--- /dev/null
+From 11e7a91994c29da96d847f676be023da6a2c1359 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 27 May 2020 21:48:30 +0300
+Subject: airo: Fix read overflows sending packets
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 11e7a91994c29da96d847f676be023da6a2c1359 upstream.
+
+The problem is that we always copy a minimum of ETH_ZLEN (60) bytes from
+skb->data even when skb->len is less than ETH_ZLEN so it leads to a read
+overflow.
+
+The fix is to pad skb->data to at least ETH_ZLEN bytes.
+
+Cc: <stable@vger.kernel.org>
+Reported-by: Hu Jiahui <kirin.say@gmail.com>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20200527184830.GA1164846@mwanda
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/cisco/airo.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/net/wireless/cisco/airo.c
++++ b/drivers/net/wireless/cisco/airo.c
+@@ -1925,6 +1925,10 @@ static netdev_tx_t mpi_start_xmit(struct
+ airo_print_err(dev->name, "%s: skb == NULL!",__func__);
+ return NETDEV_TX_OK;
+ }
++ if (skb_padto(skb, ETH_ZLEN)) {
++ dev->stats.tx_dropped++;
++ return NETDEV_TX_OK;
++ }
+ npacks = skb_queue_len (&ai->txq);
+
+ if (npacks >= MAXTXQ - 1) {
+@@ -2127,6 +2131,10 @@ static netdev_tx_t airo_start_xmit(struc
+ airo_print_err(dev->name, "%s: skb == NULL!", __func__);
+ return NETDEV_TX_OK;
+ }
++ if (skb_padto(skb, ETH_ZLEN)) {
++ dev->stats.tx_dropped++;
++ return NETDEV_TX_OK;
++ }
+
+ /* Find a vacant FID */
+ for( i = 0; i < MAX_FIDS / 2 && (fids[i] & 0xffff0000); i++ );
+@@ -2201,6 +2209,10 @@ static netdev_tx_t airo_start_xmit11(str
+ airo_print_err(dev->name, "%s: skb == NULL!", __func__);
+ return NETDEV_TX_OK;
+ }
++ if (skb_padto(skb, ETH_ZLEN)) {
++ dev->stats.tx_dropped++;
++ return NETDEV_TX_OK;
++ }
+
+ /* Find a vacant FID */
+ for( i = MAX_FIDS / 2; i < MAX_FIDS && (fids[i] & 0xffff0000); i++ );
--- /dev/null
+From 38152ea37d8bdaffa22603e0a5b5b86cfa8714c9 Mon Sep 17 00:00:00 2001
+From: DENG Qingfang <dqfext@gmail.com>
+Date: Wed, 13 May 2020 23:37:17 +0800
+Subject: net: dsa: mt7530: set CPU port to fallback mode
+
+From: DENG Qingfang <dqfext@gmail.com>
+
+commit 38152ea37d8bdaffa22603e0a5b5b86cfa8714c9 upstream.
+
+Currently, setting a bridge's self PVID to other value and deleting
+the default VID 1 renders untagged ports of that VLAN unable to talk to
+the CPU port:
+
+ bridge vlan add dev br0 vid 2 pvid untagged self
+ bridge vlan del dev br0 vid 1 self
+ bridge vlan add dev sw0p0 vid 2 pvid untagged
+ bridge vlan del dev sw0p0 vid 1
+ # br0 cannot send untagged frames out of sw0p0 anymore
+
+That is because the CPU port is set to security mode and its PVID is
+still 1, and untagged frames are dropped due to VLAN member violation.
+
+Set the CPU port to fallback mode so untagged frames can pass through.
+
+Fixes: 83163f7dca56 ("net: dsa: mediatek: add VLAN support for MT7530")
+Signed-off-by: DENG Qingfang <dqfext@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/dsa/mt7530.c | 11 ++++++++---
+ drivers/net/dsa/mt7530.h | 6 ++++++
+ 2 files changed, 14 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -818,10 +818,15 @@ mt7530_port_set_vlan_aware(struct dsa_sw
+ PCR_MATRIX_MASK, PCR_MATRIX(MT7530_ALL_MEMBERS));
+
+ /* Trapped into security mode allows packet forwarding through VLAN
+- * table lookup.
++ * table lookup. CPU port is set to fallback mode to let untagged
++ * frames pass through.
+ */
+- mt7530_rmw(priv, MT7530_PCR_P(port), PCR_PORT_VLAN_MASK,
+- MT7530_PORT_SECURITY_MODE);
++ if (dsa_is_cpu_port(ds, port))
++ mt7530_rmw(priv, MT7530_PCR_P(port), PCR_PORT_VLAN_MASK,
++ MT7530_PORT_FALLBACK_MODE);
++ else
++ mt7530_rmw(priv, MT7530_PCR_P(port), PCR_PORT_VLAN_MASK,
++ MT7530_PORT_SECURITY_MODE);
+
+ /* Set the port as a user port which is to be able to recognize VID
+ * from incoming packets before fetching entry within the VLAN table.
+--- a/drivers/net/dsa/mt7530.h
++++ b/drivers/net/dsa/mt7530.h
+@@ -148,6 +148,12 @@ enum mt7530_port_mode {
+ /* Port Matrix Mode: Frames are forwarded by the PCR_MATRIX members. */
+ MT7530_PORT_MATRIX_MODE = PORT_VLAN(0),
+
++ /* Fallback Mode: Forward received frames with ingress ports that do
++ * not belong to the VLAN member. Frames whose VID is not listed on
++ * the VLAN table are forwarded by the PCR_MATRIX members.
++ */
++ MT7530_PORT_FALLBACK_MODE = PORT_VLAN(1),
++
+ /* Security Mode: Discard any frame due to ingress membership
+ * violation or VID missed on the VLAN table.
+ */
--- /dev/null
+From 17c7d35f141ef6158076adf3338f115f64fcf760 Mon Sep 17 00:00:00 2001
+From: Can Guo <cang@codeaurora.org>
+Date: Thu, 5 Dec 2019 02:14:33 +0000
+Subject: scsi: ufs: Release clock if DMA map fails
+
+From: Can Guo <cang@codeaurora.org>
+
+commit 17c7d35f141ef6158076adf3338f115f64fcf760 upstream.
+
+In queuecommand path, if DMA map fails, it bails out with clock held. In
+this case, release the clock to keep its usage paired.
+
+[mkp: applied by hand]
+
+Link: https://lore.kernel.org/r/0101016ed3d66395-1b7e7fce-b74d-42ca-a88a-4db78b795d3b-000000@us-west-2.amazonses.com
+Reviewed-by: Bean Huo <beanhuo@micron.com>
+Signed-off-by: Can Guo <cang@codeaurora.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+[EB: resolved cherry-pick conflict caused by newer kernels not having
+ the clear_bit_unlock() line]
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -2480,6 +2480,7 @@ static int ufshcd_queuecommand(struct Sc
+
+ err = ufshcd_map_sg(hba, lrbp);
+ if (err) {
++ ufshcd_release(hba);
+ lrbp->cmd = NULL;
+ clear_bit_unlock(tag, &hba->lrb_in_use);
+ goto out;
mmc-fix-compilation-of-user-api.patch
media-revert-staging-imgu-address-a-compiler-warning-on-alignment.patch
media-staging-ipu3-imgu-move-alignment-attribute-to-field.patch
+scsi-ufs-release-clock-if-dma-map-fails.patch
+net-dsa-mt7530-set-cpu-port-to-fallback-mode.patch
+airo-fix-read-overflows-sending-packets.patch
drm-i915-fix-port-checks-for-mst-support-on-gen-11.patch
scsi-hisi_sas-check-sas_port-before-using-it.patch
powerpc-powernv-avoid-re-registration-of-imc-debugfs.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
