From 592246b6aa2fa210d3da8af8cb4ba3599b6cf5cf Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 4 Jul 2022 14:19:07 +0200 Subject: [PATCH] 5.18-stable patches added patches: linux-dim-fix-divide-by-0-in-rdma-dim.patch mptcp-fix-conflict-with-netinet-in.h.patch mptcp-fix-race-on-unaccepted-mptcp-sockets.patch net-dp83822-disable-false-carrier-interrupt.patch net-dp83822-disable-rx-error-interrupt.patch net-dsa-bcm_sf2-force-pause-link-settings.patch net-fix-iff_tx_skb_no_linear-definition.patch net-tun-stop-napi-when-detaching-queues.patch net-tun-unlink-napi-from-device-on-destruction.patch net-usb-asix-do-not-force-pause-frames-support.patch rdma-cm-fix-memory-leak-in-ib_cm_insert_listen.patch rdma-qedr-fix-reporting-qp-timeout-attribute.patch selftests-mptcp-initialize-variables-to-quiet-gcc-12-warnings.patch selftests-mptcp-more-stable-diag-tests.patch selftests-net-pass-ipv6_args-to-udpgso_bench-s-ipv6-tcp-test.patch usbnet-fix-memory-allocation-in-helpers.patch --- ...inux-dim-fix-divide-by-0-in-rdma-dim.patch | 69 ++++++++++ ...mptcp-fix-conflict-with-netinet-in.h.patch | 57 ++++++++ ...fix-race-on-unaccepted-mptcp-sockets.patch | 129 ++++++++++++++++++ ...3822-disable-false-carrier-interrupt.patch | 41 ++++++ ...t-dp83822-disable-rx-error-interrupt.patch | 38 ++++++ ...sa-bcm_sf2-force-pause-link-settings.patch | 37 +++++ ...-fix-iff_tx_skb_no_linear-definition.patch | 33 +++++ ...-tun-stop-napi-when-detaching-queues.patch | 58 ++++++++ ...link-napi-from-device-on-destruction.patch | 34 +++++ ...ix-do-not-force-pause-frames-support.patch | 37 +++++ ...x-memory-leak-in-ib_cm_insert_listen.patch | 37 +++++ ...r-fix-reporting-qp-timeout-attribute.patch | 58 ++++++++ ...e-variables-to-quiet-gcc-12-warnings.patch | 62 +++++++++ ...lftests-mptcp-more-stable-diag-tests.patch | 129 ++++++++++++++++++ ...args-to-udpgso_bench-s-ipv6-tcp-test.patch | 34 +++++ queue-5.18/series | 16 +++ ...net-fix-memory-allocation-in-helpers.patch | 45 ++++++ 17 files changed, 914 insertions(+) create mode 100644 queue-5.18/linux-dim-fix-divide-by-0-in-rdma-dim.patch create mode 100644 queue-5.18/mptcp-fix-conflict-with-netinet-in.h.patch create mode 100644 queue-5.18/mptcp-fix-race-on-unaccepted-mptcp-sockets.patch create mode 100644 queue-5.18/net-dp83822-disable-false-carrier-interrupt.patch create mode 100644 queue-5.18/net-dp83822-disable-rx-error-interrupt.patch create mode 100644 queue-5.18/net-dsa-bcm_sf2-force-pause-link-settings.patch create mode 100644 queue-5.18/net-fix-iff_tx_skb_no_linear-definition.patch create mode 100644 queue-5.18/net-tun-stop-napi-when-detaching-queues.patch create mode 100644 queue-5.18/net-tun-unlink-napi-from-device-on-destruction.patch create mode 100644 queue-5.18/net-usb-asix-do-not-force-pause-frames-support.patch create mode 100644 queue-5.18/rdma-cm-fix-memory-leak-in-ib_cm_insert_listen.patch create mode 100644 queue-5.18/rdma-qedr-fix-reporting-qp-timeout-attribute.patch create mode 100644 queue-5.18/selftests-mptcp-initialize-variables-to-quiet-gcc-12-warnings.patch create mode 100644 queue-5.18/selftests-mptcp-more-stable-diag-tests.patch create mode 100644 queue-5.18/selftests-net-pass-ipv6_args-to-udpgso_bench-s-ipv6-tcp-test.patch create mode 100644 queue-5.18/usbnet-fix-memory-allocation-in-helpers.patch diff --git a/queue-5.18/linux-dim-fix-divide-by-0-in-rdma-dim.patch b/queue-5.18/linux-dim-fix-divide-by-0-in-rdma-dim.patch new file mode 100644 index 00000000000..a3d05fd42db --- /dev/null +++ b/queue-5.18/linux-dim-fix-divide-by-0-in-rdma-dim.patch @@ -0,0 +1,69 @@ +From 0fe3dbbefb74a8575f61d7801b08dbc50523d60d Mon Sep 17 00:00:00 2001 +From: Tao Liu +Date: Mon, 27 Jun 2022 22:00:04 +0800 +Subject: linux/dim: Fix divide by 0 in RDMA DIM + +From: Tao Liu + +commit 0fe3dbbefb74a8575f61d7801b08dbc50523d60d upstream. + +Fix a divide 0 error in rdma_dim_stats_compare() when prev->cpe_ratio == +0. + +CallTrace: + Hardware name: H3C R4900 G3/RS33M2C9S, BIOS 2.00.37P21 03/12/2020 + task: ffff880194b78000 task.stack: ffffc90006714000 + RIP: 0010:backport_rdma_dim+0x10e/0x240 [mlx_compat] + RSP: 0018:ffff880c10e83ec0 EFLAGS: 00010202 + RAX: 0000000000002710 RBX: ffff88096cd7f780 RCX: 0000000000000064 + RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000001 + RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 + R10: 0000000000000000 R11: 0000000000000000 R12: 000000001d7c6c09 + R13: ffff88096cd7f780 R14: ffff880b174fe800 R15: 0000000000000000 + FS: 0000000000000000(0000) GS:ffff880c10e80000(0000) + knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00000000a0965b00 CR3: 000000000200a003 CR4: 00000000007606e0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + PKRU: 55555554 + Call Trace: + + ib_poll_handler+0x43/0x80 [ib_core] + irq_poll_softirq+0xae/0x110 + __do_softirq+0xd1/0x28c + irq_exit+0xde/0xf0 + do_IRQ+0x54/0xe0 + common_interrupt+0x8f/0x8f + + ? cpuidle_enter_state+0xd9/0x2a0 + ? cpuidle_enter_state+0xc7/0x2a0 + ? do_idle+0x170/0x1d0 + ? cpu_startup_entry+0x6f/0x80 + ? start_secondary+0x1b9/0x210 + ? secondary_startup_64+0xa5/0xb0 + Code: 0f 87 e1 00 00 00 8b 4c 24 14 44 8b 43 14 89 c8 4d 63 c8 44 29 c0 99 31 d0 29 d0 31 d2 48 98 48 8d 04 80 48 8d 04 80 48 c1 e0 02 <49> f7 f1 48 83 f8 0a 0f 86 c1 00 00 00 44 39 c1 7f 10 48 89 df + RIP: backport_rdma_dim+0x10e/0x240 [mlx_compat] RSP: ffff880c10e83ec0 + +Fixes: f4915455dcf0 ("linux/dim: Implement RDMA adaptive moderation (DIM)") +Link: https://lore.kernel.org/r/20220627140004.3099-1-thomas.liu@ucloud.cn +Signed-off-by: Tao Liu +Reviewed-by: Max Gurtovoy +Acked-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/dim.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/linux/dim.h ++++ b/include/linux/dim.h +@@ -21,7 +21,7 @@ + * We consider 10% difference as significant. + */ + #define IS_SIGNIFICANT_DIFF(val, ref) \ +- (((100UL * abs((val) - (ref))) / (ref)) > 10) ++ ((ref) && (((100UL * abs((val) - (ref))) / (ref)) > 10)) + + /* + * Calculate the gap between two values. diff --git a/queue-5.18/mptcp-fix-conflict-with-netinet-in.h.patch b/queue-5.18/mptcp-fix-conflict-with-netinet-in.h.patch new file mode 100644 index 00000000000..f4e65d57835 --- /dev/null +++ b/queue-5.18/mptcp-fix-conflict-with-netinet-in.h.patch @@ -0,0 +1,57 @@ +From 06e445f740c1a0fe5d16b3dff8a4ef18e124e54e Mon Sep 17 00:00:00 2001 +From: Ossama Othman +Date: Mon, 27 Jun 2022 18:02:42 -0700 +Subject: mptcp: fix conflict with + +From: Ossama Othman + +commit 06e445f740c1a0fe5d16b3dff8a4ef18e124e54e upstream. + +Including before the C library header +causes symbol redefinition errors at compile-time due to duplicate +declarations and definitions in the header included by +. + +Explicitly include before in + when __KERNEL__ is not defined so that the C library +compatibility logic in is enabled when including + in user space code. + +Fixes: c11c5906bc0a ("mptcp: add MPTCP_SUBFLOW_ADDRS getsockopt support") +Signed-off-by: Ossama Othman +Signed-off-by: Mat Martineau +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + include/uapi/linux/mptcp.h | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/include/uapi/linux/mptcp.h b/include/uapi/linux/mptcp.h +index 921963589904..dfe19bf13f4c 100644 +--- a/include/uapi/linux/mptcp.h ++++ b/include/uapi/linux/mptcp.h +@@ -2,16 +2,17 @@ + #ifndef _UAPI_MPTCP_H + #define _UAPI_MPTCP_H + ++#ifndef __KERNEL__ ++#include /* for sockaddr_in and sockaddr_in6 */ ++#include /* for struct sockaddr */ ++#endif ++ + #include + #include + #include /* for sockaddr_in */ + #include /* for sockaddr_in6 */ + #include /* for sockaddr_storage and sa_family */ + +-#ifndef __KERNEL__ +-#include /* for struct sockaddr */ +-#endif +- + #define MPTCP_SUBFLOW_FLAG_MCAP_REM _BITUL(0) + #define MPTCP_SUBFLOW_FLAG_MCAP_LOC _BITUL(1) + #define MPTCP_SUBFLOW_FLAG_JOIN_REM _BITUL(2) +-- +2.37.0 + diff --git a/queue-5.18/mptcp-fix-race-on-unaccepted-mptcp-sockets.patch b/queue-5.18/mptcp-fix-race-on-unaccepted-mptcp-sockets.patch new file mode 100644 index 00000000000..2caff912d9a --- /dev/null +++ b/queue-5.18/mptcp-fix-race-on-unaccepted-mptcp-sockets.patch @@ -0,0 +1,129 @@ +From 6aeed9045071f2252ff4e98fc13d1e304f33e5b0 Mon Sep 17 00:00:00 2001 +From: Paolo Abeni +Date: Mon, 27 Jun 2022 18:02:40 -0700 +Subject: mptcp: fix race on unaccepted mptcp sockets + +From: Paolo Abeni + +commit 6aeed9045071f2252ff4e98fc13d1e304f33e5b0 upstream. + +When the listener socket owning the relevant request is closed, +it frees the unaccepted subflows and that causes later deletion +of the paired MPTCP sockets. + +The mptcp socket's worker can run in the time interval between such delete +operations. When that happens, any access to msk->first will cause an UaF +access, as the subflow cleanup did not cleared such field in the mptcp +socket. + +Address the issue explicitly traversing the listener socket accept +queue at close time and performing the needed cleanup on the pending +msk. + +Note that the locking is a bit tricky, as we need to acquire the msk +socket lock, while still owning the subflow socket one. + +Fixes: 86e39e04482b ("mptcp: keep track of local endpoint still available for each msk") +Signed-off-by: Paolo Abeni +Signed-off-by: Mat Martineau +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/protocol.c | 5 ++++ + net/mptcp/protocol.h | 2 + + net/mptcp/subflow.c | 52 +++++++++++++++++++++++++++++++++++++++++++++++++++ + 3 files changed, 59 insertions(+) + +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -2305,6 +2305,11 @@ static void __mptcp_close_ssk(struct soc + kfree_rcu(subflow, rcu); + } else { + /* otherwise tcp will dispose of the ssk and subflow ctx */ ++ if (ssk->sk_state == TCP_LISTEN) { ++ tcp_set_state(ssk, TCP_CLOSE); ++ mptcp_subflow_queue_clean(ssk); ++ inet_csk_listen_stop(ssk); ++ } + __tcp_close(ssk, 0); + + /* close acquired an extra ref */ +--- a/net/mptcp/protocol.h ++++ b/net/mptcp/protocol.h +@@ -286,6 +286,7 @@ struct mptcp_sock { + + u32 setsockopt_seq; + char ca_name[TCP_CA_NAME_MAX]; ++ struct mptcp_sock *dl_next; + }; + + #define mptcp_data_lock(sk) spin_lock_bh(&(sk)->sk_lock.slock) +@@ -585,6 +586,7 @@ void mptcp_close_ssk(struct sock *sk, st + struct mptcp_subflow_context *subflow); + void mptcp_subflow_send_ack(struct sock *ssk); + void mptcp_subflow_reset(struct sock *ssk); ++void mptcp_subflow_queue_clean(struct sock *ssk); + void mptcp_sock_graft(struct sock *sk, struct socket *parent); + struct socket *__mptcp_nmpc_socket(const struct mptcp_sock *msk); + +--- a/net/mptcp/subflow.c ++++ b/net/mptcp/subflow.c +@@ -1688,6 +1688,58 @@ static void subflow_state_change(struct + } + } + ++void mptcp_subflow_queue_clean(struct sock *listener_ssk) ++{ ++ struct request_sock_queue *queue = &inet_csk(listener_ssk)->icsk_accept_queue; ++ struct mptcp_sock *msk, *next, *head = NULL; ++ struct request_sock *req; ++ ++ /* build a list of all unaccepted mptcp sockets */ ++ spin_lock_bh(&queue->rskq_lock); ++ for (req = queue->rskq_accept_head; req; req = req->dl_next) { ++ struct mptcp_subflow_context *subflow; ++ struct sock *ssk = req->sk; ++ struct mptcp_sock *msk; ++ ++ if (!sk_is_mptcp(ssk)) ++ continue; ++ ++ subflow = mptcp_subflow_ctx(ssk); ++ if (!subflow || !subflow->conn) ++ continue; ++ ++ /* skip if already in list */ ++ msk = mptcp_sk(subflow->conn); ++ if (msk->dl_next || msk == head) ++ continue; ++ ++ msk->dl_next = head; ++ head = msk; ++ } ++ spin_unlock_bh(&queue->rskq_lock); ++ if (!head) ++ return; ++ ++ /* can't acquire the msk socket lock under the subflow one, ++ * or will cause ABBA deadlock ++ */ ++ release_sock(listener_ssk); ++ ++ for (msk = head; msk; msk = next) { ++ struct sock *sk = (struct sock *)msk; ++ bool slow; ++ ++ slow = lock_sock_fast_nested(sk); ++ next = msk->dl_next; ++ msk->first = NULL; ++ msk->dl_next = NULL; ++ unlock_sock_fast(sk, slow); ++ } ++ ++ /* we are still under the listener msk socket lock */ ++ lock_sock_nested(listener_ssk, SINGLE_DEPTH_NESTING); ++} ++ + static int subflow_ulp_init(struct sock *sk) + { + struct inet_connection_sock *icsk = inet_csk(sk); diff --git a/queue-5.18/net-dp83822-disable-false-carrier-interrupt.patch b/queue-5.18/net-dp83822-disable-false-carrier-interrupt.patch new file mode 100644 index 00000000000..41931f7a239 --- /dev/null +++ b/queue-5.18/net-dp83822-disable-false-carrier-interrupt.patch @@ -0,0 +1,41 @@ +From c96614eeab663646f57f67aa591e015abd8bd0ba Mon Sep 17 00:00:00 2001 +From: Enguerrand de Ribaucourt +Date: Thu, 23 Jun 2022 15:46:44 +0200 +Subject: net: dp83822: disable false carrier interrupt + +From: Enguerrand de Ribaucourt + +commit c96614eeab663646f57f67aa591e015abd8bd0ba upstream. + +When unplugging an Ethernet cable, false carrier events were produced by +the PHY at a very high rate. Once the false carrier counter full, an +interrupt was triggered every few clock cycles until the cable was +replugged. This resulted in approximately 10k/s interrupts. + +Since the false carrier counter (FCSCR) is never used, we can safely +disable this interrupt. + +In addition to improving performance, this also solved MDIO read +timeouts I was randomly encountering with an i.MX8 fec MAC because of +the interrupt flood. The interrupt count and MDIO timeout fix were +tested on a v5.4.110 kernel. + +Fixes: 87461f7a58ab ("net: phy: DP83822 initial driver submission") +Signed-off-by: Enguerrand de Ribaucourt +Reviewed-by: Andrew Lunn +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/dp83822.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/net/phy/dp83822.c ++++ b/drivers/net/phy/dp83822.c +@@ -229,7 +229,6 @@ static int dp83822_config_intr(struct ph + return misr_status; + + misr_status |= (DP83822_RX_ERR_HF_INT_EN | +- DP83822_FALSE_CARRIER_HF_INT_EN | + DP83822_LINK_STAT_INT_EN | + DP83822_ENERGY_DET_INT_EN | + DP83822_LINK_QUAL_INT_EN); diff --git a/queue-5.18/net-dp83822-disable-rx-error-interrupt.patch b/queue-5.18/net-dp83822-disable-rx-error-interrupt.patch new file mode 100644 index 00000000000..4718f6f784d --- /dev/null +++ b/queue-5.18/net-dp83822-disable-rx-error-interrupt.patch @@ -0,0 +1,38 @@ +From 0e597e2affb90d6ea48df6890d882924acf71e19 Mon Sep 17 00:00:00 2001 +From: Enguerrand de Ribaucourt +Date: Thu, 23 Jun 2022 15:46:45 +0200 +Subject: net: dp83822: disable rx error interrupt + +From: Enguerrand de Ribaucourt + +commit 0e597e2affb90d6ea48df6890d882924acf71e19 upstream. + +Some RX errors, notably when disconnecting the cable, increase the RCSR +register. Once half full (0x7fff), an interrupt flood is generated. I +measured ~3k/s interrupts even after the RX errors transfer was +stopped. + +Since we don't read and clear the RCSR register, we should disable this +interrupt. + +Fixes: 87461f7a58ab ("net: phy: DP83822 initial driver submission") +Signed-off-by: Enguerrand de Ribaucourt +Reviewed-by: Andrew Lunn +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/dp83822.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/net/phy/dp83822.c ++++ b/drivers/net/phy/dp83822.c +@@ -228,8 +228,7 @@ static int dp83822_config_intr(struct ph + if (misr_status < 0) + return misr_status; + +- misr_status |= (DP83822_RX_ERR_HF_INT_EN | +- DP83822_LINK_STAT_INT_EN | ++ misr_status |= (DP83822_LINK_STAT_INT_EN | + DP83822_ENERGY_DET_INT_EN | + DP83822_LINK_QUAL_INT_EN); + diff --git a/queue-5.18/net-dsa-bcm_sf2-force-pause-link-settings.patch b/queue-5.18/net-dsa-bcm_sf2-force-pause-link-settings.patch new file mode 100644 index 00000000000..f3b84f0d3d5 --- /dev/null +++ b/queue-5.18/net-dsa-bcm_sf2-force-pause-link-settings.patch @@ -0,0 +1,37 @@ +From 7c97bc0128b2eecc703106112679a69d446d1a12 Mon Sep 17 00:00:00 2001 +From: Doug Berger +Date: Wed, 22 Jun 2022 20:02:04 -0700 +Subject: net: dsa: bcm_sf2: force pause link settings + +From: Doug Berger + +commit 7c97bc0128b2eecc703106112679a69d446d1a12 upstream. + +The pause settings reported by the PHY should also be applied to the GMII port +status override otherwise the switch will not generate pause frames towards the +link partner despite the advertisement saying otherwise. + +Fixes: 246d7f773c13 ("net: dsa: add Broadcom SF2 switch driver") +Signed-off-by: Doug Berger +Signed-off-by: Florian Fainelli +Link: https://lore.kernel.org/r/20220623030204.1966851-1-f.fainelli@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/bcm_sf2.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/dsa/bcm_sf2.c ++++ b/drivers/net/dsa/bcm_sf2.c +@@ -878,6 +878,11 @@ static void bcm_sf2_sw_mac_link_up(struc + if (duplex == DUPLEX_FULL) + reg |= DUPLX_MODE; + ++ if (tx_pause) ++ reg |= TXFLOW_CNTL; ++ if (rx_pause) ++ reg |= RXFLOW_CNTL; ++ + core_writel(priv, reg, offset); + } + diff --git a/queue-5.18/net-fix-iff_tx_skb_no_linear-definition.patch b/queue-5.18/net-fix-iff_tx_skb_no_linear-definition.patch new file mode 100644 index 00000000000..e157e25f2d8 --- /dev/null +++ b/queue-5.18/net-fix-iff_tx_skb_no_linear-definition.patch @@ -0,0 +1,33 @@ +From 3b89b511ea0c705cc418440e2abf9d692a556d84 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 23 Jun 2022 16:32:32 +0300 +Subject: net: fix IFF_TX_SKB_NO_LINEAR definition + +From: Dan Carpenter + +commit 3b89b511ea0c705cc418440e2abf9d692a556d84 upstream. + +The "1<<31" shift has a sign extension bug so IFF_TX_SKB_NO_LINEAR is +0xffffffff80000000 instead of 0x0000000080000000. + +Fixes: c2ff53d8049f ("net: Add priv_flags for allow tx skb without linear") +Signed-off-by: Dan Carpenter +Reviewed-by: Xuan Zhuo +Link: https://lore.kernel.org/r/YrRrcGttfEVnf85Q@kili +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/netdevice.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -1653,7 +1653,7 @@ enum netdev_priv_flags { + IFF_FAILOVER_SLAVE = 1<<28, + IFF_L3MDEV_RX_HANDLER = 1<<29, + IFF_LIVE_RENAME_OK = 1<<30, +- IFF_TX_SKB_NO_LINEAR = 1<<31, ++ IFF_TX_SKB_NO_LINEAR = BIT_ULL(31), + IFF_CHANGE_PROTO_DOWN = BIT_ULL(32), + }; + diff --git a/queue-5.18/net-tun-stop-napi-when-detaching-queues.patch b/queue-5.18/net-tun-stop-napi-when-detaching-queues.patch new file mode 100644 index 00000000000..14705ce84cb --- /dev/null +++ b/queue-5.18/net-tun-stop-napi-when-detaching-queues.patch @@ -0,0 +1,58 @@ +From a8fc8cb5692aebb9c6f7afd4265366d25dcd1d01 Mon Sep 17 00:00:00 2001 +From: Jakub Kicinski +Date: Wed, 22 Jun 2022 21:21:05 -0700 +Subject: net: tun: stop NAPI when detaching queues + +From: Jakub Kicinski + +commit a8fc8cb5692aebb9c6f7afd4265366d25dcd1d01 upstream. + +While looking at a syzbot report I noticed the NAPI only gets +disabled before it's deleted. I think that user can detach +the queue before destroying the device and the NAPI will never +be stopped. + +Fixes: 943170998b20 ("tun: enable NAPI for TUN/TAP driver") +Acked-by: Petar Penkov +Link: https://lore.kernel.org/r/20220623042105.2274812-1-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/tun.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -274,6 +274,12 @@ static void tun_napi_init(struct tun_str + } + } + ++static void tun_napi_enable(struct tun_file *tfile) ++{ ++ if (tfile->napi_enabled) ++ napi_enable(&tfile->napi); ++} ++ + static void tun_napi_disable(struct tun_file *tfile) + { + if (tfile->napi_enabled) +@@ -654,8 +660,10 @@ static void __tun_detach(struct tun_file + if (clean) { + RCU_INIT_POINTER(tfile->tun, NULL); + sock_put(&tfile->sk); +- } else ++ } else { + tun_disable_queue(tun, tfile); ++ tun_napi_disable(tfile); ++ } + + synchronize_net(); + tun_flow_delete_by_queue(tun, tun->numqueues + 1); +@@ -809,6 +817,7 @@ static int tun_attach(struct tun_struct + + if (tfile->detached) { + tun_enable_queue(tfile); ++ tun_napi_enable(tfile); + } else { + sock_hold(&tfile->sk); + tun_napi_init(tun, tfile, napi, napi_frags); diff --git a/queue-5.18/net-tun-unlink-napi-from-device-on-destruction.patch b/queue-5.18/net-tun-unlink-napi-from-device-on-destruction.patch new file mode 100644 index 00000000000..f6ca2ae7981 --- /dev/null +++ b/queue-5.18/net-tun-unlink-napi-from-device-on-destruction.patch @@ -0,0 +1,34 @@ +From 3b9bc84d311104906d2b4995a9a02d7b7ddab2db Mon Sep 17 00:00:00 2001 +From: Jakub Kicinski +Date: Wed, 22 Jun 2022 21:20:39 -0700 +Subject: net: tun: unlink NAPI from device on destruction + +From: Jakub Kicinski + +commit 3b9bc84d311104906d2b4995a9a02d7b7ddab2db upstream. + +Syzbot found a race between tun file and device destruction. +NAPIs live in struct tun_file which can get destroyed before +the netdev so we have to del them explicitly. The current +code is missing deleting the NAPI if the queue was detached +first. + +Fixes: 943170998b20 ("tun: enable NAPI for TUN/TAP driver") +Reported-by: syzbot+b75c138e9286ac742647@syzkaller.appspotmail.com +Link: https://lore.kernel.org/r/20220623042039.2274708-1-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/tun.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -728,6 +728,7 @@ static void tun_detach_all(struct net_de + sock_put(&tfile->sk); + } + list_for_each_entry_safe(tfile, tmp, &tun->disabled, next) { ++ tun_napi_del(tfile); + tun_enable_queue(tfile); + tun_queue_purge(tfile); + xdp_rxq_info_unreg(&tfile->xdp_rxq); diff --git a/queue-5.18/net-usb-asix-do-not-force-pause-frames-support.patch b/queue-5.18/net-usb-asix-do-not-force-pause-frames-support.patch new file mode 100644 index 00000000000..162d7cb5d87 --- /dev/null +++ b/queue-5.18/net-usb-asix-do-not-force-pause-frames-support.patch @@ -0,0 +1,37 @@ +From ce95ab775f8d8e89a038c0e5611a7381a2ef8e43 Mon Sep 17 00:00:00 2001 +From: Oleksij Rempel +Date: Fri, 24 Jun 2022 09:51:39 +0200 +Subject: net: usb: asix: do not force pause frames support + +From: Oleksij Rempel + +commit ce95ab775f8d8e89a038c0e5611a7381a2ef8e43 upstream. + +We should respect link partner capabilities and not force flow control +support on every link. Even more, in current state the MAC driver do not +advertises pause support so we should not keep flow control enabled at +all. + +Fixes: e532a096be0e ("net: usb: asix: ax88772: add phylib support") +Reported-by: Anton Lundin +Signed-off-by: Oleksij Rempel +Tested-by: Anton Lundin +Link: https://lore.kernel.org/r/20220624075139.3139300-2-o.rempel@pengutronix.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/asix.h | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/net/usb/asix.h ++++ b/drivers/net/usb/asix.h +@@ -126,8 +126,7 @@ + AX_MEDIUM_RE) + + #define AX88772_MEDIUM_DEFAULT \ +- (AX_MEDIUM_FD | AX_MEDIUM_RFC | \ +- AX_MEDIUM_TFC | AX_MEDIUM_PS | \ ++ (AX_MEDIUM_FD | AX_MEDIUM_PS | \ + AX_MEDIUM_AC | AX_MEDIUM_RE) + + /* AX88772 & AX88178 RX_CTL values */ diff --git a/queue-5.18/rdma-cm-fix-memory-leak-in-ib_cm_insert_listen.patch b/queue-5.18/rdma-cm-fix-memory-leak-in-ib_cm_insert_listen.patch new file mode 100644 index 00000000000..bed0cad1278 --- /dev/null +++ b/queue-5.18/rdma-cm-fix-memory-leak-in-ib_cm_insert_listen.patch @@ -0,0 +1,37 @@ +From 2990f223ffa7bb25422956b9f79f9176a5b38346 Mon Sep 17 00:00:00 2001 +From: Miaoqian Lin +Date: Tue, 21 Jun 2022 09:25:44 +0400 +Subject: RDMA/cm: Fix memory leak in ib_cm_insert_listen + +From: Miaoqian Lin + +commit 2990f223ffa7bb25422956b9f79f9176a5b38346 upstream. + +cm_alloc_id_priv() allocates resource for the cm_id_priv. When +cm_init_listen() fails it doesn't free it, leading to memory leak. + +Add the missing error unwind. + +Fixes: 98f67156a80f ("RDMA/cm: Simplify establishing a listen cm_id") +Link: https://lore.kernel.org/r/20220621052546.4821-1-linmq006@gmail.com +Signed-off-by: Miaoqian Lin +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/core/cm.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -1252,8 +1252,10 @@ struct ib_cm_id *ib_cm_insert_listen(str + return ERR_CAST(cm_id_priv); + + err = cm_init_listen(cm_id_priv, service_id, 0); +- if (err) ++ if (err) { ++ ib_destroy_cm_id(&cm_id_priv->id); + return ERR_PTR(err); ++ } + + spin_lock_irq(&cm_id_priv->lock); + listen_id_priv = cm_insert_listen(cm_id_priv, cm_handler); diff --git a/queue-5.18/rdma-qedr-fix-reporting-qp-timeout-attribute.patch b/queue-5.18/rdma-qedr-fix-reporting-qp-timeout-attribute.patch new file mode 100644 index 00000000000..b714393eecf --- /dev/null +++ b/queue-5.18/rdma-qedr-fix-reporting-qp-timeout-attribute.patch @@ -0,0 +1,58 @@ +From 118f767413ada4eef7825fbd4af7c0866f883441 Mon Sep 17 00:00:00 2001 +From: Kamal Heib +Date: Wed, 25 May 2022 16:20:29 +0300 +Subject: RDMA/qedr: Fix reporting QP timeout attribute +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kamal Heib + +commit 118f767413ada4eef7825fbd4af7c0866f883441 upstream. + +Make sure to save the passed QP timeout attribute when the QP gets modified, +so when calling query QP the right value is reported and not the +converted value that is required by the firmware. This issue was found +while running the pyverbs tests. + +Fixes: cecbcddf6461 ("qedr: Add support for QP verbs") +Link: https://lore.kernel.org/r/20220525132029.84813-1-kamalheib1@gmail.com +Signed-off-by: Kamal Heib +Acked-by: Michal Kalderon  +Signed-off-by: Leon Romanovsky +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/qedr/qedr.h | 1 + + drivers/infiniband/hw/qedr/verbs.c | 4 +++- + 2 files changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/qedr/qedr.h ++++ b/drivers/infiniband/hw/qedr/qedr.h +@@ -418,6 +418,7 @@ struct qedr_qp { + u32 sq_psn; + u32 qkey; + u32 dest_qp_num; ++ u8 timeout; + + /* Relevant to qps created from kernel space only (ULPs) */ + u8 prev_wqe_size; +--- a/drivers/infiniband/hw/qedr/verbs.c ++++ b/drivers/infiniband/hw/qedr/verbs.c +@@ -2612,6 +2612,8 @@ int qedr_modify_qp(struct ib_qp *ibqp, s + 1 << max_t(int, attr->timeout - 8, 0); + else + qp_params.ack_timeout = 0; ++ ++ qp->timeout = attr->timeout; + } + + if (attr_mask & IB_QP_RETRY_CNT) { +@@ -2771,7 +2773,7 @@ int qedr_query_qp(struct ib_qp *ibqp, + rdma_ah_set_dgid_raw(&qp_attr->ah_attr, ¶ms.dgid.bytes[0]); + rdma_ah_set_port_num(&qp_attr->ah_attr, 1); + rdma_ah_set_sl(&qp_attr->ah_attr, 0); +- qp_attr->timeout = params.timeout; ++ qp_attr->timeout = qp->timeout; + qp_attr->rnr_retry = params.rnr_retry; + qp_attr->retry_cnt = params.retry_cnt; + qp_attr->min_rnr_timer = params.min_rnr_nak_timer; diff --git a/queue-5.18/selftests-mptcp-initialize-variables-to-quiet-gcc-12-warnings.patch b/queue-5.18/selftests-mptcp-initialize-variables-to-quiet-gcc-12-warnings.patch new file mode 100644 index 00000000000..30e1c8cd831 --- /dev/null +++ b/queue-5.18/selftests-mptcp-initialize-variables-to-quiet-gcc-12-warnings.patch @@ -0,0 +1,62 @@ +From fd37c2ecb21f7aee04ccca5f561469f07d00063c Mon Sep 17 00:00:00 2001 +From: Mat Martineau +Date: Mon, 27 Jun 2022 18:02:43 -0700 +Subject: selftests: mptcp: Initialize variables to quiet gcc 12 warnings + +From: Mat Martineau + +commit fd37c2ecb21f7aee04ccca5f561469f07d00063c upstream. + +In a few MPTCP selftest tools, gcc 12 complains that the 'sock' variable +might be used uninitialized. This is a false positive because the only +code path that could lead to uninitialized access is where getaddrinfo() +fails, but the local xgetaddrinfo() wrapper exits if such a failure +occurs. + +Initialize the 'sock' variable anyway to allow the tools to build with +gcc 12. + +Fixes: 048d19d444be ("mptcp: add basic kselftest for mptcp") +Acked-by: Paolo Abeni +Signed-off-by: Mat Martineau +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/net/mptcp/mptcp_connect.c | 2 +- + tools/testing/selftests/net/mptcp/mptcp_inq.c | 2 +- + tools/testing/selftests/net/mptcp/mptcp_sockopt.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +--- a/tools/testing/selftests/net/mptcp/mptcp_connect.c ++++ b/tools/testing/selftests/net/mptcp/mptcp_connect.c +@@ -265,7 +265,7 @@ static void sock_test_tcpulp(int sock, i + static int sock_listen_mptcp(const char * const listenaddr, + const char * const port) + { +- int sock; ++ int sock = -1; + struct addrinfo hints = { + .ai_protocol = IPPROTO_TCP, + .ai_socktype = SOCK_STREAM, +--- a/tools/testing/selftests/net/mptcp/mptcp_inq.c ++++ b/tools/testing/selftests/net/mptcp/mptcp_inq.c +@@ -88,7 +88,7 @@ static void xgetaddrinfo(const char *nod + static int sock_listen_mptcp(const char * const listenaddr, + const char * const port) + { +- int sock; ++ int sock = -1; + struct addrinfo hints = { + .ai_protocol = IPPROTO_TCP, + .ai_socktype = SOCK_STREAM, +--- a/tools/testing/selftests/net/mptcp/mptcp_sockopt.c ++++ b/tools/testing/selftests/net/mptcp/mptcp_sockopt.c +@@ -136,7 +136,7 @@ static void xgetaddrinfo(const char *nod + static int sock_listen_mptcp(const char * const listenaddr, + const char * const port) + { +- int sock; ++ int sock = -1; + struct addrinfo hints = { + .ai_protocol = IPPROTO_TCP, + .ai_socktype = SOCK_STREAM, diff --git a/queue-5.18/selftests-mptcp-more-stable-diag-tests.patch b/queue-5.18/selftests-mptcp-more-stable-diag-tests.patch new file mode 100644 index 00000000000..08795656b99 --- /dev/null +++ b/queue-5.18/selftests-mptcp-more-stable-diag-tests.patch @@ -0,0 +1,129 @@ +From 42fb6cddec3b306c9f6ef136b6438e0de1836431 Mon Sep 17 00:00:00 2001 +From: Paolo Abeni +Date: Mon, 27 Jun 2022 18:02:41 -0700 +Subject: selftests: mptcp: more stable diag tests + +From: Paolo Abeni + +commit 42fb6cddec3b306c9f6ef136b6438e0de1836431 upstream. + +The mentioned test-case still use an hard-coded-len sleep to +wait for a relative large number of connection to be established. + +On very slow VM and with debug build such timeout could be exceeded, +causing failures in our CI. + +Address the issue polling for the expected condition several times, +up to an unreasonable high amount of time. On reasonably fast system +the self-tests will be faster then before, on very slow one we will +still catch the correct condition. + +Fixes: df62f2ec3df6 ("selftests/mptcp: add diag interface tests") +Signed-off-by: Paolo Abeni +Signed-off-by: Mat Martineau +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/net/mptcp/diag.sh | 48 +++++++++++++++++++++++++----- + 1 file changed, 40 insertions(+), 8 deletions(-) + +--- a/tools/testing/selftests/net/mptcp/diag.sh ++++ b/tools/testing/selftests/net/mptcp/diag.sh +@@ -61,6 +61,39 @@ chk_msk_nr() + __chk_nr "grep -c token:" $* + } + ++wait_msk_nr() ++{ ++ local condition="grep -c token:" ++ local expected=$1 ++ local timeout=20 ++ local msg nr ++ local max=0 ++ local i=0 ++ ++ shift 1 ++ msg=$* ++ ++ while [ $i -lt $timeout ]; do ++ nr=$(ss -inmHMN $ns | $condition) ++ [ $nr == $expected ] && break; ++ [ $nr -gt $max ] && max=$nr ++ i=$((i + 1)) ++ sleep 1 ++ done ++ ++ printf "%-50s" "$msg" ++ if [ $i -ge $timeout ]; then ++ echo "[ fail ] timeout while expecting $expected max $max last $nr" ++ ret=$test_cnt ++ elif [ $nr != $expected ]; then ++ echo "[ fail ] expected $expected found $nr" ++ ret=$test_cnt ++ else ++ echo "[ ok ]" ++ fi ++ test_cnt=$((test_cnt+1)) ++} ++ + chk_msk_fallback_nr() + { + __chk_nr "grep -c fallback" $* +@@ -109,7 +142,7 @@ ip -n $ns link set dev lo up + echo "a" | \ + timeout ${timeout_test} \ + ip netns exec $ns \ +- ./mptcp_connect -p 10000 -l -t ${timeout_poll} \ ++ ./mptcp_connect -p 10000 -l -t ${timeout_poll} -w 20 \ + 0.0.0.0 >/dev/null & + wait_local_port_listen $ns 10000 + chk_msk_nr 0 "no msk on netns creation" +@@ -117,7 +150,7 @@ chk_msk_nr 0 "no msk on netns creation" + echo "b" | \ + timeout ${timeout_test} \ + ip netns exec $ns \ +- ./mptcp_connect -p 10000 -r 0 -t ${timeout_poll} \ ++ ./mptcp_connect -p 10000 -r 0 -t ${timeout_poll} -w 20 \ + 127.0.0.1 >/dev/null & + wait_connected $ns 10000 + chk_msk_nr 2 "after MPC handshake " +@@ -129,13 +162,13 @@ flush_pids + echo "a" | \ + timeout ${timeout_test} \ + ip netns exec $ns \ +- ./mptcp_connect -p 10001 -l -s TCP -t ${timeout_poll} \ ++ ./mptcp_connect -p 10001 -l -s TCP -t ${timeout_poll} -w 20 \ + 0.0.0.0 >/dev/null & + wait_local_port_listen $ns 10001 + echo "b" | \ + timeout ${timeout_test} \ + ip netns exec $ns \ +- ./mptcp_connect -p 10001 -r 0 -t ${timeout_poll} \ ++ ./mptcp_connect -p 10001 -r 0 -t ${timeout_poll} -w 20 \ + 127.0.0.1 >/dev/null & + wait_connected $ns 10001 + chk_msk_fallback_nr 1 "check fallback" +@@ -146,7 +179,7 @@ for I in `seq 1 $NR_CLIENTS`; do + echo "a" | \ + timeout ${timeout_test} \ + ip netns exec $ns \ +- ./mptcp_connect -p $((I+10001)) -l -w 10 \ ++ ./mptcp_connect -p $((I+10001)) -l -w 20 \ + -t ${timeout_poll} 0.0.0.0 >/dev/null & + done + wait_local_port_listen $ns $((NR_CLIENTS + 10001)) +@@ -155,12 +188,11 @@ for I in `seq 1 $NR_CLIENTS`; do + echo "b" | \ + timeout ${timeout_test} \ + ip netns exec $ns \ +- ./mptcp_connect -p $((I+10001)) -w 10 \ ++ ./mptcp_connect -p $((I+10001)) -w 20 \ + -t ${timeout_poll} 127.0.0.1 >/dev/null & + done +-sleep 1.5 + +-chk_msk_nr $((NR_CLIENTS*2)) "many msk socket present" ++wait_msk_nr $((NR_CLIENTS*2)) "many msk socket present" + flush_pids + + exit $ret diff --git a/queue-5.18/selftests-net-pass-ipv6_args-to-udpgso_bench-s-ipv6-tcp-test.patch b/queue-5.18/selftests-net-pass-ipv6_args-to-udpgso_bench-s-ipv6-tcp-test.patch new file mode 100644 index 00000000000..98ee114d338 --- /dev/null +++ b/queue-5.18/selftests-net-pass-ipv6_args-to-udpgso_bench-s-ipv6-tcp-test.patch @@ -0,0 +1,34 @@ +From b968080808f7f28b89aa495b7402ba48eb17ee93 Mon Sep 17 00:00:00 2001 +From: Dimitris Michailidis +Date: Wed, 22 Jun 2022 17:02:34 -0700 +Subject: selftests/net: pass ipv6_args to udpgso_bench's IPv6 TCP test + +From: Dimitris Michailidis + +commit b968080808f7f28b89aa495b7402ba48eb17ee93 upstream. + +udpgso_bench.sh has been running its IPv6 TCP test with IPv4 arguments +since its initial conmit. Looks like a typo. + +Fixes: 3a687bef148d ("selftests: udp gso benchmark") +Cc: willemb@google.com +Signed-off-by: Dimitris Michailidis +Acked-by: Willem de Bruijn +Link: https://lore.kernel.org/r/20220623000234.61774-1-dmichail@fungible.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/net/udpgso_bench.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/testing/selftests/net/udpgso_bench.sh ++++ b/tools/testing/selftests/net/udpgso_bench.sh +@@ -120,7 +120,7 @@ run_all() { + run_udp "${ipv4_args}" + + echo "ipv6" +- run_tcp "${ipv4_args}" ++ run_tcp "${ipv6_args}" + run_udp "${ipv6_args}" + } + diff --git a/queue-5.18/series b/queue-5.18/series index 1f619d9675a..b3278454ecc 100644 --- a/queue-5.18/series +++ b/queue-5.18/series @@ -23,3 +23,19 @@ sunrpc-fix-read_plus-crasher.patch net-rose-fix-uaf-bugs-caused-by-timer-handler.patch net-usb-ax88179_178a-fix-packet-receiving.patch virtio-net-fix-race-between-ndo_open-and-virtio_device_ready.patch +selftests-net-pass-ipv6_args-to-udpgso_bench-s-ipv6-tcp-test.patch +net-dsa-bcm_sf2-force-pause-link-settings.patch +net-tun-unlink-napi-from-device-on-destruction.patch +net-tun-stop-napi-when-detaching-queues.patch +net-fix-iff_tx_skb_no_linear-definition.patch +net-dp83822-disable-false-carrier-interrupt.patch +net-dp83822-disable-rx-error-interrupt.patch +rdma-qedr-fix-reporting-qp-timeout-attribute.patch +rdma-cm-fix-memory-leak-in-ib_cm_insert_listen.patch +linux-dim-fix-divide-by-0-in-rdma-dim.patch +net-usb-asix-do-not-force-pause-frames-support.patch +usbnet-fix-memory-allocation-in-helpers.patch +mptcp-fix-race-on-unaccepted-mptcp-sockets.patch +selftests-mptcp-more-stable-diag-tests.patch +mptcp-fix-conflict-with-netinet-in.h.patch +selftests-mptcp-initialize-variables-to-quiet-gcc-12-warnings.patch diff --git a/queue-5.18/usbnet-fix-memory-allocation-in-helpers.patch b/queue-5.18/usbnet-fix-memory-allocation-in-helpers.patch new file mode 100644 index 00000000000..5cc38dbcb5a --- /dev/null +++ b/queue-5.18/usbnet-fix-memory-allocation-in-helpers.patch @@ -0,0 +1,45 @@ +From e65af5403e462ccd7dff6a045a886c64da598c2e Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Tue, 28 Jun 2022 11:35:17 +0200 +Subject: usbnet: fix memory allocation in helpers + +From: Oliver Neukum + +commit e65af5403e462ccd7dff6a045a886c64da598c2e upstream. + +usbnet provides some helper functions that are also used in +the context of reset() operations. During a reset the other +drivers on a device are unable to operate. As that can be block +drivers, a driver for another interface cannot use paging +in its memory allocations without risking a deadlock. +Use GFP_NOIO in the helpers. + +Fixes: 877bd862f32b8 ("usbnet: introduce usbnet 3 command helpers") +Signed-off-by: Oliver Neukum +Link: https://lore.kernel.org/r/20220628093517.7469-1-oneukum@suse.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/usbnet.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/usb/usbnet.c ++++ b/drivers/net/usb/usbnet.c +@@ -2004,7 +2004,7 @@ static int __usbnet_read_cmd(struct usbn + cmd, reqtype, value, index, size); + + if (size) { +- buf = kmalloc(size, GFP_KERNEL); ++ buf = kmalloc(size, GFP_NOIO); + if (!buf) + goto out; + } +@@ -2036,7 +2036,7 @@ static int __usbnet_write_cmd(struct usb + cmd, reqtype, value, index, size); + + if (data) { +- buf = kmemdup(data, size, GFP_KERNEL); ++ buf = kmemdup(data, size, GFP_NOIO); + if (!buf) + goto out; + } else { -- 2.47.3