From: Sasha Levin Date: Fri, 25 Jul 2025 15:06:07 +0000 (-0400) Subject: Fixes for 5.15 X-Git-Tag: v6.6.101~43 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f2bbd45163bde26c853619ba1b63fa4cb1de11af;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/i40e-add-rx_missed_errors-for-buffer-exhaustion.patch b/queue-5.15/i40e-add-rx_missed_errors-for-buffer-exhaustion.patch new file mode 100644 index 0000000000..b40c71fe61 --- /dev/null +++ b/queue-5.15/i40e-add-rx_missed_errors-for-buffer-exhaustion.patch @@ -0,0 +1,120 @@ +From d124ddddeb757bd6b2989cf1d85439bcc779d61e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Sep 2023 15:27:57 +0800 +Subject: i40e: Add rx_missed_errors for buffer exhaustion + +From: Yajun Deng + +[ Upstream commit 5337d294973331660e84e41836a54014de22e5b0 ] + +As the comment in struct rtnl_link_stats64, rx_dropped should not +include packets dropped by the device due to buffer exhaustion. +They are counted in rx_missed_errors, procfs folds those two counters +together. + +Add rx_missed_errors for buffer exhaustion, rx_missed_errors corresponds +to rx_discards, rx_dropped corresponds to rx_discards_other. + +Signed-off-by: Yajun Deng +Tested-by: Arpana Arland (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Stable-dep-of: 50b2af451597 ("i40e: report VF tx_dropped with tx_errors instead of tx_discards") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 3 ++- + drivers/net/ethernet/intel/i40e/i40e_main.c | 18 +++++++----------- + .../net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 2 +- + 3 files changed, 10 insertions(+), 13 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +index d0b9ee756b306..504edc8ec531c 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +@@ -247,6 +247,7 @@ static const struct i40e_stats i40e_gstrings_net_stats[] = { + I40E_NETDEV_STAT(rx_errors), + I40E_NETDEV_STAT(tx_errors), + I40E_NETDEV_STAT(rx_dropped), ++ I40E_NETDEV_STAT(rx_missed_errors), + I40E_NETDEV_STAT(tx_dropped), + I40E_NETDEV_STAT(collisions), + I40E_NETDEV_STAT(rx_length_errors), +@@ -317,7 +318,7 @@ static const struct i40e_stats i40e_gstrings_stats[] = { + I40E_PF_STAT("port.rx_broadcast", stats.eth.rx_broadcast), + I40E_PF_STAT("port.tx_broadcast", stats.eth.tx_broadcast), + I40E_PF_STAT("port.tx_errors", stats.eth.tx_errors), +- I40E_PF_STAT("port.rx_dropped", stats.eth.rx_discards), ++ I40E_PF_STAT("port.rx_discards", stats.eth.rx_discards), + I40E_PF_STAT("port.tx_dropped_link_down", stats.tx_dropped_link_down), + I40E_PF_STAT("port.rx_crc_errors", stats.crc_errors), + I40E_PF_STAT("port.illegal_bytes", stats.illegal_bytes), +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index bc5da0b8648c1..2a3b8dd72686d 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -493,6 +493,7 @@ static void i40e_get_netdev_stats_struct(struct net_device *netdev, + stats->tx_dropped = vsi_stats->tx_dropped; + stats->rx_errors = vsi_stats->rx_errors; + stats->rx_dropped = vsi_stats->rx_dropped; ++ stats->rx_missed_errors = vsi_stats->rx_missed_errors; + stats->rx_crc_errors = vsi_stats->rx_crc_errors; + stats->rx_length_errors = vsi_stats->rx_length_errors; + } +@@ -684,17 +685,13 @@ i40e_stats_update_rx_discards(struct i40e_vsi *vsi, struct i40e_hw *hw, + struct i40e_eth_stats *stat_offset, + struct i40e_eth_stats *stat) + { +- u64 rx_rdpc, rx_rxerr; +- + i40e_stat_update32(hw, I40E_GLV_RDPC(stat_idx), offset_loaded, +- &stat_offset->rx_discards, &rx_rdpc); ++ &stat_offset->rx_discards, &stat->rx_discards); + i40e_stat_update64(hw, + I40E_GL_RXERR1H(i40e_compute_pci_to_hw_id(vsi, hw)), + I40E_GL_RXERR1L(i40e_compute_pci_to_hw_id(vsi, hw)), + offset_loaded, &stat_offset->rx_discards_other, +- &rx_rxerr); +- +- stat->rx_discards = rx_rdpc + rx_rxerr; ++ &stat->rx_discards_other); + } + + /** +@@ -716,9 +713,6 @@ void i40e_update_eth_stats(struct i40e_vsi *vsi) + i40e_stat_update32(hw, I40E_GLV_TEPC(stat_idx), + vsi->stat_offsets_loaded, + &oes->tx_errors, &es->tx_errors); +- i40e_stat_update32(hw, I40E_GLV_RDPC(stat_idx), +- vsi->stat_offsets_loaded, +- &oes->rx_discards, &es->rx_discards); + i40e_stat_update32(hw, I40E_GLV_RUPP(stat_idx), + vsi->stat_offsets_loaded, + &oes->rx_unknown_protocol, &es->rx_unknown_protocol); +@@ -959,8 +953,10 @@ static void i40e_update_vsi_stats(struct i40e_vsi *vsi) + ns->tx_errors = es->tx_errors; + ons->multicast = oes->rx_multicast; + ns->multicast = es->rx_multicast; +- ons->rx_dropped = oes->rx_discards; +- ns->rx_dropped = es->rx_discards; ++ ons->rx_dropped = oes->rx_discards_other; ++ ns->rx_dropped = es->rx_discards_other; ++ ons->rx_missed_errors = oes->rx_discards; ++ ns->rx_missed_errors = es->rx_discards; + ons->tx_dropped = oes->tx_discards; + ns->tx_dropped = es->tx_discards; + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index d5b8462aa3eae..cc0c775d5d057 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -4879,7 +4879,7 @@ int i40e_get_vf_stats(struct net_device *netdev, int vf_id, + vf_stats->tx_bytes = stats->tx_bytes; + vf_stats->broadcast = stats->rx_broadcast; + vf_stats->multicast = stats->rx_multicast; +- vf_stats->rx_dropped = stats->rx_discards; ++ vf_stats->rx_dropped = stats->rx_discards + stats->rx_discards_other; + vf_stats->tx_dropped = stats->tx_discards; + + return 0; +-- +2.39.5 + diff --git a/queue-5.15/i40e-report-vf-tx_dropped-with-tx_errors-instead-of-.patch b/queue-5.15/i40e-report-vf-tx_dropped-with-tx_errors-instead-of-.patch new file mode 100644 index 0000000000..d8169768c9 --- /dev/null +++ b/queue-5.15/i40e-report-vf-tx_dropped-with-tx_errors-instead-of-.patch @@ -0,0 +1,108 @@ +From 9fdfb748c29405debd98b01999c9de6a904f63f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jun 2025 15:52:40 -0400 +Subject: i40e: report VF tx_dropped with tx_errors instead of tx_discards + +From: Dennis Chen + +[ Upstream commit 50b2af451597ca6eefe9d4543f8bbf8de8aa00e7 ] + +Currently the tx_dropped field in VF stats is not updated correctly +when reading stats from the PF. This is because it reads from +i40e_eth_stats.tx_discards which seems to be unused for per VSI stats, +as it is not updated by i40e_update_eth_stats() and the corresponding +register, GLV_TDPC, is not implemented[1]. + +Use i40e_eth_stats.tx_errors instead, which is actually updated by +i40e_update_eth_stats() by reading from GLV_TEPC. + +To test, create a VF and try to send bad packets through it: + +$ echo 1 > /sys/class/net/enp2s0f0/device/sriov_numvfs +$ cat test.py +from scapy.all import * + +vlan_pkt = Ether(dst="ff:ff:ff:ff:ff:ff") / Dot1Q(vlan=999) / IP(dst="192.168.0.1") / ICMP() +ttl_pkt = IP(dst="8.8.8.8", ttl=0) / ICMP() + +print("Send packet with bad VLAN tag") +sendp(vlan_pkt, iface="enp2s0f0v0") +print("Send packet with TTL=0") +sendp(ttl_pkt, iface="enp2s0f0v0") +$ ip -s link show dev enp2s0f0 +16: enp2s0f0: mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000 + link/ether 3c:ec:ef:b7:e0:ac brd ff:ff:ff:ff:ff:ff + RX: bytes packets errors dropped missed mcast + 0 0 0 0 0 0 + TX: bytes packets errors dropped carrier collsns + 0 0 0 0 0 0 + vf 0 link/ether e2:c6:fd:c1:1e:92 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off + RX: bytes packets mcast bcast dropped + 0 0 0 0 0 + TX: bytes packets dropped + 0 0 0 +$ python test.py +Send packet with bad VLAN tag +. +Sent 1 packets. +Send packet with TTL=0 +. +Sent 1 packets. +$ ip -s link show dev enp2s0f0 +16: enp2s0f0: mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000 + link/ether 3c:ec:ef:b7:e0:ac brd ff:ff:ff:ff:ff:ff + RX: bytes packets errors dropped missed mcast + 0 0 0 0 0 0 + TX: bytes packets errors dropped carrier collsns + 0 0 0 0 0 0 + vf 0 link/ether e2:c6:fd:c1:1e:92 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off + RX: bytes packets mcast bcast dropped + 0 0 0 0 0 + TX: bytes packets dropped + 0 0 0 + +A packet with non-existent VLAN tag and a packet with TTL = 0 are sent, +but tx_dropped is not incremented. + +After patch: + +$ ip -s link show dev enp2s0f0 +19: enp2s0f0: mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000 + link/ether 3c:ec:ef:b7:e0:ac brd ff:ff:ff:ff:ff:ff + RX: bytes packets errors dropped missed mcast + 0 0 0 0 0 0 + TX: bytes packets errors dropped carrier collsns + 0 0 0 0 0 0 + vf 0 link/ether 4a:b7:3d:37:f7:56 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off + RX: bytes packets mcast bcast dropped + 0 0 0 0 0 + TX: bytes packets dropped + 0 0 2 + +Fixes: dc645daef9af5bcbd9c ("i40e: implement VF stats NDO") +Signed-off-by: Dennis Chen +Link: https://www.intel.com/content/www/us/en/content-details/596333/intel-ethernet-controller-x710-tm4-at2-carlsville-datasheet.html +Reviewed-by: Simon Horman +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index cc0c775d5d057..7673ce2be1c02 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -4880,7 +4880,7 @@ int i40e_get_vf_stats(struct net_device *netdev, int vf_id, + vf_stats->broadcast = stats->rx_broadcast; + vf_stats->multicast = stats->rx_multicast; + vf_stats->rx_dropped = stats->rx_discards + stats->rx_discards_other; +- vf_stats->tx_dropped = stats->tx_discards; ++ vf_stats->tx_dropped = stats->tx_errors; + + return 0; + } +-- +2.39.5 + diff --git a/queue-5.15/net-appletalk-fix-use-after-free-in-aarp-proxy-probe.patch b/queue-5.15/net-appletalk-fix-use-after-free-in-aarp-proxy-probe.patch new file mode 100644 index 0000000000..fc2046d3d5 --- /dev/null +++ b/queue-5.15/net-appletalk-fix-use-after-free-in-aarp-proxy-probe.patch @@ -0,0 +1,185 @@ +From 62ad76c3de56fe29f3163a1097af047dfccb594a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Jul 2025 01:28:43 +0000 +Subject: net: appletalk: Fix use-after-free in AARP proxy probe +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kito Xu (veritas501) + +[ Upstream commit 6c4a92d07b0850342d3becf2e608f805e972467c ] + +The AARP proxy‐probe routine (aarp_proxy_probe_network) sends a probe, +releases the aarp_lock, sleeps, then re-acquires the lock. During that +window an expire timer thread (__aarp_expire_timer) can remove and +kfree() the same entry, leading to a use-after-free. + +race condition: + + cpu 0 | cpu 1 + atalk_sendmsg() | atif_proxy_probe_device() + aarp_send_ddp() | aarp_proxy_probe_network() + mod_timer() | lock(aarp_lock) // LOCK!! + timeout around 200ms | alloc(aarp_entry) + and then call | proxies[hash] = aarp_entry + aarp_expire_timeout() | aarp_send_probe() + | unlock(aarp_lock) // UNLOCK!! + lock(aarp_lock) // LOCK!! | msleep(100); + __aarp_expire_timer(&proxies[ct]) | + free(aarp_entry) | + unlock(aarp_lock) // UNLOCK!! | + | lock(aarp_lock) // LOCK!! + | UAF aarp_entry !! + +================================================================== +BUG: KASAN: slab-use-after-free in aarp_proxy_probe_network+0x560/0x630 net/appletalk/aarp.c:493 +Read of size 4 at addr ffff8880123aa360 by task repro/13278 + +CPU: 3 UID: 0 PID: 13278 Comm: repro Not tainted 6.15.2 #3 PREEMPT(full) +Call Trace: + + __dump_stack lib/dump_stack.c:94 [inline] + dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120 + print_address_description mm/kasan/report.c:408 [inline] + print_report+0xc1/0x630 mm/kasan/report.c:521 + kasan_report+0xca/0x100 mm/kasan/report.c:634 + aarp_proxy_probe_network+0x560/0x630 net/appletalk/aarp.c:493 + atif_proxy_probe_device net/appletalk/ddp.c:332 [inline] + atif_ioctl+0xb58/0x16c0 net/appletalk/ddp.c:857 + atalk_ioctl+0x198/0x2f0 net/appletalk/ddp.c:1818 + sock_do_ioctl+0xdc/0x260 net/socket.c:1190 + sock_ioctl+0x239/0x6a0 net/socket.c:1311 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:906 [inline] + __se_sys_ioctl fs/ioctl.c:892 [inline] + __x64_sys_ioctl+0x194/0x200 fs/ioctl.c:892 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0xcb/0x250 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + + +Allocated: + aarp_alloc net/appletalk/aarp.c:382 [inline] + aarp_proxy_probe_network+0xd8/0x630 net/appletalk/aarp.c:468 + atif_proxy_probe_device net/appletalk/ddp.c:332 [inline] + atif_ioctl+0xb58/0x16c0 net/appletalk/ddp.c:857 + atalk_ioctl+0x198/0x2f0 net/appletalk/ddp.c:1818 + +Freed: + kfree+0x148/0x4d0 mm/slub.c:4841 + __aarp_expire net/appletalk/aarp.c:90 [inline] + __aarp_expire_timer net/appletalk/aarp.c:261 [inline] + aarp_expire_timeout+0x480/0x6e0 net/appletalk/aarp.c:317 + +The buggy address belongs to the object at ffff8880123aa300 + which belongs to the cache kmalloc-192 of size 192 +The buggy address is located 96 bytes inside of + freed 192-byte region [ffff8880123aa300, ffff8880123aa3c0) + +Memory state around the buggy address: + ffff8880123aa200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + ffff8880123aa280: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc +>ffff8880123aa300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ^ + ffff8880123aa380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc + ffff8880123aa400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +================================================================== + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kito Xu (veritas501) +Link: https://patch.msgid.link/20250717012843.880423-1-hxzene@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/appletalk/aarp.c | 24 +++++++++++++++++++++--- + 1 file changed, 21 insertions(+), 3 deletions(-) + +diff --git a/net/appletalk/aarp.c b/net/appletalk/aarp.c +index c7236daa24152..0d7c14a496681 100644 +--- a/net/appletalk/aarp.c ++++ b/net/appletalk/aarp.c +@@ -35,6 +35,7 @@ + #include + #include + #include ++#include + + int sysctl_aarp_expiry_time = AARP_EXPIRY_TIME; + int sysctl_aarp_tick_time = AARP_TICK_TIME; +@@ -44,6 +45,7 @@ int sysctl_aarp_resolve_time = AARP_RESOLVE_TIME; + /* Lists of aarp entries */ + /** + * struct aarp_entry - AARP entry ++ * @refcnt: Reference count + * @last_sent: Last time we xmitted the aarp request + * @packet_queue: Queue of frames wait for resolution + * @status: Used for proxy AARP +@@ -55,6 +57,7 @@ int sysctl_aarp_resolve_time = AARP_RESOLVE_TIME; + * @next: Next entry in chain + */ + struct aarp_entry { ++ refcount_t refcnt; + /* These first two are only used for unresolved entries */ + unsigned long last_sent; + struct sk_buff_head packet_queue; +@@ -79,6 +82,17 @@ static DEFINE_RWLOCK(aarp_lock); + /* Used to walk the list and purge/kick entries. */ + static struct timer_list aarp_timer; + ++static inline void aarp_entry_get(struct aarp_entry *a) ++{ ++ refcount_inc(&a->refcnt); ++} ++ ++static inline void aarp_entry_put(struct aarp_entry *a) ++{ ++ if (refcount_dec_and_test(&a->refcnt)) ++ kfree(a); ++} ++ + /* + * Delete an aarp queue + * +@@ -87,7 +101,7 @@ static struct timer_list aarp_timer; + static void __aarp_expire(struct aarp_entry *a) + { + skb_queue_purge(&a->packet_queue); +- kfree(a); ++ aarp_entry_put(a); + } + + /* +@@ -380,9 +394,11 @@ static void aarp_purge(void) + static struct aarp_entry *aarp_alloc(void) + { + struct aarp_entry *a = kmalloc(sizeof(*a), GFP_ATOMIC); ++ if (!a) ++ return NULL; + +- if (a) +- skb_queue_head_init(&a->packet_queue); ++ refcount_set(&a->refcnt, 1); ++ skb_queue_head_init(&a->packet_queue); + return a; + } + +@@ -508,6 +524,7 @@ int aarp_proxy_probe_network(struct atalk_iface *atif, struct atalk_addr *sa) + entry->dev = atif->dev; + + write_lock_bh(&aarp_lock); ++ aarp_entry_get(entry); + + hash = sa->s_node % (AARP_HASH_SIZE - 1); + entry->next = proxies[hash]; +@@ -533,6 +550,7 @@ int aarp_proxy_probe_network(struct atalk_iface *atif, struct atalk_addr *sa) + retval = 1; + } + ++ aarp_entry_put(entry); + write_unlock_bh(&aarp_lock); + out: + return retval; +-- +2.39.5 + diff --git a/queue-5.15/net-hns3-disable-interrupt-when-ptp-init-failed.patch b/queue-5.15/net-hns3-disable-interrupt-when-ptp-init-failed.patch new file mode 100644 index 0000000000..4191737dae --- /dev/null +++ b/queue-5.15/net-hns3-disable-interrupt-when-ptp-init-failed.patch @@ -0,0 +1,66 @@ +From 08689438c64d3dccf15fd66908e478463dc4c873 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jul 2025 20:54:21 +0800 +Subject: net: hns3: disable interrupt when ptp init failed + +From: Yonglong Liu + +[ Upstream commit cde304655f25d94a996c45b0f9956e7dcc2bc4c0 ] + +When ptp init failed, we'd better disable the interrupt and clear the +flag, to avoid early report interrupt at next probe. + +Fixes: 0bf5eb788512 ("net: hns3: add support for PTP") +Signed-off-by: Yonglong Liu +Signed-off-by: Jijie Shao +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250722125423.1270673-3-shaojijie@huawei.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c +index b7cf9fbf97183..6d7aeac600128 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c +@@ -509,14 +509,14 @@ int hclge_ptp_init(struct hclge_dev *hdev) + if (ret) { + dev_err(&hdev->pdev->dev, + "failed to init freq, ret = %d\n", ret); +- goto out; ++ goto out_clear_int; + } + + ret = hclge_ptp_set_ts_mode(hdev, &hdev->ptp->ts_cfg); + if (ret) { + dev_err(&hdev->pdev->dev, + "failed to init ts mode, ret = %d\n", ret); +- goto out; ++ goto out_clear_int; + } + + ktime_get_real_ts64(&ts); +@@ -524,7 +524,7 @@ int hclge_ptp_init(struct hclge_dev *hdev) + if (ret) { + dev_err(&hdev->pdev->dev, + "failed to init ts time, ret = %d\n", ret); +- goto out; ++ goto out_clear_int; + } + + set_bit(HCLGE_STATE_PTP_EN, &hdev->state); +@@ -532,6 +532,9 @@ int hclge_ptp_init(struct hclge_dev *hdev) + + return 0; + ++out_clear_int: ++ clear_bit(HCLGE_PTP_FLAG_EN, &hdev->ptp->flags); ++ hclge_ptp_int_en(hdev, false); + out: + hclge_ptp_destroy_clock(hdev); + +-- +2.39.5 + diff --git a/queue-5.15/net-hns3-fix-concurrent-setting-vlan-filter-issue.patch b/queue-5.15/net-hns3-fix-concurrent-setting-vlan-filter-issue.patch new file mode 100644 index 0000000000..5b11aa6a78 --- /dev/null +++ b/queue-5.15/net-hns3-fix-concurrent-setting-vlan-filter-issue.patch @@ -0,0 +1,105 @@ +From 47a9ce73cf35d147a2e88068b12124741e91e999 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jul 2025 20:54:20 +0800 +Subject: net: hns3: fix concurrent setting vlan filter issue + +From: Jian Shen + +[ Upstream commit 4555f8f8b6aa46940f55feb6a07704c2935b6d6e ] + +The vport->req_vlan_fltr_en may be changed concurrently by function +hclge_sync_vlan_fltr_state() called in periodic work task and +function hclge_enable_vport_vlan_filter() called by user configuration. +It may cause the user configuration inoperative. Fixes it by protect +the vport->req_vlan_fltr by vport_lock. + +Fixes: 2ba306627f59 ("net: hns3: add support for modify VLAN filter state") +Signed-off-by: Jian Shen +Signed-off-by: Jijie Shao +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250722125423.1270673-2-shaojijie@huawei.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../hisilicon/hns3/hns3pf/hclge_main.c | 36 +++++++++++-------- + 1 file changed, 21 insertions(+), 15 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index a0284a9d90e89..d228e37f8b3d9 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -9709,33 +9709,36 @@ static bool hclge_need_enable_vport_vlan_filter(struct hclge_vport *vport) + return false; + } + +-int hclge_enable_vport_vlan_filter(struct hclge_vport *vport, bool request_en) ++static int __hclge_enable_vport_vlan_filter(struct hclge_vport *vport, ++ bool request_en) + { +- struct hclge_dev *hdev = vport->back; + bool need_en; + int ret; + +- mutex_lock(&hdev->vport_lock); +- +- vport->req_vlan_fltr_en = request_en; +- + need_en = hclge_need_enable_vport_vlan_filter(vport); +- if (need_en == vport->cur_vlan_fltr_en) { +- mutex_unlock(&hdev->vport_lock); ++ if (need_en == vport->cur_vlan_fltr_en) + return 0; +- } + + ret = hclge_set_vport_vlan_filter(vport, need_en); +- if (ret) { +- mutex_unlock(&hdev->vport_lock); ++ if (ret) + return ret; +- } + + vport->cur_vlan_fltr_en = need_en; + ++ return 0; ++} ++ ++int hclge_enable_vport_vlan_filter(struct hclge_vport *vport, bool request_en) ++{ ++ struct hclge_dev *hdev = vport->back; ++ int ret; ++ ++ mutex_lock(&hdev->vport_lock); ++ vport->req_vlan_fltr_en = request_en; ++ ret = __hclge_enable_vport_vlan_filter(vport, request_en); + mutex_unlock(&hdev->vport_lock); + +- return 0; ++ return ret; + } + + static int hclge_enable_vlan_filter(struct hnae3_handle *handle, bool enable) +@@ -10743,16 +10746,19 @@ static void hclge_sync_vlan_fltr_state(struct hclge_dev *hdev) + &vport->state)) + continue; + +- ret = hclge_enable_vport_vlan_filter(vport, +- vport->req_vlan_fltr_en); ++ mutex_lock(&hdev->vport_lock); ++ ret = __hclge_enable_vport_vlan_filter(vport, ++ vport->req_vlan_fltr_en); + if (ret) { + dev_err(&hdev->pdev->dev, + "failed to sync vlan filter state for vport%u, ret = %d\n", + vport->vport_id, ret); + set_bit(HCLGE_VPORT_STATE_VLAN_FLTR_CHANGE, + &vport->state); ++ mutex_unlock(&hdev->vport_lock); + return; + } ++ mutex_unlock(&hdev->vport_lock); + } + } + +-- +2.39.5 + diff --git a/queue-5.15/net-hns3-fixed-vf-get-max-channels-bug.patch b/queue-5.15/net-hns3-fixed-vf-get-max-channels-bug.patch new file mode 100644 index 0000000000..78da7a1e27 --- /dev/null +++ b/queue-5.15/net-hns3-fixed-vf-get-max-channels-bug.patch @@ -0,0 +1,45 @@ +From b908039559bdb1b9e8cad163345874bd2494a3a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jul 2025 20:54:22 +0800 +Subject: net: hns3: fixed vf get max channels bug + +From: Jian Shen + +[ Upstream commit b3e75c0bcc53f647311960bc1b0970b9b480ca5a ] + +Currently, the queried maximum of vf channels is the maximum of channels +supported by each TC. However, the actual maximum of channels is +the maximum of channels supported by the device. + +Fixes: 849e46077689 ("net: hns3: add ethtool_ops.get_channels support for VF") +Signed-off-by: Jian Shen +Signed-off-by: Hao Lan +Signed-off-by: Jijie Shao +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250722125423.1270673-4-shaojijie@huawei.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +index 628d5c5ad75de..94e615177ff14 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +@@ -3571,11 +3571,7 @@ static void hclgevf_uninit_ae_dev(struct hnae3_ae_dev *ae_dev) + + static u32 hclgevf_get_max_channels(struct hclgevf_dev *hdev) + { +- struct hnae3_handle *nic = &hdev->nic; +- struct hnae3_knic_private_info *kinfo = &nic->kinfo; +- +- return min_t(u32, hdev->rss_size_max, +- hdev->num_tqps / kinfo->tc_info.num_tc); ++ return min(hdev->rss_size_max, hdev->num_tqps); + } + + /** +-- +2.39.5 + diff --git a/queue-5.15/net-sched-sch_qfq-avoid-triggering-might_sleep-in-at.patch b/queue-5.15/net-sched-sch_qfq-avoid-triggering-might_sleep-in-at.patch new file mode 100644 index 0000000000..4b0ac7ecb4 --- /dev/null +++ b/queue-5.15/net-sched-sch_qfq-avoid-triggering-might_sleep-in-at.patch @@ -0,0 +1,74 @@ +From b06ace715298e2a726100f38f9cd83545b378a88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Jul 2025 16:01:28 -0700 +Subject: net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in + qfq_delete_class + +From: Xiang Mei + +[ Upstream commit cf074eca0065bc5142e6004ae236bb35a2687fdf ] + +might_sleep could be trigger in the atomic context in qfq_delete_class. + +qfq_destroy_class was moved into atomic context locked +by sch_tree_lock to avoid a race condition bug on +qfq_aggregate. However, might_sleep could be triggered by +qfq_destroy_class, which introduced sleeping in atomic context (path: +qfq_destroy_class->qdisc_put->__qdisc_destroy->lockdep_unregister_key +->might_sleep). + +Considering the race is on the qfq_aggregate objects, keeping +qfq_rm_from_agg in the lock but moving the left part out can solve +this issue. + +Fixes: 5e28d5a3f774 ("net/sched: sch_qfq: Fix race condition on qfq_aggregate") +Reported-by: Dan Carpenter +Signed-off-by: Xiang Mei +Link: https://patch.msgid.link/4a04e0cc-a64b-44e7-9213-2880ed641d77@sabinyo.mountain +Reviewed-by: Cong Wang +Reviewed-by: Dan Carpenter +Link: https://patch.msgid.link/20250717230128.159766-1-xmei5@asu.edu +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/sched/sch_qfq.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c +index 0ef66612a5484..a00f6a9bcf367 100644 +--- a/net/sched/sch_qfq.c ++++ b/net/sched/sch_qfq.c +@@ -538,9 +538,6 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, + + static void qfq_destroy_class(struct Qdisc *sch, struct qfq_class *cl) + { +- struct qfq_sched *q = qdisc_priv(sch); +- +- qfq_rm_from_agg(q, cl); + gen_kill_estimator(&cl->rate_est); + qdisc_put(cl->qdisc); + kfree(cl); +@@ -559,10 +556,11 @@ static int qfq_delete_class(struct Qdisc *sch, unsigned long arg, + + qdisc_purge_queue(cl->qdisc); + qdisc_class_hash_remove(&q->clhash, &cl->common); +- qfq_destroy_class(sch, cl); ++ qfq_rm_from_agg(q, cl); + + sch_tree_unlock(sch); + ++ qfq_destroy_class(sch, cl); + return 0; + } + +@@ -1510,6 +1508,7 @@ static void qfq_destroy_qdisc(struct Qdisc *sch) + for (i = 0; i < q->clhash.hashsize; i++) { + hlist_for_each_entry_safe(cl, next, &q->clhash.hash[i], + common.hnode) { ++ qfq_rm_from_agg(q, cl); + qfq_destroy_class(sch, cl); + } + } +-- +2.39.5 + diff --git a/queue-5.15/series b/queue-5.15/series index f88430e857..01b8acf874 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -78,3 +78,10 @@ regulator-core-fix-null-dereference-on-unbind-due-to.patch rdma-core-rate-limit-gid-cache-warning-messages.patch interconnect-qcom-sc7280-add-missing-num_links-to-xm.patch regmap-fix-potential-memory-leak-of-regmap_bus.patch +i40e-add-rx_missed_errors-for-buffer-exhaustion.patch +i40e-report-vf-tx_dropped-with-tx_errors-instead-of-.patch +net-appletalk-fix-use-after-free-in-aarp-proxy-probe.patch +net-sched-sch_qfq-avoid-triggering-might_sleep-in-at.patch +net-hns3-fix-concurrent-setting-vlan-filter-issue.patch +net-hns3-disable-interrupt-when-ptp-init-failed.patch +net-hns3-fixed-vf-get-max-channels-bug.patch