From 5a7d9abf529cc55c994d8dd0b43d7baa117bdf8e Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 15 Aug 2022 15:14:56 +0200 Subject: [PATCH] 5.10-stable patches added patches: revert-mwifiex-fix-sleep-in-atomic-context-bugs-caused-by-dev_coredumpv.patch tcp-fix-over-estimation-in-sk_forced_mem_schedule.patch --- ...context-bugs-caused-by-dev_coredumpv.patch | 100 ++++++++++++++++++ queue-5.10/series | 2 + ...estimation-in-sk_forced_mem_schedule.patch | 45 ++++++++ 3 files changed, 147 insertions(+) create mode 100644 queue-5.10/revert-mwifiex-fix-sleep-in-atomic-context-bugs-caused-by-dev_coredumpv.patch create mode 100644 queue-5.10/tcp-fix-over-estimation-in-sk_forced_mem_schedule.patch diff --git a/queue-5.10/revert-mwifiex-fix-sleep-in-atomic-context-bugs-caused-by-dev_coredumpv.patch b/queue-5.10/revert-mwifiex-fix-sleep-in-atomic-context-bugs-caused-by-dev_coredumpv.patch new file mode 100644 index 00000000000..c748d34bed0 --- /dev/null +++ b/queue-5.10/revert-mwifiex-fix-sleep-in-atomic-context-bugs-caused-by-dev_coredumpv.patch @@ -0,0 +1,100 @@ +From 5f8954e099b8ae96e7de1bb95950e00c85bedd40 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Mon, 27 Jun 2022 16:35:59 +0200 +Subject: Revert "mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv" + +From: Greg Kroah-Hartman + +commit 5f8954e099b8ae96e7de1bb95950e00c85bedd40 upstream. + +This reverts commit a52ed4866d2b90dd5e4ae9dabd453f3ed8fa3cbc as it +causes build problems in linux-next. It needs to be reintroduced in a +way that can allow the api to evolve and not require a "flag day" to +catch all users. + +Link: https://lore.kernel.org/r/20220623160723.7a44b573@canb.auug.org.au +Cc: Duoming Zhou +Cc: Brian Norris +Cc: Johannes Berg +Reported-by: Stephen Rothwell +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/marvell/mwifiex/init.c | 9 ++++----- + drivers/net/wireless/marvell/mwifiex/main.h | 3 +-- + drivers/net/wireless/marvell/mwifiex/sta_event.c | 6 +++--- + 3 files changed, 8 insertions(+), 10 deletions(-) + +--- a/drivers/net/wireless/marvell/mwifiex/init.c ++++ b/drivers/net/wireless/marvell/mwifiex/init.c +@@ -63,10 +63,9 @@ static void wakeup_timer_fn(struct timer + adapter->if_ops.card_reset(adapter); + } + +-static void fw_dump_work(struct work_struct *work) ++static void fw_dump_timer_fn(struct timer_list *t) + { +- struct mwifiex_adapter *adapter = +- container_of(work, struct mwifiex_adapter, devdump_work.work); ++ struct mwifiex_adapter *adapter = from_timer(adapter, t, devdump_timer); + + mwifiex_upload_device_dump(adapter); + } +@@ -322,7 +321,7 @@ static void mwifiex_init_adapter(struct + adapter->active_scan_triggered = false; + timer_setup(&adapter->wakeup_timer, wakeup_timer_fn, 0); + adapter->devdump_len = 0; +- INIT_DELAYED_WORK(&adapter->devdump_work, fw_dump_work); ++ timer_setup(&adapter->devdump_timer, fw_dump_timer_fn, 0); + } + + /* +@@ -401,7 +400,7 @@ static void + mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter) + { + del_timer(&adapter->wakeup_timer); +- cancel_delayed_work_sync(&adapter->devdump_work); ++ del_timer_sync(&adapter->devdump_timer); + mwifiex_cancel_all_pending_cmd(adapter); + wake_up_interruptible(&adapter->cmd_wait_q.wait); + wake_up_interruptible(&adapter->hs_activate_wait_q); +--- a/drivers/net/wireless/marvell/mwifiex/main.h ++++ b/drivers/net/wireless/marvell/mwifiex/main.h +@@ -49,7 +49,6 @@ + #include + #include + #include +-#include + + #include "decl.h" + #include "ioctl.h" +@@ -1054,7 +1053,7 @@ struct mwifiex_adapter { + /* Device dump data/length */ + void *devdump_data; + int devdump_len; +- struct delayed_work devdump_work; ++ struct timer_list devdump_timer; + + bool ignore_btcoex_events; + }; +--- a/drivers/net/wireless/marvell/mwifiex/sta_event.c ++++ b/drivers/net/wireless/marvell/mwifiex/sta_event.c +@@ -622,8 +622,8 @@ mwifiex_fw_dump_info_event(struct mwifie + * transmission event get lost, in this cornel case, + * user would still get partial of the dump. + */ +- schedule_delayed_work(&adapter->devdump_work, +- msecs_to_jiffies(MWIFIEX_TIMER_10S)); ++ mod_timer(&adapter->devdump_timer, ++ jiffies + msecs_to_jiffies(MWIFIEX_TIMER_10S)); + } + + /* Overflow check */ +@@ -642,7 +642,7 @@ mwifiex_fw_dump_info_event(struct mwifie + return; + + upload_dump: +- cancel_delayed_work_sync(&adapter->devdump_work); ++ del_timer_sync(&adapter->devdump_timer); + mwifiex_upload_device_dump(adapter); + } + diff --git a/queue-5.10/series b/queue-5.10/series index d98ba853ab8..fc5b6c0e334 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -538,3 +538,5 @@ kvm-add-infrastructure-and-macro-to-mark-vm-as-bugged.patch kvm-x86-check-lapic_in_kernel-before-attempting-to-set-a-synic-irq.patch kvm-x86-avoid-theoretical-null-pointer-dereference-in-kvm_irq_delivery_to_apic_fast.patch mac80211-fix-a-memory-leak-where-sta_info-is-not-freed.patch +tcp-fix-over-estimation-in-sk_forced_mem_schedule.patch +revert-mwifiex-fix-sleep-in-atomic-context-bugs-caused-by-dev_coredumpv.patch diff --git a/queue-5.10/tcp-fix-over-estimation-in-sk_forced_mem_schedule.patch b/queue-5.10/tcp-fix-over-estimation-in-sk_forced_mem_schedule.patch new file mode 100644 index 00000000000..e12b03bf8a8 --- /dev/null +++ b/queue-5.10/tcp-fix-over-estimation-in-sk_forced_mem_schedule.patch @@ -0,0 +1,45 @@ +From c4ee118561a0f74442439b7b5b486db1ac1ddfeb Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Tue, 14 Jun 2022 10:17:33 -0700 +Subject: tcp: fix over estimation in sk_forced_mem_schedule() + +From: Eric Dumazet + +commit c4ee118561a0f74442439b7b5b486db1ac1ddfeb upstream. + +sk_forced_mem_schedule() has a bug similar to ones fixed +in commit 7c80b038d23e ("net: fix sk_wmem_schedule() and +sk_rmem_schedule() errors") + +While this bug has little chance to trigger in old kernels, +we need to fix it before the following patch. + +Fixes: d83769a580f1 ("tcp: fix possible deadlock in tcp_send_fin()") +Signed-off-by: Eric Dumazet +Acked-by: Soheil Hassas Yeganeh +Reviewed-by: Shakeel Butt +Reviewed-by: Wei Wang +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_output.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -3372,11 +3372,12 @@ void tcp_xmit_retransmit_queue(struct so + */ + void sk_forced_mem_schedule(struct sock *sk, int size) + { +- int amt; ++ int delta, amt; + +- if (size <= sk->sk_forward_alloc) ++ delta = size - sk->sk_forward_alloc; ++ if (delta <= 0) + return; +- amt = sk_mem_pages(size); ++ amt = sk_mem_pages(delta); + sk->sk_forward_alloc += amt * SK_MEM_QUANTUM; + sk_memory_allocated_add(sk, amt); + -- 2.47.3