--- /dev/null
+From 6a291acc42309ef92bab93fe75bb83b2aa420c1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 May 2021 12:04:38 -0400
+Subject: drm/amdgpu/jpeg2.5: add cancel_delayed_work_sync before power gate
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: James Zhu <James.Zhu@amd.com>
+
+[ Upstream commit 23f10a571da5eaa63b7845d16e2f49837e841ab9 ]
+
+Add cancel_delayed_work_sync before set power gating state
+to avoid race condition issue when power gating.
+
+Signed-off-by: James Zhu <James.Zhu@amd.com>
+Reviewed-by: Leo Liu <leo.liu@amd.com>
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c b/drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c
+index 63b350182389..8c84e35c2719 100644
+--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c
++++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c
+@@ -187,14 +187,14 @@ static int jpeg_v2_5_hw_init(void *handle)
+ static int jpeg_v2_5_hw_fini(void *handle)
+ {
+ struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+- struct amdgpu_ring *ring;
+ int i;
+
++ cancel_delayed_work_sync(&adev->vcn.idle_work);
++
+ for (i = 0; i < adev->jpeg.num_jpeg_inst; ++i) {
+ if (adev->jpeg.harvest_config & (1 << i))
+ continue;
+
+- ring = &adev->jpeg.inst[i].ring_dec;
+ if (adev->jpeg.cur_state != AMD_PG_STATE_GATE &&
+ RREG32_SOC15(JPEG, i, mmUVD_JRBC_STATUS))
+ jpeg_v2_5_set_powergating_state(adev, AMD_PG_STATE_GATE);
+--
+2.30.2
+
--- /dev/null
+From 6bbb35068b37ebe24cafcace6067598a5f0be1ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 May 2021 12:08:20 -0400
+Subject: drm/amdgpu/jpeg3: add cancel_delayed_work_sync before power gate
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: James Zhu <James.Zhu@amd.com>
+
+[ Upstream commit 20ebbfd22f8115a1e4f60d3d289f66be4d47f1ec ]
+
+Add cancel_delayed_work_sync before set power gating state
+to avoid race condition issue when power gating.
+
+Signed-off-by: James Zhu <James.Zhu@amd.com>
+Reviewed-by: Leo Liu <leo.liu@amd.com>
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/jpeg_v3_0.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/jpeg_v3_0.c b/drivers/gpu/drm/amd/amdgpu/jpeg_v3_0.c
+index 9259e35f0f55..e00c88abeaed 100644
+--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v3_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v3_0.c
+@@ -159,9 +159,9 @@ static int jpeg_v3_0_hw_init(void *handle)
+ static int jpeg_v3_0_hw_fini(void *handle)
+ {
+ struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+- struct amdgpu_ring *ring;
+
+- ring = &adev->jpeg.inst->ring_dec;
++ cancel_delayed_work_sync(&adev->vcn.idle_work);
++
+ if (adev->jpeg.cur_state != AMD_PG_STATE_GATE &&
+ RREG32_SOC15(JPEG, 0, mmUVD_JRBC_STATUS))
+ jpeg_v3_0_set_powergating_state(adev, AMD_PG_STATE_GATE);
+--
+2.30.2
+
--- /dev/null
+From 65d6692bb2f103faa511a4159c6596bd469c1406 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 May 2021 16:39:17 -0400
+Subject: drm/amdgpu/vcn3: add cancel_delayed_work_sync before power gate
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: James Zhu <James.Zhu@amd.com>
+
+[ Upstream commit 4a62542ae064e3b645d6bbf2295a6c05136956c6 ]
+
+Add cancel_delayed_work_sync before set power gating state
+to avoid race condition issue when power gating.
+
+Signed-off-by: James Zhu <James.Zhu@amd.com>
+Reviewed-by: Leo Liu <leo.liu@amd.com>
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
+index 700621ddc02e..c9c888be1228 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
+@@ -345,15 +345,14 @@ done:
+ static int vcn_v3_0_hw_fini(void *handle)
+ {
+ struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+- struct amdgpu_ring *ring;
+ int i;
+
++ cancel_delayed_work_sync(&adev->vcn.idle_work);
++
+ for (i = 0; i < adev->vcn.num_vcn_inst; ++i) {
+ if (adev->vcn.harvest_config & (1 << i))
+ continue;
+
+- ring = &adev->vcn.inst[i].ring_dec;
+-
+ if (!amdgpu_sriov_vf(adev)) {
+ if ((adev->pg_flags & AMD_PG_SUPPORT_VCN_DPG) ||
+ (adev->vcn.cur_state != AMD_PG_STATE_GATE &&
+--
+2.30.2
+
--- /dev/null
+From 8781b5ecd0aadae802855ba95ba5295e99622dfe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 May 2021 21:06:38 +0100
+Subject: io_uring: fix link timeout refs
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit a298232ee6b9a1d5d732aa497ff8be0d45b5bd82 ]
+
+WARNING: CPU: 0 PID: 10242 at lib/refcount.c:28 refcount_warn_saturate+0x15b/0x1a0 lib/refcount.c:28
+RIP: 0010:refcount_warn_saturate+0x15b/0x1a0 lib/refcount.c:28
+Call Trace:
+ __refcount_sub_and_test include/linux/refcount.h:283 [inline]
+ __refcount_dec_and_test include/linux/refcount.h:315 [inline]
+ refcount_dec_and_test include/linux/refcount.h:333 [inline]
+ io_put_req fs/io_uring.c:2140 [inline]
+ io_queue_linked_timeout fs/io_uring.c:6300 [inline]
+ __io_queue_sqe+0xbef/0xec0 fs/io_uring.c:6354
+ io_submit_sqe fs/io_uring.c:6534 [inline]
+ io_submit_sqes+0x2bbd/0x7c50 fs/io_uring.c:6660
+ __do_sys_io_uring_enter fs/io_uring.c:9240 [inline]
+ __se_sys_io_uring_enter+0x256/0x1d60 fs/io_uring.c:9182
+
+io_link_timeout_fn() should put only one reference of the linked timeout
+request, however in case of racing with the master request's completion
+first io_req_complete() puts one and then io_put_req_deferred() is
+called.
+
+Cc: stable@vger.kernel.org # 5.12+
+Fixes: 9ae1f8dd372e0 ("io_uring: fix inconsistent lock state")
+Reported-by: syzbot+a2910119328ce8e7996f@syzkaller.appspotmail.com
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Link: https://lore.kernel.org/r/ff51018ff29de5ffa76f09273ef48cb24c720368.1620417627.git.asml.silence@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io_uring.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index 369ec81033d6..958c463c11eb 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -6266,6 +6266,7 @@ static enum hrtimer_restart io_link_timeout_fn(struct hrtimer *timer)
+ if (prev) {
+ io_async_find_and_cancel(ctx, req, prev->user_data, -ETIME);
+ io_put_req_deferred(prev, 1);
++ io_put_req_deferred(req, 1);
+ } else {
+ io_cqring_add_event(req, -ETIME, 0);
+ io_put_req_deferred(req, 1);
+--
+2.30.2
+
--- /dev/null
+From 23331b00bb0a24f1cf90f48b879cefd93448cc14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Feb 2021 22:35:15 +0000
+Subject: io_uring: use better types for cflags
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit 8c3f9cd1603d0e4af6c50ebc6d974ab7bdd03cf4 ]
+
+__io_cqring_fill_event() takes cflags as long to squeeze it into u32 in
+an CQE, awhile all users pass int or unsigned. Replace it with unsigned
+int and store it as u32 in struct io_completion to match CQE.
+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io_uring.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index 958c463c11eb..fdbaaf579cc6 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -545,7 +545,7 @@ struct io_statx {
+ struct io_completion {
+ struct file *file;
+ struct list_head list;
+- int cflags;
++ u32 cflags;
+ };
+
+ struct io_async_connect {
+@@ -1711,7 +1711,8 @@ static void io_cqring_overflow_flush(struct io_ring_ctx *ctx, bool force,
+ }
+ }
+
+-static void __io_cqring_fill_event(struct io_kiocb *req, long res, long cflags)
++static void __io_cqring_fill_event(struct io_kiocb *req, long res,
++ unsigned int cflags)
+ {
+ struct io_ring_ctx *ctx = req->ctx;
+ struct io_uring_cqe *cqe;
+--
+2.30.2
+
--- /dev/null
+From 8aafbd64da80c2d17994d435c0afc113cba4afa4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Apr 2021 21:29:08 +0800
+Subject: riscv: vdso: fix and clean-up Makefile
+
+From: Jisheng Zhang <jszhang@kernel.org>
+
+[ Upstream commit 772d7891e8b3b0baae7bb88a294d61fd07ba6d15 ]
+
+Running "make" on an already compiled kernel tree will rebuild the
+kernel even without any modifications:
+
+ CALL linux/scripts/checksyscalls.sh
+ CALL linux/scripts/atomic/check-atomics.sh
+ CHK include/generated/compile.h
+ SO2S arch/riscv/kernel/vdso/vdso-syms.S
+ AS arch/riscv/kernel/vdso/vdso-syms.o
+ AR arch/riscv/kernel/vdso/built-in.a
+ AR arch/riscv/kernel/built-in.a
+ AR arch/riscv/built-in.a
+ GEN .version
+ CHK include/generated/compile.h
+ UPD include/generated/compile.h
+ CC init/version.o
+ AR init/built-in.a
+ LD vmlinux.o
+
+The reason is "Any target that utilizes if_changed must be listed in
+$(targets), otherwise the command line check will fail, and the target
+will always be built" as explained by Documentation/kbuild/makefiles.rst
+
+Fix this build bug by adding vdso-syms.S to $(targets)
+
+At the same time, there are two trivial clean up modifications:
+
+- the vdso-dummy.o is not needed any more after so remove it.
+
+- vdso.lds is a generated file, so it should be prefixed with
+ $(obj)/ instead of $(src)/
+
+Fixes: c2c81bb2f691 ("RISC-V: Fix the VDSO symbol generaton for binutils-2.35+")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jisheng Zhang <jszhang@kernel.org>
+Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/vdso/Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/riscv/kernel/vdso/Makefile b/arch/riscv/kernel/vdso/Makefile
+index ca2b40dfd24b..24d936c147cd 100644
+--- a/arch/riscv/kernel/vdso/Makefile
++++ b/arch/riscv/kernel/vdso/Makefile
+@@ -23,7 +23,7 @@ ifneq ($(c-gettimeofday-y),)
+ endif
+
+ # Build rules
+-targets := $(obj-vdso) vdso.so vdso.so.dbg vdso.lds vdso-dummy.o
++targets := $(obj-vdso) vdso.so vdso.so.dbg vdso.lds vdso-syms.S
+ obj-vdso := $(addprefix $(obj)/, $(obj-vdso))
+
+ obj-y += vdso.o vdso-syms.o
+@@ -41,7 +41,7 @@ KASAN_SANITIZE := n
+ $(obj)/vdso.o: $(obj)/vdso.so
+
+ # link rule for the .so file, .lds has to be first
+-$(obj)/vdso.so.dbg: $(src)/vdso.lds $(obj-vdso) FORCE
++$(obj)/vdso.so.dbg: $(obj)/vdso.lds $(obj-vdso) FORCE
+ $(call if_changed,vdsold)
+ LDFLAGS_vdso.so.dbg = -shared -s -soname=linux-vdso.so.1 \
+ --build-id=sha1 --hash-style=both --eh-frame-hdr
+--
+2.30.2
+
--- /dev/null
+From 737a62969d947084aa3355f46df58335bb16c1a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Apr 2021 16:05:56 +0200
+Subject: serial: stm32: fix threaded interrupt handling
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit e359b4411c2836cf87c8776682d1b594635570de ]
+
+When DMA is enabled the receive handler runs in a threaded handler, but
+the primary handler up until very recently neither disabled interrupts
+in the device or used IRQF_ONESHOT. This would lead to a deadlock if an
+interrupt comes in while the threaded receive handler is running under
+the port lock.
+
+Commit ad7676812437 ("serial: stm32: fix a deadlock condition with
+wakeup event") claimed to fix an unrelated deadlock, but unfortunately
+also disabled interrupts in the threaded handler. While this prevents
+the deadlock mentioned in the previous paragraph it also defeats the
+purpose of using a threaded handler in the first place.
+
+Fix this by making the interrupt one-shot and not disabling interrupts
+in the threaded handler.
+
+Note that (receive) DMA must not be used for a console port as the
+threaded handler could be interrupted while holding the port lock,
+something which could lead to a deadlock in case an interrupt handler
+ends up calling printk.
+
+Fixes: ad7676812437 ("serial: stm32: fix a deadlock condition with wakeup event")
+Fixes: 3489187204eb ("serial: stm32: adding dma support")
+Cc: stable@vger.kernel.org # 4.9
+Cc: Alexandre TORGUE <alexandre.torgue@st.com>
+Cc: Gerald Baeza <gerald.baeza@st.com>
+Reviewed-by: Valentin Caron<valentin.caron@foss.st.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20210416140557.25177-3-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 22 ++++++++++++----------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index 2cf9fc915510..844059861f9e 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -213,14 +213,11 @@ static void stm32_usart_receive_chars(struct uart_port *port, bool threaded)
+ struct tty_port *tport = &port->state->port;
+ struct stm32_port *stm32_port = to_stm32_port(port);
+ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
+- unsigned long c, flags;
++ unsigned long c;
+ u32 sr;
+ char flag;
+
+- if (threaded)
+- spin_lock_irqsave(&port->lock, flags);
+- else
+- spin_lock(&port->lock);
++ spin_lock(&port->lock);
+
+ while (stm32_usart_pending_rx(port, &sr, &stm32_port->last_res,
+ threaded)) {
+@@ -277,10 +274,7 @@ static void stm32_usart_receive_chars(struct uart_port *port, bool threaded)
+ uart_insert_char(port, sr, USART_SR_ORE, c, flag);
+ }
+
+- if (threaded)
+- spin_unlock_irqrestore(&port->lock, flags);
+- else
+- spin_unlock(&port->lock);
++ spin_unlock(&port->lock);
+
+ tty_flip_buffer_push(tport);
+ }
+@@ -653,7 +647,8 @@ static int stm32_usart_startup(struct uart_port *port)
+
+ ret = request_threaded_irq(port->irq, stm32_usart_interrupt,
+ stm32_usart_threaded_interrupt,
+- IRQF_NO_SUSPEND, name, port);
++ IRQF_ONESHOT | IRQF_NO_SUSPEND,
++ name, port);
+ if (ret)
+ return ret;
+
+@@ -1126,6 +1121,13 @@ static int stm32_usart_of_dma_rx_probe(struct stm32_port *stm32port,
+ struct dma_async_tx_descriptor *desc = NULL;
+ int ret;
+
++ /*
++ * Using DMA and threaded handler for the console could lead to
++ * deadlocks.
++ */
++ if (uart_console(port))
++ return -ENODEV;
++
+ /* Request DMA RX channel */
+ stm32port->rx_ch = dma_request_slave_channel(dev, "rx");
+ if (!stm32port->rx_ch) {
+--
+2.30.2
+
arm-dts-imx7d-pico-fix-the-tuning-step-property.patch
arm-dts-imx-emcon-avari-fix-nxp-pca8574-gpio-cells.patch
bus-ti-sysc-fix-flakey-idling-of-uarts-and-stop-usin.patch
+tipc-add-extack-messages-for-bearer-media-failure.patch
+tipc-fix-unique-bearer-names-sanity-check.patch
+serial-stm32-fix-threaded-interrupt-handling.patch
+riscv-vdso-fix-and-clean-up-makefile.patch
+io_uring-fix-link-timeout-refs.patch
+io_uring-use-better-types-for-cflags.patch
+drm-amdgpu-vcn3-add-cancel_delayed_work_sync-before-.patch
+drm-amdgpu-jpeg2.5-add-cancel_delayed_work_sync-befo.patch
+drm-amdgpu-jpeg3-add-cancel_delayed_work_sync-before.patch
--- /dev/null
+From 1a16342ed867acf0bd281d3ad77080e645b7b35a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Mar 2021 08:56:41 +0700
+Subject: tipc: add extack messages for bearer/media failure
+
+From: Hoang Le <hoang.h.le@dektech.com.au>
+
+[ Upstream commit b83e214b2e04204f1fc674574362061492c37245 ]
+
+Add extack error messages for -EINVAL errors when enabling bearer,
+getting/setting properties for a media/bearer
+
+Acked-by: Jon Maloy <jmaloy@redhat.com>
+Signed-off-by: Hoang Le <hoang.h.le@dektech.com.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/bearer.c | 50 +++++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 40 insertions(+), 10 deletions(-)
+
+diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
+index 650414110452..4d0e11623e5c 100644
+--- a/net/tipc/bearer.c
++++ b/net/tipc/bearer.c
+@@ -234,7 +234,8 @@ void tipc_bearer_remove_dest(struct net *net, u32 bearer_id, u32 dest)
+ */
+ static int tipc_enable_bearer(struct net *net, const char *name,
+ u32 disc_domain, u32 prio,
+- struct nlattr *attr[])
++ struct nlattr *attr[],
++ struct netlink_ext_ack *extack)
+ {
+ struct tipc_net *tn = tipc_net(net);
+ struct tipc_bearer_names b_names;
+@@ -248,17 +249,20 @@ static int tipc_enable_bearer(struct net *net, const char *name,
+
+ if (!bearer_name_validate(name, &b_names)) {
+ errstr = "illegal name";
++ NL_SET_ERR_MSG(extack, "Illegal name");
+ goto rejected;
+ }
+
+ if (prio > TIPC_MAX_LINK_PRI && prio != TIPC_MEDIA_LINK_PRI) {
+ errstr = "illegal priority";
++ NL_SET_ERR_MSG(extack, "Illegal priority");
+ goto rejected;
+ }
+
+ m = tipc_media_find(b_names.media_name);
+ if (!m) {
+ errstr = "media not registered";
++ NL_SET_ERR_MSG(extack, "Media not registered");
+ goto rejected;
+ }
+
+@@ -272,6 +276,7 @@ static int tipc_enable_bearer(struct net *net, const char *name,
+ break;
+ if (!strcmp(name, b->name)) {
+ errstr = "already enabled";
++ NL_SET_ERR_MSG(extack, "Already enabled");
+ goto rejected;
+ }
+ bearer_id++;
+@@ -283,6 +288,7 @@ static int tipc_enable_bearer(struct net *net, const char *name,
+ name, prio);
+ if (prio == TIPC_MIN_LINK_PRI) {
+ errstr = "cannot adjust to lower";
++ NL_SET_ERR_MSG(extack, "Cannot adjust to lower");
+ goto rejected;
+ }
+ pr_warn("Bearer <%s>: trying with adjusted priority\n", name);
+@@ -293,6 +299,7 @@ static int tipc_enable_bearer(struct net *net, const char *name,
+
+ if (bearer_id >= MAX_BEARERS) {
+ errstr = "max 3 bearers permitted";
++ NL_SET_ERR_MSG(extack, "Max 3 bearers permitted");
+ goto rejected;
+ }
+
+@@ -306,6 +313,7 @@ static int tipc_enable_bearer(struct net *net, const char *name,
+ if (res) {
+ kfree(b);
+ errstr = "failed to enable media";
++ NL_SET_ERR_MSG(extack, "Failed to enable media");
+ goto rejected;
+ }
+
+@@ -322,6 +330,7 @@ static int tipc_enable_bearer(struct net *net, const char *name,
+ if (res) {
+ bearer_disable(net, b);
+ errstr = "failed to create discoverer";
++ NL_SET_ERR_MSG(extack, "Failed to create discoverer");
+ goto rejected;
+ }
+
+@@ -894,6 +903,7 @@ int tipc_nl_bearer_get(struct sk_buff *skb, struct genl_info *info)
+ bearer = tipc_bearer_find(net, name);
+ if (!bearer) {
+ err = -EINVAL;
++ NL_SET_ERR_MSG(info->extack, "Bearer not found");
+ goto err_out;
+ }
+
+@@ -933,8 +943,10 @@ int __tipc_nl_bearer_disable(struct sk_buff *skb, struct genl_info *info)
+ name = nla_data(attrs[TIPC_NLA_BEARER_NAME]);
+
+ bearer = tipc_bearer_find(net, name);
+- if (!bearer)
++ if (!bearer) {
++ NL_SET_ERR_MSG(info->extack, "Bearer not found");
+ return -EINVAL;
++ }
+
+ bearer_disable(net, bearer);
+
+@@ -992,7 +1004,8 @@ int __tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info)
+ prio = nla_get_u32(props[TIPC_NLA_PROP_PRIO]);
+ }
+
+- return tipc_enable_bearer(net, bearer, domain, prio, attrs);
++ return tipc_enable_bearer(net, bearer, domain, prio, attrs,
++ info->extack);
+ }
+
+ int tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info)
+@@ -1031,6 +1044,7 @@ int tipc_nl_bearer_add(struct sk_buff *skb, struct genl_info *info)
+ b = tipc_bearer_find(net, name);
+ if (!b) {
+ rtnl_unlock();
++ NL_SET_ERR_MSG(info->extack, "Bearer not found");
+ return -EINVAL;
+ }
+
+@@ -1071,8 +1085,10 @@ int __tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info)
+ name = nla_data(attrs[TIPC_NLA_BEARER_NAME]);
+
+ b = tipc_bearer_find(net, name);
+- if (!b)
++ if (!b) {
++ NL_SET_ERR_MSG(info->extack, "Bearer not found");
+ return -EINVAL;
++ }
+
+ if (attrs[TIPC_NLA_BEARER_PROP]) {
+ struct nlattr *props[TIPC_NLA_PROP_MAX + 1];
+@@ -1091,12 +1107,18 @@ int __tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info)
+ if (props[TIPC_NLA_PROP_WIN])
+ b->max_win = nla_get_u32(props[TIPC_NLA_PROP_WIN]);
+ if (props[TIPC_NLA_PROP_MTU]) {
+- if (b->media->type_id != TIPC_MEDIA_TYPE_UDP)
++ if (b->media->type_id != TIPC_MEDIA_TYPE_UDP) {
++ NL_SET_ERR_MSG(info->extack,
++ "MTU property is unsupported");
+ return -EINVAL;
++ }
+ #ifdef CONFIG_TIPC_MEDIA_UDP
+ if (tipc_udp_mtu_bad(nla_get_u32
+- (props[TIPC_NLA_PROP_MTU])))
++ (props[TIPC_NLA_PROP_MTU]))) {
++ NL_SET_ERR_MSG(info->extack,
++ "MTU value is out-of-range");
+ return -EINVAL;
++ }
+ b->mtu = nla_get_u32(props[TIPC_NLA_PROP_MTU]);
+ tipc_node_apply_property(net, b, TIPC_NLA_PROP_MTU);
+ #endif
+@@ -1224,6 +1246,7 @@ int tipc_nl_media_get(struct sk_buff *skb, struct genl_info *info)
+ rtnl_lock();
+ media = tipc_media_find(name);
+ if (!media) {
++ NL_SET_ERR_MSG(info->extack, "Media not found");
+ err = -EINVAL;
+ goto err_out;
+ }
+@@ -1260,9 +1283,10 @@ int __tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info)
+ name = nla_data(attrs[TIPC_NLA_MEDIA_NAME]);
+
+ m = tipc_media_find(name);
+- if (!m)
++ if (!m) {
++ NL_SET_ERR_MSG(info->extack, "Media not found");
+ return -EINVAL;
+-
++ }
+ if (attrs[TIPC_NLA_MEDIA_PROP]) {
+ struct nlattr *props[TIPC_NLA_PROP_MAX + 1];
+
+@@ -1278,12 +1302,18 @@ int __tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info)
+ if (props[TIPC_NLA_PROP_WIN])
+ m->max_win = nla_get_u32(props[TIPC_NLA_PROP_WIN]);
+ if (props[TIPC_NLA_PROP_MTU]) {
+- if (m->type_id != TIPC_MEDIA_TYPE_UDP)
++ if (m->type_id != TIPC_MEDIA_TYPE_UDP) {
++ NL_SET_ERR_MSG(info->extack,
++ "MTU property is unsupported");
+ return -EINVAL;
++ }
+ #ifdef CONFIG_TIPC_MEDIA_UDP
+ if (tipc_udp_mtu_bad(nla_get_u32
+- (props[TIPC_NLA_PROP_MTU])))
++ (props[TIPC_NLA_PROP_MTU]))) {
++ NL_SET_ERR_MSG(info->extack,
++ "MTU value is out-of-range");
+ return -EINVAL;
++ }
+ m->mtu = nla_get_u32(props[TIPC_NLA_PROP_MTU]);
+ #endif
+ }
+--
+2.30.2
+
--- /dev/null
+From e6bc25f6c3302c20f9fa8e983fa808c0aaa88285 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Apr 2021 09:30:48 +0700
+Subject: tipc: fix unique bearer names sanity check
+
+From: Hoang Le <hoang.h.le@dektech.com.au>
+
+[ Upstream commit f20a46c3044c3f75232b3d0e2d09af9b25efaf45 ]
+
+When enabling a bearer by name, we don't sanity check its name with
+higher slot in bearer list. This may have the effect that the name
+of an already enabled bearer bypasses the check.
+
+To fix the above issue, we just perform an extra checking with all
+existing bearers.
+
+Fixes: cb30a63384bc9 ("tipc: refactor function tipc_enable_bearer()")
+Cc: stable@vger.kernel.org
+Acked-by: Jon Maloy <jmaloy@redhat.com>
+Signed-off-by: Hoang Le <hoang.h.le@dektech.com.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/bearer.c | 46 +++++++++++++++++++++++++++-------------------
+ 1 file changed, 27 insertions(+), 19 deletions(-)
+
+diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
+index 4d0e11623e5c..12e535b43d88 100644
+--- a/net/tipc/bearer.c
++++ b/net/tipc/bearer.c
+@@ -246,6 +246,7 @@ static int tipc_enable_bearer(struct net *net, const char *name,
+ int bearer_id = 0;
+ int res = -EINVAL;
+ char *errstr = "";
++ u32 i;
+
+ if (!bearer_name_validate(name, &b_names)) {
+ errstr = "illegal name";
+@@ -270,31 +271,38 @@ static int tipc_enable_bearer(struct net *net, const char *name,
+ prio = m->priority;
+
+ /* Check new bearer vs existing ones and find free bearer id if any */
+- while (bearer_id < MAX_BEARERS) {
+- b = rtnl_dereference(tn->bearer_list[bearer_id]);
+- if (!b)
+- break;
++ bearer_id = MAX_BEARERS;
++ i = MAX_BEARERS;
++ while (i-- != 0) {
++ b = rtnl_dereference(tn->bearer_list[i]);
++ if (!b) {
++ bearer_id = i;
++ continue;
++ }
+ if (!strcmp(name, b->name)) {
+ errstr = "already enabled";
+ NL_SET_ERR_MSG(extack, "Already enabled");
+ goto rejected;
+ }
+- bearer_id++;
+- if (b->priority != prio)
+- continue;
+- if (++with_this_prio <= 2)
+- continue;
+- pr_warn("Bearer <%s>: already 2 bearers with priority %u\n",
+- name, prio);
+- if (prio == TIPC_MIN_LINK_PRI) {
+- errstr = "cannot adjust to lower";
+- NL_SET_ERR_MSG(extack, "Cannot adjust to lower");
+- goto rejected;
++
++ if (b->priority == prio &&
++ (++with_this_prio > 2)) {
++ pr_warn("Bearer <%s>: already 2 bearers with priority %u\n",
++ name, prio);
++
++ if (prio == TIPC_MIN_LINK_PRI) {
++ errstr = "cannot adjust to lower";
++ NL_SET_ERR_MSG(extack, "Cannot adjust to lower");
++ goto rejected;
++ }
++
++ pr_warn("Bearer <%s>: trying with adjusted priority\n",
++ name);
++ prio--;
++ bearer_id = MAX_BEARERS;
++ i = MAX_BEARERS;
++ with_this_prio = 1;
+ }
+- pr_warn("Bearer <%s>: trying with adjusted priority\n", name);
+- prio--;
+- bearer_id = 0;
+- with_this_prio = 1;
+ }
+
+ if (bearer_id >= MAX_BEARERS) {
+--
+2.30.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
