--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Sat, 19 Dec 2020 14:01:44 +0300
+Subject: atm: idt77252: call pci_disable_device() on error path
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 8df66af5c1e5f80562fe728db5ec069b21810144 ]
+
+This error path needs to disable the pci device before returning.
+
+Fixes: ede58ef28e10 ("atm: remove deprecated use of pci api")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/X93dmC4NX0vbTpGp@mwanda
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/atm/idt77252.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/atm/idt77252.c
++++ b/drivers/atm/idt77252.c
+@@ -3607,7 +3607,7 @@ static int idt77252_init_one(struct pci_
+
+ if ((err = dma_set_mask_and_coherent(&pcidev->dev, DMA_BIT_MASK(32)))) {
+ printk("idt77252: can't enable DMA for PCI device at %s\n", pci_name(pcidev));
+- return err;
++ goto err_out_disable_pdev;
+ }
+
+ card = kzalloc(sizeof(struct idt77252_dev), GFP_KERNEL);
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: Roland Dreier <roland@kernel.org>
+Date: Wed, 23 Dec 2020 19:21:16 -0800
+Subject: CDC-NCM: remove "connected" log message
+
+From: Roland Dreier <roland@kernel.org>
+
+[ Upstream commit 59b4a8fa27f5a895582ada1ae5034af7c94a57b5 ]
+
+The cdc_ncm driver passes network connection notifications up to
+usbnet_link_change(), which is the right place for any logging.
+Remove the netdev_info() duplicating this from the driver itself.
+
+This stops devices such as my "TRENDnet USB 10/100/1G/2.5G LAN"
+(ID 20f4:e02b) adapter from spamming the kernel log with
+
+ cdc_ncm 2-2:2.0 enp0s2u2c2: network connection: connected
+
+messages every 60 msec or so.
+
+Signed-off-by: Roland Dreier <roland@kernel.org>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20201224032116.2453938-1-roland@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/cdc_ncm.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -1629,9 +1629,6 @@ static void cdc_ncm_status(struct usbnet
+ * USB_CDC_NOTIFY_NETWORK_CONNECTION notification shall be
+ * sent by device after USB_CDC_NOTIFY_SPEED_CHANGE.
+ */
+- netif_info(dev, link, dev->net,
+- "network connection: %sconnected\n",
+- !!event->wValue ? "" : "dis");
+ usbnet_link_change(dev, !!event->wValue, 0);
+ break;
+
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: Cong Wang <cong.wang@bytedance.com>
+Date: Sat, 26 Dec 2020 15:44:53 -0800
+Subject: erspan: fix version 1 check in gre_parse_header()
+
+From: Cong Wang <cong.wang@bytedance.com>
+
+[ Upstream commit 085c7c4e1c0e50d90b7d90f61a12e12b317a91e2 ]
+
+Both version 0 and version 1 use ETH_P_ERSPAN, but version 0 does not
+have an erspan header. So the check in gre_parse_header() is wrong,
+we have to distinguish version 1 from version 0.
+
+We can just check the gre header length like is_erspan_type1().
+
+Fixes: cb73ee40b1b3 ("net: ip_gre: use erspan key field for tunnel lookup")
+Reported-by: syzbot+f583ce3d4ddf9836b27a@syzkaller.appspotmail.com
+Cc: William Tu <u9012063@gmail.com>
+Cc: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Signed-off-by: Cong Wang <cong.wang@bytedance.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/gre_demux.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/gre_demux.c
++++ b/net/ipv4/gre_demux.c
+@@ -133,7 +133,7 @@ int gre_parse_header(struct sk_buff *skb
+ * to 0 and sets the configured key in the
+ * inner erspan header field
+ */
+- if (greh->protocol == htons(ETH_P_ERSPAN) ||
++ if ((greh->protocol == htons(ETH_P_ERSPAN) && hdr_len != 4) ||
+ greh->protocol == htons(ETH_P_ERSPAN2)) {
+ struct erspan_base_hdr *ershdr;
+
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+Date: Fri, 18 Dec 2020 11:55:38 +0100
+Subject: ethernet: ucc_geth: fix use-after-free in ucc_geth_remove()
+
+From: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+
+[ Upstream commit e925e0cd2a705aaacb0b907bb3691fcac3a973a4 ]
+
+ugeth is the netdiv_priv() part of the netdevice. Accessing the memory
+pointed to by ugeth (such as done by ucc_geth_memclean() and the two
+of_node_puts) after free_netdev() is thus use-after-free.
+
+Fixes: 80a9fad8e89a ("ucc_geth: fix module removal")
+Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/ucc_geth.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/freescale/ucc_geth.c
++++ b/drivers/net/ethernet/freescale/ucc_geth.c
+@@ -3947,12 +3947,12 @@ static int ucc_geth_remove(struct platfo
+ struct device_node *np = ofdev->dev.of_node;
+
+ unregister_netdev(dev);
+- free_netdev(dev);
+ ucc_geth_memclean(ugeth);
+ if (of_phy_is_fixed_link(np))
+ of_phy_deregister_fixed_link(np);
+ of_node_put(ugeth->ug_info->tbi_node);
+ of_node_put(ugeth->ug_info->phy_node);
++ free_netdev(dev);
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+Date: Fri, 18 Dec 2020 11:55:36 +0100
+Subject: ethernet: ucc_geth: set dev->max_mtu to 1518
+
+From: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+
+[ Upstream commit 1385ae5c30f238f81bc6528d897c6d7a0816783f ]
+
+All the buffers and registers are already set up appropriately for an
+MTU slightly above 1500, so we just need to expose this to the
+networking stack. AFAICT, there's no need to implement .ndo_change_mtu
+when the receive buffers are always set up to support the max_mtu.
+
+This fixes several warnings during boot on our mpc8309-board with an
+embedded mv88e6250 switch:
+
+mv88e6085 mdio@e0102120:10: nonfatal error -34 setting MTU 1500 on port 0
+...
+mv88e6085 mdio@e0102120:10: nonfatal error -34 setting MTU 1500 on port 4
+ucc_geth e0102000.ethernet eth1: error -22 setting MTU to 1504 to include DSA overhead
+
+The last line explains what the DSA stack tries to do: achieving an MTU
+of 1500 on-the-wire requires that the master netdevice connected to
+the CPU port supports an MTU of 1500+the tagging overhead.
+
+Fixes: bfcb813203e6 ("net: dsa: configure the MTU for switch ports")
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/ucc_geth.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/freescale/ucc_geth.c
++++ b/drivers/net/ethernet/freescale/ucc_geth.c
+@@ -3902,6 +3902,7 @@ static int ucc_geth_probe(struct platfor
+ INIT_WORK(&ugeth->timeout_work, ucc_geth_timeout_work);
+ netif_napi_add(dev, &ugeth->napi, ucc_geth_poll, 64);
+ dev->mtu = 1500;
++ dev->max_mtu = 1518;
+
+ ugeth->msg_enable = netif_msg_init(debug.msg_enable, UGETH_MSG_DEFAULT);
+ ugeth->phy_interface = phy_interface;
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
+Date: Thu, 22 Oct 2020 12:39:36 +0200
+Subject: i40e: Fix Error I40E_AQ_RC_EINVAL when removing VFs
+
+From: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
+
+[ Upstream commit 3ac874fa84d1baaf0c0175f2a1499f5d88d528b2 ]
+
+When removing VFs for PF added to bridge there was
+an error I40E_AQ_RC_EINVAL. It was caused by not properly
+resetting and reinitializing PF when adding/removing VFs.
+Changed how reset is performed when adding/removing VFs
+to properly reinitialize PFs VSI.
+
+Fixes: fc60861e9b00 ("i40e: start up in VEPA mode by default")
+Signed-off-by: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
+Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e.h | 3 +++
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 10 ++++++++++
+ drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 4 ++--
+ 3 files changed, 15 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e.h
++++ b/drivers/net/ethernet/intel/i40e/i40e.h
+@@ -127,6 +127,7 @@ enum i40e_state_t {
+ __I40E_RESET_INTR_RECEIVED,
+ __I40E_REINIT_REQUESTED,
+ __I40E_PF_RESET_REQUESTED,
++ __I40E_PF_RESET_AND_REBUILD_REQUESTED,
+ __I40E_CORE_RESET_REQUESTED,
+ __I40E_GLOBAL_RESET_REQUESTED,
+ __I40E_EMP_RESET_REQUESTED,
+@@ -153,6 +154,8 @@ enum i40e_state_t {
+ };
+
+ #define I40E_PF_RESET_FLAG BIT_ULL(__I40E_PF_RESET_REQUESTED)
++#define I40E_PF_RESET_AND_REBUILD_FLAG \
++ BIT_ULL(__I40E_PF_RESET_AND_REBUILD_REQUESTED)
+
+ /* VSI state flags */
+ enum i40e_vsi_state_t {
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -42,6 +42,8 @@ static int i40e_setup_misc_vector(struct
+ static void i40e_determine_queue_usage(struct i40e_pf *pf);
+ static int i40e_setup_pf_filter_control(struct i40e_pf *pf);
+ static void i40e_prep_for_reset(struct i40e_pf *pf, bool lock_acquired);
++static void i40e_reset_and_rebuild(struct i40e_pf *pf, bool reinit,
++ bool lock_acquired);
+ static int i40e_reset(struct i40e_pf *pf);
+ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired);
+ static void i40e_fdir_sb_setup(struct i40e_pf *pf);
+@@ -7929,6 +7931,14 @@ void i40e_do_reset(struct i40e_pf *pf, u
+ dev_dbg(&pf->pdev->dev, "PFR requested\n");
+ i40e_handle_reset_warning(pf, lock_acquired);
+
++ } else if (reset_flags & I40E_PF_RESET_AND_REBUILD_FLAG) {
++ /* Request a PF Reset
++ *
++ * Resets PF and reinitializes PFs VSI.
++ */
++ i40e_prep_for_reset(pf, lock_acquired);
++ i40e_reset_and_rebuild(pf, true, lock_acquired);
++
+ } else if (reset_flags & BIT_ULL(__I40E_REINIT_REQUESTED)) {
+ int v;
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -1567,7 +1567,7 @@ int i40e_pci_sriov_configure(struct pci_
+ if (num_vfs) {
+ if (!(pf->flags & I40E_FLAG_VEB_MODE_ENABLED)) {
+ pf->flags |= I40E_FLAG_VEB_MODE_ENABLED;
+- i40e_do_reset_safe(pf, I40E_PF_RESET_FLAG);
++ i40e_do_reset_safe(pf, I40E_PF_RESET_AND_REBUILD_FLAG);
+ }
+ return i40e_pci_sriov_enable(pdev, num_vfs);
+ }
+@@ -1575,7 +1575,7 @@ int i40e_pci_sriov_configure(struct pci_
+ if (!pci_vfs_assigned(pf->pdev)) {
+ i40e_free_vfs(pf);
+ pf->flags &= ~I40E_FLAG_VEB_MODE_ENABLED;
+- i40e_do_reset_safe(pf, I40E_PF_RESET_FLAG);
++ i40e_do_reset_safe(pf, I40E_PF_RESET_AND_REBUILD_FLAG);
+ } else {
+ dev_warn(&pdev->dev, "Unable to free VFs because some are assigned to VMs.\n");
+ return -EINVAL;
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: Guillaume Nault <gnault@redhat.com>
+Date: Thu, 24 Dec 2020 20:01:09 +0100
+Subject: ipv4: Ignore ECN bits for fib lookups in fib_compute_spec_dst()
+
+From: Guillaume Nault <gnault@redhat.com>
+
+[ Upstream commit 21fdca22eb7df2a1e194b8adb812ce370748b733 ]
+
+RT_TOS() only clears one of the ECN bits. Therefore, when
+fib_compute_spec_dst() resorts to a fib lookup, it can return
+different results depending on the value of the second ECN bit.
+
+For example, ECT(0) and ECT(1) packets could be treated differently.
+
+ $ ip netns add ns0
+ $ ip netns add ns1
+ $ ip link add name veth01 netns ns0 type veth peer name veth10 netns ns1
+ $ ip -netns ns0 link set dev lo up
+ $ ip -netns ns1 link set dev lo up
+ $ ip -netns ns0 link set dev veth01 up
+ $ ip -netns ns1 link set dev veth10 up
+
+ $ ip -netns ns0 address add 192.0.2.10/24 dev veth01
+ $ ip -netns ns1 address add 192.0.2.11/24 dev veth10
+
+ $ ip -netns ns1 address add 192.0.2.21/32 dev lo
+ $ ip -netns ns1 route add 192.0.2.10/32 tos 4 dev veth10 src 192.0.2.21
+ $ ip netns exec ns1 sysctl -wq net.ipv4.icmp_echo_ignore_broadcasts=0
+
+With TOS 4 and ECT(1), ns1 replies using source address 192.0.2.21
+(ping uses -Q to set all TOS and ECN bits):
+
+ $ ip netns exec ns0 ping -c 1 -b -Q 5 192.0.2.255
+ [...]
+ 64 bytes from 192.0.2.21: icmp_seq=1 ttl=64 time=0.544 ms
+
+But with TOS 4 and ECT(0), ns1 replies using source address 192.0.2.11
+because the "tos 4" route isn't matched:
+
+ $ ip netns exec ns0 ping -c 1 -b -Q 6 192.0.2.255
+ [...]
+ 64 bytes from 192.0.2.11: icmp_seq=1 ttl=64 time=0.597 ms
+
+After this patch the ECN bits don't affect the result anymore:
+
+ $ ip netns exec ns0 ping -c 1 -b -Q 6 192.0.2.255
+ [...]
+ 64 bytes from 192.0.2.21: icmp_seq=1 ttl=64 time=0.591 ms
+
+Fixes: 35ebf65e851c ("ipv4: Create and use fib_compute_spec_dst() helper.")
+Signed-off-by: Guillaume Nault <gnault@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/fib_frontend.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -302,7 +302,7 @@ __be32 fib_compute_spec_dst(struct sk_bu
+ .flowi4_iif = LOOPBACK_IFINDEX,
+ .flowi4_oif = l3mdev_master_ifindex_rcu(dev),
+ .daddr = ip_hdr(skb)->saddr,
+- .flowi4_tos = RT_TOS(ip_hdr(skb)->tos),
++ .flowi4_tos = ip_hdr(skb)->tos & IPTOS_RT_MASK,
+ .flowi4_scope = scope,
+ .flowi4_mark = vmark ? skb->mark : 0,
+ };
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: Petr Machata <me@pmachata.org>
+Date: Tue, 22 Dec 2020 22:49:44 +0100
+Subject: net: dcb: Validate netlink message in DCB handler
+
+From: Petr Machata <me@pmachata.org>
+
+[ Upstream commit 826f328e2b7e8854dd42ea44e6519cd75018e7b1 ]
+
+DCB uses the same handler function for both RTM_GETDCB and RTM_SETDCB
+messages. dcb_doit() bounces RTM_SETDCB mesasges if the user does not have
+the CAP_NET_ADMIN capability.
+
+However, the operation to be performed is not decided from the DCB message
+type, but from the DCB command. Thus DCB_CMD_*_GET commands are used for
+reading DCB objects, the corresponding SET and DEL commands are used for
+manipulation.
+
+The assumption is that set-like commands will be sent via an RTM_SETDCB
+message, and get-like ones via RTM_GETDCB. However, this assumption is not
+enforced.
+
+It is therefore possible to manipulate DCB objects without CAP_NET_ADMIN
+capability by sending the corresponding command in an RTM_GETDCB message.
+That is a bug. Fix it by validating the type of the request message against
+the type used for the response.
+
+Fixes: 2f90b8657ec9 ("ixgbe: this patch adds support for DCB to the kernel and ixgbe driver")
+Signed-off-by: Petr Machata <me@pmachata.org>
+Link: https://lore.kernel.org/r/a2a9b88418f3a58ef211b718f2970128ef9e3793.1608673640.git.me@pmachata.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/dcb/dcbnl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/dcb/dcbnl.c
++++ b/net/dcb/dcbnl.c
+@@ -1756,6 +1756,8 @@ static int dcb_doit(struct sk_buff *skb,
+ fn = &reply_funcs[dcb->cmd];
+ if (!fn->cb)
+ return -EOPNOTSUPP;
++ if (fn->type != nlh->nlmsg_type)
++ return -EPERM;
+
+ if (!tb[DCB_ATTR_IFNAME])
+ return -EINVAL;
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Date: Wed, 23 Dec 2020 19:06:12 +0800
+Subject: net: ethernet: Fix memleak in ethoc_probe
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit 5d41f9b7ee7a5a5138894f58846a4ffed601498a ]
+
+When mdiobus_register() fails, priv->mdio allocated
+by mdiobus_alloc() has not been freed, which leads
+to memleak.
+
+Fixes: e7f4dc3536a4 ("mdio: Move allocation of interrupts into core")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lore.kernel.org/r/20201223110615.31389-1-dinghao.liu@zju.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ethoc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/ethoc.c
++++ b/drivers/net/ethernet/ethoc.c
+@@ -1213,7 +1213,7 @@ static int ethoc_probe(struct platform_d
+ ret = mdiobus_register(priv->mdio);
+ if (ret) {
+ dev_err(&netdev->dev, "failed to register MDIO bus\n");
+- goto free2;
++ goto free3;
+ }
+
+ ret = ethoc_mdio_probe(netdev);
+@@ -1245,6 +1245,7 @@ error2:
+ netif_napi_del(&priv->napi);
+ error:
+ mdiobus_unregister(priv->mdio);
++free3:
+ mdiobus_free(priv->mdio);
+ free2:
+ clk_disable_unprepare(priv->clk);
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+Date: Thu, 24 Dec 2020 18:24:05 +0200
+Subject: net: ethernet: ti: cpts: fix ethtool output when no ptp_clock registered
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+[ Upstream commit 4614792eebcbf81c60ad3604c1aeeb2b0899cea4 ]
+
+The CPTS driver registers PTP PHC clock when first netif is going up and
+unregister it when all netif are down. Now ethtool will show:
+ - PTP PHC clock index 0 after boot until first netif is up;
+ - the last assigned PTP PHC clock index even if PTP PHC clock is not
+registered any more after all netifs are down.
+
+This patch ensures that -1 is returned by ethtool when PTP PHC clock is not
+registered any more.
+
+Fixes: 8a2c9a5ab4b9 ("net: ethernet: ti: cpts: rework initialization/deinitialization")
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Acked-by: Richard Cochran <richardcochran@gmail.com>
+Link: https://lore.kernel.org/r/20201224162405.28032-1-grygorii.strashko@ti.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ti/cpts.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/ethernet/ti/cpts.c
++++ b/drivers/net/ethernet/ti/cpts.c
+@@ -476,6 +476,7 @@ void cpts_unregister(struct cpts *cpts)
+
+ ptp_clock_unregister(cpts->clock);
+ cpts->clock = NULL;
++ cpts->phc_index = -1;
+
+ cpts_write32(cpts, 0, int_enable);
+ cpts_write32(cpts, 0, control);
+@@ -577,6 +578,7 @@ struct cpts *cpts_create(struct device *
+ cpts->cc.read = cpts_systim_read;
+ cpts->cc.mask = CLOCKSOURCE_MASK(32);
+ cpts->info = cpts_info;
++ cpts->phc_index = -1;
+
+ cpts_calc_mult_shift(cpts);
+ /* save cc.mult original value as it can be modified
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: Xie He <xie.he.0141@gmail.com>
+Date: Sun, 27 Dec 2020 18:53:39 -0800
+Subject: net: hdlc_ppp: Fix issues when mod_timer is called while timer is running
+
+From: Xie He <xie.he.0141@gmail.com>
+
+[ Upstream commit 1fef73597fa545c35fddc953979013882fbd4e55 ]
+
+ppp_cp_event is called directly or indirectly by ppp_rx with "ppp->lock"
+held. It may call mod_timer to add a new timer. However, at the same time
+ppp_timer may be already running and waiting for "ppp->lock". In this
+case, there's no need for ppp_timer to continue running and it can just
+exit.
+
+If we let ppp_timer continue running, it may call add_timer. This causes
+kernel panic because add_timer can't be called with a timer pending.
+This patch fixes this problem.
+
+Fixes: e022c2f07ae5 ("WAN: new synchronous PPP implementation for generic HDLC.")
+Cc: Krzysztof Halasa <khc@pm.waw.pl>
+Signed-off-by: Xie He <xie.he.0141@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wan/hdlc_ppp.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/net/wan/hdlc_ppp.c
++++ b/drivers/net/wan/hdlc_ppp.c
+@@ -572,6 +572,13 @@ static void ppp_timer(struct timer_list
+ unsigned long flags;
+
+ spin_lock_irqsave(&ppp->lock, flags);
++ /* mod_timer could be called after we entered this function but
++ * before we got the lock.
++ */
++ if (timer_pending(&proto->timer)) {
++ spin_unlock_irqrestore(&ppp->lock, flags);
++ return;
++ }
+ switch (proto->state) {
+ case STOPPING:
+ case REQ_SENT:
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: Yunjian Wang <wangyunjian@huawei.com>
+Date: Sat, 26 Dec 2020 16:10:05 +0800
+Subject: net: hns: fix return value check in __lb_other_process()
+
+From: Yunjian Wang <wangyunjian@huawei.com>
+
+[ Upstream commit 5ede3ada3da7f050519112b81badc058190b9f9f ]
+
+The function skb_copy() could return NULL, the return value
+need to be checked.
+
+Fixes: b5996f11ea54 ("net: add Hisilicon Network Subsystem basic ethernet support")
+Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hns_ethtool.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+@@ -419,6 +419,10 @@ static void __lb_other_process(struct hn
+ /* for mutl buffer*/
+ new_skb = skb_copy(skb, GFP_ATOMIC);
+ dev_kfree_skb_any(skb);
++ if (!new_skb) {
++ netdev_err(ndev, "skb alloc failed\n");
++ return;
++ }
+ skb = new_skb;
+
+ check_ok = 0;
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: Stefan Chulski <stefanc@marvell.com>
+Date: Thu, 17 Dec 2020 20:30:17 +0200
+Subject: net: mvpp2: Add TCAM entry to drop flow control pause frames
+
+From: Stefan Chulski <stefanc@marvell.com>
+
+[ Upstream commit 3f48fab62bb81a7f9d01e9d43c40395fad011dd5 ]
+
+Issue:
+Flow control frame used to pause GoP(MAC) was delivered to the CPU
+and created a load on the CPU. Since XOFF/XON frames are used only
+by MAC, these frames should be dropped inside MAC.
+
+Fix:
+According to 802.3-2012 - IEEE Standard for Ethernet pause frame
+has unique destination MAC address 01-80-C2-00-00-01.
+Add TCAM parser entry to track and drop pause frames by destination MAC.
+
+Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit")
+Signed-off-by: Stefan Chulski <stefanc@marvell.com>
+Link: https://lore.kernel.org/r/1608229817-21951-1-git-send-email-stefanc@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c | 33 +++++++++++++++++++++++++
+ drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.h | 2 -
+ 2 files changed, 34 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
+@@ -405,6 +405,38 @@ static int mvpp2_prs_tcam_first_free(str
+ return -EINVAL;
+ }
+
++/* Drop flow control pause frames */
++static void mvpp2_prs_drop_fc(struct mvpp2 *priv)
++{
++ unsigned char da[ETH_ALEN] = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x01 };
++ struct mvpp2_prs_entry pe;
++ unsigned int len;
++
++ memset(&pe, 0, sizeof(pe));
++
++ /* For all ports - drop flow control frames */
++ pe.index = MVPP2_PE_FC_DROP;
++ mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_MAC);
++
++ /* Set match on DA */
++ len = ETH_ALEN;
++ while (len--)
++ mvpp2_prs_tcam_data_byte_set(&pe, len, da[len], 0xff);
++
++ mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_DROP_MASK,
++ MVPP2_PRS_RI_DROP_MASK);
++
++ mvpp2_prs_sram_bits_set(&pe, MVPP2_PRS_SRAM_LU_GEN_BIT, 1);
++ mvpp2_prs_sram_next_lu_set(&pe, MVPP2_PRS_LU_FLOWS);
++
++ /* Mask all ports */
++ mvpp2_prs_tcam_port_map_set(&pe, MVPP2_PRS_PORT_MASK);
++
++ /* Update shadow table and hw entry */
++ mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_MAC);
++ mvpp2_prs_hw_write(priv, &pe);
++}
++
+ /* Enable/disable dropping all mac da's */
+ static void mvpp2_prs_mac_drop_all_set(struct mvpp2 *priv, int port, bool add)
+ {
+@@ -1162,6 +1194,7 @@ static void mvpp2_prs_mac_init(struct mv
+ mvpp2_prs_hw_write(priv, &pe);
+
+ /* Create dummy entries for drop all and promiscuous modes */
++ mvpp2_prs_drop_fc(priv);
+ mvpp2_prs_mac_drop_all_set(priv, 0, false);
+ mvpp2_prs_mac_promisc_set(priv, 0, MVPP2_PRS_L2_UNI_CAST, false);
+ mvpp2_prs_mac_promisc_set(priv, 0, MVPP2_PRS_L2_MULTI_CAST, false);
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.h
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.h
+@@ -129,7 +129,7 @@
+ #define MVPP2_PE_VID_EDSA_FLTR_DEFAULT (MVPP2_PRS_TCAM_SRAM_SIZE - 7)
+ #define MVPP2_PE_VLAN_DBL (MVPP2_PRS_TCAM_SRAM_SIZE - 6)
+ #define MVPP2_PE_VLAN_NONE (MVPP2_PRS_TCAM_SRAM_SIZE - 5)
+-/* reserved */
++#define MVPP2_PE_FC_DROP (MVPP2_PRS_TCAM_SRAM_SIZE - 4)
+ #define MVPP2_PE_MAC_MC_PROMISCUOUS (MVPP2_PRS_TCAM_SRAM_SIZE - 3)
+ #define MVPP2_PE_MAC_UC_PROMISCUOUS (MVPP2_PRS_TCAM_SRAM_SIZE - 2)
+ #define MVPP2_PE_MAC_NON_PROMISCUOUS (MVPP2_PRS_TCAM_SRAM_SIZE - 1)
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: Stefan Chulski <stefanc@marvell.com>
+Date: Sun, 20 Dec 2020 13:02:29 +0200
+Subject: net: mvpp2: Fix GoP port 3 Networking Complex Control configurations
+
+From: Stefan Chulski <stefanc@marvell.com>
+
+[ Upstream commit 2575bc1aa9d52a62342b57a0b7d0a12146cf6aed ]
+
+During GoP port 2 Networking Complex Control mode of operation configurations,
+also GoP port 3 mode of operation was wrongly set.
+Patch removes these configurations.
+
+Fixes: f84bf386f395 ("net: mvpp2: initialize the GoP")
+Acked-by: Marcin Wojtas <mw@semihalf.com>
+Signed-off-by: Stefan Chulski <stefanc@marvell.com>
+Link: https://lore.kernel.org/r/1608462149-1702-1-git-send-email-stefanc@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -954,7 +954,7 @@ static void mvpp22_gop_init_rgmii(struct
+
+ regmap_read(priv->sysctrl_base, GENCONF_CTRL0, &val);
+ if (port->gop_id == 2)
+- val |= GENCONF_CTRL0_PORT0_RGMII | GENCONF_CTRL0_PORT1_RGMII;
++ val |= GENCONF_CTRL0_PORT0_RGMII;
+ else if (port->gop_id == 3)
+ val |= GENCONF_CTRL0_PORT1_RGMII_MII;
+ regmap_write(priv->sysctrl_base, GENCONF_CTRL0, val);
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: Stefan Chulski <stefanc@marvell.com>
+Date: Thu, 17 Dec 2020 20:37:46 +0200
+Subject: net: mvpp2: prs: fix PPPoE with ipv6 packet parse
+
+From: Stefan Chulski <stefanc@marvell.com>
+
+[ Upstream commit fec6079b2eeab319d9e3d074f54d3b6f623e9701 ]
+
+Current PPPoE+IPv6 entry is jumping to 'next-hdr'
+field and not to 'DIP' field as done for IPv4.
+
+Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit")
+Reported-by: Liron Himi <lironh@marvell.com>
+Signed-off-by: Stefan Chulski <stefanc@marvell.com>
+Link: https://lore.kernel.org/r/1608230266-22111-1-git-send-email-stefanc@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
+@@ -1680,8 +1680,9 @@ static int mvpp2_prs_pppoe_init(struct m
+ mvpp2_prs_sram_next_lu_set(&pe, MVPP2_PRS_LU_IP6);
+ mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_L3_IP6,
+ MVPP2_PRS_RI_L3_PROTO_MASK);
+- /* Skip eth_type + 4 bytes of IPv6 header */
+- mvpp2_prs_sram_shift_set(&pe, MVPP2_ETH_TYPE_LEN + 4,
++ /* Jump to DIP of IPV6 header */
++ mvpp2_prs_sram_shift_set(&pe, MVPP2_ETH_TYPE_LEN + 8 +
++ MVPP2_MAX_L3_ADDR_SIZE,
+ MVPP2_PRS_SRAM_OP_SEL_SHIFT_ADD);
+ /* Set L3 offset */
+ mvpp2_prs_sram_offset_set(&pe, MVPP2_PRS_SRAM_UDF_TYPE_L3,
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: John Wang <wangzhiqiang.bj@bytedance.com>
+Date: Wed, 23 Dec 2020 13:55:23 +0800
+Subject: net/ncsi: Use real net-device for response handler
+
+From: John Wang <wangzhiqiang.bj@bytedance.com>
+
+[ Upstream commit 427c940558560bff2583d07fc119a21094675982 ]
+
+When aggregating ncsi interfaces and dedicated interfaces to bond
+interfaces, the ncsi response handler will use the wrong net device to
+find ncsi_dev, so that the ncsi interface will not work properly.
+Here, we use the original net device to fix it.
+
+Fixes: 138635cc27c9 ("net/ncsi: NCSI response packet handler")
+Signed-off-by: John Wang <wangzhiqiang.bj@bytedance.com>
+Link: https://lore.kernel.org/r/20201223055523.2069-1-wangzhiqiang.bj@bytedance.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ncsi/ncsi-rsp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ncsi/ncsi-rsp.c
++++ b/net/ncsi/ncsi-rsp.c
+@@ -949,7 +949,7 @@ int ncsi_rcv_rsp(struct sk_buff *skb, st
+ int payload, i, ret;
+
+ /* Find the NCSI device */
+- nd = ncsi_find_dev(dev);
++ nd = ncsi_find_dev(orig_dev);
+ ndp = nd ? TO_NCSI_DEV_PRIV(nd) : NULL;
+ if (!ndp)
+ return -ENODEV;
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: Randy Dunlap <rdunlap@infradead.org>
+Date: Thu, 24 Dec 2020 22:23:44 -0800
+Subject: net: sched: prevent invalid Scell_log shift count
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit bd1248f1ddbc48b0c30565fce897a3b6423313b8 ]
+
+Check Scell_log shift size in red_check_params() and modify all callers
+of red_check_params() to pass Scell_log.
+
+This prevents a shift out-of-bounds as detected by UBSAN:
+ UBSAN: shift-out-of-bounds in ./include/net/red.h:252:22
+ shift exponent 72 is too large for 32-bit type 'int'
+
+Fixes: 8afa10cbe281 ("net_sched: red: Avoid illegal values")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: syzbot+97c5bd9cc81eca63d36e@syzkaller.appspotmail.com
+Cc: Nogah Frankel <nogahf@mellanox.com>
+Cc: Jamal Hadi Salim <jhs@mojatatu.com>
+Cc: Cong Wang <xiyou.wangcong@gmail.com>
+Cc: Jiri Pirko <jiri@resnulli.us>
+Cc: netdev@vger.kernel.org
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/red.h | 4 +++-
+ net/sched/sch_choke.c | 2 +-
+ net/sched/sch_gred.c | 2 +-
+ net/sched/sch_red.c | 2 +-
+ net/sched/sch_sfq.c | 2 +-
+ 5 files changed, 7 insertions(+), 5 deletions(-)
+
+--- a/include/net/red.h
++++ b/include/net/red.h
+@@ -168,12 +168,14 @@ static inline void red_set_vars(struct r
+ v->qcount = -1;
+ }
+
+-static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog)
++static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, u8 Scell_log)
+ {
+ if (fls(qth_min) + Wlog > 32)
+ return false;
+ if (fls(qth_max) + Wlog > 32)
+ return false;
++ if (Scell_log >= 32)
++ return false;
+ if (qth_max < qth_min)
+ return false;
+ return true;
+--- a/net/sched/sch_choke.c
++++ b/net/sched/sch_choke.c
+@@ -371,7 +371,7 @@ static int choke_change(struct Qdisc *sc
+
+ ctl = nla_data(tb[TCA_CHOKE_PARMS]);
+
+- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog))
++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log))
+ return -EINVAL;
+
+ if (ctl->limit > CHOKE_MAX_QUEUE)
+--- a/net/sched/sch_gred.c
++++ b/net/sched/sch_gred.c
+@@ -357,7 +357,7 @@ static inline int gred_change_vq(struct
+ struct gred_sched *table = qdisc_priv(sch);
+ struct gred_sched_data *q = table->tab[dp];
+
+- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog))
++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log))
+ return -EINVAL;
+
+ if (!q) {
+--- a/net/sched/sch_red.c
++++ b/net/sched/sch_red.c
+@@ -214,7 +214,7 @@ static int red_change(struct Qdisc *sch,
+ max_P = tb[TCA_RED_MAX_P] ? nla_get_u32(tb[TCA_RED_MAX_P]) : 0;
+
+ ctl = nla_data(tb[TCA_RED_PARMS]);
+- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog))
++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log))
+ return -EINVAL;
+
+ if (ctl->limit > 0) {
+--- a/net/sched/sch_sfq.c
++++ b/net/sched/sch_sfq.c
+@@ -651,7 +651,7 @@ static int sfq_change(struct Qdisc *sch,
+ }
+
+ if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max,
+- ctl_v1->Wlog))
++ ctl_v1->Wlog, ctl_v1->Scell_log))
+ return -EINVAL;
+ if (ctl_v1 && ctl_v1->qth_min) {
+ p = kmalloc(sizeof(*p), GFP_KERNEL);
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: Antoine Tenart <atenart@kernel.org>
+Date: Wed, 23 Dec 2020 22:23:21 +0100
+Subject: net-sysfs: take the rtnl lock when accessing xps_cpus_map and num_tc
+
+From: Antoine Tenart <atenart@kernel.org>
+
+[ Upstream commit fb25038586d0064123e393cadf1fadd70a9df97a ]
+
+Accesses to dev->xps_cpus_map (when using dev->num_tc) should be
+protected by the rtnl lock, like we do for netif_set_xps_queue. I didn't
+see an actual bug being triggered, but let's be safe here and take the
+rtnl lock while accessing the map in sysfs.
+
+Fixes: 184c449f91fe ("net: Add support for XPS with QoS via traffic classes")
+Signed-off-by: Antoine Tenart <atenart@kernel.org>
+Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/net-sysfs.c | 29 ++++++++++++++++++++++-------
+ 1 file changed, 22 insertions(+), 7 deletions(-)
+
+--- a/net/core/net-sysfs.c
++++ b/net/core/net-sysfs.c
+@@ -1244,8 +1244,8 @@ static const struct attribute_group dql_
+ static ssize_t xps_cpus_show(struct netdev_queue *queue,
+ char *buf)
+ {
++ int cpu, len, ret, num_tc = 1, tc = 0;
+ struct net_device *dev = queue->dev;
+- int cpu, len, num_tc = 1, tc = 0;
+ struct xps_dev_maps *dev_maps;
+ cpumask_var_t mask;
+ unsigned long index;
+@@ -1255,22 +1255,31 @@ static ssize_t xps_cpus_show(struct netd
+
+ index = get_netdev_queue_index(queue);
+
++ if (!rtnl_trylock())
++ return restart_syscall();
++
+ if (dev->num_tc) {
+ /* Do not allow XPS on subordinate device directly */
+ num_tc = dev->num_tc;
+- if (num_tc < 0)
+- return -EINVAL;
++ if (num_tc < 0) {
++ ret = -EINVAL;
++ goto err_rtnl_unlock;
++ }
+
+ /* If queue belongs to subordinate dev use its map */
+ dev = netdev_get_tx_queue(dev, index)->sb_dev ? : dev;
+
+ tc = netdev_txq_to_tc(dev, index);
+- if (tc < 0)
+- return -EINVAL;
++ if (tc < 0) {
++ ret = -EINVAL;
++ goto err_rtnl_unlock;
++ }
+ }
+
+- if (!zalloc_cpumask_var(&mask, GFP_KERNEL))
+- return -ENOMEM;
++ if (!zalloc_cpumask_var(&mask, GFP_KERNEL)) {
++ ret = -ENOMEM;
++ goto err_rtnl_unlock;
++ }
+
+ rcu_read_lock();
+ dev_maps = rcu_dereference(dev->xps_cpus_map);
+@@ -1293,9 +1302,15 @@ static ssize_t xps_cpus_show(struct netd
+ }
+ rcu_read_unlock();
+
++ rtnl_unlock();
++
+ len = snprintf(buf, PAGE_SIZE, "%*pb\n", cpumask_pr_args(mask));
+ free_cpumask_var(mask);
+ return len < PAGE_SIZE ? len : -EINVAL;
++
++err_rtnl_unlock:
++ rtnl_unlock();
++ return ret;
+ }
+
+ static ssize_t xps_cpus_store(struct netdev_queue *queue,
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: Antoine Tenart <atenart@kernel.org>
+Date: Wed, 23 Dec 2020 22:23:23 +0100
+Subject: net-sysfs: take the rtnl lock when accessing xps_rxqs_map and num_tc
+
+From: Antoine Tenart <atenart@kernel.org>
+
+[ Upstream commit 4ae2bb81649dc03dfc95875f02126b14b773f7ab ]
+
+Accesses to dev->xps_rxqs_map (when using dev->num_tc) should be
+protected by the rtnl lock, like we do for netif_set_xps_queue. I didn't
+see an actual bug being triggered, but let's be safe here and take the
+rtnl lock while accessing the map in sysfs.
+
+Fixes: 8af2c06ff4b1 ("net-sysfs: Add interface for Rx queue(s) map per Tx queue")
+Signed-off-by: Antoine Tenart <atenart@kernel.org>
+Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/net-sysfs.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+--- a/net/core/net-sysfs.c
++++ b/net/core/net-sysfs.c
+@@ -1356,23 +1356,30 @@ static struct netdev_queue_attribute xps
+
+ static ssize_t xps_rxqs_show(struct netdev_queue *queue, char *buf)
+ {
++ int j, len, ret, num_tc = 1, tc = 0;
+ struct net_device *dev = queue->dev;
+ struct xps_dev_maps *dev_maps;
+ unsigned long *mask, index;
+- int j, len, num_tc = 1, tc = 0;
+
+ index = get_netdev_queue_index(queue);
+
++ if (!rtnl_trylock())
++ return restart_syscall();
++
+ if (dev->num_tc) {
+ num_tc = dev->num_tc;
+ tc = netdev_txq_to_tc(dev, index);
+- if (tc < 0)
+- return -EINVAL;
++ if (tc < 0) {
++ ret = -EINVAL;
++ goto err_rtnl_unlock;
++ }
+ }
+ mask = kcalloc(BITS_TO_LONGS(dev->num_rx_queues), sizeof(long),
+ GFP_KERNEL);
+- if (!mask)
+- return -ENOMEM;
++ if (!mask) {
++ ret = -ENOMEM;
++ goto err_rtnl_unlock;
++ }
+
+ rcu_read_lock();
+ dev_maps = rcu_dereference(dev->xps_rxqs_map);
+@@ -1398,10 +1405,16 @@ static ssize_t xps_rxqs_show(struct netd
+ out_no_maps:
+ rcu_read_unlock();
+
++ rtnl_unlock();
++
+ len = bitmap_print_to_pagebuf(false, buf, mask, dev->num_rx_queues);
+ kfree(mask);
+
+ return len < PAGE_SIZE ? len : -EINVAL;
++
++err_rtnl_unlock:
++ rtnl_unlock();
++ return ret;
+ }
+
+ static ssize_t xps_rxqs_store(struct netdev_queue *queue, const char *buf,
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: Antoine Tenart <atenart@kernel.org>
+Date: Wed, 23 Dec 2020 22:23:20 +0100
+Subject: net-sysfs: take the rtnl lock when storing xps_cpus
+
+From: Antoine Tenart <atenart@kernel.org>
+
+[ Upstream commit 1ad58225dba3f2f598d2c6daed4323f24547168f ]
+
+Two race conditions can be triggered when storing xps cpus, resulting in
+various oops and invalid memory accesses:
+
+1. Calling netdev_set_num_tc while netif_set_xps_queue:
+
+ - netif_set_xps_queue uses dev->tc_num as one of the parameters to
+ compute the size of new_dev_maps when allocating it. dev->tc_num is
+ also used to access the map, and the compiler may generate code to
+ retrieve this field multiple times in the function.
+
+ - netdev_set_num_tc sets dev->tc_num.
+
+ If new_dev_maps is allocated using dev->tc_num and then dev->tc_num
+ is set to a higher value through netdev_set_num_tc, later accesses to
+ new_dev_maps in netif_set_xps_queue could lead to accessing memory
+ outside of new_dev_maps; triggering an oops.
+
+2. Calling netif_set_xps_queue while netdev_set_num_tc is running:
+
+ 2.1. netdev_set_num_tc starts by resetting the xps queues,
+ dev->tc_num isn't updated yet.
+
+ 2.2. netif_set_xps_queue is called, setting up the map with the
+ *old* dev->num_tc.
+
+ 2.3. netdev_set_num_tc updates dev->tc_num.
+
+ 2.4. Later accesses to the map lead to out of bound accesses and
+ oops.
+
+ A similar issue can be found with netdev_reset_tc.
+
+One way of triggering this is to set an iface up (for which the driver
+uses netdev_set_num_tc in the open path, such as bnx2x) and writing to
+xps_cpus in a concurrent thread. With the right timing an oops is
+triggered.
+
+Both issues have the same fix: netif_set_xps_queue, netdev_set_num_tc
+and netdev_reset_tc should be mutually exclusive. We do that by taking
+the rtnl lock in xps_cpus_store.
+
+Fixes: 184c449f91fe ("net: Add support for XPS with QoS via traffic classes")
+Signed-off-by: Antoine Tenart <atenart@kernel.org>
+Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/net-sysfs.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/net/core/net-sysfs.c
++++ b/net/core/net-sysfs.c
+@@ -1323,7 +1323,13 @@ static ssize_t xps_cpus_store(struct net
+ return err;
+ }
+
++ if (!rtnl_trylock()) {
++ free_cpumask_var(mask);
++ return restart_syscall();
++ }
++
+ err = netif_set_xps_queue(dev, mask, index);
++ rtnl_unlock();
+
+ free_cpumask_var(mask);
+
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: Antoine Tenart <atenart@kernel.org>
+Date: Wed, 23 Dec 2020 22:23:22 +0100
+Subject: net-sysfs: take the rtnl lock when storing xps_rxqs
+
+From: Antoine Tenart <atenart@kernel.org>
+
+[ Upstream commit 2d57b4f142e0b03e854612b8e28978935414bced ]
+
+Two race conditions can be triggered when storing xps rxqs, resulting in
+various oops and invalid memory accesses:
+
+1. Calling netdev_set_num_tc while netif_set_xps_queue:
+
+ - netif_set_xps_queue uses dev->tc_num as one of the parameters to
+ compute the size of new_dev_maps when allocating it. dev->tc_num is
+ also used to access the map, and the compiler may generate code to
+ retrieve this field multiple times in the function.
+
+ - netdev_set_num_tc sets dev->tc_num.
+
+ If new_dev_maps is allocated using dev->tc_num and then dev->tc_num
+ is set to a higher value through netdev_set_num_tc, later accesses to
+ new_dev_maps in netif_set_xps_queue could lead to accessing memory
+ outside of new_dev_maps; triggering an oops.
+
+2. Calling netif_set_xps_queue while netdev_set_num_tc is running:
+
+ 2.1. netdev_set_num_tc starts by resetting the xps queues,
+ dev->tc_num isn't updated yet.
+
+ 2.2. netif_set_xps_queue is called, setting up the map with the
+ *old* dev->num_tc.
+
+ 2.3. netdev_set_num_tc updates dev->tc_num.
+
+ 2.4. Later accesses to the map lead to out of bound accesses and
+ oops.
+
+ A similar issue can be found with netdev_reset_tc.
+
+One way of triggering this is to set an iface up (for which the driver
+uses netdev_set_num_tc in the open path, such as bnx2x) and writing to
+xps_rxqs in a concurrent thread. With the right timing an oops is
+triggered.
+
+Both issues have the same fix: netif_set_xps_queue, netdev_set_num_tc
+and netdev_reset_tc should be mutually exclusive. We do that by taking
+the rtnl lock in xps_rxqs_store.
+
+Fixes: 8af2c06ff4b1 ("net-sysfs: Add interface for Rx queue(s) map per Tx queue")
+Signed-off-by: Antoine Tenart <atenart@kernel.org>
+Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/net-sysfs.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/net/core/net-sysfs.c
++++ b/net/core/net-sysfs.c
+@@ -1428,10 +1428,17 @@ static ssize_t xps_rxqs_store(struct net
+ return err;
+ }
+
++ if (!rtnl_trylock()) {
++ bitmap_free(mask);
++ return restart_syscall();
++ }
++
+ cpus_read_lock();
+ err = __netif_set_xps_queue(dev, mask, index, true);
+ cpus_read_unlock();
+
++ rtnl_unlock();
++
+ kfree(mask);
+ return err ? : len;
+ }
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Fri, 18 Dec 2020 09:38:43 -0800
+Subject: net: systemport: set dev->max_mtu to UMAC_MAX_MTU_SIZE
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 54ddbdb024882e226055cc4c3c246592ddde2ee5 ]
+
+The driver is already allocating receive buffers of 2KiB and the
+Ethernet MAC is configured to accept frames up to UMAC_MAX_MTU_SIZE.
+
+Fixes: bfcb813203e6 ("net: dsa: configure the MTU for switch ports")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Link: https://lore.kernel.org/r/20201218173843.141046-1-f.fainelli@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bcmsysport.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -2507,6 +2507,7 @@ static int bcm_sysport_probe(struct plat
+ /* HW supported features, none enabled by default */
+ dev->hw_features |= NETIF_F_RXCSUM | NETIF_F_HIGHDMA |
+ NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
++ dev->max_mtu = UMAC_MAX_MTU_SIZE;
+
+ /* Request the WOL interrupt and advertise suspend if available */
+ priv->wol_irq_disabled = 1;
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: "Bjørn Mork" <bjorn@mork.no>
+Date: Wed, 30 Dec 2020 16:24:51 +0100
+Subject: net: usb: qmi_wwan: add Quectel EM160R-GL
+
+From: "Bjørn Mork" <bjorn@mork.no>
+
+[ Upstream commit cfd82dfc9799c53ef109343a23af006a0f6860a9 ]
+
+New modem using ff/ff/30 for QCDM, ff/00/00 for AT and NMEA,
+and ff/ff/ff for RMNET/QMI.
+
+T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0
+D: Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1
+P: Vendor=2c7c ProdID=0620 Rev= 4.09
+S: Manufacturer=Quectel
+S: Product=EM160R-GL
+S: SerialNumber=e31cedc1
+C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=896mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=(none)
+E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
+E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
+E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
+E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
+E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Link: https://lore.kernel.org/r/20201230152451.245271-1-bjorn@mork.no
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/qmi_wwan.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -995,6 +995,7 @@ static const struct usb_device_id produc
+ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0125)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */
+ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0306)}, /* Quectel EP06/EG06/EM06 */
+ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0512)}, /* Quectel EG12/EM12 */
++ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0620)}, /* Quectel EM160R-GL */
+ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0800)}, /* Quectel RM500Q-GL */
+
+ /* 3. Combined interface devices matching on interface number */
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: Manish Chopra <manishc@marvell.com>
+Date: Mon, 21 Dec 2020 06:55:30 -0800
+Subject: qede: fix offload for IPIP tunnel packets
+
+From: Manish Chopra <manishc@marvell.com>
+
+[ Upstream commit 5d5647dad259bb416fd5d3d87012760386d97530 ]
+
+IPIP tunnels packets are unknown to device,
+hence these packets are incorrectly parsed and
+caused the packet corruption, so disable offlods
+for such packets at run time.
+
+Signed-off-by: Manish Chopra <manishc@marvell.com>
+Signed-off-by: Sudarsana Kalluru <skalluru@marvell.com>
+Signed-off-by: Igor Russkikh <irusskikh@marvell.com>
+Link: https://lore.kernel.org/r/20201221145530.7771-1-manishc@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qede/qede_fp.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c
+@@ -1747,6 +1747,11 @@ netdev_features_t qede_features_check(st
+ ntohs(udp_hdr(skb)->dest) != gnv_port))
+ return features & ~(NETIF_F_CSUM_MASK |
+ NETIF_F_GSO_MASK);
++ } else if (l4_proto == IPPROTO_IPIP) {
++ /* IPIP tunnels are unknown to the device or at least unsupported natively,
++ * offloads for them can't be done trivially, so disable them for such skb.
++ */
++ return features & ~(NETIF_F_CSUM_MASK | NETIF_F_GSO_MASK);
+ }
+ }
+
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Wed, 30 Dec 2020 19:33:34 +0100
+Subject: r8169: work around power-saving bug on some chip versions
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit e80bd76fbf563cc7ed8c9e9f3bbcdf59b0897f69 ]
+
+A user reported failing network with RTL8168dp (a quite rare chip
+version). Realtek confirmed that few chip versions suffer from a PLL
+power-down hw bug.
+
+Fixes: 07df5bd874f0 ("r8169: power down chip in probe")
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://lore.kernel.org/r/a1c39460-d533-7f9e-fa9d-2b8990b02426@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/realtek/r8169.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -4237,7 +4237,8 @@ static void r8168_pll_power_down(struct
+ return;
+
+ switch (tp->mac_version) {
+- case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_33:
++ case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_26:
++ case RTL_GIGA_MAC_VER_32 ... RTL_GIGA_MAC_VER_33:
+ case RTL_GIGA_MAC_VER_37:
+ case RTL_GIGA_MAC_VER_39:
+ case RTL_GIGA_MAC_VER_43:
+@@ -4263,7 +4264,8 @@ static void r8168_pll_power_down(struct
+ static void r8168_pll_power_up(struct rtl8169_private *tp)
+ {
+ switch (tp->mac_version) {
+- case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_33:
++ case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_26:
++ case RTL_GIGA_MAC_VER_32 ... RTL_GIGA_MAC_VER_33:
+ case RTL_GIGA_MAC_VER_37:
+ case RTL_GIGA_MAC_VER_39:
+ case RTL_GIGA_MAC_VER_43:
depmod-handle-the-case-of-sbin-depmod-without-sbin-i.patch
proc-change-nlink-under-proc_subdir_lock.patch
proc-fix-lookup-in-proc-net-subdirectories-after-set.patch
+i40e-fix-error-i40e_aq_rc_einval-when-removing-vfs.patch
+net-mvpp2-add-tcam-entry-to-drop-flow-control-pause-frames.patch
+net-mvpp2-prs-fix-pppoe-with-ipv6-packet-parse.patch
+ethernet-ucc_geth-fix-use-after-free-in-ucc_geth_remove.patch
+ethernet-ucc_geth-set-dev-max_mtu-to-1518.patch
+atm-idt77252-call-pci_disable_device-on-error-path.patch
+net-mvpp2-fix-gop-port-3-networking-complex-control-configurations.patch
+qede-fix-offload-for-ipip-tunnel-packets.patch
+virtio_net-fix-recursive-call-to-cpus_read_lock.patch
+net-dcb-validate-netlink-message-in-dcb-handler.patch
+net-ncsi-use-real-net-device-for-response-handler.patch
+net-ethernet-fix-memleak-in-ethoc_probe.patch
+net-sysfs-take-the-rtnl-lock-when-storing-xps_cpus.patch
+net-sysfs-take-the-rtnl-lock-when-accessing-xps_cpus_map-and-num_tc.patch
+net-ethernet-ti-cpts-fix-ethtool-output-when-no-ptp_clock-registered.patch
+tun-fix-return-value-when-the-number-of-iovs-exceeds-max_skb_frags.patch
+ipv4-ignore-ecn-bits-for-fib-lookups-in-fib_compute_spec_dst.patch
+net-hns-fix-return-value-check-in-__lb_other_process.patch
+erspan-fix-version-1-check-in-gre_parse_header.patch
+net-hdlc_ppp-fix-issues-when-mod_timer-is-called-while-timer-is-running.patch
+cdc-ncm-remove-connected-log-message.patch
+net-usb-qmi_wwan-add-quectel-em160r-gl.patch
+r8169-work-around-power-saving-bug-on-some-chip-versions.patch
+vhost_net-fix-ubuf-refcount-incorrectly-when-sendmsg-fails.patch
+net-sched-prevent-invalid-scell_log-shift-count.patch
+net-sysfs-take-the-rtnl-lock-when-storing-xps_rxqs.patch
+net-sysfs-take-the-rtnl-lock-when-accessing-xps_rxqs_map-and-num_tc.patch
+net-systemport-set-dev-max_mtu-to-umac_max_mtu_size.patch
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: Yunjian Wang <wangyunjian@huawei.com>
+Date: Fri, 25 Dec 2020 10:52:16 +0800
+Subject: tun: fix return value when the number of iovs exceeds MAX_SKB_FRAGS
+
+From: Yunjian Wang <wangyunjian@huawei.com>
+
+[ Upstream commit 950271d7cc0b4546af3549d8143c4132d6e1f138 ]
+
+Currently the tun_napi_alloc_frags() function returns -ENOMEM when the
+number of iovs exceeds MAX_SKB_FRAGS + 1. However this is inappropriate,
+we should use -EMSGSIZE instead of -ENOMEM.
+
+The following distinctions are matters:
+1. the caller need to drop the bad packet when -EMSGSIZE is returned,
+ which means meeting a persistent failure.
+2. the caller can try again when -ENOMEM is returned, which means
+ meeting a transient failure.
+
+Fixes: 90e33d459407 ("tun: enable napi_gro_frags() for TUN/TAP driver")
+Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
+Acked-by: Willem de Bruijn <willemb@google.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Link: https://lore.kernel.org/r/1608864736-24332-1-git-send-email-wangyunjian@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/tun.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1450,7 +1450,7 @@ static struct sk_buff *tun_napi_alloc_fr
+ int i;
+
+ if (it->nr_segs > MAX_SKB_FRAGS + 1)
+- return ERR_PTR(-ENOMEM);
++ return ERR_PTR(-EMSGSIZE);
+
+ local_bh_disable();
+ skb = napi_get_frags(&tfile->napi);
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: Yunjian Wang <wangyunjian@huawei.com>
+Date: Tue, 29 Dec 2020 10:01:48 +0800
+Subject: vhost_net: fix ubuf refcount incorrectly when sendmsg fails
+
+From: Yunjian Wang <wangyunjian@huawei.com>
+
+[ Upstream commit 01e31bea7e622f1890c274f4aaaaf8bccd296aa5 ]
+
+Currently the vhost_zerocopy_callback() maybe be called to decrease
+the refcount when sendmsg fails in tun. The error handling in vhost
+handle_tx_zerocopy() will try to decrease the same refcount again.
+This is wrong. To fix this issue, we only call vhost_net_ubuf_put()
+when vq->heads[nvq->desc].len == VHOST_DMA_IN_PROGRESS.
+
+Fixes: bab632d69ee4 ("vhost: vhost TX zero-copy support")
+Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
+Acked-by: Willem de Bruijn <willemb@google.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Link: https://lore.kernel.org/r/1609207308-20544-1-git-send-email-wangyunjian@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/vhost/net.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/vhost/net.c
++++ b/drivers/vhost/net.c
+@@ -613,6 +613,7 @@ static void handle_tx_zerocopy(struct vh
+ size_t len, total_len = 0;
+ int err;
+ struct vhost_net_ubuf_ref *uninitialized_var(ubufs);
++ struct ubuf_info *ubuf;
+ bool zcopy_used;
+ int sent_pkts = 0;
+
+@@ -645,9 +646,7 @@ static void handle_tx_zerocopy(struct vh
+
+ /* use msg_control to pass vhost zerocopy ubuf info to skb */
+ if (zcopy_used) {
+- struct ubuf_info *ubuf;
+ ubuf = nvq->ubuf_info + nvq->upend_idx;
+-
+ vq->heads[nvq->upend_idx].id = cpu_to_vhost32(vq, head);
+ vq->heads[nvq->upend_idx].len = VHOST_DMA_IN_PROGRESS;
+ ubuf->callback = vhost_zerocopy_callback;
+@@ -675,7 +674,8 @@ static void handle_tx_zerocopy(struct vh
+ err = sock->ops->sendmsg(sock, &msg, len);
+ if (unlikely(err < 0)) {
+ if (zcopy_used) {
+- vhost_net_ubuf_put(ubufs);
++ if (vq->heads[ubuf->desc].len == VHOST_DMA_IN_PROGRESS)
++ vhost_net_ubuf_put(ubufs);
+ nvq->upend_idx = ((unsigned)nvq->upend_idx - 1)
+ % UIO_MAXIOV;
+ }
--- /dev/null
+From foo@baz Sun Jan 10 12:47:32 PM CET 2021
+From: Jeff Dike <jdike@akamai.com>
+Date: Tue, 22 Dec 2020 21:54:21 -0500
+Subject: virtio_net: Fix recursive call to cpus_read_lock()
+
+From: Jeff Dike <jdike@akamai.com>
+
+[ Upstream commit de33212f768c5d9e2fe791b008cb26f92f0aa31c ]
+
+virtnet_set_channels can recursively call cpus_read_lock if CONFIG_XPS
+and CONFIG_HOTPLUG are enabled.
+
+The path is:
+ virtnet_set_channels - calls get_online_cpus(), which is a trivial
+wrapper around cpus_read_lock()
+ netif_set_real_num_tx_queues
+ netif_reset_xps_queues_gt
+ netif_reset_xps_queues - calls cpus_read_lock()
+
+This call chain and potential deadlock happens when the number of TX
+queues is reduced.
+
+This commit the removes netif_set_real_num_[tr]x_queues calls from
+inside the get/put_online_cpus section, as they don't require that it
+be held.
+
+Fixes: 47be24796c13 ("virtio-net: fix the set affinity bug when CPU IDs are not consecutive")
+Signed-off-by: Jeff Dike <jdike@akamai.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Link: https://lore.kernel.org/r/20201223025421.671-1-jdike@akamai.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/virtio_net.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -2077,14 +2077,16 @@ static int virtnet_set_channels(struct n
+
+ get_online_cpus();
+ err = _virtnet_set_queues(vi, queue_pairs);
+- if (!err) {
+- netif_set_real_num_tx_queues(dev, queue_pairs);
+- netif_set_real_num_rx_queues(dev, queue_pairs);
+-
+- virtnet_set_affinity(vi);
++ if (err) {
++ put_online_cpus();
++ goto err;
+ }
++ virtnet_set_affinity(vi);
+ put_online_cpus();
+
++ netif_set_real_num_tx_queues(dev, queue_pairs);
++ netif_set_real_num_rx_queues(dev, queue_pairs);
++ err:
+ return err;
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
