--- /dev/null
+From 20d7d1c5c9b11e9f538ed4a2289be106de970d3e Mon Sep 17 00:00:00 2001
+From: Edwin Peer <edwin.peer@broadcom.com>
+Date: Fri, 26 Feb 2021 04:43:10 -0500
+Subject: bnxt_en: reliably allocate IRQ table on reset to avoid crash
+
+From: Edwin Peer <edwin.peer@broadcom.com>
+
+commit 20d7d1c5c9b11e9f538ed4a2289be106de970d3e upstream.
+
+The following trace excerpt corresponds with a NULL pointer dereference
+of 'bp->irq_tbl' in bnxt_setup_inta() on an Aarch64 system after many
+device resets:
+
+ Unable to handle kernel NULL pointer dereference at ... 000000d
+ ...
+ pc : string+0x3c/0x80
+ lr : vsnprintf+0x294/0x7e0
+ sp : ffff00000f61ba70 pstate : 20000145
+ x29: ffff00000f61ba70 x28: 000000000000000d
+ x27: ffff0000009c8b5a x26: ffff00000f61bb80
+ x25: ffff0000009c8b5a x24: 0000000000000012
+ x23: 00000000ffffffe0 x22: ffff000008990428
+ x21: ffff00000f61bb80 x20: 000000000000000d
+ x19: 000000000000001f x18: 0000000000000000
+ x17: 0000000000000000 x16: ffff800b6d0fb400
+ x15: 0000000000000000 x14: ffff800b7fe31ae8
+ x13: 00001ed16472c920 x12: ffff000008c6b1c9
+ x11: ffff000008cf0580 x10: ffff00000f61bb80
+ x9 : 00000000ffffffd8 x8 : 000000000000000c
+ x7 : ffff800b684b8000 x6 : 0000000000000000
+ x5 : 0000000000000065 x4 : 0000000000000001
+ x3 : ffff0a00ffffff04 x2 : 000000000000001f
+ x1 : 0000000000000000 x0 : 000000000000000d
+ Call trace:
+ string+0x3c/0x80
+ vsnprintf+0x294/0x7e0
+ snprintf+0x44/0x50
+ __bnxt_open_nic+0x34c/0x928 [bnxt_en]
+ bnxt_open+0xe8/0x238 [bnxt_en]
+ __dev_open+0xbc/0x130
+ __dev_change_flags+0x12c/0x168
+ dev_change_flags+0x20/0x60
+ ...
+
+Ordinarily, a call to bnxt_setup_inta() (not in trace due to inlining)
+would not be expected on a system supporting MSIX at all. However, if
+bnxt_init_int_mode() does not end up being called after the call to
+bnxt_clear_int_mode() in bnxt_fw_reset_close(), then the driver will
+think that only INTA is supported and bp->irq_tbl will be NULL,
+causing the above crash.
+
+In the error recovery scenario, we call bnxt_clear_int_mode() in
+bnxt_fw_reset_close() early in the sequence. Ordinarily, we will
+call bnxt_init_int_mode() in bnxt_hwrm_if_change() after we
+reestablish communication with the firmware after reset. However,
+if the sequence has to abort before we call bnxt_init_int_mode() and
+if the user later attempts to re-open the device, then it will cause
+the crash above.
+
+We fix it in 2 ways:
+
+1. Check for bp->irq_tbl in bnxt_setup_int_mode(). If it is NULL, call
+bnxt_init_init_mode().
+
+2. If we need to abort in bnxt_hwrm_if_change() and cannot complete
+the error recovery sequence, set the BNXT_STATE_ABORT_ERR flag. This
+will cause more drastic recovery at the next attempt to re-open the
+device, including a call to bnxt_init_int_mode().
+
+Fixes: 3bc7d4a352ef ("bnxt_en: Add BNXT_STATE_IN_FW_RESET state.")
+Reviewed-by: Scott Branden <scott.branden@broadcom.com>
+Signed-off-by: Edwin Peer <edwin.peer@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -7925,10 +7925,18 @@ static void bnxt_setup_inta(struct bnxt
+ bp->irq_tbl[0].handler = bnxt_inta;
+ }
+
++static int bnxt_init_int_mode(struct bnxt *bp);
++
+ static int bnxt_setup_int_mode(struct bnxt *bp)
+ {
+ int rc;
+
++ if (!bp->irq_tbl) {
++ rc = bnxt_init_int_mode(bp);
++ if (rc || !bp->irq_tbl)
++ return rc ?: -ENODEV;
++ }
++
+ if (bp->flags & BNXT_FLAG_USING_MSIX)
+ bnxt_setup_msix(bp);
+ else
+@@ -8113,7 +8121,7 @@ static int bnxt_init_inta(struct bnxt *b
+
+ static int bnxt_init_int_mode(struct bnxt *bp)
+ {
+- int rc = 0;
++ int rc = -ENODEV;
+
+ if (bp->flags & BNXT_FLAG_MSIX_CAP)
+ rc = bnxt_init_msix(bp);
+@@ -8748,7 +8756,8 @@ static int bnxt_hwrm_if_change(struct bn
+ {
+ struct hwrm_func_drv_if_change_output *resp = bp->hwrm_cmd_resp_addr;
+ struct hwrm_func_drv_if_change_input req = {0};
+- bool resc_reinit = false, fw_reset = false;
++ bool fw_reset = !bp->irq_tbl;
++ bool resc_reinit = false;
+ u32 flags = 0;
+ int rc;
+
+@@ -8776,6 +8785,7 @@ static int bnxt_hwrm_if_change(struct bn
+
+ if (test_bit(BNXT_STATE_IN_FW_RESET, &bp->state) && !fw_reset) {
+ netdev_err(bp->dev, "RESET_DONE not set during FW reset.\n");
++ set_bit(BNXT_STATE_ABORT_ERR, &bp->state);
+ return -ENODEV;
+ }
+ if (resc_reinit || fw_reset) {
--- /dev/null
+From ad5d07f4a9cd671233ae20983848874731102c08 Mon Sep 17 00:00:00 2001
+From: Paul Moore <paul@paul-moore.com>
+Date: Thu, 4 Mar 2021 16:29:51 -0500
+Subject: cipso,calipso: resolve a number of problems with the DOI refcounts
+
+From: Paul Moore <paul@paul-moore.com>
+
+commit ad5d07f4a9cd671233ae20983848874731102c08 upstream.
+
+The current CIPSO and CALIPSO refcounting scheme for the DOI
+definitions is a bit flawed in that we:
+
+1. Don't correctly match gets/puts in netlbl_cipsov4_list().
+2. Decrement the refcount on each attempt to remove the DOI from the
+ DOI list, only removing it from the list once the refcount drops
+ to zero.
+
+This patch fixes these problems by adding the missing "puts" to
+netlbl_cipsov4_list() and introduces a more conventional, i.e.
+not-buggy, refcounting mechanism to the DOI definitions. Upon the
+addition of a DOI to the DOI list, it is initialized with a refcount
+of one, removing a DOI from the list removes it from the list and
+drops the refcount by one; "gets" and "puts" behave as expected with
+respect to refcounts, increasing and decreasing the DOI's refcount by
+one.
+
+Fixes: b1edeb102397 ("netlabel: Replace protocol/NetLabel linking with refrerence counts")
+Fixes: d7cce01504a0 ("netlabel: Add support for removing a CALIPSO DOI.")
+Reported-by: syzbot+9ec037722d2603a9f52e@syzkaller.appspotmail.com
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/cipso_ipv4.c | 11 +----------
+ net/ipv6/calipso.c | 14 +++++---------
+ net/netlabel/netlabel_cipso_v4.c | 3 +++
+ 3 files changed, 9 insertions(+), 19 deletions(-)
+
+--- a/net/ipv4/cipso_ipv4.c
++++ b/net/ipv4/cipso_ipv4.c
+@@ -519,16 +519,10 @@ int cipso_v4_doi_remove(u32 doi, struct
+ ret_val = -ENOENT;
+ goto doi_remove_return;
+ }
+- if (!refcount_dec_and_test(&doi_def->refcount)) {
+- spin_unlock(&cipso_v4_doi_list_lock);
+- ret_val = -EBUSY;
+- goto doi_remove_return;
+- }
+ list_del_rcu(&doi_def->list);
+ spin_unlock(&cipso_v4_doi_list_lock);
+
+- cipso_v4_cache_invalidate();
+- call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu);
++ cipso_v4_doi_putdef(doi_def);
+ ret_val = 0;
+
+ doi_remove_return:
+@@ -585,9 +579,6 @@ void cipso_v4_doi_putdef(struct cipso_v4
+
+ if (!refcount_dec_and_test(&doi_def->refcount))
+ return;
+- spin_lock(&cipso_v4_doi_list_lock);
+- list_del_rcu(&doi_def->list);
+- spin_unlock(&cipso_v4_doi_list_lock);
+
+ cipso_v4_cache_invalidate();
+ call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu);
+--- a/net/ipv6/calipso.c
++++ b/net/ipv6/calipso.c
+@@ -83,6 +83,9 @@ struct calipso_map_cache_entry {
+
+ static struct calipso_map_cache_bkt *calipso_cache;
+
++static void calipso_cache_invalidate(void);
++static void calipso_doi_putdef(struct calipso_doi *doi_def);
++
+ /* Label Mapping Cache Functions
+ */
+
+@@ -444,15 +447,10 @@ static int calipso_doi_remove(u32 doi, s
+ ret_val = -ENOENT;
+ goto doi_remove_return;
+ }
+- if (!refcount_dec_and_test(&doi_def->refcount)) {
+- spin_unlock(&calipso_doi_list_lock);
+- ret_val = -EBUSY;
+- goto doi_remove_return;
+- }
+ list_del_rcu(&doi_def->list);
+ spin_unlock(&calipso_doi_list_lock);
+
+- call_rcu(&doi_def->rcu, calipso_doi_free_rcu);
++ calipso_doi_putdef(doi_def);
+ ret_val = 0;
+
+ doi_remove_return:
+@@ -508,10 +506,8 @@ static void calipso_doi_putdef(struct ca
+
+ if (!refcount_dec_and_test(&doi_def->refcount))
+ return;
+- spin_lock(&calipso_doi_list_lock);
+- list_del_rcu(&doi_def->list);
+- spin_unlock(&calipso_doi_list_lock);
+
++ calipso_cache_invalidate();
+ call_rcu(&doi_def->rcu, calipso_doi_free_rcu);
+ }
+
+--- a/net/netlabel/netlabel_cipso_v4.c
++++ b/net/netlabel/netlabel_cipso_v4.c
+@@ -575,6 +575,7 @@ list_start:
+
+ break;
+ }
++ cipso_v4_doi_putdef(doi_def);
+ rcu_read_unlock();
+
+ genlmsg_end(ans_skb, data);
+@@ -583,12 +584,14 @@ list_start:
+ list_retry:
+ /* XXX - this limit is a guesstimate */
+ if (nlsze_mult < 4) {
++ cipso_v4_doi_putdef(doi_def);
+ rcu_read_unlock();
+ kfree_skb(ans_skb);
+ nlsze_mult *= 2;
+ goto list_start;
+ }
+ list_failure_lock:
++ cipso_v4_doi_putdef(doi_def);
+ rcu_read_unlock();
+ list_failure:
+ kfree_skb(ans_skb);
--- /dev/null
+From d785e1fec60179f534fbe8d006c890e5ad186e51 Mon Sep 17 00:00:00 2001
+From: Antony Antony <antony@phenome.org>
+Date: Wed, 14 Oct 2020 16:17:48 +0200
+Subject: ixgbe: fail to create xfrm offload of IPsec tunnel mode SA
+
+From: Antony Antony <antony@phenome.org>
+
+commit d785e1fec60179f534fbe8d006c890e5ad186e51 upstream.
+
+Based on talks and indirect references ixgbe IPsec offlod do not
+support IPsec tunnel mode offload. It can only support IPsec transport
+mode offload. Now explicitly fail when creating non transport mode SA
+with offload to avoid false performance expectations.
+
+Fixes: 63a67fe229ea ("ixgbe: add ipsec offload add and remove SA")
+Signed-off-by: Antony Antony <antony@phenome.org>
+Acked-by: Shannon Nelson <snelson@pensando.io>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 5 +++++
+ drivers/net/ethernet/intel/ixgbevf/ipsec.c | 5 +++++
+ 2 files changed, 10 insertions(+)
+
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+@@ -575,6 +575,11 @@ static int ixgbe_ipsec_add_sa(struct xfr
+ return -EINVAL;
+ }
+
++ if (xs->props.mode != XFRM_MODE_TRANSPORT) {
++ netdev_err(dev, "Unsupported mode for ipsec offload\n");
++ return -EINVAL;
++ }
++
+ if (ixgbe_ipsec_check_mgmt_ip(xs)) {
+ netdev_err(dev, "IPsec IP addr clash with mgmt filters\n");
+ return -EINVAL;
+--- a/drivers/net/ethernet/intel/ixgbevf/ipsec.c
++++ b/drivers/net/ethernet/intel/ixgbevf/ipsec.c
+@@ -272,6 +272,11 @@ static int ixgbevf_ipsec_add_sa(struct x
+ return -EINVAL;
+ }
+
++ if (xs->props.mode != XFRM_MODE_TRANSPORT) {
++ netdev_err(dev, "Unsupported mode for ipsec offload\n");
++ return -EINVAL;
++ }
++
+ if (xs->xso.flags & XFRM_OFFLOAD_INBOUND) {
+ struct rx_sa rsa;
+
--- /dev/null
+From 2055a99da8a253a357bdfd359b3338ef3375a26c Mon Sep 17 00:00:00 2001
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+Date: Sun, 7 Mar 2021 19:11:02 -0800
+Subject: net: bonding: fix error return code of bond_neigh_init()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+commit 2055a99da8a253a357bdfd359b3338ef3375a26c upstream.
+
+When slave is NULL or slave_ops->ndo_neigh_setup is NULL, no error
+return code of bond_neigh_init() is assigned.
+To fix this bug, ret is assigned with -EINVAL in these cases.
+
+Fixes: 9e99bfefdbce ("bonding: fix bond_neigh_init()")
+Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/bonding/bond_main.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -3703,11 +3703,15 @@ static int bond_neigh_init(struct neighb
+
+ rcu_read_lock();
+ slave = bond_first_slave_rcu(bond);
+- if (!slave)
++ if (!slave) {
++ ret = -EINVAL;
+ goto out;
++ }
+ slave_ops = slave->dev->netdev_ops;
+- if (!slave_ops->ndo_neigh_setup)
++ if (!slave_ops->ndo_neigh_setup) {
++ ret = -EINVAL;
+ goto out;
++ }
+
+ /* TODO: find another way [1] to implement this.
+ * Passing a zeroed structure is fragile,
--- /dev/null
+From cf9e60aa69ae6c40d3e3e4c94dd6c8de31674e9b Mon Sep 17 00:00:00 2001
+From: Paul Cercueil <paul@crapouillou.net>
+Date: Sun, 7 Mar 2021 13:17:48 +0000
+Subject: net: davicom: Fix regulator not turned off on driver removal
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+commit cf9e60aa69ae6c40d3e3e4c94dd6c8de31674e9b upstream.
+
+We must disable the regulator that was enabled in the probe function.
+
+Fixes: 7994fe55a4a2 ("dm9000: Add regulator and reset support to dm9000")
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/davicom/dm9000.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/davicom/dm9000.c
++++ b/drivers/net/ethernet/davicom/dm9000.c
+@@ -134,6 +134,8 @@ struct board_info {
+ u32 wake_state;
+
+ int ip_summed;
++
++ struct regulator *power_supply;
+ };
+
+ /* debug code */
+@@ -1486,6 +1488,8 @@ dm9000_probe(struct platform_device *pde
+
+ db->dev = &pdev->dev;
+ db->ndev = ndev;
++ if (!IS_ERR(power))
++ db->power_supply = power;
+
+ spin_lock_init(&db->lock);
+ mutex_init(&db->addr_lock);
+@@ -1771,10 +1775,13 @@ static int
+ dm9000_drv_remove(struct platform_device *pdev)
+ {
+ struct net_device *ndev = platform_get_drvdata(pdev);
++ struct board_info *dm = to_dm9000_board(ndev);
+
+ unregister_netdev(ndev);
+- dm9000_release_board(pdev, netdev_priv(ndev));
++ dm9000_release_board(pdev, dm);
+ free_netdev(ndev); /* free device structure */
++ if (dm->power_supply)
++ regulator_disable(dm->power_supply);
+
+ dev_dbg(&pdev->dev, "released and freed device\n");
+ return 0;
--- /dev/null
+From ac88c531a5b38877eba2365a3f28f0c8b513dc33 Mon Sep 17 00:00:00 2001
+From: Paul Cercueil <paul@crapouillou.net>
+Date: Sun, 7 Mar 2021 13:17:47 +0000
+Subject: net: davicom: Fix regulator not turned off on failed probe
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+commit ac88c531a5b38877eba2365a3f28f0c8b513dc33 upstream.
+
+When the probe fails or requests to be defered, we must disable the
+regulator that was previously enabled.
+
+Fixes: 7994fe55a4a2 ("dm9000: Add regulator and reset support to dm9000")
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/davicom/dm9000.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/davicom/dm9000.c
++++ b/drivers/net/ethernet/davicom/dm9000.c
+@@ -1454,7 +1454,7 @@ dm9000_probe(struct platform_device *pde
+ if (ret) {
+ dev_err(dev, "failed to request reset gpio %d: %d\n",
+ reset_gpios, ret);
+- return -ENODEV;
++ goto out_regulator_disable;
+ }
+
+ /* According to manual PWRST# Low Period Min 1ms */
+@@ -1466,8 +1466,10 @@ dm9000_probe(struct platform_device *pde
+
+ if (!pdata) {
+ pdata = dm9000_parse_dt(&pdev->dev);
+- if (IS_ERR(pdata))
+- return PTR_ERR(pdata);
++ if (IS_ERR(pdata)) {
++ ret = PTR_ERR(pdata);
++ goto out_regulator_disable;
++ }
+ }
+
+ /* Init network device */
+@@ -1708,6 +1710,10 @@ out:
+ dm9000_release_board(pdev, db);
+ free_netdev(ndev);
+
++out_regulator_disable:
++ if (!IS_ERR(power))
++ regulator_disable(power);
++
+ return ret;
+ }
+
--- /dev/null
+From b36fc875bcdee56865c444a2cdae17d354a6d5f5 Mon Sep 17 00:00:00 2001
+From: Jian Shen <shenjian15@huawei.com>
+Date: Sat, 27 Feb 2021 15:24:53 +0800
+Subject: net: hns3: fix bug when calculating the TCAM table info
+
+From: Jian Shen <shenjian15@huawei.com>
+
+commit b36fc875bcdee56865c444a2cdae17d354a6d5f5 upstream.
+
+The function hclge_fd_convert_tuple() is used to convert tuples
+and tuples mask to TCAM x and y. But it misuses the source mac
+as source mac mask when convert INNER_SRC_MAC, which may cause
+the flow director rule works unexpectedly. So fix it.
+
+Fixes: 117328680288 ("net: hns3: Add input key and action config support for flow director")
+Signed-off-by: Jian Shen <shenjian15@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -4908,9 +4908,9 @@ static bool hclge_fd_convert_tuple(u32 t
+ case BIT(INNER_SRC_MAC):
+ for (i = 0; i < ETH_ALEN; i++) {
+ calc_x(key_x[ETH_ALEN - 1 - i], rule->tuples.src_mac[i],
+- rule->tuples.src_mac[i]);
++ rule->tuples_mask.src_mac[i]);
+ calc_y(key_y[ETH_ALEN - 1 - i], rule->tuples.src_mac[i],
+- rule->tuples.src_mac[i]);
++ rule->tuples_mask.src_mac[i]);
+ }
+
+ return true;
--- /dev/null
+From c75ec148a316e8cf52274d16b9b422703b96f5ce Mon Sep 17 00:00:00 2001
+From: Jian Shen <shenjian15@huawei.com>
+Date: Sat, 27 Feb 2021 15:24:52 +0800
+Subject: net: hns3: fix query vlan mask value error for flow director
+
+From: Jian Shen <shenjian15@huawei.com>
+
+commit c75ec148a316e8cf52274d16b9b422703b96f5ce upstream.
+
+Currently, the driver returns VLAN_VID_MASK for vlan mask field,
+when get flow director rule information for rule doesn't use vlan.
+It may cause the vlan mask value display as 0xf000 in this
+case, like below:
+
+estuary:/$ ethtool -u eth1
+50 RX rings available
+Total 1 rules
+
+Filter: 2
+Rule Type: TCP over IPv4
+Src IP addr: 0.0.0.0 mask: 255.255.255.255
+Dest IP addr: 0.0.0.0 mask: 255.255.255.255
+TOS: 0x0 mask: 0xff
+Src port: 0 mask: 0xffff
+Dest port: 0 mask: 0xffff
+VLAN EtherType: 0x0 mask: 0xffff
+VLAN: 0x0 mask: 0xf000
+User-defined: 0x1234 mask: 0x0
+Action: Direct to queue 3
+
+Fix it by return 0.
+
+Fixes: 05c2314fe6a8 ("net: hns3: Add support for rule query of flow director")
+Signed-off-by: Jian Shen <shenjian15@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -5939,8 +5939,7 @@ static int hclge_get_fd_rule_info(struct
+ fs->h_ext.vlan_tci = cpu_to_be16(rule->tuples.vlan_tag1);
+ fs->m_ext.vlan_tci =
+ rule->unused_tuple & BIT(INNER_VLAN_TAG_FST) ?
+- cpu_to_be16(VLAN_VID_MASK) :
+- cpu_to_be16(rule->tuples_mask.vlan_tag1);
++ 0 : cpu_to_be16(rule->tuples_mask.vlan_tag1);
+ }
+
+ if (fs->flow_type & FLOW_MAC_EXT) {
--- /dev/null
+From f7d9d4854519fdf4d45c70a4d953438cd88e7e58 Mon Sep 17 00:00:00 2001
+From: Xie He <xie.he.0141@gmail.com>
+Date: Sun, 7 Mar 2021 03:33:07 -0800
+Subject: net: lapbether: Remove netif_start_queue / netif_stop_queue
+
+From: Xie He <xie.he.0141@gmail.com>
+
+commit f7d9d4854519fdf4d45c70a4d953438cd88e7e58 upstream.
+
+For the devices in this driver, the default qdisc is "noqueue",
+because their "tx_queue_len" is 0.
+
+In function "__dev_queue_xmit" in "net/core/dev.c", devices with the
+"noqueue" qdisc are specially handled. Packets are transmitted without
+being queued after a "dev->flags & IFF_UP" check. However, it's possible
+that even if this check succeeds, "ops->ndo_stop" may still have already
+been called. This is because in "__dev_close_many", "ops->ndo_stop" is
+called before clearing the "IFF_UP" flag.
+
+If we call "netif_stop_queue" in "ops->ndo_stop", then it's possible in
+"__dev_queue_xmit", it sees the "IFF_UP" flag is present, and then it
+checks "netif_xmit_stopped" and finds that the queue is already stopped.
+In this case, it will complain that:
+"Virtual device ... asks to queue packet!"
+
+To prevent "__dev_queue_xmit" from generating this complaint, we should
+not call "netif_stop_queue" in "ops->ndo_stop".
+
+We also don't need to call "netif_start_queue" in "ops->ndo_open",
+because after a netdev is allocated and registered, the
+"__QUEUE_STATE_DRV_XOFF" flag is initially not set, so there is no need
+to call "netif_start_queue" to clear it.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Xie He <xie.he.0141@gmail.com>
+Acked-by: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wan/lapbether.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/net/wan/lapbether.c
++++ b/drivers/net/wan/lapbether.c
+@@ -283,7 +283,6 @@ static int lapbeth_open(struct net_devic
+ return -ENODEV;
+ }
+
+- netif_start_queue(dev);
+ return 0;
+ }
+
+@@ -291,8 +290,6 @@ static int lapbeth_close(struct net_devi
+ {
+ int err;
+
+- netif_stop_queue(dev);
+-
+ if ((err = lapb_unregister(dev)) != LAPB_OK)
+ pr_err("lapb_unregister error: %d\n", err);
+
--- /dev/null
+From 179d0ba0c454057a65929c46af0d6ad986754781 Mon Sep 17 00:00:00 2001
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+Date: Mon, 8 Mar 2021 01:13:55 -0800
+Subject: net: qrtr: fix error return code of qrtr_sendmsg()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+commit 179d0ba0c454057a65929c46af0d6ad986754781 upstream.
+
+When sock_alloc_send_skb() returns NULL to skb, no error return code of
+qrtr_sendmsg() is assigned.
+To fix this bug, rc is assigned with -ENOMEM in this case.
+
+Fixes: 194ccc88297a ("net: qrtr: Support decoding incoming v2 packets")
+Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/qrtr/qrtr.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/qrtr/qrtr.c
++++ b/net/qrtr/qrtr.c
+@@ -791,8 +791,10 @@ static int qrtr_sendmsg(struct socket *s
+ plen = (len + 3) & ~3;
+ skb = sock_alloc_send_skb(sk, plen + QRTR_HDR_MAX_SIZE,
+ msg->msg_flags & MSG_DONTWAIT, &rc);
+- if (!skb)
++ if (!skb) {
++ rc = -ENOMEM;
+ goto out_node;
++ }
+
+ skb_reserve(skb, QRTR_HDR_MAX_SIZE);
+
--- /dev/null
+From bfc2560563586372212b0a8aeca7428975fa91fe Mon Sep 17 00:00:00 2001
+From: Maximilian Heyne <mheyne@amazon.de>
+Date: Thu, 4 Mar 2021 14:43:17 +0000
+Subject: net: sched: avoid duplicates in classes dump
+
+From: Maximilian Heyne <mheyne@amazon.de>
+
+commit bfc2560563586372212b0a8aeca7428975fa91fe upstream.
+
+This is a follow up of commit ea3274695353 ("net: sched: avoid
+duplicates in qdisc dump") which has fixed the issue only for the qdisc
+dump.
+
+The duplicate printing also occurs when dumping the classes via
+ tc class show dev eth0
+
+Fixes: 59cc1f61f09c ("net: sched: convert qdisc linked list to hashtable")
+Signed-off-by: Maximilian Heyne <mheyne@amazon.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_api.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/net/sched/sch_api.c
++++ b/net/sched/sch_api.c
+@@ -2157,7 +2157,7 @@ static int tc_dump_tclass_qdisc(struct Q
+
+ static int tc_dump_tclass_root(struct Qdisc *root, struct sk_buff *skb,
+ struct tcmsg *tcm, struct netlink_callback *cb,
+- int *t_p, int s_t)
++ int *t_p, int s_t, bool recur)
+ {
+ struct Qdisc *q;
+ int b;
+@@ -2168,7 +2168,7 @@ static int tc_dump_tclass_root(struct Qd
+ if (tc_dump_tclass_qdisc(root, skb, tcm, cb, t_p, s_t) < 0)
+ return -1;
+
+- if (!qdisc_dev(root))
++ if (!qdisc_dev(root) || !recur)
+ return 0;
+
+ if (tcm->tcm_parent) {
+@@ -2203,13 +2203,13 @@ static int tc_dump_tclass(struct sk_buff
+ s_t = cb->args[0];
+ t = 0;
+
+- if (tc_dump_tclass_root(dev->qdisc, skb, tcm, cb, &t, s_t) < 0)
++ if (tc_dump_tclass_root(dev->qdisc, skb, tcm, cb, &t, s_t, true) < 0)
+ goto done;
+
+ dev_queue = dev_ingress_queue(dev);
+ if (dev_queue &&
+ tc_dump_tclass_root(dev_queue->qdisc_sleeping, skb, tcm, cb,
+- &t, s_t) < 0)
++ &t, s_t, false) < 0)
+ goto done;
+
+ done:
--- /dev/null
+From c511819d138de38e1637eedb645c207e09680d0f Mon Sep 17 00:00:00 2001
+From: Joakim Zhang <qiangqing.zhang@nxp.com>
+Date: Thu, 25 Feb 2021 17:01:11 +0800
+Subject: net: stmmac: fix watchdog timeout during suspend/resume stress test
+
+From: Joakim Zhang <qiangqing.zhang@nxp.com>
+
+commit c511819d138de38e1637eedb645c207e09680d0f upstream.
+
+stmmac_xmit() call stmmac_tx_timer_arm() at the end to modify tx timer to
+do the transmission cleanup work. Imagine such a situation, stmmac enters
+suspend immediately after tx timer modified, it's expire callback
+stmmac_tx_clean() would not be invoked. This could affect BQL, since
+netdev_tx_sent_queue() has been called, but netdev_tx_completed_queue()
+have not been involved, as a result, dql_avail(&dev_queue->dql) finally
+always return a negative value.
+
+__dev_queue_xmit->__dev_xmit_skb->qdisc_run->__qdisc_run->qdisc_restart->dequeue_skb:
+ if ((q->flags & TCQ_F_ONETXQUEUE) &&
+ netif_xmit_frozen_or_stopped(txq)) // __QUEUE_STATE_STACK_XOFF is set
+
+Net core will stop transmitting any more. Finillay, net watchdong would timeout.
+To fix this issue, we should call netdev_tx_reset_queue() in stmmac_resume().
+
+Fixes: 54139cf3bb33 ("net: stmmac: adding multiple buffers for rx")
+Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -4821,6 +4821,8 @@ static void stmmac_reset_queues_param(st
+ tx_q->cur_tx = 0;
+ tx_q->dirty_tx = 0;
+ tx_q->mss = 0;
++
++ netdev_tx_reset_queue(netdev_get_tx_queue(priv->dev, queue));
+ }
+ }
+
--- /dev/null
+From a3e860a83397bf761ec1128a3f0ba186445992c6 Mon Sep 17 00:00:00 2001
+From: Joakim Zhang <qiangqing.zhang@nxp.com>
+Date: Thu, 25 Feb 2021 17:01:10 +0800
+Subject: net: stmmac: stop each tx channel independently
+
+From: Joakim Zhang <qiangqing.zhang@nxp.com>
+
+commit a3e860a83397bf761ec1128a3f0ba186445992c6 upstream.
+
+If clear GMAC_CONFIG_TE bit, it would stop all tx channels, but users
+may only want to stop specific tx channel.
+
+Fixes: 48863ce5940f ("stmmac: add DMA support for GMAC 4.xx")
+Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c
+@@ -60,10 +60,6 @@ void dwmac4_dma_stop_tx(void __iomem *io
+
+ value &= ~DMA_CONTROL_ST;
+ writel(value, ioaddr + DMA_CHAN_TX_CONTROL(chan));
+-
+- value = readl(ioaddr + GMAC_CONFIG);
+- value &= ~GMAC_CONFIG_TE;
+- writel(value, ioaddr + GMAC_CONFIG);
+ }
+
+ void dwmac4_dma_start_rx(void __iomem *ioaddr, u32 chan)
--- /dev/null
+From 6c59cff38e66584ae3ac6c2f0cbd8d039c710ba7 Mon Sep 17 00:00:00 2001
+From: Daniele Palmas <dnlplm@gmail.com>
+Date: Thu, 4 Mar 2021 14:15:13 +0100
+Subject: net: usb: qmi_wwan: allow qmimux add/del with master up
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniele Palmas <dnlplm@gmail.com>
+
+commit 6c59cff38e66584ae3ac6c2f0cbd8d039c710ba7 upstream.
+
+There's no reason for preventing the creation and removal
+of qmimux network interfaces when the underlying interface
+is up.
+
+This makes qmi_wwan mux implementation more similar to the
+rmnet one, simplifying userspace management of the same
+logical interfaces.
+
+Fixes: c6adf77953bc ("net: usb: qmi_wwan: add qmap mux protocol support")
+Reported-by: Aleksander Morgado <aleksander@aleksander.es>
+Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
+Acked-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/qmi_wwan.c | 14 --------------
+ 1 file changed, 14 deletions(-)
+
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -441,13 +441,6 @@ static ssize_t add_mux_store(struct devi
+ goto err;
+ }
+
+- /* we don't want to modify a running netdev */
+- if (netif_running(dev->net)) {
+- netdev_err(dev->net, "Cannot change a running device\n");
+- ret = -EBUSY;
+- goto err;
+- }
+-
+ ret = qmimux_register_device(dev->net, mux_id);
+ if (!ret) {
+ info->flags |= QMI_WWAN_FLAG_MUX;
+@@ -477,13 +470,6 @@ static ssize_t del_mux_store(struct devi
+ if (!rtnl_trylock())
+ return restart_syscall();
+
+- /* we don't want to modify a running netdev */
+- if (netif_running(dev->net)) {
+- netdev_err(dev->net, "Cannot change a running device\n");
+- ret = -EBUSY;
+- goto err;
+- }
+-
+ del_dev = qmimux_find_dev(dev, mux_id);
+ if (!del_dev) {
+ netdev_err(dev->net, "mux_id not present\n");
--- /dev/null
+From 863a42b289c22df63db62b10fc2c2ffc237e2125 Mon Sep 17 00:00:00 2001
+From: Hillf Danton <hdanton@sina.com>
+Date: Thu, 4 Mar 2021 10:30:09 -0800
+Subject: netdevsim: init u64 stats for 32bit hardware
+
+From: Hillf Danton <hdanton@sina.com>
+
+commit 863a42b289c22df63db62b10fc2c2ffc237e2125 upstream.
+
+Init the u64 stats in order to avoid the lockdep prints on the 32bit
+hardware like
+
+ INFO: trying to register non-static key.
+ the code is fine but needs lockdep annotation.
+ turning off the locking correctness validator.
+ CPU: 0 PID: 4695 Comm: syz-executor.0 Not tainted 5.11.0-rc5-syzkaller #0
+ Hardware name: ARM-Versatile Express
+ Backtrace:
+ [<826fc5b8>] (dump_backtrace) from [<826fc82c>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:252)
+ [<826fc814>] (show_stack) from [<8270d1f8>] (__dump_stack lib/dump_stack.c:79 [inline])
+ [<826fc814>] (show_stack) from [<8270d1f8>] (dump_stack+0xa8/0xc8 lib/dump_stack.c:120)
+ [<8270d150>] (dump_stack) from [<802bf9c0>] (assign_lock_key kernel/locking/lockdep.c:935 [inline])
+ [<8270d150>] (dump_stack) from [<802bf9c0>] (register_lock_class+0xabc/0xb68 kernel/locking/lockdep.c:1247)
+ [<802bef04>] (register_lock_class) from [<802baa2c>] (__lock_acquire+0x84/0x32d4 kernel/locking/lockdep.c:4711)
+ [<802ba9a8>] (__lock_acquire) from [<802be840>] (lock_acquire.part.0+0xf0/0x554 kernel/locking/lockdep.c:5442)
+ [<802be750>] (lock_acquire.part.0) from [<802bed10>] (lock_acquire+0x6c/0x74 kernel/locking/lockdep.c:5415)
+ [<802beca4>] (lock_acquire) from [<81560548>] (seqcount_lockdep_reader_access include/linux/seqlock.h:103 [inline])
+ [<802beca4>] (lock_acquire) from [<81560548>] (__u64_stats_fetch_begin include/linux/u64_stats_sync.h:164 [inline])
+ [<802beca4>] (lock_acquire) from [<81560548>] (u64_stats_fetch_begin include/linux/u64_stats_sync.h:175 [inline])
+ [<802beca4>] (lock_acquire) from [<81560548>] (nsim_get_stats64+0xdc/0xf0 drivers/net/netdevsim/netdev.c:70)
+ [<8156046c>] (nsim_get_stats64) from [<81e2efa0>] (dev_get_stats+0x44/0xd0 net/core/dev.c:10405)
+ [<81e2ef5c>] (dev_get_stats) from [<81e53204>] (rtnl_fill_stats+0x38/0x120 net/core/rtnetlink.c:1211)
+ [<81e531cc>] (rtnl_fill_stats) from [<81e59d58>] (rtnl_fill_ifinfo+0x6d4/0x148c net/core/rtnetlink.c:1783)
+ [<81e59684>] (rtnl_fill_ifinfo) from [<81e5ceb4>] (rtmsg_ifinfo_build_skb+0x9c/0x108 net/core/rtnetlink.c:3798)
+ [<81e5ce18>] (rtmsg_ifinfo_build_skb) from [<81e5d0ac>] (rtmsg_ifinfo_event net/core/rtnetlink.c:3830 [inline])
+ [<81e5ce18>] (rtmsg_ifinfo_build_skb) from [<81e5d0ac>] (rtmsg_ifinfo_event net/core/rtnetlink.c:3821 [inline])
+ [<81e5ce18>] (rtmsg_ifinfo_build_skb) from [<81e5d0ac>] (rtmsg_ifinfo+0x44/0x70 net/core/rtnetlink.c:3839)
+ [<81e5d068>] (rtmsg_ifinfo) from [<81e45c2c>] (register_netdevice+0x664/0x68c net/core/dev.c:10103)
+ [<81e455c8>] (register_netdevice) from [<815608bc>] (nsim_create+0xf8/0x124 drivers/net/netdevsim/netdev.c:317)
+ [<815607c4>] (nsim_create) from [<81561184>] (__nsim_dev_port_add+0x108/0x188 drivers/net/netdevsim/dev.c:941)
+ [<8156107c>] (__nsim_dev_port_add) from [<815620d8>] (nsim_dev_port_add_all drivers/net/netdevsim/dev.c:990 [inline])
+ [<8156107c>] (__nsim_dev_port_add) from [<815620d8>] (nsim_dev_probe+0x5cc/0x750 drivers/net/netdevsim/dev.c:1119)
+ [<81561b0c>] (nsim_dev_probe) from [<815661dc>] (nsim_bus_probe+0x10/0x14 drivers/net/netdevsim/bus.c:287)
+ [<815661cc>] (nsim_bus_probe) from [<811724c0>] (really_probe+0x100/0x50c drivers/base/dd.c:554)
+ [<811723c0>] (really_probe) from [<811729c4>] (driver_probe_device+0xf8/0x1c8 drivers/base/dd.c:740)
+ [<811728cc>] (driver_probe_device) from [<81172fe4>] (__device_attach_driver+0x8c/0xf0 drivers/base/dd.c:846)
+ [<81172f58>] (__device_attach_driver) from [<8116fee0>] (bus_for_each_drv+0x88/0xd8 drivers/base/bus.c:431)
+ [<8116fe58>] (bus_for_each_drv) from [<81172c6c>] (__device_attach+0xdc/0x1d0 drivers/base/dd.c:914)
+ [<81172b90>] (__device_attach) from [<8117305c>] (device_initial_probe+0x14/0x18 drivers/base/dd.c:961)
+ [<81173048>] (device_initial_probe) from [<81171358>] (bus_probe_device+0x90/0x98 drivers/base/bus.c:491)
+ [<811712c8>] (bus_probe_device) from [<8116e77c>] (device_add+0x320/0x824 drivers/base/core.c:3109)
+ [<8116e45c>] (device_add) from [<8116ec9c>] (device_register+0x1c/0x20 drivers/base/core.c:3182)
+ [<8116ec80>] (device_register) from [<81566710>] (nsim_bus_dev_new drivers/net/netdevsim/bus.c:336 [inline])
+ [<8116ec80>] (device_register) from [<81566710>] (new_device_store+0x178/0x208 drivers/net/netdevsim/bus.c:215)
+ [<81566598>] (new_device_store) from [<8116fcb4>] (bus_attr_store+0x2c/0x38 drivers/base/bus.c:122)
+ [<8116fc88>] (bus_attr_store) from [<805b4b8c>] (sysfs_kf_write+0x48/0x54 fs/sysfs/file.c:139)
+ [<805b4b44>] (sysfs_kf_write) from [<805b3c90>] (kernfs_fop_write_iter+0x128/0x1ec fs/kernfs/file.c:296)
+ [<805b3b68>] (kernfs_fop_write_iter) from [<804d22fc>] (call_write_iter include/linux/fs.h:1901 [inline])
+ [<805b3b68>] (kernfs_fop_write_iter) from [<804d22fc>] (new_sync_write fs/read_write.c:518 [inline])
+ [<805b3b68>] (kernfs_fop_write_iter) from [<804d22fc>] (vfs_write+0x3dc/0x57c fs/read_write.c:605)
+ [<804d1f20>] (vfs_write) from [<804d2604>] (ksys_write+0x68/0xec fs/read_write.c:658)
+ [<804d259c>] (ksys_write) from [<804d2698>] (__do_sys_write fs/read_write.c:670 [inline])
+ [<804d259c>] (ksys_write) from [<804d2698>] (sys_write+0x10/0x14 fs/read_write.c:667)
+ [<804d2688>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x2c arch/arm/mm/proc-v7.S:64)
+
+Fixes: 83c9e13aa39a ("netdevsim: add software driver for testing offloads")
+Reported-by: syzbot+e74a6857f2d0efe3ad81@syzkaller.appspotmail.com
+Tested-by: Dmitry Vyukov <dvyukov@google.com>
+Signed-off-by: Hillf Danton <hdanton@sina.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/netdevsim/netdev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/netdevsim/netdev.c
++++ b/drivers/net/netdevsim/netdev.c
+@@ -292,6 +292,7 @@ nsim_create(struct nsim_dev *nsim_dev, s
+
+ ns = netdev_priv(dev);
+ ns->netdev = dev;
++ u64_stats_init(&ns->syncp);
+ ns->nsim_dev = nsim_dev;
+ ns->nsim_dev_port = nsim_dev_port;
+ ns->nsim_bus_dev = nsim_dev->nsim_bus_dev;
--- /dev/null
+From 137a5258939aca56558f3a23eb229b9c4b293917 Mon Sep 17 00:00:00 2001
+From: Ian Rogers <irogers@google.com>
+Date: Fri, 26 Feb 2021 14:14:31 -0800
+Subject: perf traceevent: Ensure read cmdlines are null terminated.
+
+From: Ian Rogers <irogers@google.com>
+
+commit 137a5258939aca56558f3a23eb229b9c4b293917 upstream.
+
+Issue detected by address sanitizer.
+
+Fixes: cd4ceb63438e9e28 ("perf util: Save pid-cmdline mapping into tracing header")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Link: http://lore.kernel.org/lkml/20210226221431.1985458-1-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/trace-event-read.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/tools/perf/util/trace-event-read.c
++++ b/tools/perf/util/trace-event-read.c
+@@ -361,6 +361,7 @@ static int read_saved_cmdline(struct tep
+ pr_debug("error reading saved cmdlines\n");
+ goto out;
+ }
++ buf[ret] = '\0';
+
+ parse_saved_cmdline(pevent, buf, size);
+ ret = 0;
--- /dev/null
+From 51c44babdc19aaf882e1213325a0ba291573308f Mon Sep 17 00:00:00 2001
+From: Wang Qing <wangqing@vivo.com>
+Date: Mon, 1 Mar 2021 20:01:33 +0800
+Subject: s390/cio: return -EFAULT if copy_to_user() fails
+
+From: Wang Qing <wangqing@vivo.com>
+
+commit 51c44babdc19aaf882e1213325a0ba291573308f upstream.
+
+The copy_to_user() function returns the number of bytes remaining to be
+copied, but we want to return -EFAULT if the copy doesn't complete.
+
+Fixes: e01bcdd61320 ("vfio: ccw: realize VFIO_DEVICE_GET_REGION_INFO ioctl")
+Signed-off-by: Wang Qing <wangqing@vivo.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Link: https://lore.kernel.org/r/1614600093-13992-1-git-send-email-wangqing@vivo.com
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/s390/cio/vfio_ccw_ops.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/s390/cio/vfio_ccw_ops.c
++++ b/drivers/s390/cio/vfio_ccw_ops.c
+@@ -506,7 +506,7 @@ static ssize_t vfio_ccw_mdev_ioctl(struc
+ if (ret)
+ return ret;
+
+- return copy_to_user((void __user *)arg, &info, minsz);
++ return copy_to_user((void __user *)arg, &info, minsz) ? -EFAULT : 0;
+ }
+ case VFIO_DEVICE_GET_REGION_INFO:
+ {
+@@ -524,7 +524,7 @@ static ssize_t vfio_ccw_mdev_ioctl(struc
+ if (ret)
+ return ret;
+
+- return copy_to_user((void __user *)arg, &info, minsz);
++ return copy_to_user((void __user *)arg, &info, minsz) ? -EFAULT : 0;
+ }
+ case VFIO_DEVICE_GET_IRQ_INFO:
+ {
--- /dev/null
+From edcbf5137f093b5502f5f6b97cce3cbadbde27aa Mon Sep 17 00:00:00 2001
+From: Danielle Ratson <danieller@nvidia.com>
+Date: Thu, 25 Feb 2021 18:57:19 +0200
+Subject: selftests: forwarding: Fix race condition in mirror installation
+
+From: Danielle Ratson <danieller@nvidia.com>
+
+commit edcbf5137f093b5502f5f6b97cce3cbadbde27aa upstream.
+
+When mirroring to a gretap in hardware the device expects to be
+programmed with the egress port and all the encapsulating headers. This
+requires the driver to resolve the path the packet will take in the
+software data path and program the device accordingly.
+
+If the path cannot be resolved (in this case because of an unresolved
+neighbor), then mirror installation fails until the path is resolved.
+This results in a race that causes the test to sometimes fail.
+
+Fix this by setting the neighbor's state to permanent, so that it is
+always valid.
+
+Fixes: b5b029399fa6d ("selftests: forwarding: mirror_gre_bridge_1d_vlan: Add STP test")
+Signed-off-by: Danielle Ratson <danieller@nvidia.com>
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/forwarding/mirror_gre_bridge_1d_vlan.sh | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1d_vlan.sh
++++ b/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1d_vlan.sh
+@@ -86,11 +86,20 @@ test_ip6gretap()
+
+ test_gretap_stp()
+ {
++ # Sometimes after mirror installation, the neighbor's state is not valid.
++ # The reason is that there is no SW datapath activity related to the
++ # neighbor for the remote GRE address. Therefore whether the corresponding
++ # neighbor will be valid is a matter of luck, and the test is thus racy.
++ # Set the neighbor's state to permanent, so it would be always valid.
++ ip neigh replace 192.0.2.130 lladdr $(mac_get $h3) \
++ nud permanent dev br2
+ full_test_span_gre_stp gt4 $swp3.555 "mirror to gretap"
+ }
+
+ test_ip6gretap_stp()
+ {
++ ip neigh replace 2001:db8:2::2 lladdr $(mac_get $h3) \
++ nud permanent dev br2
+ full_test_span_gre_stp gt6 $swp3.555 "mirror to ip6gretap"
+ }
+
net-mlx4_en-update-moderation-when-config-reset.patch
net-stmmac-fix-incorrect-dma-channel-intr-enable-setting-of-eqos-v4.10.patch
nexthop-do-not-flush-blackhole-nexthops-when-loopback-goes-down.patch
+net-sched-avoid-duplicates-in-classes-dump.patch
+net-usb-qmi_wwan-allow-qmimux-add-del-with-master-up.patch
+netdevsim-init-u64-stats-for-32bit-hardware.patch
+cipso-calipso-resolve-a-number-of-problems-with-the-doi-refcounts.patch
+net-lapbether-remove-netif_start_queue-netif_stop_queue.patch
+net-davicom-fix-regulator-not-turned-off-on-failed-probe.patch
+net-davicom-fix-regulator-not-turned-off-on-driver-removal.patch
+net-bonding-fix-error-return-code-of-bond_neigh_init.patch
+net-qrtr-fix-error-return-code-of-qrtr_sendmsg.patch
+ixgbe-fail-to-create-xfrm-offload-of-ipsec-tunnel-mode-sa.patch
+net-stmmac-stop-each-tx-channel-independently.patch
+net-stmmac-fix-watchdog-timeout-during-suspend-resume-stress-test.patch
+selftests-forwarding-fix-race-condition-in-mirror-installation.patch
+perf-traceevent-ensure-read-cmdlines-are-null-terminated.patch
+net-hns3-fix-query-vlan-mask-value-error-for-flow-director.patch
+net-hns3-fix-bug-when-calculating-the-tcam-table-info.patch
+s390-cio-return-efault-if-copy_to_user-fails.patch
+bnxt_en-reliably-allocate-irq-table-on-reset-to-avoid-crash.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
