--- /dev/null
+From foo@baz Fri Jan 15 09:43:29 AM CET 2021
+From: Ayush Sawal <ayush.sawal@chelsio.com>
+Date: Wed, 6 Jan 2021 09:59:11 +0530
+Subject: chtls: Added a check to avoid NULL pointer dereference
+
+From: Ayush Sawal <ayush.sawal@chelsio.com>
+
+[ Upstream commit eade1e0a4fb31d48eeb1589d9bb859ae4dd6181d ]
+
+In case of server removal lookup_stid() may return NULL pointer, which
+is used as listen_ctx. So added a check before accessing this pointer.
+
+Fixes: cc35c88ae4db ("crypto : chtls - CPL handler definition")
+Signed-off-by: Vinay Kumar Yadav <vinay.yadav@chelsio.com>
+Signed-off-by: Ayush Sawal <ayush.sawal@chelsio.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/chelsio/chtls/chtls_cm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/crypto/chelsio/chtls/chtls_cm.c
++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c
+@@ -1432,6 +1432,11 @@ static int chtls_pass_establish(struct c
+ sk_wake_async(sk, 0, POLL_OUT);
+
+ data = lookup_stid(cdev->tids, stid);
++ if (!data) {
++ /* listening server close */
++ kfree_skb(skb);
++ goto unlock;
++ }
+ lsk = ((struct listen_ctx *)data)->lsk;
+
+ bh_lock_sock(lsk);
--- /dev/null
+From foo@baz Fri Jan 15 08:22:25 AM CET 2021
+From: Ayush Sawal <ayush.sawal@chelsio.com>
+Date: Wed, 6 Jan 2021 09:59:12 +0530
+Subject: chtls: Fix chtls resources release sequence
+
+From: Ayush Sawal <ayush.sawal@chelsio.com>
+
+[ Upstream commit 15ef6b0e30b354253e2c10b3836bc59767eb162b ]
+
+CPL_ABORT_RPL is sent after releasing the resources by calling
+chtls_release_resources(sk); and chtls_conn_done(sk);
+eventually causing kernel panic. Fixing it by calling release
+in appropriate order.
+
+Fixes: cc35c88ae4db ("crypto : chtls - CPL handler definition")
+Signed-off-by: Vinay Kumar Yadav <vinay.yadav@chelsio.com>
+Signed-off-by: Ayush Sawal <ayush.sawal@chelsio.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/chelsio/chtls/chtls_cm.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/drivers/crypto/chelsio/chtls/chtls_cm.c
++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c
+@@ -1884,9 +1884,9 @@ static void bl_abort_syn_rcv(struct sock
+ queue = csk->txq_idx;
+
+ skb->sk = NULL;
+- do_abort_syn_rcv(child, lsk);
+ chtls_send_abort_rpl(child, skb, BLOG_SKB_CB(skb)->cdev,
+ CPL_ABORT_NO_RST, queue);
++ do_abort_syn_rcv(child, lsk);
+ }
+
+ static int abort_syn_rcv(struct sock *sk, struct sk_buff *skb)
+@@ -1916,8 +1916,8 @@ static int abort_syn_rcv(struct sock *sk
+ if (!sock_owned_by_user(psk)) {
+ int queue = csk->txq_idx;
+
+- do_abort_syn_rcv(sk, psk);
+ chtls_send_abort_rpl(sk, skb, cdev, CPL_ABORT_NO_RST, queue);
++ do_abort_syn_rcv(sk, psk);
+ } else {
+ skb->sk = sk;
+ BLOG_SKB_CB(skb)->backlog_rcv = bl_abort_syn_rcv;
+@@ -1960,12 +1960,11 @@ static void chtls_abort_req_rss(struct s
+
+ if (sk->sk_state == TCP_SYN_RECV && !abort_syn_rcv(sk, skb))
+ return;
+-
+- chtls_release_resources(sk);
+- chtls_conn_done(sk);
+ }
+
+ chtls_send_abort_rpl(sk, skb, csk->cdev, rst_status, queue);
++ chtls_release_resources(sk);
++ chtls_conn_done(sk);
+ }
+
+ static void chtls_abort_rpl_rss(struct sock *sk, struct sk_buff *skb)
--- /dev/null
+From foo@baz Fri Jan 15 08:22:25 AM CET 2021
+From: Ayush Sawal <ayush.sawal@chelsio.com>
+Date: Wed, 6 Jan 2021 09:59:06 +0530
+Subject: chtls: Fix hardware tid leak
+
+From: Ayush Sawal <ayush.sawal@chelsio.com>
+
+[ Upstream commit 717df0f4cdc9044c415431a3522b3e9ccca5b4a3 ]
+
+send_abort_rpl() is not calculating cpl_abort_req_rss offset and
+ends up sending wrong TID with abort_rpl WR causng tid leaks.
+Replaced send_abort_rpl() with chtls_send_abort_rpl() as it is
+redundant.
+
+Fixes: cc35c88ae4db ("crypto : chtls - CPL handler definition")
+Signed-off-by: Rohit Maheshwari <rohitm@chelsio.com>
+Signed-off-by: Ayush Sawal <ayush.sawal@chelsio.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/chelsio/chtls/chtls_cm.c | 39 ++------------------------------
+ 1 file changed, 3 insertions(+), 36 deletions(-)
+
+--- a/drivers/crypto/chelsio/chtls/chtls_cm.c
++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c
+@@ -1807,39 +1807,6 @@ static void send_defer_abort_rpl(struct
+ kfree_skb(skb);
+ }
+
+-static void send_abort_rpl(struct sock *sk, struct sk_buff *skb,
+- struct chtls_dev *cdev, int status, int queue)
+-{
+- struct cpl_abort_req_rss *req = cplhdr(skb);
+- struct sk_buff *reply_skb;
+- struct chtls_sock *csk;
+-
+- csk = rcu_dereference_sk_user_data(sk);
+-
+- reply_skb = alloc_skb(sizeof(struct cpl_abort_rpl),
+- GFP_KERNEL);
+-
+- if (!reply_skb) {
+- req->status = (queue << 1);
+- send_defer_abort_rpl(cdev, skb);
+- return;
+- }
+-
+- set_abort_rpl_wr(reply_skb, GET_TID(req), status);
+- kfree_skb(skb);
+-
+- set_wr_txq(reply_skb, CPL_PRIORITY_DATA, queue);
+- if (csk_conn_inline(csk)) {
+- struct l2t_entry *e = csk->l2t_entry;
+-
+- if (e && sk->sk_state != TCP_SYN_RECV) {
+- cxgb4_l2t_send(csk->egress_dev, reply_skb, e);
+- return;
+- }
+- }
+- cxgb4_ofld_send(cdev->lldi->ports[0], reply_skb);
+-}
+-
+ /*
+ * Add an skb to the deferred skb queue for processing from process context.
+ */
+@@ -1903,8 +1870,8 @@ static void bl_abort_syn_rcv(struct sock
+
+ skb->sk = NULL;
+ do_abort_syn_rcv(child, lsk);
+- send_abort_rpl(child, skb, BLOG_SKB_CB(skb)->cdev,
+- CPL_ABORT_NO_RST, queue);
++ chtls_send_abort_rpl(child, skb, BLOG_SKB_CB(skb)->cdev,
++ CPL_ABORT_NO_RST, queue);
+ }
+
+ static int abort_syn_rcv(struct sock *sk, struct sk_buff *skb)
+@@ -1935,7 +1902,7 @@ static int abort_syn_rcv(struct sock *sk
+ int queue = csk->txq_idx;
+
+ do_abort_syn_rcv(sk, psk);
+- send_abort_rpl(sk, skb, cdev, CPL_ABORT_NO_RST, queue);
++ chtls_send_abort_rpl(sk, skb, cdev, CPL_ABORT_NO_RST, queue);
+ } else {
+ skb->sk = sk;
+ BLOG_SKB_CB(skb)->backlog_rcv = bl_abort_syn_rcv;
--- /dev/null
+From foo@baz Fri Jan 15 08:22:25 AM CET 2021
+From: Ayush Sawal <ayush.sawal@chelsio.com>
+Date: Wed, 6 Jan 2021 09:59:08 +0530
+Subject: chtls: Fix panic when route to peer not configured
+
+From: Ayush Sawal <ayush.sawal@chelsio.com>
+
+[ Upstream commit 5a5fac9966bb6d513198634b0b1357be7e8447d2 ]
+
+If route to peer is not configured, we might get non tls
+devices from dst_neigh_lookup() which is invalid, adding a
+check to avoid it.
+
+Fixes: cc35c88ae4db ("crypto : chtls - CPL handler definition")
+Signed-off-by: Rohit Maheshwari <rohitm@chelsio.com>
+Signed-off-by: Ayush Sawal <ayush.sawal@chelsio.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/chelsio/chtls/chtls_cm.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/drivers/crypto/chelsio/chtls/chtls_cm.c
++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c
+@@ -1024,6 +1024,7 @@ static struct sock *chtls_recv_sock(stru
+ const struct cpl_pass_accept_req *req,
+ struct chtls_dev *cdev)
+ {
++ struct adapter *adap = pci_get_drvdata(cdev->pdev);
+ const struct tcphdr *tcph;
+ struct inet_sock *newinet;
+ const struct iphdr *iph;
+@@ -1033,9 +1034,10 @@ static struct sock *chtls_recv_sock(stru
+ struct neighbour *n;
+ struct tcp_sock *tp;
+ struct sock *newsk;
++ bool found = false;
+ u16 port_id;
+ int rxq_idx;
+- int step;
++ int step, i;
+
+ iph = (const struct iphdr *)network_hdr;
+ newsk = tcp_create_openreq_child(lsk, oreq, cdev->askb);
+@@ -1048,7 +1050,7 @@ static struct sock *chtls_recv_sock(stru
+
+ tcph = (struct tcphdr *)(iph + 1);
+ n = dst_neigh_lookup(dst, &iph->saddr);
+- if (!n)
++ if (!n || !n->dev)
+ goto free_sk;
+
+ ndev = n->dev;
+@@ -1057,6 +1059,13 @@ static struct sock *chtls_recv_sock(stru
+ if (is_vlan_dev(ndev))
+ ndev = vlan_dev_real_dev(ndev);
+
++ for_each_port(adap, i)
++ if (cdev->ports[i] == ndev)
++ found = true;
++
++ if (!found)
++ goto free_dst;
++
+ port_id = cxgb4_port_idx(ndev);
+
+ csk = chtls_sock_create(cdev);
+@@ -1108,6 +1117,7 @@ static struct sock *chtls_recv_sock(stru
+ free_csk:
+ chtls_sock_release(&csk->kref);
+ free_dst:
++ neigh_release(n);
+ dst_release(dst);
+ free_sk:
+ inet_csk_prepare_forced_close(newsk);
--- /dev/null
+From foo@baz Fri Jan 15 09:43:29 AM CET 2021
+From: Ayush Sawal <ayush.sawal@chelsio.com>
+Date: Wed, 6 Jan 2021 09:59:07 +0530
+Subject: chtls: Remove invalid set_tcb call
+
+From: Ayush Sawal <ayush.sawal@chelsio.com>
+
+[ Upstream commit 827d329105bfde6701f0077e34a09c4a86e27145 ]
+
+At the time of SYN_RECV, connection information is not
+initialized at FW, updating tcb flag over uninitialized
+connection causes adapter crash. We don't need to
+update the flag during SYN_RECV state, so avoid this.
+
+Fixes: cc35c88ae4db ("crypto : chtls - CPL handler definition")
+Signed-off-by: Rohit Maheshwari <rohitm@chelsio.com>
+Signed-off-by: Ayush Sawal <ayush.sawal@chelsio.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/chelsio/chtls/chtls_cm.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/crypto/chelsio/chtls/chtls_cm.c
++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c
+@@ -1920,9 +1920,6 @@ static void chtls_abort_req_rss(struct s
+ int queue = csk->txq_idx;
+
+ if (is_neg_adv(req->status)) {
+- if (sk->sk_state == TCP_SYN_RECV)
+- chtls_set_tcb_tflag(sk, 0, 0);
+-
+ kfree_skb(skb);
+ return;
+ }
--- /dev/null
+From foo@baz Fri Jan 15 09:43:29 AM CET 2021
+From: Ayush Sawal <ayush.sawal@chelsio.com>
+Date: Wed, 6 Jan 2021 09:59:10 +0530
+Subject: chtls: Replace skb_dequeue with skb_peek
+
+From: Ayush Sawal <ayush.sawal@chelsio.com>
+
+[ Upstream commit a84b2c0d5fa23da6d6c8c0d5f5c93184a2744d3e ]
+
+The skb is unlinked twice, one in __skb_dequeue in function
+chtls_reset_synq() and another in cleanup_syn_rcv_conn().
+So in this patch using skb_peek() instead of __skb_dequeue(),
+so that unlink will be handled only in cleanup_syn_rcv_conn().
+
+Fixes: cc35c88ae4db ("crypto : chtls - CPL handler definition")
+Signed-off-by: Vinay Kumar Yadav <vinay.yadav@chelsio.com>
+Signed-off-by: Ayush Sawal <ayush.sawal@chelsio.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/chelsio/chtls/chtls_cm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/crypto/chelsio/chtls/chtls_cm.c
++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c
+@@ -581,7 +581,7 @@ static void chtls_reset_synq(struct list
+
+ while (!skb_queue_empty(&listen_ctx->synq)) {
+ struct chtls_sock *csk =
+- container_of((struct synq *)__skb_dequeue
++ container_of((struct synq *)skb_peek
+ (&listen_ctx->synq), struct chtls_sock, synq);
+ struct sock *child = csk->sk;
+
--- /dev/null
+From foo@baz Fri Jan 15 09:43:29 AM CET 2021
+From: "Jouni K. Seppänen" <jks@iki.fi>
+Date: Tue, 5 Jan 2021 06:52:49 +0200
+Subject: net: cdc_ncm: correct overhead in delayed_ndp_size
+
+From: "Jouni K. Seppänen" <jks@iki.fi>
+
+[ Upstream commit 7a68d725e4ea384977445e0bcaed3d7de83ab5b3 ]
+
+Aligning to tx_ndp_modulus is not sufficient because the next align
+call can be cdc_ncm_align_tail, which can add up to ctx->tx_modulus +
+ctx->tx_remainder - 1 bytes. This used to lead to occasional crashes
+on a Huawei 909s-120 LTE module as follows:
+
+- the condition marked /* if there is a remaining skb [...] */ is true
+ so the swaps happen
+- skb_out is set from ctx->tx_curr_skb
+- skb_out->len is exactly 0x3f52
+- ctx->tx_curr_size is 0x4000 and delayed_ndp_size is 0xac
+ (note that the sum of skb_out->len and delayed_ndp_size is 0x3ffe)
+- the for loop over n is executed once
+- the cdc_ncm_align_tail call marked /* align beginning of next frame */
+ increases skb_out->len to 0x3f56 (the sum is now 0x4002)
+- the condition marked /* check if we had enough room left [...] */ is
+ false so we break out of the loop
+- the condition marked /* If requested, put NDP at end of frame. */ is
+ true so the NDP is written into skb_out
+- now skb_out->len is 0x4002, so padding_count is minus two interpreted
+ as an unsigned number, which is used as the length argument to memset,
+ leading to a crash with various symptoms but usually including
+
+> Call Trace:
+> <IRQ>
+> cdc_ncm_fill_tx_frame+0x83a/0x970 [cdc_ncm]
+> cdc_mbim_tx_fixup+0x1d9/0x240 [cdc_mbim]
+> usbnet_start_xmit+0x5d/0x720 [usbnet]
+
+The cdc_ncm_align_tail call first aligns on a ctx->tx_modulus
+boundary (adding at most ctx->tx_modulus-1 bytes), then adds
+ctx->tx_remainder bytes. Alternatively, the next alignment call can
+occur in cdc_ncm_ndp16 or cdc_ncm_ndp32, in which case at most
+ctx->tx_ndp_modulus-1 bytes are added.
+
+A similar problem has occurred before, and the code is nontrivial to
+reason about, so add a guard before the crashing call. By that time it
+is too late to prevent any memory corruption (we'll have written past
+the end of the buffer already) but we can at least try to get a warning
+written into an on-disk log by avoiding the hard crash caused by padding
+past the buffer with a huge number of zeros.
+
+Signed-off-by: Jouni K. Seppänen <jks@iki.fi>
+Fixes: 4a0e3e989d66 ("cdc_ncm: Add support for moving NDP to end of NCM frame")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=209407
+Reported-by: kernel test robot <lkp@intel.com>
+Reviewed-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/cdc_ncm.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -1127,7 +1127,10 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev
+ * accordingly. Otherwise, we should check here.
+ */
+ if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END)
+- delayed_ndp_size = ALIGN(ctx->max_ndp_size, ctx->tx_ndp_modulus);
++ delayed_ndp_size = ctx->max_ndp_size +
++ max_t(u32,
++ ctx->tx_ndp_modulus,
++ ctx->tx_modulus + ctx->tx_remainder) - 1;
+ else
+ delayed_ndp_size = 0;
+
+@@ -1308,7 +1311,8 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev
+ if (!(dev->driver_info->flags & FLAG_SEND_ZLP) &&
+ skb_out->len > ctx->min_tx_pkt) {
+ padding_count = ctx->tx_curr_size - skb_out->len;
+- skb_put_zero(skb_out, padding_count);
++ if (!WARN_ON(padding_count > ctx->tx_curr_size))
++ skb_put_zero(skb_out, padding_count);
+ } else if (skb_out->len < ctx->tx_curr_size &&
+ (skb_out->len % dev->maxpacket) == 0) {
+ skb_put_u8(skb_out, 0); /* force short packet */
--- /dev/null
+From foo@baz Fri Jan 15 09:43:29 AM CET 2021
+From: Florian Westphal <fw@strlen.de>
+Date: Wed, 6 Jan 2021 00:15:22 +0100
+Subject: net: fix pmtu check in nopmtudisc mode
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 50c661670f6a3908c273503dfa206dfc7aa54c07 ]
+
+For some reason ip_tunnel insist on setting the DF bit anyway when the
+inner header has the DF bit set, EVEN if the tunnel was configured with
+'nopmtudisc'.
+
+This means that the script added in the previous commit
+cannot be made to work by adding the 'nopmtudisc' flag to the
+ip tunnel configuration. Doing so breaks connectivity even for the
+without-conntrack/netfilter scenario.
+
+When nopmtudisc is set, the tunnel will skip the mtu check, so no
+icmp error is sent to client. Then, because inner header has DF set,
+the outer header gets added with DF bit set as well.
+
+IP stack then sends an error to itself because the packet exceeds
+the device MTU.
+
+Fixes: 23a3647bc4f93 ("ip_tunnels: Use skb-len to PMTU check.")
+Cc: Stefano Brivio <sbrivio@redhat.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/ip_tunnel.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -736,7 +736,11 @@ void ip_tunnel_xmit(struct sk_buff *skb,
+ goto tx_error;
+ }
+
+- if (tnl_update_pmtu(dev, skb, rt, tnl_params->frag_off, inner_iph)) {
++ df = tnl_params->frag_off;
++ if (skb->protocol == htons(ETH_P_IP) && !tunnel->ignore_df)
++ df |= (inner_iph->frag_off & htons(IP_DF));
++
++ if (tnl_update_pmtu(dev, skb, rt, df, inner_iph)) {
+ ip_rt_put(rt);
+ goto tx_error;
+ }
+@@ -764,10 +768,6 @@ void ip_tunnel_xmit(struct sk_buff *skb,
+ ttl = ip4_dst_hoplimit(&rt->dst);
+ }
+
+- df = tnl_params->frag_off;
+- if (skb->protocol == htons(ETH_P_IP) && !tunnel->ignore_df)
+- df |= (inner_iph->frag_off&htons(IP_DF));
+-
+ max_headroom = LL_RESERVED_SPACE(rt->dst.dev) + sizeof(struct iphdr)
+ + rt->dst.header_len + ip_encap_hlen(&tunnel->encap);
+ if (max_headroom > dev->needed_headroom)
--- /dev/null
+From foo@baz Fri Jan 15 09:43:29 AM CET 2021
+From: Yufeng Mo <moyufeng@huawei.com>
+Date: Tue, 5 Jan 2021 11:37:27 +0800
+Subject: net: hns3: fix the number of queues actually used by ARQ
+
+From: Yufeng Mo <moyufeng@huawei.com>
+
+[ Upstream commit 65e61e3c2a619c4d4b873885b2d5394025ed117b ]
+
+HCLGE_MBX_MAX_ARQ_MSG_NUM is used to apply memory for the number
+of queues used by ARQ(Asynchronous Receive Queue), so the head
+and tail pointers should also use this macro.
+
+Fixes: 07a0556a3a73 ("net: hns3: Changes to support ARQ(Asynchronous Receive Queue)")
+Signed-off-by: Yufeng Mo <moyufeng@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hclge_mbx.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/hisilicon/hns3/hclge_mbx.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hclge_mbx.h
+@@ -102,7 +102,7 @@ struct hclgevf_mbx_arq_ring {
+ #define hclge_mbx_ring_ptr_move_crq(crq) \
+ (crq->next_to_use = (crq->next_to_use + 1) % crq->desc_num)
+ #define hclge_mbx_tail_ptr_move_arq(arq) \
+- (arq.tail = (arq.tail + 1) % HCLGE_MBX_MAX_ARQ_MSG_SIZE)
++ (arq.tail = (arq.tail + 1) % HCLGE_MBX_MAX_ARQ_MSG_NUM)
+ #define hclge_mbx_head_ptr_move_arq(arq) \
+- (arq.head = (arq.head + 1) % HCLGE_MBX_MAX_ARQ_MSG_SIZE)
++ (arq.head = (arq.head + 1) % HCLGE_MBX_MAX_ARQ_MSG_NUM)
+ #endif
--- /dev/null
+From foo@baz Fri Jan 15 09:43:29 AM CET 2021
+From: Florian Westphal <fw@strlen.de>
+Date: Wed, 6 Jan 2021 00:15:23 +0100
+Subject: net: ip: always refragment ip defragmented packets
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit bb4cc1a18856a73f0ff5137df0c2a31f4c50f6cf ]
+
+Conntrack reassembly records the largest fragment size seen in IPCB.
+However, when this gets forwarded/transmitted, fragmentation will only
+be forced if one of the fragmented packets had the DF bit set.
+
+In that case, a flag in IPCB will force fragmentation even if the
+MTU is large enough.
+
+This should work fine, but this breaks with ip tunnels.
+Consider client that sends a UDP datagram of size X to another host.
+
+The client fragments the datagram, so two packets, of size y and z, are
+sent. DF bit is not set on any of these packets.
+
+Middlebox netfilter reassembles those packets back to single size-X
+packet, before routing decision.
+
+packet-size-vs-mtu checks in ip_forward are irrelevant, because DF bit
+isn't set. At output time, ip refragmentation is skipped as well
+because x is still smaller than the mtu of the output device.
+
+If ttransmit device is an ip tunnel, the packet size increases to
+x+overhead.
+
+Also, tunnel might be configured to force DF bit on outer header.
+
+In this case, packet will be dropped (exceeds MTU) and an ICMP error is
+generated back to sender.
+
+But sender already respects the announced MTU, all the packets that
+it sent did fit the announced mtu.
+
+Force refragmentation as per original sizes unconditionally so ip tunnel
+will encapsulate the fragments instead.
+
+The only other solution I see is to place ip refragmentation in
+the ip_tunnel code to handle this case.
+
+Fixes: d6b915e29f4ad ("ip_fragment: don't forward defragmented DF packet")
+Reported-by: Christian Perle <christian.perle@secunet.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/ip_output.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -312,7 +312,7 @@ static int ip_finish_output(struct net *
+ if (skb_is_gso(skb))
+ return ip_finish_output_gso(net, sk, skb, mtu);
+
+- if (skb->len > mtu || (IPCB(skb)->flags & IPSKB_FRAG_PMTU))
++ if (skb->len > mtu || IPCB(skb)->frag_max_size)
+ return ip_fragment(net, sk, skb, mtu, ip_finish_output2);
+
+ return ip_finish_output2(net, sk, skb);
--- /dev/null
+From foo@baz Fri Jan 15 09:43:29 AM CET 2021
+From: Sean Tranchetti <stranche@codeaurora.org>
+Date: Tue, 5 Jan 2021 16:22:25 -0800
+Subject: net: ipv6: fib: flush exceptions when purging route
+
+From: Sean Tranchetti <stranche@codeaurora.org>
+
+[ Upstream commit d8f5c29653c3f6995e8979be5623d263e92f6b86 ]
+
+Route removal is handled by two code paths. The main removal path is via
+fib6_del_route() which will handle purging any PMTU exceptions from the
+cache, removing all per-cpu copies of the DST entry used by the route, and
+releasing the fib6_info struct.
+
+The second removal location is during fib6_add_rt2node() during a route
+replacement operation. This path also calls fib6_purge_rt() to handle
+cleaning up the per-cpu copies of the DST entries and releasing the
+fib6_info associated with the older route, but it does not flush any PMTU
+exceptions that the older route had. Since the older route is removed from
+the tree during the replacement, we lose any way of accessing it again.
+
+As these lingering DSTs and the fib6_info struct are holding references to
+the underlying netdevice struct as well, unregistering that device from the
+kernel can never complete.
+
+Fixes: 2b760fcf5cfb3 ("ipv6: hook up exception table to store dst cache")
+Signed-off-by: Sean Tranchetti <stranche@codeaurora.org>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://lore.kernel.org/r/1609892546-11389-1-git-send-email-stranche@quicinc.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/ip6_fib.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/net/ipv6/ip6_fib.c
++++ b/net/ipv6/ip6_fib.c
+@@ -906,6 +906,8 @@ static void fib6_purge_rt(struct fib6_in
+ {
+ struct fib6_table *table = rt->fib6_table;
+
++ /* Flush all cached dst in exception table */
++ rt6_flush_exceptions(rt);
+ if (rt->rt6i_pcpu)
+ fib6_drop_pcpu_from(rt, table);
+
+@@ -1756,9 +1758,6 @@ static void fib6_del_route(struct fib6_t
+ net->ipv6.rt6_stats->fib_rt_entries--;
+ net->ipv6.rt6_stats->fib_discarded_routes++;
+
+- /* Flush all cached dst in exception table */
+- rt6_flush_exceptions(rt);
+-
+ /* Reset round-robin state, if necessary */
+ if (rcu_access_pointer(fn->rr_ptr) == rt)
+ fn->rr_ptr = NULL;
--- /dev/null
+From foo@baz Fri Jan 15 09:43:29 AM CET 2021
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Sun, 3 Jan 2021 11:26:26 +1100
+Subject: net/sonic: Fix some resource leaks in error handling paths
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 0f7ba7bc46fa0b574ccacf5672991b321e028492 ]
+
+A call to dma_alloc_coherent() is wrapped by sonic_alloc_descriptors().
+
+This is correctly freed in the remove function, but not in the error
+handling path of the probe function. Fix this by adding the missing
+dma_free_coherent() call.
+
+While at it, rename a label in order to be slightly more informative.
+
+Cc: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Cc: Chris Zankel <chris@zankel.net>
+References: commit 10e3cc180e64 ("net/sonic: Fix a resource leak in an error handling path in 'jazz_sonic_probe()'")
+Fixes: 74f2a5f0ef64 ("xtensa: Add support for the Sonic Ethernet device for the XT2000 board.")
+Fixes: efcce839360f ("[PATCH] macsonic/jazzsonic network drivers update")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/natsemi/macsonic.c | 12 ++++++++++--
+ drivers/net/ethernet/natsemi/xtsonic.c | 7 +++++--
+ 2 files changed, 15 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/natsemi/macsonic.c
++++ b/drivers/net/ethernet/natsemi/macsonic.c
+@@ -540,10 +540,14 @@ static int mac_sonic_platform_probe(stru
+
+ err = register_netdev(dev);
+ if (err)
+- goto out;
++ goto undo_probe;
+
+ return 0;
+
++undo_probe:
++ dma_free_coherent(lp->device,
++ SIZEOF_SONIC_DESC * SONIC_BUS_SCALE(lp->dma_bitmode),
++ lp->descriptors, lp->descriptors_laddr);
+ out:
+ free_netdev(dev);
+
+@@ -618,12 +622,16 @@ static int mac_sonic_nubus_probe(struct
+
+ err = register_netdev(ndev);
+ if (err)
+- goto out;
++ goto undo_probe;
+
+ nubus_set_drvdata(board, ndev);
+
+ return 0;
+
++undo_probe:
++ dma_free_coherent(lp->device,
++ SIZEOF_SONIC_DESC * SONIC_BUS_SCALE(lp->dma_bitmode),
++ lp->descriptors, lp->descriptors_laddr);
+ out:
+ free_netdev(ndev);
+ return err;
+--- a/drivers/net/ethernet/natsemi/xtsonic.c
++++ b/drivers/net/ethernet/natsemi/xtsonic.c
+@@ -265,11 +265,14 @@ int xtsonic_probe(struct platform_device
+ sonic_msg_init(dev);
+
+ if ((err = register_netdev(dev)))
+- goto out1;
++ goto undo_probe1;
+
+ return 0;
+
+-out1:
++undo_probe1:
++ dma_free_coherent(lp->device,
++ SIZEOF_SONIC_DESC * SONIC_BUS_SCALE(lp->dma_bitmode),
++ lp->descriptors, lp->descriptors_laddr);
+ release_region(dev->base_addr, SONIC_MEM_SIZE);
+ out:
+ free_netdev(dev);
--- /dev/null
+From foo@baz Fri Jan 15 09:43:29 AM CET 2021
+From: Samuel Holland <samuel@sholland.org>
+Date: Sun, 3 Jan 2021 05:17:43 -0600
+Subject: net: stmmac: dwmac-sun8i: Balance internal PHY power
+
+From: Samuel Holland <samuel@sholland.org>
+
+[ Upstream commit b8239638853e3e37b287e4bd4d57b41f14c78550 ]
+
+sun8i_dwmac_exit calls sun8i_dwmac_unpower_internal_phy, but
+sun8i_dwmac_init did not call sun8i_dwmac_power_internal_phy. This
+caused PHY power to remain off after a suspend/resume cycle. Fix this by
+recording if PHY power should be restored, and if so, restoring it.
+
+Fixes: 634db83b8265 ("net: stmmac: dwmac-sun8i: Handle integrated/external MDIOs")
+Signed-off-by: Samuel Holland <samuel@sholland.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 31 ++++++++++++++++------
+ 1 file changed, 23 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+@@ -73,6 +73,7 @@ struct emac_variant {
+ * @variant: reference to the current board variant
+ * @regmap: regmap for using the syscon
+ * @internal_phy_powered: Does the internal PHY is enabled
++ * @use_internal_phy: Is the internal PHY selected for use
+ * @mux_handle: Internal pointer used by mdio-mux lib
+ */
+ struct sunxi_priv_data {
+@@ -83,6 +84,7 @@ struct sunxi_priv_data {
+ const struct emac_variant *variant;
+ struct regmap_field *regmap_field;
+ bool internal_phy_powered;
++ bool use_internal_phy;
+ void *mux_handle;
+ };
+
+@@ -518,8 +520,11 @@ static const struct stmmac_dma_ops sun8i
+ .dma_interrupt = sun8i_dwmac_dma_interrupt,
+ };
+
++static int sun8i_dwmac_power_internal_phy(struct stmmac_priv *priv);
++
+ static int sun8i_dwmac_init(struct platform_device *pdev, void *priv)
+ {
++ struct net_device *ndev = platform_get_drvdata(pdev);
+ struct sunxi_priv_data *gmac = priv;
+ int ret;
+
+@@ -533,13 +538,25 @@ static int sun8i_dwmac_init(struct platf
+
+ ret = clk_prepare_enable(gmac->tx_clk);
+ if (ret) {
+- if (gmac->regulator)
+- regulator_disable(gmac->regulator);
+ dev_err(&pdev->dev, "Could not enable AHB clock\n");
+- return ret;
++ goto err_disable_regulator;
++ }
++
++ if (gmac->use_internal_phy) {
++ ret = sun8i_dwmac_power_internal_phy(netdev_priv(ndev));
++ if (ret)
++ goto err_disable_clk;
+ }
+
+ return 0;
++
++err_disable_clk:
++ clk_disable_unprepare(gmac->tx_clk);
++err_disable_regulator:
++ if (gmac->regulator)
++ regulator_disable(gmac->regulator);
++
++ return ret;
+ }
+
+ static void sun8i_dwmac_core_init(struct mac_device_info *hw,
+@@ -809,7 +826,6 @@ static int mdio_mux_syscon_switch_fn(int
+ struct sunxi_priv_data *gmac = priv->plat->bsp_priv;
+ u32 reg, val;
+ int ret = 0;
+- bool need_power_ephy = false;
+
+ if (current_child ^ desired_child) {
+ regmap_field_read(gmac->regmap_field, ®);
+@@ -817,13 +833,12 @@ static int mdio_mux_syscon_switch_fn(int
+ case DWMAC_SUN8I_MDIO_MUX_INTERNAL_ID:
+ dev_info(priv->device, "Switch mux to internal PHY");
+ val = (reg & ~H3_EPHY_MUX_MASK) | H3_EPHY_SELECT;
+-
+- need_power_ephy = true;
++ gmac->use_internal_phy = true;
+ break;
+ case DWMAC_SUN8I_MDIO_MUX_EXTERNAL_ID:
+ dev_info(priv->device, "Switch mux to external PHY");
+ val = (reg & ~H3_EPHY_MUX_MASK) | H3_EPHY_SHUTDOWN;
+- need_power_ephy = false;
++ gmac->use_internal_phy = false;
+ break;
+ default:
+ dev_err(priv->device, "Invalid child ID %x\n",
+@@ -831,7 +846,7 @@ static int mdio_mux_syscon_switch_fn(int
+ return -EINVAL;
+ }
+ regmap_field_write(gmac->regmap_field, val);
+- if (need_power_ephy) {
++ if (gmac->use_internal_phy) {
+ ret = sun8i_dwmac_power_internal_phy(priv);
+ if (ret)
+ return ret;
--- /dev/null
+From foo@baz Fri Jan 15 09:43:29 AM CET 2021
+From: Samuel Holland <samuel@sholland.org>
+Date: Sun, 3 Jan 2021 05:17:42 -0600
+Subject: net: stmmac: dwmac-sun8i: Balance internal PHY resource references
+
+From: Samuel Holland <samuel@sholland.org>
+
+[ Upstream commit 529254216773acd5039c07aa18cf06fd1f9fccdd ]
+
+While stmmac_pltfr_remove calls sun8i_dwmac_exit, the sun8i_dwmac_init
+and sun8i_dwmac_exit functions are also called by the stmmac_platform
+suspend/resume callbacks. They may be called many times during the
+device's lifetime and should not release resources used by the driver.
+
+Furthermore, there was no error handling in case registering the MDIO
+mux failed during probe, and the EPHY clock was never released at all.
+
+Fix all of these issues by moving the deinitialization code to a driver
+removal callback. Also ensure the EPHY is powered down before removal.
+
+Fixes: 634db83b8265 ("net: stmmac: dwmac-sun8i: Handle integrated/external MDIOs")
+Signed-off-by: Samuel Holland <samuel@sholland.org>
+Reviewed-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 27 +++++++++++++++++-----
+ 1 file changed, 21 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+@@ -977,17 +977,12 @@ static void sun8i_dwmac_exit(struct plat
+ struct sunxi_priv_data *gmac = priv;
+
+ if (gmac->variant->soc_has_internal_phy) {
+- /* sun8i_dwmac_exit could be called with mdiomux uninit */
+- if (gmac->mux_handle)
+- mdio_mux_uninit(gmac->mux_handle);
+ if (gmac->internal_phy_powered)
+ sun8i_dwmac_unpower_internal_phy(gmac);
+ }
+
+ sun8i_dwmac_unset_syscon(gmac);
+
+- reset_control_put(gmac->rst_ephy);
+-
+ clk_disable_unprepare(gmac->tx_clk);
+
+ if (gmac->regulator)
+@@ -1200,12 +1195,32 @@ static int sun8i_dwmac_probe(struct plat
+
+ return ret;
+ dwmac_mux:
++ reset_control_put(gmac->rst_ephy);
++ clk_put(gmac->ephy_clk);
+ sun8i_dwmac_unset_syscon(gmac);
+ dwmac_exit:
+ stmmac_pltfr_remove(pdev);
+ return ret;
+ }
+
++static int sun8i_dwmac_remove(struct platform_device *pdev)
++{
++ struct net_device *ndev = platform_get_drvdata(pdev);
++ struct stmmac_priv *priv = netdev_priv(ndev);
++ struct sunxi_priv_data *gmac = priv->plat->bsp_priv;
++
++ if (gmac->variant->soc_has_internal_phy) {
++ mdio_mux_uninit(gmac->mux_handle);
++ sun8i_dwmac_unpower_internal_phy(gmac);
++ reset_control_put(gmac->rst_ephy);
++ clk_put(gmac->ephy_clk);
++ }
++
++ stmmac_pltfr_remove(pdev);
++
++ return 0;
++}
++
+ static const struct of_device_id sun8i_dwmac_match[] = {
+ { .compatible = "allwinner,sun8i-h3-emac",
+ .data = &emac_variant_h3 },
+@@ -1223,7 +1238,7 @@ MODULE_DEVICE_TABLE(of, sun8i_dwmac_matc
+
+ static struct platform_driver sun8i_dwmac_driver = {
+ .probe = sun8i_dwmac_probe,
+- .remove = stmmac_pltfr_remove,
++ .remove = sun8i_dwmac_remove,
+ .driver = {
+ .name = "dwmac-sun8i",
+ .pm = &stmmac_pltfr_pm_ops,
--- /dev/null
+From foo@baz Fri Jan 15 09:43:29 AM CET 2021
+From: Jakub Kicinski <kuba@kernel.org>
+Date: Wed, 30 Dec 2020 19:40:27 -0800
+Subject: net: vlan: avoid leaks on register_vlan_dev() failures
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 55b7ab1178cbf41f979ff83236d3321ad35ed2ad ]
+
+VLAN checks for NETREG_UNINITIALIZED to distinguish between
+registration failure and unregistration in progress.
+
+Since commit cb626bf566eb ("net-sysfs: Fix reference count leak")
+registration failure may, however, result in NETREG_UNREGISTERED
+as well as NETREG_UNINITIALIZED.
+
+This fix is similer to cebb69754f37 ("rtnetlink: Fix
+memory(net_device) leak when ->newlink fails")
+
+Fixes: cb626bf566eb ("net-sysfs: Fix reference count leak")
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/8021q/vlan.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/8021q/vlan.c
++++ b/net/8021q/vlan.c
+@@ -277,7 +277,8 @@ static int register_vlan_device(struct n
+ return 0;
+
+ out_free_newdev:
+- if (new_dev->reg_state == NETREG_UNINITIALIZED)
++ if (new_dev->reg_state == NETREG_UNINITIALIZED ||
++ new_dev->reg_state == NETREG_UNREGISTERED)
+ free_netdev(new_dev);
+ return err;
+ }
--- /dev/null
+net-cdc_ncm-correct-overhead-in-delayed_ndp_size.patch
+net-hns3-fix-the-number-of-queues-actually-used-by-arq.patch
+net-stmmac-dwmac-sun8i-balance-internal-phy-resource-references.patch
+net-stmmac-dwmac-sun8i-balance-internal-phy-power.patch
+net-vlan-avoid-leaks-on-register_vlan_dev-failures.patch
+net-sonic-fix-some-resource-leaks-in-error-handling-paths.patch
+net-ip-always-refragment-ip-defragmented-packets.patch
+net-fix-pmtu-check-in-nopmtudisc-mode.patch
+net-ipv6-fib-flush-exceptions-when-purging-route.patch
+chtls-fix-hardware-tid-leak.patch
+chtls-remove-invalid-set_tcb-call.patch
+chtls-fix-panic-when-route-to-peer-not-configured.patch
+chtls-replace-skb_dequeue-with-skb_peek.patch
+chtls-added-a-check-to-avoid-null-pointer-dereference.patch
+chtls-fix-chtls-resources-release-sequence.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
