--- /dev/null
+From 0fe3dbbefb74a8575f61d7801b08dbc50523d60d Mon Sep 17 00:00:00 2001
+From: Tao Liu <thomas.liu@ucloud.cn>
+Date: Mon, 27 Jun 2022 22:00:04 +0800
+Subject: linux/dim: Fix divide by 0 in RDMA DIM
+
+From: Tao Liu <thomas.liu@ucloud.cn>
+
+commit 0fe3dbbefb74a8575f61d7801b08dbc50523d60d upstream.
+
+Fix a divide 0 error in rdma_dim_stats_compare() when prev->cpe_ratio ==
+0.
+
+CallTrace:
+ Hardware name: H3C R4900 G3/RS33M2C9S, BIOS 2.00.37P21 03/12/2020
+ task: ffff880194b78000 task.stack: ffffc90006714000
+ RIP: 0010:backport_rdma_dim+0x10e/0x240 [mlx_compat]
+ RSP: 0018:ffff880c10e83ec0 EFLAGS: 00010202
+ RAX: 0000000000002710 RBX: ffff88096cd7f780 RCX: 0000000000000064
+ RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000001
+ RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
+ R10: 0000000000000000 R11: 0000000000000000 R12: 000000001d7c6c09
+ R13: ffff88096cd7f780 R14: ffff880b174fe800 R15: 0000000000000000
+ FS: 0000000000000000(0000) GS:ffff880c10e80000(0000)
+ knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00000000a0965b00 CR3: 000000000200a003 CR4: 00000000007606e0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ PKRU: 55555554
+ Call Trace:
+ <IRQ>
+ ib_poll_handler+0x43/0x80 [ib_core]
+ irq_poll_softirq+0xae/0x110
+ __do_softirq+0xd1/0x28c
+ irq_exit+0xde/0xf0
+ do_IRQ+0x54/0xe0
+ common_interrupt+0x8f/0x8f
+ </IRQ>
+ ? cpuidle_enter_state+0xd9/0x2a0
+ ? cpuidle_enter_state+0xc7/0x2a0
+ ? do_idle+0x170/0x1d0
+ ? cpu_startup_entry+0x6f/0x80
+ ? start_secondary+0x1b9/0x210
+ ? secondary_startup_64+0xa5/0xb0
+ Code: 0f 87 e1 00 00 00 8b 4c 24 14 44 8b 43 14 89 c8 4d 63 c8 44 29 c0 99 31 d0 29 d0 31 d2 48 98 48 8d 04 80 48 8d 04 80 48 c1 e0 02 <49> f7 f1 48 83 f8 0a 0f 86 c1 00 00 00 44 39 c1 7f 10 48 89 df
+ RIP: backport_rdma_dim+0x10e/0x240 [mlx_compat] RSP: ffff880c10e83ec0
+
+Fixes: f4915455dcf0 ("linux/dim: Implement RDMA adaptive moderation (DIM)")
+Link: https://lore.kernel.org/r/20220627140004.3099-1-thomas.liu@ucloud.cn
+Signed-off-by: Tao Liu <thomas.liu@ucloud.cn>
+Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com>
+Acked-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/dim.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/dim.h
++++ b/include/linux/dim.h
+@@ -21,7 +21,7 @@
+ * We consider 10% difference as significant.
+ */
+ #define IS_SIGNIFICANT_DIFF(val, ref) \
+- (((100UL * abs((val) - (ref))) / (ref)) > 10)
++ ((ref) && (((100UL * abs((val) - (ref))) / (ref)) > 10))
+
+ /*
+ * Calculate the gap between two values.
--- /dev/null
+From 06e445f740c1a0fe5d16b3dff8a4ef18e124e54e Mon Sep 17 00:00:00 2001
+From: Ossama Othman <ossama.othman@intel.com>
+Date: Mon, 27 Jun 2022 18:02:42 -0700
+Subject: mptcp: fix conflict with <netinet/in.h>
+
+From: Ossama Othman <ossama.othman@intel.com>
+
+commit 06e445f740c1a0fe5d16b3dff8a4ef18e124e54e upstream.
+
+Including <linux/mptcp.h> before the C library <netinet/in.h> header
+causes symbol redefinition errors at compile-time due to duplicate
+declarations and definitions in the <linux/in.h> header included by
+<linux/mptcp.h>.
+
+Explicitly include <netinet/in.h> before <linux/in.h> in
+<linux/mptcp.h> when __KERNEL__ is not defined so that the C library
+compatibility logic in <linux/libc-compat.h> is enabled when including
+<linux/mptcp.h> in user space code.
+
+Fixes: c11c5906bc0a ("mptcp: add MPTCP_SUBFLOW_ADDRS getsockopt support")
+Signed-off-by: Ossama Othman <ossama.othman@intel.com>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/uapi/linux/mptcp.h | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/include/uapi/linux/mptcp.h b/include/uapi/linux/mptcp.h
+index 921963589904..dfe19bf13f4c 100644
+--- a/include/uapi/linux/mptcp.h
++++ b/include/uapi/linux/mptcp.h
+@@ -2,16 +2,17 @@
+ #ifndef _UAPI_MPTCP_H
+ #define _UAPI_MPTCP_H
+
++#ifndef __KERNEL__
++#include <netinet/in.h> /* for sockaddr_in and sockaddr_in6 */
++#include <sys/socket.h> /* for struct sockaddr */
++#endif
++
+ #include <linux/const.h>
+ #include <linux/types.h>
+ #include <linux/in.h> /* for sockaddr_in */
+ #include <linux/in6.h> /* for sockaddr_in6 */
+ #include <linux/socket.h> /* for sockaddr_storage and sa_family */
+
+-#ifndef __KERNEL__
+-#include <sys/socket.h> /* for struct sockaddr */
+-#endif
+-
+ #define MPTCP_SUBFLOW_FLAG_MCAP_REM _BITUL(0)
+ #define MPTCP_SUBFLOW_FLAG_MCAP_LOC _BITUL(1)
+ #define MPTCP_SUBFLOW_FLAG_JOIN_REM _BITUL(2)
+--
+2.37.0
+
--- /dev/null
+From 6aeed9045071f2252ff4e98fc13d1e304f33e5b0 Mon Sep 17 00:00:00 2001
+From: Paolo Abeni <pabeni@redhat.com>
+Date: Mon, 27 Jun 2022 18:02:40 -0700
+Subject: mptcp: fix race on unaccepted mptcp sockets
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+commit 6aeed9045071f2252ff4e98fc13d1e304f33e5b0 upstream.
+
+When the listener socket owning the relevant request is closed,
+it frees the unaccepted subflows and that causes later deletion
+of the paired MPTCP sockets.
+
+The mptcp socket's worker can run in the time interval between such delete
+operations. When that happens, any access to msk->first will cause an UaF
+access, as the subflow cleanup did not cleared such field in the mptcp
+socket.
+
+Address the issue explicitly traversing the listener socket accept
+queue at close time and performing the needed cleanup on the pending
+msk.
+
+Note that the locking is a bit tricky, as we need to acquire the msk
+socket lock, while still owning the subflow socket one.
+
+Fixes: 86e39e04482b ("mptcp: keep track of local endpoint still available for each msk")
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/protocol.c | 5 ++++
+ net/mptcp/protocol.h | 2 +
+ net/mptcp/subflow.c | 52 +++++++++++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 59 insertions(+)
+
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -2305,6 +2305,11 @@ static void __mptcp_close_ssk(struct soc
+ kfree_rcu(subflow, rcu);
+ } else {
+ /* otherwise tcp will dispose of the ssk and subflow ctx */
++ if (ssk->sk_state == TCP_LISTEN) {
++ tcp_set_state(ssk, TCP_CLOSE);
++ mptcp_subflow_queue_clean(ssk);
++ inet_csk_listen_stop(ssk);
++ }
+ __tcp_close(ssk, 0);
+
+ /* close acquired an extra ref */
+--- a/net/mptcp/protocol.h
++++ b/net/mptcp/protocol.h
+@@ -286,6 +286,7 @@ struct mptcp_sock {
+
+ u32 setsockopt_seq;
+ char ca_name[TCP_CA_NAME_MAX];
++ struct mptcp_sock *dl_next;
+ };
+
+ #define mptcp_data_lock(sk) spin_lock_bh(&(sk)->sk_lock.slock)
+@@ -585,6 +586,7 @@ void mptcp_close_ssk(struct sock *sk, st
+ struct mptcp_subflow_context *subflow);
+ void mptcp_subflow_send_ack(struct sock *ssk);
+ void mptcp_subflow_reset(struct sock *ssk);
++void mptcp_subflow_queue_clean(struct sock *ssk);
+ void mptcp_sock_graft(struct sock *sk, struct socket *parent);
+ struct socket *__mptcp_nmpc_socket(const struct mptcp_sock *msk);
+
+--- a/net/mptcp/subflow.c
++++ b/net/mptcp/subflow.c
+@@ -1688,6 +1688,58 @@ static void subflow_state_change(struct
+ }
+ }
+
++void mptcp_subflow_queue_clean(struct sock *listener_ssk)
++{
++ struct request_sock_queue *queue = &inet_csk(listener_ssk)->icsk_accept_queue;
++ struct mptcp_sock *msk, *next, *head = NULL;
++ struct request_sock *req;
++
++ /* build a list of all unaccepted mptcp sockets */
++ spin_lock_bh(&queue->rskq_lock);
++ for (req = queue->rskq_accept_head; req; req = req->dl_next) {
++ struct mptcp_subflow_context *subflow;
++ struct sock *ssk = req->sk;
++ struct mptcp_sock *msk;
++
++ if (!sk_is_mptcp(ssk))
++ continue;
++
++ subflow = mptcp_subflow_ctx(ssk);
++ if (!subflow || !subflow->conn)
++ continue;
++
++ /* skip if already in list */
++ msk = mptcp_sk(subflow->conn);
++ if (msk->dl_next || msk == head)
++ continue;
++
++ msk->dl_next = head;
++ head = msk;
++ }
++ spin_unlock_bh(&queue->rskq_lock);
++ if (!head)
++ return;
++
++ /* can't acquire the msk socket lock under the subflow one,
++ * or will cause ABBA deadlock
++ */
++ release_sock(listener_ssk);
++
++ for (msk = head; msk; msk = next) {
++ struct sock *sk = (struct sock *)msk;
++ bool slow;
++
++ slow = lock_sock_fast_nested(sk);
++ next = msk->dl_next;
++ msk->first = NULL;
++ msk->dl_next = NULL;
++ unlock_sock_fast(sk, slow);
++ }
++
++ /* we are still under the listener msk socket lock */
++ lock_sock_nested(listener_ssk, SINGLE_DEPTH_NESTING);
++}
++
+ static int subflow_ulp_init(struct sock *sk)
+ {
+ struct inet_connection_sock *icsk = inet_csk(sk);
--- /dev/null
+From c96614eeab663646f57f67aa591e015abd8bd0ba Mon Sep 17 00:00:00 2001
+From: Enguerrand de Ribaucourt <enguerrand.de-ribaucourt@savoirfairelinux.com>
+Date: Thu, 23 Jun 2022 15:46:44 +0200
+Subject: net: dp83822: disable false carrier interrupt
+
+From: Enguerrand de Ribaucourt <enguerrand.de-ribaucourt@savoirfairelinux.com>
+
+commit c96614eeab663646f57f67aa591e015abd8bd0ba upstream.
+
+When unplugging an Ethernet cable, false carrier events were produced by
+the PHY at a very high rate. Once the false carrier counter full, an
+interrupt was triggered every few clock cycles until the cable was
+replugged. This resulted in approximately 10k/s interrupts.
+
+Since the false carrier counter (FCSCR) is never used, we can safely
+disable this interrupt.
+
+In addition to improving performance, this also solved MDIO read
+timeouts I was randomly encountering with an i.MX8 fec MAC because of
+the interrupt flood. The interrupt count and MDIO timeout fix were
+tested on a v5.4.110 kernel.
+
+Fixes: 87461f7a58ab ("net: phy: DP83822 initial driver submission")
+Signed-off-by: Enguerrand de Ribaucourt <enguerrand.de-ribaucourt@savoirfairelinux.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/dp83822.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/net/phy/dp83822.c
++++ b/drivers/net/phy/dp83822.c
+@@ -229,7 +229,6 @@ static int dp83822_config_intr(struct ph
+ return misr_status;
+
+ misr_status |= (DP83822_RX_ERR_HF_INT_EN |
+- DP83822_FALSE_CARRIER_HF_INT_EN |
+ DP83822_LINK_STAT_INT_EN |
+ DP83822_ENERGY_DET_INT_EN |
+ DP83822_LINK_QUAL_INT_EN);
--- /dev/null
+From 0e597e2affb90d6ea48df6890d882924acf71e19 Mon Sep 17 00:00:00 2001
+From: Enguerrand de Ribaucourt <enguerrand.de-ribaucourt@savoirfairelinux.com>
+Date: Thu, 23 Jun 2022 15:46:45 +0200
+Subject: net: dp83822: disable rx error interrupt
+
+From: Enguerrand de Ribaucourt <enguerrand.de-ribaucourt@savoirfairelinux.com>
+
+commit 0e597e2affb90d6ea48df6890d882924acf71e19 upstream.
+
+Some RX errors, notably when disconnecting the cable, increase the RCSR
+register. Once half full (0x7fff), an interrupt flood is generated. I
+measured ~3k/s interrupts even after the RX errors transfer was
+stopped.
+
+Since we don't read and clear the RCSR register, we should disable this
+interrupt.
+
+Fixes: 87461f7a58ab ("net: phy: DP83822 initial driver submission")
+Signed-off-by: Enguerrand de Ribaucourt <enguerrand.de-ribaucourt@savoirfairelinux.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/dp83822.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/phy/dp83822.c
++++ b/drivers/net/phy/dp83822.c
+@@ -228,8 +228,7 @@ static int dp83822_config_intr(struct ph
+ if (misr_status < 0)
+ return misr_status;
+
+- misr_status |= (DP83822_RX_ERR_HF_INT_EN |
+- DP83822_LINK_STAT_INT_EN |
++ misr_status |= (DP83822_LINK_STAT_INT_EN |
+ DP83822_ENERGY_DET_INT_EN |
+ DP83822_LINK_QUAL_INT_EN);
+
--- /dev/null
+From 7c97bc0128b2eecc703106112679a69d446d1a12 Mon Sep 17 00:00:00 2001
+From: Doug Berger <opendmb@gmail.com>
+Date: Wed, 22 Jun 2022 20:02:04 -0700
+Subject: net: dsa: bcm_sf2: force pause link settings
+
+From: Doug Berger <opendmb@gmail.com>
+
+commit 7c97bc0128b2eecc703106112679a69d446d1a12 upstream.
+
+The pause settings reported by the PHY should also be applied to the GMII port
+status override otherwise the switch will not generate pause frames towards the
+link partner despite the advertisement saying otherwise.
+
+Fixes: 246d7f773c13 ("net: dsa: add Broadcom SF2 switch driver")
+Signed-off-by: Doug Berger <opendmb@gmail.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20220623030204.1966851-1-f.fainelli@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/bcm_sf2.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -878,6 +878,11 @@ static void bcm_sf2_sw_mac_link_up(struc
+ if (duplex == DUPLEX_FULL)
+ reg |= DUPLX_MODE;
+
++ if (tx_pause)
++ reg |= TXFLOW_CNTL;
++ if (rx_pause)
++ reg |= RXFLOW_CNTL;
++
+ core_writel(priv, reg, offset);
+ }
+
--- /dev/null
+From 3b89b511ea0c705cc418440e2abf9d692a556d84 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 23 Jun 2022 16:32:32 +0300
+Subject: net: fix IFF_TX_SKB_NO_LINEAR definition
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 3b89b511ea0c705cc418440e2abf9d692a556d84 upstream.
+
+The "1<<31" shift has a sign extension bug so IFF_TX_SKB_NO_LINEAR is
+0xffffffff80000000 instead of 0x0000000080000000.
+
+Fixes: c2ff53d8049f ("net: Add priv_flags for allow tx skb without linear")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
+Link: https://lore.kernel.org/r/YrRrcGttfEVnf85Q@kili
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/netdevice.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -1653,7 +1653,7 @@ enum netdev_priv_flags {
+ IFF_FAILOVER_SLAVE = 1<<28,
+ IFF_L3MDEV_RX_HANDLER = 1<<29,
+ IFF_LIVE_RENAME_OK = 1<<30,
+- IFF_TX_SKB_NO_LINEAR = 1<<31,
++ IFF_TX_SKB_NO_LINEAR = BIT_ULL(31),
+ IFF_CHANGE_PROTO_DOWN = BIT_ULL(32),
+ };
+
--- /dev/null
+From a8fc8cb5692aebb9c6f7afd4265366d25dcd1d01 Mon Sep 17 00:00:00 2001
+From: Jakub Kicinski <kuba@kernel.org>
+Date: Wed, 22 Jun 2022 21:21:05 -0700
+Subject: net: tun: stop NAPI when detaching queues
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+commit a8fc8cb5692aebb9c6f7afd4265366d25dcd1d01 upstream.
+
+While looking at a syzbot report I noticed the NAPI only gets
+disabled before it's deleted. I think that user can detach
+the queue before destroying the device and the NAPI will never
+be stopped.
+
+Fixes: 943170998b20 ("tun: enable NAPI for TUN/TAP driver")
+Acked-by: Petar Penkov <ppenkov@aviatrix.com>
+Link: https://lore.kernel.org/r/20220623042105.2274812-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/tun.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -274,6 +274,12 @@ static void tun_napi_init(struct tun_str
+ }
+ }
+
++static void tun_napi_enable(struct tun_file *tfile)
++{
++ if (tfile->napi_enabled)
++ napi_enable(&tfile->napi);
++}
++
+ static void tun_napi_disable(struct tun_file *tfile)
+ {
+ if (tfile->napi_enabled)
+@@ -654,8 +660,10 @@ static void __tun_detach(struct tun_file
+ if (clean) {
+ RCU_INIT_POINTER(tfile->tun, NULL);
+ sock_put(&tfile->sk);
+- } else
++ } else {
+ tun_disable_queue(tun, tfile);
++ tun_napi_disable(tfile);
++ }
+
+ synchronize_net();
+ tun_flow_delete_by_queue(tun, tun->numqueues + 1);
+@@ -809,6 +817,7 @@ static int tun_attach(struct tun_struct
+
+ if (tfile->detached) {
+ tun_enable_queue(tfile);
++ tun_napi_enable(tfile);
+ } else {
+ sock_hold(&tfile->sk);
+ tun_napi_init(tun, tfile, napi, napi_frags);
--- /dev/null
+From 3b9bc84d311104906d2b4995a9a02d7b7ddab2db Mon Sep 17 00:00:00 2001
+From: Jakub Kicinski <kuba@kernel.org>
+Date: Wed, 22 Jun 2022 21:20:39 -0700
+Subject: net: tun: unlink NAPI from device on destruction
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+commit 3b9bc84d311104906d2b4995a9a02d7b7ddab2db upstream.
+
+Syzbot found a race between tun file and device destruction.
+NAPIs live in struct tun_file which can get destroyed before
+the netdev so we have to del them explicitly. The current
+code is missing deleting the NAPI if the queue was detached
+first.
+
+Fixes: 943170998b20 ("tun: enable NAPI for TUN/TAP driver")
+Reported-by: syzbot+b75c138e9286ac742647@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/r/20220623042039.2274708-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/tun.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -728,6 +728,7 @@ static void tun_detach_all(struct net_de
+ sock_put(&tfile->sk);
+ }
+ list_for_each_entry_safe(tfile, tmp, &tun->disabled, next) {
++ tun_napi_del(tfile);
+ tun_enable_queue(tfile);
+ tun_queue_purge(tfile);
+ xdp_rxq_info_unreg(&tfile->xdp_rxq);
--- /dev/null
+From ce95ab775f8d8e89a038c0e5611a7381a2ef8e43 Mon Sep 17 00:00:00 2001
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+Date: Fri, 24 Jun 2022 09:51:39 +0200
+Subject: net: usb: asix: do not force pause frames support
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+commit ce95ab775f8d8e89a038c0e5611a7381a2ef8e43 upstream.
+
+We should respect link partner capabilities and not force flow control
+support on every link. Even more, in current state the MAC driver do not
+advertises pause support so we should not keep flow control enabled at
+all.
+
+Fixes: e532a096be0e ("net: usb: asix: ax88772: add phylib support")
+Reported-by: Anton Lundin <glance@acc.umu.se>
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Tested-by: Anton Lundin <glance@acc.umu.se>
+Link: https://lore.kernel.org/r/20220624075139.3139300-2-o.rempel@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/asix.h | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/usb/asix.h
++++ b/drivers/net/usb/asix.h
+@@ -126,8 +126,7 @@
+ AX_MEDIUM_RE)
+
+ #define AX88772_MEDIUM_DEFAULT \
+- (AX_MEDIUM_FD | AX_MEDIUM_RFC | \
+- AX_MEDIUM_TFC | AX_MEDIUM_PS | \
++ (AX_MEDIUM_FD | AX_MEDIUM_PS | \
+ AX_MEDIUM_AC | AX_MEDIUM_RE)
+
+ /* AX88772 & AX88178 RX_CTL values */
--- /dev/null
+From 2990f223ffa7bb25422956b9f79f9176a5b38346 Mon Sep 17 00:00:00 2001
+From: Miaoqian Lin <linmq006@gmail.com>
+Date: Tue, 21 Jun 2022 09:25:44 +0400
+Subject: RDMA/cm: Fix memory leak in ib_cm_insert_listen
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+commit 2990f223ffa7bb25422956b9f79f9176a5b38346 upstream.
+
+cm_alloc_id_priv() allocates resource for the cm_id_priv. When
+cm_init_listen() fails it doesn't free it, leading to memory leak.
+
+Add the missing error unwind.
+
+Fixes: 98f67156a80f ("RDMA/cm: Simplify establishing a listen cm_id")
+Link: https://lore.kernel.org/r/20220621052546.4821-1-linmq006@gmail.com
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/core/cm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/core/cm.c
++++ b/drivers/infiniband/core/cm.c
+@@ -1252,8 +1252,10 @@ struct ib_cm_id *ib_cm_insert_listen(str
+ return ERR_CAST(cm_id_priv);
+
+ err = cm_init_listen(cm_id_priv, service_id, 0);
+- if (err)
++ if (err) {
++ ib_destroy_cm_id(&cm_id_priv->id);
+ return ERR_PTR(err);
++ }
+
+ spin_lock_irq(&cm_id_priv->lock);
+ listen_id_priv = cm_insert_listen(cm_id_priv, cm_handler);
--- /dev/null
+From 118f767413ada4eef7825fbd4af7c0866f883441 Mon Sep 17 00:00:00 2001
+From: Kamal Heib <kamalheib1@gmail.com>
+Date: Wed, 25 May 2022 16:20:29 +0300
+Subject: RDMA/qedr: Fix reporting QP timeout attribute
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kamal Heib <kamalheib1@gmail.com>
+
+commit 118f767413ada4eef7825fbd4af7c0866f883441 upstream.
+
+Make sure to save the passed QP timeout attribute when the QP gets modified,
+so when calling query QP the right value is reported and not the
+converted value that is required by the firmware. This issue was found
+while running the pyverbs tests.
+
+Fixes: cecbcddf6461 ("qedr: Add support for QP verbs")
+Link: https://lore.kernel.org/r/20220525132029.84813-1-kamalheib1@gmail.com
+Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
+Acked-by: Michal Kalderon <michal.kalderon@marvell.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/qedr/qedr.h | 1 +
+ drivers/infiniband/hw/qedr/verbs.c | 4 +++-
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/qedr/qedr.h
++++ b/drivers/infiniband/hw/qedr/qedr.h
+@@ -418,6 +418,7 @@ struct qedr_qp {
+ u32 sq_psn;
+ u32 qkey;
+ u32 dest_qp_num;
++ u8 timeout;
+
+ /* Relevant to qps created from kernel space only (ULPs) */
+ u8 prev_wqe_size;
+--- a/drivers/infiniband/hw/qedr/verbs.c
++++ b/drivers/infiniband/hw/qedr/verbs.c
+@@ -2612,6 +2612,8 @@ int qedr_modify_qp(struct ib_qp *ibqp, s
+ 1 << max_t(int, attr->timeout - 8, 0);
+ else
+ qp_params.ack_timeout = 0;
++
++ qp->timeout = attr->timeout;
+ }
+
+ if (attr_mask & IB_QP_RETRY_CNT) {
+@@ -2771,7 +2773,7 @@ int qedr_query_qp(struct ib_qp *ibqp,
+ rdma_ah_set_dgid_raw(&qp_attr->ah_attr, ¶ms.dgid.bytes[0]);
+ rdma_ah_set_port_num(&qp_attr->ah_attr, 1);
+ rdma_ah_set_sl(&qp_attr->ah_attr, 0);
+- qp_attr->timeout = params.timeout;
++ qp_attr->timeout = qp->timeout;
+ qp_attr->rnr_retry = params.rnr_retry;
+ qp_attr->retry_cnt = params.retry_cnt;
+ qp_attr->min_rnr_timer = params.min_rnr_nak_timer;
--- /dev/null
+From fd37c2ecb21f7aee04ccca5f561469f07d00063c Mon Sep 17 00:00:00 2001
+From: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Date: Mon, 27 Jun 2022 18:02:43 -0700
+Subject: selftests: mptcp: Initialize variables to quiet gcc 12 warnings
+
+From: Mat Martineau <mathew.j.martineau@linux.intel.com>
+
+commit fd37c2ecb21f7aee04ccca5f561469f07d00063c upstream.
+
+In a few MPTCP selftest tools, gcc 12 complains that the 'sock' variable
+might be used uninitialized. This is a false positive because the only
+code path that could lead to uninitialized access is where getaddrinfo()
+fails, but the local xgetaddrinfo() wrapper exits if such a failure
+occurs.
+
+Initialize the 'sock' variable anyway to allow the tools to build with
+gcc 12.
+
+Fixes: 048d19d444be ("mptcp: add basic kselftest for mptcp")
+Acked-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/mptcp/mptcp_connect.c | 2 +-
+ tools/testing/selftests/net/mptcp/mptcp_inq.c | 2 +-
+ tools/testing/selftests/net/mptcp/mptcp_sockopt.c | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/tools/testing/selftests/net/mptcp/mptcp_connect.c
++++ b/tools/testing/selftests/net/mptcp/mptcp_connect.c
+@@ -265,7 +265,7 @@ static void sock_test_tcpulp(int sock, i
+ static int sock_listen_mptcp(const char * const listenaddr,
+ const char * const port)
+ {
+- int sock;
++ int sock = -1;
+ struct addrinfo hints = {
+ .ai_protocol = IPPROTO_TCP,
+ .ai_socktype = SOCK_STREAM,
+--- a/tools/testing/selftests/net/mptcp/mptcp_inq.c
++++ b/tools/testing/selftests/net/mptcp/mptcp_inq.c
+@@ -88,7 +88,7 @@ static void xgetaddrinfo(const char *nod
+ static int sock_listen_mptcp(const char * const listenaddr,
+ const char * const port)
+ {
+- int sock;
++ int sock = -1;
+ struct addrinfo hints = {
+ .ai_protocol = IPPROTO_TCP,
+ .ai_socktype = SOCK_STREAM,
+--- a/tools/testing/selftests/net/mptcp/mptcp_sockopt.c
++++ b/tools/testing/selftests/net/mptcp/mptcp_sockopt.c
+@@ -136,7 +136,7 @@ static void xgetaddrinfo(const char *nod
+ static int sock_listen_mptcp(const char * const listenaddr,
+ const char * const port)
+ {
+- int sock;
++ int sock = -1;
+ struct addrinfo hints = {
+ .ai_protocol = IPPROTO_TCP,
+ .ai_socktype = SOCK_STREAM,
--- /dev/null
+From 42fb6cddec3b306c9f6ef136b6438e0de1836431 Mon Sep 17 00:00:00 2001
+From: Paolo Abeni <pabeni@redhat.com>
+Date: Mon, 27 Jun 2022 18:02:41 -0700
+Subject: selftests: mptcp: more stable diag tests
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+commit 42fb6cddec3b306c9f6ef136b6438e0de1836431 upstream.
+
+The mentioned test-case still use an hard-coded-len sleep to
+wait for a relative large number of connection to be established.
+
+On very slow VM and with debug build such timeout could be exceeded,
+causing failures in our CI.
+
+Address the issue polling for the expected condition several times,
+up to an unreasonable high amount of time. On reasonably fast system
+the self-tests will be faster then before, on very slow one we will
+still catch the correct condition.
+
+Fixes: df62f2ec3df6 ("selftests/mptcp: add diag interface tests")
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/mptcp/diag.sh | 48 +++++++++++++++++++++++++-----
+ 1 file changed, 40 insertions(+), 8 deletions(-)
+
+--- a/tools/testing/selftests/net/mptcp/diag.sh
++++ b/tools/testing/selftests/net/mptcp/diag.sh
+@@ -61,6 +61,39 @@ chk_msk_nr()
+ __chk_nr "grep -c token:" $*
+ }
+
++wait_msk_nr()
++{
++ local condition="grep -c token:"
++ local expected=$1
++ local timeout=20
++ local msg nr
++ local max=0
++ local i=0
++
++ shift 1
++ msg=$*
++
++ while [ $i -lt $timeout ]; do
++ nr=$(ss -inmHMN $ns | $condition)
++ [ $nr == $expected ] && break;
++ [ $nr -gt $max ] && max=$nr
++ i=$((i + 1))
++ sleep 1
++ done
++
++ printf "%-50s" "$msg"
++ if [ $i -ge $timeout ]; then
++ echo "[ fail ] timeout while expecting $expected max $max last $nr"
++ ret=$test_cnt
++ elif [ $nr != $expected ]; then
++ echo "[ fail ] expected $expected found $nr"
++ ret=$test_cnt
++ else
++ echo "[ ok ]"
++ fi
++ test_cnt=$((test_cnt+1))
++}
++
+ chk_msk_fallback_nr()
+ {
+ __chk_nr "grep -c fallback" $*
+@@ -109,7 +142,7 @@ ip -n $ns link set dev lo up
+ echo "a" | \
+ timeout ${timeout_test} \
+ ip netns exec $ns \
+- ./mptcp_connect -p 10000 -l -t ${timeout_poll} \
++ ./mptcp_connect -p 10000 -l -t ${timeout_poll} -w 20 \
+ 0.0.0.0 >/dev/null &
+ wait_local_port_listen $ns 10000
+ chk_msk_nr 0 "no msk on netns creation"
+@@ -117,7 +150,7 @@ chk_msk_nr 0 "no msk on netns creation"
+ echo "b" | \
+ timeout ${timeout_test} \
+ ip netns exec $ns \
+- ./mptcp_connect -p 10000 -r 0 -t ${timeout_poll} \
++ ./mptcp_connect -p 10000 -r 0 -t ${timeout_poll} -w 20 \
+ 127.0.0.1 >/dev/null &
+ wait_connected $ns 10000
+ chk_msk_nr 2 "after MPC handshake "
+@@ -129,13 +162,13 @@ flush_pids
+ echo "a" | \
+ timeout ${timeout_test} \
+ ip netns exec $ns \
+- ./mptcp_connect -p 10001 -l -s TCP -t ${timeout_poll} \
++ ./mptcp_connect -p 10001 -l -s TCP -t ${timeout_poll} -w 20 \
+ 0.0.0.0 >/dev/null &
+ wait_local_port_listen $ns 10001
+ echo "b" | \
+ timeout ${timeout_test} \
+ ip netns exec $ns \
+- ./mptcp_connect -p 10001 -r 0 -t ${timeout_poll} \
++ ./mptcp_connect -p 10001 -r 0 -t ${timeout_poll} -w 20 \
+ 127.0.0.1 >/dev/null &
+ wait_connected $ns 10001
+ chk_msk_fallback_nr 1 "check fallback"
+@@ -146,7 +179,7 @@ for I in `seq 1 $NR_CLIENTS`; do
+ echo "a" | \
+ timeout ${timeout_test} \
+ ip netns exec $ns \
+- ./mptcp_connect -p $((I+10001)) -l -w 10 \
++ ./mptcp_connect -p $((I+10001)) -l -w 20 \
+ -t ${timeout_poll} 0.0.0.0 >/dev/null &
+ done
+ wait_local_port_listen $ns $((NR_CLIENTS + 10001))
+@@ -155,12 +188,11 @@ for I in `seq 1 $NR_CLIENTS`; do
+ echo "b" | \
+ timeout ${timeout_test} \
+ ip netns exec $ns \
+- ./mptcp_connect -p $((I+10001)) -w 10 \
++ ./mptcp_connect -p $((I+10001)) -w 20 \
+ -t ${timeout_poll} 127.0.0.1 >/dev/null &
+ done
+-sleep 1.5
+
+-chk_msk_nr $((NR_CLIENTS*2)) "many msk socket present"
++wait_msk_nr $((NR_CLIENTS*2)) "many msk socket present"
+ flush_pids
+
+ exit $ret
--- /dev/null
+From b968080808f7f28b89aa495b7402ba48eb17ee93 Mon Sep 17 00:00:00 2001
+From: Dimitris Michailidis <d.michailidis@fungible.com>
+Date: Wed, 22 Jun 2022 17:02:34 -0700
+Subject: selftests/net: pass ipv6_args to udpgso_bench's IPv6 TCP test
+
+From: Dimitris Michailidis <d.michailidis@fungible.com>
+
+commit b968080808f7f28b89aa495b7402ba48eb17ee93 upstream.
+
+udpgso_bench.sh has been running its IPv6 TCP test with IPv4 arguments
+since its initial conmit. Looks like a typo.
+
+Fixes: 3a687bef148d ("selftests: udp gso benchmark")
+Cc: willemb@google.com
+Signed-off-by: Dimitris Michailidis <dmichail@fungible.com>
+Acked-by: Willem de Bruijn <willemb@google.com>
+Link: https://lore.kernel.org/r/20220623000234.61774-1-dmichail@fungible.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/udpgso_bench.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/testing/selftests/net/udpgso_bench.sh
++++ b/tools/testing/selftests/net/udpgso_bench.sh
+@@ -120,7 +120,7 @@ run_all() {
+ run_udp "${ipv4_args}"
+
+ echo "ipv6"
+- run_tcp "${ipv4_args}"
++ run_tcp "${ipv6_args}"
+ run_udp "${ipv6_args}"
+ }
+
net-rose-fix-uaf-bugs-caused-by-timer-handler.patch
net-usb-ax88179_178a-fix-packet-receiving.patch
virtio-net-fix-race-between-ndo_open-and-virtio_device_ready.patch
+selftests-net-pass-ipv6_args-to-udpgso_bench-s-ipv6-tcp-test.patch
+net-dsa-bcm_sf2-force-pause-link-settings.patch
+net-tun-unlink-napi-from-device-on-destruction.patch
+net-tun-stop-napi-when-detaching-queues.patch
+net-fix-iff_tx_skb_no_linear-definition.patch
+net-dp83822-disable-false-carrier-interrupt.patch
+net-dp83822-disable-rx-error-interrupt.patch
+rdma-qedr-fix-reporting-qp-timeout-attribute.patch
+rdma-cm-fix-memory-leak-in-ib_cm_insert_listen.patch
+linux-dim-fix-divide-by-0-in-rdma-dim.patch
+net-usb-asix-do-not-force-pause-frames-support.patch
+usbnet-fix-memory-allocation-in-helpers.patch
+mptcp-fix-race-on-unaccepted-mptcp-sockets.patch
+selftests-mptcp-more-stable-diag-tests.patch
+mptcp-fix-conflict-with-netinet-in.h.patch
+selftests-mptcp-initialize-variables-to-quiet-gcc-12-warnings.patch
--- /dev/null
+From e65af5403e462ccd7dff6a045a886c64da598c2e Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.com>
+Date: Tue, 28 Jun 2022 11:35:17 +0200
+Subject: usbnet: fix memory allocation in helpers
+
+From: Oliver Neukum <oneukum@suse.com>
+
+commit e65af5403e462ccd7dff6a045a886c64da598c2e upstream.
+
+usbnet provides some helper functions that are also used in
+the context of reset() operations. During a reset the other
+drivers on a device are unable to operate. As that can be block
+drivers, a driver for another interface cannot use paging
+in its memory allocations without risking a deadlock.
+Use GFP_NOIO in the helpers.
+
+Fixes: 877bd862f32b8 ("usbnet: introduce usbnet 3 command helpers")
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Link: https://lore.kernel.org/r/20220628093517.7469-1-oneukum@suse.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/usbnet.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -2004,7 +2004,7 @@ static int __usbnet_read_cmd(struct usbn
+ cmd, reqtype, value, index, size);
+
+ if (size) {
+- buf = kmalloc(size, GFP_KERNEL);
++ buf = kmalloc(size, GFP_NOIO);
+ if (!buf)
+ goto out;
+ }
+@@ -2036,7 +2036,7 @@ static int __usbnet_write_cmd(struct usb
+ cmd, reqtype, value, index, size);
+
+ if (data) {
+- buf = kmemdup(data, size, GFP_KERNEL);
++ buf = kmemdup(data, size, GFP_NOIO);
+ if (!buf)
+ goto out;
+ } else {
projects / thirdparty / kernel / stable-queue.git / commitdiff
