--- /dev/null
+From foo@baz Sun Jan 10 01:16:11 PM CET 2021
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Sat, 19 Dec 2020 14:01:44 +0300
+Subject: atm: idt77252: call pci_disable_device() on error path
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 8df66af5c1e5f80562fe728db5ec069b21810144 ]
+
+This error path needs to disable the pci device before returning.
+
+Fixes: ede58ef28e10 ("atm: remove deprecated use of pci api")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/X93dmC4NX0vbTpGp@mwanda
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/atm/idt77252.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/atm/idt77252.c
++++ b/drivers/atm/idt77252.c
+@@ -3608,7 +3608,7 @@ static int idt77252_init_one(struct pci_
+
+ if ((err = dma_set_mask_and_coherent(&pcidev->dev, DMA_BIT_MASK(32)))) {
+ printk("idt77252: can't enable DMA for PCI device at %s\n", pci_name(pcidev));
+- return err;
++ goto err_out_disable_pdev;
+ }
+
+ card = kzalloc(sizeof(struct idt77252_dev), GFP_KERNEL);
--- /dev/null
+From foo@baz Sun Jan 10 01:16:11 PM CET 2021
+From: Roland Dreier <roland@kernel.org>
+Date: Wed, 23 Dec 2020 19:21:16 -0800
+Subject: CDC-NCM: remove "connected" log message
+
+From: Roland Dreier <roland@kernel.org>
+
+[ Upstream commit 59b4a8fa27f5a895582ada1ae5034af7c94a57b5 ]
+
+The cdc_ncm driver passes network connection notifications up to
+usbnet_link_change(), which is the right place for any logging.
+Remove the netdev_info() duplicating this from the driver itself.
+
+This stops devices such as my "TRENDnet USB 10/100/1G/2.5G LAN"
+(ID 20f4:e02b) adapter from spamming the kernel log with
+
+ cdc_ncm 2-2:2.0 enp0s2u2c2: network connection: connected
+
+messages every 60 msec or so.
+
+Signed-off-by: Roland Dreier <roland@kernel.org>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20201224032116.2453938-1-roland@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/cdc_ncm.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -1630,9 +1630,6 @@ static void cdc_ncm_status(struct usbnet
+ * USB_CDC_NOTIFY_NETWORK_CONNECTION notification shall be
+ * sent by device after USB_CDC_NOTIFY_SPEED_CHANGE.
+ */
+- netif_info(dev, link, dev->net,
+- "network connection: %sconnected\n",
+- !!event->wValue ? "" : "dis");
+ usbnet_link_change(dev, !!event->wValue, 0);
+ break;
+
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- scripts/depmod.sh | 2 ++
+ scripts/depmod.sh | 2 ++
1 file changed, 2 insertions(+)
-diff --git a/scripts/depmod.sh b/scripts/depmod.sh
-index cf5b2b24b3cf1..c7b8f827c4b09 100755
--- a/scripts/depmod.sh
+++ b/scripts/depmod.sh
@@ -15,6 +15,8 @@ if ! test -r System.map ; then
if [ -z $(command -v $DEPMOD) ]; then
echo "Warning: 'make modules_install' requires $DEPMOD. Please install it." >&2
echo "This is probably in the kmod package." >&2
---
-2.27.0
-
--- /dev/null
+From foo@baz Sun Jan 10 01:16:11 PM CET 2021
+From: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+Date: Fri, 18 Dec 2020 11:55:38 +0100
+Subject: ethernet: ucc_geth: fix use-after-free in ucc_geth_remove()
+
+From: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+
+[ Upstream commit e925e0cd2a705aaacb0b907bb3691fcac3a973a4 ]
+
+ugeth is the netdiv_priv() part of the netdevice. Accessing the memory
+pointed to by ugeth (such as done by ucc_geth_memclean() and the two
+of_node_puts) after free_netdev() is thus use-after-free.
+
+Fixes: 80a9fad8e89a ("ucc_geth: fix module removal")
+Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/ucc_geth.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/freescale/ucc_geth.c
++++ b/drivers/net/ethernet/freescale/ucc_geth.c
+@@ -3939,12 +3939,12 @@ static int ucc_geth_remove(struct platfo
+ struct device_node *np = ofdev->dev.of_node;
+
+ unregister_netdev(dev);
+- free_netdev(dev);
+ ucc_geth_memclean(ugeth);
+ if (of_phy_is_fixed_link(np))
+ of_phy_deregister_fixed_link(np);
+ of_node_put(ugeth->ug_info->tbi_node);
+ of_node_put(ugeth->ug_info->phy_node);
++ free_netdev(dev);
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Sun Jan 10 01:16:11 PM CET 2021
+From: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+Date: Fri, 18 Dec 2020 11:55:36 +0100
+Subject: ethernet: ucc_geth: set dev->max_mtu to 1518
+
+From: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+
+[ Upstream commit 1385ae5c30f238f81bc6528d897c6d7a0816783f ]
+
+All the buffers and registers are already set up appropriately for an
+MTU slightly above 1500, so we just need to expose this to the
+networking stack. AFAICT, there's no need to implement .ndo_change_mtu
+when the receive buffers are always set up to support the max_mtu.
+
+This fixes several warnings during boot on our mpc8309-board with an
+embedded mv88e6250 switch:
+
+mv88e6085 mdio@e0102120:10: nonfatal error -34 setting MTU 1500 on port 0
+...
+mv88e6085 mdio@e0102120:10: nonfatal error -34 setting MTU 1500 on port 4
+ucc_geth e0102000.ethernet eth1: error -22 setting MTU to 1504 to include DSA overhead
+
+The last line explains what the DSA stack tries to do: achieving an MTU
+of 1500 on-the-wire requires that the master netdevice connected to
+the CPU port supports an MTU of 1500+the tagging overhead.
+
+Fixes: bfcb813203e6 ("net: dsa: configure the MTU for switch ports")
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/ucc_geth.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/freescale/ucc_geth.c
++++ b/drivers/net/ethernet/freescale/ucc_geth.c
+@@ -3894,6 +3894,7 @@ static int ucc_geth_probe(struct platfor
+ INIT_WORK(&ugeth->timeout_work, ucc_geth_timeout_work);
+ netif_napi_add(dev, &ugeth->napi, ucc_geth_poll, 64);
+ dev->mtu = 1500;
++ dev->max_mtu = 1518;
+
+ ugeth->msg_enable = netif_msg_init(debug.msg_enable, UGETH_MSG_DEFAULT);
+ ugeth->phy_interface = phy_interface;
--- /dev/null
+From foo@baz Sun Jan 10 01:16:11 PM CET 2021
+From: Guillaume Nault <gnault@redhat.com>
+Date: Thu, 24 Dec 2020 20:01:09 +0100
+Subject: ipv4: Ignore ECN bits for fib lookups in fib_compute_spec_dst()
+
+From: Guillaume Nault <gnault@redhat.com>
+
+[ Upstream commit 21fdca22eb7df2a1e194b8adb812ce370748b733 ]
+
+RT_TOS() only clears one of the ECN bits. Therefore, when
+fib_compute_spec_dst() resorts to a fib lookup, it can return
+different results depending on the value of the second ECN bit.
+
+For example, ECT(0) and ECT(1) packets could be treated differently.
+
+ $ ip netns add ns0
+ $ ip netns add ns1
+ $ ip link add name veth01 netns ns0 type veth peer name veth10 netns ns1
+ $ ip -netns ns0 link set dev lo up
+ $ ip -netns ns1 link set dev lo up
+ $ ip -netns ns0 link set dev veth01 up
+ $ ip -netns ns1 link set dev veth10 up
+
+ $ ip -netns ns0 address add 192.0.2.10/24 dev veth01
+ $ ip -netns ns1 address add 192.0.2.11/24 dev veth10
+
+ $ ip -netns ns1 address add 192.0.2.21/32 dev lo
+ $ ip -netns ns1 route add 192.0.2.10/32 tos 4 dev veth10 src 192.0.2.21
+ $ ip netns exec ns1 sysctl -wq net.ipv4.icmp_echo_ignore_broadcasts=0
+
+With TOS 4 and ECT(1), ns1 replies using source address 192.0.2.21
+(ping uses -Q to set all TOS and ECN bits):
+
+ $ ip netns exec ns0 ping -c 1 -b -Q 5 192.0.2.255
+ [...]
+ 64 bytes from 192.0.2.21: icmp_seq=1 ttl=64 time=0.544 ms
+
+But with TOS 4 and ECT(0), ns1 replies using source address 192.0.2.11
+because the "tos 4" route isn't matched:
+
+ $ ip netns exec ns0 ping -c 1 -b -Q 6 192.0.2.255
+ [...]
+ 64 bytes from 192.0.2.11: icmp_seq=1 ttl=64 time=0.597 ms
+
+After this patch the ECN bits don't affect the result anymore:
+
+ $ ip netns exec ns0 ping -c 1 -b -Q 6 192.0.2.255
+ [...]
+ 64 bytes from 192.0.2.21: icmp_seq=1 ttl=64 time=0.591 ms
+
+Fixes: 35ebf65e851c ("ipv4: Create and use fib_compute_spec_dst() helper.")
+Signed-off-by: Guillaume Nault <gnault@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/fib_frontend.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -292,7 +292,7 @@ __be32 fib_compute_spec_dst(struct sk_bu
+ .flowi4_iif = LOOPBACK_IFINDEX,
+ .flowi4_oif = l3mdev_master_ifindex_rcu(dev),
+ .daddr = ip_hdr(skb)->saddr,
+- .flowi4_tos = RT_TOS(ip_hdr(skb)->tos),
++ .flowi4_tos = ip_hdr(skb)->tos & IPTOS_RT_MASK,
+ .flowi4_scope = scope,
+ .flowi4_mark = vmark ? skb->mark : 0,
+ };
--- /dev/null
+From foo@baz Sun Jan 10 01:16:11 PM CET 2021
+From: Petr Machata <me@pmachata.org>
+Date: Tue, 22 Dec 2020 22:49:44 +0100
+Subject: net: dcb: Validate netlink message in DCB handler
+
+From: Petr Machata <me@pmachata.org>
+
+[ Upstream commit 826f328e2b7e8854dd42ea44e6519cd75018e7b1 ]
+
+DCB uses the same handler function for both RTM_GETDCB and RTM_SETDCB
+messages. dcb_doit() bounces RTM_SETDCB mesasges if the user does not have
+the CAP_NET_ADMIN capability.
+
+However, the operation to be performed is not decided from the DCB message
+type, but from the DCB command. Thus DCB_CMD_*_GET commands are used for
+reading DCB objects, the corresponding SET and DEL commands are used for
+manipulation.
+
+The assumption is that set-like commands will be sent via an RTM_SETDCB
+message, and get-like ones via RTM_GETDCB. However, this assumption is not
+enforced.
+
+It is therefore possible to manipulate DCB objects without CAP_NET_ADMIN
+capability by sending the corresponding command in an RTM_GETDCB message.
+That is a bug. Fix it by validating the type of the request message against
+the type used for the response.
+
+Fixes: 2f90b8657ec9 ("ixgbe: this patch adds support for DCB to the kernel and ixgbe driver")
+Signed-off-by: Petr Machata <me@pmachata.org>
+Link: https://lore.kernel.org/r/a2a9b88418f3a58ef211b718f2970128ef9e3793.1608673640.git.me@pmachata.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/dcb/dcbnl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/dcb/dcbnl.c
++++ b/net/dcb/dcbnl.c
+@@ -1727,6 +1727,8 @@ static int dcb_doit(struct sk_buff *skb,
+ fn = &reply_funcs[dcb->cmd];
+ if (!fn->cb)
+ return -EOPNOTSUPP;
++ if (fn->type != nlh->nlmsg_type)
++ return -EPERM;
+
+ if (!tb[DCB_ATTR_IFNAME])
+ return -EINVAL;
--- /dev/null
+From foo@baz Sun Jan 10 01:16:11 PM CET 2021
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Date: Wed, 23 Dec 2020 19:06:12 +0800
+Subject: net: ethernet: Fix memleak in ethoc_probe
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit 5d41f9b7ee7a5a5138894f58846a4ffed601498a ]
+
+When mdiobus_register() fails, priv->mdio allocated
+by mdiobus_alloc() has not been freed, which leads
+to memleak.
+
+Fixes: e7f4dc3536a4 ("mdio: Move allocation of interrupts into core")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lore.kernel.org/r/20201223110615.31389-1-dinghao.liu@zju.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ethoc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/ethoc.c
++++ b/drivers/net/ethernet/ethoc.c
+@@ -1212,7 +1212,7 @@ static int ethoc_probe(struct platform_d
+ ret = mdiobus_register(priv->mdio);
+ if (ret) {
+ dev_err(&netdev->dev, "failed to register MDIO bus\n");
+- goto free2;
++ goto free3;
+ }
+
+ ret = ethoc_mdio_probe(netdev);
+@@ -1244,6 +1244,7 @@ error2:
+ netif_napi_del(&priv->napi);
+ error:
+ mdiobus_unregister(priv->mdio);
++free3:
+ mdiobus_free(priv->mdio);
+ free2:
+ if (priv->clk)
--- /dev/null
+From foo@baz Sun Jan 10 01:16:11 PM CET 2021
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+Date: Thu, 24 Dec 2020 18:24:05 +0200
+Subject: net: ethernet: ti: cpts: fix ethtool output when no ptp_clock registered
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+[ Upstream commit 4614792eebcbf81c60ad3604c1aeeb2b0899cea4 ]
+
+The CPTS driver registers PTP PHC clock when first netif is going up and
+unregister it when all netif are down. Now ethtool will show:
+ - PTP PHC clock index 0 after boot until first netif is up;
+ - the last assigned PTP PHC clock index even if PTP PHC clock is not
+registered any more after all netifs are down.
+
+This patch ensures that -1 is returned by ethtool when PTP PHC clock is not
+registered any more.
+
+Fixes: 8a2c9a5ab4b9 ("net: ethernet: ti: cpts: rework initialization/deinitialization")
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Acked-by: Richard Cochran <richardcochran@gmail.com>
+Link: https://lore.kernel.org/r/20201224162405.28032-1-grygorii.strashko@ti.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ti/cpts.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/ethernet/ti/cpts.c
++++ b/drivers/net/ethernet/ti/cpts.c
+@@ -471,6 +471,7 @@ void cpts_unregister(struct cpts *cpts)
+
+ ptp_clock_unregister(cpts->clock);
+ cpts->clock = NULL;
++ cpts->phc_index = -1;
+
+ cpts_write32(cpts, 0, int_enable);
+ cpts_write32(cpts, 0, control);
+@@ -572,6 +573,7 @@ struct cpts *cpts_create(struct device *
+ cpts->cc.read = cpts_systim_read;
+ cpts->cc.mask = CLOCKSOURCE_MASK(32);
+ cpts->info = cpts_info;
++ cpts->phc_index = -1;
+
+ cpts_calc_mult_shift(cpts);
+ /* save cc.mult original value as it can be modified
--- /dev/null
+From foo@baz Sun Jan 10 01:16:11 PM CET 2021
+From: Xie He <xie.he.0141@gmail.com>
+Date: Sun, 27 Dec 2020 18:53:39 -0800
+Subject: net: hdlc_ppp: Fix issues when mod_timer is called while timer is running
+
+From: Xie He <xie.he.0141@gmail.com>
+
+[ Upstream commit 1fef73597fa545c35fddc953979013882fbd4e55 ]
+
+ppp_cp_event is called directly or indirectly by ppp_rx with "ppp->lock"
+held. It may call mod_timer to add a new timer. However, at the same time
+ppp_timer may be already running and waiting for "ppp->lock". In this
+case, there's no need for ppp_timer to continue running and it can just
+exit.
+
+If we let ppp_timer continue running, it may call add_timer. This causes
+kernel panic because add_timer can't be called with a timer pending.
+This patch fixes this problem.
+
+Fixes: e022c2f07ae5 ("WAN: new synchronous PPP implementation for generic HDLC.")
+Cc: Krzysztof Halasa <khc@pm.waw.pl>
+Signed-off-by: Xie He <xie.he.0141@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wan/hdlc_ppp.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/net/wan/hdlc_ppp.c
++++ b/drivers/net/wan/hdlc_ppp.c
+@@ -572,6 +572,13 @@ static void ppp_timer(unsigned long arg)
+ unsigned long flags;
+
+ spin_lock_irqsave(&ppp->lock, flags);
++ /* mod_timer could be called after we entered this function but
++ * before we got the lock.
++ */
++ if (timer_pending(&proto->timer)) {
++ spin_unlock_irqrestore(&ppp->lock, flags);
++ return;
++ }
+ switch (proto->state) {
+ case STOPPING:
+ case REQ_SENT:
--- /dev/null
+From foo@baz Sun Jan 10 01:16:11 PM CET 2021
+From: Yunjian Wang <wangyunjian@huawei.com>
+Date: Sat, 26 Dec 2020 16:10:05 +0800
+Subject: net: hns: fix return value check in __lb_other_process()
+
+From: Yunjian Wang <wangyunjian@huawei.com>
+
+[ Upstream commit 5ede3ada3da7f050519112b81badc058190b9f9f ]
+
+The function skb_copy() could return NULL, the return value
+need to be checked.
+
+Fixes: b5996f11ea54 ("net: add Hisilicon Network Subsystem basic ethernet support")
+Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hns_ethtool.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+@@ -418,6 +418,10 @@ static void __lb_other_process(struct hn
+ /* for mutl buffer*/
+ new_skb = skb_copy(skb, GFP_ATOMIC);
+ dev_kfree_skb_any(skb);
++ if (!new_skb) {
++ netdev_err(ndev, "skb alloc failed\n");
++ return;
++ }
+ skb = new_skb;
+
+ check_ok = 0;
--- /dev/null
+From foo@baz Sun Jan 10 01:16:11 PM CET 2021
+From: Stefan Chulski <stefanc@marvell.com>
+Date: Sun, 20 Dec 2020 13:02:29 +0200
+Subject: net: mvpp2: Fix GoP port 3 Networking Complex Control configurations
+
+From: Stefan Chulski <stefanc@marvell.com>
+
+[ Upstream commit 2575bc1aa9d52a62342b57a0b7d0a12146cf6aed ]
+
+During GoP port 2 Networking Complex Control mode of operation configurations,
+also GoP port 3 mode of operation was wrongly set.
+Patch removes these configurations.
+
+Fixes: f84bf386f395 ("net: mvpp2: initialize the GoP")
+Acked-by: Marcin Wojtas <mw@semihalf.com>
+Signed-off-by: Stefan Chulski <stefanc@marvell.com>
+Link: https://lore.kernel.org/r/1608462149-1702-1-git-send-email-stefanc@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/marvell/mvpp2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/marvell/mvpp2.c
++++ b/drivers/net/ethernet/marvell/mvpp2.c
+@@ -4349,7 +4349,7 @@ static void mvpp22_gop_init_rgmii(struct
+
+ regmap_read(priv->sysctrl_base, GENCONF_CTRL0, &val);
+ if (port->gop_id == 2)
+- val |= GENCONF_CTRL0_PORT0_RGMII | GENCONF_CTRL0_PORT1_RGMII;
++ val |= GENCONF_CTRL0_PORT0_RGMII;
+ else if (port->gop_id == 3)
+ val |= GENCONF_CTRL0_PORT1_RGMII_MII;
+ regmap_write(priv->sysctrl_base, GENCONF_CTRL0, val);
--- /dev/null
+From foo@baz Sun Jan 10 01:16:11 PM CET 2021
+From: John Wang <wangzhiqiang.bj@bytedance.com>
+Date: Wed, 23 Dec 2020 13:55:23 +0800
+Subject: net/ncsi: Use real net-device for response handler
+
+From: John Wang <wangzhiqiang.bj@bytedance.com>
+
+[ Upstream commit 427c940558560bff2583d07fc119a21094675982 ]
+
+When aggregating ncsi interfaces and dedicated interfaces to bond
+interfaces, the ncsi response handler will use the wrong net device to
+find ncsi_dev, so that the ncsi interface will not work properly.
+Here, we use the original net device to fix it.
+
+Fixes: 138635cc27c9 ("net/ncsi: NCSI response packet handler")
+Signed-off-by: John Wang <wangzhiqiang.bj@bytedance.com>
+Link: https://lore.kernel.org/r/20201223055523.2069-1-wangzhiqiang.bj@bytedance.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ncsi/ncsi-rsp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ncsi/ncsi-rsp.c
++++ b/net/ncsi/ncsi-rsp.c
+@@ -983,7 +983,7 @@ int ncsi_rcv_rsp(struct sk_buff *skb, st
+ int payload, i, ret;
+
+ /* Find the NCSI device */
+- nd = ncsi_find_dev(dev);
++ nd = ncsi_find_dev(orig_dev);
+ ndp = nd ? TO_NCSI_DEV_PRIV(nd) : NULL;
+ if (!ndp)
+ return -ENODEV;
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: Randy Dunlap <rdunlap@infradead.org>
+Date: Thu, 24 Dec 2020 22:23:44 -0800
+Subject: net: sched: prevent invalid Scell_log shift count
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit bd1248f1ddbc48b0c30565fce897a3b6423313b8 ]
+
+Check Scell_log shift size in red_check_params() and modify all callers
+of red_check_params() to pass Scell_log.
+
+This prevents a shift out-of-bounds as detected by UBSAN:
+ UBSAN: shift-out-of-bounds in ./include/net/red.h:252:22
+ shift exponent 72 is too large for 32-bit type 'int'
+
+Fixes: 8afa10cbe281 ("net_sched: red: Avoid illegal values")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: syzbot+97c5bd9cc81eca63d36e@syzkaller.appspotmail.com
+Cc: Nogah Frankel <nogahf@mellanox.com>
+Cc: Jamal Hadi Salim <jhs@mojatatu.com>
+Cc: Cong Wang <xiyou.wangcong@gmail.com>
+Cc: Jiri Pirko <jiri@resnulli.us>
+Cc: netdev@vger.kernel.org
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/red.h | 4 +++-
+ net/sched/sch_choke.c | 2 +-
+ net/sched/sch_gred.c | 2 +-
+ net/sched/sch_red.c | 2 +-
+ net/sched/sch_sfq.c | 2 +-
+ 5 files changed, 7 insertions(+), 5 deletions(-)
+
+--- a/include/net/red.h
++++ b/include/net/red.h
+@@ -168,12 +168,14 @@ static inline void red_set_vars(struct r
+ v->qcount = -1;
+ }
+
+-static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog)
++static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, u8 Scell_log)
+ {
+ if (fls(qth_min) + Wlog > 32)
+ return false;
+ if (fls(qth_max) + Wlog > 32)
+ return false;
++ if (Scell_log >= 32)
++ return false;
+ if (qth_max < qth_min)
+ return false;
+ return true;
+--- a/net/sched/sch_choke.c
++++ b/net/sched/sch_choke.c
+@@ -370,7 +370,7 @@ static int choke_change(struct Qdisc *sc
+
+ ctl = nla_data(tb[TCA_CHOKE_PARMS]);
+
+- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog))
++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log))
+ return -EINVAL;
+
+ if (ctl->limit > CHOKE_MAX_QUEUE)
+--- a/net/sched/sch_gred.c
++++ b/net/sched/sch_gred.c
+@@ -356,7 +356,7 @@ static inline int gred_change_vq(struct
+ struct gred_sched *table = qdisc_priv(sch);
+ struct gred_sched_data *q = table->tab[dp];
+
+- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog))
++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log))
+ return -EINVAL;
+
+ if (!q) {
+--- a/net/sched/sch_red.c
++++ b/net/sched/sch_red.c
+@@ -184,7 +184,7 @@ static int red_change(struct Qdisc *sch,
+ max_P = tb[TCA_RED_MAX_P] ? nla_get_u32(tb[TCA_RED_MAX_P]) : 0;
+
+ ctl = nla_data(tb[TCA_RED_PARMS]);
+- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog))
++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log))
+ return -EINVAL;
+
+ if (ctl->limit > 0) {
+--- a/net/sched/sch_sfq.c
++++ b/net/sched/sch_sfq.c
+@@ -649,7 +649,7 @@ static int sfq_change(struct Qdisc *sch,
+ }
+
+ if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max,
+- ctl_v1->Wlog))
++ ctl_v1->Wlog, ctl_v1->Scell_log))
+ return -EINVAL;
+ if (ctl_v1 && ctl_v1->qth_min) {
+ p = kmalloc(sizeof(*p), GFP_KERNEL);
--- /dev/null
+From foo@baz Sun Jan 10 01:16:11 PM CET 2021
+From: Antoine Tenart <atenart@kernel.org>
+Date: Wed, 23 Dec 2020 22:23:21 +0100
+Subject: net-sysfs: take the rtnl lock when accessing xps_cpus_map and num_tc
+
+From: Antoine Tenart <atenart@kernel.org>
+
+[ Upstream commit fb25038586d0064123e393cadf1fadd70a9df97a ]
+
+Accesses to dev->xps_cpus_map (when using dev->num_tc) should be
+protected by the rtnl lock, like we do for netif_set_xps_queue. I didn't
+see an actual bug being triggered, but let's be safe here and take the
+rtnl lock while accessing the map in sysfs.
+
+Fixes: 184c449f91fe ("net: Add support for XPS with QoS via traffic classes")
+Signed-off-by: Antoine Tenart <atenart@kernel.org>
+Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/net-sysfs.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+--- a/net/core/net-sysfs.c
++++ b/net/core/net-sysfs.c
+@@ -1207,23 +1207,30 @@ static const struct attribute_group dql_
+ static ssize_t xps_cpus_show(struct netdev_queue *queue,
+ char *buf)
+ {
++ int cpu, len, ret, num_tc = 1, tc = 0;
+ struct net_device *dev = queue->dev;
+- int cpu, len, num_tc = 1, tc = 0;
+ struct xps_dev_maps *dev_maps;
+ cpumask_var_t mask;
+ unsigned long index;
+
+ index = get_netdev_queue_index(queue);
+
++ if (!rtnl_trylock())
++ return restart_syscall();
++
+ if (dev->num_tc) {
+ num_tc = dev->num_tc;
+ tc = netdev_txq_to_tc(dev, index);
+- if (tc < 0)
+- return -EINVAL;
++ if (tc < 0) {
++ ret = -EINVAL;
++ goto err_rtnl_unlock;
++ }
+ }
+
+- if (!zalloc_cpumask_var(&mask, GFP_KERNEL))
+- return -ENOMEM;
++ if (!zalloc_cpumask_var(&mask, GFP_KERNEL)) {
++ ret = -ENOMEM;
++ goto err_rtnl_unlock;
++ }
+
+ rcu_read_lock();
+ dev_maps = rcu_dereference(dev->xps_maps);
+@@ -1246,9 +1253,15 @@ static ssize_t xps_cpus_show(struct netd
+ }
+ rcu_read_unlock();
+
++ rtnl_unlock();
++
+ len = snprintf(buf, PAGE_SIZE, "%*pb\n", cpumask_pr_args(mask));
+ free_cpumask_var(mask);
+ return len < PAGE_SIZE ? len : -EINVAL;
++
++err_rtnl_unlock:
++ rtnl_unlock();
++ return ret;
+ }
+
+ static ssize_t xps_cpus_store(struct netdev_queue *queue,
--- /dev/null
+From foo@baz Sun Jan 10 01:16:11 PM CET 2021
+From: Antoine Tenart <atenart@kernel.org>
+Date: Wed, 23 Dec 2020 22:23:20 +0100
+Subject: net-sysfs: take the rtnl lock when storing xps_cpus
+
+From: Antoine Tenart <atenart@kernel.org>
+
+[ Upstream commit 1ad58225dba3f2f598d2c6daed4323f24547168f ]
+
+Two race conditions can be triggered when storing xps cpus, resulting in
+various oops and invalid memory accesses:
+
+1. Calling netdev_set_num_tc while netif_set_xps_queue:
+
+ - netif_set_xps_queue uses dev->tc_num as one of the parameters to
+ compute the size of new_dev_maps when allocating it. dev->tc_num is
+ also used to access the map, and the compiler may generate code to
+ retrieve this field multiple times in the function.
+
+ - netdev_set_num_tc sets dev->tc_num.
+
+ If new_dev_maps is allocated using dev->tc_num and then dev->tc_num
+ is set to a higher value through netdev_set_num_tc, later accesses to
+ new_dev_maps in netif_set_xps_queue could lead to accessing memory
+ outside of new_dev_maps; triggering an oops.
+
+2. Calling netif_set_xps_queue while netdev_set_num_tc is running:
+
+ 2.1. netdev_set_num_tc starts by resetting the xps queues,
+ dev->tc_num isn't updated yet.
+
+ 2.2. netif_set_xps_queue is called, setting up the map with the
+ *old* dev->num_tc.
+
+ 2.3. netdev_set_num_tc updates dev->tc_num.
+
+ 2.4. Later accesses to the map lead to out of bound accesses and
+ oops.
+
+ A similar issue can be found with netdev_reset_tc.
+
+One way of triggering this is to set an iface up (for which the driver
+uses netdev_set_num_tc in the open path, such as bnx2x) and writing to
+xps_cpus in a concurrent thread. With the right timing an oops is
+triggered.
+
+Both issues have the same fix: netif_set_xps_queue, netdev_set_num_tc
+and netdev_reset_tc should be mutually exclusive. We do that by taking
+the rtnl lock in xps_cpus_store.
+
+Fixes: 184c449f91fe ("net: Add support for XPS with QoS via traffic classes")
+Signed-off-by: Antoine Tenart <atenart@kernel.org>
+Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/net-sysfs.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/net/core/net-sysfs.c
++++ b/net/core/net-sysfs.c
+@@ -1273,7 +1273,13 @@ static ssize_t xps_cpus_store(struct net
+ return err;
+ }
+
++ if (!rtnl_trylock()) {
++ free_cpumask_var(mask);
++ return restart_syscall();
++ }
++
+ err = netif_set_xps_queue(dev, mask, index);
++ rtnl_unlock();
+
+ free_cpumask_var(mask);
+
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Fri, 18 Dec 2020 09:38:43 -0800
+Subject: net: systemport: set dev->max_mtu to UMAC_MAX_MTU_SIZE
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 54ddbdb024882e226055cc4c3c246592ddde2ee5 ]
+
+The driver is already allocating receive buffers of 2KiB and the
+Ethernet MAC is configured to accept frames up to UMAC_MAX_MTU_SIZE.
+
+Fixes: bfcb813203e6 ("net: dsa: configure the MTU for switch ports")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Link: https://lore.kernel.org/r/20201218173843.141046-1-f.fainelli@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bcmsysport.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -2153,6 +2153,7 @@ static int bcm_sysport_probe(struct plat
+ /* HW supported features, none enabled by default */
+ dev->hw_features |= NETIF_F_RXCSUM | NETIF_F_HIGHDMA |
+ NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
++ dev->max_mtu = UMAC_MAX_MTU_SIZE;
+
+ /* Request the WOL interrupt and advertise suspend if available */
+ priv->wol_irq_disabled = 1;
--- /dev/null
+From foo@baz Sun Jan 10 01:16:11 PM CET 2021
+From: "Bjørn Mork" <bjorn@mork.no>
+Date: Wed, 30 Dec 2020 16:24:51 +0100
+Subject: net: usb: qmi_wwan: add Quectel EM160R-GL
+
+From: "Bjørn Mork" <bjorn@mork.no>
+
+[ Upstream commit cfd82dfc9799c53ef109343a23af006a0f6860a9 ]
+
+New modem using ff/ff/30 for QCDM, ff/00/00 for AT and NMEA,
+and ff/ff/ff for RMNET/QMI.
+
+T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0
+D: Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1
+P: Vendor=2c7c ProdID=0620 Rev= 4.09
+S: Manufacturer=Quectel
+S: Product=EM160R-GL
+S: SerialNumber=e31cedc1
+C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=896mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=(none)
+E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
+E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
+E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
+E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
+E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Link: https://lore.kernel.org/r/20201230152451.245271-1-bjorn@mork.no
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/qmi_wwan.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -995,6 +995,7 @@ static const struct usb_device_id produc
+ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0125)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */
+ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0306)}, /* Quectel EP06/EG06/EM06 */
+ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0512)}, /* Quectel EG12/EM12 */
++ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0620)}, /* Quectel EM160R-GL */
+ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0800)}, /* Quectel RM500Q-GL */
+
+ /* 3. Combined interface devices matching on interface number */
--- /dev/null
+From foo@baz Sun Jan 10 01:16:11 PM CET 2021
+From: Manish Chopra <manishc@marvell.com>
+Date: Mon, 21 Dec 2020 06:55:30 -0800
+Subject: qede: fix offload for IPIP tunnel packets
+
+From: Manish Chopra <manishc@marvell.com>
+
+[ Upstream commit 5d5647dad259bb416fd5d3d87012760386d97530 ]
+
+IPIP tunnels packets are unknown to device,
+hence these packets are incorrectly parsed and
+caused the packet corruption, so disable offlods
+for such packets at run time.
+
+Signed-off-by: Manish Chopra <manishc@marvell.com>
+Signed-off-by: Sudarsana Kalluru <skalluru@marvell.com>
+Signed-off-by: Igor Russkikh <irusskikh@marvell.com>
+Link: https://lore.kernel.org/r/20201221145530.7771-1-manishc@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qede/qede_fp.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c
+@@ -1708,6 +1708,11 @@ netdev_features_t qede_features_check(st
+ ntohs(udp_hdr(skb)->dest) != gnv_port))
+ return features & ~(NETIF_F_CSUM_MASK |
+ NETIF_F_GSO_MASK);
++ } else if (l4_proto == IPPROTO_IPIP) {
++ /* IPIP tunnels are unknown to the device or at least unsupported natively,
++ * offloads for them can't be done trivially, so disable them for such skb.
++ */
++ return features & ~(NETIF_F_CSUM_MASK | NETIF_F_GSO_MASK);
+ }
+ }
+
scsi-ide-do-not-set-the-rqf_preempt-flag-for-sense-r.patch
lib-genalloc-fix-the-overflow-when-size-is-too-big.patch
depmod-handle-the-case-of-sbin-depmod-without-sbin-i.patch
+ethernet-ucc_geth-fix-use-after-free-in-ucc_geth_remove.patch
+ethernet-ucc_geth-set-dev-max_mtu-to-1518.patch
+atm-idt77252-call-pci_disable_device-on-error-path.patch
+qede-fix-offload-for-ipip-tunnel-packets.patch
+virtio_net-fix-recursive-call-to-cpus_read_lock.patch
+net-dcb-validate-netlink-message-in-dcb-handler.patch
+net-ncsi-use-real-net-device-for-response-handler.patch
+net-ethernet-fix-memleak-in-ethoc_probe.patch
+net-sysfs-take-the-rtnl-lock-when-storing-xps_cpus.patch
+net-ethernet-ti-cpts-fix-ethtool-output-when-no-ptp_clock-registered.patch
+ipv4-ignore-ecn-bits-for-fib-lookups-in-fib_compute_spec_dst.patch
+net-hns-fix-return-value-check-in-__lb_other_process.patch
+net-hdlc_ppp-fix-issues-when-mod_timer-is-called-while-timer-is-running.patch
+cdc-ncm-remove-connected-log-message.patch
+net-usb-qmi_wwan-add-quectel-em160r-gl.patch
+vhost_net-fix-ubuf-refcount-incorrectly-when-sendmsg-fails.patch
+net-sched-prevent-invalid-scell_log-shift-count.patch
+net-sysfs-take-the-rtnl-lock-when-accessing-xps_cpus_map-and-num_tc.patch
+net-mvpp2-fix-gop-port-3-networking-complex-control-configurations.patch
+net-systemport-set-dev-max_mtu-to-umac_max_mtu_size.patch
--- /dev/null
+From foo@baz Sun Jan 10 01:16:11 PM CET 2021
+From: Yunjian Wang <wangyunjian@huawei.com>
+Date: Tue, 29 Dec 2020 10:01:48 +0800
+Subject: vhost_net: fix ubuf refcount incorrectly when sendmsg fails
+
+From: Yunjian Wang <wangyunjian@huawei.com>
+
+[ Upstream commit 01e31bea7e622f1890c274f4aaaaf8bccd296aa5 ]
+
+Currently the vhost_zerocopy_callback() maybe be called to decrease
+the refcount when sendmsg fails in tun. The error handling in vhost
+handle_tx_zerocopy() will try to decrease the same refcount again.
+This is wrong. To fix this issue, we only call vhost_net_ubuf_put()
+when vq->heads[nvq->desc].len == VHOST_DMA_IN_PROGRESS.
+
+Fixes: bab632d69ee4 ("vhost: vhost TX zero-copy support")
+Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
+Acked-by: Willem de Bruijn <willemb@google.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Link: https://lore.kernel.org/r/1609207308-20544-1-git-send-email-wangyunjian@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/vhost/net.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/vhost/net.c
++++ b/drivers/vhost/net.c
+@@ -466,6 +466,7 @@ static void handle_tx(struct vhost_net *
+ size_t hdr_size;
+ struct socket *sock;
+ struct vhost_net_ubuf_ref *uninitialized_var(ubufs);
++ struct ubuf_info *ubuf;
+ bool zcopy, zcopy_used;
+ int sent_pkts = 0;
+
+@@ -532,9 +533,7 @@ static void handle_tx(struct vhost_net *
+
+ /* use msg_control to pass vhost zerocopy ubuf info to skb */
+ if (zcopy_used) {
+- struct ubuf_info *ubuf;
+ ubuf = nvq->ubuf_info + nvq->upend_idx;
+-
+ vq->heads[nvq->upend_idx].id = cpu_to_vhost32(vq, head);
+ vq->heads[nvq->upend_idx].len = VHOST_DMA_IN_PROGRESS;
+ ubuf->callback = vhost_zerocopy_callback;
+@@ -563,7 +562,8 @@ static void handle_tx(struct vhost_net *
+ err = sock->ops->sendmsg(sock, &msg, len);
+ if (unlikely(err < 0)) {
+ if (zcopy_used) {
+- vhost_net_ubuf_put(ubufs);
++ if (vq->heads[ubuf->desc].len == VHOST_DMA_IN_PROGRESS)
++ vhost_net_ubuf_put(ubufs);
+ nvq->upend_idx = ((unsigned)nvq->upend_idx - 1)
+ % UIO_MAXIOV;
+ }
--- /dev/null
+From foo@baz Sun Jan 10 01:16:11 PM CET 2021
+From: Jeff Dike <jdike@akamai.com>
+Date: Tue, 22 Dec 2020 21:54:21 -0500
+Subject: virtio_net: Fix recursive call to cpus_read_lock()
+
+From: Jeff Dike <jdike@akamai.com>
+
+[ Upstream commit de33212f768c5d9e2fe791b008cb26f92f0aa31c ]
+
+virtnet_set_channels can recursively call cpus_read_lock if CONFIG_XPS
+and CONFIG_HOTPLUG are enabled.
+
+The path is:
+ virtnet_set_channels - calls get_online_cpus(), which is a trivial
+wrapper around cpus_read_lock()
+ netif_set_real_num_tx_queues
+ netif_reset_xps_queues_gt
+ netif_reset_xps_queues - calls cpus_read_lock()
+
+This call chain and potential deadlock happens when the number of TX
+queues is reduced.
+
+This commit the removes netif_set_real_num_[tr]x_queues calls from
+inside the get/put_online_cpus section, as they don't require that it
+be held.
+
+Fixes: 47be24796c13 ("virtio-net: fix the set affinity bug when CPU IDs are not consecutive")
+Signed-off-by: Jeff Dike <jdike@akamai.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Link: https://lore.kernel.org/r/20201223025421.671-1-jdike@akamai.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/virtio_net.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -1788,14 +1788,16 @@ static int virtnet_set_channels(struct n
+
+ get_online_cpus();
+ err = _virtnet_set_queues(vi, queue_pairs);
+- if (!err) {
+- netif_set_real_num_tx_queues(dev, queue_pairs);
+- netif_set_real_num_rx_queues(dev, queue_pairs);
+-
+- virtnet_set_affinity(vi);
++ if (err) {
++ put_online_cpus();
++ goto err;
+ }
++ virtnet_set_affinity(vi);
+ put_online_cpus();
+
++ netif_set_real_num_tx_queues(dev, queue_pairs);
++ netif_set_real_num_rx_queues(dev, queue_pairs);
++ err:
+ return err;
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
