y2): device 1e620000.spi function FWSPID group FWQSPID + pin 242 (Y3): device 1e620000.spi function FWSPID group FWQSPID + pin 243 (Y4): device 1e620000.spi function FWSPID group FWQSPID + +Fixes: f510f04c8c83 ("ARM: dts: aspeed: Add AST2600 pinmux nodes") +Signed-off-by: Joel Stanley +Reviewed-by: Andrew Jeffery +Link: https://lore.kernel.org/r/20220304011010.974863-1-joel@jms.id.au +Link: https://lore.kernel.org/r/20220304011010.974863-1-joel@jms.id.au' +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi b/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi +index 910eacc8ad3b..a362714ae9fc 100644 +--- a/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi ++++ b/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi +@@ -118,7 +118,7 @@ pinctrl_fwspid_default: fwspid_default { + }; + + pinctrl_fwqspid_default: fwqspid_default { +- function = "FWQSPID"; ++ function = "FWSPID"; + groups = "FWQSPID"; + }; + +-- +2.34.1 + diff --git a/queue-5.10/arm64-dts-armada-3720-turris-mox-add-missing-etherne.patch b/queue-5.10/arm64-dts-armada-3720-turris-mox-add-missing-etherne.patch new file mode 100644 index 00000000000..0ac718594d6 --- /dev/null +++ b/queue-5.10/arm64-dts-armada-3720-turris-mox-add-missing-etherne.patch @@ -0,0 +1,39 @@ +From b728eb41ab4ec1ce4ac8d61d9c1b41ed3c01c2fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jan 2022 19:20:06 +0100 +Subject: arm64: dts: armada-3720-turris-mox: Add missing ethernet0 alias +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit a0e897d1b36793fe0ab899f2fe93dff25c82f418 ] + +U-Boot uses ethernet* aliases for setting MAC addresses. Therefore define +also alias for ethernet0. + +Fixes: 7109d817db2e ("arm64: dts: marvell: add DTS for Turris Mox") +Signed-off-by: Pali Rohár +Signed-off-by: Gregory CLEMENT +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts +index 2e437f20da39..ad963b51dcbe 100644 +--- a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts ++++ b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts +@@ -18,6 +18,7 @@ / { + + aliases { + spi0 = &spi0; ++ ethernet0 = ð0; + ethernet1 = ð1; + mmc0 = &sdhci0; + mmc1 = &sdhci1; +-- +2.34.1 + diff --git a/queue-5.10/ax25-fix-null-pointer-dereference-in-ax25_kill_by_de.patch b/queue-5.10/ax25-fix-null-pointer-dereference-in-ax25_kill_by_de.patch new file mode 100644 index 00000000000..24659b1adc9 --- /dev/null +++ b/queue-5.10/ax25-fix-null-pointer-dereference-in-ax25_kill_by_de.patch @@ -0,0 +1,65 @@ +From 57a8b00908bf3c081d133f08c7f58d4a330df9b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Mar 2022 16:12:23 +0800 +Subject: ax25: Fix NULL pointer dereference in ax25_kill_by_device + +From: Duoming Zhou + +[ Upstream commit 71171ac8eb34ce7fe6b3267dce27c313ab3cb3ac ] + +When two ax25 devices attempted to establish connection, the requester use ax25_create(), +ax25_bind() and ax25_connect() to initiate connection. The receiver use ax25_rcv() to +accept connection and use ax25_create_cb() in ax25_rcv() to create ax25_cb, but the +ax25_cb->sk is NULL. When the receiver is detaching, a NULL pointer dereference bug +caused by sock_hold(sk) in ax25_kill_by_device() will happen. The corresponding +fail log is shown below: + +=============================================================== +BUG: KASAN: null-ptr-deref in ax25_device_event+0xfd/0x290 +Call Trace: +... +ax25_device_event+0xfd/0x290 +raw_notifier_call_chain+0x5e/0x70 +dev_close_many+0x174/0x220 +unregister_netdevice_many+0x1f7/0xa60 +unregister_netdevice_queue+0x12f/0x170 +unregister_netdev+0x13/0x20 +mkiss_close+0xcd/0x140 +tty_ldisc_release+0xc0/0x220 +tty_release_struct+0x17/0xa0 +tty_release+0x62d/0x670 +... + +This patch add condition check in ax25_kill_by_device(). If s->sk is +NULL, it will goto if branch to kill device. + +Fixes: 4e0f718daf97 ("ax25: improve the incomplete fix to avoid UAF and NPD bugs") +Reported-by: Thomas Osterried +Signed-off-by: Duoming Zhou +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ax25/af_ax25.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c +index 23bd26057a82..9e0eef7fe9ad 100644 +--- a/net/ax25/af_ax25.c ++++ b/net/ax25/af_ax25.c +@@ -87,6 +87,13 @@ static void ax25_kill_by_device(struct net_device *dev) + ax25_for_each(s, &ax25_list) { + if (s->ax25_dev == ax25_dev) { + sk = s->sk; ++ if (!sk) { ++ spin_unlock_bh(&ax25_list_lock); ++ s->ax25_dev = NULL; ++ ax25_disconnect(s, ENETUNREACH); ++ spin_lock_bh(&ax25_list_lock); ++ goto again; ++ } + sock_hold(sk); + spin_unlock_bh(&ax25_list_lock); + lock_sock(sk); +-- +2.34.1 + diff --git a/queue-5.10/clk-qcom-gdsc-add-support-to-update-gdsc-transition-.patch b/queue-5.10/clk-qcom-gdsc-add-support-to-update-gdsc-transition-.patch new file mode 100644 index 00000000000..b845d92f3aa --- /dev/null +++ b/queue-5.10/clk-qcom-gdsc-add-support-to-update-gdsc-transition-.patch @@ -0,0 +1,119 @@ +From 4a817acd03448574a16e387e41db2e0509abc8d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Feb 2022 00:26:05 +0530 +Subject: clk: qcom: gdsc: Add support to update GDSC transition delay + +From: Taniya Das + +[ Upstream commit 4e7c4d3652f96f41179aab3ff53025c7a550d689 ] + +GDSCs have multiple transition delays which are used for the GDSC FSM +states. Older targets/designs required these values to be updated from +gdsc code to certain default values for the FSM state to work as +expected. But on the newer targets/designs the values updated from the +GDSC driver can hamper the FSM state to not work as expected. + +On SC7180 we observe black screens because the gdsc is being +enabled/disabled very rapidly and the GDSC FSM state does not work as +expected. This is due to the fact that the GDSC reset value is being +updated from SW. + +Thus add support to update the transition delay from the clock +controller gdscs as required. + +Fixes: 45dd0e55317cc ("clk: qcom: Add support for GDSCs) +Signed-off-by: Taniya Das +Link: https://lore.kernel.org/r/20220223185606.3941-1-tdas@codeaurora.org +Reviewed-by: Bjorn Andersson +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gdsc.c | 26 +++++++++++++++++++++----- + drivers/clk/qcom/gdsc.h | 8 +++++++- + 2 files changed, 28 insertions(+), 6 deletions(-) + +diff --git a/drivers/clk/qcom/gdsc.c b/drivers/clk/qcom/gdsc.c +index 4ece326ea233..cf23cfd7e467 100644 +--- a/drivers/clk/qcom/gdsc.c ++++ b/drivers/clk/qcom/gdsc.c +@@ -1,6 +1,6 @@ + // SPDX-License-Identifier: GPL-2.0-only + /* +- * Copyright (c) 2015, 2017-2018, The Linux Foundation. All rights reserved. ++ * Copyright (c) 2015, 2017-2018, 2022, The Linux Foundation. All rights reserved. + */ + + #include +@@ -34,9 +34,14 @@ + #define CFG_GDSCR_OFFSET 0x4 + + /* Wait 2^n CXO cycles between all states. Here, n=2 (4 cycles). */ +-#define EN_REST_WAIT_VAL (0x2 << 20) +-#define EN_FEW_WAIT_VAL (0x8 << 16) +-#define CLK_DIS_WAIT_VAL (0x2 << 12) ++#define EN_REST_WAIT_VAL 0x2 ++#define EN_FEW_WAIT_VAL 0x8 ++#define CLK_DIS_WAIT_VAL 0x2 ++ ++/* Transition delay shifts */ ++#define EN_REST_WAIT_SHIFT 20 ++#define EN_FEW_WAIT_SHIFT 16 ++#define CLK_DIS_WAIT_SHIFT 12 + + #define RETAIN_MEM BIT(14) + #define RETAIN_PERIPH BIT(13) +@@ -341,7 +346,18 @@ static int gdsc_init(struct gdsc *sc) + */ + mask = HW_CONTROL_MASK | SW_OVERRIDE_MASK | + EN_REST_WAIT_MASK | EN_FEW_WAIT_MASK | CLK_DIS_WAIT_MASK; +- val = EN_REST_WAIT_VAL | EN_FEW_WAIT_VAL | CLK_DIS_WAIT_VAL; ++ ++ if (!sc->en_rest_wait_val) ++ sc->en_rest_wait_val = EN_REST_WAIT_VAL; ++ if (!sc->en_few_wait_val) ++ sc->en_few_wait_val = EN_FEW_WAIT_VAL; ++ if (!sc->clk_dis_wait_val) ++ sc->clk_dis_wait_val = CLK_DIS_WAIT_VAL; ++ ++ val = sc->en_rest_wait_val << EN_REST_WAIT_SHIFT | ++ sc->en_few_wait_val << EN_FEW_WAIT_SHIFT | ++ sc->clk_dis_wait_val << CLK_DIS_WAIT_SHIFT; ++ + ret = regmap_update_bits(sc->regmap, sc->gdscr, mask, val); + if (ret) + return ret; +diff --git a/drivers/clk/qcom/gdsc.h b/drivers/clk/qcom/gdsc.h +index 5bb396b344d1..762f1b5e1ec5 100644 +--- a/drivers/clk/qcom/gdsc.h ++++ b/drivers/clk/qcom/gdsc.h +@@ -1,6 +1,6 @@ + /* SPDX-License-Identifier: GPL-2.0-only */ + /* +- * Copyright (c) 2015, 2017-2018, The Linux Foundation. All rights reserved. ++ * Copyright (c) 2015, 2017-2018, 2022, The Linux Foundation. All rights reserved. + */ + + #ifndef __QCOM_GDSC_H__ +@@ -22,6 +22,9 @@ struct reset_controller_dev; + * @cxcs: offsets of branch registers to toggle mem/periph bits in + * @cxc_count: number of @cxcs + * @pwrsts: Possible powerdomain power states ++ * @en_rest_wait_val: transition delay value for receiving enr ack signal ++ * @en_few_wait_val: transition delay value for receiving enf ack signal ++ * @clk_dis_wait_val: transition delay value for halting clock + * @resets: ids of resets associated with this gdsc + * @reset_count: number of @resets + * @rcdev: reset controller +@@ -35,6 +38,9 @@ struct gdsc { + unsigned int clamp_io_ctrl; + unsigned int *cxcs; + unsigned int cxc_count; ++ unsigned int en_rest_wait_val; ++ unsigned int en_few_wait_val; ++ unsigned int clk_dis_wait_val; + const u8 pwrsts; + /* Powerdomain allowable state bitfields */ + #define PWRSTS_OFF BIT(0) +-- +2.34.1 + diff --git a/queue-5.10/drm-sun4i-mixer-fix-p010-and-p210-format-numbers.patch b/queue-5.10/drm-sun4i-mixer-fix-p010-and-p210-format-numbers.patch new file mode 100644 index 00000000000..bffd30a2455 --- /dev/null +++ b/queue-5.10/drm-sun4i-mixer-fix-p010-and-p210-format-numbers.patch @@ -0,0 +1,46 @@ +From 3ec86270c18fcf96d8beaea60d5cbfce0e46f1ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Feb 2022 19:14:36 +0100 +Subject: drm/sun4i: mixer: Fix P010 and P210 format numbers + +From: Jernej Skrabec + +[ Upstream commit 9470c29faa91c804aa04de4c10634bf02462bfa5 ] + +It turns out that DE3 manual has inverted YUV and YVU format numbers for +P010 and P210. Invert them. + +This was tested by playing video decoded to P010 and additionally +confirmed by looking at BSP driver source. + +Fixes: 169ca4b38932 ("drm/sun4i: Add separate DE3 VI layer formats") +Signed-off-by: Jernej Skrabec +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20220228181436.1424550-1-jernej.skrabec@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sun4i/sun8i_mixer.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/sun4i/sun8i_mixer.h b/drivers/gpu/drm/sun4i/sun8i_mixer.h +index 7576b523fdbb..b0178c045267 100644 +--- a/drivers/gpu/drm/sun4i/sun8i_mixer.h ++++ b/drivers/gpu/drm/sun4i/sun8i_mixer.h +@@ -113,10 +113,10 @@ + /* format 13 is semi-planar YUV411 VUVU */ + #define SUN8I_MIXER_FBFMT_YUV411 14 + /* format 15 doesn't exist */ +-/* format 16 is P010 YVU */ +-#define SUN8I_MIXER_FBFMT_P010_YUV 17 +-/* format 18 is P210 YVU */ +-#define SUN8I_MIXER_FBFMT_P210_YUV 19 ++#define SUN8I_MIXER_FBFMT_P010_YUV 16 ++/* format 17 is P010 YVU */ ++#define SUN8I_MIXER_FBFMT_P210_YUV 18 ++/* format 19 is P210 YVU */ + /* format 20 is packed YVU444 10-bit */ + /* format 21 is packed YUV444 10-bit */ + +-- +2.34.1 + diff --git a/queue-5.10/esp-fix-beet-mode-inter-address-family-tunneling-on-.patch b/queue-5.10/esp-fix-beet-mode-inter-address-family-tunneling-on-.patch new file mode 100644 index 00000000000..a5ca202008e --- /dev/null +++ b/queue-5.10/esp-fix-beet-mode-inter-address-family-tunneling-on-.patch @@ -0,0 +1,53 @@ +From 906c5378b94c7c69454bdb375f722c06f0622eae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Mar 2022 13:11:40 +0100 +Subject: esp: Fix BEET mode inter address family tunneling on GSO + +From: Steffen Klassert + +[ Upstream commit 053c8fdf2c930efdff5496960842bbb5c34ad43a ] + +The xfrm{4,6}_beet_gso_segment() functions did not correctly set the +SKB_GSO_IPXIP4 and SKB_GSO_IPXIP6 gso types for the address family +tunneling case. Fix this by setting these gso types. + +Fixes: 384a46ea7bdc7 ("esp4: add gso_segment for esp4 beet mode") +Fixes: 7f9e40eb18a99 ("esp6: add gso_segment for esp6 beet mode") +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/ipv4/esp4_offload.c | 3 +++ + net/ipv6/esp6_offload.c | 3 +++ + 2 files changed, 6 insertions(+) + +diff --git a/net/ipv4/esp4_offload.c b/net/ipv4/esp4_offload.c +index 5aa7344dbec7..3450c9ba2728 100644 +--- a/net/ipv4/esp4_offload.c ++++ b/net/ipv4/esp4_offload.c +@@ -160,6 +160,9 @@ static struct sk_buff *xfrm4_beet_gso_segment(struct xfrm_state *x, + skb_shinfo(skb)->gso_type |= SKB_GSO_TCPV4; + } + ++ if (proto == IPPROTO_IPV6) ++ skb_shinfo(skb)->gso_type |= SKB_GSO_IPXIP4; ++ + __skb_pull(skb, skb_transport_offset(skb)); + ops = rcu_dereference(inet_offloads[proto]); + if (likely(ops && ops->callbacks.gso_segment)) +diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c +index 4af56affaafd..1c3f02d05d2b 100644 +--- a/net/ipv6/esp6_offload.c ++++ b/net/ipv6/esp6_offload.c +@@ -198,6 +198,9 @@ static struct sk_buff *xfrm6_beet_gso_segment(struct xfrm_state *x, + ipv6_skip_exthdr(skb, 0, &proto, &frag); + } + ++ if (proto == IPPROTO_IPIP) ++ skb_shinfo(skb)->gso_type |= SKB_GSO_IPXIP6; ++ + __skb_pull(skb, skb_transport_offset(skb)); + ops = rcu_dereference(inet6_offloads[proto]); + if (likely(ops && ops->callbacks.gso_segment)) +-- +2.34.1 + diff --git a/queue-5.10/ethernet-fix-error-handling-in-xemaclite_of_probe.patch b/queue-5.10/ethernet-fix-error-handling-in-xemaclite_of_probe.patch new file mode 100644 index 00000000000..6e5ac28dcdf --- /dev/null +++ b/queue-5.10/ethernet-fix-error-handling-in-xemaclite_of_probe.patch @@ -0,0 +1,48 @@ +From b11ca67a5fdb388b39e44230ec6d7c7a65036422 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Mar 2022 02:47:49 +0000 +Subject: ethernet: Fix error handling in xemaclite_of_probe + +From: Miaoqian Lin + +[ Upstream commit b19ab4b38b06aae12442b2de95ccf58b5dc53584 ] + +This node pointer is returned by of_parse_phandle() with refcount +incremented in this function. Calling of_node_put() to avoid the +refcount leak. As the remove function do. + +Fixes: 5cdaaa12866e ("net: emaclite: adding MDIO and phy lib support") +Signed-off-by: Miaoqian Lin +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20220308024751.2320-1-linmq006@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/xilinx/xilinx_emaclite.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c +index 962831cdde4d..4bd44fbc6ecf 100644 +--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c ++++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c +@@ -1187,7 +1187,7 @@ static int xemaclite_of_probe(struct platform_device *ofdev) + if (rc) { + dev_err(dev, + "Cannot register network device, aborting\n"); +- goto error; ++ goto put_node; + } + + dev_info(dev, +@@ -1195,6 +1195,8 @@ static int xemaclite_of_probe(struct platform_device *ofdev) + (unsigned int __force)ndev->mem_start, lp->base_addr, ndev->irq); + return 0; + ++put_node: ++ of_node_put(lp->phy_node); + error: + free_netdev(ndev); + return rc; +-- +2.34.1 + diff --git a/queue-5.10/gianfar-ethtool-fix-refcount-leak-in-gfar_get_ts_inf.patch b/queue-5.10/gianfar-ethtool-fix-refcount-leak-in-gfar_get_ts_inf.patch new file mode 100644 index 00000000000..61098144546 --- /dev/null +++ b/queue-5.10/gianfar-ethtool-fix-refcount-leak-in-gfar_get_ts_inf.patch @@ -0,0 +1,39 @@ +From 4d60408dfc918aec20ebafc96fdfcb95d8955457 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Mar 2022 01:53:13 +0000 +Subject: gianfar: ethtool: Fix refcount leak in gfar_get_ts_info + +From: Miaoqian Lin + +[ Upstream commit 2ac5b58e645c66932438bb021cb5b52097ce70b0 ] + +The of_find_compatible_node() function returns a node pointer with +refcount incremented, We should use of_node_put() on it when done +Add the missing of_node_put() to release the refcount. + +Fixes: 7349a74ea75c ("net: ethernet: gianfar_ethtool: get phc index through drvdata") +Signed-off-by: Miaoqian Lin +Reviewed-by: Jesse Brandeburg +Reviewed-by: Claudiu Manoil +Link: https://lore.kernel.org/r/20220310015313.14938-1-linmq006@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/gianfar_ethtool.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/freescale/gianfar_ethtool.c b/drivers/net/ethernet/freescale/gianfar_ethtool.c +index cc7d4f93da54..799a1486f586 100644 +--- a/drivers/net/ethernet/freescale/gianfar_ethtool.c ++++ b/drivers/net/ethernet/freescale/gianfar_ethtool.c +@@ -1456,6 +1456,7 @@ static int gfar_get_ts_info(struct net_device *dev, + ptp_node = of_find_compatible_node(NULL, NULL, "fsl,etsec-ptp"); + if (ptp_node) { + ptp_dev = of_find_device_by_node(ptp_node); ++ of_node_put(ptp_node); + if (ptp_dev) + ptp = platform_get_drvdata(ptp_dev); + } +-- +2.34.1 + diff --git a/queue-5.10/gpio-return-eprobe_defer-if-gc-to_irq-is-null.patch b/queue-5.10/gpio-return-eprobe_defer-if-gc-to_irq-is-null.patch new file mode 100644 index 00000000000..ed5a9e89b42 --- /dev/null +++ b/queue-5.10/gpio-return-eprobe_defer-if-gc-to_irq-is-null.patch @@ -0,0 +1,72 @@ +From 5ca3f93bdf8040630d378a942f6f88c4d208b2dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Feb 2022 01:56:55 +0530 +Subject: gpio: Return EPROBE_DEFER if gc->to_irq is NULL + +From: Shreeya Patel + +[ Upstream commit ae42f9288846353982e2eab181fb41e7fd8bf60f ] + +We are racing the registering of .to_irq when probing the +i2c driver. This results in random failure of touchscreen +devices. + +Following explains the race condition better. + +[gpio driver] gpio driver registers gpio chip +[gpio consumer] gpio is acquired +[gpio consumer] gpiod_to_irq() fails with -ENXIO +[gpio driver] gpio driver registers irqchip +gpiod_to_irq works at this point, but -ENXIO is fatal + +We could see the following errors in dmesg logs when gc->to_irq is NULL + +[2.101857] i2c_hid i2c-FTS3528:00: HID over i2c has not been provided an Int IRQ +[2.101953] i2c_hid: probe of i2c-FTS3528:00 failed with error -22 + +To avoid this situation, defer probing until to_irq is registered. +Returning -EPROBE_DEFER would be the first step towards avoiding +the failure of devices due to the race in registration of .to_irq. +Final solution to this issue would be to avoid using gc irq members +until they are fully initialized. + +This issue has been reported many times in past and people have been +using workarounds like changing the pinctrl_amd to built-in instead +of loading it as a module or by adding a softdep for pinctrl_amd into +the config file. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=209413 +Reviewed-by: Linus Walleij +Reviewed-by: Andy Shevchenko +Reported-by: kernel test robot +Signed-off-by: Shreeya Patel +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpiolib.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index af5bb8fedfea..00526fdd7691 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -3215,6 +3215,16 @@ int gpiod_to_irq(const struct gpio_desc *desc) + + return retirq; + } ++#ifdef CONFIG_GPIOLIB_IRQCHIP ++ if (gc->irq.chip) { ++ /* ++ * Avoid race condition with other code, which tries to lookup ++ * an IRQ before the irqchip has been properly registered, ++ * i.e. while gpiochip is still being brought up. ++ */ ++ return -EPROBE_DEFER; ++ } ++#endif + return -ENXIO; + } + EXPORT_SYMBOL_GPL(gpiod_to_irq); +-- +2.34.1 + diff --git a/queue-5.10/gpio-ts4900-do-not-set-dat-and-oe-together.patch b/queue-5.10/gpio-ts4900-do-not-set-dat-and-oe-together.patch new file mode 100644 index 00000000000..b1d94d6e1bf --- /dev/null +++ b/queue-5.10/gpio-ts4900-do-not-set-dat-and-oe-together.patch @@ -0,0 +1,82 @@ +From 0014dfa9e9137abb1f5a75cad383f74af39f748f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Mar 2022 17:16:16 -0800 +Subject: gpio: ts4900: Do not set DAT and OE together + +From: Mark Featherston + +[ Upstream commit 03fe003547975680fdb9ff5ab0e41cb68276c4f2 ] + +This works around an issue with the hardware where both OE and +DAT are exposed in the same register. If both are updated +simultaneously, the harware makes no guarantees that OE or DAT +will actually change in any given order and may result in a +glitch of a few ns on a GPIO pin when changing direction and value +in a single write. + +Setting direction to input now only affects OE bit. Setting +direction to output updates DAT first, then OE. + +Fixes: 9c6686322d74 ("gpio: add Technologic I2C-FPGA gpio support") +Signed-off-by: Mark Featherston +Signed-off-by: Kris Bahnsen +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-ts4900.c | 24 +++++++++++++++++++----- + 1 file changed, 19 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpio/gpio-ts4900.c b/drivers/gpio/gpio-ts4900.c +index d885032cf814..d918d2df4de2 100644 +--- a/drivers/gpio/gpio-ts4900.c ++++ b/drivers/gpio/gpio-ts4900.c +@@ -1,7 +1,7 @@ + /* + * Digital I/O driver for Technologic Systems I2C FPGA Core + * +- * Copyright (C) 2015 Technologic Systems ++ * Copyright (C) 2015, 2018 Technologic Systems + * Copyright (C) 2016 Savoir-Faire Linux + * + * This program is free software; you can redistribute it and/or +@@ -55,19 +55,33 @@ static int ts4900_gpio_direction_input(struct gpio_chip *chip, + { + struct ts4900_gpio_priv *priv = gpiochip_get_data(chip); + +- /* +- * This will clear the output enable bit, the other bits are +- * dontcare when this is cleared ++ /* Only clear the OE bit here, requires a RMW. Prevents potential issue ++ * with OE and data getting to the physical pin at different times. + */ +- return regmap_write(priv->regmap, offset, 0); ++ return regmap_update_bits(priv->regmap, offset, TS4900_GPIO_OE, 0); + } + + static int ts4900_gpio_direction_output(struct gpio_chip *chip, + unsigned int offset, int value) + { + struct ts4900_gpio_priv *priv = gpiochip_get_data(chip); ++ unsigned int reg; + int ret; + ++ /* If changing from an input to an output, we need to first set the ++ * proper data bit to what is requested and then set OE bit. This ++ * prevents a glitch that can occur on the IO line ++ */ ++ regmap_read(priv->regmap, offset, ®); ++ if (!(reg & TS4900_GPIO_OE)) { ++ if (value) ++ reg = TS4900_GPIO_OUT; ++ else ++ reg &= ~TS4900_GPIO_OUT; ++ ++ regmap_write(priv->regmap, offset, reg); ++ } ++ + if (value) + ret = regmap_write(priv->regmap, offset, TS4900_GPIO_OE | + TS4900_GPIO_OUT); +-- +2.34.1 + diff --git a/queue-5.10/hid-vivaldi-fix-sysfs-attributes-leak.patch b/queue-5.10/hid-vivaldi-fix-sysfs-attributes-leak.patch new file mode 100644 index 00000000000..1285fbb2cfb --- /dev/null +++ b/queue-5.10/hid-vivaldi-fix-sysfs-attributes-leak.patch @@ -0,0 +1,43 @@ +From 3880dc127314f6a13097f2ed14d723abe04e3771 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Feb 2022 17:18:58 -0800 +Subject: HID: vivaldi: fix sysfs attributes leak + +From: Dmitry Torokhov + +[ Upstream commit cc71d37fd1f11e0495b1cf580909ebea37eaa886 ] + +The driver creates the top row map sysfs attribute in input_configured() +method; unfortunately we do not have a callback that is executed when HID +interface is unbound, thus we are leaking these sysfs attributes, for +example when device is disconnected. + +To fix it let's switch to managed version of adding sysfs attributes which +will ensure that they are destroyed when the driver is unbound. + +Fixes: 14c9c014babe ("HID: add vivaldi HID driver") +Signed-off-by: Dmitry Torokhov +Tested-by: Stephen Boyd +Reviewed-by: Stephen Boyd +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-vivaldi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-vivaldi.c b/drivers/hid/hid-vivaldi.c +index 576518e704ee..d57ec1767037 100644 +--- a/drivers/hid/hid-vivaldi.c ++++ b/drivers/hid/hid-vivaldi.c +@@ -143,7 +143,7 @@ static void vivaldi_feature_mapping(struct hid_device *hdev, + static int vivaldi_input_configured(struct hid_device *hdev, + struct hid_input *hidinput) + { +- return sysfs_create_group(&hdev->dev.kobj, &input_attribute_group); ++ return devm_device_add_group(&hdev->dev, &input_attribute_group); + } + + static const struct hid_device_id vivaldi_table[] = { +-- +2.34.1 + diff --git a/queue-5.10/hwmon-pmbus-clear-pmbus-fault-warning-bits-after-rea.patch b/queue-5.10/hwmon-pmbus-clear-pmbus-fault-warning-bits-after-rea.patch new file mode 100644 index 00000000000..9d8c972b57b --- /dev/null +++ b/queue-5.10/hwmon-pmbus-clear-pmbus-fault-warning-bits-after-rea.patch @@ -0,0 +1,42 @@ +From 46c167c04b7710cb955cbe9e0a5c478e95c8802a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Feb 2022 13:12:53 +0000 +Subject: hwmon: (pmbus) Clear pmbus fault/warning bits after read + +From: Vikash Chandola + +[ Upstream commit 35f165f08950a876f1b95a61d79c93678fba2fd6 ] + +Almost all fault/warning bits in pmbus status registers remain set even +after fault/warning condition are removed. As per pmbus specification +these faults must be cleared by user. +Modify hwmon behavior to clear fault/warning bit after fetching data if +fault/warning bit was set. This allows to get fresh data in next read. + +Signed-off-by: Vikash Chandola +Link: https://lore.kernel.org/r/20220222131253.2426834-1-vikash.chandola@linux.intel.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/pmbus/pmbus_core.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c +index b0e2820a2d57..71798fde2ef0 100644 +--- a/drivers/hwmon/pmbus/pmbus_core.c ++++ b/drivers/hwmon/pmbus/pmbus_core.c +@@ -898,6 +898,11 @@ static int pmbus_get_boolean(struct i2c_client *client, struct pmbus_boolean *b, + pmbus_update_sensor_data(client, s2); + + regval = status & mask; ++ if (regval) { ++ ret = pmbus_write_byte_data(client, page, reg, regval); ++ if (ret) ++ goto unlock; ++ } + if (s1 && s2) { + s64 v1, v2; + +-- +2.34.1 + diff --git a/queue-5.10/i40e-stop-disabling-vfs-due-to-pf-error-responses.patch b/queue-5.10/i40e-stop-disabling-vfs-due-to-pf-error-responses.patch new file mode 100644 index 00000000000..ce7ac97f224 --- /dev/null +++ b/queue-5.10/i40e-stop-disabling-vfs-due-to-pf-error-responses.patch @@ -0,0 +1,238 @@ +From 9630072ba8ef42e981e5f60e8daffe3bf2961ad5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Feb 2022 16:51:35 -0800 +Subject: i40e: stop disabling VFs due to PF error responses + +From: Jacob Keller + +[ Upstream commit 5710ab79166504013f7c0ae6a57e7d2fd26e5c43 ] + +The i40e_vc_send_msg_to_vf_ex (and its wrapper i40e_vc_send_msg_to_vf) +function has logic to detect "failure" responses sent to the VF. If a VF +is sent more than I40E_DEFAULT_NUM_INVALID_MSGS_ALLOWED, then the VF is +marked as disabled. In either case, a dev_info message is printed +stating that a VF opcode failed. + +This logic originates from the early implementation of VF support in +commit 5c3c48ac6bf5 ("i40e: implement virtual device interface"). + +That commit did not go far enough. The "logic" for this behavior seems +to be that error responses somehow indicate a malicious VF. This is not +really true. The PF might be sending an error for any number of reasons +such as lacking resources, an unsupported operation, etc. This does not +indicate a malicious VF. We already have a separate robust malicious VF +detection which relies on hardware logic to detect and prevent a variety +of behaviors. + +There is no justification for this behavior in the original +implementation. In fact, a later commit 18b7af57d9c1 ("i40e: Lower some +message levels") reduced the opcode failure message from a dev_err to a +dev_info. In addition, recent commit 01cbf50877e6 ("i40e: Fix to not +show opcode msg on unsuccessful VF MAC change") changed the logic to +allow quieting it for expected failures. + +That commit prevented this logic from kicking in for specific +circumstances. This change did not go far enough. The behavior is not +documented nor is it part of any requirement for our products. Other +operating systems such as the FreeBSD implementation of our driver do +not include this logic. + +It is clear this check does not make sense, and causes problems which +led to ugly workarounds. + +Fix this by just removing the entire logic and the need for the +i40e_vc_send_msg_to_vf_ex function. + +Fixes: 01cbf50877e6 ("i40e: Fix to not show opcode msg on unsuccessful VF MAC change") +Fixes: 5c3c48ac6bf5 ("i40e: implement virtual device interface") +Signed-off-by: Jacob Keller +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + .../net/ethernet/intel/i40e/i40e_debugfs.c | 6 +- + .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 57 +++---------------- + .../ethernet/intel/i40e/i40e_virtchnl_pf.h | 5 -- + 3 files changed, 9 insertions(+), 59 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c +index 1114a15a9ce3..989d5c7263d7 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c +@@ -742,10 +742,8 @@ static void i40e_dbg_dump_vf(struct i40e_pf *pf, int vf_id) + vsi = pf->vsi[vf->lan_vsi_idx]; + dev_info(&pf->pdev->dev, "vf %2d: VSI id=%d, seid=%d, qps=%d\n", + vf_id, vf->lan_vsi_id, vsi->seid, vf->num_queue_pairs); +- dev_info(&pf->pdev->dev, " num MDD=%lld, invalid msg=%lld, valid msg=%lld\n", +- vf->num_mdd_events, +- vf->num_invalid_msgs, +- vf->num_valid_msgs); ++ dev_info(&pf->pdev->dev, " num MDD=%lld\n", ++ vf->num_mdd_events); + } else { + dev_info(&pf->pdev->dev, "invalid VF id %d\n", vf_id); + } +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index f71b7334e295..9181e007e039 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -1864,19 +1864,17 @@ int i40e_pci_sriov_configure(struct pci_dev *pdev, int num_vfs) + /***********************virtual channel routines******************/ + + /** +- * i40e_vc_send_msg_to_vf_ex ++ * i40e_vc_send_msg_to_vf + * @vf: pointer to the VF info + * @v_opcode: virtual channel opcode + * @v_retval: virtual channel return value + * @msg: pointer to the msg buffer + * @msglen: msg length +- * @is_quiet: true for not printing unsuccessful return values, false otherwise + * + * send msg to VF + **/ +-static int i40e_vc_send_msg_to_vf_ex(struct i40e_vf *vf, u32 v_opcode, +- u32 v_retval, u8 *msg, u16 msglen, +- bool is_quiet) ++static int i40e_vc_send_msg_to_vf(struct i40e_vf *vf, u32 v_opcode, ++ u32 v_retval, u8 *msg, u16 msglen) + { + struct i40e_pf *pf; + struct i40e_hw *hw; +@@ -1891,25 +1889,6 @@ static int i40e_vc_send_msg_to_vf_ex(struct i40e_vf *vf, u32 v_opcode, + hw = &pf->hw; + abs_vf_id = vf->vf_id + hw->func_caps.vf_base_id; + +- /* single place to detect unsuccessful return values */ +- if (v_retval && !is_quiet) { +- vf->num_invalid_msgs++; +- dev_info(&pf->pdev->dev, "VF %d failed opcode %d, retval: %d\n", +- vf->vf_id, v_opcode, v_retval); +- if (vf->num_invalid_msgs > +- I40E_DEFAULT_NUM_INVALID_MSGS_ALLOWED) { +- dev_err(&pf->pdev->dev, +- "Number of invalid messages exceeded for VF %d\n", +- vf->vf_id); +- dev_err(&pf->pdev->dev, "Use PF Control I/F to enable the VF\n"); +- set_bit(I40E_VF_STATE_DISABLED, &vf->vf_states); +- } +- } else { +- vf->num_valid_msgs++; +- /* reset the invalid counter, if a valid message is received. */ +- vf->num_invalid_msgs = 0; +- } +- + aq_ret = i40e_aq_send_msg_to_vf(hw, abs_vf_id, v_opcode, v_retval, + msg, msglen, NULL); + if (aq_ret) { +@@ -1922,23 +1901,6 @@ static int i40e_vc_send_msg_to_vf_ex(struct i40e_vf *vf, u32 v_opcode, + return 0; + } + +-/** +- * i40e_vc_send_msg_to_vf +- * @vf: pointer to the VF info +- * @v_opcode: virtual channel opcode +- * @v_retval: virtual channel return value +- * @msg: pointer to the msg buffer +- * @msglen: msg length +- * +- * send msg to VF +- **/ +-static int i40e_vc_send_msg_to_vf(struct i40e_vf *vf, u32 v_opcode, +- u32 v_retval, u8 *msg, u16 msglen) +-{ +- return i40e_vc_send_msg_to_vf_ex(vf, v_opcode, v_retval, +- msg, msglen, false); +-} +- + /** + * i40e_vc_send_resp_to_vf + * @vf: pointer to the VF info +@@ -2759,7 +2721,6 @@ static int i40e_vc_get_stats_msg(struct i40e_vf *vf, u8 *msg) + * i40e_check_vf_permission + * @vf: pointer to the VF info + * @al: MAC address list from virtchnl +- * @is_quiet: set true for printing msg without opcode info, false otherwise + * + * Check that the given list of MAC addresses is allowed. Will return -EPERM + * if any address in the list is not valid. Checks the following conditions: +@@ -2774,15 +2735,13 @@ static int i40e_vc_get_stats_msg(struct i40e_vf *vf, u8 *msg) + * addresses might not be accurate. + **/ + static inline int i40e_check_vf_permission(struct i40e_vf *vf, +- struct virtchnl_ether_addr_list *al, +- bool *is_quiet) ++ struct virtchnl_ether_addr_list *al) + { + struct i40e_pf *pf = vf->pf; + struct i40e_vsi *vsi = pf->vsi[vf->lan_vsi_idx]; + int mac2add_cnt = 0; + int i; + +- *is_quiet = false; + for (i = 0; i < al->num_elements; i++) { + struct i40e_mac_filter *f; + u8 *addr = al->list[i].addr; +@@ -2806,7 +2765,6 @@ static inline int i40e_check_vf_permission(struct i40e_vf *vf, + !ether_addr_equal(addr, vf->default_lan_addr.addr)) { + dev_err(&pf->pdev->dev, + "VF attempting to override administratively set MAC address, bring down and up the VF interface to resume normal operation\n"); +- *is_quiet = true; + return -EPERM; + } + +@@ -2843,7 +2801,6 @@ static int i40e_vc_add_mac_addr_msg(struct i40e_vf *vf, u8 *msg) + (struct virtchnl_ether_addr_list *)msg; + struct i40e_pf *pf = vf->pf; + struct i40e_vsi *vsi = NULL; +- bool is_quiet = false; + i40e_status ret = 0; + int i; + +@@ -2860,7 +2817,7 @@ static int i40e_vc_add_mac_addr_msg(struct i40e_vf *vf, u8 *msg) + */ + spin_lock_bh(&vsi->mac_filter_hash_lock); + +- ret = i40e_check_vf_permission(vf, al, &is_quiet); ++ ret = i40e_check_vf_permission(vf, al); + if (ret) { + spin_unlock_bh(&vsi->mac_filter_hash_lock); + goto error_param; +@@ -2898,8 +2855,8 @@ static int i40e_vc_add_mac_addr_msg(struct i40e_vf *vf, u8 *msg) + + error_param: + /* send the response to the VF */ +- return i40e_vc_send_msg_to_vf_ex(vf, VIRTCHNL_OP_ADD_ETH_ADDR, +- ret, NULL, 0, is_quiet); ++ return i40e_vc_send_msg_to_vf(vf, VIRTCHNL_OP_ADD_ETH_ADDR, ++ ret, NULL, 0); + } + + /** +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h +index 03c42fd0fea1..a554d0a0b09b 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h +@@ -10,8 +10,6 @@ + + #define I40E_VIRTCHNL_SUPPORTED_QTYPES 2 + +-#define I40E_DEFAULT_NUM_INVALID_MSGS_ALLOWED 10 +- + #define I40E_VLAN_PRIORITY_SHIFT 13 + #define I40E_VLAN_MASK 0xFFF + #define I40E_PRIORITY_MASK 0xE000 +@@ -92,9 +90,6 @@ struct i40e_vf { + u8 num_queue_pairs; /* num of qps assigned to VF vsis */ + u8 num_req_queues; /* num of requested qps */ + u64 num_mdd_events; /* num of mdd events detected */ +- /* num of continuous malformed or invalid msgs detected */ +- u64 num_invalid_msgs; +- u64 num_valid_msgs; /* num of valid msgs detected */ + + unsigned long vf_caps; /* vf's adv. capabilities */ + unsigned long vf_states; /* vf's runtime states */ +-- +2.34.1 + diff --git a/queue-5.10/ice-align-macro-names-to-the-specification.patch b/queue-5.10/ice-align-macro-names-to-the-specification.patch new file mode 100644 index 00000000000..b6f62b08253 --- /dev/null +++ b/queue-5.10/ice-align-macro-names-to-the-specification.patch @@ -0,0 +1,216 @@ +From 93d21dff2df5fe30184c31e8ad781cf64f4b1791 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 15:35:06 -0700 +Subject: ice: Align macro names to the specification + +From: Anirudh Venkataramanan + +[ Upstream commit d6730a871e68f10c786cdee59aebd6f92d49d249 ] + +For get PHY abilities AQ, the specification defines "report modes" +as "with media", "without media" and "active configuration". For +clarity, rename macros to align with the specification. + +Signed-off-by: Anirudh Venkataramanan +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_adminq_cmd.h | 10 +++++----- + drivers/net/ethernet/intel/ice/ice_common.c | 13 +++++++------ + drivers/net/ethernet/intel/ice/ice_ethtool.c | 12 ++++++------ + drivers/net/ethernet/intel/ice/ice_main.c | 12 ++++++------ + 4 files changed, 24 insertions(+), 23 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h +index b06fbe99d8e9..b6dd8f81d699 100644 +--- a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h ++++ b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h +@@ -870,11 +870,11 @@ struct ice_aqc_get_phy_caps { + * 01b - Report topology capabilities + * 10b - Report SW configured + */ +-#define ICE_AQC_REPORT_MODE_S 1 +-#define ICE_AQC_REPORT_MODE_M (3 << ICE_AQC_REPORT_MODE_S) +-#define ICE_AQC_REPORT_NVM_CAP 0 +-#define ICE_AQC_REPORT_TOPO_CAP BIT(1) +-#define ICE_AQC_REPORT_SW_CFG BIT(2) ++#define ICE_AQC_REPORT_MODE_S 1 ++#define ICE_AQC_REPORT_MODE_M (3 << ICE_AQC_REPORT_MODE_S) ++#define ICE_AQC_REPORT_TOPO_CAP_NO_MEDIA 0 ++#define ICE_AQC_REPORT_TOPO_CAP_MEDIA BIT(1) ++#define ICE_AQC_REPORT_ACTIVE_CFG BIT(2) + __le32 reserved1; + __le32 addr_high; + __le32 addr_low; +diff --git a/drivers/net/ethernet/intel/ice/ice_common.c b/drivers/net/ethernet/intel/ice/ice_common.c +index 2b0d0373ab2c..ecdc467c4f6f 100644 +--- a/drivers/net/ethernet/intel/ice/ice_common.c ++++ b/drivers/net/ethernet/intel/ice/ice_common.c +@@ -193,7 +193,7 @@ ice_aq_get_phy_caps(struct ice_port_info *pi, bool qual_mods, u8 report_mode, + ice_debug(hw, ICE_DBG_LINK, " module_type[2] = 0x%x\n", + pcaps->module_type[2]); + +- if (!status && report_mode == ICE_AQC_REPORT_TOPO_CAP) { ++ if (!status && report_mode == ICE_AQC_REPORT_TOPO_CAP_MEDIA) { + pi->phy.phy_type_low = le64_to_cpu(pcaps->phy_type_low); + pi->phy.phy_type_high = le64_to_cpu(pcaps->phy_type_high); + memcpy(pi->phy.link_info.module_type, &pcaps->module_type, +@@ -924,7 +924,8 @@ enum ice_status ice_init_hw(struct ice_hw *hw) + + /* Initialize port_info struct with PHY capabilities */ + status = ice_aq_get_phy_caps(hw->port_info, false, +- ICE_AQC_REPORT_TOPO_CAP, pcaps, NULL); ++ ICE_AQC_REPORT_TOPO_CAP_MEDIA, pcaps, ++ NULL); + devm_kfree(ice_hw_to_dev(hw), pcaps); + if (status) + goto err_unroll_sched; +@@ -2682,7 +2683,7 @@ enum ice_status ice_update_link_info(struct ice_port_info *pi) + if (!pcaps) + return ICE_ERR_NO_MEMORY; + +- status = ice_aq_get_phy_caps(pi, false, ICE_AQC_REPORT_TOPO_CAP, ++ status = ice_aq_get_phy_caps(pi, false, ICE_AQC_REPORT_TOPO_CAP_MEDIA, + pcaps, NULL); + + devm_kfree(ice_hw_to_dev(hw), pcaps); +@@ -2842,8 +2843,8 @@ ice_set_fc(struct ice_port_info *pi, u8 *aq_failures, bool ena_auto_link_update) + return ICE_ERR_NO_MEMORY; + + /* Get the current PHY config */ +- status = ice_aq_get_phy_caps(pi, false, ICE_AQC_REPORT_SW_CFG, pcaps, +- NULL); ++ status = ice_aq_get_phy_caps(pi, false, ICE_AQC_REPORT_ACTIVE_CFG, ++ pcaps, NULL); + if (status) { + *aq_failures = ICE_SET_FC_AQ_FAIL_GET; + goto out; +@@ -2989,7 +2990,7 @@ ice_cfg_phy_fec(struct ice_port_info *pi, struct ice_aqc_set_phy_cfg_data *cfg, + if (!pcaps) + return ICE_ERR_NO_MEMORY; + +- status = ice_aq_get_phy_caps(pi, false, ICE_AQC_REPORT_TOPO_CAP, pcaps, ++ status = ice_aq_get_phy_caps(pi, false, ICE_AQC_REPORT_TOPO_CAP_MEDIA, pcaps, + NULL); + if (status) + goto out; +diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c +index 14eba9bc174d..be02f8f4d854 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c ++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c +@@ -1081,7 +1081,7 @@ ice_get_fecparam(struct net_device *netdev, struct ethtool_fecparam *fecparam) + if (!caps) + return -ENOMEM; + +- status = ice_aq_get_phy_caps(pi, false, ICE_AQC_REPORT_TOPO_CAP, ++ status = ice_aq_get_phy_caps(pi, false, ICE_AQC_REPORT_TOPO_CAP_MEDIA, + caps, NULL); + if (status) { + err = -EAGAIN; +@@ -1976,7 +1976,7 @@ ice_get_link_ksettings(struct net_device *netdev, + return -ENOMEM; + + status = ice_aq_get_phy_caps(vsi->port_info, false, +- ICE_AQC_REPORT_SW_CFG, caps, NULL); ++ ICE_AQC_REPORT_ACTIVE_CFG, caps, NULL); + if (status) { + err = -EIO; + goto done; +@@ -2013,7 +2013,7 @@ ice_get_link_ksettings(struct net_device *netdev, + ethtool_link_ksettings_add_link_mode(ks, advertising, FEC_RS); + + status = ice_aq_get_phy_caps(vsi->port_info, false, +- ICE_AQC_REPORT_TOPO_CAP, caps, NULL); ++ ICE_AQC_REPORT_TOPO_CAP_MEDIA, caps, NULL); + if (status) { + err = -EIO; + goto done; +@@ -2225,7 +2225,7 @@ ice_set_link_ksettings(struct net_device *netdev, + return -ENOMEM; + + /* Get the PHY capabilities based on media */ +- status = ice_aq_get_phy_caps(p, false, ICE_AQC_REPORT_TOPO_CAP, ++ status = ice_aq_get_phy_caps(p, false, ICE_AQC_REPORT_TOPO_CAP_MEDIA, + abilities, NULL); + if (status) { + err = -EAGAIN; +@@ -2954,7 +2954,7 @@ ice_get_pauseparam(struct net_device *netdev, struct ethtool_pauseparam *pause) + return; + + /* Get current PHY config */ +- status = ice_aq_get_phy_caps(pi, false, ICE_AQC_REPORT_SW_CFG, pcaps, ++ status = ice_aq_get_phy_caps(pi, false, ICE_AQC_REPORT_ACTIVE_CFG, pcaps, + NULL); + if (status) + goto out; +@@ -3021,7 +3021,7 @@ ice_set_pauseparam(struct net_device *netdev, struct ethtool_pauseparam *pause) + return -ENOMEM; + + /* Get current PHY config */ +- status = ice_aq_get_phy_caps(pi, false, ICE_AQC_REPORT_SW_CFG, pcaps, ++ status = ice_aq_get_phy_caps(pi, false, ICE_AQC_REPORT_ACTIVE_CFG, pcaps, + NULL); + if (status) { + kfree(pcaps); +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index 6c75df216fa7..20c9d55f3adc 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -726,7 +726,7 @@ void ice_print_link_msg(struct ice_vsi *vsi, bool isup) + } + + status = ice_aq_get_phy_caps(vsi->port_info, false, +- ICE_AQC_REPORT_SW_CFG, caps, NULL); ++ ICE_AQC_REPORT_ACTIVE_CFG, caps, NULL); + if (status) + netdev_info(vsi->netdev, "Get phy capability failed.\n"); + +@@ -1645,7 +1645,7 @@ static int ice_force_phys_link_state(struct ice_vsi *vsi, bool link_up) + if (!pcaps) + return -ENOMEM; + +- retcode = ice_aq_get_phy_caps(pi, false, ICE_AQC_REPORT_SW_CFG, pcaps, ++ retcode = ice_aq_get_phy_caps(pi, false, ICE_AQC_REPORT_ACTIVE_CFG, pcaps, + NULL); + if (retcode) { + dev_err(dev, "Failed to get phy capabilities, VSI %d error %d\n", +@@ -1705,7 +1705,7 @@ static int ice_init_nvm_phy_type(struct ice_port_info *pi) + if (!pcaps) + return -ENOMEM; + +- status = ice_aq_get_phy_caps(pi, false, ICE_AQC_REPORT_NVM_CAP, pcaps, ++ status = ice_aq_get_phy_caps(pi, false, ICE_AQC_REPORT_TOPO_CAP_NO_MEDIA, pcaps, + NULL); + + if (status) { +@@ -1821,7 +1821,7 @@ static int ice_init_phy_user_cfg(struct ice_port_info *pi) + if (!pcaps) + return -ENOMEM; + +- status = ice_aq_get_phy_caps(pi, false, ICE_AQC_REPORT_TOPO_CAP, pcaps, ++ status = ice_aq_get_phy_caps(pi, false, ICE_AQC_REPORT_TOPO_CAP_MEDIA, pcaps, + NULL); + if (status) { + dev_err(ice_pf_to_dev(pf), "Get PHY capability failed.\n"); +@@ -1900,7 +1900,7 @@ static int ice_configure_phy(struct ice_vsi *vsi) + return -ENOMEM; + + /* Get current PHY config */ +- status = ice_aq_get_phy_caps(pi, false, ICE_AQC_REPORT_SW_CFG, pcaps, ++ status = ice_aq_get_phy_caps(pi, false, ICE_AQC_REPORT_ACTIVE_CFG, pcaps, + NULL); + if (status) { + dev_err(dev, "Failed to get PHY configuration, VSI %d error %s\n", +@@ -1918,7 +1918,7 @@ static int ice_configure_phy(struct ice_vsi *vsi) + + /* Use PHY topology as baseline for configuration */ + memset(pcaps, 0, sizeof(*pcaps)); +- status = ice_aq_get_phy_caps(pi, false, ICE_AQC_REPORT_TOPO_CAP, pcaps, ++ status = ice_aq_get_phy_caps(pi, false, ICE_AQC_REPORT_TOPO_CAP_MEDIA, pcaps, + NULL); + if (status) { + dev_err(dev, "Failed to get PHY topology, VSI %d error %s\n", +-- +2.34.1 + diff --git a/queue-5.10/ice-fix-curr_link_speed-advertised-speed.patch b/queue-5.10/ice-fix-curr_link_speed-advertised-speed.patch new file mode 100644 index 00000000000..4762537f3ac --- /dev/null +++ b/queue-5.10/ice-fix-curr_link_speed-advertised-speed.patch @@ -0,0 +1,43 @@ +From be19caae357f08529cc7e9d9285b9fb3b86cd01a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Feb 2022 11:43:04 +0000 +Subject: ice: Fix curr_link_speed advertised speed + +From: Jedrzej Jagielski + +[ Upstream commit ad35ffa252af67d4cc7c744b9377a2b577748e3f ] + +Change curr_link_speed advertised speed, due to +link_info.link_speed is not equal phy.curr_user_speed_req. +Without this patch it is impossible to set advertised +speed to same as link_speed. + +Testing Hints: Try to set advertised speed +to 25G only with 25G default link (use ethtool -s 0x80000000) + +Fixes: 48cb27f2fd18 ("ice: Implement handlers for ethtool PHY/link operations") +Signed-off-by: Grzegorz Siwik +Signed-off-by: Jedrzej Jagielski +Tested-by: Gurucharan (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c +index 0582fca5e07f..421fc707f80a 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c ++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c +@@ -2299,7 +2299,7 @@ ice_set_link_ksettings(struct net_device *netdev, + goto done; + } + +- curr_link_speed = pi->phy.link_info.link_speed; ++ curr_link_speed = pi->phy.curr_user_speed_req; + adv_link_speed = ice_ksettings_find_adv_link_speed(ks); + + /* If speed didn't get set, set it to what it currently is. +-- +2.34.1 + diff --git a/queue-5.10/ice-remove-unnecessary-checker-loop.patch b/queue-5.10/ice-remove-unnecessary-checker-loop.patch new file mode 100644 index 00000000000..1df2f1f5691 --- /dev/null +++ b/queue-5.10/ice-remove-unnecessary-checker-loop.patch @@ -0,0 +1,53 @@ +From 8114d3d89f6688921f7bbc93236c859894c13a18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 15:35:08 -0700 +Subject: ice: Remove unnecessary checker loop + +From: Anirudh Venkataramanan + +[ Upstream commit fd3dc1655eda6173566d56eaeb54f27ab4c9e33c ] + +The loop checking for PF VSI doesn't make any sense. The VSI type +backing the netdev passed to ice_set_link_ksettings will always be +of type ICE_PF_VSI. Remove it. + +Signed-off-by: Anirudh Venkataramanan +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +--------- + 1 file changed, 1 insertion(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c +index be02f8f4d854..300fd5d0ff32 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c ++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c +@@ -2189,8 +2189,8 @@ ice_set_link_ksettings(struct net_device *netdev, + struct ethtool_link_ksettings safe_ks, copy_ks; + struct ice_aqc_get_phy_caps_data *abilities; + u8 autoneg, timeout = TEST_SET_BITS_TIMEOUT; +- u16 adv_link_speed, curr_link_speed, idx; + struct ice_aqc_set_phy_cfg_data config; ++ u16 adv_link_speed, curr_link_speed; + struct ice_pf *pf = np->vsi->back; + struct ice_port_info *p; + u8 autoneg_changed = 0; +@@ -2205,14 +2205,6 @@ ice_set_link_ksettings(struct net_device *netdev, + if (!p) + return -EOPNOTSUPP; + +- /* Check if this is LAN VSI */ +- ice_for_each_vsi(pf, idx) +- if (pf->vsi[idx]->type == ICE_VSI_PF) { +- if (np->vsi != pf->vsi[idx]) +- return -EOPNOTSUPP; +- break; +- } +- + if (p->phy.media_type != ICE_MEDIA_BASET && + p->phy.media_type != ICE_MEDIA_FIBER && + p->phy.media_type != ICE_MEDIA_BACKPLANE && +-- +2.34.1 + diff --git a/queue-5.10/ice-rename-a-couple-of-variables.patch b/queue-5.10/ice-rename-a-couple-of-variables.patch new file mode 100644 index 00000000000..dc25b38b134 --- /dev/null +++ b/queue-5.10/ice-rename-a-couple-of-variables.patch @@ -0,0 +1,163 @@ +From b19765b5b89550c91d85709ed33c3d7de705762c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 15:35:09 -0700 +Subject: ice: Rename a couple of variables + +From: Anirudh Venkataramanan + +[ Upstream commit 0be39bb4c7c8c358f7baf10296db2426f7cf814c ] + +In ice_set_link_ksettings, change 'abilities' to 'phy_caps' and 'p' to +'pi'. This is more consistent with similar usages elsewhere in the +driver. + +Signed-off-by: Anirudh Venkataramanan +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_ethtool.c | 50 ++++++++++---------- + 1 file changed, 25 insertions(+), 25 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c +index 300fd5d0ff32..0582fca5e07f 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c ++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c +@@ -2187,12 +2187,12 @@ ice_set_link_ksettings(struct net_device *netdev, + { + struct ice_netdev_priv *np = netdev_priv(netdev); + struct ethtool_link_ksettings safe_ks, copy_ks; +- struct ice_aqc_get_phy_caps_data *abilities; + u8 autoneg, timeout = TEST_SET_BITS_TIMEOUT; ++ struct ice_aqc_get_phy_caps_data *phy_caps; + struct ice_aqc_set_phy_cfg_data config; + u16 adv_link_speed, curr_link_speed; + struct ice_pf *pf = np->vsi->back; +- struct ice_port_info *p; ++ struct ice_port_info *pi; + u8 autoneg_changed = 0; + enum ice_status status; + u64 phy_type_high = 0; +@@ -2200,25 +2200,25 @@ ice_set_link_ksettings(struct net_device *netdev, + int err = 0; + bool linkup; + +- p = np->vsi->port_info; ++ pi = np->vsi->port_info; + +- if (!p) ++ if (!pi) + return -EOPNOTSUPP; + +- if (p->phy.media_type != ICE_MEDIA_BASET && +- p->phy.media_type != ICE_MEDIA_FIBER && +- p->phy.media_type != ICE_MEDIA_BACKPLANE && +- p->phy.media_type != ICE_MEDIA_DA && +- p->phy.link_info.link_info & ICE_AQ_LINK_UP) ++ if (pi->phy.media_type != ICE_MEDIA_BASET && ++ pi->phy.media_type != ICE_MEDIA_FIBER && ++ pi->phy.media_type != ICE_MEDIA_BACKPLANE && ++ pi->phy.media_type != ICE_MEDIA_DA && ++ pi->phy.link_info.link_info & ICE_AQ_LINK_UP) + return -EOPNOTSUPP; + +- abilities = kzalloc(sizeof(*abilities), GFP_KERNEL); +- if (!abilities) ++ phy_caps = kzalloc(sizeof(*phy_caps), GFP_KERNEL); ++ if (!phy_caps) + return -ENOMEM; + + /* Get the PHY capabilities based on media */ +- status = ice_aq_get_phy_caps(p, false, ICE_AQC_REPORT_TOPO_CAP_MEDIA, +- abilities, NULL); ++ status = ice_aq_get_phy_caps(pi, false, ICE_AQC_REPORT_TOPO_CAP_MEDIA, ++ phy_caps, NULL); + if (status) { + err = -EAGAIN; + goto done; +@@ -2280,26 +2280,26 @@ ice_set_link_ksettings(struct net_device *netdev, + * configuration is initialized during probe from PHY capabilities + * software mode, and updated on set PHY configuration. + */ +- memcpy(&config, &p->phy.curr_user_phy_cfg, sizeof(config)); ++ memcpy(&config, &pi->phy.curr_user_phy_cfg, sizeof(config)); + + config.caps |= ICE_AQ_PHY_ENA_AUTO_LINK_UPDT; + + /* Check autoneg */ +- err = ice_setup_autoneg(p, &safe_ks, &config, autoneg, &autoneg_changed, ++ err = ice_setup_autoneg(pi, &safe_ks, &config, autoneg, &autoneg_changed, + netdev); + + if (err) + goto done; + + /* Call to get the current link speed */ +- p->phy.get_link_info = true; +- status = ice_get_link_status(p, &linkup); ++ pi->phy.get_link_info = true; ++ status = ice_get_link_status(pi, &linkup); + if (status) { + err = -EAGAIN; + goto done; + } + +- curr_link_speed = p->phy.link_info.link_speed; ++ curr_link_speed = pi->phy.link_info.link_speed; + adv_link_speed = ice_ksettings_find_adv_link_speed(ks); + + /* If speed didn't get set, set it to what it currently is. +@@ -2318,7 +2318,7 @@ ice_set_link_ksettings(struct net_device *netdev, + } + + /* save the requested speeds */ +- p->phy.link_info.req_speeds = adv_link_speed; ++ pi->phy.link_info.req_speeds = adv_link_speed; + + /* set link and auto negotiation so changes take effect */ + config.caps |= ICE_AQ_PHY_ENA_LINK; +@@ -2334,9 +2334,9 @@ ice_set_link_ksettings(struct net_device *netdev, + * for set PHY configuration + */ + config.phy_type_high = cpu_to_le64(phy_type_high) & +- abilities->phy_type_high; ++ phy_caps->phy_type_high; + config.phy_type_low = cpu_to_le64(phy_type_low) & +- abilities->phy_type_low; ++ phy_caps->phy_type_low; + + if (!(config.phy_type_high || config.phy_type_low)) { + /* If there is no intersection and lenient mode is enabled, then +@@ -2356,7 +2356,7 @@ ice_set_link_ksettings(struct net_device *netdev, + } + + /* If link is up put link down */ +- if (p->phy.link_info.link_info & ICE_AQ_LINK_UP) { ++ if (pi->phy.link_info.link_info & ICE_AQ_LINK_UP) { + /* Tell the OS link is going down, the link will go + * back up when fw says it is ready asynchronously + */ +@@ -2366,7 +2366,7 @@ ice_set_link_ksettings(struct net_device *netdev, + } + + /* make the aq call */ +- status = ice_aq_set_phy_cfg(&pf->hw, p, &config, NULL); ++ status = ice_aq_set_phy_cfg(&pf->hw, pi, &config, NULL); + if (status) { + netdev_info(netdev, "Set phy config failed,\n"); + err = -EAGAIN; +@@ -2374,9 +2374,9 @@ ice_set_link_ksettings(struct net_device *netdev, + } + + /* Save speed request */ +- p->phy.curr_user_speed_req = adv_link_speed; ++ pi->phy.curr_user_speed_req = adv_link_speed; + done: +- kfree(abilities); ++ kfree(phy_caps); + clear_bit(__ICE_CFG_BUSY, pf->state); + + return err; +-- +2.34.1 + diff --git a/queue-5.10/ice-stop-disabling-vfs-due-to-pf-error-responses.patch b/queue-5.10/ice-stop-disabling-vfs-due-to-pf-error-responses.patch new file mode 100644 index 00000000000..557a6d6f5f7 --- /dev/null +++ b/queue-5.10/ice-stop-disabling-vfs-due-to-pf-error-responses.patch @@ -0,0 +1,108 @@ +From b752817ca13dd15016a130cc809786a7724c754f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Feb 2022 16:51:36 -0800 +Subject: ice: stop disabling VFs due to PF error responses + +From: Jacob Keller + +[ Upstream commit 79498d5af8e458102242d1667cf44df1f1564e63 ] + +The ice_vc_send_msg_to_vf function has logic to detect "failure" +responses being sent to a VF. If a VF is sent more than +ICE_DFLT_NUM_INVAL_MSGS_ALLOWED then the VF is marked as disabled. +Almost identical logic also existed in the i40e driver. + +This logic was added to the ice driver in commit 1071a8358a28 ("ice: +Implement virtchnl commands for AVF support") which itself copied from +the i40e implementation in commit 5c3c48ac6bf5 ("i40e: implement virtual +device interface"). + +Neither commit provides a proper explanation or justification of the +check. In fact, later commits to i40e changed the logic to allow +bypassing the check in some specific instances. + +The "logic" for this seems to be that error responses somehow indicate a +malicious VF. This is not really true. The PF might be sending an error +for any number of reasons such as lack of resources, etc. + +Additionally, this causes the PF to log an info message for every failed +VF response which may confuse users, and can spam the kernel log. + +This behavior is not documented as part of any requirement for our +products and other operating system drivers such as the FreeBSD +implementation of our drivers do not include this type of check. + +In fact, the change from dev_err to dev_info in i40e commit 18b7af57d9c1 +("i40e: Lower some message levels") explains that these messages +typically don't actually indicate a real issue. It is quite likely that +a user who hits this in practice will be very confused as the VF will be +disabled without an obvious way to recover. + +We already have robust malicious driver detection logic using actual +hardware detection mechanisms that detect and prevent invalid device +usage. Remove the logic since its not a documented requirement and the +behavior is not intuitive. + +Fixes: 1071a8358a28 ("ice: Implement virtchnl commands for AVF support") +Signed-off-by: Jacob Keller +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + .../net/ethernet/intel/ice/ice_virtchnl_pf.c | 18 ------------------ + .../net/ethernet/intel/ice/ice_virtchnl_pf.h | 3 --- + 2 files changed, 21 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c +index 48511ad0e0c8..5134342ff70f 100644 +--- a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c +@@ -1849,24 +1849,6 @@ ice_vc_send_msg_to_vf(struct ice_vf *vf, u32 v_opcode, + + dev = ice_pf_to_dev(pf); + +- /* single place to detect unsuccessful return values */ +- if (v_retval) { +- vf->num_inval_msgs++; +- dev_info(dev, "VF %d failed opcode %d, retval: %d\n", vf->vf_id, +- v_opcode, v_retval); +- if (vf->num_inval_msgs > ICE_DFLT_NUM_INVAL_MSGS_ALLOWED) { +- dev_err(dev, "Number of invalid messages exceeded for VF %d\n", +- vf->vf_id); +- dev_err(dev, "Use PF Control I/F to enable the VF\n"); +- set_bit(ICE_VF_STATE_DIS, vf->vf_states); +- return -EIO; +- } +- } else { +- vf->num_valid_msgs++; +- /* reset the invalid counter, if a valid message is received. */ +- vf->num_inval_msgs = 0; +- } +- + aq_ret = ice_aq_send_msg_to_vf(&pf->hw, vf->vf_id, v_opcode, v_retval, + msg, msglen, NULL); + if (aq_ret && pf->hw.mailboxq.sq_last_status != ICE_AQ_RC_ENOSYS) { +diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.h b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.h +index 59e5b4f16e96..d2e935c678a1 100644 +--- a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.h ++++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.h +@@ -13,7 +13,6 @@ + #define ICE_MAX_MACADDR_PER_VF 18 + + /* Malicious Driver Detection */ +-#define ICE_DFLT_NUM_INVAL_MSGS_ALLOWED 10 + #define ICE_MDD_EVENTS_THRESHOLD 30 + + /* Static VF transaction/status register def */ +@@ -97,8 +96,6 @@ struct ice_vf { + unsigned int tx_rate; /* Tx bandwidth limit in Mbps */ + DECLARE_BITMAP(vf_states, ICE_VF_STATES_NBITS); /* VF runtime states */ + +- u64 num_inval_msgs; /* number of continuous invalid msgs */ +- u64 num_valid_msgs; /* number of valid msgs detected */ + unsigned long vf_caps; /* VF's adv. capabilities */ + u8 num_req_qs; /* num of queue pairs requested by VF */ + u16 num_mac; +-- +2.34.1 + diff --git a/queue-5.10/ipv6-prevent-a-possible-race-condition-with-lifetime.patch b/queue-5.10/ipv6-prevent-a-possible-race-condition-with-lifetime.patch new file mode 100644 index 00000000000..af6327d255b --- /dev/null +++ b/queue-5.10/ipv6-prevent-a-possible-race-condition-with-lifetime.patch @@ -0,0 +1,47 @@ +From bc8efc347c499fd9f9f2e38dabf08e0e23457d36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Feb 2022 14:19:56 +0100 +Subject: ipv6: prevent a possible race condition with lifetimes + +From: Niels Dossche + +[ Upstream commit 6c0d8833a605e195ae219b5042577ce52bf71fff ] + +valid_lft, prefered_lft and tstamp are always accessed under the lock +"lock" in other places. Reading these without taking the lock may result +in inconsistencies regarding the calculation of the valid and preferred +variables since decisions are taken on these fields for those variables. + +Signed-off-by: Niels Dossche +Reviewed-by: David Ahern +Signed-off-by: Niels Dossche +Link: https://lore.kernel.org/r/20220223131954.6570-1-niels.dossche@ugent.be +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/addrconf.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index 072c34823753..7c5bf39dca5d 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -4979,6 +4979,7 @@ static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa, + nla_put_s32(skb, IFA_TARGET_NETNSID, args->netnsid)) + goto error; + ++ spin_lock_bh(&ifa->lock); + if (!((ifa->flags&IFA_F_PERMANENT) && + (ifa->prefered_lft == INFINITY_LIFE_TIME))) { + preferred = ifa->prefered_lft; +@@ -5000,6 +5001,7 @@ static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa, + preferred = INFINITY_LIFE_TIME; + valid = INFINITY_LIFE_TIME; + } ++ spin_unlock_bh(&ifa->lock); + + if (!ipv6_addr_any(&ifa->peer_addr)) { + if (nla_put_in6_addr(skb, IFA_LOCAL, &ifa->addr) < 0 || +-- +2.34.1 + diff --git a/queue-5.10/isdn-hfcpci-check-the-return-value-of-dma_set_mask-i.patch b/queue-5.10/isdn-hfcpci-check-the-return-value-of-dma_set_mask-i.patch new file mode 100644 index 00000000000..8cf09c1da8b --- /dev/null +++ b/queue-5.10/isdn-hfcpci-check-the-return-value-of-dma_set_mask-i.patch @@ -0,0 +1,41 @@ +From d32c0de43b7263988a0279ff0f7a57bd0b5bd787 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Mar 2022 00:58:16 -0800 +Subject: isdn: hfcpci: check the return value of dma_set_mask() in setup_hw() + +From: Jia-Ju Bai + +[ Upstream commit d0aeb0d4a3f7d2a0df7e9545892bbeede8f2ac7e ] + +The function dma_set_mask() in setup_hw() can fail, so its return value +should be checked. + +Fixes: 1700fe1a10dc ("Add mISDN HFC PCI driver") +Reported-by: TOTE Robot +Signed-off-by: Jia-Ju Bai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/isdn/hardware/mISDN/hfcpci.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/isdn/hardware/mISDN/hfcpci.c b/drivers/isdn/hardware/mISDN/hfcpci.c +index bd087cca1c1d..af17459c1a5c 100644 +--- a/drivers/isdn/hardware/mISDN/hfcpci.c ++++ b/drivers/isdn/hardware/mISDN/hfcpci.c +@@ -2005,7 +2005,11 @@ setup_hw(struct hfc_pci *hc) + } + /* Allocate memory for FIFOS */ + /* the memory needs to be on a 32k boundary within the first 4G */ +- dma_set_mask(&hc->pdev->dev, 0xFFFF8000); ++ if (dma_set_mask(&hc->pdev->dev, 0xFFFF8000)) { ++ printk(KERN_WARNING ++ "HFC-PCI: No usable DMA configuration!\n"); ++ return -EIO; ++ } + buffer = dma_alloc_coherent(&hc->pdev->dev, 0x8000, &hc->hw.dmahandle, + GFP_KERNEL); + /* We silently assume the address is okay if nonzero */ +-- +2.34.1 + diff --git a/queue-5.10/misdn-fix-memory-leak-in-dsp_pipeline_build.patch b/queue-5.10/misdn-fix-memory-leak-in-dsp_pipeline_build.patch new file mode 100644 index 00000000000..5d59d910422 --- /dev/null +++ b/queue-5.10/misdn-fix-memory-leak-in-dsp_pipeline_build.patch @@ -0,0 +1,52 @@ +From e2f498597d61cb09264d18d47eed0fd1b34da28a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Mar 2022 21:25:36 +0300 +Subject: mISDN: Fix memory leak in dsp_pipeline_build() + +From: Alexey Khoroshilov + +[ Upstream commit c6a502c2299941c8326d029cfc8a3bc8a4607ad5 ] + +dsp_pipeline_build() allocates dup pointer by kstrdup(cfg), +but then it updates dup variable by strsep(&dup, "|"). +As a result when it calls kfree(dup), the dup variable contains NULL. + +Found by Linux Driver Verification project (linuxtesting.org) with SVACE. + +Signed-off-by: Alexey Khoroshilov +Fixes: 960366cf8dbb ("Add mISDN DSP") +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/isdn/mISDN/dsp_pipeline.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/isdn/mISDN/dsp_pipeline.c b/drivers/isdn/mISDN/dsp_pipeline.c +index e11ca6bbc7f4..c3b2c99b5cd5 100644 +--- a/drivers/isdn/mISDN/dsp_pipeline.c ++++ b/drivers/isdn/mISDN/dsp_pipeline.c +@@ -192,7 +192,7 @@ void dsp_pipeline_destroy(struct dsp_pipeline *pipeline) + int dsp_pipeline_build(struct dsp_pipeline *pipeline, const char *cfg) + { + int found = 0; +- char *dup, *tok, *name, *args; ++ char *dup, *next, *tok, *name, *args; + struct dsp_element_entry *entry, *n; + struct dsp_pipeline_entry *pipeline_entry; + struct mISDN_dsp_element *elem; +@@ -203,10 +203,10 @@ int dsp_pipeline_build(struct dsp_pipeline *pipeline, const char *cfg) + if (!list_empty(&pipeline->list)) + _dsp_pipeline_destroy(pipeline); + +- dup = kstrdup(cfg, GFP_ATOMIC); ++ dup = next = kstrdup(cfg, GFP_ATOMIC); + if (!dup) + return 0; +- while ((tok = strsep(&dup, "|"))) { ++ while ((tok = strsep(&next, "|"))) { + if (!strlen(tok)) + continue; + name = strsep(&tok, "("); +-- +2.34.1 + diff --git a/queue-5.10/misdn-remove-obsolete-pipeline_debug-debugging-infor.patch b/queue-5.10/misdn-remove-obsolete-pipeline_debug-debugging-infor.patch new file mode 100644 index 00000000000..3ab19402009 --- /dev/null +++ b/queue-5.10/misdn-remove-obsolete-pipeline_debug-debugging-infor.patch @@ -0,0 +1,164 @@ +From 40f1a993dd8405df29108d4222514f2bae2e4318 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 May 2021 10:14:11 +0800 +Subject: mISDN: Remove obsolete PIPELINE_DEBUG debugging information + +From: Zhen Lei + +[ Upstream commit 2682ea324b000709dafec7e9210caa5189377c45 ] + +As Leon Romanovsky's tips: +The definition of macro PIPELINE_DEBUG is commented more than 10 years ago +and can be seen as a dead code that should be removed. + +Suggested-by: Leon Romanovsky +Signed-off-by: Zhen Lei +Reviewed-by: Leon Romanovsky +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/isdn/mISDN/dsp_pipeline.c | 46 ++----------------------------- + 1 file changed, 2 insertions(+), 44 deletions(-) + +diff --git a/drivers/isdn/mISDN/dsp_pipeline.c b/drivers/isdn/mISDN/dsp_pipeline.c +index 40588692cec7..e11ca6bbc7f4 100644 +--- a/drivers/isdn/mISDN/dsp_pipeline.c ++++ b/drivers/isdn/mISDN/dsp_pipeline.c +@@ -17,9 +17,6 @@ + #include "dsp.h" + #include "dsp_hwec.h" + +-/* uncomment for debugging */ +-/*#define PIPELINE_DEBUG*/ +- + struct dsp_pipeline_entry { + struct mISDN_dsp_element *elem; + void *p; +@@ -104,10 +101,6 @@ int mISDN_dsp_element_register(struct mISDN_dsp_element *elem) + } + } + +-#ifdef PIPELINE_DEBUG +- printk(KERN_DEBUG "%s: %s registered\n", __func__, elem->name); +-#endif +- + return 0; + + err2: +@@ -129,10 +122,6 @@ void mISDN_dsp_element_unregister(struct mISDN_dsp_element *elem) + list_for_each_entry_safe(entry, n, &dsp_elements, list) + if (entry->elem == elem) { + device_unregister(&entry->dev); +-#ifdef PIPELINE_DEBUG +- printk(KERN_DEBUG "%s: %s unregistered\n", +- __func__, elem->name); +-#endif + return; + } + printk(KERN_ERR "%s: element %s not in list.\n", __func__, elem->name); +@@ -145,10 +134,6 @@ int dsp_pipeline_module_init(void) + if (IS_ERR(elements_class)) + return PTR_ERR(elements_class); + +-#ifdef PIPELINE_DEBUG +- printk(KERN_DEBUG "%s: dsp pipeline module initialized\n", __func__); +-#endif +- + dsp_hwec_init(); + + return 0; +@@ -168,10 +153,6 @@ void dsp_pipeline_module_exit(void) + __func__, entry->elem->name); + kfree(entry); + } +- +-#ifdef PIPELINE_DEBUG +- printk(KERN_DEBUG "%s: dsp pipeline module exited\n", __func__); +-#endif + } + + int dsp_pipeline_init(struct dsp_pipeline *pipeline) +@@ -181,10 +162,6 @@ int dsp_pipeline_init(struct dsp_pipeline *pipeline) + + INIT_LIST_HEAD(&pipeline->list); + +-#ifdef PIPELINE_DEBUG +- printk(KERN_DEBUG "%s: dsp pipeline ready\n", __func__); +-#endif +- + return 0; + } + +@@ -210,15 +187,11 @@ void dsp_pipeline_destroy(struct dsp_pipeline *pipeline) + return; + + _dsp_pipeline_destroy(pipeline); +- +-#ifdef PIPELINE_DEBUG +- printk(KERN_DEBUG "%s: dsp pipeline destroyed\n", __func__); +-#endif + } + + int dsp_pipeline_build(struct dsp_pipeline *pipeline, const char *cfg) + { +- int incomplete = 0, found = 0; ++ int found = 0; + char *dup, *tok, *name, *args; + struct dsp_element_entry *entry, *n; + struct dsp_pipeline_entry *pipeline_entry; +@@ -251,7 +224,6 @@ int dsp_pipeline_build(struct dsp_pipeline *pipeline, const char *cfg) + printk(KERN_ERR "%s: failed to add " + "entry to pipeline: %s (out of " + "memory)\n", __func__, elem->name); +- incomplete = 1; + goto _out; + } + pipeline_entry->elem = elem; +@@ -268,20 +240,12 @@ int dsp_pipeline_build(struct dsp_pipeline *pipeline, const char *cfg) + if (pipeline_entry->p) { + list_add_tail(&pipeline_entry-> + list, &pipeline->list); +-#ifdef PIPELINE_DEBUG +- printk(KERN_DEBUG "%s: created " +- "instance of %s%s%s\n", +- __func__, name, args ? +- " with args " : "", args ? +- args : ""); +-#endif + } else { + printk(KERN_ERR "%s: failed " + "to add entry to pipeline: " + "%s (new() returned NULL)\n", + __func__, elem->name); + kfree(pipeline_entry); +- incomplete = 1; + } + } + found = 1; +@@ -290,11 +254,9 @@ int dsp_pipeline_build(struct dsp_pipeline *pipeline, const char *cfg) + + if (found) + found = 0; +- else { ++ else + printk(KERN_ERR "%s: element not found, skipping: " + "%s\n", __func__, name); +- incomplete = 1; +- } + } + + _out: +@@ -303,10 +265,6 @@ int dsp_pipeline_build(struct dsp_pipeline *pipeline, const char *cfg) + else + pipeline->inuse = 0; + +-#ifdef PIPELINE_DEBUG +- printk(KERN_DEBUG "%s: dsp pipeline built%s: %s\n", +- __func__, incomplete ? " incomplete" : "", cfg); +-#endif + kfree(dup); + return 0; + } +-- +2.34.1 + diff --git a/queue-5.10/net-bcmgenet-don-t-claim-wol-when-its-not-available.patch b/queue-5.10/net-bcmgenet-don-t-claim-wol-when-its-not-available.patch new file mode 100644 index 00000000000..479301db68e --- /dev/null +++ b/queue-5.10/net-bcmgenet-don-t-claim-wol-when-its-not-available.patch @@ -0,0 +1,58 @@ +From 5054041cd81e6b129ac20864660a7a249d8c6e3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Mar 2022 22:55:35 -0600 +Subject: net: bcmgenet: Don't claim WOL when its not available + +From: Jeremy Linton + +[ Upstream commit 00b022f8f876a3a036b0df7f971001bef6398605 ] + +Some of the bcmgenet platforms don't correctly support WOL, yet +ethtool returns: + +"Supports Wake-on: gsf" + +which is false. + +Ideally if there isn't a wol_irq, or there is something else that +keeps the device from being able to wakeup it should display: + +"Supports Wake-on: d" + +This patch checks whether the device can wakup, before using the +hard-coded supported flags. This corrects the ethtool reporting, as +well as the WOL configuration because ethtool verifies that the mode +is supported before attempting it. + +Fixes: c51de7f3976b ("net: bcmgenet: add Wake-on-LAN support code") +Signed-off-by: Jeremy Linton +Tested-by: Peter Robinson +Acked-by: Florian Fainelli +Link: https://lore.kernel.org/r/20220310045535.224450-1-jeremy.linton@arm.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c b/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c +index e84ad587fb21..2c2a56d5a0a1 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c +@@ -41,6 +41,13 @@ + void bcmgenet_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol) + { + struct bcmgenet_priv *priv = netdev_priv(dev); ++ struct device *kdev = &priv->pdev->dev; ++ ++ if (!device_can_wakeup(kdev)) { ++ wol->supported = 0; ++ wol->wolopts = 0; ++ return; ++ } + + wol->supported = WAKE_MAGIC | WAKE_MAGICSECURE | WAKE_FILTER; + wol->wolopts = priv->wolopts; +-- +2.34.1 + diff --git a/queue-5.10/net-dsa-mt7530-fix-incorrect-test-in-mt753x_phylink_.patch b/queue-5.10/net-dsa-mt7530-fix-incorrect-test-in-mt753x_phylink_.patch new file mode 100644 index 00000000000..898ef5d2a06 --- /dev/null +++ b/queue-5.10/net-dsa-mt7530-fix-incorrect-test-in-mt753x_phylink_.patch @@ -0,0 +1,37 @@ +From 55667093d11f3822a63837670ca612e27de4d478 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Mar 2022 12:13:30 +0000 +Subject: net: dsa: mt7530: fix incorrect test in mt753x_phylink_validate() + +From: Russell King (Oracle) + +[ Upstream commit e5417cbf7ab5df1632e68fe7d9e6331fc0e7dbd6 ] + +Discussing one of the tests in mt753x_phylink_validate() with Landen +Chao confirms that the "||" should be "&&". Fix this. + +Fixes: c288575f7810 ("net: dsa: mt7530: Add the support of MT7531 switch") +Signed-off-by: Russell King (Oracle) +Link: https://lore.kernel.org/r/E1nRCF0-00CiXD-7q@rmk-PC.armlinux.org.uk +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mt7530.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c +index 1f642fdbf214..5ee8809bc271 100644 +--- a/drivers/net/dsa/mt7530.c ++++ b/drivers/net/dsa/mt7530.c +@@ -2342,7 +2342,7 @@ mt753x_phylink_validate(struct dsa_switch *ds, int port, + + phylink_set_port_modes(mask); + +- if (state->interface != PHY_INTERFACE_MODE_TRGMII || ++ if (state->interface != PHY_INTERFACE_MODE_TRGMII && + !phy_interface_mode_is_8023z(state->interface)) { + phylink_set(mask, 10baseT_Half); + phylink_set(mask, 10baseT_Full); +-- +2.34.1 + diff --git a/queue-5.10/net-ethernet-lpc_eth-handle-error-for-clk_enable.patch b/queue-5.10/net-ethernet-lpc_eth-handle-error-for-clk_enable.patch new file mode 100644 index 00000000000..b06705cc505 --- /dev/null +++ b/queue-5.10/net-ethernet-lpc_eth-handle-error-for-clk_enable.patch @@ -0,0 +1,47 @@ +From a5d7171014f7cb2f8d73c187b88a32045df81603 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Mar 2022 14:57:39 +0800 +Subject: net: ethernet: lpc_eth: Handle error for clk_enable + +From: Jiasheng Jiang + +[ Upstream commit 2169b79258c8be803d2595d6456b1e77129fe154 ] + +As the potential failure of the clk_enable(), +it should be better to check it and return error +if fails. + +Fixes: b7370112f519 ("lpc32xx: Added ethernet driver") +Signed-off-by: Jiasheng Jiang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/nxp/lpc_eth.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c +index 9e098e40fb1c..a9a9bf2e065a 100644 +--- a/drivers/net/ethernet/nxp/lpc_eth.c ++++ b/drivers/net/ethernet/nxp/lpc_eth.c +@@ -1468,6 +1468,7 @@ static int lpc_eth_drv_resume(struct platform_device *pdev) + { + struct net_device *ndev = platform_get_drvdata(pdev); + struct netdata_local *pldat; ++ int ret; + + if (device_may_wakeup(&pdev->dev)) + disable_irq_wake(ndev->irq); +@@ -1477,7 +1478,9 @@ static int lpc_eth_drv_resume(struct platform_device *pdev) + pldat = netdev_priv(ndev); + + /* Enable interface clock */ +- clk_enable(pldat->clk); ++ ret = clk_enable(pldat->clk); ++ if (ret) ++ return ret; + + /* Reset and initialize */ + __lpc_eth_reset(pldat); +-- +2.34.1 + diff --git a/queue-5.10/net-ethernet-ti-cpts-handle-error-for-clk_enable.patch b/queue-5.10/net-ethernet-ti-cpts-handle-error-for-clk_enable.patch new file mode 100644 index 00000000000..04e43a8a97b --- /dev/null +++ b/queue-5.10/net-ethernet-ti-cpts-handle-error-for-clk_enable.patch @@ -0,0 +1,39 @@ +From 704d5e9b621361159e6735b3871a8ee8b5ff4094 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Mar 2022 14:40:07 +0800 +Subject: net: ethernet: ti: cpts: Handle error for clk_enable + +From: Jiasheng Jiang + +[ Upstream commit 6babfc6e6fab068018c36e8f6605184b8c0b349d ] + +As the potential failure of the clk_enable(), +it should be better to check it and return error +if fails. + +Fixes: 8a2c9a5ab4b9 ("net: ethernet: ti: cpts: rework initialization/deinitialization") +Signed-off-by: Jiasheng Jiang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/cpts.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c +index 43222a34cba0..f9514518700e 100644 +--- a/drivers/net/ethernet/ti/cpts.c ++++ b/drivers/net/ethernet/ti/cpts.c +@@ -568,7 +568,9 @@ int cpts_register(struct cpts *cpts) + for (i = 0; i < CPTS_MAX_EVENTS; i++) + list_add(&cpts->pool_data[i].list, &cpts->pool); + +- clk_enable(cpts->refclk); ++ err = clk_enable(cpts->refclk); ++ if (err) ++ return err; + + cpts_write32(cpts, CPTS_EN, control); + cpts_write32(cpts, TS_PEND_EN, int_enable); +-- +2.34.1 + diff --git a/queue-5.10/net-mlx5-fix-a-race-on-command-flush-flow.patch b/queue-5.10/net-mlx5-fix-a-race-on-command-flush-flow.patch new file mode 100644 index 00000000000..d5b6e630ece --- /dev/null +++ b/queue-5.10/net-mlx5-fix-a-race-on-command-flush-flow.patch @@ -0,0 +1,92 @@ +From b1cd4e696882fb36ef7f623f45c3e480e120e467 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Feb 2022 11:47:44 +0200 +Subject: net/mlx5: Fix a race on command flush flow + +From: Moshe Shemesh + +[ Upstream commit 063bd355595428750803d8736a9bb7c8db67d42d ] + +Fix a refcount use after free warning due to a race on command entry. +Such race occurs when one of the commands releases its last refcount and +frees its index and entry while another process running command flush +flow takes refcount to this command entry. The process which handles +commands flush may see this command as needed to be flushed if the other +process released its refcount but didn't release the index yet. Fix it +by adding the needed spin lock. + +It fixes the following warning trace: + +refcount_t: addition on 0; use-after-free. +WARNING: CPU: 11 PID: 540311 at lib/refcount.c:25 refcount_warn_saturate+0x80/0xe0 +... +RIP: 0010:refcount_warn_saturate+0x80/0xe0 +... +Call Trace: + + mlx5_cmd_trigger_completions+0x293/0x340 [mlx5_core] + mlx5_cmd_flush+0x3a/0xf0 [mlx5_core] + enter_error_state+0x44/0x80 [mlx5_core] + mlx5_fw_fatal_reporter_err_work+0x37/0xe0 [mlx5_core] + process_one_work+0x1be/0x390 + worker_thread+0x4d/0x3d0 + ? rescuer_thread+0x350/0x350 + kthread+0x141/0x160 + ? set_kthread_struct+0x40/0x40 + ret_from_fork+0x1f/0x30 + + +Fixes: 50b2412b7e78 ("net/mlx5: Avoid possible free of command entry while timeout comp handler") +Signed-off-by: Moshe Shemesh +Reviewed-by: Eran Ben Elisha +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +index 6af0dd847169..94426d29025e 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +@@ -130,11 +130,8 @@ static int cmd_alloc_index(struct mlx5_cmd *cmd) + + static void cmd_free_index(struct mlx5_cmd *cmd, int idx) + { +- unsigned long flags; +- +- spin_lock_irqsave(&cmd->alloc_lock, flags); ++ lockdep_assert_held(&cmd->alloc_lock); + set_bit(idx, &cmd->bitmask); +- spin_unlock_irqrestore(&cmd->alloc_lock, flags); + } + + static void cmd_ent_get(struct mlx5_cmd_work_ent *ent) +@@ -144,17 +141,21 @@ static void cmd_ent_get(struct mlx5_cmd_work_ent *ent) + + static void cmd_ent_put(struct mlx5_cmd_work_ent *ent) + { ++ struct mlx5_cmd *cmd = ent->cmd; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&cmd->alloc_lock, flags); + if (!refcount_dec_and_test(&ent->refcnt)) +- return; ++ goto out; + + if (ent->idx >= 0) { +- struct mlx5_cmd *cmd = ent->cmd; +- + cmd_free_index(cmd, ent->idx); + up(ent->page_queue ? &cmd->pages_sem : &cmd->sem); + } + + cmd_free_ent(ent); ++out: ++ spin_unlock_irqrestore(&cmd->alloc_lock, flags); + } + + static struct mlx5_cmd_layout *get_inst(struct mlx5_cmd *cmd, int idx) +-- +2.34.1 + diff --git a/queue-5.10/net-mlx5-fix-size-field-in-bufferx_reg-struct.patch b/queue-5.10/net-mlx5-fix-size-field-in-bufferx_reg-struct.patch new file mode 100644 index 00000000000..cc933b0705a --- /dev/null +++ b/queue-5.10/net-mlx5-fix-size-field-in-bufferx_reg-struct.patch @@ -0,0 +1,39 @@ +From e8493d2f71762a584a91af7590e402b77674b342 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 14:38:55 +0200 +Subject: net/mlx5: Fix size field in bufferx_reg struct + +From: Mohammad Kabat + +[ Upstream commit ac77998b7ac3044f0509b097da9637184598980d ] + +According to HW spec the field "size" should be 16 bits +in bufferx register. + +Fixes: e281682bf294 ("net/mlx5_core: HW data structs/types definitions cleanup") +Signed-off-by: Mohammad Kabat +Reviewed-by: Moshe Shemesh +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + include/linux/mlx5/mlx5_ifc.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h +index f5e829e12a76..eba1f1cbc9fb 100644 +--- a/include/linux/mlx5/mlx5_ifc.h ++++ b/include/linux/mlx5/mlx5_ifc.h +@@ -9307,8 +9307,8 @@ struct mlx5_ifc_bufferx_reg_bits { + u8 reserved_at_0[0x6]; + u8 lossy[0x1]; + u8 epsb[0x1]; +- u8 reserved_at_8[0xc]; +- u8 size[0xc]; ++ u8 reserved_at_8[0x8]; ++ u8 size[0x10]; + + u8 xoff_threshold[0x10]; + u8 xon_threshold[0x10]; +-- +2.34.1 + diff --git a/queue-5.10/net-mlx5e-lag-only-handle-events-from-highest-priori.patch b/queue-5.10/net-mlx5e-lag-only-handle-events-from-highest-priori.patch new file mode 100644 index 00000000000..d9b78f8cb77 --- /dev/null +++ b/queue-5.10/net-mlx5e-lag-only-handle-events-from-highest-priori.patch @@ -0,0 +1,59 @@ +From bfad8b39035884421662f6d34d1aed6043530e96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Feb 2022 13:56:57 +0200 +Subject: net/mlx5e: Lag, Only handle events from highest priority multipath + entry + +From: Roi Dayan + +[ Upstream commit ad11c4f1d8fd1f03639460e425a36f7fd0ea83f5 ] + +There could be multiple multipath entries but changing the port affinity +for each one doesn't make much sense and there should be a default one. +So only track the entry with lowest priority value. +The commit doesn't affect existing users with a single entry. + +Fixes: 544fe7c2e654 ("net/mlx5e: Activate HW multipath and handle port affinity based on FIB events") +Signed-off-by: Roi Dayan +Reviewed-by: Maor Dickman +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c b/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c +index 0f0d250bbc15..c04413f449c5 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c +@@ -123,6 +123,10 @@ static void mlx5_lag_fib_route_event(struct mlx5_lag *ldev, + return; + } + ++ /* Handle multipath entry with lower priority value */ ++ if (mp->mfi && mp->mfi != fi && fi->fib_priority >= mp->mfi->fib_priority) ++ return; ++ + /* Handle add/replace event */ + nhs = fib_info_num_path(fi); + if (nhs == 1) { +@@ -132,12 +136,13 @@ static void mlx5_lag_fib_route_event(struct mlx5_lag *ldev, + int i = mlx5_lag_dev_get_netdev_idx(ldev, nh_dev); + + if (i < 0) +- i = MLX5_LAG_NORMAL_AFFINITY; +- else +- ++i; ++ return; + ++ i++; + mlx5_lag_set_port_affinity(ldev, i); + } ++ ++ mp->mfi = fi; + return; + } + +-- +2.34.1 + diff --git a/queue-5.10/net-phy-dp83822-clear-misr2-register-to-disable-inte.patch b/queue-5.10/net-phy-dp83822-clear-misr2-register-to-disable-inte.patch new file mode 100644 index 00000000000..663248f947b --- /dev/null +++ b/queue-5.10/net-phy-dp83822-clear-misr2-register-to-disable-inte.patch @@ -0,0 +1,43 @@ +From 6cad200500b4316e8edeab3d59a7c4c5c6a24e8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Mar 2022 15:22:28 +0100 +Subject: net: phy: DP83822: clear MISR2 register to disable interrupts +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Clément Léger + +[ Upstream commit 37c9d66c95564c85a001d8a035354f0220a1e1c3 ] + +MISR1 was cleared twice but the original author intention was probably +to clear MISR1 & MISR2 to completely disable interrupts. Fix it to +clear MISR2. + +Fixes: 87461f7a58ab ("net: phy: DP83822 initial driver submission") +Signed-off-by: Clément Léger +Reviewed-by: Andrew Lunn +Reviewed-by: Florian Fainelli +Link: https://lore.kernel.org/r/20220309142228.761153-1-clement.leger@bootlin.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/dp83822.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/phy/dp83822.c b/drivers/net/phy/dp83822.c +index 7bf43031cea8..3d75b98f3051 100644 +--- a/drivers/net/phy/dp83822.c ++++ b/drivers/net/phy/dp83822.c +@@ -289,7 +289,7 @@ static int dp83822_config_intr(struct phy_device *phydev) + if (err < 0) + return err; + +- err = phy_write(phydev, MII_DP83822_MISR1, 0); ++ err = phy_write(phydev, MII_DP83822_MISR2, 0); + if (err < 0) + return err; + +-- +2.34.1 + diff --git a/queue-5.10/net-qlogic-check-the-return-value-of-dma_alloc_coher.patch b/queue-5.10/net-qlogic-check-the-return-value-of-dma_alloc_coher.patch new file mode 100644 index 00000000000..33894adbcb9 --- /dev/null +++ b/queue-5.10/net-qlogic-check-the-return-value-of-dma_alloc_coher.patch @@ -0,0 +1,50 @@ +From e4eedeb689b1b42d6bb91e36950f2318e6058f1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Mar 2022 01:14:11 -0800 +Subject: net: qlogic: check the return value of dma_alloc_coherent() in + qed_vf_hw_prepare() + +From: Jia-Ju Bai + +[ Upstream commit e0058f0fa80f6e09c4d363779c241c45a3c56b94 ] + +The function dma_alloc_coherent() in qed_vf_hw_prepare() can fail, so +its return value should be checked. + +Fixes: 1408cc1fa48c ("qed: Introduce VFs") +Reported-by: TOTE Robot +Signed-off-by: Jia-Ju Bai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_vf.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_vf.c b/drivers/net/ethernet/qlogic/qed/qed_vf.c +index 72a38d53d33f..e2a5a6a373cb 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_vf.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_vf.c +@@ -513,6 +513,9 @@ int qed_vf_hw_prepare(struct qed_hwfn *p_hwfn) + p_iov->bulletin.size, + &p_iov->bulletin.phys, + GFP_KERNEL); ++ if (!p_iov->bulletin.p_virt) ++ goto free_pf2vf_reply; ++ + DP_VERBOSE(p_hwfn, QED_MSG_IOV, + "VF's bulletin Board [%p virt 0x%llx phys 0x%08x bytes]\n", + p_iov->bulletin.p_virt, +@@ -552,6 +555,10 @@ int qed_vf_hw_prepare(struct qed_hwfn *p_hwfn) + + return rc; + ++free_pf2vf_reply: ++ dma_free_coherent(&p_hwfn->cdev->pdev->dev, ++ sizeof(union pfvf_tlvs), ++ p_iov->pf2vf_reply, p_iov->pf2vf_reply_phys); + free_vf2pf_request: + dma_free_coherent(&p_hwfn->cdev->pdev->dev, + sizeof(union vfpf_tlvs), +-- +2.34.1 + diff --git a/queue-5.10/net-sysfs-add-check-for-netdevice-being-present-to-s.patch b/queue-5.10/net-sysfs-add-check-for-netdevice-being-present-to-s.patch new file mode 100644 index 00000000000..f868ac32fc3 --- /dev/null +++ b/queue-5.10/net-sysfs-add-check-for-netdevice-being-present-to-s.patch @@ -0,0 +1,78 @@ +From b13112d600da1d92944b5a789ae1d67b367e6e84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Feb 2022 07:25:18 +0530 +Subject: net-sysfs: add check for netdevice being present to speed_show + +From: suresh kumar + +[ Upstream commit 4224cfd7fb6523f7a9d1c8bb91bb5df1e38eb624 ] + +When bringing down the netdevice or system shutdown, a panic can be +triggered while accessing the sysfs path because the device is already +removed. + + [ 755.549084] mlx5_core 0000:12:00.1: Shutdown was called + [ 756.404455] mlx5_core 0000:12:00.0: Shutdown was called + ... + [ 757.937260] BUG: unable to handle kernel NULL pointer dereference at (null) + [ 758.031397] IP: [] dma_pool_alloc+0x1ab/0x280 + + crash> bt + ... + PID: 12649 TASK: ffff8924108f2100 CPU: 1 COMMAND: "amsd" + ... + #9 [ffff89240e1a38b0] page_fault at ffffffff8f38c778 + [exception RIP: dma_pool_alloc+0x1ab] + RIP: ffffffff8ee11acb RSP: ffff89240e1a3968 RFLAGS: 00010046 + RAX: 0000000000000246 RBX: ffff89243d874100 RCX: 0000000000001000 + RDX: 0000000000000000 RSI: 0000000000000246 RDI: ffff89243d874090 + RBP: ffff89240e1a39c0 R8: 000000000001f080 R9: ffff8905ffc03c00 + R10: ffffffffc04680d4 R11: ffffffff8edde9fd R12: 00000000000080d0 + R13: ffff89243d874090 R14: ffff89243d874080 R15: 0000000000000000 + ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 + #10 [ffff89240e1a39c8] mlx5_alloc_cmd_msg at ffffffffc04680f3 [mlx5_core] + #11 [ffff89240e1a3a18] cmd_exec at ffffffffc046ad62 [mlx5_core] + #12 [ffff89240e1a3ab8] mlx5_cmd_exec at ffffffffc046b4fb [mlx5_core] + #13 [ffff89240e1a3ae8] mlx5_core_access_reg at ffffffffc0475434 [mlx5_core] + #14 [ffff89240e1a3b40] mlx5e_get_fec_caps at ffffffffc04a7348 [mlx5_core] + #15 [ffff89240e1a3bb0] get_fec_supported_advertised at ffffffffc04992bf [mlx5_core] + #16 [ffff89240e1a3c08] mlx5e_get_link_ksettings at ffffffffc049ab36 [mlx5_core] + #17 [ffff89240e1a3ce8] __ethtool_get_link_ksettings at ffffffff8f25db46 + #18 [ffff89240e1a3d48] speed_show at ffffffff8f277208 + #19 [ffff89240e1a3dd8] dev_attr_show at ffffffff8f0b70e3 + #20 [ffff89240e1a3df8] sysfs_kf_seq_show at ffffffff8eedbedf + #21 [ffff89240e1a3e18] kernfs_seq_show at ffffffff8eeda596 + #22 [ffff89240e1a3e28] seq_read at ffffffff8ee76d10 + #23 [ffff89240e1a3e98] kernfs_fop_read at ffffffff8eedaef5 + #24 [ffff89240e1a3ed8] vfs_read at ffffffff8ee4e3ff + #25 [ffff89240e1a3f08] sys_read at ffffffff8ee4f27f + #26 [ffff89240e1a3f50] system_call_fastpath at ffffffff8f395f92 + + crash> net_device.state ffff89443b0c0000 + state = 0x5 (__LINK_STATE_START| __LINK_STATE_NOCARRIER) + +To prevent this scenario, we also make sure that the netdevice is present. + +Signed-off-by: suresh kumar +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/net-sysfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c +index 99303897b7bb..989b3f7ee85f 100644 +--- a/net/core/net-sysfs.c ++++ b/net/core/net-sysfs.c +@@ -213,7 +213,7 @@ static ssize_t speed_show(struct device *dev, + if (!rtnl_trylock()) + return restart_syscall(); + +- if (netif_running(netdev)) { ++ if (netif_running(netdev) && netif_device_present(netdev)) { + struct ethtool_link_ksettings cmd; + + if (!__ethtool_get_link_ksettings(netdev, &cmd)) +-- +2.34.1 + diff --git a/queue-5.10/nfc-port100-fix-use-after-free-in-port100_send_compl.patch b/queue-5.10/nfc-port100-fix-use-after-free-in-port100_send_compl.patch new file mode 100644 index 00000000000..a15663b6b80 --- /dev/null +++ b/queue-5.10/nfc-port100-fix-use-after-free-in-port100_send_compl.patch @@ -0,0 +1,86 @@ +From fc603e1d8a3f9f8f790df65862535e0db79777c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Mar 2022 21:50:07 +0300 +Subject: NFC: port100: fix use-after-free in port100_send_complete + +From: Pavel Skripkin + +[ Upstream commit f80cfe2f26581f188429c12bd937eb905ad3ac7b ] + +Syzbot reported UAF in port100_send_complete(). The root case is in +missing usb_kill_urb() calls on error handling path of ->probe function. + +port100_send_complete() accesses devm allocated memory which will be +freed on probe failure. We should kill this urbs before returning an +error from probe function to prevent reported use-after-free + +Fail log: + +BUG: KASAN: use-after-free in port100_send_complete+0x16e/0x1a0 drivers/nfc/port100.c:935 +Read of size 1 at addr ffff88801bb59540 by task ksoftirqd/2/26 +... +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 + print_address_description.constprop.0.cold+0x8d/0x303 mm/kasan/report.c:255 + __kasan_report mm/kasan/report.c:442 [inline] + kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 + port100_send_complete+0x16e/0x1a0 drivers/nfc/port100.c:935 + __usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1670 + +... + +Allocated by task 1255: + kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 + kasan_set_track mm/kasan/common.c:45 [inline] + set_alloc_info mm/kasan/common.c:436 [inline] + ____kasan_kmalloc mm/kasan/common.c:515 [inline] + ____kasan_kmalloc mm/kasan/common.c:474 [inline] + __kasan_kmalloc+0xa6/0xd0 mm/kasan/common.c:524 + alloc_dr drivers/base/devres.c:116 [inline] + devm_kmalloc+0x96/0x1d0 drivers/base/devres.c:823 + devm_kzalloc include/linux/device.h:209 [inline] + port100_probe+0x8a/0x1320 drivers/nfc/port100.c:1502 + +Freed by task 1255: + kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 + kasan_set_track+0x21/0x30 mm/kasan/common.c:45 + kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 + ____kasan_slab_free mm/kasan/common.c:366 [inline] + ____kasan_slab_free+0xff/0x140 mm/kasan/common.c:328 + kasan_slab_free include/linux/kasan.h:236 [inline] + __cache_free mm/slab.c:3437 [inline] + kfree+0xf8/0x2b0 mm/slab.c:3794 + release_nodes+0x112/0x1a0 drivers/base/devres.c:501 + devres_release_all+0x114/0x190 drivers/base/devres.c:530 + really_probe+0x626/0xcc0 drivers/base/dd.c:670 + +Reported-and-tested-by: syzbot+16bcb127fb73baeecb14@syzkaller.appspotmail.com +Fixes: 0347a6ab300a ("NFC: port100: Commands mechanism implementation") +Signed-off-by: Pavel Skripkin +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20220308185007.6987-1-paskripkin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/nfc/port100.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/nfc/port100.c b/drivers/nfc/port100.c +index 1caebefb25ff..2ae1474faede 100644 +--- a/drivers/nfc/port100.c ++++ b/drivers/nfc/port100.c +@@ -1609,7 +1609,9 @@ static int port100_probe(struct usb_interface *interface, + nfc_digital_free_device(dev->nfc_digital_dev); + + error: ++ usb_kill_urb(dev->in_urb); + usb_free_urb(dev->in_urb); ++ usb_kill_urb(dev->out_urb); + usb_free_urb(dev->out_urb); + usb_put_dev(dev->udev); + +-- +2.34.1 + diff --git a/queue-5.10/qed-return-status-of-qed_iov_get_link.patch b/queue-5.10/qed-return-status-of-qed_iov_get_link.patch new file mode 100644 index 00000000000..c59be3c488f --- /dev/null +++ b/queue-5.10/qed-return-status-of-qed_iov_get_link.patch @@ -0,0 +1,87 @@ +From bc71da6a655167a3107fadb942c38aff182c1354 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Mar 2022 07:06:42 -0800 +Subject: qed: return status of qed_iov_get_link + +From: Tom Rix + +[ Upstream commit d9dc0c84ad2d4cc911ba252c973d1bf18d5eb9cf ] + +Clang static analysis reports this issue +qed_sriov.c:4727:19: warning: Assigned value is + garbage or undefined + ivi->max_tx_rate = tx_rate ? tx_rate : link.speed; + ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +link is only sometimes set by the call to qed_iov_get_link() +qed_iov_get_link fails without setting link or returning +status. So change the decl to return status. + +Fixes: 73390ac9d82b ("qed*: support ndo_get_vf_config") +Signed-off-by: Tom Rix +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_sriov.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +index b8dc5c4591ef..ef0ad4cf82e6 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +@@ -3778,11 +3778,11 @@ bool qed_iov_mark_vf_flr(struct qed_hwfn *p_hwfn, u32 *p_disabled_vfs) + return found; + } + +-static void qed_iov_get_link(struct qed_hwfn *p_hwfn, +- u16 vfid, +- struct qed_mcp_link_params *p_params, +- struct qed_mcp_link_state *p_link, +- struct qed_mcp_link_capabilities *p_caps) ++static int qed_iov_get_link(struct qed_hwfn *p_hwfn, ++ u16 vfid, ++ struct qed_mcp_link_params *p_params, ++ struct qed_mcp_link_state *p_link, ++ struct qed_mcp_link_capabilities *p_caps) + { + struct qed_vf_info *p_vf = qed_iov_get_vf_info(p_hwfn, + vfid, +@@ -3790,7 +3790,7 @@ static void qed_iov_get_link(struct qed_hwfn *p_hwfn, + struct qed_bulletin_content *p_bulletin; + + if (!p_vf) +- return; ++ return -EINVAL; + + p_bulletin = p_vf->bulletin.p_virt; + +@@ -3800,6 +3800,7 @@ static void qed_iov_get_link(struct qed_hwfn *p_hwfn, + __qed_vf_get_link_state(p_hwfn, p_link, p_bulletin); + if (p_caps) + __qed_vf_get_link_caps(p_hwfn, p_caps, p_bulletin); ++ return 0; + } + + static int +@@ -4658,6 +4659,7 @@ static int qed_get_vf_config(struct qed_dev *cdev, + struct qed_public_vf_info *vf_info; + struct qed_mcp_link_state link; + u32 tx_rate; ++ int ret; + + /* Sanitize request */ + if (IS_VF(cdev)) +@@ -4671,7 +4673,9 @@ static int qed_get_vf_config(struct qed_dev *cdev, + + vf_info = qed_iov_get_public_vf_info(hwfn, vf_id, true); + +- qed_iov_get_link(hwfn, vf_id, NULL, &link, NULL); ++ ret = qed_iov_get_link(hwfn, vf_id, NULL, &link, NULL); ++ if (ret) ++ return ret; + + /* Fill information about VF */ + ivi->vf = vf_id; +-- +2.34.1 + diff --git a/queue-5.10/revert-xen-netback-check-for-hotplug-status-existenc.patch b/queue-5.10/revert-xen-netback-check-for-hotplug-status-existenc.patch new file mode 100644 index 00000000000..78aaa9e2d47 --- /dev/null +++ b/queue-5.10/revert-xen-netback-check-for-hotplug-status-existenc.patch @@ -0,0 +1,68 @@ +From 5bd821fc146ebb3c49991edc4fa828dbb53bf95d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Feb 2022 01:18:17 +0100 +Subject: Revert "xen-netback: Check for hotplug-status existence before + watching" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Marczykowski-Górecki + +[ Upstream commit e8240addd0a3919e0fd7436416afe9aa6429c484 ] + +This reverts commit 2afeec08ab5c86ae21952151f726bfe184f6b23d. + +The reasoning in the commit was wrong - the code expected to setup the +watch even if 'hotplug-status' didn't exist. In fact, it relied on the +watch being fired the first time - to check if maybe 'hotplug-status' is +already set to 'connected'. Not registering a watch for non-existing +path (which is the case if hotplug script hasn't been executed yet), +made the backend not waiting for the hotplug script to execute. This in +turns, made the netfront think the interface is fully operational, while +in fact it was not (the vif interface on xen-netback side might not be +configured yet). + +This was a workaround for 'hotplug-status' erroneously being removed. +But since that is reverted now, the workaround is not necessary either. + +More discussion at +https://lore.kernel.org/xen-devel/afedd7cb-a291-e773-8b0d-4db9b291fa98@ipxe.org/T/#u + +Signed-off-by: Marek Marczykowski-Górecki +Reviewed-by: Paul Durrant +Reviewed-by: Michael Brown +Link: https://lore.kernel.org/r/20220222001817.2264967-2-marmarek@invisiblethingslab.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/xen-netback/xenbus.c | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c +index 7acf3940dc1f..ca261e0fc9c9 100644 +--- a/drivers/net/xen-netback/xenbus.c ++++ b/drivers/net/xen-netback/xenbus.c +@@ -824,15 +824,11 @@ static void connect(struct backend_info *be) + xenvif_carrier_on(be->vif); + + unregister_hotplug_status_watch(be); +- if (xenbus_exists(XBT_NIL, dev->nodename, "hotplug-status")) { +- err = xenbus_watch_pathfmt(dev, &be->hotplug_status_watch, +- NULL, hotplug_status_changed, +- "%s/%s", dev->nodename, +- "hotplug-status"); +- if (err) +- goto err; ++ err = xenbus_watch_pathfmt(dev, &be->hotplug_status_watch, NULL, ++ hotplug_status_changed, ++ "%s/%s", dev->nodename, "hotplug-status"); ++ if (!err) + be->have_hotplug_status_watch = 1; +- } + + netif_tx_wake_all_queues(be->vif->dev); + +-- +2.34.1 + diff --git a/queue-5.10/revert-xen-netback-remove-hotplug-status-once-it-has.patch b/queue-5.10/revert-xen-netback-remove-hotplug-status-once-it-has.patch new file mode 100644 index 00000000000..851679a5527 --- /dev/null +++ b/queue-5.10/revert-xen-netback-remove-hotplug-status-once-it-has.patch @@ -0,0 +1,66 @@ +From 7056f5e5f3b77f24bffa5156d150675b36332cbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Feb 2022 01:18:16 +0100 +Subject: Revert "xen-netback: remove 'hotplug-status' once it has served its + purpose" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Marczykowski-Górecki + +[ Upstream commit 0f4558ae91870692ce7f509c31c9d6ee721d8cdc ] + +This reverts commit 1f2565780e9b7218cf92c7630130e82dcc0fe9c2. + +The 'hotplug-status' node should not be removed as long as the vif +device remains configured. Otherwise the xen-netback would wait for +re-running the network script even if it was already called (in case of +the frontent re-connecting). But also, it _should_ be removed when the +vif device is destroyed (for example when unbinding the driver) - +otherwise hotplug script would not configure the device whenever it +re-appear. + +Moving removal of the 'hotplug-status' node was a workaround for nothing +calling network script after xen-netback module is reloaded. But when +vif interface is re-created (on xen-netback unbind/bind for example), +the script should be called, regardless of who does that - currently +this case is not handled by the toolstack, and requires manual +script call. Keeping hotplug-status=connected to skip the call is wrong +and leads to not configured interface. + +More discussion at +https://lore.kernel.org/xen-devel/afedd7cb-a291-e773-8b0d-4db9b291fa98@ipxe.org/T/#u + +Signed-off-by: Marek Marczykowski-Górecki +Reviewed-by: Paul Durrant +Link: https://lore.kernel.org/r/20220222001817.2264967-1-marmarek@invisiblethingslab.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/xen-netback/xenbus.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c +index 94d19158efc1..7acf3940dc1f 100644 +--- a/drivers/net/xen-netback/xenbus.c ++++ b/drivers/net/xen-netback/xenbus.c +@@ -256,6 +256,7 @@ static void backend_disconnect(struct backend_info *be) + unsigned int queue_index; + + xen_unregister_watchers(vif); ++ xenbus_rm(XBT_NIL, be->dev->nodename, "hotplug-status"); + #ifdef CONFIG_DEBUG_FS + xenvif_debugfs_delif(vif); + #endif /* CONFIG_DEBUG_FS */ +@@ -675,7 +676,6 @@ static void hotplug_status_changed(struct xenbus_watch *watch, + + /* Not interested in this watch anymore. */ + unregister_hotplug_status_watch(be); +- xenbus_rm(XBT_NIL, be->dev->nodename, "hotplug-status"); + } + kfree(str); + } +-- +2.34.1 + diff --git a/queue-5.10/sctp-fix-kernel-infoleak-for-sctp-sockets.patch b/queue-5.10/sctp-fix-kernel-infoleak-for-sctp-sockets.patch new file mode 100644 index 00000000000..8214708343d --- /dev/null +++ b/queue-5.10/sctp-fix-kernel-infoleak-for-sctp-sockets.patch @@ -0,0 +1,128 @@ +From f4c0be247204da2022103104b2c6258844a2a550 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Mar 2022 16:11:45 -0800 +Subject: sctp: fix kernel-infoleak for SCTP sockets + +From: Eric Dumazet + +[ Upstream commit 633593a808980f82d251d0ca89730d8bb8b0220c ] + +syzbot reported a kernel infoleak [1] of 4 bytes. + +After analysis, it turned out r->idiag_expires is not initialized +if inet_sctp_diag_fill() calls inet_diag_msg_common_fill() + +Make sure to clear idiag_timer/idiag_retrans/idiag_expires +and let inet_diag_msg_sctpasoc_fill() fill them again if needed. + +[1] + +BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline] +BUG: KMSAN: kernel-infoleak in copyout lib/iov_iter.c:154 [inline] +BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x6ef/0x25a0 lib/iov_iter.c:668 + instrument_copy_to_user include/linux/instrumented.h:121 [inline] + copyout lib/iov_iter.c:154 [inline] + _copy_to_iter+0x6ef/0x25a0 lib/iov_iter.c:668 + copy_to_iter include/linux/uio.h:162 [inline] + simple_copy_to_iter+0xf3/0x140 net/core/datagram.c:519 + __skb_datagram_iter+0x2d5/0x11b0 net/core/datagram.c:425 + skb_copy_datagram_iter+0xdc/0x270 net/core/datagram.c:533 + skb_copy_datagram_msg include/linux/skbuff.h:3696 [inline] + netlink_recvmsg+0x669/0x1c80 net/netlink/af_netlink.c:1977 + sock_recvmsg_nosec net/socket.c:948 [inline] + sock_recvmsg net/socket.c:966 [inline] + __sys_recvfrom+0x795/0xa10 net/socket.c:2097 + __do_sys_recvfrom net/socket.c:2115 [inline] + __se_sys_recvfrom net/socket.c:2111 [inline] + __x64_sys_recvfrom+0x19d/0x210 net/socket.c:2111 + do_syscall_x64 arch/x86/entry/common.c:51 [inline] + do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Uninit was created at: + slab_post_alloc_hook mm/slab.h:737 [inline] + slab_alloc_node mm/slub.c:3247 [inline] + __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4975 + kmalloc_reserve net/core/skbuff.c:354 [inline] + __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 + alloc_skb include/linux/skbuff.h:1158 [inline] + netlink_dump+0x3e5/0x16c0 net/netlink/af_netlink.c:2248 + __netlink_dump_start+0xcf8/0xe90 net/netlink/af_netlink.c:2373 + netlink_dump_start include/linux/netlink.h:254 [inline] + inet_diag_handler_cmd+0x2e7/0x400 net/ipv4/inet_diag.c:1341 + sock_diag_rcv_msg+0x24a/0x620 + netlink_rcv_skb+0x40c/0x7e0 net/netlink/af_netlink.c:2494 + sock_diag_rcv+0x63/0x80 net/core/sock_diag.c:277 + netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline] + netlink_unicast+0x1093/0x1360 net/netlink/af_netlink.c:1343 + netlink_sendmsg+0x14d9/0x1720 net/netlink/af_netlink.c:1919 + sock_sendmsg_nosec net/socket.c:705 [inline] + sock_sendmsg net/socket.c:725 [inline] + sock_write_iter+0x594/0x690 net/socket.c:1061 + do_iter_readv_writev+0xa7f/0xc70 + do_iter_write+0x52c/0x1500 fs/read_write.c:851 + vfs_writev fs/read_write.c:924 [inline] + do_writev+0x645/0xe00 fs/read_write.c:967 + __do_sys_writev fs/read_write.c:1040 [inline] + __se_sys_writev fs/read_write.c:1037 [inline] + __x64_sys_writev+0xe5/0x120 fs/read_write.c:1037 + do_syscall_x64 arch/x86/entry/common.c:51 [inline] + do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Bytes 68-71 of 2508 are uninitialized +Memory access of size 2508 starts at ffff888114f9b000 +Data copied to user address 00007f7fe09ff2e0 + +CPU: 1 PID: 3478 Comm: syz-executor306 Not tainted 5.17.0-rc4-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 + +Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Cc: Vlad Yasevich +Cc: Neil Horman +Cc: Marcelo Ricardo Leitner +Reviewed-by: Xin Long +Link: https://lore.kernel.org/r/20220310001145.297371-1-eric.dumazet@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sctp/diag.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/net/sctp/diag.c b/net/sctp/diag.c +index babadd6720a2..68ff82ff49a3 100644 +--- a/net/sctp/diag.c ++++ b/net/sctp/diag.c +@@ -61,10 +61,6 @@ static void inet_diag_msg_sctpasoc_fill(struct inet_diag_msg *r, + r->idiag_timer = SCTP_EVENT_TIMEOUT_T3_RTX; + r->idiag_retrans = asoc->rtx_data_chunks; + r->idiag_expires = jiffies_to_msecs(t3_rtx->expires - jiffies); +- } else { +- r->idiag_timer = 0; +- r->idiag_retrans = 0; +- r->idiag_expires = 0; + } + } + +@@ -144,13 +140,14 @@ static int inet_sctp_diag_fill(struct sock *sk, struct sctp_association *asoc, + r = nlmsg_data(nlh); + BUG_ON(!sk_fullsock(sk)); + ++ r->idiag_timer = 0; ++ r->idiag_retrans = 0; ++ r->idiag_expires = 0; + if (asoc) { + inet_diag_msg_sctpasoc_fill(r, sk, asoc); + } else { + inet_diag_msg_common_fill(r, sk); + r->idiag_state = sk->sk_state; +- r->idiag_timer = 0; +- r->idiag_retrans = 0; + } + + if (inet_diag_msg_attrs_fill(sk, skb, r, ext, user_ns, net_admin)) +-- +2.34.1 + diff --git a/queue-5.10/selftest-vm-fix-map_fixed_noreplace-test-failure.patch b/queue-5.10/selftest-vm-fix-map_fixed_noreplace-test-failure.patch new file mode 100644 index 00000000000..c87a1197a55 --- /dev/null +++ b/queue-5.10/selftest-vm-fix-map_fixed_noreplace-test-failure.patch @@ -0,0 +1,181 @@ +From d0cf5f5b7e806f82707416311973c2630211b152 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Feb 2022 19:11:08 -0800 +Subject: selftest/vm: fix map_fixed_noreplace test failure + +From: Aneesh Kumar K.V + +[ Upstream commit f39c58008dee7ab5fc94c3f1995a21e886801df0 ] + +On the latest RHEL the test fails due to executable mapped at 256MB +address + + # ./map_fixed_noreplace + mmap() @ 0x10000000-0x10050000 p=0xffffffffffffffff result=File exists + 10000000-10010000 r-xp 00000000 fd:04 34905657 /root/rpmbuild/BUILD/kernel-5.14.0-56.el9/linux-5.14.0-56.el9.ppc64le/tools/testing/selftests/vm/map_fixed_noreplace + 10010000-10020000 r--p 00000000 fd:04 34905657 /root/rpmbuild/BUILD/kernel-5.14.0-56.el9/linux-5.14.0-56.el9.ppc64le/tools/testing/selftests/vm/map_fixed_noreplace + 10020000-10030000 rw-p 00010000 fd:04 34905657 /root/rpmbuild/BUILD/kernel-5.14.0-56.el9/linux-5.14.0-56.el9.ppc64le/tools/testing/selftests/vm/map_fixed_noreplace + 10029b90000-10029bc0000 rw-p 00000000 00:00 0 [heap] + 7fffbb510000-7fffbb750000 r-xp 00000000 fd:04 24534 /usr/lib64/libc.so.6 + 7fffbb750000-7fffbb760000 r--p 00230000 fd:04 24534 /usr/lib64/libc.so.6 + 7fffbb760000-7fffbb770000 rw-p 00240000 fd:04 24534 /usr/lib64/libc.so.6 + 7fffbb780000-7fffbb7a0000 r--p 00000000 00:00 0 [vvar] + 7fffbb7a0000-7fffbb7b0000 r-xp 00000000 00:00 0 [vdso] + 7fffbb7b0000-7fffbb800000 r-xp 00000000 fd:04 24514 /usr/lib64/ld64.so.2 + 7fffbb800000-7fffbb810000 r--p 00040000 fd:04 24514 /usr/lib64/ld64.so.2 + 7fffbb810000-7fffbb820000 rw-p 00050000 fd:04 24514 /usr/lib64/ld64.so.2 + 7fffd93f0000-7fffd9420000 rw-p 00000000 00:00 0 [stack] + Error: couldn't map the space we need for the test + +Fix this by finding a free address using mmap instead of hardcoding +BASE_ADDRESS. + +Link: https://lkml.kernel.org/r/20220217083417.373823-1-aneesh.kumar@linux.ibm.com +Signed-off-by: Aneesh Kumar K.V +Cc: Michael Ellerman +Cc: Jann Horn +Cc: Shuah Khan +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + .../selftests/vm/map_fixed_noreplace.c | 49 ++++++++++++++----- + 1 file changed, 37 insertions(+), 12 deletions(-) + +diff --git a/tools/testing/selftests/vm/map_fixed_noreplace.c b/tools/testing/selftests/vm/map_fixed_noreplace.c +index d91bde511268..eed44322d1a6 100644 +--- a/tools/testing/selftests/vm/map_fixed_noreplace.c ++++ b/tools/testing/selftests/vm/map_fixed_noreplace.c +@@ -17,9 +17,6 @@ + #define MAP_FIXED_NOREPLACE 0x100000 + #endif + +-#define BASE_ADDRESS (256ul * 1024 * 1024) +- +- + static void dump_maps(void) + { + char cmd[32]; +@@ -28,18 +25,46 @@ static void dump_maps(void) + system(cmd); + } + ++static unsigned long find_base_addr(unsigned long size) ++{ ++ void *addr; ++ unsigned long flags; ++ ++ flags = MAP_PRIVATE | MAP_ANONYMOUS; ++ addr = mmap(NULL, size, PROT_NONE, flags, -1, 0); ++ if (addr == MAP_FAILED) { ++ printf("Error: couldn't map the space we need for the test\n"); ++ return 0; ++ } ++ ++ if (munmap(addr, size) != 0) { ++ printf("Error: couldn't map the space we need for the test\n"); ++ return 0; ++ } ++ return (unsigned long)addr; ++} ++ + int main(void) + { ++ unsigned long base_addr; + unsigned long flags, addr, size, page_size; + char *p; + + page_size = sysconf(_SC_PAGE_SIZE); + ++ //let's find a base addr that is free before we start the tests ++ size = 5 * page_size; ++ base_addr = find_base_addr(size); ++ if (!base_addr) { ++ printf("Error: couldn't map the space we need for the test\n"); ++ return 1; ++ } ++ + flags = MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED_NOREPLACE; + + // Check we can map all the areas we need below + errno = 0; +- addr = BASE_ADDRESS; ++ addr = base_addr; + size = 5 * page_size; + p = mmap((void *)addr, size, PROT_NONE, flags, -1, 0); + +@@ -60,7 +85,7 @@ int main(void) + printf("unmap() successful\n"); + + errno = 0; +- addr = BASE_ADDRESS + page_size; ++ addr = base_addr + page_size; + size = 3 * page_size; + p = mmap((void *)addr, size, PROT_NONE, flags, -1, 0); + printf("mmap() @ 0x%lx-0x%lx p=%p result=%m\n", addr, addr + size, p); +@@ -80,7 +105,7 @@ int main(void) + * +4 | free | new + */ + errno = 0; +- addr = BASE_ADDRESS; ++ addr = base_addr; + size = 5 * page_size; + p = mmap((void *)addr, size, PROT_NONE, flags, -1, 0); + printf("mmap() @ 0x%lx-0x%lx p=%p result=%m\n", addr, addr + size, p); +@@ -101,7 +126,7 @@ int main(void) + * +4 | free | + */ + errno = 0; +- addr = BASE_ADDRESS + (2 * page_size); ++ addr = base_addr + (2 * page_size); + size = page_size; + p = mmap((void *)addr, size, PROT_NONE, flags, -1, 0); + printf("mmap() @ 0x%lx-0x%lx p=%p result=%m\n", addr, addr + size, p); +@@ -121,7 +146,7 @@ int main(void) + * +4 | free | new + */ + errno = 0; +- addr = BASE_ADDRESS + (3 * page_size); ++ addr = base_addr + (3 * page_size); + size = 2 * page_size; + p = mmap((void *)addr, size, PROT_NONE, flags, -1, 0); + printf("mmap() @ 0x%lx-0x%lx p=%p result=%m\n", addr, addr + size, p); +@@ -141,7 +166,7 @@ int main(void) + * +4 | free | + */ + errno = 0; +- addr = BASE_ADDRESS; ++ addr = base_addr; + size = 2 * page_size; + p = mmap((void *)addr, size, PROT_NONE, flags, -1, 0); + printf("mmap() @ 0x%lx-0x%lx p=%p result=%m\n", addr, addr + size, p); +@@ -161,7 +186,7 @@ int main(void) + * +4 | free | + */ + errno = 0; +- addr = BASE_ADDRESS; ++ addr = base_addr; + size = page_size; + p = mmap((void *)addr, size, PROT_NONE, flags, -1, 0); + printf("mmap() @ 0x%lx-0x%lx p=%p result=%m\n", addr, addr + size, p); +@@ -181,7 +206,7 @@ int main(void) + * +4 | free | new + */ + errno = 0; +- addr = BASE_ADDRESS + (4 * page_size); ++ addr = base_addr + (4 * page_size); + size = page_size; + p = mmap((void *)addr, size, PROT_NONE, flags, -1, 0); + printf("mmap() @ 0x%lx-0x%lx p=%p result=%m\n", addr, addr + size, p); +@@ -192,7 +217,7 @@ int main(void) + return 1; + } + +- addr = BASE_ADDRESS; ++ addr = base_addr; + size = 5 * page_size; + if (munmap((void *)addr, size) != 0) { + dump_maps(); +-- +2.34.1 + diff --git a/queue-5.10/selftests-bpf-add-test-for-bpf_timer-overwriting-cra.patch b/queue-5.10/selftests-bpf-add-test-for-bpf_timer-overwriting-cra.patch new file mode 100644 index 00000000000..eaaa4f8705a --- /dev/null +++ b/queue-5.10/selftests-bpf-add-test-for-bpf_timer-overwriting-cra.patch @@ -0,0 +1,125 @@ +From 53582ce4277660bd77b1acab51155b5edef8af7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Feb 2022 12:33:24 +0530 +Subject: selftests/bpf: Add test for bpf_timer overwriting crash + +From: Kumar Kartikeya Dwivedi + +[ Upstream commit a7e75016a0753c24d6c995bc02501ae35368e333 ] + +Add a test that validates that timer value is not overwritten when doing +a copy_map_value call in the kernel. Without the prior fix, this test +triggers a crash. + +Signed-off-by: Kumar Kartikeya Dwivedi +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/20220209070324.1093182-3-memxor@gmail.com +Signed-off-by: Sasha Levin +--- + .../selftests/bpf/prog_tests/timer_crash.c | 32 +++++++++++ + .../testing/selftests/bpf/progs/timer_crash.c | 54 +++++++++++++++++++ + 2 files changed, 86 insertions(+) + create mode 100644 tools/testing/selftests/bpf/prog_tests/timer_crash.c + create mode 100644 tools/testing/selftests/bpf/progs/timer_crash.c + +diff --git a/tools/testing/selftests/bpf/prog_tests/timer_crash.c b/tools/testing/selftests/bpf/prog_tests/timer_crash.c +new file mode 100644 +index 000000000000..f74b82305da8 +--- /dev/null ++++ b/tools/testing/selftests/bpf/prog_tests/timer_crash.c +@@ -0,0 +1,32 @@ ++// SPDX-License-Identifier: GPL-2.0 ++#include ++#include "timer_crash.skel.h" ++ ++enum { ++ MODE_ARRAY, ++ MODE_HASH, ++}; ++ ++static void test_timer_crash_mode(int mode) ++{ ++ struct timer_crash *skel; ++ ++ skel = timer_crash__open_and_load(); ++ if (!ASSERT_OK_PTR(skel, "timer_crash__open_and_load")) ++ return; ++ skel->bss->pid = getpid(); ++ skel->bss->crash_map = mode; ++ if (!ASSERT_OK(timer_crash__attach(skel), "timer_crash__attach")) ++ goto end; ++ usleep(1); ++end: ++ timer_crash__destroy(skel); ++} ++ ++void test_timer_crash(void) ++{ ++ if (test__start_subtest("array")) ++ test_timer_crash_mode(MODE_ARRAY); ++ if (test__start_subtest("hash")) ++ test_timer_crash_mode(MODE_HASH); ++} +diff --git a/tools/testing/selftests/bpf/progs/timer_crash.c b/tools/testing/selftests/bpf/progs/timer_crash.c +new file mode 100644 +index 000000000000..f8f7944e70da +--- /dev/null ++++ b/tools/testing/selftests/bpf/progs/timer_crash.c +@@ -0,0 +1,54 @@ ++// SPDX-License-Identifier: GPL-2.0 ++ ++#include ++#include ++#include ++ ++struct map_elem { ++ struct bpf_timer timer; ++ struct bpf_spin_lock lock; ++}; ++ ++struct { ++ __uint(type, BPF_MAP_TYPE_ARRAY); ++ __uint(max_entries, 1); ++ __type(key, int); ++ __type(value, struct map_elem); ++} amap SEC(".maps"); ++ ++struct { ++ __uint(type, BPF_MAP_TYPE_HASH); ++ __uint(max_entries, 1); ++ __type(key, int); ++ __type(value, struct map_elem); ++} hmap SEC(".maps"); ++ ++int pid = 0; ++int crash_map = 0; /* 0 for amap, 1 for hmap */ ++ ++SEC("fentry/do_nanosleep") ++int sys_enter(void *ctx) ++{ ++ struct map_elem *e, value = {}; ++ void *map = crash_map ? (void *)&hmap : (void *)&amap; ++ ++ if (bpf_get_current_task_btf()->tgid != pid) ++ return 0; ++ ++ *(void **)&value = (void *)0xdeadcaf3; ++ ++ bpf_map_update_elem(map, &(int){0}, &value, 0); ++ /* For array map, doing bpf_map_update_elem will do a ++ * check_and_free_timer_in_array, which will trigger the crash if timer ++ * pointer was overwritten, for hmap we need to use bpf_timer_cancel. ++ */ ++ if (crash_map == 1) { ++ e = bpf_map_lookup_elem(map, &(int){0}); ++ if (!e) ++ return 0; ++ bpf_timer_cancel(&e->timer); ++ } ++ return 0; ++} ++ ++char _license[] SEC("license") = "GPL"; +-- +2.34.1 + diff --git a/queue-5.10/selftests-memfd-clean-up-mapping-in-mfd_fail_write.patch b/queue-5.10/selftests-memfd-clean-up-mapping-in-mfd_fail_write.patch new file mode 100644 index 00000000000..9c71dfb9b16 --- /dev/null +++ b/queue-5.10/selftests-memfd-clean-up-mapping-in-mfd_fail_write.patch @@ -0,0 +1,57 @@ +From 95489dd46b5727bda6e9cfd8050d7ceb6e59f2d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Feb 2022 19:11:26 -0800 +Subject: selftests/memfd: clean up mapping in mfd_fail_write + +From: Mike Kravetz + +[ Upstream commit fda153c89af344d21df281009a9d046cf587ea0f ] + +Running the memfd script ./run_hugetlbfs_test.sh will often end in error +as follows: + + memfd-hugetlb: CREATE + memfd-hugetlb: BASIC + memfd-hugetlb: SEAL-WRITE + memfd-hugetlb: SEAL-FUTURE-WRITE + memfd-hugetlb: SEAL-SHRINK + fallocate(ALLOC) failed: No space left on device + ./run_hugetlbfs_test.sh: line 60: 166855 Aborted (core dumped) ./memfd_test hugetlbfs + opening: ./mnt/memfd + fuse: DONE + +If no hugetlb pages have been preallocated, run_hugetlbfs_test.sh will +allocate 'just enough' pages to run the test. In the SEAL-FUTURE-WRITE +test the mfd_fail_write routine maps the file, but does not unmap. As a +result, two hugetlb pages remain reserved for the mapping. When the +fallocate call in the SEAL-SHRINK test attempts allocate all hugetlb +pages, it is short by the two reserved pages. + +Fix by making sure to unmap in mfd_fail_write. + +Link: https://lkml.kernel.org/r/20220219004340.56478-1-mike.kravetz@oracle.com +Signed-off-by: Mike Kravetz +Cc: Joel Fernandes +Cc: Shuah Khan +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/memfd/memfd_test.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/memfd/memfd_test.c b/tools/testing/selftests/memfd/memfd_test.c +index 334a7eea2004..fba322d1c67a 100644 +--- a/tools/testing/selftests/memfd/memfd_test.c ++++ b/tools/testing/selftests/memfd/memfd_test.c +@@ -455,6 +455,7 @@ static void mfd_fail_write(int fd) + printf("mmap()+mprotect() didn't fail as expected\n"); + abort(); + } ++ munmap(p, mfd_def_size); + } + + /* verify PUNCH_HOLE fails */ +-- +2.34.1 + diff --git a/queue-5.10/selftests-pmtu.sh-kill-tcpdump-processes-launched-by.patch b/queue-5.10/selftests-pmtu.sh-kill-tcpdump-processes-launched-by.patch new file mode 100644 index 00000000000..5781d1ddf60 --- /dev/null +++ b/queue-5.10/selftests-pmtu.sh-kill-tcpdump-processes-launched-by.patch @@ -0,0 +1,95 @@ +From ef43a769b0edc21b3cacb9a37bbf09eca8d15091 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Mar 2022 23:15:00 +0100 +Subject: selftests: pmtu.sh: Kill tcpdump processes launched by subshell. + +From: Guillaume Nault + +[ Upstream commit 18dfc667550fe9c032a6dcc3402b50e691e18029 ] + +The cleanup() function takes care of killing processes launched by the +test functions. It relies on variables like ${tcpdump_pids} to get the +relevant PIDs. But tests are run in their own subshell, so updated +*_pids values are invisible to other shells. Therefore cleanup() never +sees any process to kill: + +$ ./tools/testing/selftests/net/pmtu.sh -t pmtu_ipv4_exception +TEST: ipv4: PMTU exceptions [ OK ] +TEST: ipv4: PMTU exceptions - nexthop objects [ OK ] + +$ pgrep -af tcpdump +6084 tcpdump -s 0 -i veth_A-R1 -w pmtu_ipv4_exception_veth_A-R1.pcap +6085 tcpdump -s 0 -i veth_R1-A -w pmtu_ipv4_exception_veth_R1-A.pcap +6086 tcpdump -s 0 -i veth_R1-B -w pmtu_ipv4_exception_veth_R1-B.pcap +6087 tcpdump -s 0 -i veth_B-R1 -w pmtu_ipv4_exception_veth_B-R1.pcap +6088 tcpdump -s 0 -i veth_A-R2 -w pmtu_ipv4_exception_veth_A-R2.pcap +6089 tcpdump -s 0 -i veth_R2-A -w pmtu_ipv4_exception_veth_R2-A.pcap +6090 tcpdump -s 0 -i veth_R2-B -w pmtu_ipv4_exception_veth_R2-B.pcap +6091 tcpdump -s 0 -i veth_B-R2 -w pmtu_ipv4_exception_veth_B-R2.pcap +6228 tcpdump -s 0 -i veth_A-R1 -w pmtu_ipv4_exception_veth_A-R1.pcap +6229 tcpdump -s 0 -i veth_R1-A -w pmtu_ipv4_exception_veth_R1-A.pcap +6230 tcpdump -s 0 -i veth_R1-B -w pmtu_ipv4_exception_veth_R1-B.pcap +6231 tcpdump -s 0 -i veth_B-R1 -w pmtu_ipv4_exception_veth_B-R1.pcap +6232 tcpdump -s 0 -i veth_A-R2 -w pmtu_ipv4_exception_veth_A-R2.pcap +6233 tcpdump -s 0 -i veth_R2-A -w pmtu_ipv4_exception_veth_R2-A.pcap +6234 tcpdump -s 0 -i veth_R2-B -w pmtu_ipv4_exception_veth_R2-B.pcap +6235 tcpdump -s 0 -i veth_B-R2 -w pmtu_ipv4_exception_veth_B-R2.pcap + +Fix this by running cleanup() in the context of the test subshell. +Now that each test cleans the environment after completion, there's no +need for calling cleanup() again when the next test starts. So let's +drop it from the setup() function. This is okay because cleanup() is +also called when pmtu.sh starts, so even the first test starts in a +clean environment. + +Also, use tcpdump's immediate mode. Otherwise it might not have time to +process buffered packets, resulting in missing packets or even empty +pcap files for short tests. + +Note: PAUSE_ON_FAIL is still evaluated before cleanup(), so one can +still inspect the test environment upon failure when using -p. + +Fixes: a92a0a7b8e7c ("selftests: pmtu: Simplify cleanup and namespace names") +Signed-off-by: Guillaume Nault +Reviewed-by: Shuah Khan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/pmtu.sh | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/net/pmtu.sh b/tools/testing/selftests/net/pmtu.sh +index 3367fb5f2fef..3253fdc780d6 100755 +--- a/tools/testing/selftests/net/pmtu.sh ++++ b/tools/testing/selftests/net/pmtu.sh +@@ -799,7 +799,6 @@ setup_ovs_bridge() { + setup() { + [ "$(id -u)" -ne 0 ] && echo " need to run as root" && return $ksft_skip + +- cleanup + for arg do + eval setup_${arg} || { echo " ${arg} not supported"; return 1; } + done +@@ -810,7 +809,7 @@ trace() { + + for arg do + [ "${ns_cmd}" = "" ] && ns_cmd="${arg}" && continue +- ${ns_cmd} tcpdump -s 0 -i "${arg}" -w "${name}_${arg}.pcap" 2> /dev/null & ++ ${ns_cmd} tcpdump --immediate-mode -s 0 -i "${arg}" -w "${name}_${arg}.pcap" 2> /dev/null & + tcpdump_pids="${tcpdump_pids} $!" + ns_cmd= + done +@@ -1636,6 +1635,10 @@ run_test() { + + unset IFS + ++ # Since cleanup() relies on variables modified by this subshell, it ++ # has to run in this context. ++ trap cleanup EXIT ++ + if [ "$VERBOSE" = "1" ]; then + printf "\n##########################################################################\n\n" + fi +-- +2.34.1 + diff --git a/queue-5.10/series b/queue-5.10/series new file mode 100644 index 00000000000..7a30e938f3a --- /dev/null +++ b/queue-5.10/series @@ -0,0 +1,48 @@ +arm-boot-dts-bcm2711-fix-hvs-register-range.patch +clk-qcom-gdsc-add-support-to-update-gdsc-transition-.patch +hid-vivaldi-fix-sysfs-attributes-leak.patch +arm64-dts-armada-3720-turris-mox-add-missing-etherne.patch +tipc-fix-kernel-panic-when-enabling-bearer.patch +misdn-remove-obsolete-pipeline_debug-debugging-infor.patch +misdn-fix-memory-leak-in-dsp_pipeline_build.patch +virtio-blk-don-t-use-max_discard_segments-if-max_dis.patch +isdn-hfcpci-check-the-return-value-of-dma_set_mask-i.patch +net-qlogic-check-the-return-value-of-dma_alloc_coher.patch +esp-fix-beet-mode-inter-address-family-tunneling-on-.patch +qed-return-status-of-qed_iov_get_link.patch +drm-sun4i-mixer-fix-p010-and-p210-format-numbers.patch +net-dsa-mt7530-fix-incorrect-test-in-mt753x_phylink_.patch +arm-dts-aspeed-fix-ast2600-quad-spi-group.patch +i40e-stop-disabling-vfs-due-to-pf-error-responses.patch +ice-stop-disabling-vfs-due-to-pf-error-responses.patch +ice-align-macro-names-to-the-specification.patch +ice-remove-unnecessary-checker-loop.patch +ice-rename-a-couple-of-variables.patch +ice-fix-curr_link_speed-advertised-speed.patch +ethernet-fix-error-handling-in-xemaclite_of_probe.patch +tipc-fix-incorrect-order-of-state-message-data-sanit.patch +net-ethernet-ti-cpts-handle-error-for-clk_enable.patch +net-ethernet-lpc_eth-handle-error-for-clk_enable.patch +ax25-fix-null-pointer-dereference-in-ax25_kill_by_de.patch +net-mlx5-fix-size-field-in-bufferx_reg-struct.patch +net-mlx5-fix-a-race-on-command-flush-flow.patch +net-mlx5e-lag-only-handle-events-from-highest-priori.patch +nfc-port100-fix-use-after-free-in-port100_send_compl.patch +selftests-pmtu.sh-kill-tcpdump-processes-launched-by.patch +gpio-ts4900-do-not-set-dat-and-oe-together.patch +gianfar-ethtool-fix-refcount-leak-in-gfar_get_ts_inf.patch +net-phy-dp83822-clear-misr2-register-to-disable-inte.patch +sctp-fix-kernel-infoleak-for-sctp-sockets.patch +net-bcmgenet-don-t-claim-wol-when-its-not-available.patch +selftests-bpf-add-test-for-bpf_timer-overwriting-cra.patch +spi-rockchip-fix-error-in-getting-num-cs-property.patch +spi-rockchip-terminate-dma-transmission-when-slave-a.patch +net-sysfs-add-check-for-netdevice-being-present-to-s.patch +hwmon-pmbus-clear-pmbus-fault-warning-bits-after-rea.patch +gpio-return-eprobe_defer-if-gc-to_irq-is-null.patch +revert-xen-netback-remove-hotplug-status-once-it-has.patch +revert-xen-netback-check-for-hotplug-status-existenc.patch +ipv6-prevent-a-possible-race-condition-with-lifetime.patch +tracing-ensure-trace-buffer-is-at-least-4096-bytes-l.patch +selftest-vm-fix-map_fixed_noreplace-test-failure.patch +selftests-memfd-clean-up-mapping-in-mfd_fail_write.patch diff --git a/queue-5.10/spi-rockchip-fix-error-in-getting-num-cs-property.patch b/queue-5.10/spi-rockchip-fix-error-in-getting-num-cs-property.patch new file mode 100644 index 00000000000..7e1979a4f2a --- /dev/null +++ b/queue-5.10/spi-rockchip-fix-error-in-getting-num-cs-property.patch @@ -0,0 +1,47 @@ +From 028f671124e91d475114a670dc142c81aa132d83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Feb 2022 09:40:23 +0800 +Subject: spi: rockchip: Fix error in getting num-cs property + +From: Jon Lin + +[ Upstream commit 9382df0a98aad5bbcd4d634790305a1d786ad224 ] + +Get num-cs u32 from dts of_node property rather than u16. + +Signed-off-by: Jon Lin +Link: https://lore.kernel.org/r/20220216014028.8123-2-jon.lin@rock-chips.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-rockchip.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c +index 624273d0e727..a59431075411 100644 +--- a/drivers/spi/spi-rockchip.c ++++ b/drivers/spi/spi-rockchip.c +@@ -636,7 +636,7 @@ static int rockchip_spi_probe(struct platform_device *pdev) + struct spi_controller *ctlr; + struct resource *mem; + struct device_node *np = pdev->dev.of_node; +- u32 rsd_nsecs; ++ u32 rsd_nsecs, num_cs; + bool slave_mode; + + slave_mode = of_property_read_bool(np, "spi-slave"); +@@ -744,8 +744,9 @@ static int rockchip_spi_probe(struct platform_device *pdev) + * rk spi0 has two native cs, spi1..5 one cs only + * if num-cs is missing in the dts, default to 1 + */ +- if (of_property_read_u16(np, "num-cs", &ctlr->num_chipselect)) +- ctlr->num_chipselect = 1; ++ if (of_property_read_u32(np, "num-cs", &num_cs)) ++ num_cs = 1; ++ ctlr->num_chipselect = num_cs; + ctlr->use_gpio_descriptors = true; + } + ctlr->dev.of_node = pdev->dev.of_node; +-- +2.34.1 + diff --git a/queue-5.10/spi-rockchip-terminate-dma-transmission-when-slave-a.patch b/queue-5.10/spi-rockchip-terminate-dma-transmission-when-slave-a.patch new file mode 100644 index 00000000000..2a9bb2453c1 --- /dev/null +++ b/queue-5.10/spi-rockchip-terminate-dma-transmission-when-slave-a.patch @@ -0,0 +1,40 @@ +From c1a0913e6579984a6456d1340b29f605801a4b76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Feb 2022 09:40:24 +0800 +Subject: spi: rockchip: terminate dma transmission when slave abort + +From: Jon Lin + +[ Upstream commit 80808768e41324d2e23de89972b5406c1020e6e4 ] + +After slave abort, all DMA should be stopped, or it will affect the +next transmission and maybe abort again. + +Signed-off-by: Jon Lin +Link: https://lore.kernel.org/r/20220216014028.8123-3-jon.lin@rock-chips.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-rockchip.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c +index a59431075411..a9f97023d5a0 100644 +--- a/drivers/spi/spi-rockchip.c ++++ b/drivers/spi/spi-rockchip.c +@@ -567,6 +567,12 @@ static int rockchip_spi_slave_abort(struct spi_controller *ctlr) + { + struct rockchip_spi *rs = spi_controller_get_devdata(ctlr); + ++ if (atomic_read(&rs->state) & RXDMA) ++ dmaengine_terminate_sync(ctlr->dma_rx); ++ if (atomic_read(&rs->state) & TXDMA) ++ dmaengine_terminate_sync(ctlr->dma_tx); ++ atomic_set(&rs->state, 0); ++ spi_enable_chip(rs, false); + rs->slave_abort = true; + complete(&ctlr->xfer_completion); + +-- +2.34.1 + diff --git a/queue-5.10/tipc-fix-incorrect-order-of-state-message-data-sanit.patch b/queue-5.10/tipc-fix-incorrect-order-of-state-message-data-sanit.patch new file mode 100644 index 00000000000..0814a2136c2 --- /dev/null +++ b/queue-5.10/tipc-fix-incorrect-order-of-state-message-data-sanit.patch @@ -0,0 +1,59 @@ +From 4a514df6b83ea37000780089d1fa6420ace8102a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Mar 2022 02:11:59 +0000 +Subject: tipc: fix incorrect order of state message data sanity check + +From: Tung Nguyen + +[ Upstream commit c79fcc27be90b308b3fa90811aefafdd4078668c ] + +When receiving a state message, function tipc_link_validate_msg() +is called to validate its header portion. Then, its data portion +is validated before it can be accessed correctly. However, current +data sanity check is done after the message header is accessed to +update some link variables. + +This commit fixes this issue by moving the data sanity check to +the beginning of state message handling and right after the header +sanity check. + +Fixes: 9aa422ad3266 ("tipc: improve size validations for received domain records") +Acked-by: Jon Maloy +Signed-off-by: Tung Nguyen +Link: https://lore.kernel.org/r/20220308021200.9245-1-tung.q.nguyen@dektech.com.au +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tipc/link.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/net/tipc/link.c b/net/tipc/link.c +index fb835a3822f4..7a353ff62844 100644 +--- a/net/tipc/link.c ++++ b/net/tipc/link.c +@@ -2245,6 +2245,11 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb, + break; + + case STATE_MSG: ++ /* Validate Gap ACK blocks, drop if invalid */ ++ glen = tipc_get_gap_ack_blks(&ga, l, hdr, true); ++ if (glen > dlen) ++ break; ++ + l->rcv_nxt_state = msg_seqno(hdr) + 1; + + /* Update own tolerance if peer indicates a non-zero value */ +@@ -2270,10 +2275,6 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb, + break; + } + +- /* Receive Gap ACK blocks from peer if any */ +- glen = tipc_get_gap_ack_blks(&ga, l, hdr, true); +- if(glen > dlen) +- break; + tipc_mon_rcv(l->net, data + glen, dlen - glen, l->addr, + &l->mon_state, l->bearer_id); + +-- +2.34.1 + diff --git a/queue-5.10/tipc-fix-kernel-panic-when-enabling-bearer.patch b/queue-5.10/tipc-fix-kernel-panic-when-enabling-bearer.patch new file mode 100644 index 00000000000..dbe38d2ce9b --- /dev/null +++ b/queue-5.10/tipc-fix-kernel-panic-when-enabling-bearer.patch @@ -0,0 +1,106 @@ +From 67c0d4dbb526fc5de1e566bf05f0216b5d812919 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Mar 2022 03:25:18 +0000 +Subject: tipc: fix kernel panic when enabling bearer + +From: Tung Nguyen + +[ Upstream commit be4977b847f5d5cedb64d50eaaf2218c3a55a3a3 ] + +When enabling a bearer on a node, a kernel panic is observed: + +[ 4.498085] RIP: 0010:tipc_mon_prep+0x4e/0x130 [tipc] +... +[ 4.520030] Call Trace: +[ 4.520689] +[ 4.521236] tipc_link_build_proto_msg+0x375/0x750 [tipc] +[ 4.522654] tipc_link_build_state_msg+0x48/0xc0 [tipc] +[ 4.524034] __tipc_node_link_up+0xd7/0x290 [tipc] +[ 4.525292] tipc_rcv+0x5da/0x730 [tipc] +[ 4.526346] ? __netif_receive_skb_core+0xb7/0xfc0 +[ 4.527601] tipc_l2_rcv_msg+0x5e/0x90 [tipc] +[ 4.528737] __netif_receive_skb_list_core+0x20b/0x260 +[ 4.530068] netif_receive_skb_list_internal+0x1bf/0x2e0 +[ 4.531450] ? dev_gro_receive+0x4c2/0x680 +[ 4.532512] napi_complete_done+0x6f/0x180 +[ 4.533570] virtnet_poll+0x29c/0x42e [virtio_net] +... + +The node in question is receiving activate messages in another +thread after changing bearer status to allow message sending/ +receiving in current thread: + + thread 1 | thread 2 + -------- | -------- + | +tipc_enable_bearer() | + test_and_set_bit_lock() | + tipc_bearer_xmit_skb() | + | tipc_l2_rcv_msg() + | tipc_rcv() + | __tipc_node_link_up() + | tipc_link_build_state_msg() + | tipc_link_build_proto_msg() + | tipc_mon_prep() + | { + | ... + | // null-pointer dereference + | u16 gen = mon->dom_gen; + | ... + | } + // Not being executed yet | + tipc_mon_create() | + { | + ... | + // allocate | + mon = kzalloc(); | + ... | + } | + +Monitoring pointer in thread 2 is dereferenced before monitoring data +is allocated in thread 1. This causes kernel panic. + +This commit fixes it by allocating the monitoring data before enabling +the bearer to receive messages. + +Fixes: 35c55c9877f8 ("tipc: add neighbor monitoring framework") +Reported-by: Shuang Li +Acked-by: Jon Maloy +Signed-off-by: Tung Nguyen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/tipc/bearer.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c +index 12e535b43d88..6911f1cab206 100644 +--- a/net/tipc/bearer.c ++++ b/net/tipc/bearer.c +@@ -342,16 +342,18 @@ static int tipc_enable_bearer(struct net *net, const char *name, + goto rejected; + } + +- test_and_set_bit_lock(0, &b->up); +- rcu_assign_pointer(tn->bearer_list[bearer_id], b); +- if (skb) +- tipc_bearer_xmit_skb(net, bearer_id, skb, &b->bcast_addr); +- ++ /* Create monitoring data before accepting activate messages */ + if (tipc_mon_create(net, bearer_id)) { + bearer_disable(net, b); ++ kfree_skb(skb); + return -ENOMEM; + } + ++ test_and_set_bit_lock(0, &b->up); ++ rcu_assign_pointer(tn->bearer_list[bearer_id], b); ++ if (skb) ++ tipc_bearer_xmit_skb(net, bearer_id, skb, &b->bcast_addr); ++ + pr_info("Enabled bearer <%s>, priority %u\n", name, prio); + + return res; +-- +2.34.1 + diff --git a/queue-5.10/tracing-ensure-trace-buffer-is-at-least-4096-bytes-l.patch b/queue-5.10/tracing-ensure-trace-buffer-is-at-least-4096-bytes-l.patch new file mode 100644 index 00000000000..d2357742e7b --- /dev/null +++ b/queue-5.10/tracing-ensure-trace-buffer-is-at-least-4096-bytes-l.patch @@ -0,0 +1,58 @@ +From 0c31842f911d0349b88016915abf90c8dae3d89d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Feb 2022 14:44:56 +0100 +Subject: tracing: Ensure trace buffer is at least 4096 bytes large + +From: Sven Schnelle + +[ Upstream commit 7acf3a127bb7c65ff39099afd78960e77b2ca5de ] + +Booting the kernel with 'trace_buf_size=1' give a warning at +boot during the ftrace selftests: + +[ 0.892809] Running postponed tracer tests: +[ 0.892893] Testing tracer function: +[ 0.901899] Callback from call_rcu_tasks_trace() invoked. +[ 0.983829] Callback from call_rcu_tasks_rude() invoked. +[ 1.072003] .. bad ring buffer .. corrupted trace buffer .. +[ 1.091944] Callback from call_rcu_tasks() invoked. +[ 1.097695] PASSED +[ 1.097701] Testing dynamic ftrace: .. filter failed count=0 ..FAILED! +[ 1.353474] ------------[ cut here ]------------ +[ 1.353478] WARNING: CPU: 0 PID: 1 at kernel/trace/trace.c:1951 run_tracer_selftest+0x13c/0x1b0 + +Therefore enforce a minimum of 4096 bytes to make the selftest pass. + +Link: https://lkml.kernel.org/r/20220214134456.1751749-1-svens@linux.ibm.com + +Signed-off-by: Sven Schnelle +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 71ed0616d83b..953dd9568dd7 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -1490,10 +1490,12 @@ static int __init set_buf_size(char *str) + if (!str) + return 0; + buf_size = memparse(str, &str); +- /* nr_entries can not be zero */ +- if (buf_size == 0) +- return 0; +- trace_buf_size = buf_size; ++ /* ++ * nr_entries can not be zero and the startup ++ * tests require some buffer space. Therefore ++ * ensure we have at least 4096 bytes of buffer. ++ */ ++ trace_buf_size = max(4096UL, buf_size); + return 1; + } + __setup("trace_buf_size=", set_buf_size); +-- +2.34.1 + diff --git a/queue-5.10/virtio-blk-don-t-use-max_discard_segments-if-max_dis.patch b/queue-5.10/virtio-blk-don-t-use-max_discard_segments-if-max_dis.patch new file mode 100644 index 00000000000..ad2e5375206 --- /dev/null +++ b/queue-5.10/virtio-blk-don-t-use-max_discard_segments-if-max_dis.patch @@ -0,0 +1,49 @@ +From 2be16612401e1f4a2fa419de55ae23a4d92f1ab0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Mar 2022 18:00:57 +0800 +Subject: virtio-blk: Don't use MAX_DISCARD_SEGMENTS if max_discard_seg is zero + +From: Xie Yongji + +[ Upstream commit dacc73ed0b88f1a787ec20385f42ca9dd9eddcd0 ] + +Currently the value of max_discard_segment will be set to +MAX_DISCARD_SEGMENTS (256) with no basis in hardware if device +set 0 to max_discard_seg in configuration space. It's incorrect +since the device might not be able to handle such large descriptors. +To fix it, let's follow max_segments restrictions in this case. + +Fixes: 1f23816b8eb8 ("virtio_blk: add discard and write zeroes support") +Signed-off-by: Xie Yongji +Link: https://lore.kernel.org/r/20220304100058.116-1-xieyongji@bytedance.com +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/block/virtio_blk.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c +index 42acf9587ef3..a03390127741 100644 +--- a/drivers/block/virtio_blk.c ++++ b/drivers/block/virtio_blk.c +@@ -869,9 +869,15 @@ static int virtblk_probe(struct virtio_device *vdev) + + virtio_cread(vdev, struct virtio_blk_config, max_discard_seg, + &v); ++ ++ /* ++ * max_discard_seg == 0 is out of spec but we always ++ * handled it. ++ */ ++ if (!v) ++ v = sg_elems - 2; + blk_queue_max_discard_segments(q, +- min_not_zero(v, +- MAX_DISCARD_SEGMENTS)); ++ min(v, MAX_DISCARD_SEGMENTS)); + + blk_queue_flag_set(QUEUE_FLAG_DISCARD, q); + } +-- +2.34.1 + -- 2.47.3