Fixes for 5.15

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-5.15/i40e-fix-potential-null-pointer-dereferencing-of-pf-.patch b/queue-5.15/i40e-fix-potential-null-pointer-dereferencing-of-pf-.patch
new file mode 100644 (file)
index 0000000..b986262
--- /dev/null
+++ b/queue-5.15/i40e-fix-potential-null-pointer-dereferencing-of-pf-.patch
@@ -0,0 +1,52 @@
+From bd1e559f7a546ab98a1056c2056c3b1db92f8b02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Aug 2023 15:16:53 -0700
+Subject: i40e: fix potential NULL pointer dereferencing of pf->vf
+ i40e_sync_vsi_filters()
+
+From: Andrii Staikov <andrii.staikov@intel.com>
+
+[ Upstream commit 9525a3c38accd2e186f52443e35e633e296cc7f5 ]
+
+Add check for pf->vf not being NULL before dereferencing
+pf->vf[vsi->vf_id] in updating VSI filter sync.
+Add a similar check before dereferencing !pf->vf[vsi->vf_id].trusted
+in the condition for clearing promisc mode bit.
+
+Fixes: c87c938f62d8 ("i40e: Add VF VLAN pruning")
+Signed-off-by: Andrii Staikov <andrii.staikov@intel.com>
+Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 76bb1d0de8d1c..539bb69548f23 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -2595,7 +2595,7 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi)
+                       retval = i40e_correct_mac_vlan_filters
+                               (vsi, &tmp_add_list, &tmp_del_list,
+                                vlan_filters);
+-              else
++              else if (pf->vf)
+                       retval = i40e_correct_vf_mac_vlan_filters
+                               (vsi, &tmp_add_list, &tmp_del_list,
+                                vlan_filters, pf->vf[vsi->vf_id].trusted);
+@@ -2768,7 +2768,8 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi)
+       }
+ 
+       /* if the VF is not trusted do not do promisc */
+-      if ((vsi->type == I40E_VSI_SRIOV) && !pf->vf[vsi->vf_id].trusted) {
++      if (vsi->type == I40E_VSI_SRIOV && pf->vf &&
++          !pf->vf[vsi->vf_id].trusted) {
+               clear_bit(__I40E_VSI_OVERFLOW_PROMISC, vsi->state);
+               goto out;
+       }
+-- 
+2.40.1
+

diff --git a/queue-5.15/nvme-pci-always-return-an-err_ptr-from-nvme_pci_allo.patch b/queue-5.15/nvme-pci-always-return-an-err_ptr-from-nvme_pci_allo.patch
new file mode 100644 (file)
index 0000000..264b985
--- /dev/null
+++ b/queue-5.15/nvme-pci-always-return-an-err_ptr-from-nvme_pci_allo.patch
@@ -0,0 +1,47 @@
+From 638a6b3db7bc0c57c4da57e1fa1eb6057e1cec4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 17:43:57 -0300
+Subject: nvme-pci: always return an ERR_PTR from nvme_pci_alloc_dev
+
+From: Irvin Cote <irvin.cote@insa-lyon.fr>
+
+[ Upstream commit dc785d69d753a3894c93afc23b91404652382ead ]
+
+Don't mix NULL and ERR_PTR returns.
+
+Fixes: 2e87570be9d2 ("nvme-pci: factor out a nvme_pci_alloc_dev helper")
+Signed-off-by: Irvin Cote <irvin.cote@insa-lyon.fr>
+Reviewed-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index e5980df2094ad..65172a654a198 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -2977,7 +2977,7 @@ static struct nvme_dev *nvme_pci_alloc_dev(struct pci_dev *pdev,
+ 
+       dev = kzalloc_node(sizeof(*dev), GFP_KERNEL, node);
+       if (!dev)
+-              return NULL;
++              return ERR_PTR(-ENOMEM);
+       INIT_WORK(&dev->ctrl.reset_work, nvme_reset_work);
+       INIT_WORK(&dev->remove_work, nvme_remove_dead_ctrl_work);
+       mutex_init(&dev->shutdown_lock);
+@@ -3022,8 +3022,8 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+       int result = -ENOMEM;
+ 
+       dev = nvme_pci_alloc_dev(pdev, id);
+-      if (!dev)
+-              return -ENOMEM;
++      if (IS_ERR(dev))
++              return PTR_ERR(dev);
+ 
+       result = nvme_dev_map(dev);
+       if (result)
+-- 
+2.40.1
+

diff --git a/queue-5.15/perf-metric-return-early-if-no-cpu-pmu-table-exists.patch b/queue-5.15/perf-metric-return-early-if-no-cpu-pmu-table-exists.patch
new file mode 100644 (file)
index 0000000..5a497be
--- /dev/null
+++ b/queue-5.15/perf-metric-return-early-if-no-cpu-pmu-table-exists.patch
@@ -0,0 +1,78 @@
+From af3d21ffdb5a9a838f97589d2724f307b44fc492 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Aug 2022 09:48:40 -0700
+Subject: perf metric: Return early if no CPU PMU table exists
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 3f5df3ac646e21a79a421ae4037c4ef0632bcaa9 ]
+
+Previous behavior is to segfault if there is no CPU PMU table and a
+metric is sought. To reproduce compile with NO_JEVENTS=1 then request a
+metric, for example, "perf stat -M IPC true".
+
+Committer testing:
+
+Before:
+
+  $ make -k NO_JEVENTS=1 BUILD_BPF_SKEL=1 O=/tmp/build/perf-urgent -C tools/perf install-bin
+  $ perf stat -M IPC true
+  Segmentation fault (core dumped)
+  $
+
+After:
+
+  $ perf stat -M IPC true
+
+   Usage: perf stat [<options>] [<command>]
+
+      -M, --metrics <metric/metric group list>
+                            monitor specified metrics or metric groups (separated by ,)
+  $
+
+Fixes: 00facc760903be66 ("perf jevents: Switch build to use jevents.py")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Caleb Biggers <caleb.biggers@intel.com>
+Cc: Florian Fischer <florian.fischer@muhq.space>
+Cc: Ian Rogers <rogers.email@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@arm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: John Garry <john.garry@huawei.com>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Kshipra Bopardikar <kshipra.bopardikar@intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Miaoqian Lin <linmq006@gmail.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Perry Taylor <perry.taylor@intel.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Thomas Richter <tmricht@linux.ibm.com>
+Cc: Xing Zhengjun <zhengjun.xing@linux.intel.com>
+Link: https://lore.kernel.org/r/20220830164846.401143-3-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/metricgroup.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tools/perf/util/metricgroup.c b/tools/perf/util/metricgroup.c
+index 29b747ac31c12..ee6c5582681bd 100644
+--- a/tools/perf/util/metricgroup.c
++++ b/tools/perf/util/metricgroup.c
+@@ -1258,6 +1258,9 @@ int metricgroup__parse_groups(const struct option *opt,
+       struct evlist *perf_evlist = *(struct evlist **)opt->value;
+       struct pmu_events_map *map = pmu_events_map__find();
+ 
++      if (!table)
++              return -EINVAL;
++
+       return parse_groups(perf_evlist, str, metric_no_group,
+                           metric_no_merge, NULL, metric_events, map);
+ }
+-- 
+2.40.1
+

diff --git a/queue-5.15/scsi-qla2xxx-fix-null-pointer-dereference-in-target-.patch b/queue-5.15/scsi-qla2xxx-fix-null-pointer-dereference-in-target-.patch
new file mode 100644 (file)
index 0000000..3cd7d10
--- /dev/null
+++ b/queue-5.15/scsi-qla2xxx-fix-null-pointer-dereference-in-target-.patch
@@ -0,0 +1,94 @@
+From aabb59b51f0aae3ba27ade0ffb25a3c9c85a84e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 May 2023 11:22:35 +0300
+Subject: scsi: qla2xxx: Fix NULL pointer dereference in target mode
+
+From: Gleb Chesnokov <gleb.chesnokov@scst.dev>
+
+[ Upstream commit d54820b22e404b06b2b65877ff802cc7b31688bc ]
+
+When target mode is enabled, the pci_irq_get_affinity() function may return
+a NULL value in qla_mapq_init_qp_cpu_map() due to the qla24xx_enable_msix()
+code that handles IRQ settings for target mode. This leads to a crash due
+to a NULL pointer dereference.
+
+This patch fixes the issue by adding a check for the NULL value returned by
+pci_irq_get_affinity() and introducing a 'cpu_mapped' boolean flag to the
+qla_qpair structure, ensuring that the qpair's CPU affinity is updated when
+it has not been mapped to a CPU.
+
+Fixes: 1d201c81d4cc ("scsi: qla2xxx: Select qpair depending on which CPU post_cmd() gets called")
+Signed-off-by: Gleb Chesnokov <gleb.chesnokov@scst.dev>
+Link: https://lore.kernel.org/r/56b416f2-4e0f-b6cf-d6d5-b7c372e3c6a2@scst.dev
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_def.h    | 1 +
+ drivers/scsi/qla2xxx/qla_init.c   | 3 +++
+ drivers/scsi/qla2xxx/qla_inline.h | 3 +++
+ drivers/scsi/qla2xxx/qla_isr.c    | 3 +++
+ 4 files changed, 10 insertions(+)
+
+diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
+index 723f9953ad701..3c876967e8b16 100644
+--- a/drivers/scsi/qla2xxx/qla_def.h
++++ b/drivers/scsi/qla2xxx/qla_def.h
+@@ -3791,6 +3791,7 @@ struct qla_qpair {
+       uint64_t retry_term_jiff;
+       struct qla_tgt_counters tgt_counters;
+       uint16_t cpuid;
++      bool cpu_mapped;
+       struct qla_fw_resources fwres ____cacheline_aligned;
+       u32     cmd_cnt;
+       u32     cmd_completion_cnt;
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index d259f6727cf74..b59d5b560a278 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -9780,6 +9780,9 @@ struct qla_qpair *qla2xxx_create_qpair(struct scsi_qla_host *vha, int qos,
+               qpair->rsp->req = qpair->req;
+               qpair->rsp->qpair = qpair;
+ 
++              if (!qpair->cpu_mapped)
++                      qla_cpu_update(qpair, raw_smp_processor_id());
++
+               if (IS_T10_PI_CAPABLE(ha) && ql2xenabledif) {
+                       if (ha->fw_attributes & BIT_4)
+                               qpair->difdix_supported = 1;
+diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h
+index e66441355f7ae..a4a56ab0ba747 100644
+--- a/drivers/scsi/qla2xxx/qla_inline.h
++++ b/drivers/scsi/qla2xxx/qla_inline.h
+@@ -597,11 +597,14 @@ qla_mapq_init_qp_cpu_map(struct qla_hw_data *ha,
+       if (!ha->qp_cpu_map)
+               return;
+       mask = pci_irq_get_affinity(ha->pdev, msix->vector_base0);
++      if (!mask)
++              return;
+       qpair->cpuid = cpumask_first(mask);
+       for_each_cpu(cpu, mask) {
+               ha->qp_cpu_map[cpu] = qpair;
+       }
+       msix->cpuid = qpair->cpuid;
++      qpair->cpu_mapped = true;
+ }
+ 
+ static inline void
+diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
+index 4f6aab2599350..51e906fa8694e 100644
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -3782,6 +3782,9 @@ void qla24xx_process_response_queue(struct scsi_qla_host *vha,
+ 
+       if (rsp->qpair->cpuid != raw_smp_processor_id() || !rsp->qpair->rcv_intr) {
+               rsp->qpair->rcv_intr = 1;
++
++              if (!rsp->qpair->cpu_mapped)
++                      qla_cpu_update(rsp->qpair, raw_smp_processor_id());
+       }
+ 
+ #define __update_rsp_in(_update, _is_shadow_hba, _rsp, _rsp_in)               \
+-- 
+2.40.1
+

diff --git a/queue-5.15/series b/queue-5.15/series
index c0e1dd5864fc30e5752f8c944c8fbdeaf9202a97..e9560ee192a9ccd146b5fd310f4493c1992d3c8f 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -147,3 +147,7 @@ nvme-pci-factor-out-a-nvme_pci_alloc_dev-helper.patch
 nvme-pci-do-not-set-the-numa-node-of-device-if-it-ha.patch
 watchdog-itco_wdt-no-need-to-stop-the-timer-in-probe.patch
 watchdog-itco_wdt-set-no_reboot-if-the-watchdog-is-n.patch
+i40e-fix-potential-null-pointer-dereferencing-of-pf-.patch
+perf-metric-return-early-if-no-cpu-pmu-table-exists.patch
+scsi-qla2xxx-fix-null-pointer-dereference-in-target-.patch
+nvme-pci-always-return-an-err_ptr-from-nvme_pci_allo.patch