--- /dev/null
+From 2ed70139e0b002757566915b336ddc2b8d268e15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Dec 2020 23:52:03 +0000
+Subject: afs: Fix memory leak when mounting with multiple source parameters
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 4cb682964706deffb4861f0a91329ab3a705039f ]
+
+There's a memory leak in afs_parse_source() whereby multiple source=
+parameters overwrite fc->source in the fs_context struct without freeing
+the previously recorded source.
+
+Fix this by only permitting a single source parameter and rejecting with
+an error all subsequent ones.
+
+This was caught by syzbot with the kernel memory leak detector, showing
+something like the following trace:
+
+ unreferenced object 0xffff888114375440 (size 32):
+ comm "repro", pid 5168, jiffies 4294923723 (age 569.948s)
+ backtrace:
+ slab_post_alloc_hook+0x42/0x79
+ __kmalloc_track_caller+0x125/0x16a
+ kmemdup_nul+0x24/0x3c
+ vfs_parse_fs_string+0x5a/0xa1
+ generic_parse_monolithic+0x9d/0xc5
+ do_new_mount+0x10d/0x15a
+ do_mount+0x5f/0x8e
+ __do_sys_mount+0xff/0x127
+ do_syscall_64+0x2d/0x3a
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Fixes: 13fcc6837049 ("afs: Add fs_context support")
+Reported-by: syzbot+86dc6632faaca40133ab@syzkaller.appspotmail.com
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/super.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/afs/super.c b/fs/afs/super.c
+index 7f8a9b3137bff..eb04dcc543289 100644
+--- a/fs/afs/super.c
++++ b/fs/afs/super.c
+@@ -236,6 +236,9 @@ static int afs_parse_source(struct fs_context *fc, struct fs_parameter *param)
+
+ _enter(",%s", name);
+
++ if (fc->source)
++ return invalf(fc, "kAFS: Multiple sources not supported");
++
+ if (!name) {
+ printk(KERN_ERR "kAFS: no volume name specified\n");
+ return -EINVAL;
+--
+2.27.0
+
--- /dev/null
+From 8f078091e355d9627992e533ee148e82d24116cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Nov 2020 18:56:28 +0100
+Subject: ARM: dts: imx6qdl-kontron-samx6i: fix I2C_PM scl pin
+
+From: Bernd Bauer <bernd.bauer@anton-paar.com>
+
+[ Upstream commit 19ba8fb810c60b46869acc9f455613de454e0fca ]
+
+Use the correct pin for the i2c scl signal else we can't access the
+SoM eeprom.
+
+Fixes: 2a51f9dae13d ("ARM: dts: imx6qdl-kontron-samx6i: Add iMX6-based Kontron SMARC-sAMX6i module")
+Signed-off-by: Bernd Bauer <bernd.bauer@anton-paar.com>
+[m.felsch@pengutronix.de: Adapt commit message]
+Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi
+index 81c7ebb4b3fbe..6acc8591219a7 100644
+--- a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi
+@@ -551,7 +551,7 @@
+
+ pinctrl_i2c3: i2c3grp {
+ fsl,pins = <
+- MX6QDL_PAD_GPIO_3__I2C3_SCL 0x4001b8b1
++ MX6QDL_PAD_GPIO_5__I2C3_SCL 0x4001b8b1
+ MX6QDL_PAD_GPIO_16__I2C3_SDA 0x4001b8b1
+ >;
+ };
+--
+2.27.0
+
--- /dev/null
+From b0db0dcf8b6c2d2c749a8414fa216e0e2da66f1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Nov 2020 17:54:47 -0300
+Subject: ARM: dts: imx6qdl-wandboard-revd1: Remove PAD_GPIO_6 from enetgrp
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 58d6bca5efc73235b0f84c0d53321737177c651e ]
+
+Since commit 8ad2d1dcce54 ("ARM: dts: imx6qdl-wandboard: Add OV5645 camera
+support") the PAD_GPIO_6 is used for providing the camera sensor clock.
+
+Remove it from the enetgrp to fix the following IOMXU conflict:
+
+[ 9.972414] imx6q-pinctrl 20e0000.pinctrl: pin MX6Q_PAD_GPIO_6 already requested by 2188000.ethernet; cannot claim for 1-003c
+[ 9.983857] imx6q-pinctrl 20e0000.pinctrl: pin-140 (1-003c) status -22
+[ 9.990514] imx6q-pinctrl 20e0000.pinctrl: could not request pin 140 (MX6Q_PAD_GPIO_6) from group ov5645grp on device 20e0000.pinctrl
+
+Fixes: 8ad2d1dcce54 ("ARM: dts: imx6qdl-wandboard: Add OV5645 camera support")
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6qdl-wandboard-revd1.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-wandboard-revd1.dtsi b/arch/arm/boot/dts/imx6qdl-wandboard-revd1.dtsi
+index 93909796885a0..b9b698f72b261 100644
+--- a/arch/arm/boot/dts/imx6qdl-wandboard-revd1.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-wandboard-revd1.dtsi
+@@ -166,7 +166,6 @@
+ MX6QDL_PAD_RGMII_RD2__RGMII_RD2 0x1b030
+ MX6QDL_PAD_RGMII_RD3__RGMII_RD3 0x1b030
+ MX6QDL_PAD_RGMII_RX_CTL__RGMII_RX_CTL 0x1b030
+- MX6QDL_PAD_GPIO_6__ENET_IRQ 0x000b1
+ >;
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 150deac78c3fc77b4ff107f5fe6ef5741d0d0e3e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 11:16:40 -0300
+Subject: ARM: dts: sun7i: bananapi: Enable RGMII RX/TX delay on Ethernet PHY
+
+From: Pablo Greco <pgreco@centosproject.org>
+
+[ Upstream commit 8c9cb4094ccf242eddd140efba13872c55f68a87 ]
+
+The Ethernet PHY on the Bananapi M1 has the RX and TX delays enabled on
+the PHY, using pull-ups on the RXDLY and TXDLY pins.
+
+Fix the phy-mode description to correct reflect this so that the
+implementation doesn't reconfigure the delays incorrectly. This
+happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e
+rx/tx delay config").
+
+Fixes: 8a5b272fbf44 ("ARM: dts: sun7i: Add Banana Pi board")
+Signed-off-by: Pablo Greco <pgreco@centosproject.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/1604326600-39544-1-git-send-email-pgreco@centosproject.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun7i-a20-bananapi.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/sun7i-a20-bananapi.dts b/arch/arm/boot/dts/sun7i-a20-bananapi.dts
+index bb3987e101c29..0b3d9ae756503 100644
+--- a/arch/arm/boot/dts/sun7i-a20-bananapi.dts
++++ b/arch/arm/boot/dts/sun7i-a20-bananapi.dts
+@@ -132,7 +132,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&gmac_rgmii_pins>;
+ phy-handle = <&phy1>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ phy-supply = <®_gmac_3v3>;
+ status = "okay";
+ };
+--
+2.27.0
+
--- /dev/null
+From 1ab197332b9a6fcca02f1296c6136853ffd13ad8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Nov 2020 17:47:39 +0000
+Subject: ARM: dts: sun7i: pcduino3-nano: enable RGMII RX/TX delay on PHY
+
+From: Adam Sampson <ats@offog.org>
+
+[ Upstream commit a7361b9c4615951f52ffd2b1afa09a1384c7b4e4 ]
+
+The RX/TX delays for the Ethernet PHY on the Linksprite pcDuino 3 Nano
+are configured in hardware, using resistors that are populated to pull
+the RTL8211E's RXDLY/TXDLY pins low or high as needed.
+
+phy-mode should be set to rgmii-id to reflect this. Previously it was
+set to rgmii, which used to work but now results in the delays being
+disabled again as a result of the bugfix in commit bbc4d71d6354 ("net:
+phy: realtek: fix rtl8211e rx/tx delay config").
+
+Tested on two pcDuino 3 Nano boards purchased in 2015. Without this fix,
+Ethernet works unreliably on one board and doesn't work at all on the
+other.
+
+Fixes: 061035d456c9 ("ARM: dts: sun7i: Add dts file for pcDuino 3 Nano board")
+Signed-off-by: Adam Sampson <ats@offog.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Link: https://lore.kernel.org/r/20201123174739.6809-1-ats@offog.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun7i-a20-pcduino3-nano.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun7i-a20-pcduino3-nano.dts b/arch/arm/boot/dts/sun7i-a20-pcduino3-nano.dts
+index fce2f7fcd084a..bf38c66c1815b 100644
+--- a/arch/arm/boot/dts/sun7i-a20-pcduino3-nano.dts
++++ b/arch/arm/boot/dts/sun7i-a20-pcduino3-nano.dts
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright 2015 Adam Sampson <ats@offog.org>
++ * Copyright 2015-2020 Adam Sampson <ats@offog.org>
+ *
+ * This file is dual-licensed: you can use it either under the terms
+ * of the GPL or the X11 license, at your option. Note that this dual
+@@ -115,7 +115,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&gmac_rgmii_pins>;
+ phy-handle = <&phy1>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ status = "okay";
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 495ff24f31f535f5f8fdf94ff09dbf7d26691806 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 11:19:14 -0300
+Subject: ARM: dts: sun8i: r40: bananapi-m2-berry: Fix dcdc1 regulator
+
+From: Pablo Greco <pgreco@centosproject.org>
+
+[ Upstream commit bd5cdcdc66e1f7179ff6d172d1e5f55e43403aa8 ]
+
+DCDC1 regulator powers many different subsystems. While some of them can
+work at 3.0 V, some of them can not. For example, VCC-HDMI can only work
+between 3.24 V and 3.36 V. According to OS images provided by the board
+manufacturer this regulator should be set to 3.3 V.
+
+Set DCDC1 and DCDC1SW to 3.3 V in order to fix this.
+
+Fixes: 23edc168bd98 ("ARM: dts: sun8i: Add board dts file for Banana Pi M2 Berry")
+Fixes: 27e81e1970a8 ("ARM: dts: sun8i: v40: bananapi-m2-berry: Enable GMAC ethernet controller")
+Signed-off-by: Pablo Greco <pgreco@centosproject.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/1604326755-39742-1-git-send-email-pgreco@centosproject.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
+index 15c22b06fc4b6..84eb082957183 100644
+--- a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
++++ b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
+@@ -198,16 +198,16 @@
+ };
+
+ ®_dc1sw {
+- regulator-min-microvolt = <3000000>;
+- regulator-max-microvolt = <3000000>;
++ regulator-min-microvolt = <3300000>;
++ regulator-max-microvolt = <3300000>;
+ regulator-name = "vcc-gmac-phy";
+ };
+
+ ®_dcdc1 {
+ regulator-always-on;
+- regulator-min-microvolt = <3000000>;
+- regulator-max-microvolt = <3000000>;
+- regulator-name = "vcc-3v0";
++ regulator-min-microvolt = <3300000>;
++ regulator-max-microvolt = <3300000>;
++ regulator-name = "vcc-3v3";
+ };
+
+ ®_dcdc2 {
+--
+2.27.0
+
--- /dev/null
+From 9634142600b5a91a0d50b84ab8696336c98b6f2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 13:08:51 +0800
+Subject: ARM: dts: sun8i: v3s: fix GIC node memory range
+
+From: Icenowy Zheng <icenowy@aosc.io>
+
+[ Upstream commit a98fd117a2553ab1a6d2fe3c7acae88c1eca4372 ]
+
+Currently the GIC node in V3s DTSI follows some old DT examples, and
+being broken. This leads a warning at boot.
+
+Fix this.
+
+Fixes: f989086ccbc6 ("ARM: dts: sunxi: add dtsi file for V3s SoC")
+Signed-off-by: Icenowy Zheng <icenowy@aosc.io>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20201120050851.4123759-1-icenowy@aosc.io
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-v3s.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/sun8i-v3s.dtsi b/arch/arm/boot/dts/sun8i-v3s.dtsi
+index 2abcba35d27e6..50c32cf72c65c 100644
+--- a/arch/arm/boot/dts/sun8i-v3s.dtsi
++++ b/arch/arm/boot/dts/sun8i-v3s.dtsi
+@@ -423,7 +423,7 @@
+ gic: interrupt-controller@1c81000 {
+ compatible = "arm,gic-400";
+ reg = <0x01c81000 0x1000>,
+- <0x01c82000 0x1000>,
++ <0x01c82000 0x2000>,
+ <0x01c84000 0x2000>,
+ <0x01c86000 0x2000>;
+ interrupt-controller;
+--
+2.27.0
+
--- /dev/null
+From 014424c301ff8753dc52cfcad4ebf4be2d76ba6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 11:19:29 -0300
+Subject: ARM: dts: sun8i: v40: bananapi-m2-berry: Fix ethernet node
+
+From: Pablo Greco <pgreco@centosproject.org>
+
+[ Upstream commit 8a82d91fa275aaea49be06d7f5b1407ce1c0dd4b ]
+
+Ethernet PHY on BananaPi M2 Berry provides RX and TX delays. Fix ethernet
+node to reflect that fact.
+
+Fixes: 27e81e1970a8 ("ARM: dts: sun8i: v40: bananapi-m2-berry: Enable GMAC ethernet controller")
+Signed-off-by: Pablo Greco <pgreco@centosproject.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/1604326769-39802-1-git-send-email-pgreco@centosproject.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
+index 84eb082957183..47954551f5735 100644
+--- a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
++++ b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
+@@ -120,7 +120,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&gmac_rgmii_pins>;
+ phy-handle = <&phy1>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ phy-supply = <®_dc1sw>;
+ status = "okay";
+ };
+--
+2.27.0
+
--- /dev/null
+From 6aeaa2c54c5ca27cec268fafbaced1e026f19ac0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Nov 2020 11:59:40 +0000
+Subject: arm64: syscall: exit userspace before unmasking exceptions
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+[ Upstream commit ca1314d73eed493c49bb1932c60a8605530db2e4 ]
+
+In el0_svc_common() we unmask exceptions before we call user_exit(), and
+so there's a window where an IRQ or debug exception can be taken while
+RCU is not watching. In do_debug_exception() we account for this in via
+debug_exception_{enter,exit}(), but in the el1_irq asm we do not and we
+call trace functions which rely on RCU before we have a guarantee that
+RCU is watching.
+
+Let's avoid this by having el0_svc_common() exit userspace before
+unmasking exceptions, matching what we do for all other EL0 entry paths.
+We can use user_exit_irqoff() to avoid the pointless save/restore of IRQ
+flags while we're sure exceptions are masked in DAIF.
+
+The workaround for Cortex-A76 erratum 1463225 may trigger a debug
+exception before this point, but the debug code invoked in this case is
+safe even when RCU is not watching.
+
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: James Morse <james.morse@arm.com>
+Cc: Will Deacon <will@kernel.org>
+Link: https://lore.kernel.org/r/20201130115950.22492-2-mark.rutland@arm.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/syscall.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/kernel/syscall.c b/arch/arm64/kernel/syscall.c
+index 1457a0ba83dbc..f2d2dbbbfca20 100644
+--- a/arch/arm64/kernel/syscall.c
++++ b/arch/arm64/kernel/syscall.c
+@@ -102,8 +102,8 @@ static void el0_svc_common(struct pt_regs *regs, int scno, int sc_nr,
+ regs->syscallno = scno;
+
+ cortex_a76_erratum_1463225_svc_handler();
++ user_exit_irqoff();
+ local_daif_restore(DAIF_PROCCTX);
+- user_exit();
+
+ if (has_syscall_work(flags)) {
+ /* set default errno for user-issued syscall(-1) */
+--
+2.27.0
+
--- /dev/null
+From b5e6ef0a5491378cf44d3a48dd7572e542580a26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Apr 2020 09:24:51 -0700
+Subject: blk-mq: In blk_mq_dispatch_rq_list() "no budget" is a reason to kick
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit ab3cee3762e5e69f27c302c43691289fdfc12316 ]
+
+In blk_mq_dispatch_rq_list(), if blk_mq_sched_needs_restart() returns
+true and the driver returns BLK_STS_RESOURCE then we'll kick the
+queue. However, there's another case where we might need to kick it.
+If we were unable to get budget we can be in much the same state as
+when the driver returns BLK_STS_RESOURCE, so we should treat it the
+same.
+
+It should be noted that even if we add a whole bunch of extra kicking
+to the queue in other patches this patch is still important.
+Specifically any kicking that happened before we re-spliced leftover
+requests into 'hctx->dispatch' wouldn't have found any work, so we
+really need to make sure we kick ourselves after we've done the
+splicing.
+
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index c0efd3e278da6..057a634396a90 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1233,6 +1233,7 @@ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list,
+ bool no_tag = false;
+ int errors, queued;
+ blk_status_t ret = BLK_STS_OK;
++ bool no_budget_avail = false;
+
+ if (list_empty(list))
+ return false;
+@@ -1251,6 +1252,7 @@ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list,
+ hctx = rq->mq_hctx;
+ if (!got_budget && !blk_mq_get_dispatch_budget(hctx)) {
+ blk_mq_put_driver_tag(rq);
++ no_budget_avail = true;
+ break;
+ }
+
+@@ -1356,13 +1358,15 @@ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list,
+ *
+ * If driver returns BLK_STS_RESOURCE and SCHED_RESTART
+ * bit is set, run queue after a delay to avoid IO stalls
+- * that could otherwise occur if the queue is idle.
++ * that could otherwise occur if the queue is idle. We'll do
++ * similar if we couldn't get budget and SCHED_RESTART is set.
+ */
+ needs_restart = blk_mq_sched_needs_restart(hctx);
+ if (!needs_restart ||
+ (no_tag && list_empty_careful(&hctx->dispatch_wait.entry)))
+ blk_mq_run_hw_queue(hctx, true);
+- else if (needs_restart && (ret == BLK_STS_RESOURCE))
++ else if (needs_restart && (ret == BLK_STS_RESOURCE ||
++ no_budget_avail))
+ blk_mq_delay_run_hw_queue(hctx, BLK_MQ_RESOURCE_DELAY);
+
+ blk_mq_update_dispatch_busy(hctx, true);
+--
+2.27.0
+
--- /dev/null
+From fc5a9f0402167e00c92335cd3a449ec143d28c31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Mar 2020 00:24:44 +0900
+Subject: block: factor out requeue handling from dispatch code
+
+From: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+
+[ Upstream commit c92a41031a6d57395889b5c87cea359220a24d2a ]
+
+Factor out the requeue handling from the dispatch code, this will make
+subsequent addition of different requeueing schemes easier.
+
+Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq.c | 29 ++++++++++++++++++-----------
+ 1 file changed, 18 insertions(+), 11 deletions(-)
+
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index b748d1e63f9c8..c0efd3e278da6 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1205,6 +1205,23 @@ static void blk_mq_update_dispatch_busy(struct blk_mq_hw_ctx *hctx, bool busy)
+
+ #define BLK_MQ_RESOURCE_DELAY 3 /* ms units */
+
++static void blk_mq_handle_dev_resource(struct request *rq,
++ struct list_head *list)
++{
++ struct request *next =
++ list_first_entry_or_null(list, struct request, queuelist);
++
++ /*
++ * If an I/O scheduler has been configured and we got a driver tag for
++ * the next request already, free it.
++ */
++ if (next)
++ blk_mq_put_driver_tag(next);
++
++ list_add(&rq->queuelist, list);
++ __blk_mq_requeue_request(rq);
++}
++
+ /*
+ * Returns true if we did some work AND can potentially do more.
+ */
+@@ -1274,17 +1291,7 @@ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list,
+
+ ret = q->mq_ops->queue_rq(hctx, &bd);
+ if (ret == BLK_STS_RESOURCE || ret == BLK_STS_DEV_RESOURCE) {
+- /*
+- * If an I/O scheduler has been configured and we got a
+- * driver tag for the next request already, free it
+- * again.
+- */
+- if (!list_empty(list)) {
+- nxt = list_first_entry(list, struct request, queuelist);
+- blk_mq_put_driver_tag(nxt);
+- }
+- list_add(&rq->queuelist, list);
+- __blk_mq_requeue_request(rq);
++ blk_mq_handle_dev_resource(rq, list);
+ break;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 53352fcb346ff1f3327adc7ca695b2105b20bada Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Oct 2019 23:05:43 +0900
+Subject: block: Simplify REQ_OP_ZONE_RESET_ALL handling
+
+From: Damien Le Moal <damien.lemoal@wdc.com>
+
+[ Upstream commit c7a1d926dc4076aadad187614500afcd8de78818 ]
+
+There is no need for the function __blkdev_reset_all_zones() as
+REQ_OP_ZONE_RESET_ALL can be handled directly in blkdev_reset_zones()
+bio loop with an early break from the loop. This patch removes this
+function and modifies blkdev_reset_zones(), simplifying the code.
+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-zoned.c | 40 +++++++++++++---------------------------
+ 1 file changed, 13 insertions(+), 27 deletions(-)
+
+diff --git a/block/blk-zoned.c b/block/blk-zoned.c
+index 4bc5f260248a6..b17c094cb977c 100644
+--- a/block/blk-zoned.c
++++ b/block/blk-zoned.c
+@@ -202,32 +202,14 @@ int blkdev_report_zones(struct block_device *bdev, sector_t sector,
+ }
+ EXPORT_SYMBOL_GPL(blkdev_report_zones);
+
+-/*
+- * Special case of zone reset operation to reset all zones in one command,
+- * useful for applications like mkfs.
+- */
+-static int __blkdev_reset_all_zones(struct block_device *bdev, gfp_t gfp_mask)
+-{
+- struct bio *bio = bio_alloc(gfp_mask, 0);
+- int ret;
+-
+- /* across the zones operations, don't need any sectors */
+- bio_set_dev(bio, bdev);
+- bio_set_op_attrs(bio, REQ_OP_ZONE_RESET_ALL, 0);
+-
+- ret = submit_bio_wait(bio);
+- bio_put(bio);
+-
+- return ret;
+-}
+-
+ static inline bool blkdev_allow_reset_all_zones(struct block_device *bdev,
++ sector_t sector,
+ sector_t nr_sectors)
+ {
+ if (!blk_queue_zone_resetall(bdev_get_queue(bdev)))
+ return false;
+
+- if (nr_sectors != part_nr_sects_read(bdev->bd_part))
++ if (sector || nr_sectors != part_nr_sects_read(bdev->bd_part))
+ return false;
+ /*
+ * REQ_OP_ZONE_RESET_ALL can be executed only if the block device is
+@@ -271,9 +253,6 @@ int blkdev_reset_zones(struct block_device *bdev,
+ /* Out of range */
+ return -EINVAL;
+
+- if (blkdev_allow_reset_all_zones(bdev, nr_sectors))
+- return __blkdev_reset_all_zones(bdev, gfp_mask);
+-
+ /* Check alignment (handle eventual smaller last zone) */
+ zone_sectors = blk_queue_zone_sectors(q);
+ if (sector & (zone_sectors - 1))
+@@ -285,17 +264,24 @@ int blkdev_reset_zones(struct block_device *bdev,
+
+ blk_start_plug(&plug);
+ while (sector < end_sector) {
+-
+ bio = blk_next_bio(bio, 0, gfp_mask);
+- bio->bi_iter.bi_sector = sector;
+ bio_set_dev(bio, bdev);
+- bio_set_op_attrs(bio, REQ_OP_ZONE_RESET, 0);
+
++ /*
++ * Special case for the zone reset operation that reset all
++ * zones, this is useful for applications like mkfs.
++ */
++ if (blkdev_allow_reset_all_zones(bdev, sector, nr_sectors)) {
++ bio->bi_opf = REQ_OP_ZONE_RESET_ALL;
++ break;
++ }
++
++ bio->bi_opf = REQ_OP_ZONE_RESET;
++ bio->bi_iter.bi_sector = sector;
+ sector += zone_sectors;
+
+ /* This may take a while, so be nice to others */
+ cond_resched();
+-
+ }
+
+ ret = submit_bio_wait(bio);
+--
+2.27.0
+
--- /dev/null
+From 5ca41e30b4e70a7ea7427e30080e74de73c619dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 14:35:06 +0100
+Subject: can: softing: softing_netdev_open(): fix error handling
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 4d1be581ec6b92a338bb7ed23e1381f45ddf336f ]
+
+If softing_netdev_open() fails, we should call close_candev() to avoid
+reference leak.
+
+Fixes: 03fd3cf5a179d ("can: add driver for Softing card")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Acked-by: Kurt Van Dijck <dev.kurt@vandijck-laurijssen.be>
+Link: https://lore.kernel.org/r/20201202151632.1343786-1-zhangqilong3@huawei.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Link: https://lore.kernel.org/r/20201204133508.742120-2-mkl@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/softing/softing_main.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/softing/softing_main.c b/drivers/net/can/softing/softing_main.c
+index 8242fb287cbbe..16e3f55efa311 100644
+--- a/drivers/net/can/softing/softing_main.c
++++ b/drivers/net/can/softing/softing_main.c
+@@ -382,8 +382,13 @@ static int softing_netdev_open(struct net_device *ndev)
+
+ /* check or determine and set bittime */
+ ret = open_candev(ndev);
+- if (!ret)
+- ret = softing_startstop(ndev, 1);
++ if (ret)
++ return ret;
++
++ ret = softing_startstop(ndev, 1);
++ if (ret < 0)
++ close_candev(ndev);
++
+ return ret;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 08e4efac890ed579e6db876c944e4382b0a67789 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Nov 2020 09:57:43 +0100
+Subject: clk: renesas: r9a06g032: Drop __packed for portability
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit ceabbf94c317c6175dee6e91805fca4a6353745a ]
+
+The R9A06G032 clock driver uses an array of packed structures to reduce
+kernel size. However, this array contains pointers, which are no longer
+aligned naturally, and cannot be relocated on PPC64. Hence when
+compile-testing this driver on PPC64 with CONFIG_RELOCATABLE=y (e.g.
+PowerPC allyesconfig), the following warnings are produced:
+
+ WARNING: 136 bad relocations
+ c000000000616be3 R_PPC64_UADDR64 .rodata+0x00000000000cf338
+ c000000000616bfe R_PPC64_UADDR64 .rodata+0x00000000000cf370
+ ...
+
+Fix this by dropping the __packed attribute from the r9a06g032_clkdesc
+definition, trading a small size increase for portability.
+
+This increases the 156-entry clock table by 1 byte per entry, but due to
+the compiler generating more efficient code for unpacked accesses, the
+net size increase is only 76 bytes (gcc 9.3.0 on arm32).
+
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Fixes: 4c3d88526eba2143 ("clk: renesas: Renesas R9A06G032 clock driver")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20201130085743.1656317-1-geert+renesas@glider.be
+Tested-by: Stephen Rothwell <sfr@canb.auug.org.au> # PowerPC allyesconfig build
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/r9a06g032-clocks.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/renesas/r9a06g032-clocks.c b/drivers/clk/renesas/r9a06g032-clocks.c
+index 1907ee195a08c..f2dc625b745da 100644
+--- a/drivers/clk/renesas/r9a06g032-clocks.c
++++ b/drivers/clk/renesas/r9a06g032-clocks.c
+@@ -55,7 +55,7 @@ struct r9a06g032_clkdesc {
+ u16 sel, g1, r1, g2, r2;
+ } dual;
+ };
+-} __packed;
++};
+
+ #define I_GATE(_clk, _rst, _rdy, _midle, _scon, _mirack, _mistat) \
+ { .gate = _clk, .reset = _rst, \
+--
+2.27.0
+
--- /dev/null
+From ebbedab683460cfd78c3cd447a5a0072ba444cf5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Nov 2020 15:19:10 +0100
+Subject: dm table: Remove BUG_ON(in_interrupt())
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit e7b624183d921b49ef0a96329f21647d38865ee9 ]
+
+The BUG_ON(in_interrupt()) in dm_table_event() is a historic leftover from
+a rework of the dm table code which changed the calling context.
+
+Issuing a BUG for a wrong calling context is frowned upon and
+in_interrupt() is deprecated and only covering parts of the wrong
+contexts. The sanity check for the context is covered by
+CONFIG_DEBUG_ATOMIC_SLEEP and other debug facilities already.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-table.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
+index 13ad791126618..6dd56afa048c2 100644
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -1320,12 +1320,6 @@ void dm_table_event_callback(struct dm_table *t,
+
+ void dm_table_event(struct dm_table *t)
+ {
+- /*
+- * You can no longer call dm_table_event() from interrupt
+- * context, use a bottom half instead.
+- */
+- BUG_ON(in_interrupt());
+-
+ mutex_lock(&_event_lock);
+ if (t->event_fn)
+ t->event_fn(t->event_context);
+--
+2.27.0
+
--- /dev/null
+From f3758db7a74e25f7f582a3a236b32bd9816187fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Nov 2020 15:35:52 +0800
+Subject: drm/amd/display: Init clock value by current vbios CLKs
+
+From: Brandon Syu <Brandon.Syu@amd.com>
+
+[ Upstream commit 7e0b367db85ef7b91399006253759a024eab7653 ]
+
+[Why]
+While booting into OS, driver updates DPP/DISP CLKs.
+But init clock value is zero which is invalid.
+
+[How]
+Get current clocks value to update init clocks.
+To avoid underflow.
+
+Signed-off-by: Brandon Syu <Brandon.Syu@amd.com>
+Reviewed-by: Tony Cheng <Tony.Cheng@amd.com>
+Acked-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c
+index dd92f9c295b45..9f301f8575a54 100644
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c
+@@ -97,8 +97,17 @@ void rn_update_clocks(struct clk_mgr *clk_mgr_base,
+ new_clocks->dppclk_khz = 100000;
+ }
+
+- if (should_set_clock(safe_to_lower, new_clocks->dppclk_khz, clk_mgr->base.clks.dppclk_khz)) {
+- if (clk_mgr->base.clks.dppclk_khz > new_clocks->dppclk_khz)
++ /*
++ * Temporally ignore thew 0 cases for disp and dpp clks.
++ * We may have a new feature that requires 0 clks in the future.
++ */
++ if (new_clocks->dppclk_khz == 0 || new_clocks->dispclk_khz == 0) {
++ new_clocks->dppclk_khz = clk_mgr_base->clks.dppclk_khz;
++ new_clocks->dispclk_khz = clk_mgr_base->clks.dispclk_khz;
++ }
++
++ if (should_set_clock(safe_to_lower, new_clocks->dppclk_khz, clk_mgr_base->clks.dppclk_khz)) {
++ if (clk_mgr_base->clks.dppclk_khz > new_clocks->dppclk_khz)
+ dpp_clock_lowered = true;
+ clk_mgr_base->clks.dppclk_khz = new_clocks->dppclk_khz;
+ update_dppclk = true;
+--
+2.27.0
+
--- /dev/null
+From abdcffdae2a1cd443a507187798131c95e1fc0e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Nov 2020 23:29:28 +0530
+Subject: drm/tegra: replace idr_init() by idr_init_base()
+
+From: Deepak R Varma <mh12gx2825@gmail.com>
+
+[ Upstream commit 41f71629b4c432f8dd47d70ace813be5f79d4d75 ]
+
+idr_init() uses base 0 which is an invalid identifier for this driver.
+The new function idr_init_base allows IDR to set the ID lookup from
+base 1. This avoids all lookups that otherwise starts from 0 since
+0 is always unused.
+
+References: commit 6ce711f27500 ("idr: Make 1-based IDRs more efficient")
+
+Signed-off-by: Deepak R Varma <mh12gx2825@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/drm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
+index bc7cc32140f81..6833dfad7241b 100644
+--- a/drivers/gpu/drm/tegra/drm.c
++++ b/drivers/gpu/drm/tegra/drm.c
+@@ -256,7 +256,7 @@ static int tegra_drm_open(struct drm_device *drm, struct drm_file *filp)
+ if (!fpriv)
+ return -ENOMEM;
+
+- idr_init(&fpriv->contexts);
++ idr_init_base(&fpriv->contexts, 1);
+ mutex_init(&fpriv->lock);
+ filp->driver_priv = fpriv;
+
+--
+2.27.0
+
--- /dev/null
+From 105a9483b0ff87bcca4ff322554999673acd3829 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Oct 2020 09:34:24 +0800
+Subject: drm/tegra: sor: Disable clocks on error in tegra_sor_init()
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit bf3a3cdcad40e5928a22ea0fd200d17fd6d6308d ]
+
+Fix the missing clk_disable_unprepare() before return from
+tegra_sor_init() in the error handling case.
+
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/sor.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c
+index 75e65d9536d54..6c3d221652393 100644
+--- a/drivers/gpu/drm/tegra/sor.c
++++ b/drivers/gpu/drm/tegra/sor.c
+@@ -2899,6 +2899,7 @@ static int tegra_sor_init(struct host1x_client *client)
+ if (err < 0) {
+ dev_err(sor->dev, "failed to deassert SOR reset: %d\n",
+ err);
++ clk_disable_unprepare(sor->clk);
+ return err;
+ }
+
+@@ -2906,12 +2907,17 @@ static int tegra_sor_init(struct host1x_client *client)
+ }
+
+ err = clk_prepare_enable(sor->clk_safe);
+- if (err < 0)
++ if (err < 0) {
++ clk_disable_unprepare(sor->clk);
+ return err;
++ }
+
+ err = clk_prepare_enable(sor->clk_dp);
+- if (err < 0)
++ if (err < 0) {
++ clk_disable_unprepare(sor->clk_safe);
++ clk_disable_unprepare(sor->clk);
+ return err;
++ }
+
+ /*
+ * Enable and unmask the HDA codec SCRATCH0 register interrupt. This
+--
+2.27.0
+
--- /dev/null
+From f9c84771c8384660b92add15120aeef0f46188df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Dec 2020 13:51:06 +0800
+Subject: gpio: eic-sprd: break loop when getting NULL device resource
+
+From: Chunyan Zhang <chunyan.zhang@unisoc.com>
+
+[ Upstream commit 263ade7166a2e589c5b605272690c155c0637dcb ]
+
+EIC controller have unfixed numbers of banks on different Spreadtrum SoCs,
+and each bank has its own base address, the loop of getting there base
+address in driver should break if the resource gotten via
+platform_get_resource() is NULL already. The later ones would be all NULL
+even if the loop continues.
+
+Fixes: 25518e024e3a ("gpio: Add Spreadtrum EIC driver support")
+Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com>
+Link: https://lore.kernel.org/r/20201209055106.840100-1-zhang.lyra@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-eic-sprd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpio-eic-sprd.c b/drivers/gpio/gpio-eic-sprd.c
+index 8c97577740100..a69b3faf51ef0 100644
+--- a/drivers/gpio/gpio-eic-sprd.c
++++ b/drivers/gpio/gpio-eic-sprd.c
+@@ -598,7 +598,7 @@ static int sprd_eic_probe(struct platform_device *pdev)
+ */
+ res = platform_get_resource(pdev, IORESOURCE_MEM, i);
+ if (!res)
+- continue;
++ break;
+
+ sprd_eic->base[i] = devm_ioremap_resource(&pdev->dev, res);
+ if (IS_ERR(sprd_eic->base[i]))
+--
+2.27.0
+
--- /dev/null
+From fa0327e328f3ca0a5a23e7f9acc8855f3263844d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Dec 2020 09:15:32 +0200
+Subject: gpio: mvebu: fix potential user-after-free on probe
+
+From: Baruch Siach <baruch@tkos.co.il>
+
+[ Upstream commit 7ee1a01e47403f72b9f38839a737692f6991263e ]
+
+When mvebu_pwm_probe() fails IRQ domain is not released. Move pwm probe
+before IRQ domain allocation. Add pwm cleanup code to the failure path.
+
+Fixes: 757642f9a584 ("gpio: mvebu: Add limited PWM support")
+Reported-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Baruch Siach <baruch@tkos.co.il>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-mvebu.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
+index 6c06876943412..3985d6e1c17dc 100644
+--- a/drivers/gpio/gpio-mvebu.c
++++ b/drivers/gpio/gpio-mvebu.c
+@@ -1196,6 +1196,13 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
+
+ devm_gpiochip_add_data(&pdev->dev, &mvchip->chip, mvchip);
+
++ /* Some MVEBU SoCs have simple PWM support for GPIO lines */
++ if (IS_ENABLED(CONFIG_PWM)) {
++ err = mvebu_pwm_probe(pdev, mvchip, id);
++ if (err)
++ return err;
++ }
++
+ /* Some gpio controllers do not provide irq support */
+ if (!have_irqs)
+ return 0;
+@@ -1205,7 +1212,8 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
+ if (!mvchip->domain) {
+ dev_err(&pdev->dev, "couldn't allocate irq domain %s (DT).\n",
+ mvchip->chip.label);
+- return -ENODEV;
++ err = -ENODEV;
++ goto err_pwm;
+ }
+
+ err = irq_alloc_domain_generic_chips(
+@@ -1253,14 +1261,12 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
+ mvchip);
+ }
+
+- /* Some MVEBU SoCs have simple PWM support for GPIO lines */
+- if (IS_ENABLED(CONFIG_PWM))
+- return mvebu_pwm_probe(pdev, mvchip, id);
+-
+ return 0;
+
+ err_domain:
+ irq_domain_remove(mvchip->domain);
++err_pwm:
++ pwmchip_remove(&mvchip->mvpwm->chip);
+
+ return err;
+ }
+--
+2.27.0
+
--- /dev/null
+From 504d08b8e6fe32f6f7d8e9d2261105803f4baa58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Nov 2020 17:44:45 +0800
+Subject: gpio: zynq: fix reference leak in zynq_gpio functions
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit 7f57b295f990c0fa07f96d51ca1c82c52dbf79cc ]
+
+pm_runtime_get_sync will increment pm usage counter even it
+failed. Forgetting to putting operation will result in a
+reference leak here.
+
+A new function pm_runtime_resume_and_get is introduced in
+[0] to keep usage counter balanced. So We fix the reference
+leak by replacing it with new funtion.
+
+[0] dd8088d5a896 ("PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter")
+
+Fixes: c2df3de0d07e ("gpio: zynq: properly support runtime PM for GPIO used as interrupts")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-zynq.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpio-zynq.c b/drivers/gpio/gpio-zynq.c
+index 7835aad6d1628..88b04d8a7fa7d 100644
+--- a/drivers/gpio/gpio-zynq.c
++++ b/drivers/gpio/gpio-zynq.c
+@@ -556,7 +556,7 @@ static int zynq_gpio_irq_reqres(struct irq_data *d)
+ struct gpio_chip *chip = irq_data_get_irq_chip_data(d);
+ int ret;
+
+- ret = pm_runtime_get_sync(chip->parent);
++ ret = pm_runtime_resume_and_get(chip->parent);
+ if (ret < 0)
+ return ret;
+
+@@ -884,7 +884,7 @@ static int zynq_gpio_probe(struct platform_device *pdev)
+
+ pm_runtime_set_active(&pdev->dev);
+ pm_runtime_enable(&pdev->dev);
+- ret = pm_runtime_get_sync(&pdev->dev);
++ ret = pm_runtime_resume_and_get(&pdev->dev);
+ if (ret < 0)
+ goto err_pm_dis;
+
+--
+2.27.0
+
--- /dev/null
+From 82af2b66d1622c3c9b46ad47d01945c3512051dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Nov 2020 09:34:12 +0200
+Subject: habanalabs: put devices before driver removal
+
+From: Ofir Bitton <obitton@habana.ai>
+
+[ Upstream commit 5555b7c56bdec7a29c789fec27f84d40f52fbdfa ]
+
+Driver never puts its device and control_device objects, hence
+a memory leak is introduced every driver removal.
+
+Signed-off-by: Ofir Bitton <obitton@habana.ai>
+Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/habanalabs/device.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/misc/habanalabs/device.c b/drivers/misc/habanalabs/device.c
+index a7a4fed4d8995..3eeb1920ddb43 100644
+--- a/drivers/misc/habanalabs/device.c
++++ b/drivers/misc/habanalabs/device.c
+@@ -229,16 +229,16 @@ static int device_cdev_sysfs_add(struct hl_device *hdev)
+
+ static void device_cdev_sysfs_del(struct hl_device *hdev)
+ {
+- /* device_release() won't be called so must free devices explicitly */
+- if (!hdev->cdev_sysfs_created) {
+- kfree(hdev->dev_ctrl);
+- kfree(hdev->dev);
+- return;
+- }
++ if (!hdev->cdev_sysfs_created)
++ goto put_devices;
+
+ hl_sysfs_fini(hdev);
+ cdev_device_del(&hdev->cdev_ctrl, hdev->dev_ctrl);
+ cdev_device_del(&hdev->cdev, hdev->dev);
++
++put_devices:
++ put_device(hdev->dev);
++ put_device(hdev->dev_ctrl);
+ }
+
+ /*
+@@ -1285,9 +1285,9 @@ int hl_device_init(struct hl_device *hdev, struct class *hclass)
+ early_fini:
+ device_early_fini(hdev);
+ free_dev_ctrl:
+- kfree(hdev->dev_ctrl);
++ put_device(hdev->dev_ctrl);
+ free_dev:
+- kfree(hdev->dev);
++ put_device(hdev->dev);
+ out_disabled:
+ hdev->disabled = true;
+ if (add_cdev_sysfs_on_err)
+--
+2.27.0
+
--- /dev/null
+From f33f0607fe948a2ba47633119b6a89785b5663f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Aug 2020 19:27:34 +0200
+Subject: i40e: avoid premature Rx buffer reuse
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Björn Töpel <bjorn.topel@intel.com>
+
+[ Upstream commit 75aab4e10ae6a4593a60f66d13de755d4e91f400 ]
+
+The page recycle code, incorrectly, relied on that a page fragment
+could not be freed inside xdp_do_redirect(). This assumption leads to
+that page fragments that are used by the stack/XDP redirect can be
+reused and overwritten.
+
+To avoid this, store the page count prior invoking xdp_do_redirect().
+
+Longer explanation:
+
+Intel NICs have a recycle mechanism. The main idea is that a page is
+split into two parts. One part is owned by the driver, one part might
+be owned by someone else, such as the stack.
+
+t0: Page is allocated, and put on the Rx ring
+ +---------------
+used by NIC ->| upper buffer
+(rx_buffer) +---------------
+ | lower buffer
+ +---------------
+ page count == USHRT_MAX
+ rx_buffer->pagecnt_bias == USHRT_MAX
+
+t1: Buffer is received, and passed to the stack (e.g.)
+ +---------------
+ | upper buff (skb)
+ +---------------
+used by NIC ->| lower buffer
+(rx_buffer) +---------------
+ page count == USHRT_MAX
+ rx_buffer->pagecnt_bias == USHRT_MAX - 1
+
+t2: Buffer is received, and redirected
+ +---------------
+ | upper buff (skb)
+ +---------------
+used by NIC ->| lower buffer
+(rx_buffer) +---------------
+
+Now, prior calling xdp_do_redirect():
+ page count == USHRT_MAX
+ rx_buffer->pagecnt_bias == USHRT_MAX - 2
+
+This means that buffer *cannot* be flipped/reused, because the skb is
+still using it.
+
+The problem arises when xdp_do_redirect() actually frees the
+segment. Then we get:
+ page count == USHRT_MAX - 1
+ rx_buffer->pagecnt_bias == USHRT_MAX - 2
+
+From a recycle perspective, the buffer can be flipped and reused,
+which means that the skb data area is passed to the Rx HW ring!
+
+To work around this, the page count is stored prior calling
+xdp_do_redirect().
+
+Note that this is not optimal, since the NIC could actually reuse the
+"lower buffer" again. However, then we need to track whether
+XDP_REDIRECT consumed the buffer or not.
+
+Fixes: d9314c474d4f ("i40e: add support for XDP_REDIRECT")
+Reported-and-analyzed-by: Li RongQing <lirongqing@baidu.com>
+Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
+Tested-by: George Kuruvinakunnel <george.kuruvinakunnel@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_txrx.c | 27 +++++++++++++++------
+ 1 file changed, 20 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+index 89a3be41d6d83..f47841f3a69d5 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+@@ -1869,6 +1869,7 @@ static inline bool i40e_page_is_reusable(struct page *page)
+ * the adapter for another receive
+ *
+ * @rx_buffer: buffer containing the page
++ * @rx_buffer_pgcnt: buffer page refcount pre xdp_do_redirect() call
+ *
+ * If page is reusable, rx_buffer->page_offset is adjusted to point to
+ * an unused region in the page.
+@@ -1891,7 +1892,8 @@ static inline bool i40e_page_is_reusable(struct page *page)
+ *
+ * In either case, if the page is reusable its refcount is increased.
+ **/
+-static bool i40e_can_reuse_rx_page(struct i40e_rx_buffer *rx_buffer)
++static bool i40e_can_reuse_rx_page(struct i40e_rx_buffer *rx_buffer,
++ int rx_buffer_pgcnt)
+ {
+ unsigned int pagecnt_bias = rx_buffer->pagecnt_bias;
+ struct page *page = rx_buffer->page;
+@@ -1902,7 +1904,7 @@ static bool i40e_can_reuse_rx_page(struct i40e_rx_buffer *rx_buffer)
+
+ #if (PAGE_SIZE < 8192)
+ /* if we are only owner of page we can reuse it */
+- if (unlikely((page_count(page) - pagecnt_bias) > 1))
++ if (unlikely((rx_buffer_pgcnt - pagecnt_bias) > 1))
+ return false;
+ #else
+ #define I40E_LAST_OFFSET \
+@@ -1961,16 +1963,24 @@ static void i40e_add_rx_frag(struct i40e_ring *rx_ring,
+ * i40e_get_rx_buffer - Fetch Rx buffer and synchronize data for use
+ * @rx_ring: rx descriptor ring to transact packets on
+ * @size: size of buffer to add to skb
++ * @rx_buffer_pgcnt: buffer page refcount
+ *
+ * This function will pull an Rx buffer from the ring and synchronize it
+ * for use by the CPU.
+ */
+ static struct i40e_rx_buffer *i40e_get_rx_buffer(struct i40e_ring *rx_ring,
+- const unsigned int size)
++ const unsigned int size,
++ int *rx_buffer_pgcnt)
+ {
+ struct i40e_rx_buffer *rx_buffer;
+
+ rx_buffer = i40e_rx_bi(rx_ring, rx_ring->next_to_clean);
++ *rx_buffer_pgcnt =
++#if (PAGE_SIZE < 8192)
++ page_count(rx_buffer->page);
++#else
++ 0;
++#endif
+ prefetch_page_address(rx_buffer->page);
+
+ /* we are reusing so sync this buffer for CPU use */
+@@ -2125,14 +2135,16 @@ static struct sk_buff *i40e_build_skb(struct i40e_ring *rx_ring,
+ * i40e_put_rx_buffer - Clean up used buffer and either recycle or free
+ * @rx_ring: rx descriptor ring to transact packets on
+ * @rx_buffer: rx buffer to pull data from
++ * @rx_buffer_pgcnt: rx buffer page refcount pre xdp_do_redirect() call
+ *
+ * This function will clean up the contents of the rx_buffer. It will
+ * either recycle the buffer or unmap it and free the associated resources.
+ */
+ static void i40e_put_rx_buffer(struct i40e_ring *rx_ring,
+- struct i40e_rx_buffer *rx_buffer)
++ struct i40e_rx_buffer *rx_buffer,
++ int rx_buffer_pgcnt)
+ {
+- if (i40e_can_reuse_rx_page(rx_buffer)) {
++ if (i40e_can_reuse_rx_page(rx_buffer, rx_buffer_pgcnt)) {
+ /* hand second half of page back to the ring */
+ i40e_reuse_rx_page(rx_ring, rx_buffer);
+ } else {
+@@ -2345,6 +2357,7 @@ static int i40e_clean_rx_irq(struct i40e_ring *rx_ring, int budget)
+ while (likely(total_rx_packets < (unsigned int)budget)) {
+ struct i40e_rx_buffer *rx_buffer;
+ union i40e_rx_desc *rx_desc;
++ int rx_buffer_pgcnt;
+ unsigned int size;
+ u64 qword;
+
+@@ -2384,7 +2397,7 @@ static int i40e_clean_rx_irq(struct i40e_ring *rx_ring, int budget)
+ break;
+
+ i40e_trace(clean_rx_irq, rx_ring, rx_desc, skb);
+- rx_buffer = i40e_get_rx_buffer(rx_ring, size);
++ rx_buffer = i40e_get_rx_buffer(rx_ring, size, &rx_buffer_pgcnt);
+
+ /* retrieve a buffer from the ring */
+ if (!skb) {
+@@ -2424,7 +2437,7 @@ static int i40e_clean_rx_irq(struct i40e_ring *rx_ring, int budget)
+ break;
+ }
+
+- i40e_put_rx_buffer(rx_ring, rx_buffer);
++ i40e_put_rx_buffer(rx_ring, rx_buffer, rx_buffer_pgcnt);
+ cleaned_count++;
+
+ if (i40e_is_non_eop(rx_ring, rx_desc, skb))
+--
+2.27.0
+
--- /dev/null
+From 18dc097224f3129d6498c16cfa8c8a5e82940c62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Aug 2020 15:07:57 +0800
+Subject: i40e: optimise prefetch page refcount
+
+From: Li RongQing <lirongqing@baidu.com>
+
+[ Upstream commit 1fa5cef283420b3dad93cd6ab04d7125bc1562de ]
+
+refcount of rx_buffer page will be added here originally, so prefetchw
+is needed, but after commit 1793668c3b8c ("i40e/i40evf: Update code to
+better handle incrementing page count"), and refcount is not added
+every time, so change prefetchw as prefetch.
+
+Now it mainly services page_address(), but which accesses struct page
+only when WANT_PAGE_VIRTUAL or HASHED_PAGE_VIRTUAL is defined otherwise
+it returns address based on offset, so we prefetch it conditionally.
+
+Jakub suggested to define prefetch_page_address in a common header.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Suggested-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Li RongQing <lirongqing@baidu.com>
+Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Tested-by: Aaron Brown <aaron.f.brown@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_txrx.c | 2 +-
+ include/linux/prefetch.h | 8 ++++++++
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+index 7f7f02bc2b794..89a3be41d6d83 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+@@ -1971,7 +1971,7 @@ static struct i40e_rx_buffer *i40e_get_rx_buffer(struct i40e_ring *rx_ring,
+ struct i40e_rx_buffer *rx_buffer;
+
+ rx_buffer = i40e_rx_bi(rx_ring, rx_ring->next_to_clean);
+- prefetchw(rx_buffer->page);
++ prefetch_page_address(rx_buffer->page);
+
+ /* we are reusing so sync this buffer for CPU use */
+ dma_sync_single_range_for_cpu(rx_ring->dev,
+diff --git a/include/linux/prefetch.h b/include/linux/prefetch.h
+index 13eafebf3549a..b83a3f944f287 100644
+--- a/include/linux/prefetch.h
++++ b/include/linux/prefetch.h
+@@ -15,6 +15,7 @@
+ #include <asm/processor.h>
+ #include <asm/cache.h>
+
++struct page;
+ /*
+ prefetch(x) attempts to pre-emptively get the memory pointed to
+ by address "x" into the CPU L1 cache.
+@@ -62,4 +63,11 @@ static inline void prefetch_range(void *addr, size_t len)
+ #endif
+ }
+
++static inline void prefetch_page_address(struct page *page)
++{
++#if defined(WANT_PAGE_VIRTUAL) || defined(HASHED_PAGE_VIRTUAL)
++ prefetch(page);
++#endif
++}
++
+ #endif
+--
+2.27.0
+
--- /dev/null
+From 3f26aa271907b88ed2656ec294be2711e6bcd753 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 May 2020 21:20:54 +0200
+Subject: i40e: Refactor rx_bi accesses
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Björn Töpel <bjorn.topel@intel.com>
+
+[ Upstream commit e1675f97367bed74d4dcfe08de9ce9b5d6b288c1 ]
+
+As a first step to migrate i40e to the new MEM_TYPE_XSK_BUFF_POOL
+APIs, code that accesses the rx_bi (SW/shadow ring) is refactored to
+use an accessor function.
+
+Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Cc: intel-wired-lan@lists.osuosl.org
+Link: https://lore.kernel.org/bpf/20200520192103.355233-7-bjorn.topel@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_txrx.c | 17 +++++++++++------
+ drivers/net/ethernet/intel/i40e/i40e_xsk.c | 18 ++++++++++++------
+ 2 files changed, 23 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+index e3f29dc8b290a..7f7f02bc2b794 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+@@ -1195,6 +1195,11 @@ static void i40e_update_itr(struct i40e_q_vector *q_vector,
+ rc->total_packets = 0;
+ }
+
++static struct i40e_rx_buffer *i40e_rx_bi(struct i40e_ring *rx_ring, u32 idx)
++{
++ return &rx_ring->rx_bi[idx];
++}
++
+ /**
+ * i40e_reuse_rx_page - page flip buffer and store it back on the ring
+ * @rx_ring: rx descriptor ring to store buffers on
+@@ -1208,7 +1213,7 @@ static void i40e_reuse_rx_page(struct i40e_ring *rx_ring,
+ struct i40e_rx_buffer *new_buff;
+ u16 nta = rx_ring->next_to_alloc;
+
+- new_buff = &rx_ring->rx_bi[nta];
++ new_buff = i40e_rx_bi(rx_ring, nta);
+
+ /* update, and store next to alloc */
+ nta++;
+@@ -1272,7 +1277,7 @@ struct i40e_rx_buffer *i40e_clean_programming_status(
+ ntc = rx_ring->next_to_clean;
+
+ /* fetch, update, and store next to clean */
+- rx_buffer = &rx_ring->rx_bi[ntc++];
++ rx_buffer = i40e_rx_bi(rx_ring, ntc++);
+ ntc = (ntc < rx_ring->count) ? ntc : 0;
+ rx_ring->next_to_clean = ntc;
+
+@@ -1361,7 +1366,7 @@ void i40e_clean_rx_ring(struct i40e_ring *rx_ring)
+
+ /* Free all the Rx ring sk_buffs */
+ for (i = 0; i < rx_ring->count; i++) {
+- struct i40e_rx_buffer *rx_bi = &rx_ring->rx_bi[i];
++ struct i40e_rx_buffer *rx_bi = i40e_rx_bi(rx_ring, i);
+
+ if (!rx_bi->page)
+ continue;
+@@ -1576,7 +1581,7 @@ bool i40e_alloc_rx_buffers(struct i40e_ring *rx_ring, u16 cleaned_count)
+ return false;
+
+ rx_desc = I40E_RX_DESC(rx_ring, ntu);
+- bi = &rx_ring->rx_bi[ntu];
++ bi = i40e_rx_bi(rx_ring, ntu);
+
+ do {
+ if (!i40e_alloc_mapped_page(rx_ring, bi))
+@@ -1598,7 +1603,7 @@ bool i40e_alloc_rx_buffers(struct i40e_ring *rx_ring, u16 cleaned_count)
+ ntu++;
+ if (unlikely(ntu == rx_ring->count)) {
+ rx_desc = I40E_RX_DESC(rx_ring, 0);
+- bi = rx_ring->rx_bi;
++ bi = i40e_rx_bi(rx_ring, 0);
+ ntu = 0;
+ }
+
+@@ -1965,7 +1970,7 @@ static struct i40e_rx_buffer *i40e_get_rx_buffer(struct i40e_ring *rx_ring,
+ {
+ struct i40e_rx_buffer *rx_buffer;
+
+- rx_buffer = &rx_ring->rx_bi[rx_ring->next_to_clean];
++ rx_buffer = i40e_rx_bi(rx_ring, rx_ring->next_to_clean);
+ prefetchw(rx_buffer->page);
+
+ /* we are reusing so sync this buffer for CPU use */
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+index 3156de786d955..c9d4534fbdf02 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+@@ -9,6 +9,11 @@
+ #include "i40e_txrx_common.h"
+ #include "i40e_xsk.h"
+
++static struct i40e_rx_buffer *i40e_rx_bi(struct i40e_ring *rx_ring, u32 idx)
++{
++ return &rx_ring->rx_bi[idx];
++}
++
+ /**
+ * i40e_xsk_umem_dma_map - DMA maps all UMEM memory for the netdev
+ * @vsi: Current VSI
+@@ -321,7 +326,7 @@ __i40e_alloc_rx_buffers_zc(struct i40e_ring *rx_ring, u16 count,
+ bool ok = true;
+
+ rx_desc = I40E_RX_DESC(rx_ring, ntu);
+- bi = &rx_ring->rx_bi[ntu];
++ bi = i40e_rx_bi(rx_ring, ntu);
+ do {
+ if (!alloc(rx_ring, bi)) {
+ ok = false;
+@@ -340,7 +345,7 @@ __i40e_alloc_rx_buffers_zc(struct i40e_ring *rx_ring, u16 count,
+
+ if (unlikely(ntu == rx_ring->count)) {
+ rx_desc = I40E_RX_DESC(rx_ring, 0);
+- bi = rx_ring->rx_bi;
++ bi = i40e_rx_bi(rx_ring, 0);
+ ntu = 0;
+ }
+
+@@ -402,7 +407,7 @@ static struct i40e_rx_buffer *i40e_get_rx_buffer_zc(struct i40e_ring *rx_ring,
+ {
+ struct i40e_rx_buffer *bi;
+
+- bi = &rx_ring->rx_bi[rx_ring->next_to_clean];
++ bi = i40e_rx_bi(rx_ring, rx_ring->next_to_clean);
+
+ /* we are reusing so sync this buffer for CPU use */
+ dma_sync_single_range_for_cpu(rx_ring->dev,
+@@ -424,7 +429,8 @@ static struct i40e_rx_buffer *i40e_get_rx_buffer_zc(struct i40e_ring *rx_ring,
+ static void i40e_reuse_rx_buffer_zc(struct i40e_ring *rx_ring,
+ struct i40e_rx_buffer *old_bi)
+ {
+- struct i40e_rx_buffer *new_bi = &rx_ring->rx_bi[rx_ring->next_to_alloc];
++ struct i40e_rx_buffer *new_bi = i40e_rx_bi(rx_ring,
++ rx_ring->next_to_alloc);
+ u16 nta = rx_ring->next_to_alloc;
+
+ /* update, and store next to alloc */
+@@ -456,7 +462,7 @@ void i40e_zca_free(struct zero_copy_allocator *alloc, unsigned long handle)
+ mask = rx_ring->xsk_umem->chunk_mask;
+
+ nta = rx_ring->next_to_alloc;
+- bi = &rx_ring->rx_bi[nta];
++ bi = i40e_rx_bi(rx_ring, nta);
+
+ nta++;
+ rx_ring->next_to_alloc = (nta < rx_ring->count) ? nta : 0;
+@@ -824,7 +830,7 @@ void i40e_xsk_clean_rx_ring(struct i40e_ring *rx_ring)
+ u16 i;
+
+ for (i = 0; i < rx_ring->count; i++) {
+- struct i40e_rx_buffer *rx_bi = &rx_ring->rx_bi[i];
++ struct i40e_rx_buffer *rx_bi = i40e_rx_bi(rx_ring, i);
+
+ if (!rx_bi->addr)
+ continue;
+--
+2.27.0
+
--- /dev/null
+From 37c39be49d908edf9305953a35b5860e0914d758 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Dec 2020 14:41:49 +0200
+Subject: iwlwifi: pcie: add one missing entry for AX210
+
+From: Luca Coelho <luciano.coelho@intel.com>
+
+[ Upstream commit 5febcdef30902fa870128b9789b873199f13aff1 ]
+
+The 0x0024 subsytem device ID was missing from the list, so some AX210
+devices were not recognized. Add it.
+
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/iwlwifi.20201202143859.308eab4db42c.I3763196cd3f7bb36f3dcabf02ec4e7c4fe859c0f@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+index b0b7eca1754ed..f34297fd453c0 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+@@ -968,6 +968,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
+
+ {IWL_PCI_DEVICE(0x2725, 0x0090, iwlax211_2ax_cfg_so_gf_a0)},
+ {IWL_PCI_DEVICE(0x2725, 0x0020, iwlax210_2ax_cfg_ty_gf_a0)},
++ {IWL_PCI_DEVICE(0x2725, 0x0024, iwlax210_2ax_cfg_ty_gf_a0)},
+ {IWL_PCI_DEVICE(0x2725, 0x0310, iwlax210_2ax_cfg_ty_gf_a0)},
+ {IWL_PCI_DEVICE(0x2725, 0x0510, iwlax210_2ax_cfg_ty_gf_a0)},
+ {IWL_PCI_DEVICE(0x2725, 0x0A10, iwlax210_2ax_cfg_ty_gf_a0)},
+--
+2.27.0
+
--- /dev/null
+From 4c5acbb2547058f0d1074094e498c7e49b790c2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Aug 2020 19:27:35 +0200
+Subject: ixgbe: avoid premature Rx buffer reuse
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Björn Töpel <bjorn.topel@intel.com>
+
+[ Upstream commit a06316dc87bdc000f7f39a315476957af2ba0f05 ]
+
+The page recycle code, incorrectly, relied on that a page fragment
+could not be freed inside xdp_do_redirect(). This assumption leads to
+that page fragments that are used by the stack/XDP redirect can be
+reused and overwritten.
+
+To avoid this, store the page count prior invoking xdp_do_redirect().
+
+Fixes: 6453073987ba ("ixgbe: add initial support for xdp redirect")
+Reported-and-analyzed-by: Li RongQing <lirongqing@baidu.com>
+Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
+Tested-by: Sandeep Penigalapati <sandeep.penigalapati@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 24 +++++++++++++------
+ 1 file changed, 17 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index 5336bfcd2d701..f605540644035 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -1947,7 +1947,8 @@ static inline bool ixgbe_page_is_reserved(struct page *page)
+ return (page_to_nid(page) != numa_mem_id()) || page_is_pfmemalloc(page);
+ }
+
+-static bool ixgbe_can_reuse_rx_page(struct ixgbe_rx_buffer *rx_buffer)
++static bool ixgbe_can_reuse_rx_page(struct ixgbe_rx_buffer *rx_buffer,
++ int rx_buffer_pgcnt)
+ {
+ unsigned int pagecnt_bias = rx_buffer->pagecnt_bias;
+ struct page *page = rx_buffer->page;
+@@ -1958,7 +1959,7 @@ static bool ixgbe_can_reuse_rx_page(struct ixgbe_rx_buffer *rx_buffer)
+
+ #if (PAGE_SIZE < 8192)
+ /* if we are only owner of page we can reuse it */
+- if (unlikely((page_ref_count(page) - pagecnt_bias) > 1))
++ if (unlikely((rx_buffer_pgcnt - pagecnt_bias) > 1))
+ return false;
+ #else
+ /* The last offset is a bit aggressive in that we assume the
+@@ -2023,11 +2024,18 @@ static void ixgbe_add_rx_frag(struct ixgbe_ring *rx_ring,
+ static struct ixgbe_rx_buffer *ixgbe_get_rx_buffer(struct ixgbe_ring *rx_ring,
+ union ixgbe_adv_rx_desc *rx_desc,
+ struct sk_buff **skb,
+- const unsigned int size)
++ const unsigned int size,
++ int *rx_buffer_pgcnt)
+ {
+ struct ixgbe_rx_buffer *rx_buffer;
+
+ rx_buffer = &rx_ring->rx_buffer_info[rx_ring->next_to_clean];
++ *rx_buffer_pgcnt =
++#if (PAGE_SIZE < 8192)
++ page_count(rx_buffer->page);
++#else
++ 0;
++#endif
+ prefetchw(rx_buffer->page);
+ *skb = rx_buffer->skb;
+
+@@ -2057,9 +2065,10 @@ static struct ixgbe_rx_buffer *ixgbe_get_rx_buffer(struct ixgbe_ring *rx_ring,
+
+ static void ixgbe_put_rx_buffer(struct ixgbe_ring *rx_ring,
+ struct ixgbe_rx_buffer *rx_buffer,
+- struct sk_buff *skb)
++ struct sk_buff *skb,
++ int rx_buffer_pgcnt)
+ {
+- if (ixgbe_can_reuse_rx_page(rx_buffer)) {
++ if (ixgbe_can_reuse_rx_page(rx_buffer, rx_buffer_pgcnt)) {
+ /* hand second half of page back to the ring */
+ ixgbe_reuse_rx_page(rx_ring, rx_buffer);
+ } else {
+@@ -2295,6 +2304,7 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
+ union ixgbe_adv_rx_desc *rx_desc;
+ struct ixgbe_rx_buffer *rx_buffer;
+ struct sk_buff *skb;
++ int rx_buffer_pgcnt;
+ unsigned int size;
+
+ /* return some buffers to hardware, one at a time is too slow */
+@@ -2314,7 +2324,7 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
+ */
+ dma_rmb();
+
+- rx_buffer = ixgbe_get_rx_buffer(rx_ring, rx_desc, &skb, size);
++ rx_buffer = ixgbe_get_rx_buffer(rx_ring, rx_desc, &skb, size, &rx_buffer_pgcnt);
+
+ /* retrieve a buffer from the ring */
+ if (!skb) {
+@@ -2356,7 +2366,7 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
+ break;
+ }
+
+- ixgbe_put_rx_buffer(rx_ring, rx_buffer, skb);
++ ixgbe_put_rx_buffer(rx_ring, rx_buffer, skb, rx_buffer_pgcnt);
+ cleaned_count++;
+
+ /* place incomplete frames back on ring for completion */
+--
+2.27.0
+
--- /dev/null
+From c1633e35fd563809fe1534cc24e35015708b28ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 02:55:51 +0900
+Subject: kbuild: avoid split lines in .mod files
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 7d32358be8acb119dcfe39b6cf67ec6d94bf1fe7 ]
+
+"xargs echo" is not a safe way to remove line breaks because the input
+may exceed the command line limit and xargs may break it up into
+multiple invocations of echo. This should never happen because
+scripts/gen_autoksyms.sh expects all undefined symbols are placed in
+the second line of .mod files.
+
+One possible way is to replace "xargs echo" with
+"sed ':x;N;$!bx;s/\n/ /g'" or something, but I rewrote the code by
+using awk because it is more readable.
+
+This issue was reported by Sami Tolvanen; in his Clang LTO patch set,
+$(multi-used-m) is no longer an ELF object, but a thin archive that
+contains LLVM bitcode files. llvm-nm prints out symbols for each
+archive member separately, which results a lot of dupications, in some
+places, beyond the system-defined limit.
+
+This problem must be fixed irrespective of LTO, and we must ensure
+zero possibility of having this issue.
+
+Link: https://lkml.org/lkml/2020/12/1/1658
+Reported-by: Sami Tolvanen <samitolvanen@google.com>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/Makefile.build | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/scripts/Makefile.build b/scripts/Makefile.build
+index 24a33c01bbf7c..9c689d011bced 100644
+--- a/scripts/Makefile.build
++++ b/scripts/Makefile.build
+@@ -234,6 +234,9 @@ objtool_dep = $(objtool_obj) \
+ ifdef CONFIG_TRIM_UNUSED_KSYMS
+ cmd_gen_ksymdeps = \
+ $(CONFIG_SHELL) $(srctree)/scripts/gen_ksymdeps.sh $@ >> $(dot-target).cmd
++
++# List module undefined symbols
++undefined_syms = $(NM) $< | $(AWK) '$$1 == "U" { printf("%s%s", x++ ? " " : "", $$2) }';
+ endif
+
+ define rule_cc_o_c
+@@ -253,13 +256,6 @@ define rule_as_o_S
+ $(call cmd,modversions_S)
+ endef
+
+-# List module undefined symbols (or empty line if not enabled)
+-ifdef CONFIG_TRIM_UNUSED_KSYMS
+-cmd_undef_syms = $(NM) $< | sed -n 's/^ *U //p' | xargs echo
+-else
+-cmd_undef_syms = echo
+-endif
+-
+ # Built-in and composite module parts
+ $(obj)/%.o: $(src)/%.c $(recordmcount_source) $(objtool_dep) FORCE
+ $(call cmd,force_checksrc)
+@@ -267,7 +263,7 @@ $(obj)/%.o: $(src)/%.c $(recordmcount_source) $(objtool_dep) FORCE
+
+ cmd_mod = { \
+ echo $(if $($*-objs)$($*-y)$($*-m), $(addprefix $(obj)/, $($*-objs) $($*-y) $($*-m)), $(@:.mod=.o)); \
+- $(cmd_undef_syms); \
++ $(undefined_syms) echo; \
+ } > $@
+
+ $(obj)/%.mod: $(obj)/%.o FORCE
+--
+2.27.0
+
--- /dev/null
+From 8e174684a300bcae21bc0c50775d7b2ff5c38096 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Nov 2020 20:25:29 +1000
+Subject: kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm
+ handling
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit 8ff00399b153440c1c83e20c43020385b416415b ]
+
+powerpc/64s keeps a counter in the mm which counts bits set in
+mm_cpumask as well as other things. This means it can't use generic code
+to clear bits out of the mask and doesn't adjust the arch specific
+counter.
+
+Add an arch override that allows powerpc/64s to use
+clear_tasks_mm_cpumask().
+
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20201126102530.691335-4-npiggin@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/cpu.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index 7527825ac7daa..fa0e5727b4d9c 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -815,6 +815,10 @@ void __init cpuhp_threads_init(void)
+ }
+
+ #ifdef CONFIG_HOTPLUG_CPU
++#ifndef arch_clear_mm_cpumask_cpu
++#define arch_clear_mm_cpumask_cpu(cpu, mm) cpumask_clear_cpu(cpu, mm_cpumask(mm))
++#endif
++
+ /**
+ * clear_tasks_mm_cpumask - Safely clear tasks' mm_cpumask for a CPU
+ * @cpu: a CPU id
+@@ -850,7 +854,7 @@ void clear_tasks_mm_cpumask(int cpu)
+ t = find_lock_task_mm(p);
+ if (!t)
+ continue;
+- cpumask_clear_cpu(cpu, mm_cpumask(t->mm));
++ arch_clear_mm_cpumask_cpu(cpu, t->mm);
+ task_unlock(t);
+ }
+ rcu_read_unlock();
+--
+2.27.0
+
--- /dev/null
+From 520dc7f501956b55d60f9353ac4acc57bee85906 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Jun 2020 10:21:32 +0100
+Subject: net: mvpp2: add mvpp2_phylink_to_port() helper
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 6c2b49eb96716e91f202756bfbd3f5fea3b2b172 ]
+
+Add a helper to convert the struct phylink_config pointer passed in
+from phylink to the drivers internal struct mvpp2_port.
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/marvell/mvpp2/mvpp2_main.c | 29 +++++++++----------
+ 1 file changed, 14 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index 63c0334430134..931d1a56b79ca 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -4745,12 +4745,16 @@ static void mvpp2_port_copy_mac_addr(struct net_device *dev, struct mvpp2 *priv,
+ eth_hw_addr_random(dev);
+ }
+
++static struct mvpp2_port *mvpp2_phylink_to_port(struct phylink_config *config)
++{
++ return container_of(config, struct mvpp2_port, phylink_config);
++}
++
+ static void mvpp2_phylink_validate(struct phylink_config *config,
+ unsigned long *supported,
+ struct phylink_link_state *state)
+ {
+- struct mvpp2_port *port = container_of(config, struct mvpp2_port,
+- phylink_config);
++ struct mvpp2_port *port = mvpp2_phylink_to_port(config);
+ __ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, };
+
+ /* Invalid combinations */
+@@ -4877,8 +4881,7 @@ static void mvpp2_gmac_link_state(struct mvpp2_port *port,
+ static int mvpp2_phylink_mac_link_state(struct phylink_config *config,
+ struct phylink_link_state *state)
+ {
+- struct mvpp2_port *port = container_of(config, struct mvpp2_port,
+- phylink_config);
++ struct mvpp2_port *port = mvpp2_phylink_to_port(config);
+
+ if (port->priv->hw_version == MVPP22 && port->gop_id == 0) {
+ u32 mode = readl(port->base + MVPP22_XLG_CTRL3_REG);
+@@ -4896,8 +4899,7 @@ static int mvpp2_phylink_mac_link_state(struct phylink_config *config,
+
+ static void mvpp2_mac_an_restart(struct phylink_config *config)
+ {
+- struct mvpp2_port *port = container_of(config, struct mvpp2_port,
+- phylink_config);
++ struct mvpp2_port *port = mvpp2_phylink_to_port(config);
+ u32 val = readl(port->base + MVPP2_GMAC_AUTONEG_CONFIG);
+
+ writel(val | MVPP2_GMAC_IN_BAND_RESTART_AN,
+@@ -5085,13 +5087,12 @@ static void mvpp2_gmac_config(struct mvpp2_port *port, unsigned int mode,
+ static void mvpp2_mac_config(struct phylink_config *config, unsigned int mode,
+ const struct phylink_link_state *state)
+ {
+- struct net_device *dev = to_net_dev(config->dev);
+- struct mvpp2_port *port = netdev_priv(dev);
++ struct mvpp2_port *port = mvpp2_phylink_to_port(config);
+ bool change_interface = port->phy_interface != state->interface;
+
+ /* Check for invalid configuration */
+ if (mvpp2_is_xlg(state->interface) && port->gop_id != 0) {
+- netdev_err(dev, "Invalid mode on %s\n", dev->name);
++ netdev_err(port->dev, "Invalid mode on %s\n", port->dev->name);
+ return;
+ }
+
+@@ -5128,8 +5129,7 @@ static void mvpp2_mac_config(struct phylink_config *config, unsigned int mode,
+ static void mvpp2_mac_link_up(struct phylink_config *config, unsigned int mode,
+ phy_interface_t interface, struct phy_device *phy)
+ {
+- struct net_device *dev = to_net_dev(config->dev);
+- struct mvpp2_port *port = netdev_priv(dev);
++ struct mvpp2_port *port = mvpp2_phylink_to_port(config);
+ u32 val;
+
+ if (!phylink_autoneg_inband(mode)) {
+@@ -5150,14 +5150,13 @@ static void mvpp2_mac_link_up(struct phylink_config *config, unsigned int mode,
+
+ mvpp2_egress_enable(port);
+ mvpp2_ingress_enable(port);
+- netif_tx_wake_all_queues(dev);
++ netif_tx_wake_all_queues(port->dev);
+ }
+
+ static void mvpp2_mac_link_down(struct phylink_config *config,
+ unsigned int mode, phy_interface_t interface)
+ {
+- struct net_device *dev = to_net_dev(config->dev);
+- struct mvpp2_port *port = netdev_priv(dev);
++ struct mvpp2_port *port = mvpp2_phylink_to_port(config);
+ u32 val;
+
+ if (!phylink_autoneg_inband(mode)) {
+@@ -5174,7 +5173,7 @@ static void mvpp2_mac_link_down(struct phylink_config *config,
+ }
+ }
+
+- netif_tx_stop_all_queues(dev);
++ netif_tx_stop_all_queues(port->dev);
+ mvpp2_egress_disable(port);
+ mvpp2_ingress_disable(port);
+
+--
+2.27.0
+
--- /dev/null
+From cbbef329fb48624186823e410a505fbe0be9d9d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jul 2020 13:34:46 +0200
+Subject: netfilter: nft_compat: make sure xtables destructors have run
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit ffe8923f109b7ea92c0842c89e61300eefa11c94 ]
+
+Pablo Neira found that after recent update of xt_IDLETIMER the
+iptables-nft tests sometimes show an error.
+
+He tracked this down to the delayed cleanup used by nf_tables core:
+del rule (transaction A)
+add rule (transaction B)
+
+Its possible that by time transaction B (both in same netns) runs,
+the xt target destructor has not been invoked yet.
+
+For native nft expressions this is no problem because all expressions
+that have such side effects make sure these are handled from the commit
+phase, rather than async cleanup.
+
+For nft_compat however this isn't true.
+
+Instead of forcing synchronous behaviour for nft_compat, keep track
+of the number of outstanding destructor calls.
+
+When we attempt to create a new expression, flush the cleanup worker
+to make sure destructors have completed.
+
+With lots of help from Pablo Neira.
+
+Reported-by: Pablo Neira Ayso <pablo@netfilter.org>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/netfilter/nf_tables.h | 2 ++
+ net/netfilter/nf_tables_api.c | 10 +++++++--
+ net/netfilter/nft_compat.c | 36 +++++++++++++++++++++++++++----
+ 3 files changed, 42 insertions(+), 6 deletions(-)
+
+diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
+index a576bcbba2fcc..6a6fcd10d3185 100644
+--- a/include/net/netfilter/nf_tables.h
++++ b/include/net/netfilter/nf_tables.h
+@@ -1462,4 +1462,6 @@ void nft_chain_filter_fini(void);
+
+ void __init nft_chain_route_init(void);
+ void nft_chain_route_fini(void);
++
++void nf_tables_trans_destroy_flush_work(void);
+ #endif /* _NET_NF_TABLES_H */
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 459b7c0547115..7753d6f1467c9 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -6605,6 +6605,12 @@ static void nf_tables_trans_destroy_work(struct work_struct *w)
+ }
+ }
+
++void nf_tables_trans_destroy_flush_work(void)
++{
++ flush_work(&trans_destroy_work);
++}
++EXPORT_SYMBOL_GPL(nf_tables_trans_destroy_flush_work);
++
+ static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *chain)
+ {
+ struct nft_rule *rule;
+@@ -6776,9 +6782,9 @@ static void nf_tables_commit_release(struct net *net)
+ spin_unlock(&nf_tables_destroy_list_lock);
+
+ nf_tables_module_autoload_cleanup(net);
+- mutex_unlock(&net->nft.commit_mutex);
+-
+ schedule_work(&trans_destroy_work);
++
++ mutex_unlock(&net->nft.commit_mutex);
+ }
+
+ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
+diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
+index f9adca62ccb3d..0e3e0ff805812 100644
+--- a/net/netfilter/nft_compat.c
++++ b/net/netfilter/nft_compat.c
+@@ -27,6 +27,8 @@ struct nft_xt_match_priv {
+ void *info;
+ };
+
++static refcount_t nft_compat_pending_destroy = REFCOUNT_INIT(1);
++
+ static int nft_compat_chain_validate_dependency(const struct nft_ctx *ctx,
+ const char *tablename)
+ {
+@@ -236,6 +238,15 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
+
+ nft_target_set_tgchk_param(&par, ctx, target, info, &e, proto, inv);
+
++ /* xtables matches or targets can have side effects, e.g.
++ * creation/destruction of /proc files.
++ * The xt ->destroy functions are run asynchronously from
++ * work queue. If we have pending invocations we thus
++ * need to wait for those to finish.
++ */
++ if (refcount_read(&nft_compat_pending_destroy) > 1)
++ nf_tables_trans_destroy_flush_work();
++
+ ret = xt_check_target(&par, size, proto, inv);
+ if (ret < 0)
+ return ret;
+@@ -247,6 +258,13 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
+ return 0;
+ }
+
++static void __nft_mt_tg_destroy(struct module *me, const struct nft_expr *expr)
++{
++ refcount_dec(&nft_compat_pending_destroy);
++ module_put(me);
++ kfree(expr->ops);
++}
++
+ static void
+ nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
+ {
+@@ -262,8 +280,7 @@ nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
+ if (par.target->destroy != NULL)
+ par.target->destroy(&par);
+
+- module_put(me);
+- kfree(expr->ops);
++ __nft_mt_tg_destroy(me, expr);
+ }
+
+ static int nft_extension_dump_info(struct sk_buff *skb, int attr,
+@@ -494,8 +511,7 @@ __nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr,
+ if (par.match->destroy != NULL)
+ par.match->destroy(&par);
+
+- module_put(me);
+- kfree(expr->ops);
++ __nft_mt_tg_destroy(me, expr);
+ }
+
+ static void
+@@ -700,6 +716,14 @@ static const struct nfnetlink_subsystem nfnl_compat_subsys = {
+
+ static struct nft_expr_type nft_match_type;
+
++static void nft_mt_tg_deactivate(const struct nft_ctx *ctx,
++ const struct nft_expr *expr,
++ enum nft_trans_phase phase)
++{
++ if (phase == NFT_TRANS_COMMIT)
++ refcount_inc(&nft_compat_pending_destroy);
++}
++
+ static const struct nft_expr_ops *
+ nft_match_select_ops(const struct nft_ctx *ctx,
+ const struct nlattr * const tb[])
+@@ -738,6 +762,7 @@ nft_match_select_ops(const struct nft_ctx *ctx,
+ ops->type = &nft_match_type;
+ ops->eval = nft_match_eval;
+ ops->init = nft_match_init;
++ ops->deactivate = nft_mt_tg_deactivate,
+ ops->destroy = nft_match_destroy;
+ ops->dump = nft_match_dump;
+ ops->validate = nft_match_validate;
+@@ -828,6 +853,7 @@ nft_target_select_ops(const struct nft_ctx *ctx,
+ ops->size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize));
+ ops->init = nft_target_init;
+ ops->destroy = nft_target_destroy;
++ ops->deactivate = nft_mt_tg_deactivate,
+ ops->dump = nft_target_dump;
+ ops->validate = nft_target_validate;
+ ops->data = target;
+@@ -891,6 +917,8 @@ static void __exit nft_compat_module_exit(void)
+ nfnetlink_subsys_unregister(&nfnl_compat_subsys);
+ nft_unregister_expr(&nft_target_type);
+ nft_unregister_expr(&nft_match_type);
++
++ WARN_ON_ONCE(refcount_read(&nft_compat_pending_destroy) != 1);
+ }
+
+ MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFT_COMPAT);
+--
+2.27.0
+
--- /dev/null
+From faf24d131e62ad936fc4e34b43cbdcc850743d1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Dec 2020 16:39:24 -0500
+Subject: netfilter: nft_ct: Remove confirmation check for NFT_CT_ID
+
+From: Brett Mastbergen <brett.mastbergen@gmail.com>
+
+[ Upstream commit 2d94b20b95b009eec1a267dcf026b01af627c0cd ]
+
+Since commit 656c8e9cc1ba ("netfilter: conntrack: Use consistent ct id
+hash calculation") the ct id will not change from initialization to
+confirmation. Removing the confirmation check allows for things like
+adding an element to a 'typeof ct id' set in prerouting upon reception
+of the first packet of a new connection, and then being able to
+reference that set consistently both before and after the connection
+is confirmed.
+
+Fixes: 656c8e9cc1ba ("netfilter: conntrack: Use consistent ct id hash calculation")
+Signed-off-by: Brett Mastbergen <brett.mastbergen@gmail.com>
+Acked-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_ct.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
+index 46ca8bcca1bd5..2042c6f4629cc 100644
+--- a/net/netfilter/nft_ct.c
++++ b/net/netfilter/nft_ct.c
+@@ -177,8 +177,6 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
+ }
+ #endif
+ case NFT_CT_ID:
+- if (!nf_ct_is_confirmed(ct))
+- goto err;
+ *dest = nf_ct_get_id(ct);
+ return;
+ default:
+--
+2.27.0
+
--- /dev/null
+From 337e1a3853cbe0718689ddb1d9275db7d8f616ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Dec 2020 18:25:53 +0100
+Subject: netfilter: nft_dynset: fix timeouts later than 23 days
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 917d80d376ffbaa9725fde9e3c0282f63643f278 ]
+
+Use nf_msecs_to_jiffies64 and nf_jiffies64_to_msecs as provided by
+8e1102d5a159 ("netfilter: nf_tables: support timeouts larger than 23
+days"), otherwise ruleset listing breaks.
+
+Fixes: a8b1e36d0d1d ("netfilter: nft_dynset: fix element timeout for HZ != 1000")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/netfilter/nf_tables.h | 4 ++++
+ net/netfilter/nf_tables_api.c | 4 ++--
+ net/netfilter/nft_dynset.c | 8 +++++---
+ 3 files changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
+index 6a6fcd10d3185..f694f08ad635b 100644
+--- a/include/net/netfilter/nf_tables.h
++++ b/include/net/netfilter/nf_tables.h
+@@ -1464,4 +1464,8 @@ void __init nft_chain_route_init(void);
+ void nft_chain_route_fini(void);
+
+ void nf_tables_trans_destroy_flush_work(void);
++
++int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result);
++__be64 nf_jiffies64_to_msecs(u64 input);
++
+ #endif /* _NET_NF_TABLES_H */
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 7753d6f1467c9..40216c2a7dd72 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -3277,7 +3277,7 @@ static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
+ return 0;
+ }
+
+-static int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)
++int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)
+ {
+ u64 ms = be64_to_cpu(nla_get_be64(nla));
+ u64 max = (u64)(~((u64)0));
+@@ -3291,7 +3291,7 @@ static int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)
+ return 0;
+ }
+
+-static __be64 nf_jiffies64_to_msecs(u64 input)
++__be64 nf_jiffies64_to_msecs(u64 input)
+ {
+ return cpu_to_be64(jiffies64_to_msecs(input));
+ }
+diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
+index 8887295414dcb..217fd1bdc55e7 100644
+--- a/net/netfilter/nft_dynset.c
++++ b/net/netfilter/nft_dynset.c
+@@ -180,8 +180,10 @@ static int nft_dynset_init(const struct nft_ctx *ctx,
+ if (tb[NFTA_DYNSET_TIMEOUT] != NULL) {
+ if (!(set->flags & NFT_SET_TIMEOUT))
+ return -EINVAL;
+- timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
+- tb[NFTA_DYNSET_TIMEOUT])));
++
++ err = nf_msecs_to_jiffies64(tb[NFTA_DYNSET_TIMEOUT], &timeout);
++ if (err)
++ return err;
+ }
+
+ priv->sreg_key = nft_parse_register(tb[NFTA_DYNSET_SREG_KEY]);
+@@ -296,7 +298,7 @@ static int nft_dynset_dump(struct sk_buff *skb, const struct nft_expr *expr)
+ if (nla_put_string(skb, NFTA_DYNSET_SET_NAME, priv->set->name))
+ goto nla_put_failure;
+ if (nla_put_be64(skb, NFTA_DYNSET_TIMEOUT,
+- cpu_to_be64(jiffies_to_msecs(priv->timeout)),
++ nf_jiffies64_to_msecs(priv->timeout),
+ NFTA_DYNSET_PAD))
+ goto nla_put_failure;
+ if (priv->expr && nft_expr_dump(skb, NFTA_DYNSET_EXPR, priv->expr))
+--
+2.27.0
+
--- /dev/null
+From 12d075a522a2cdbfa03eed1a5c4b758c781f1e7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 11:27:22 -0700
+Subject: netfilter: x_tables: Switch synchronization to RCU
+
+From: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
+
+[ Upstream commit cc00bcaa589914096edef7fb87ca5cee4a166b5c ]
+
+When running concurrent iptables rules replacement with data, the per CPU
+sequence count is checked after the assignment of the new information.
+The sequence count is used to synchronize with the packet path without the
+use of any explicit locking. If there are any packets in the packet path using
+the table information, the sequence count is incremented to an odd value and
+is incremented to an even after the packet process completion.
+
+The new table value assignment is followed by a write memory barrier so every
+CPU should see the latest value. If the packet path has started with the old
+table information, the sequence counter will be odd and the iptables
+replacement will wait till the sequence count is even prior to freeing the
+old table info.
+
+However, this assumes that the new table information assignment and the memory
+barrier is actually executed prior to the counter check in the replacement
+thread. If CPU decides to execute the assignment later as there is no user of
+the table information prior to the sequence check, the packet path in another
+CPU may use the old table information. The replacement thread would then free
+the table information under it leading to a use after free in the packet
+processing context-
+
+Unable to handle kernel NULL pointer dereference at virtual
+address 000000000000008e
+pc : ip6t_do_table+0x5d0/0x89c
+lr : ip6t_do_table+0x5b8/0x89c
+ip6t_do_table+0x5d0/0x89c
+ip6table_filter_hook+0x24/0x30
+nf_hook_slow+0x84/0x120
+ip6_input+0x74/0xe0
+ip6_rcv_finish+0x7c/0x128
+ipv6_rcv+0xac/0xe4
+__netif_receive_skb+0x84/0x17c
+process_backlog+0x15c/0x1b8
+napi_poll+0x88/0x284
+net_rx_action+0xbc/0x23c
+__do_softirq+0x20c/0x48c
+
+This could be fixed by forcing instruction order after the new table
+information assignment or by switching to RCU for the synchronization.
+
+Fixes: 80055dab5de0 ("netfilter: x_tables: make xt_replace_table wait until old rules are not used anymore")
+Reported-by: Sean Tranchetti <stranche@codeaurora.org>
+Reported-by: kernel test robot <lkp@intel.com>
+Suggested-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netfilter/x_tables.h | 5 ++-
+ net/ipv4/netfilter/arp_tables.c | 14 ++++-----
+ net/ipv4/netfilter/ip_tables.c | 14 ++++-----
+ net/ipv6/netfilter/ip6_tables.c | 14 ++++-----
+ net/netfilter/x_tables.c | 49 +++++++++---------------------
+ 5 files changed, 40 insertions(+), 56 deletions(-)
+
+diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
+index 1b261c51b3a3a..f5c21b7d29748 100644
+--- a/include/linux/netfilter/x_tables.h
++++ b/include/linux/netfilter/x_tables.h
+@@ -227,7 +227,7 @@ struct xt_table {
+ unsigned int valid_hooks;
+
+ /* Man behind the curtain... */
+- struct xt_table_info *private;
++ struct xt_table_info __rcu *private;
+
+ /* Set this to THIS_MODULE if you are a module, otherwise NULL */
+ struct module *me;
+@@ -448,6 +448,9 @@ xt_get_per_cpu_counter(struct xt_counters *cnt, unsigned int cpu)
+
+ struct nf_hook_ops *xt_hook_ops_alloc(const struct xt_table *, nf_hookfn *);
+
++struct xt_table_info
++*xt_table_get_private_protected(const struct xt_table *table);
++
+ #ifdef CONFIG_COMPAT
+ #include <net/compat.h>
+
+diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
+index f1f78a742b36a..8a6a4384e7916 100644
+--- a/net/ipv4/netfilter/arp_tables.c
++++ b/net/ipv4/netfilter/arp_tables.c
+@@ -203,7 +203,7 @@ unsigned int arpt_do_table(struct sk_buff *skb,
+
+ local_bh_disable();
+ addend = xt_write_recseq_begin();
+- private = READ_ONCE(table->private); /* Address dependency. */
++ private = rcu_access_pointer(table->private);
+ cpu = smp_processor_id();
+ table_base = private->entries;
+ jumpstack = (struct arpt_entry **)private->jumpstack[cpu];
+@@ -649,7 +649,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table)
+ {
+ unsigned int countersize;
+ struct xt_counters *counters;
+- const struct xt_table_info *private = table->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(table);
+
+ /* We need atomic snapshot of counters: rest doesn't change
+ * (other than comefrom, which userspace doesn't care
+@@ -673,7 +673,7 @@ static int copy_entries_to_user(unsigned int total_size,
+ unsigned int off, num;
+ const struct arpt_entry *e;
+ struct xt_counters *counters;
+- struct xt_table_info *private = table->private;
++ struct xt_table_info *private = xt_table_get_private_protected(table);
+ int ret = 0;
+ void *loc_cpu_entry;
+
+@@ -808,7 +808,7 @@ static int get_info(struct net *net, void __user *user,
+ t = xt_request_find_table_lock(net, NFPROTO_ARP, name);
+ if (!IS_ERR(t)) {
+ struct arpt_getinfo info;
+- const struct xt_table_info *private = t->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(t);
+ #ifdef CONFIG_COMPAT
+ struct xt_table_info tmp;
+
+@@ -861,7 +861,7 @@ static int get_entries(struct net *net, struct arpt_get_entries __user *uptr,
+
+ t = xt_find_table_lock(net, NFPROTO_ARP, get.name);
+ if (!IS_ERR(t)) {
+- const struct xt_table_info *private = t->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(t);
+
+ if (get.size == private->size)
+ ret = copy_entries_to_user(private->size,
+@@ -1020,7 +1020,7 @@ static int do_add_counters(struct net *net, const void __user *user,
+ }
+
+ local_bh_disable();
+- private = t->private;
++ private = xt_table_get_private_protected(t);
+ if (private->number != tmp.num_counters) {
+ ret = -EINVAL;
+ goto unlock_up_free;
+@@ -1357,7 +1357,7 @@ static int compat_copy_entries_to_user(unsigned int total_size,
+ void __user *userptr)
+ {
+ struct xt_counters *counters;
+- const struct xt_table_info *private = table->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(table);
+ void __user *pos;
+ unsigned int size;
+ int ret = 0;
+diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
+index 10b91ebdf2131..4852769995440 100644
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -258,7 +258,7 @@ ipt_do_table(struct sk_buff *skb,
+ WARN_ON(!(table->valid_hooks & (1 << hook)));
+ local_bh_disable();
+ addend = xt_write_recseq_begin();
+- private = READ_ONCE(table->private); /* Address dependency. */
++ private = rcu_access_pointer(table->private);
+ cpu = smp_processor_id();
+ table_base = private->entries;
+ jumpstack = (struct ipt_entry **)private->jumpstack[cpu];
+@@ -791,7 +791,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table)
+ {
+ unsigned int countersize;
+ struct xt_counters *counters;
+- const struct xt_table_info *private = table->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(table);
+
+ /* We need atomic snapshot of counters: rest doesn't change
+ (other than comefrom, which userspace doesn't care
+@@ -815,7 +815,7 @@ copy_entries_to_user(unsigned int total_size,
+ unsigned int off, num;
+ const struct ipt_entry *e;
+ struct xt_counters *counters;
+- const struct xt_table_info *private = table->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(table);
+ int ret = 0;
+ const void *loc_cpu_entry;
+
+@@ -965,7 +965,7 @@ static int get_info(struct net *net, void __user *user,
+ t = xt_request_find_table_lock(net, AF_INET, name);
+ if (!IS_ERR(t)) {
+ struct ipt_getinfo info;
+- const struct xt_table_info *private = t->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(t);
+ #ifdef CONFIG_COMPAT
+ struct xt_table_info tmp;
+
+@@ -1019,7 +1019,7 @@ get_entries(struct net *net, struct ipt_get_entries __user *uptr,
+
+ t = xt_find_table_lock(net, AF_INET, get.name);
+ if (!IS_ERR(t)) {
+- const struct xt_table_info *private = t->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(t);
+ if (get.size == private->size)
+ ret = copy_entries_to_user(private->size,
+ t, uptr->entrytable);
+@@ -1175,7 +1175,7 @@ do_add_counters(struct net *net, const void __user *user,
+ }
+
+ local_bh_disable();
+- private = t->private;
++ private = xt_table_get_private_protected(t);
+ if (private->number != tmp.num_counters) {
+ ret = -EINVAL;
+ goto unlock_up_free;
+@@ -1570,7 +1570,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
+ void __user *userptr)
+ {
+ struct xt_counters *counters;
+- const struct xt_table_info *private = table->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(table);
+ void __user *pos;
+ unsigned int size;
+ int ret = 0;
+diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
+index c973ace208c51..12735ee7713a7 100644
+--- a/net/ipv6/netfilter/ip6_tables.c
++++ b/net/ipv6/netfilter/ip6_tables.c
+@@ -280,7 +280,7 @@ ip6t_do_table(struct sk_buff *skb,
+
+ local_bh_disable();
+ addend = xt_write_recseq_begin();
+- private = READ_ONCE(table->private); /* Address dependency. */
++ private = rcu_access_pointer(table->private);
+ cpu = smp_processor_id();
+ table_base = private->entries;
+ jumpstack = (struct ip6t_entry **)private->jumpstack[cpu];
+@@ -807,7 +807,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table)
+ {
+ unsigned int countersize;
+ struct xt_counters *counters;
+- const struct xt_table_info *private = table->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(table);
+
+ /* We need atomic snapshot of counters: rest doesn't change
+ (other than comefrom, which userspace doesn't care
+@@ -831,7 +831,7 @@ copy_entries_to_user(unsigned int total_size,
+ unsigned int off, num;
+ const struct ip6t_entry *e;
+ struct xt_counters *counters;
+- const struct xt_table_info *private = table->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(table);
+ int ret = 0;
+ const void *loc_cpu_entry;
+
+@@ -981,7 +981,7 @@ static int get_info(struct net *net, void __user *user,
+ t = xt_request_find_table_lock(net, AF_INET6, name);
+ if (!IS_ERR(t)) {
+ struct ip6t_getinfo info;
+- const struct xt_table_info *private = t->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(t);
+ #ifdef CONFIG_COMPAT
+ struct xt_table_info tmp;
+
+@@ -1036,7 +1036,7 @@ get_entries(struct net *net, struct ip6t_get_entries __user *uptr,
+
+ t = xt_find_table_lock(net, AF_INET6, get.name);
+ if (!IS_ERR(t)) {
+- struct xt_table_info *private = t->private;
++ struct xt_table_info *private = xt_table_get_private_protected(t);
+ if (get.size == private->size)
+ ret = copy_entries_to_user(private->size,
+ t, uptr->entrytable);
+@@ -1191,7 +1191,7 @@ do_add_counters(struct net *net, const void __user *user, unsigned int len,
+ }
+
+ local_bh_disable();
+- private = t->private;
++ private = xt_table_get_private_protected(t);
+ if (private->number != tmp.num_counters) {
+ ret = -EINVAL;
+ goto unlock_up_free;
+@@ -1579,7 +1579,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
+ void __user *userptr)
+ {
+ struct xt_counters *counters;
+- const struct xt_table_info *private = table->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(table);
+ void __user *pos;
+ unsigned int size;
+ int ret = 0;
+diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
+index 44f971f319920..d1ef2d7930739 100644
+--- a/net/netfilter/x_tables.c
++++ b/net/netfilter/x_tables.c
+@@ -1349,6 +1349,14 @@ struct xt_counters *xt_counters_alloc(unsigned int counters)
+ }
+ EXPORT_SYMBOL(xt_counters_alloc);
+
++struct xt_table_info
++*xt_table_get_private_protected(const struct xt_table *table)
++{
++ return rcu_dereference_protected(table->private,
++ mutex_is_locked(&xt[table->af].mutex));
++}
++EXPORT_SYMBOL(xt_table_get_private_protected);
++
+ struct xt_table_info *
+ xt_replace_table(struct xt_table *table,
+ unsigned int num_counters,
+@@ -1356,7 +1364,6 @@ xt_replace_table(struct xt_table *table,
+ int *error)
+ {
+ struct xt_table_info *private;
+- unsigned int cpu;
+ int ret;
+
+ ret = xt_jumpstack_alloc(newinfo);
+@@ -1366,47 +1373,20 @@ xt_replace_table(struct xt_table *table,
+ }
+
+ /* Do the substitution. */
+- local_bh_disable();
+- private = table->private;
++ private = xt_table_get_private_protected(table);
+
+ /* Check inside lock: is the old number correct? */
+ if (num_counters != private->number) {
+ pr_debug("num_counters != table->private->number (%u/%u)\n",
+ num_counters, private->number);
+- local_bh_enable();
+ *error = -EAGAIN;
+ return NULL;
+ }
+
+ newinfo->initial_entries = private->initial_entries;
+- /*
+- * Ensure contents of newinfo are visible before assigning to
+- * private.
+- */
+- smp_wmb();
+- table->private = newinfo;
+-
+- /* make sure all cpus see new ->private value */
+- smp_wmb();
+
+- /*
+- * Even though table entries have now been swapped, other CPU's
+- * may still be using the old entries...
+- */
+- local_bh_enable();
+-
+- /* ... so wait for even xt_recseq on all cpus */
+- for_each_possible_cpu(cpu) {
+- seqcount_t *s = &per_cpu(xt_recseq, cpu);
+- u32 seq = raw_read_seqcount(s);
+-
+- if (seq & 1) {
+- do {
+- cond_resched();
+- cpu_relax();
+- } while (seq == raw_read_seqcount(s));
+- }
+- }
++ rcu_assign_pointer(table->private, newinfo);
++ synchronize_rcu();
+
+ #ifdef CONFIG_AUDIT
+ if (audit_enabled) {
+@@ -1447,12 +1427,12 @@ struct xt_table *xt_register_table(struct net *net,
+ }
+
+ /* Simplifies replace_table code. */
+- table->private = bootstrap;
++ rcu_assign_pointer(table->private, bootstrap);
+
+ if (!xt_replace_table(table, 0, newinfo, &ret))
+ goto unlock;
+
+- private = table->private;
++ private = xt_table_get_private_protected(table);
+ pr_debug("table->private->number = %u\n", private->number);
+
+ /* save number of initial entries */
+@@ -1475,7 +1455,8 @@ void *xt_unregister_table(struct xt_table *table)
+ struct xt_table_info *private;
+
+ mutex_lock(&xt[table->af].mutex);
+- private = table->private;
++ private = xt_table_get_private_protected(table);
++ RCU_INIT_POINTER(table->private, NULL);
+ list_del(&table->list);
+ mutex_unlock(&xt[table->af].mutex);
+ kfree(table);
+--
+2.27.0
+
--- /dev/null
+From bbfeb6719975695b0873bfe29e8dd21a84a4d9b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Nov 2020 20:09:22 +0900
+Subject: perf/x86/intel: Check PEBS status correctly
+
+From: Stephane Eranian <eranian@google.com>
+
+[ Upstream commit fc17db8aa4c53cbd2d5469bb0521ea0f0a6dbb27 ]
+
+The kernel cannot disambiguate when 2+ PEBS counters overflow at the
+same time. This is what the comment for this code suggests. However,
+I see the comparison is done with the unfiltered p->status which is a
+copy of IA32_PERF_GLOBAL_STATUS at the time of the sample. This
+register contains more than the PEBS counter overflow bits. It also
+includes many other bits which could also be set.
+
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Stephane Eranian <eranian@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20201126110922.317681-2-namhyung@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/ds.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c
+index 1aaba2c8a9ba6..eb8bd0eeace7d 100644
+--- a/arch/x86/events/intel/ds.c
++++ b/arch/x86/events/intel/ds.c
+@@ -1912,7 +1912,7 @@ static void intel_pmu_drain_pebs_nhm(struct pt_regs *iregs)
+ * that caused the PEBS record. It's called collision.
+ * If collision happened, the record will be dropped.
+ */
+- if (p->status != (1ULL << bit)) {
++ if (pebs_status != (1ULL << bit)) {
+ for_each_set_bit(i, (unsigned long *)&pebs_status, size)
+ error[i]++;
+ continue;
+--
+2.27.0
+
--- /dev/null
+From 188d2d0dbb077744de63bf0c5b6d70dc69536985 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Nov 2020 17:03:37 +1030
+Subject: pinctrl: aspeed: Fix GPIO requests on pass-through banks
+
+From: Andrew Jeffery <andrew@aj.id.au>
+
+[ Upstream commit 7aeb353802611a8e655e019f09a370ff682af1a6 ]
+
+Commit 6726fbff19bf ("pinctrl: aspeed: Fix GPI only function problem.")
+fixes access to GPIO banks T and U on the AST2600. Both banks contain
+input-only pins and the GPIO pin function is named GPITx and GPIUx
+respectively. Unfortunately the fix had a negative impact on GPIO banks
+D and E for the AST2400 and AST2500 where the GPIO pass-through
+functions take similar "GPI"-style names. The net effect on the older
+SoCs was that when the GPIO subsystem requested a pin in banks D or E be
+muxed for GPIO, they were instead muxed for pass-through mode.
+Mistakenly muxing pass-through mode e.g. breaks booting the host on
+IBM's Witherspoon (AC922) platform where GPIOE0 is used for FSI.
+
+Further exploit the names in the provided expression structure to
+differentiate pass-through from pin-specific GPIO modes.
+
+This follow-up fix gives the expected behaviour for the following tests:
+
+Witherspoon BMC (AST2500):
+
+1. Power-on the Witherspoon host
+2. Request GPIOD1 be muxed via /sys/class/gpio/export
+3. Request GPIOE1 be muxed via /sys/class/gpio/export
+4. Request the balls for GPIOs E2 and E3 be muxed as GPIO pass-through
+ ("GPIE2" mode) via a pinctrl hog in the devicetree
+
+Rainier BMC (AST2600):
+
+5. Request GPIT0 be muxed via /sys/class/gpio/export
+6. Request GPIU0 be muxed via /sys/class/gpio/export
+
+Together the tests demonstrate that all three pieces of functionality
+(general GPIOs via 1, 2 and 3, input-only GPIOs via 5 and 6, pass-through
+mode via 4) operate as desired across old and new SoCs.
+
+Fixes: 9b92f5c51e9a ("pinctrl: aspeed: Fix GPI only function problem.")
+Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
+Tested-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Joel Stanley <joel@jms.id.au>
+Cc: Billy Tsai <billy_tsai@aspeedtech.com>
+Cc: Joel Stanley <joel@jms.id.au>
+Link: https://lore.kernel.org/r/20201126063337.489927-1-andrew@aj.id.au
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/aspeed/pinctrl-aspeed.c | 74 +++++++++++++++++++++++--
+ drivers/pinctrl/aspeed/pinmux-aspeed.h | 7 ++-
+ 2 files changed, 72 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/pinctrl/aspeed/pinctrl-aspeed.c b/drivers/pinctrl/aspeed/pinctrl-aspeed.c
+index 93b5654ff2828..22aca6d182c0c 100644
+--- a/drivers/pinctrl/aspeed/pinctrl-aspeed.c
++++ b/drivers/pinctrl/aspeed/pinctrl-aspeed.c
+@@ -277,14 +277,76 @@ int aspeed_pinmux_set_mux(struct pinctrl_dev *pctldev, unsigned int function,
+ static bool aspeed_expr_is_gpio(const struct aspeed_sig_expr *expr)
+ {
+ /*
+- * The signal type is GPIO if the signal name has "GPI" as a prefix.
+- * strncmp (rather than strcmp) is used to implement the prefix
+- * requirement.
++ * We need to differentiate between GPIO and non-GPIO signals to
++ * implement the gpio_request_enable() interface. For better or worse
++ * the ASPEED pinctrl driver uses the expression names to determine
++ * whether an expression will mux a pin for GPIO.
+ *
+- * expr->signal might look like "GPIOB1" in the GPIO case.
+- * expr->signal might look like "GPIT0" in the GPI case.
++ * Generally we have the following - A GPIO such as B1 has:
++ *
++ * - expr->signal set to "GPIOB1"
++ * - expr->function set to "GPIOB1"
++ *
++ * Using this fact we can determine whether the provided expression is
++ * a GPIO expression by testing the signal name for the string prefix
++ * "GPIO".
++ *
++ * However, some GPIOs are input-only, and the ASPEED datasheets name
++ * them differently. An input-only GPIO such as T0 has:
++ *
++ * - expr->signal set to "GPIT0"
++ * - expr->function set to "GPIT0"
++ *
++ * It's tempting to generalise the prefix test from "GPIO" to "GPI" to
++ * account for both GPIOs and GPIs, but in doing so we run aground on
++ * another feature:
++ *
++ * Some pins in the ASPEED BMC SoCs have a "pass-through" GPIO
++ * function where the input state of one pin is replicated as the
++ * output state of another (as if they were shorted together - a mux
++ * configuration that is typically enabled by hardware strapping).
++ * This feature allows the BMC to pass e.g. power button state through
++ * to the host while the BMC is yet to boot, but take control of the
++ * button state once the BMC has booted by muxing each pin as a
++ * separate, pin-specific GPIO.
++ *
++ * Conceptually this pass-through mode is a form of GPIO and is named
++ * as such in the datasheets, e.g. "GPID0". This naming similarity
++ * trips us up with the simple GPI-prefixed-signal-name scheme
++ * discussed above, as the pass-through configuration is not what we
++ * want when muxing a pin as GPIO for the GPIO subsystem.
++ *
++ * On e.g. the AST2400, a pass-through function "GPID0" is grouped on
++ * balls A18 and D16, where we have:
++ *
++ * For ball A18:
++ * - expr->signal set to "GPID0IN"
++ * - expr->function set to "GPID0"
++ *
++ * For ball D16:
++ * - expr->signal set to "GPID0OUT"
++ * - expr->function set to "GPID0"
++ *
++ * By contrast, the pin-specific GPIO expressions for the same pins are
++ * as follows:
++ *
++ * For ball A18:
++ * - expr->signal looks like "GPIOD0"
++ * - expr->function looks like "GPIOD0"
++ *
++ * For ball D16:
++ * - expr->signal looks like "GPIOD1"
++ * - expr->function looks like "GPIOD1"
++ *
++ * Testing both the signal _and_ function names gives us the means
++ * differentiate the pass-through GPIO pinmux configuration from the
++ * pin-specific configuration that the GPIO subsystem is after: An
++ * expression is a pin-specific (non-pass-through) GPIO configuration
++ * if the signal prefix is "GPI" and the signal name matches the
++ * function name.
+ */
+- return strncmp(expr->signal, "GPI", 3) == 0;
++ return !strncmp(expr->signal, "GPI", 3) &&
++ !strcmp(expr->signal, expr->function);
+ }
+
+ static bool aspeed_gpio_in_exprs(const struct aspeed_sig_expr **exprs)
+diff --git a/drivers/pinctrl/aspeed/pinmux-aspeed.h b/drivers/pinctrl/aspeed/pinmux-aspeed.h
+index 140c5ce9fbc11..0aaa20653536f 100644
+--- a/drivers/pinctrl/aspeed/pinmux-aspeed.h
++++ b/drivers/pinctrl/aspeed/pinmux-aspeed.h
+@@ -452,10 +452,11 @@ struct aspeed_sig_desc {
+ * evaluation of the descriptors.
+ *
+ * @signal: The signal name for the priority level on the pin. If the signal
+- * type is GPIO, then the signal name must begin with the string
+- * "GPIO", e.g. GPIOA0, GPIOT4 etc.
++ * type is GPIO, then the signal name must begin with the
++ * prefix "GPI", e.g. GPIOA0, GPIT0 etc.
+ * @function: The name of the function the signal participates in for the
+- * associated expression
++ * associated expression. For pin-specific GPIO, the function
++ * name must match the signal name.
+ * @ndescs: The number of signal descriptors in the expression
+ * @descs: Pointer to an array of signal descriptors that comprise the
+ * function expression
+--
+2.27.0
+
--- /dev/null
+From 6def410b848de9479c5648f44cf6e059125f2966 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Nov 2020 21:03:01 +0200
+Subject: pinctrl: baytrail: Avoid clearing debounce value when turning it off
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 0b74e40a4e41f3cbad76dff4c50850d47b525b26 ]
+
+Baytrail pin control has a common register to set up debounce timeout.
+When a pin configuration requested debounce to be disabled, the rest
+of the pins may still want to have debounce enabled and thus rely on
+the common timeout value. Avoid clearing debounce value when turning
+it off for one pin while others may still use it.
+
+Fixes: 658b476c742f ("pinctrl: baytrail: Add debounce configuration")
+Depends-on: 04ff5a095d66 ("pinctrl: baytrail: Rectify debounce support")
+Depends-on: 827e1579e1d5 ("pinctrl: baytrail: Rectify debounce support (part 2)")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/intel/pinctrl-baytrail.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
+index 5a1174a8e2bac..d05f20ca90d7e 100644
+--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
++++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
+@@ -1060,7 +1060,6 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev,
+ break;
+ case PIN_CONFIG_INPUT_DEBOUNCE:
+ debounce = readl(db_reg);
+- debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
+
+ if (arg)
+ conf |= BYT_DEBOUNCE_EN;
+@@ -1069,24 +1068,31 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev,
+
+ switch (arg) {
+ case 375:
++ debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
+ debounce |= BYT_DEBOUNCE_PULSE_375US;
+ break;
+ case 750:
++ debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
+ debounce |= BYT_DEBOUNCE_PULSE_750US;
+ break;
+ case 1500:
++ debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
+ debounce |= BYT_DEBOUNCE_PULSE_1500US;
+ break;
+ case 3000:
++ debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
+ debounce |= BYT_DEBOUNCE_PULSE_3MS;
+ break;
+ case 6000:
++ debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
+ debounce |= BYT_DEBOUNCE_PULSE_6MS;
+ break;
+ case 12000:
++ debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
+ debounce |= BYT_DEBOUNCE_PULSE_12MS;
+ break;
+ case 24000:
++ debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
+ debounce |= BYT_DEBOUNCE_PULSE_24MS;
+ break;
+ default:
+--
+2.27.0
+
--- /dev/null
+From ab8ba9d81099f0f695506cd40d599a2515f9ce3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Nov 2020 14:06:05 +0200
+Subject: pinctrl: merrifield: Set default bias in case no particular value
+ given
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 0fa86fc2e28227f1e64f13867e73cf864c6d25ad ]
+
+When GPIO library asks pin control to set the bias, it doesn't pass
+any value of it and argument is considered boolean (and this is true
+for ACPI GpioIo() / GpioInt() resources, by the way). Thus, individual
+drivers must behave well, when they got the resistance value of 1 Ohm,
+i.e. transforming it to sane default.
+
+In case of Intel Merrifield pin control hardware the 20 kOhm sounds plausible
+because it gives a good trade off between weakness and minimization of leakage
+current (will be only 50 uA with the above choice).
+
+Fixes: 4e80c8f50574 ("pinctrl: intel: Add Intel Merrifield pin controller support")
+Depends-on: 2956b5d94a76 ("pinctrl / gpio: Introduce .set_config() callback for GPIO chips")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/intel/pinctrl-merrifield.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/pinctrl/intel/pinctrl-merrifield.c b/drivers/pinctrl/intel/pinctrl-merrifield.c
+index 04ca8ae95df83..9e91d83b01388 100644
+--- a/drivers/pinctrl/intel/pinctrl-merrifield.c
++++ b/drivers/pinctrl/intel/pinctrl-merrifield.c
+@@ -741,6 +741,10 @@ static int mrfld_config_set_pin(struct mrfld_pinctrl *mp, unsigned int pin,
+ mask |= BUFCFG_Px_EN_MASK | BUFCFG_PUPD_VAL_MASK;
+ bits |= BUFCFG_PU_EN;
+
++ /* Set default strength value in case none is given */
++ if (arg == 1)
++ arg = 20000;
++
+ switch (arg) {
+ case 50000:
+ bits |= BUFCFG_PUPD_VAL_50K << BUFCFG_PUPD_VAL_SHIFT;
+@@ -761,6 +765,10 @@ static int mrfld_config_set_pin(struct mrfld_pinctrl *mp, unsigned int pin,
+ mask |= BUFCFG_Px_EN_MASK | BUFCFG_PUPD_VAL_MASK;
+ bits |= BUFCFG_PD_EN;
+
++ /* Set default strength value in case none is given */
++ if (arg == 1)
++ arg = 20000;
++
+ switch (arg) {
+ case 50000:
+ bits |= BUFCFG_PUPD_VAL_50K << BUFCFG_PUPD_VAL_SHIFT;
+--
+2.27.0
+
--- /dev/null
+From 824d52c5233279095be798f23cfd0ffa99b5d3c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 08:42:05 +0200
+Subject: RDMA/cm: Fix an attempt to use non-valid pointer when cleaning
+ timewait
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit 340b940ea0ed12d9adbb8f72dea17d516b2019e8 ]
+
+If cm_create_timewait_info() fails, the timewait_info pointer will contain
+an error value and will be used in cm_remove_remote() later.
+
+ general protection fault, probably for non-canonical address 0xdffffc0000000024: 0000 [#1] SMP KASAN PTI
+ KASAN: null-ptr-deref in range [0×0000000000000120-0×0000000000000127]
+ CPU: 2 PID: 12446 Comm: syz-executor.3 Not tainted 5.10.0-rc5-5d4c0742a60e #27
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+ RIP: 0010:cm_remove_remote.isra.0+0x24/0×170 drivers/infiniband/core/cm.c:978
+ Code: 84 00 00 00 00 00 41 54 55 53 48 89 fb 48 8d ab 2d 01 00 00 e8 7d bf 4b fe 48 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 48 89 ea 83 e2 07 38 d0 7f 08 84 c0 0f 85 fc 00 00 00
+ RSP: 0018:ffff888013127918 EFLAGS: 00010006
+ RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: ffffc9000a18b000
+ RDX: 0000000000000024 RSI: ffffffff82edc573 RDI: fffffffffffffff4
+ RBP: 0000000000000121 R08: 0000000000000001 R09: ffffed1002624f1d
+ R10: 0000000000000003 R11: ffffed1002624f1c R12: ffff888107760c70
+ R13: ffff888107760c40 R14: fffffffffffffff4 R15: ffff888107760c9c
+ FS: 00007fe1ffcc1700(0000) GS:ffff88811a600000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000001b2ff21000 CR3: 000000010f504001 CR4: 0000000000370ee0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ Call Trace:
+ cm_destroy_id+0x189/0×15b0 drivers/infiniband/core/cm.c:1155
+ cma_connect_ib drivers/infiniband/core/cma.c:4029 [inline]
+ rdma_connect_locked+0x1100/0×17c0 drivers/infiniband/core/cma.c:4107
+ rdma_connect+0x2a/0×40 drivers/infiniband/core/cma.c:4140
+ ucma_connect+0x277/0×340 drivers/infiniband/core/ucma.c:1069
+ ucma_write+0x236/0×2f0 drivers/infiniband/core/ucma.c:1724
+ vfs_write+0x220/0×830 fs/read_write.c:603
+ ksys_write+0x1df/0×240 fs/read_write.c:658
+ do_syscall_64+0x33/0×40 arch/x86/entry/common.c:46
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Fixes: a977049dacde ("[PATCH] IB: Add the kernel CM implementation")
+Link: https://lore.kernel.org/r/20201204064205.145795-1-leon@kernel.org
+Reviewed-by: Maor Gottlieb <maorg@nvidia.com>
+Reported-by: Amit Matityahu <mitm@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
+index c1d6a068f50fe..fd7c84721b0de 100644
+--- a/drivers/infiniband/core/cm.c
++++ b/drivers/infiniband/core/cm.c
+@@ -1435,6 +1435,7 @@ int ib_send_cm_req(struct ib_cm_id *cm_id,
+ id.local_id);
+ if (IS_ERR(cm_id_priv->timewait_info)) {
+ ret = PTR_ERR(cm_id_priv->timewait_info);
++ cm_id_priv->timewait_info = NULL;
+ goto out;
+ }
+
+@@ -1961,6 +1962,7 @@ static int cm_req_handler(struct cm_work *work)
+ id.local_id);
+ if (IS_ERR(cm_id_priv->timewait_info)) {
+ ret = PTR_ERR(cm_id_priv->timewait_info);
++ cm_id_priv->timewait_info = NULL;
+ goto destroy;
+ }
+ cm_id_priv->timewait_info->work.remote_id = req_msg->local_comm_id;
+--
+2.27.0
+
--- /dev/null
+From 789a6229744d9a1cb742b2c773e608782cf1c238 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Apr 2020 17:59:25 +0800
+Subject: Revert "gpio: eic-sprd: Use devm_platform_ioremap_resource()"
+
+From: Baolin Wang <baolin.wang7@gmail.com>
+
+[ Upstream commit 4ed7d7dd4890bb8120a3e77c16191a695fdfcc5a ]
+
+This reverts commit 0f5cb8cc27a266c81e6523b436479802e9aafc9e.
+
+This commit will cause below warnings, since our EIC controller can support
+differnt banks on different Spreadtrum SoCs, and each bank has its own base
+address, we will get invalid resource warning if the bank number is less than
+SPRD_EIC_MAX_BANK on some Spreadtrum SoCs.
+
+So we should not use devm_platform_ioremap_resource() here to remove the
+warnings.
+
+[ 1.118508] sprd-eic 40210000.gpio: invalid resource
+[ 1.118535] sprd-eic 40210000.gpio: invalid resource
+[ 1.119034] sprd-eic 40210080.gpio: invalid resource
+[ 1.119055] sprd-eic 40210080.gpio: invalid resource
+[ 1.119462] sprd-eic 402100a0.gpio: invalid resource
+[ 1.119482] sprd-eic 402100a0.gpio: invalid resource
+[ 1.119893] sprd-eic 402100c0.gpio: invalid resource
+[ 1.119913] sprd-eic 402100c0.gpio: invalid resource
+
+Signed-off-by: Baolin Wang <baolin.wang7@gmail.com>
+Link: https://lore.kernel.org/r/8d3579f4b49bb675dc805035960f24852898be28.1585734060.git.baolin.wang7@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-eic-sprd.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpio-eic-sprd.c b/drivers/gpio/gpio-eic-sprd.c
+index bb287f35cf408..8c97577740100 100644
+--- a/drivers/gpio/gpio-eic-sprd.c
++++ b/drivers/gpio/gpio-eic-sprd.c
+@@ -569,6 +569,7 @@ static int sprd_eic_probe(struct platform_device *pdev)
+ const struct sprd_eic_variant_data *pdata;
+ struct gpio_irq_chip *irq;
+ struct sprd_eic *sprd_eic;
++ struct resource *res;
+ int ret, i;
+
+ pdata = of_device_get_match_data(&pdev->dev);
+@@ -595,9 +596,13 @@ static int sprd_eic_probe(struct platform_device *pdev)
+ * have one bank EIC, thus base[1] and base[2] can be
+ * optional.
+ */
+- sprd_eic->base[i] = devm_platform_ioremap_resource(pdev, i);
+- if (IS_ERR(sprd_eic->base[i]))
++ res = platform_get_resource(pdev, IORESOURCE_MEM, i);
++ if (!res)
+ continue;
++
++ sprd_eic->base[i] = devm_ioremap_resource(&pdev->dev, res);
++ if (IS_ERR(sprd_eic->base[i]))
++ return PTR_ERR(sprd_eic->base[i]);
+ }
+
+ sprd_eic->chip.label = sprd_eic_label_name[sprd_eic->type];
+--
+2.27.0
+
--- /dev/null
+From 19ec576cdb41cf911f58b0d5d8c4a67ea7ec5002 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Nov 2020 23:09:16 -0800
+Subject: scsi: bnx2i: Requires MMU
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 2d586494c4a001312650f0b919d534e429dd1e09 ]
+
+The SCSI_BNX2_ISCSI kconfig symbol selects CNIC and CNIC selects UIO, which
+depends on MMU.
+
+Since 'select' does not follow dependency chains, add the same MMU
+dependency to SCSI_BNX2_ISCSI.
+
+Quietens this kconfig warning:
+
+WARNING: unmet direct dependencies detected for CNIC
+ Depends on [n]: NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_BROADCOM [=y] && PCI [=y] && (IPV6 [=m] || IPV6 [=m]=n) && MMU [=n]
+ Selected by [m]:
+ - SCSI_BNX2_ISCSI [=m] && SCSI_LOWLEVEL [=y] && SCSI [=y] && NET [=y] && PCI [=y] && (IPV6 [=m] || IPV6 [=m]=n)
+
+Link: https://lore.kernel.org/r/20201129070916.3919-1-rdunlap@infradead.org
+Fixes: cf4e6363859d ("[SCSI] bnx2i: Add bnx2i iSCSI driver.")
+Cc: linux-scsi@vger.kernel.org
+Cc: Nilesh Javali <njavali@marvell.com>
+Cc: Manish Rangankar <mrangankar@marvell.com>
+Cc: GR-QLogic-Storage-Upstream@marvell.com
+Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
+Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/bnx2i/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/scsi/bnx2i/Kconfig b/drivers/scsi/bnx2i/Kconfig
+index 702dc82c9501d..a0c0791abee69 100644
+--- a/drivers/scsi/bnx2i/Kconfig
++++ b/drivers/scsi/bnx2i/Kconfig
+@@ -4,6 +4,7 @@ config SCSI_BNX2_ISCSI
+ depends on NET
+ depends on PCI
+ depends on (IPV6 || IPV6=n)
++ depends on MMU
+ select SCSI_ISCSI_ATTRS
+ select NETDEVICES
+ select ETHERNET
+--
+2.27.0
+
--- /dev/null
+From 147d0d4b9025d684392ffbb5046667600a0ad4eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Nov 2020 13:57:33 +0530
+Subject: scsi: mpt3sas: Increase IOCInit request timeout to 30s
+
+From: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+
+[ Upstream commit 85dad327d9b58b4c9ce08189a2707167de392d23 ]
+
+Currently the IOCInit request message timeout is set to 10s. This is not
+sufficient in some scenarios such as during HBA FW downgrade operations.
+
+Increase the IOCInit request timeout to 30s.
+
+Link: https://lore.kernel.org/r/20201130082733.26120-1-sreekanth.reddy@broadcom.com
+Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_base.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
+index 8be8c510fdf79..7532603aafb15 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -6227,7 +6227,7 @@ _base_send_ioc_init(struct MPT3SAS_ADAPTER *ioc)
+
+ r = _base_handshake_req_reply_wait(ioc,
+ sizeof(Mpi2IOCInitRequest_t), (u32 *)&mpi_request,
+- sizeof(Mpi2IOCInitReply_t), (u16 *)&mpi_reply, 10);
++ sizeof(Mpi2IOCInitReply_t), (u16 *)&mpi_reply, 30);
+
+ if (r != 0) {
+ ioc_err(ioc, "%s: handshake failed (r=%d)\n", __func__, r);
+--
+2.27.0
+
--- /dev/null
+From 3acbd15bc077f3e86241a22a09355667b8703218 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Dec 2020 14:57:42 +0100
+Subject: selftests/bpf/test_offload.py: Reset ethtool features after failed
+ setting
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Toke Høiland-Jørgensen <toke@redhat.com>
+
+[ Upstream commit 766e62b7fcd2cf1d43e6594ba37c659dc48f7ddb ]
+
+When setting the ethtool feature flag fails (as expected for the test), the
+kernel now tracks that the feature was requested to be 'off' and refuses to
+subsequently disable it again. So reset it back to 'on' so a subsequent
+disable (that's not supposed to fail) can succeed.
+
+Fixes: 417ec26477a5 ("selftests/bpf: add offload test based on netdevsim")
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Jakub Kicinski <kuba@kernel.org>
+Link: https://lore.kernel.org/bpf/160752226280.110217.10696241563705667871.stgit@toke.dk
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_offload.py | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/bpf/test_offload.py b/tools/testing/selftests/bpf/test_offload.py
+index 1afa22c88e42a..8f918847ddf89 100755
+--- a/tools/testing/selftests/bpf/test_offload.py
++++ b/tools/testing/selftests/bpf/test_offload.py
+@@ -930,6 +930,7 @@ try:
+ start_test("Test disabling TC offloads is rejected while filters installed...")
+ ret, _ = sim.set_ethtool_tc_offloads(False, fail=False)
+ fail(ret == 0, "Driver should refuse to disable TC offloads with filters installed...")
++ sim.set_ethtool_tc_offloads(True)
+
+ start_test("Test qdisc removal frees things...")
+ sim.tc_flush_filters()
+--
+2.27.0
+
--- /dev/null
+From eba0cc0ece4a74a72e5394d9e2edfdd1e5f9b859 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Dec 2020 12:21:13 +0100
+Subject: selftests: fix poll error in udpgro.sh
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+[ Upstream commit 38bf8cd821be292e7d8e6f6283d67c5d9708f887 ]
+
+The test program udpgso_bench_rx always invokes the poll()
+syscall with a timeout of 10ms. If a larger timeout is specified
+via the command line, udpgso_bench_rx is supposed to do multiple
+poll() calls till the timeout is expired or an event is received.
+
+Currently the poll() loop errors out after the first invocation with
+no events, and may causes self-tests failure alike:
+
+failed
+ GRO with custom segment size ./udpgso_bench_rx: poll: 0x0 expected 0x1
+
+This change addresses the issue allowing the poll() loop to consume
+all the configured timeout.
+
+Fixes: ada641ff6ed3 ("selftests: fixes for UDP GRO")
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/udpgso_bench_rx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tools/testing/selftests/net/udpgso_bench_rx.c b/tools/testing/selftests/net/udpgso_bench_rx.c
+index db3d4a8b5a4c4..76a24052f4b47 100644
+--- a/tools/testing/selftests/net/udpgso_bench_rx.c
++++ b/tools/testing/selftests/net/udpgso_bench_rx.c
+@@ -113,6 +113,9 @@ static void do_poll(int fd, int timeout_ms)
+ interrupted = true;
+ break;
+ }
++
++ /* no events and more time to wait, do poll again */
++ continue;
+ }
+ if (pfd.revents != POLLIN)
+ error(1, errno, "poll: 0x%x expected 0x%x\n",
+--
+2.27.0
+
--- /dev/null
+arm-dts-sun7i-bananapi-enable-rgmii-rx-tx-delay-on-e.patch
+arm-dts-sun8i-r40-bananapi-m2-berry-fix-dcdc1-regula.patch
+arm-dts-sun8i-v40-bananapi-m2-berry-fix-ethernet-nod.patch
+pinctrl-merrifield-set-default-bias-in-case-no-parti.patch
+pinctrl-baytrail-avoid-clearing-debounce-value-when-.patch
+arm-dts-sun8i-v3s-fix-gic-node-memory-range.patch
+arm-dts-sun7i-pcduino3-nano-enable-rgmii-rx-tx-delay.patch
+arm-dts-imx6qdl-wandboard-revd1-remove-pad_gpio_6-fr.patch
+arm-dts-imx6qdl-kontron-samx6i-fix-i2c_pm-scl-pin.patch
+gpio-zynq-fix-reference-leak-in-zynq_gpio-functions.patch
+gpio-mvebu-fix-potential-user-after-free-on-probe.patch
+scsi-bnx2i-requires-mmu.patch
+xsk-fix-xsk_poll-s-return-type.patch
+xsk-replace-datagram_poll-by-sock_poll_wait.patch
+can-softing-softing_netdev_open-fix-error-handling.patch
+clk-renesas-r9a06g032-drop-__packed-for-portability.patch
+block-simplify-req_op_zone_reset_all-handling.patch
+block-factor-out-requeue-handling-from-dispatch-code.patch
+blk-mq-in-blk_mq_dispatch_rq_list-no-budget-is-a-rea.patch
+pinctrl-aspeed-fix-gpio-requests-on-pass-through-ban.patch
+netfilter-x_tables-switch-synchronization-to-rcu.patch
+netfilter-nft_compat-make-sure-xtables-destructors-h.patch
+netfilter-nft_dynset-fix-timeouts-later-than-23-days.patch
+afs-fix-memory-leak-when-mounting-with-multiple-sour.patch
+revert-gpio-eic-sprd-use-devm_platform_ioremap_resou.patch
+gpio-eic-sprd-break-loop-when-getting-null-device-re.patch
+netfilter-nft_ct-remove-confirmation-check-for-nft_c.patch
+selftests-bpf-test_offload.py-reset-ethtool-features.patch
+rdma-cm-fix-an-attempt-to-use-non-valid-pointer-when.patch
+i40e-refactor-rx_bi-accesses.patch
+i40e-optimise-prefetch-page-refcount.patch
+i40e-avoid-premature-rx-buffer-reuse.patch
+ixgbe-avoid-premature-rx-buffer-reuse.patch
+selftests-fix-poll-error-in-udpgro.sh.patch
+net-mvpp2-add-mvpp2_phylink_to_port-helper.patch
+drm-tegra-replace-idr_init-by-idr_init_base.patch
+kernel-cpu-add-arch-override-for-clear_tasks_mm_cpum.patch
+drm-tegra-sor-disable-clocks-on-error-in-tegra_sor_i.patch
+habanalabs-put-devices-before-driver-removal.patch
+arm64-syscall-exit-userspace-before-unmasking-except.patch
+vxlan-add-needed_headroom-for-lower-device.patch
+vxlan-copy-needed_tailroom-from-lowerdev.patch
+scsi-mpt3sas-increase-iocinit-request-timeout-to-30s.patch
+dm-table-remove-bug_on-in_interrupt.patch
+iwlwifi-pcie-add-one-missing-entry-for-ax210.patch
+drm-amd-display-init-clock-value-by-current-vbios-cl.patch
+perf-x86-intel-check-pebs-status-correctly.patch
+kbuild-avoid-split-lines-in-.mod-files.patch
--- /dev/null
+From 9bd1aa2e3379ad318a0bb79cafdbad033c4a6bf5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Nov 2020 13:52:46 +0100
+Subject: vxlan: Add needed_headroom for lower device
+
+From: Sven Eckelmann <sven@narfation.org>
+
+[ Upstream commit 0a35dc41fea67ac4495ce7584406bf9557a6e7d0 ]
+
+It was observed that sending data via batadv over vxlan (on top of
+wireguard) reduced the performance massively compared to raw ethernet or
+batadv on raw ethernet. A check of perf data showed that the
+vxlan_build_skb was calling all the time pskb_expand_head to allocate
+enough headroom for:
+
+ min_headroom = LL_RESERVED_SPACE(dst->dev) + dst->header_len
+ + VXLAN_HLEN + iphdr_len;
+
+But the vxlan_config_apply only requested needed headroom for:
+
+ lowerdev->hard_header_len + VXLAN6_HEADROOM or VXLAN_HEADROOM
+
+So it completely ignored the needed_headroom of the lower device. The first
+caller of net_dev_xmit could therefore never make sure that enough headroom
+was allocated for the rest of the transmit path.
+
+Cc: Annika Wickert <annika.wickert@exaring.de>
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Tested-by: Annika Wickert <aw@awlnx.space>
+Link: https://lore.kernel.org/r/20201126125247.1047977-1-sven@narfation.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/vxlan.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 630ac00a34ede..3753cf0942865 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -3538,6 +3538,7 @@ static void vxlan_config_apply(struct net_device *dev,
+ dev->gso_max_segs = lowerdev->gso_max_segs;
+
+ needed_headroom = lowerdev->hard_header_len;
++ needed_headroom += lowerdev->needed_headroom;
+
+ max_mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM :
+ VXLAN_HEADROOM);
+--
+2.27.0
+
--- /dev/null
+From 58f6fbfd98643a5f480cc8538d3affd6b23450d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Nov 2020 13:52:47 +0100
+Subject: vxlan: Copy needed_tailroom from lowerdev
+
+From: Sven Eckelmann <sven@narfation.org>
+
+[ Upstream commit a5e74021e84bb5eadf760aaf2c583304f02269be ]
+
+While vxlan doesn't need any extra tailroom, the lowerdev might need it. In
+that case, copy it over to reduce the chance for additional (re)allocations
+in the transmit path.
+
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Link: https://lore.kernel.org/r/20201126125247.1047977-2-sven@narfation.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/vxlan.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 3753cf0942865..5502e145aa17b 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -3540,6 +3540,8 @@ static void vxlan_config_apply(struct net_device *dev,
+ needed_headroom = lowerdev->hard_header_len;
+ needed_headroom += lowerdev->needed_headroom;
+
++ dev->needed_tailroom = lowerdev->needed_tailroom;
++
+ max_mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM :
+ VXLAN_HEADROOM);
+ if (max_mtu < ETH_MIN_MTU)
+--
+2.27.0
+
--- /dev/null
+From 56755e17cd7ad8e78b73b1853c406043ce796e17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Nov 2019 01:10:42 +0100
+Subject: xsk: Fix xsk_poll()'s return type
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
+
+[ Upstream commit 5d946c5abbaf68083fa6a41824dd79e1f06286d8 ]
+
+xsk_poll() is defined as returning 'unsigned int' but the
+.poll method is declared as returning '__poll_t', a bitwise type.
+
+Fix this by using the proper return type and using the EPOLL
+constants instead of the POLL ones, as required for __poll_t.
+
+Signed-off-by: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Björn Töpel <bjorn.topel@intel.com>
+Link: https://lore.kernel.org/bpf/20191120001042.30830-1-luc.vanoostenryck@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xdp/xsk.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
+index f9eb5efb237c7..04652797cd374 100644
+--- a/net/xdp/xsk.c
++++ b/net/xdp/xsk.c
+@@ -426,10 +426,10 @@ static int xsk_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len)
+ return __xsk_sendmsg(sk);
+ }
+
+-static unsigned int xsk_poll(struct file *file, struct socket *sock,
++static __poll_t xsk_poll(struct file *file, struct socket *sock,
+ struct poll_table_struct *wait)
+ {
+- unsigned int mask = datagram_poll(file, sock, wait);
++ __poll_t mask = datagram_poll(file, sock, wait);
+ struct sock *sk = sock->sk;
+ struct xdp_sock *xs = xdp_sk(sk);
+ struct xdp_umem *umem;
+@@ -448,9 +448,9 @@ static unsigned int xsk_poll(struct file *file, struct socket *sock,
+ }
+
+ if (xs->rx && !xskq_empty_desc(xs->rx))
+- mask |= POLLIN | POLLRDNORM;
++ mask |= EPOLLIN | EPOLLRDNORM;
+ if (xs->tx && !xskq_full_desc(xs->tx))
+- mask |= POLLOUT | POLLWRNORM;
++ mask |= EPOLLOUT | EPOLLWRNORM;
+
+ return mask;
+ }
+--
+2.27.0
+
--- /dev/null
+From 3c62262f24d92e513d8e38b385d53dbfd006cb0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Dec 2020 21:56:57 +0800
+Subject: xsk: Replace datagram_poll by sock_poll_wait
+
+From: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
+
+[ Upstream commit f5da54187e33dce9bea63170667dbb0ca8d98194 ]
+
+datagram_poll will judge the current socket status (EPOLLIN, EPOLLOUT)
+based on the traditional socket information (eg: sk_wmem_alloc), but
+this does not apply to xsk. So this patch uses sock_poll_wait instead of
+datagram_poll, and the mask is calculated by xsk_poll.
+
+Fixes: c497176cb2e4 ("xsk: add Rx receive functions and poll support")
+Signed-off-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Link: https://lore.kernel.org/bpf/e82f4697438cd63edbf271ebe1918db8261b7c09.1606555939.git.xuanzhuo@linux.alibaba.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xdp/xsk.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
+index 04652797cd374..2bc0d6e3e124c 100644
+--- a/net/xdp/xsk.c
++++ b/net/xdp/xsk.c
+@@ -429,11 +429,13 @@ static int xsk_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len)
+ static __poll_t xsk_poll(struct file *file, struct socket *sock,
+ struct poll_table_struct *wait)
+ {
+- __poll_t mask = datagram_poll(file, sock, wait);
++ __poll_t mask = 0;
+ struct sock *sk = sock->sk;
+ struct xdp_sock *xs = xdp_sk(sk);
+ struct xdp_umem *umem;
+
++ sock_poll_wait(file, sock, wait);
++
+ if (unlikely(!xsk_is_bound(xs)))
+ return mask;
+
+--
+2.27.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
