5.10-stable patches

added patches:
	revert-mwifiex-fix-sleep-in-atomic-context-bugs-caused-by-dev_coredumpv.patch
	tcp-fix-over-estimation-in-sk_forced_mem_schedule.patch

diff --git a/queue-5.10/revert-mwifiex-fix-sleep-in-atomic-context-bugs-caused-by-dev_coredumpv.patch b/queue-5.10/revert-mwifiex-fix-sleep-in-atomic-context-bugs-caused-by-dev_coredumpv.patch
new file mode 100644 (file)
index 0000000..c748d34
--- /dev/null
+++ b/queue-5.10/revert-mwifiex-fix-sleep-in-atomic-context-bugs-caused-by-dev_coredumpv.patch
@@ -0,0 +1,100 @@
+From 5f8954e099b8ae96e7de1bb95950e00c85bedd40 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Mon, 27 Jun 2022 16:35:59 +0200
+Subject: Revert "mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit 5f8954e099b8ae96e7de1bb95950e00c85bedd40 upstream.
+
+This reverts commit a52ed4866d2b90dd5e4ae9dabd453f3ed8fa3cbc as it
+causes build problems in linux-next.  It needs to be reintroduced in a
+way that can allow the api to evolve and not require a "flag day" to
+catch all users.
+
+Link: https://lore.kernel.org/r/20220623160723.7a44b573@canb.auug.org.au
+Cc: Duoming Zhou <duoming@zju.edu.cn>
+Cc: Brian Norris <briannorris@chromium.org>
+Cc: Johannes Berg <johannes@sipsolutions.net>
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/marvell/mwifiex/init.c      |    9 ++++-----
+ drivers/net/wireless/marvell/mwifiex/main.h      |    3 +--
+ drivers/net/wireless/marvell/mwifiex/sta_event.c |    6 +++---
+ 3 files changed, 8 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/wireless/marvell/mwifiex/init.c
++++ b/drivers/net/wireless/marvell/mwifiex/init.c
+@@ -63,10 +63,9 @@ static void wakeup_timer_fn(struct timer
+               adapter->if_ops.card_reset(adapter);
+ }
+ 
+-static void fw_dump_work(struct work_struct *work)
++static void fw_dump_timer_fn(struct timer_list *t)
+ {
+-      struct mwifiex_adapter *adapter =
+-              container_of(work, struct mwifiex_adapter, devdump_work.work);
++      struct mwifiex_adapter *adapter = from_timer(adapter, t, devdump_timer);
+ 
+       mwifiex_upload_device_dump(adapter);
+ }
+@@ -322,7 +321,7 @@ static void mwifiex_init_adapter(struct
+       adapter->active_scan_triggered = false;
+       timer_setup(&adapter->wakeup_timer, wakeup_timer_fn, 0);
+       adapter->devdump_len = 0;
+-      INIT_DELAYED_WORK(&adapter->devdump_work, fw_dump_work);
++      timer_setup(&adapter->devdump_timer, fw_dump_timer_fn, 0);
+ }
+ 
+ /*
+@@ -401,7 +400,7 @@ static void
+ mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
+ {
+       del_timer(&adapter->wakeup_timer);
+-      cancel_delayed_work_sync(&adapter->devdump_work);
++      del_timer_sync(&adapter->devdump_timer);
+       mwifiex_cancel_all_pending_cmd(adapter);
+       wake_up_interruptible(&adapter->cmd_wait_q.wait);
+       wake_up_interruptible(&adapter->hs_activate_wait_q);
+--- a/drivers/net/wireless/marvell/mwifiex/main.h
++++ b/drivers/net/wireless/marvell/mwifiex/main.h
+@@ -49,7 +49,6 @@
+ #include <linux/pm_runtime.h>
+ #include <linux/slab.h>
+ #include <linux/of_irq.h>
+-#include <linux/workqueue.h>
+ 
+ #include "decl.h"
+ #include "ioctl.h"
+@@ -1054,7 +1053,7 @@ struct mwifiex_adapter {
+       /* Device dump data/length */
+       void *devdump_data;
+       int devdump_len;
+-      struct delayed_work devdump_work;
++      struct timer_list devdump_timer;
+ 
+       bool ignore_btcoex_events;
+ };
+--- a/drivers/net/wireless/marvell/mwifiex/sta_event.c
++++ b/drivers/net/wireless/marvell/mwifiex/sta_event.c
+@@ -622,8 +622,8 @@ mwifiex_fw_dump_info_event(struct mwifie
+                * transmission event get lost, in this cornel case,
+                * user would still get partial of the dump.
+                */
+-              schedule_delayed_work(&adapter->devdump_work,
+-                                    msecs_to_jiffies(MWIFIEX_TIMER_10S));
++              mod_timer(&adapter->devdump_timer,
++                        jiffies + msecs_to_jiffies(MWIFIEX_TIMER_10S));
+       }
+ 
+       /* Overflow check */
+@@ -642,7 +642,7 @@ mwifiex_fw_dump_info_event(struct mwifie
+       return;
+ 
+ upload_dump:
+-      cancel_delayed_work_sync(&adapter->devdump_work);
++      del_timer_sync(&adapter->devdump_timer);
+       mwifiex_upload_device_dump(adapter);
+ }
+ 

diff --git a/queue-5.10/series b/queue-5.10/series
index d98ba853ab8d54923b3d0d5a2f1a0a059f8b3ce0..fc5b6c0e334234377bae38f94a04e6f286b80c6e 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -538,3 +538,5 @@ kvm-add-infrastructure-and-macro-to-mark-vm-as-bugged.patch
 kvm-x86-check-lapic_in_kernel-before-attempting-to-set-a-synic-irq.patch
 kvm-x86-avoid-theoretical-null-pointer-dereference-in-kvm_irq_delivery_to_apic_fast.patch
 mac80211-fix-a-memory-leak-where-sta_info-is-not-freed.patch
+tcp-fix-over-estimation-in-sk_forced_mem_schedule.patch
+revert-mwifiex-fix-sleep-in-atomic-context-bugs-caused-by-dev_coredumpv.patch

diff --git a/queue-5.10/tcp-fix-over-estimation-in-sk_forced_mem_schedule.patch b/queue-5.10/tcp-fix-over-estimation-in-sk_forced_mem_schedule.patch
new file mode 100644 (file)
index 0000000..e12b03b
--- /dev/null
+++ b/queue-5.10/tcp-fix-over-estimation-in-sk_forced_mem_schedule.patch
@@ -0,0 +1,45 @@
+From c4ee118561a0f74442439b7b5b486db1ac1ddfeb Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Tue, 14 Jun 2022 10:17:33 -0700
+Subject: tcp: fix over estimation in sk_forced_mem_schedule()
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit c4ee118561a0f74442439b7b5b486db1ac1ddfeb upstream.
+
+sk_forced_mem_schedule() has a bug similar to ones fixed
+in commit 7c80b038d23e ("net: fix sk_wmem_schedule() and
+sk_rmem_schedule() errors")
+
+While this bug has little chance to trigger in old kernels,
+we need to fix it before the following patch.
+
+Fixes: d83769a580f1 ("tcp: fix possible deadlock in tcp_send_fin()")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
+Reviewed-by: Shakeel Butt <shakeelb@google.com>
+Reviewed-by: Wei Wang <weiwan@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/tcp_output.c |    7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -3372,11 +3372,12 @@ void tcp_xmit_retransmit_queue(struct so
+  */
+ void sk_forced_mem_schedule(struct sock *sk, int size)
+ {
+-      int amt;
++      int delta, amt;
+ 
+-      if (size <= sk->sk_forward_alloc)
++      delta = size - sk->sk_forward_alloc;
++      if (delta <= 0)
+               return;
+-      amt = sk_mem_pages(size);
++      amt = sk_mem_pages(delta);
+       sk->sk_forward_alloc += amt * SK_MEM_QUANTUM;
+       sk_memory_allocated_add(sk, amt);
+