5.7-stable patches

added patches:
	airo-fix-read-overflows-sending-packets.patch
	net-dsa-mt7530-set-cpu-port-to-fallback-mode.patch

diff --git a/queue-5.7/airo-fix-read-overflows-sending-packets.patch b/queue-5.7/airo-fix-read-overflows-sending-packets.patch
new file mode 100644 (file)
index 0000000..e7ba422
--- /dev/null
+++ b/queue-5.7/airo-fix-read-overflows-sending-packets.patch
@@ -0,0 +1,62 @@
+From 11e7a91994c29da96d847f676be023da6a2c1359 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 27 May 2020 21:48:30 +0300
+Subject: airo: Fix read overflows sending packets
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 11e7a91994c29da96d847f676be023da6a2c1359 upstream.
+
+The problem is that we always copy a minimum of ETH_ZLEN (60) bytes from
+skb->data even when skb->len is less than ETH_ZLEN so it leads to a read
+overflow.
+
+The fix is to pad skb->data to at least ETH_ZLEN bytes.
+
+Cc: <stable@vger.kernel.org>
+Reported-by: Hu Jiahui <kirin.say@gmail.com>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20200527184830.GA1164846@mwanda
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/cisco/airo.c |   12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/net/wireless/cisco/airo.c
++++ b/drivers/net/wireless/cisco/airo.c
+@@ -1925,6 +1925,10 @@ static netdev_tx_t mpi_start_xmit(struct
+               airo_print_err(dev->name, "%s: skb == NULL!",__func__);
+               return NETDEV_TX_OK;
+       }
++      if (skb_padto(skb, ETH_ZLEN)) {
++              dev->stats.tx_dropped++;
++              return NETDEV_TX_OK;
++      }
+       npacks = skb_queue_len (&ai->txq);
+ 
+       if (npacks >= MAXTXQ - 1) {
+@@ -2127,6 +2131,10 @@ static netdev_tx_t airo_start_xmit(struc
+               airo_print_err(dev->name, "%s: skb == NULL!", __func__);
+               return NETDEV_TX_OK;
+       }
++      if (skb_padto(skb, ETH_ZLEN)) {
++              dev->stats.tx_dropped++;
++              return NETDEV_TX_OK;
++      }
+ 
+       /* Find a vacant FID */
+       for( i = 0; i < MAX_FIDS / 2 && (fids[i] & 0xffff0000); i++ );
+@@ -2201,6 +2209,10 @@ static netdev_tx_t airo_start_xmit11(str
+               airo_print_err(dev->name, "%s: skb == NULL!", __func__);
+               return NETDEV_TX_OK;
+       }
++      if (skb_padto(skb, ETH_ZLEN)) {
++              dev->stats.tx_dropped++;
++              return NETDEV_TX_OK;
++      }
+ 
+       /* Find a vacant FID */
+       for( i = MAX_FIDS / 2; i < MAX_FIDS && (fids[i] & 0xffff0000); i++ );

diff --git a/queue-5.7/net-dsa-mt7530-set-cpu-port-to-fallback-mode.patch b/queue-5.7/net-dsa-mt7530-set-cpu-port-to-fallback-mode.patch
new file mode 100644 (file)
index 0000000..b3b46ae
--- /dev/null
+++ b/queue-5.7/net-dsa-mt7530-set-cpu-port-to-fallback-mode.patch
@@ -0,0 +1,71 @@
+From 38152ea37d8bdaffa22603e0a5b5b86cfa8714c9 Mon Sep 17 00:00:00 2001
+From: DENG Qingfang <dqfext@gmail.com>
+Date: Wed, 13 May 2020 23:37:17 +0800
+Subject: net: dsa: mt7530: set CPU port to fallback mode
+
+From: DENG Qingfang <dqfext@gmail.com>
+
+commit 38152ea37d8bdaffa22603e0a5b5b86cfa8714c9 upstream.
+
+Currently, setting a bridge's self PVID to other value and deleting
+the default VID 1 renders untagged ports of that VLAN unable to talk to
+the CPU port:
+
+       bridge vlan add dev br0 vid 2 pvid untagged self
+       bridge vlan del dev br0 vid 1 self
+       bridge vlan add dev sw0p0 vid 2 pvid untagged
+       bridge vlan del dev sw0p0 vid 1
+       # br0 cannot send untagged frames out of sw0p0 anymore
+
+That is because the CPU port is set to security mode and its PVID is
+still 1, and untagged frames are dropped due to VLAN member violation.
+
+Set the CPU port to fallback mode so untagged frames can pass through.
+
+Fixes: 83163f7dca56 ("net: dsa: mediatek: add VLAN support for MT7530")
+Signed-off-by: DENG Qingfang <dqfext@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/dsa/mt7530.c |   11 ++++++++---
+ drivers/net/dsa/mt7530.h |    6 ++++++
+ 2 files changed, 14 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -807,10 +807,15 @@ mt7530_port_set_vlan_aware(struct dsa_sw
+                  PCR_MATRIX_MASK, PCR_MATRIX(MT7530_ALL_MEMBERS));
+ 
+       /* Trapped into security mode allows packet forwarding through VLAN
+-       * table lookup.
++       * table lookup. CPU port is set to fallback mode to let untagged
++       * frames pass through.
+        */
+-      mt7530_rmw(priv, MT7530_PCR_P(port), PCR_PORT_VLAN_MASK,
+-                 MT7530_PORT_SECURITY_MODE);
++      if (dsa_is_cpu_port(ds, port))
++              mt7530_rmw(priv, MT7530_PCR_P(port), PCR_PORT_VLAN_MASK,
++                         MT7530_PORT_FALLBACK_MODE);
++      else
++              mt7530_rmw(priv, MT7530_PCR_P(port), PCR_PORT_VLAN_MASK,
++                         MT7530_PORT_SECURITY_MODE);
+ 
+       /* Set the port as a user port which is to be able to recognize VID
+        * from incoming packets before fetching entry within the VLAN table.
+--- a/drivers/net/dsa/mt7530.h
++++ b/drivers/net/dsa/mt7530.h
+@@ -153,6 +153,12 @@ enum mt7530_port_mode {
+       /* Port Matrix Mode: Frames are forwarded by the PCR_MATRIX members. */
+       MT7530_PORT_MATRIX_MODE = PORT_VLAN(0),
+ 
++      /* Fallback Mode: Forward received frames with ingress ports that do
++       * not belong to the VLAN member. Frames whose VID is not listed on
++       * the VLAN table are forwarded by the PCR_MATRIX members.
++       */
++      MT7530_PORT_FALLBACK_MODE = PORT_VLAN(1),
++
+       /* Security Mode: Discard any frame due to ingress membership
+        * violation or VID missed on the VLAN table.
+        */

diff --git a/queue-5.7/series b/queue-5.7/series
index 379ec69a8705cc38ba0a4eaa162b92bd8626544d..ca052e83182c6325ea322e5f1b8bc556f3ae6e29 100644 (file)
--- a/queue-5.7/series
+++ b/queue-5.7/series
@@ -10,3 +10,5 @@ kernel-relay.c-handle-alloc_percpu-returning-null-in-relay_open.patch
 mmc-fix-compilation-of-user-api.patch
 media-revert-staging-imgu-address-a-compiler-warning-on-alignment.patch
 media-staging-ipu3-imgu-move-alignment-attribute-to-field.patch
+net-dsa-mt7530-set-cpu-port-to-fallback-mode.patch
+airo-fix-read-overflows-sending-packets.patch