5.4-stable patches

added patches:
	gpio-aspeed-fix-the-gpio-number-passed-to-pinctrl_gpio_set_config.patch
	gpio-pxa-disable-pinctrl-calls-for-mmp_gpio.patch
	ib-mlx4-fix-the-size-of-a-buffer-in-add_port_entries.patch
	rdma-cma-fix-truncation-compilation-warning-in-make_cma_ports.patch
	rdma-core-require-admin-capabilities-to-set-system-parameters.patch
	rdma-mlx5-fix-null-string-error.patch
	rdma-siw-fix-connection-failure-handling.patch
	rdma-uverbs-fix-typo-of-sizeof-argument.patch

diff --git a/queue-5.4/gpio-aspeed-fix-the-gpio-number-passed-to-pinctrl_gpio_set_config.patch b/queue-5.4/gpio-aspeed-fix-the-gpio-number-passed-to-pinctrl_gpio_set_config.patch
new file mode 100644 (file)
index 0000000..71bcb67
--- /dev/null
+++ b/queue-5.4/gpio-aspeed-fix-the-gpio-number-passed-to-pinctrl_gpio_set_config.patch
@@ -0,0 +1,33 @@
+From f9315f17bf778cb8079a29639419fcc8a41a3c84 Mon Sep 17 00:00:00 2001
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Date: Tue, 3 Oct 2023 09:39:26 +0200
+Subject: gpio: aspeed: fix the GPIO number passed to pinctrl_gpio_set_config()
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+commit f9315f17bf778cb8079a29639419fcc8a41a3c84 upstream.
+
+pinctrl_gpio_set_config() expects the GPIO number from the global GPIO
+numberspace, not the controller-relative offset, which needs to be added
+to the chip base.
+
+Fixes: 5ae4cb94b313 ("gpio: aspeed: Add debounce support")
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Reviewed-by: Andrew Jeffery <andrew@codeconstruct.com.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpio/gpio-aspeed.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpio/gpio-aspeed.c
++++ b/drivers/gpio/gpio-aspeed.c
+@@ -967,7 +967,7 @@ static int aspeed_gpio_set_config(struct
+       else if (param == PIN_CONFIG_BIAS_DISABLE ||
+                       param == PIN_CONFIG_BIAS_PULL_DOWN ||
+                       param == PIN_CONFIG_DRIVE_STRENGTH)
+-              return pinctrl_gpio_set_config(offset, config);
++              return pinctrl_gpio_set_config(chip->base + offset, config);
+       else if (param == PIN_CONFIG_DRIVE_OPEN_DRAIN ||
+                       param == PIN_CONFIG_DRIVE_OPEN_SOURCE)
+               /* Return -ENOTSUPP to trigger emulation, as per datasheet */

diff --git a/queue-5.4/gpio-pxa-disable-pinctrl-calls-for-mmp_gpio.patch b/queue-5.4/gpio-pxa-disable-pinctrl-calls-for-mmp_gpio.patch
new file mode 100644 (file)
index 0000000..17ee775
--- /dev/null
+++ b/queue-5.4/gpio-pxa-disable-pinctrl-calls-for-mmp_gpio.patch
@@ -0,0 +1,34 @@
+From f0575116507b981e6a810e78ce3c9040395b958b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Duje=20Mihanovi=C4=87?= <duje.mihanovic@skole.hr>
+Date: Fri, 29 Sep 2023 17:41:57 +0200
+Subject: gpio: pxa: disable pinctrl calls for MMP_GPIO
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Duje Mihanović <duje.mihanovic@skole.hr>
+
+commit f0575116507b981e6a810e78ce3c9040395b958b upstream.
+
+Similarly to PXA3xx and MMP2, pinctrl-single isn't capable of setting
+pin direction on MMP either.
+
+Fixes: a770d946371e ("gpio: pxa: add pin control gpio direction and request")
+Signed-off-by: Duje Mihanović <duje.mihanovic@skole.hr>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpio/gpio-pxa.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpio/gpio-pxa.c
++++ b/drivers/gpio/gpio-pxa.c
+@@ -243,6 +243,7 @@ static bool pxa_gpio_has_pinctrl(void)
+       switch (gpio_type) {
+       case PXA3XX_GPIO:
+       case MMP2_GPIO:
++      case MMP_GPIO:
+               return false;
+ 
+       default:

diff --git a/queue-5.4/ib-mlx4-fix-the-size-of-a-buffer-in-add_port_entries.patch b/queue-5.4/ib-mlx4-fix-the-size-of-a-buffer-in-add_port_entries.patch
new file mode 100644 (file)
index 0000000..a75fd0f
--- /dev/null
+++ b/queue-5.4/ib-mlx4-fix-the-size-of-a-buffer-in-add_port_entries.patch
@@ -0,0 +1,51 @@
+From d7f393430a17c2bfcdf805462a5aa80be4285b27 Mon Sep 17 00:00:00 2001
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Sat, 23 Sep 2023 07:55:56 +0200
+Subject: IB/mlx4: Fix the size of a buffer in add_port_entries()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+commit d7f393430a17c2bfcdf805462a5aa80be4285b27 upstream.
+
+In order to be sure that 'buff' is never truncated, its size should be
+12, not 11.
+
+When building with W=1, this fixes the following warnings:
+
+  drivers/infiniband/hw/mlx4/sysfs.c: In function ‘add_port_entries’:
+  drivers/infiniband/hw/mlx4/sysfs.c:268:34: error: ‘sprintf’ may write a terminating nul past the end of the destination [-Werror=format-overflow=]
+    268 |                 sprintf(buff, "%d", i);
+        |                                  ^
+  drivers/infiniband/hw/mlx4/sysfs.c:268:17: note: ‘sprintf’ output between 2 and 12 bytes into a destination of size 11
+    268 |                 sprintf(buff, "%d", i);
+        |                 ^~~~~~~~~~~~~~~~~~~~~~
+  drivers/infiniband/hw/mlx4/sysfs.c:286:34: error: ‘sprintf’ may write a terminating nul past the end of the destination [-Werror=format-overflow=]
+    286 |                 sprintf(buff, "%d", i);
+        |                                  ^
+  drivers/infiniband/hw/mlx4/sysfs.c:286:17: note: ‘sprintf’ output between 2 and 12 bytes into a destination of size 11
+    286 |                 sprintf(buff, "%d", i);
+        |                 ^~~~~~~~~~~~~~~~~~~~~~
+
+Fixes: c1e7e466120b ("IB/mlx4: Add iov directory in sysfs under the ib device")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/0bb1443eb47308bc9be30232cc23004c4d4cf43e.1695448530.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/mlx4/sysfs.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/mlx4/sysfs.c
++++ b/drivers/infiniband/hw/mlx4/sysfs.c
+@@ -221,7 +221,7 @@ void del_sysfs_port_mcg_attr(struct mlx4
+ static int add_port_entries(struct mlx4_ib_dev *device, int port_num)
+ {
+       int i;
+-      char buff[11];
++      char buff[12];
+       struct mlx4_ib_iov_port *port = NULL;
+       int ret = 0 ;
+       struct ib_port_attr attr;

diff --git a/queue-5.4/rdma-cma-fix-truncation-compilation-warning-in-make_cma_ports.patch b/queue-5.4/rdma-cma-fix-truncation-compilation-warning-in-make_cma_ports.patch
new file mode 100644 (file)
index 0000000..552fed1
--- /dev/null
+++ b/queue-5.4/rdma-cma-fix-truncation-compilation-warning-in-make_cma_ports.patch
@@ -0,0 +1,44 @@
+From 18126c767658ae8a831257c6cb7776c5ba5e7249 Mon Sep 17 00:00:00 2001
+From: Leon Romanovsky <leonro@nvidia.com>
+Date: Mon, 11 Sep 2023 15:18:06 +0300
+Subject: RDMA/cma: Fix truncation compilation warning in make_cma_ports
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+commit 18126c767658ae8a831257c6cb7776c5ba5e7249 upstream.
+
+The following compilation error is false alarm as RDMA devices don't
+have such large amount of ports to actually cause to format truncation.
+
+drivers/infiniband/core/cma_configfs.c: In function ‘make_cma_ports’:
+drivers/infiniband/core/cma_configfs.c:223:57: error: ‘snprintf’ output may be truncated before the last format character [-Werror=format-truncation=]
+  223 |                 snprintf(port_str, sizeof(port_str), "%u", i + 1);
+      |                                                         ^
+drivers/infiniband/core/cma_configfs.c:223:17: note: ‘snprintf’ output between 2 and 11 bytes into a destination of size 10
+  223 |                 snprintf(port_str, sizeof(port_str), "%u", i + 1);
+      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+cc1: all warnings being treated as errors
+make[5]: *** [scripts/Makefile.build:243: drivers/infiniband/core/cma_configfs.o] Error 1
+
+Fixes: 045959db65c6 ("IB/cma: Add configfs for rdma_cm")
+Link: https://lore.kernel.org/r/a7e3b347ee134167fa6a3787c56ef231a04bc8c2.1694434639.git.leonro@nvidia.com
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/core/cma_configfs.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/core/cma_configfs.c
++++ b/drivers/infiniband/core/cma_configfs.c
+@@ -218,7 +218,7 @@ static int make_cma_ports(struct cma_dev
+       }
+ 
+       for (i = 0; i < ports_num; i++) {
+-              char port_str[10];
++              char port_str[11];
+ 
+               ports[i].port_num = i + 1;
+               snprintf(port_str, sizeof(port_str), "%u", i + 1);

diff --git a/queue-5.4/rdma-core-require-admin-capabilities-to-set-system-parameters.patch b/queue-5.4/rdma-core-require-admin-capabilities-to-set-system-parameters.patch
new file mode 100644 (file)
index 0000000..d36b7e2
--- /dev/null
+++ b/queue-5.4/rdma-core-require-admin-capabilities-to-set-system-parameters.patch
@@ -0,0 +1,31 @@
+From c38d23a54445f9a8aa6831fafc9af0496ba02f9e Mon Sep 17 00:00:00 2001
+From: Leon Romanovsky <leonro@nvidia.com>
+Date: Wed, 4 Oct 2023 21:17:49 +0300
+Subject: RDMA/core: Require admin capabilities to set system parameters
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+commit c38d23a54445f9a8aa6831fafc9af0496ba02f9e upstream.
+
+Like any other set command, require admin permissions to do it.
+
+Cc: stable@vger.kernel.org
+Fixes: 2b34c5580226 ("RDMA/core: Add command to set ib_core device net namspace sharing mode")
+Link: https://lore.kernel.org/r/75d329fdd7381b52cbdf87910bef16c9965abb1f.1696443438.git.leon@kernel.org
+Reviewed-by: Parav Pandit <parav@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/core/nldev.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/infiniband/core/nldev.c
++++ b/drivers/infiniband/core/nldev.c
+@@ -2080,6 +2080,7 @@ static const struct rdma_nl_cbs nldev_cb
+       },
+       [RDMA_NLDEV_CMD_SYS_SET] = {
+               .doit = nldev_set_sys_set_doit,
++              .flags = RDMA_NL_ADMIN_PERM,
+       },
+       [RDMA_NLDEV_CMD_STAT_SET] = {
+               .doit = nldev_stat_set_doit,

diff --git a/queue-5.4/rdma-mlx5-fix-null-string-error.patch b/queue-5.4/rdma-mlx5-fix-null-string-error.patch
new file mode 100644 (file)
index 0000000..1d6ebbc
--- /dev/null
+++ b/queue-5.4/rdma-mlx5-fix-null-string-error.patch
@@ -0,0 +1,31 @@
+From dab994bcc609a172bfdab15a0d4cb7e50e8b5458 Mon Sep 17 00:00:00 2001
+From: Shay Drory <shayd@nvidia.com>
+Date: Wed, 20 Sep 2023 13:01:56 +0300
+Subject: RDMA/mlx5: Fix NULL string error
+
+From: Shay Drory <shayd@nvidia.com>
+
+commit dab994bcc609a172bfdab15a0d4cb7e50e8b5458 upstream.
+
+checkpath is complaining about NULL string, change it to 'Unknown'.
+
+Fixes: 37aa5c36aa70 ("IB/mlx5: Add UARs write-combining and non-cached mapping")
+Signed-off-by: Shay Drory <shayd@nvidia.com>
+Link: https://lore.kernel.org/r/8638e5c14fadbde5fa9961874feae917073af920.1695203958.git.leonro@nvidia.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/mlx5/main.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -2053,7 +2053,7 @@ static inline char *mmap_cmd2str(enum ml
+       case MLX5_IB_MMAP_DEVICE_MEM:
+               return "Device Memory";
+       default:
+-              return NULL;
++              return "Unknown";
+       }
+ }
+ 

diff --git a/queue-5.4/rdma-siw-fix-connection-failure-handling.patch b/queue-5.4/rdma-siw-fix-connection-failure-handling.patch
new file mode 100644 (file)
index 0000000..07b6e61
--- /dev/null
+++ b/queue-5.4/rdma-siw-fix-connection-failure-handling.patch
@@ -0,0 +1,71 @@
+From 53a3f777049771496f791504e7dc8ef017cba590 Mon Sep 17 00:00:00 2001
+From: Bernard Metzler <bmt@zurich.ibm.com>
+Date: Tue, 5 Sep 2023 16:58:22 +0200
+Subject: RDMA/siw: Fix connection failure handling
+
+From: Bernard Metzler <bmt@zurich.ibm.com>
+
+commit 53a3f777049771496f791504e7dc8ef017cba590 upstream.
+
+In case immediate MPA request processing fails, the newly
+created endpoint unlinks the listening endpoint and is
+ready to be dropped. This special case was not handled
+correctly by the code handling the later TCP socket close,
+causing a NULL dereference crash in siw_cm_work_handler()
+when dereferencing a NULL listener. We now also cancel
+the useless MPA timeout, if immediate MPA request
+processing fails.
+
+This patch furthermore simplifies MPA processing in general:
+Scheduling a useless TCP socket read in sk_data_ready() upcall
+is now surpressed, if the socket is already moved out of
+TCP_ESTABLISHED state.
+
+Fixes: 6c52fdc244b5 ("rdma/siw: connection management")
+Signed-off-by: Bernard Metzler <bmt@zurich.ibm.com>
+Link: https://lore.kernel.org/r/20230905145822.446263-1-bmt@zurich.ibm.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/sw/siw/siw_cm.c |   16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+--- a/drivers/infiniband/sw/siw/siw_cm.c
++++ b/drivers/infiniband/sw/siw/siw_cm.c
+@@ -981,6 +981,7 @@ static void siw_accept_newconn(struct si
+                       siw_cep_put(cep);
+                       new_cep->listen_cep = NULL;
+                       if (rv) {
++                              siw_cancel_mpatimer(new_cep);
+                               siw_cep_set_free(new_cep);
+                               goto error;
+                       }
+@@ -1105,9 +1106,12 @@ static void siw_cm_work_handler(struct w
+                               /*
+                                * Socket close before MPA request received.
+                                */
+-                              siw_dbg_cep(cep, "no mpareq: drop listener\n");
+-                              siw_cep_put(cep->listen_cep);
+-                              cep->listen_cep = NULL;
++                              if (cep->listen_cep) {
++                                      siw_dbg_cep(cep,
++                                              "no mpareq: drop listener\n");
++                                      siw_cep_put(cep->listen_cep);
++                                      cep->listen_cep = NULL;
++                              }
+                       }
+               }
+               release_cep = 1;
+@@ -1230,7 +1234,11 @@ static void siw_cm_llp_data_ready(struct
+       if (!cep)
+               goto out;
+ 
+-      siw_dbg_cep(cep, "state: %d\n", cep->state);
++      siw_dbg_cep(cep, "cep state: %d, socket state %d\n",
++                  cep->state, sk->sk_state);
++
++      if (sk->sk_state != TCP_ESTABLISHED)
++              goto out;
+ 
+       switch (cep->state) {
+       case SIW_EPSTATE_RDMA_MODE:

diff --git a/queue-5.4/rdma-uverbs-fix-typo-of-sizeof-argument.patch b/queue-5.4/rdma-uverbs-fix-typo-of-sizeof-argument.patch
new file mode 100644 (file)
index 0000000..6246b5a
--- /dev/null
+++ b/queue-5.4/rdma-uverbs-fix-typo-of-sizeof-argument.patch
@@ -0,0 +1,35 @@
+From c489800e0d48097fc6afebd862c6afa039110a36 Mon Sep 17 00:00:00 2001
+From: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
+Date: Tue, 5 Sep 2023 18:32:58 +0800
+Subject: RDMA/uverbs: Fix typo of sizeof argument
+
+From: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
+
+commit c489800e0d48097fc6afebd862c6afa039110a36 upstream.
+
+Since size of 'hdr' pointer and '*hdr' structure is equal on 64-bit
+machines issue probably didn't cause any wrong behavior. But anyway,
+fixing of typo is required.
+
+Fixes: da0f60df7bd5 ("RDMA/uverbs: Prohibit write() calls with too small buffers")
+Co-developed-by: Ivanov Mikhail <ivanov.mikhail1@huawei-partners.com>
+Signed-off-by: Ivanov Mikhail <ivanov.mikhail1@huawei-partners.com>
+Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
+Link: https://lore.kernel.org/r/20230905103258.1738246-1-konstantin.meskhidze@huawei.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/core/uverbs_main.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/core/uverbs_main.c
++++ b/drivers/infiniband/core/uverbs_main.c
+@@ -633,7 +633,7 @@ static ssize_t verify_hdr(struct ib_uver
+       if (hdr->in_words * 4 != count)
+               return -EINVAL;
+ 
+-      if (count < method_elm->req_size + sizeof(hdr)) {
++      if (count < method_elm->req_size + sizeof(*hdr)) {
+               /*
+                * rdma-core v18 and v19 have a bug where they send DESTROY_CQ
+                * with a 16 byte write instead of 24. Old kernels didn't

diff --git a/queue-5.4/series b/queue-5.4/series
index eaa587afa3abb0e01c475169a9a37fccc4862b77..20eb54da821a11c62497e20ad74c148aa1372c03 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -119,3 +119,11 @@ tcp-fix-delayed-acks-for-mss-boundary-condition.patch
 sctp-update-transport-state-when-processing-a-dupcoo.patch
 sctp-update-hb-timer-immediately-after-users-change-.patch
 cpupower-add-makefile-dependencies-for-install-targets.patch
+rdma-core-require-admin-capabilities-to-set-system-parameters.patch
+ib-mlx4-fix-the-size-of-a-buffer-in-add_port_entries.patch
+gpio-aspeed-fix-the-gpio-number-passed-to-pinctrl_gpio_set_config.patch
+gpio-pxa-disable-pinctrl-calls-for-mmp_gpio.patch
+rdma-cma-fix-truncation-compilation-warning-in-make_cma_ports.patch
+rdma-uverbs-fix-typo-of-sizeof-argument.patch
+rdma-siw-fix-connection-failure-handling.patch
+rdma-mlx5-fix-null-string-error.patch