--- /dev/null
+From 5b74c690e1c55953ec99fd9dab74f72dbee4fe95 Mon Sep 17 00:00:00 2001
+From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Date: Thu, 12 May 2022 01:16:51 +0530
+Subject: bpf: Fix sparse warning for bpf_kptr_xchg_proto
+
+From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+
+commit 5b74c690e1c55953ec99fd9dab74f72dbee4fe95 upstream.
+
+Kernel Test Robot complained about missing static storage class
+annotation for bpf_kptr_xchg_proto variable.
+
+sparse: symbol 'bpf_kptr_xchg_proto' was not declared. Should it be static?
+
+This caused by missing extern definition in the header. Add it to
+suppress the sparse warning.
+
+Fixes: c0a5a21c25f3 ("bpf: Allow storing referenced kptr in map")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Link: https://lore.kernel.org/r/20220511194654.765705-2-memxor@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/bpf.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -2228,6 +2228,7 @@ extern const struct bpf_func_proto bpf_f
+ extern const struct bpf_func_proto bpf_loop_proto;
+ extern const struct bpf_func_proto bpf_strncmp_proto;
+ extern const struct bpf_func_proto bpf_copy_from_user_task_proto;
++extern const struct bpf_func_proto bpf_kptr_xchg_proto;
+
+ const struct bpf_func_proto *tracing_prog_func_proto(
+ enum bpf_func_id func_id, const struct bpf_prog *prog);
--- /dev/null
+From 1ec5ee8c8a5a65ea377f8bea64bf4d5b743f6f79 Mon Sep 17 00:00:00 2001
+From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Date: Sat, 21 May 2022 18:56:20 +0530
+Subject: bpf: Suppress 'passing zero to PTR_ERR' warning
+
+From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+
+commit 1ec5ee8c8a5a65ea377f8bea64bf4d5b743f6f79 upstream.
+
+Kernel Test Robot complains about passing zero to PTR_ERR for the said
+line, suppress it by using PTR_ERR_OR_ZERO.
+
+Fixes: c0a5a21c25f3 ("bpf: Allow storing referenced kptr in map")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20220521132620.1976921-1-memxor@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/bpf/verifier.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -5327,7 +5327,7 @@ static int process_kptr_func(struct bpf_
+ return -EINVAL;
+ }
+ if (!map_value_has_kptrs(map_ptr)) {
+- ret = PTR_ERR(map_ptr->kptr_off_tab);
++ ret = PTR_ERR_OR_ZERO(map_ptr->kptr_off_tab);
+ if (ret == -E2BIG)
+ verbose(env, "map '%s' has more than %d kptr\n", map_ptr->name,
+ BPF_MAP_VALUE_OFF_MAX);
--- /dev/null
+From d6c14da474bf260d73953fbf7992c98d9112aec7 Mon Sep 17 00:00:00 2001
+From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+Date: Mon, 20 Jun 2022 09:52:43 +0200
+Subject: crypto: lib/blake2s - reduce stack frame usage in self test
+
+From: Jason A. Donenfeld <Jason@zx2c4.com>
+
+commit d6c14da474bf260d73953fbf7992c98d9112aec7 upstream.
+
+Using 3 blocks here doesn't give us much more than using 2, and it
+causes a stack frame size warning on certain compiler/config/arch
+combinations:
+
+ lib/crypto/blake2s-selftest.c: In function 'blake2s_selftest':
+>> lib/crypto/blake2s-selftest.c:632:1: warning: the frame size of 1088 bytes is larger than 1024 bytes [-Wframe-larger-than=]
+ 632 | }
+ | ^
+
+So this patch just reduces the block from 3 to 2, which makes the
+warning go away.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Link: https://lore.kernel.org/linux-crypto/202206200851.gE3MHCgd-lkp@intel.com
+Fixes: 2d16803c562e ("crypto: blake2s - remove shash module")
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ lib/crypto/blake2s-selftest.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/lib/crypto/blake2s-selftest.c
++++ b/lib/crypto/blake2s-selftest.c
+@@ -593,7 +593,7 @@ bool __init blake2s_selftest(void)
+ enum { TEST_ALIGNMENT = 16 };
+ u8 unaligned_block[BLAKE2S_BLOCK_SIZE + TEST_ALIGNMENT - 1]
+ __aligned(TEST_ALIGNMENT);
+- u8 blocks[BLAKE2S_BLOCK_SIZE * 3];
++ u8 blocks[BLAKE2S_BLOCK_SIZE * 2];
+ struct blake2s_state state1, state2;
+
+ get_random_bytes(blocks, sizeof(blocks));
+@@ -603,8 +603,8 @@ bool __init blake2s_selftest(void)
+ defined(CONFIG_CRYPTO_ARCH_HAVE_LIB_BLAKE2S)
+ memcpy(&state1, &state, sizeof(state1));
+ memcpy(&state2, &state, sizeof(state2));
+- blake2s_compress(&state1, blocks, 3, BLAKE2S_BLOCK_SIZE);
+- blake2s_compress_generic(&state2, blocks, 3, BLAKE2S_BLOCK_SIZE);
++ blake2s_compress(&state1, blocks, 2, BLAKE2S_BLOCK_SIZE);
++ blake2s_compress_generic(&state2, blocks, 2, BLAKE2S_BLOCK_SIZE);
+ if (memcmp(&state1, &state2, sizeof(state1))) {
+ pr_err("blake2s random compress self-test %d: FAIL\n",
+ i + 1);
--- /dev/null
+From 9030a9e571b3ba250d3d450a98310e3c74ecaff4 Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marex@denx.de>
+Date: Thu, 28 Apr 2022 23:31:32 +0200
+Subject: drm/bridge: tc358767: Fix (e)DP bridge endpoint parsing in dedicated function
+
+From: Marek Vasut <marex@denx.de>
+
+commit 9030a9e571b3ba250d3d450a98310e3c74ecaff4 upstream.
+
+Per toshiba,tc358767.yaml DT binding document, port@2 the output (e)DP
+port is optional. In case this port is not described in DT, the bridge
+driver operates in DPI-to-DP mode. The drm_of_find_panel_or_bridge()
+call in tc_probe_edp_bridge_endpoint() returns -ENODEV in case port@2
+is not present in DT and this specific return value is incorrectly
+propagated outside of tc_probe_edp_bridge_endpoint() function. All
+other error values must be propagated and are propagated correctly.
+
+Return 0 in case the port@2 is missing instead, that reinstates the
+original behavior before the commit this patch fixes.
+
+Fixes: 8478095a8c4b ("drm/bridge: tc358767: Move (e)DP bridge endpoint parsing into dedicated function")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Jonas Karlman <jonas@kwiboo.se>
+Cc: Laurent Pinchart <Laurent.pinchart@ideasonboard.com>
+Cc: Lucas Stach <l.stach@pengutronix.de>
+Cc: Marek Vasut <marex@denx.de>
+Cc: Maxime Ripard <maxime@cerno.tech>
+Cc: Neil Armstrong <narmstrong@baylibre.com>
+Cc: Robert Foss <robert.foss@linaro.org>
+Cc: Sam Ravnborg <sam@ravnborg.org>
+Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220428213132.447890-1-marex@denx.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/bridge/tc358767.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/bridge/tc358767.c
++++ b/drivers/gpu/drm/bridge/tc358767.c
+@@ -1573,7 +1573,7 @@ static int tc_probe_edp_bridge_endpoint(
+ tc->bridge.type = DRM_MODE_CONNECTOR_DisplayPort;
+ }
+
+- return ret;
++ return 0;
+ }
+
+ static void tc_clk_disable(void *data)
--- /dev/null
+From 63569d90863ff26c8b10c8971d1271c17a45224b Mon Sep 17 00:00:00 2001
+From: Tom Rix <trix@redhat.com>
+Date: Wed, 29 Jun 2022 16:01:01 -0400
+Subject: drm/vc4: change vc4_dma_range_matches from a global to static
+
+From: Tom Rix <trix@redhat.com>
+
+commit 63569d90863ff26c8b10c8971d1271c17a45224b upstream.
+
+sparse reports
+drivers/gpu/drm/vc4/vc4_drv.c:270:27: warning: symbol 'vc4_dma_range_matches' was not declared. Should it be static?
+
+vc4_dma_range_matches is only used in vc4_drv.c, so it's storage class specifier
+should be static.
+
+Fixes: da8e393e23ef ("drm/vc4: drv: Adopt the dma configuration from the HVS or V3D component")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220629200101.498138-1-trix@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/vc4/vc4_drv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_drv.c
++++ b/drivers/gpu/drm/vc4/vc4_drv.c
+@@ -209,7 +209,7 @@ static void vc4_match_add_drivers(struct
+ }
+ }
+
+-const struct of_device_id vc4_dma_range_matches[] = {
++static const struct of_device_id vc4_dma_range_matches[] = {
+ { .compatible = "brcm,bcm2711-hvs" },
+ { .compatible = "brcm,bcm2835-hvs" },
+ { .compatible = "brcm,bcm2835-v3d" },
--- /dev/null
+From 4a2c5b7994960fac29cf8a3f4e62855bae1b27d4 Mon Sep 17 00:00:00 2001
+From: Ye Bin <yebin10@huawei.com>
+Date: Mon, 1 Aug 2022 19:26:04 +0800
+Subject: f2fs: fix null-ptr-deref in f2fs_get_dnode_of_data
+
+From: Ye Bin <yebin10@huawei.com>
+
+commit 4a2c5b7994960fac29cf8a3f4e62855bae1b27d4 upstream.
+
+There is issue as follows when test f2fs atomic write:
+F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock
+F2FS-fs (loop0): invalid crc_offset: 0
+F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=1, run fsck to fix.
+F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=2, run fsck to fix.
+==================================================================
+BUG: KASAN: null-ptr-deref in f2fs_get_dnode_of_data+0xac/0x16d0
+Read of size 8 at addr 0000000000000028 by task rep/1990
+
+CPU: 4 PID: 1990 Comm: rep Not tainted 5.19.0-rc6-next-20220715 #266
+Call Trace:
+ <TASK>
+ dump_stack_lvl+0x6e/0x91
+ print_report.cold+0x49a/0x6bb
+ kasan_report+0xa8/0x130
+ f2fs_get_dnode_of_data+0xac/0x16d0
+ f2fs_do_write_data_page+0x2a5/0x1030
+ move_data_page+0x3c5/0xdf0
+ do_garbage_collect+0x2015/0x36c0
+ f2fs_gc+0x554/0x1d30
+ f2fs_balance_fs+0x7f5/0xda0
+ f2fs_write_single_data_page+0xb66/0xdc0
+ f2fs_write_cache_pages+0x716/0x1420
+ f2fs_write_data_pages+0x84f/0x9a0
+ do_writepages+0x130/0x3a0
+ filemap_fdatawrite_wbc+0x87/0xa0
+ file_write_and_wait_range+0x157/0x1c0
+ f2fs_do_sync_file+0x206/0x12d0
+ f2fs_sync_file+0x99/0xc0
+ vfs_fsync_range+0x75/0x140
+ f2fs_file_write_iter+0xd7b/0x1850
+ vfs_write+0x645/0x780
+ ksys_write+0xf1/0x1e0
+ do_syscall_64+0x3b/0x90
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+As 3db1de0e582c commit changed atomic write way which new a cow_inode for
+atomic write file, and also mark cow_inode as FI_ATOMIC_FILE.
+When f2fs_do_write_data_page write cow_inode will use cow_inode's cow_inode
+which is NULL. Then will trigger null-ptr-deref.
+To solve above issue, introduce FI_COW_FILE flag for COW inode.
+
+Fiexes: 3db1de0e582c("f2fs: change the current atomic write way")
+Signed-off-by: Ye Bin <yebin10@huawei.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/f2fs.h | 6 ++++++
+ fs/f2fs/file.c | 2 +-
+ fs/f2fs/segment.c | 4 ++--
+ 3 files changed, 9 insertions(+), 3 deletions(-)
+
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -756,6 +756,7 @@ enum {
+ FI_ENABLE_COMPRESS, /* enable compression in "user" compression mode */
+ FI_COMPRESS_RELEASED, /* compressed blocks were released */
+ FI_ALIGNED_WRITE, /* enable aligned write */
++ FI_COW_FILE, /* indicate COW file */
+ FI_MAX, /* max flag, never be used */
+ };
+
+@@ -3188,6 +3189,11 @@ static inline bool f2fs_is_atomic_file(s
+ return is_inode_flag_set(inode, FI_ATOMIC_FILE);
+ }
+
++static inline bool f2fs_is_cow_file(struct inode *inode)
++{
++ return is_inode_flag_set(inode, FI_COW_FILE);
++}
++
+ static inline bool f2fs_is_first_block_written(struct inode *inode)
+ {
+ return is_inode_flag_set(inode, FI_FIRST_BLOCK_WRITTEN);
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -2055,7 +2055,7 @@ static int f2fs_ioc_start_atomic_write(s
+ spin_unlock(&sbi->inode_lock[ATOMIC_FILE]);
+
+ set_inode_flag(inode, FI_ATOMIC_FILE);
+- set_inode_flag(fi->cow_inode, FI_ATOMIC_FILE);
++ set_inode_flag(fi->cow_inode, FI_COW_FILE);
+ clear_inode_flag(fi->cow_inode, FI_INLINE_DATA);
+ f2fs_up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
+
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -193,7 +193,7 @@ void f2fs_abort_atomic_write(struct inod
+ if (f2fs_is_atomic_file(inode)) {
+ if (clean)
+ truncate_inode_pages_final(inode->i_mapping);
+- clear_inode_flag(fi->cow_inode, FI_ATOMIC_FILE);
++ clear_inode_flag(fi->cow_inode, FI_COW_FILE);
+ iput(fi->cow_inode);
+ fi->cow_inode = NULL;
+ clear_inode_flag(inode, FI_ATOMIC_FILE);
+@@ -3167,7 +3167,7 @@ static int __get_segment_type_6(struct f
+ return CURSEG_COLD_DATA;
+ if (file_is_hot(inode) ||
+ is_inode_flag_set(inode, FI_HOT_DATA) ||
+- f2fs_is_atomic_file(inode))
++ f2fs_is_cow_file(inode))
+ return CURSEG_HOT_DATA;
+ return f2fs_rw_hint_to_seg_type(inode->i_write_hint);
+ } else {
--- /dev/null
+From 23339e5752d01a4b5e122759b002cf896d26f6c1 Mon Sep 17 00:00:00 2001
+From: Daeho Jeong <daehojeong@google.com>
+Date: Mon, 1 Aug 2022 10:08:08 -0700
+Subject: f2fs: revive F2FS_IOC_ABORT_VOLATILE_WRITE
+
+From: Daeho Jeong <daehojeong@google.com>
+
+commit 23339e5752d01a4b5e122759b002cf896d26f6c1 upstream.
+
+F2FS_IOC_ABORT_VOLATILE_WRITE was used to abort a atomic write before.
+However it was removed accidentally. So revive it by changing the name,
+since volatile write had gone.
+
+Signed-off-by: Daeho Jeong <daehojeong@google.com>
+Fiexes: 7bc155fec5b3("f2fs: kill volatile write support")
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/file.c | 30 ++++++++++++++++++++++++++++--
+ include/uapi/linux/f2fs.h | 2 +-
+ 2 files changed, 29 insertions(+), 3 deletions(-)
+
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -2102,6 +2102,31 @@ unlock_out:
+ return ret;
+ }
+
++static int f2fs_ioc_abort_atomic_write(struct file *filp)
++{
++ struct inode *inode = file_inode(filp);
++ struct user_namespace *mnt_userns = file_mnt_user_ns(filp);
++ int ret;
++
++ if (!inode_owner_or_capable(mnt_userns, inode))
++ return -EACCES;
++
++ ret = mnt_want_write_file(filp);
++ if (ret)
++ return ret;
++
++ inode_lock(inode);
++
++ if (f2fs_is_atomic_file(inode))
++ f2fs_abort_atomic_write(inode, true);
++
++ inode_unlock(inode);
++
++ mnt_drop_write_file(filp);
++ f2fs_update_time(F2FS_I_SB(inode), REQ_TIME);
++ return ret;
++}
++
+ static int f2fs_ioc_shutdown(struct file *filp, unsigned long arg)
+ {
+ struct inode *inode = file_inode(filp);
+@@ -4039,9 +4064,10 @@ static long __f2fs_ioctl(struct file *fi
+ return f2fs_ioc_start_atomic_write(filp);
+ case F2FS_IOC_COMMIT_ATOMIC_WRITE:
+ return f2fs_ioc_commit_atomic_write(filp);
++ case F2FS_IOC_ABORT_ATOMIC_WRITE:
++ return f2fs_ioc_abort_atomic_write(filp);
+ case F2FS_IOC_START_VOLATILE_WRITE:
+ case F2FS_IOC_RELEASE_VOLATILE_WRITE:
+- case F2FS_IOC_ABORT_VOLATILE_WRITE:
+ return -EOPNOTSUPP;
+ case F2FS_IOC_SHUTDOWN:
+ return f2fs_ioc_shutdown(filp, arg);
+@@ -4666,7 +4692,7 @@ long f2fs_compat_ioctl(struct file *file
+ case F2FS_IOC_COMMIT_ATOMIC_WRITE:
+ case F2FS_IOC_START_VOLATILE_WRITE:
+ case F2FS_IOC_RELEASE_VOLATILE_WRITE:
+- case F2FS_IOC_ABORT_VOLATILE_WRITE:
++ case F2FS_IOC_ABORT_ATOMIC_WRITE:
+ case F2FS_IOC_SHUTDOWN:
+ case FITRIM:
+ case FS_IOC_SET_ENCRYPTION_POLICY:
+--- a/include/uapi/linux/f2fs.h
++++ b/include/uapi/linux/f2fs.h
+@@ -13,7 +13,7 @@
+ #define F2FS_IOC_COMMIT_ATOMIC_WRITE _IO(F2FS_IOCTL_MAGIC, 2)
+ #define F2FS_IOC_START_VOLATILE_WRITE _IO(F2FS_IOCTL_MAGIC, 3)
+ #define F2FS_IOC_RELEASE_VOLATILE_WRITE _IO(F2FS_IOCTL_MAGIC, 4)
+-#define F2FS_IOC_ABORT_VOLATILE_WRITE _IO(F2FS_IOCTL_MAGIC, 5)
++#define F2FS_IOC_ABORT_ATOMIC_WRITE _IO(F2FS_IOCTL_MAGIC, 5)
+ #define F2FS_IOC_GARBAGE_COLLECT _IOW(F2FS_IOCTL_MAGIC, 6, __u32)
+ #define F2FS_IOC_WRITE_CHECKPOINT _IO(F2FS_IOCTL_MAGIC, 7)
+ #define F2FS_IOC_DEFRAGMENT _IOWR(F2FS_IOCTL_MAGIC, 8, \
--- /dev/null
+From 69d93daec026cdda98e29e8edb12534bfa5b1a9b Mon Sep 17 00:00:00 2001
+From: Paolo Abeni <pabeni@redhat.com>
+Date: Thu, 30 Jun 2022 15:17:56 -0700
+Subject: mptcp: refine memory scheduling
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+commit 69d93daec026cdda98e29e8edb12534bfa5b1a9b upstream.
+
+Similar to commit 7c80b038d23e ("net: fix sk_wmem_schedule() and
+sk_rmem_schedule() errors"), let the MPTCP receive path schedule
+exactly the required amount of memory.
+
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/protocol.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -323,9 +323,10 @@ static bool mptcp_rmem_schedule(struct s
+ struct mptcp_sock *msk = mptcp_sk(sk);
+ int amt, amount;
+
+- if (size < msk->rmem_fwd_alloc)
++ if (size <= msk->rmem_fwd_alloc)
+ return true;
+
++ size -= msk->rmem_fwd_alloc;
+ amt = sk_mem_pages(size);
+ amount = amt << SK_MEM_QUANTUM_SHIFT;
+ msk->rmem_fwd_alloc += amount;
--- /dev/null
+From 7e4babffa6f340a74c820d44d44d16511e666424 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Thu, 4 Aug 2022 23:28:17 +0300
+Subject: net: dsa: felix: fix min gate len calculation for tc when its first gate is closed
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+commit 7e4babffa6f340a74c820d44d44d16511e666424 upstream.
+
+min_gate_len[tc] is supposed to track the shortest interval of
+continuously open gates for a traffic class. For example, in the
+following case:
+
+TC 76543210
+
+t0 00000001b 200000 ns
+t1 00000010b 200000 ns
+
+min_gate_len[0] and min_gate_len[1] should be 200000, while
+min_gate_len[2-7] should be 0.
+
+However what happens is that min_gate_len[0] is 200000, but
+min_gate_len[1] ends up being 0 (despite gate_len[1] being 200000 at the
+point where the logic detects the gate close event for TC 1).
+
+The problem is that the code considers a "gate close" event whenever it
+sees that there is a 0 for that TC (essentially it's level rather than
+edge triggered). By doing that, any time a gate is seen as closed
+without having been open prior, gate_len, which is 0, will be written
+into min_gate_len. Once min_gate_len becomes 0, it's impossible for it
+to track anything higher than that (the length of actually open
+intervals).
+
+To fix this, we make the writing to min_gate_len[tc] be edge-triggered,
+which avoids writes for gates that are closed in consecutive intervals.
+However what this does is it makes us need to special-case the
+permanently closed gates at the end.
+
+Fixes: 55a515b1f5a9 ("net: dsa: felix: drop oversized frames with tc-taprio instead of hanging the port")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Link: https://lore.kernel.org/r/20220804202817.1677572-1-vladimir.oltean@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/ocelot/felix_vsc9959.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/dsa/ocelot/felix_vsc9959.c
++++ b/drivers/net/dsa/ocelot/felix_vsc9959.c
+@@ -1133,6 +1133,7 @@ static void vsc9959_tas_min_gate_lengths
+ {
+ struct tc_taprio_sched_entry *entry;
+ u64 gate_len[OCELOT_NUM_TC];
++ u8 gates_ever_opened = 0;
+ int tc, i, n;
+
+ /* Initialize arrays */
+@@ -1160,16 +1161,28 @@ static void vsc9959_tas_min_gate_lengths
+ for (tc = 0; tc < OCELOT_NUM_TC; tc++) {
+ if (entry->gate_mask & BIT(tc)) {
+ gate_len[tc] += entry->interval;
++ gates_ever_opened |= BIT(tc);
+ } else {
+ /* Gate closes now, record a potential new
+ * minimum and reinitialize length
+ */
+- if (min_gate_len[tc] > gate_len[tc])
++ if (min_gate_len[tc] > gate_len[tc] &&
++ gate_len[tc])
+ min_gate_len[tc] = gate_len[tc];
+ gate_len[tc] = 0;
+ }
+ }
+ }
++
++ /* min_gate_len[tc] actually tracks minimum *open* gate time, so for
++ * permanently closed gates, min_gate_len[tc] will still be U64_MAX.
++ * Therefore they are currently indistinguishable from permanently
++ * open gates. Overwrite the gate len with 0 when we know they're
++ * actually permanently closed, i.e. after the loop above.
++ */
++ for (tc = 0; tc < OCELOT_NUM_TC; tc++)
++ if (!(gates_ever_opened & BIT(tc)))
++ min_gate_len[tc] = 0;
+ }
+
+ /* Update QSYS_PORT_MAX_SDU to make sure the static guard bands added by the
--- /dev/null
+From 2642cc6c3bbe0900ba15bab078fd15ad8baccbc5 Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Mon, 20 Jun 2022 13:04:50 +0200
+Subject: net: phy: smsc: Disable Energy Detect Power-Down in interrupt mode
+
+From: Lukas Wunner <lukas@wunner.de>
+
+commit 2642cc6c3bbe0900ba15bab078fd15ad8baccbc5 upstream.
+
+Simon reports that if two LAN9514 USB adapters are directly connected
+without an intermediate switch, the link fails to come up and link LEDs
+remain dark. The issue was introduced by commit 1ce8b37241ed ("usbnet:
+smsc95xx: Forward PHY interrupts to PHY driver to avoid polling").
+
+The PHY suffers from a known erratum wherein link detection becomes
+unreliable if Energy Detect Power-Down is used. In poll mode, the
+driver works around the erratum by briefly disabling EDPD for 640 msec
+to detect a neighbor, then re-enabling it to save power.
+
+In interrupt mode, no interrupt is signaled if EDPD is used by both link
+partners, so it must not be enabled at all.
+
+We'll recoup the power savings by enabling SUSPEND1 mode on affected
+LAN95xx chips in a forthcoming commit.
+
+Fixes: 1ce8b37241ed ("usbnet: smsc95xx: Forward PHY interrupts to PHY driver to avoid polling")
+Reported-by: Simon Han <z.han@kunbus.com>
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Link: https://lore.kernel.org/r/439a3f3168c2f9d44b5fd9bb8d2b551711316be6.1655714438.git.lukas@wunner.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/smsc.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/phy/smsc.c
++++ b/drivers/net/phy/smsc.c
+@@ -110,7 +110,7 @@ static int smsc_phy_config_init(struct p
+ struct smsc_phy_priv *priv = phydev->priv;
+ int rc;
+
+- if (!priv->energy_enable)
++ if (!priv->energy_enable || phydev->irq != PHY_POLL)
+ return 0;
+
+ rc = phy_read(phydev, MII_LAN83C185_CTRL_STATUS);
+@@ -210,6 +210,8 @@ static int lan95xx_config_aneg_ext(struc
+ * response on link pulses to detect presence of plugged Ethernet cable.
+ * The Energy Detect Power-Down mode is enabled again in the end of procedure to
+ * save approximately 220 mW of power if cable is unplugged.
++ * The workaround is only applicable to poll mode. Energy Detect Power-Down may
++ * not be used in interrupt mode lest link change detection becomes unreliable.
+ */
+ static int lan87xx_read_status(struct phy_device *phydev)
+ {
+@@ -217,7 +219,7 @@ static int lan87xx_read_status(struct ph
+
+ int err = genphy_read_status(phydev);
+
+- if (!phydev->link && priv->energy_enable) {
++ if (!phydev->link && priv->energy_enable && phydev->irq == PHY_POLL) {
+ /* Disable EDPD to wake up PHY */
+ int rc = phy_read(phydev, MII_LAN83C185_CTRL_STATUS);
+ if (rc < 0)
--- /dev/null
+From 83ee9f23763a432a4077bf20624ee35de87bce99 Mon Sep 17 00:00:00 2001
+From: Russell Currey <ruscur@russell.cc>
+Date: Wed, 10 Aug 2022 15:43:31 +1000
+Subject: powerpc/kexec: Fix build failure from uninitialised variable
+
+From: Russell Currey <ruscur@russell.cc>
+
+commit 83ee9f23763a432a4077bf20624ee35de87bce99 upstream.
+
+clang 14 won't build because ret is uninitialised and can be returned if
+both prop and fdtprop are NULL. Drop the ret variable and return an
+error in that failure case.
+
+Fixes: b1fc44eaa9ba ("pseries/iommu/ddw: Fix kdump to work in absence of ibm,dma-window")
+Suggested-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Russell Currey <ruscur@russell.cc>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220810054331.373761-1-ruscur@russell.cc
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/kexec/file_load_64.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/arch/powerpc/kexec/file_load_64.c
++++ b/arch/powerpc/kexec/file_load_64.c
+@@ -1043,17 +1043,17 @@ static int copy_property(void *fdt, int
+ const char *propname)
+ {
+ const void *prop, *fdtprop;
+- int len = 0, fdtlen = 0, ret;
++ int len = 0, fdtlen = 0;
+
+ prop = of_get_property(dn, propname, &len);
+ fdtprop = fdt_getprop(fdt, node_offset, propname, &fdtlen);
+
+ if (fdtprop && !prop)
+- ret = fdt_delprop(fdt, node_offset, propname);
++ return fdt_delprop(fdt, node_offset, propname);
+ else if (prop)
+- ret = fdt_setprop(fdt, node_offset, propname, prop, len);
+-
+- return ret;
++ return fdt_setprop(fdt, node_offset, propname, prop, len);
++ else
++ return -FDT_ERR_NOTFOUND;
+ }
+
+ static int update_pci_dma_nodes(void *fdt, const char *dmapropname)
--- /dev/null
+From 97a4d46b1516250d640c1ae0c9e7129d160d6a1c Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Thu, 23 Jun 2022 19:35:40 +0000
+Subject: raw: fix a typo in raw_icmp_error()
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit 97a4d46b1516250d640c1ae0c9e7129d160d6a1c upstream.
+
+I accidentally broke IPv4 traceroute, by swapping iph->saddr
+and iph->daddr.
+
+Probably because raw_icmp_error() and raw_v4_input()
+use different order for iph->saddr and iph->daddr.
+
+Fixes: ba44f8182ec2 ("raw: use more conventional iterators")
+Reported-by: John Sperbeck <jsperbeck@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://lore.kernel.org/r/20220623193540.2851799-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/raw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/raw.c
++++ b/net/ipv4/raw.c
+@@ -278,7 +278,7 @@ void raw_icmp_error(struct sk_buff *skb,
+ hlist_nulls_for_each_entry(sk, hnode, hlist, sk_nulls_node) {
+ iph = (const struct iphdr *)skb->data;
+ if (!raw_v4_match(net, sk, iph->protocol,
+- iph->saddr, iph->daddr, dif, sdif))
++ iph->daddr, iph->saddr, dif, sdif))
+ continue;
+ raw_err(sk, skb, info);
+ }
--- /dev/null
+From c4fceb46add65481ef0dfb79cad24c3c269b4cad Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Wed, 22 Jun 2022 03:23:03 +0000
+Subject: raw: remove unused variables from raw6_icmp_error()
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit c4fceb46add65481ef0dfb79cad24c3c269b4cad upstream.
+
+saddr and daddr are set but not used.
+
+Fixes: ba44f8182ec2 ("raw: use more conventional iterators")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Acked-by: Jonathan Lemon <jonathan.lemon@gmail.com>
+Link: https://lore.kernel.org/r/20220622032303.159394-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/raw.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/net/ipv6/raw.c
++++ b/net/ipv6/raw.c
+@@ -332,7 +332,6 @@ static void rawv6_err(struct sock *sk, s
+ void raw6_icmp_error(struct sk_buff *skb, int nexthdr,
+ u8 type, u8 code, int inner_offset, __be32 info)
+ {
+- const struct in6_addr *saddr, *daddr;
+ struct net *net = dev_net(skb->dev);
+ struct hlist_nulls_head *hlist;
+ struct hlist_nulls_node *hnode;
+@@ -345,8 +344,6 @@ void raw6_icmp_error(struct sk_buff *skb
+ hlist_nulls_for_each_entry(sk, hnode, hlist, sk_nulls_node) {
+ /* Note: ipv6_hdr(skb) != skb->data */
+ const struct ipv6hdr *ip6h = (const struct ipv6hdr *)skb->data;
+- saddr = &ip6h->saddr;
+- daddr = &ip6h->daddr;
+
+ if (!raw_v6_match(net, sk, nexthdr, &ip6h->saddr, &ip6h->daddr,
+ inet6_iif(skb), inet6_iif(skb)))
--- /dev/null
+From 5f8954e099b8ae96e7de1bb95950e00c85bedd40 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Mon, 27 Jun 2022 16:35:59 +0200
+Subject: Revert "mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit 5f8954e099b8ae96e7de1bb95950e00c85bedd40 upstream.
+
+This reverts commit a52ed4866d2b90dd5e4ae9dabd453f3ed8fa3cbc as it
+causes build problems in linux-next. It needs to be reintroduced in a
+way that can allow the api to evolve and not require a "flag day" to
+catch all users.
+
+Link: https://lore.kernel.org/r/20220623160723.7a44b573@canb.auug.org.au
+Cc: Duoming Zhou <duoming@zju.edu.cn>
+Cc: Brian Norris <briannorris@chromium.org>
+Cc: Johannes Berg <johannes@sipsolutions.net>
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/marvell/mwifiex/init.c | 9 ++++-----
+ drivers/net/wireless/marvell/mwifiex/main.h | 3 +--
+ drivers/net/wireless/marvell/mwifiex/sta_event.c | 6 +++---
+ 3 files changed, 8 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/wireless/marvell/mwifiex/init.c
++++ b/drivers/net/wireless/marvell/mwifiex/init.c
+@@ -63,10 +63,9 @@ static void wakeup_timer_fn(struct timer
+ adapter->if_ops.card_reset(adapter);
+ }
+
+-static void fw_dump_work(struct work_struct *work)
++static void fw_dump_timer_fn(struct timer_list *t)
+ {
+- struct mwifiex_adapter *adapter =
+- container_of(work, struct mwifiex_adapter, devdump_work.work);
++ struct mwifiex_adapter *adapter = from_timer(adapter, t, devdump_timer);
+
+ mwifiex_upload_device_dump(adapter);
+ }
+@@ -322,7 +321,7 @@ static void mwifiex_init_adapter(struct
+ adapter->active_scan_triggered = false;
+ timer_setup(&adapter->wakeup_timer, wakeup_timer_fn, 0);
+ adapter->devdump_len = 0;
+- INIT_DELAYED_WORK(&adapter->devdump_work, fw_dump_work);
++ timer_setup(&adapter->devdump_timer, fw_dump_timer_fn, 0);
+ }
+
+ /*
+@@ -401,7 +400,7 @@ static void
+ mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
+ {
+ del_timer(&adapter->wakeup_timer);
+- cancel_delayed_work_sync(&adapter->devdump_work);
++ del_timer_sync(&adapter->devdump_timer);
+ mwifiex_cancel_all_pending_cmd(adapter);
+ wake_up_interruptible(&adapter->cmd_wait_q.wait);
+ wake_up_interruptible(&adapter->hs_activate_wait_q);
+--- a/drivers/net/wireless/marvell/mwifiex/main.h
++++ b/drivers/net/wireless/marvell/mwifiex/main.h
+@@ -49,7 +49,6 @@
+ #include <linux/pm_runtime.h>
+ #include <linux/slab.h>
+ #include <linux/of_irq.h>
+-#include <linux/workqueue.h>
+
+ #include "decl.h"
+ #include "ioctl.h"
+@@ -1056,7 +1055,7 @@ struct mwifiex_adapter {
+ /* Device dump data/length */
+ void *devdump_data;
+ int devdump_len;
+- struct delayed_work devdump_work;
++ struct timer_list devdump_timer;
+
+ bool ignore_btcoex_events;
+ };
+--- a/drivers/net/wireless/marvell/mwifiex/sta_event.c
++++ b/drivers/net/wireless/marvell/mwifiex/sta_event.c
+@@ -623,8 +623,8 @@ mwifiex_fw_dump_info_event(struct mwifie
+ * transmission event get lost, in this cornel case,
+ * user would still get partial of the dump.
+ */
+- schedule_delayed_work(&adapter->devdump_work,
+- msecs_to_jiffies(MWIFIEX_TIMER_10S));
++ mod_timer(&adapter->devdump_timer,
++ jiffies + msecs_to_jiffies(MWIFIEX_TIMER_10S));
+ }
+
+ /* Overflow check */
+@@ -643,7 +643,7 @@ mwifiex_fw_dump_info_event(struct mwifie
+ return;
+
+ upload_dump:
+- cancel_delayed_work_sync(&adapter->devdump_work);
++ del_timer_sync(&adapter->devdump_timer);
+ mwifiex_upload_device_dump(adapter);
+ }
+
--- /dev/null
+From 953503751a426413ea8aee2299ae3ee971b70d9b Mon Sep 17 00:00:00 2001
+From: Alexander Gordeev <agordeev@linux.ibm.com>
+Date: Sat, 6 Aug 2022 09:29:46 +0200
+Subject: Revert "s390/smp: enforce lowcore protection on CPU restart"
+
+From: Alexander Gordeev <agordeev@linux.ibm.com>
+
+commit 953503751a426413ea8aee2299ae3ee971b70d9b upstream.
+
+This reverts commit 6f5c672d17f583b081e283927f5040f726c54598.
+
+This breaks normal crash dump when CPU0 is offline.
+
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/s390/kernel/setup.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/s390/kernel/setup.c
++++ b/arch/s390/kernel/setup.c
+@@ -508,8 +508,8 @@ static void __init setup_lowcore_dat_on(
+ S390_lowcore.svc_new_psw.mask |= PSW_MASK_DAT;
+ S390_lowcore.program_new_psw.mask |= PSW_MASK_DAT;
+ S390_lowcore.io_new_psw.mask |= PSW_MASK_DAT;
+- __ctl_set_bit(0, 28);
+ __ctl_store(S390_lowcore.cregs_save_area, 0, 15);
++ __ctl_set_bit(0, 28);
+ put_abs_lowcore(restart_flags, RESTART_FLAG_CTLREGS);
+ put_abs_lowcore(program_new_psw, lc->program_new_psw);
+ for (cr = 0; cr < ARRAY_SIZE(lc->cregs_save_area); cr++)
mt76-mt7921s-fix-possible-sdio-deadlock-in-command-f.patch
mt76-mt7921-fix-aggregation-subframes-setting-to-he-.patch
mt76-mt7921-enlarge-maximum-vht-mpdu-length-to-11454.patch
-mt76-mt7921-add-ap-mode-support.patch
-mt76-mt7915-add-support-for-6g-in-band-discovery.patch
-mt76-mt7921-rely-on-mt76_dev-in-mt7921_mac_write_txw.patch
-mt76-mt7915-rely-on-mt76_dev-in-mt7915_mac_write_txw.patch
-mt76-connac-move-mac-connac2-defs-in-mt76_connac2_ma.patch
-mt76-connac-move-connac2_mac_write_txwi-in-mt76_conn.patch
-mt76-mt7915-fix-incorrect-testmode-ipg-on-band-1-cau.patch
mt76-mt7615-fix-throughput-regression-on-dfs-channel.patch
mediatek-mt76-mac80211-fix-missing-of_node_put-in-mt.patch
mediatek-mt76-eeprom-fix-missing-of_node_put-in-mt76.patch
btrfs-convert-count_max_extents-to-use-fs_info-max_extent_size.patch
net_sched-cls_route-remove-from-list-when-handle-is-0.patch
arm64-kexec_file-use-more-system-keyrings-to-verify-kernel-image-signature.patch
+tcp-fix-over-estimation-in-sk_forced_mem_schedule.patch
+crypto-lib-blake2s-reduce-stack-frame-usage-in-self-test.patch
+raw-remove-unused-variables-from-raw6_icmp_error.patch
+raw-fix-a-typo-in-raw_icmp_error.patch
+revert-mwifiex-fix-sleep-in-atomic-context-bugs-caused-by-dev_coredumpv.patch
+mptcp-refine-memory-scheduling.patch
+tracing-use-a-copy-of-the-va_list-for-__assign_vstr.patch
+net-dsa-felix-fix-min-gate-len-calculation-for-tc-when-its-first-gate-is-closed.patch
+revert-s390-smp-enforce-lowcore-protection-on-cpu-restart.patch
+powerpc-kexec-fix-build-failure-from-uninitialised-variable.patch
+drm-bridge-tc358767-fix-e-dp-bridge-endpoint-parsing-in-dedicated-function.patch
+bpf-fix-sparse-warning-for-bpf_kptr_xchg_proto.patch
+bpf-suppress-passing-zero-to-ptr_err-warning.patch
+net-phy-smsc-disable-energy-detect-power-down-in-interrupt-mode.patch
+f2fs-revive-f2fs_ioc_abort_volatile_write.patch
+drm-vc4-change-vc4_dma_range_matches-from-a-global-to-static.patch
+f2fs-fix-null-ptr-deref-in-f2fs_get_dnode_of_data.patch
--- /dev/null
+From c4ee118561a0f74442439b7b5b486db1ac1ddfeb Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Tue, 14 Jun 2022 10:17:33 -0700
+Subject: tcp: fix over estimation in sk_forced_mem_schedule()
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit c4ee118561a0f74442439b7b5b486db1ac1ddfeb upstream.
+
+sk_forced_mem_schedule() has a bug similar to ones fixed
+in commit 7c80b038d23e ("net: fix sk_wmem_schedule() and
+sk_rmem_schedule() errors")
+
+While this bug has little chance to trigger in old kernels,
+we need to fix it before the following patch.
+
+Fixes: d83769a580f1 ("tcp: fix possible deadlock in tcp_send_fin()")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
+Reviewed-by: Shakeel Butt <shakeelb@google.com>
+Reviewed-by: Wei Wang <weiwan@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/tcp_output.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -3367,11 +3367,12 @@ void tcp_xmit_retransmit_queue(struct so
+ */
+ void sk_forced_mem_schedule(struct sock *sk, int size)
+ {
+- int amt;
++ int delta, amt;
+
+- if (size <= sk->sk_forward_alloc)
++ delta = size - sk->sk_forward_alloc;
++ if (delta <= 0)
+ return;
+- amt = sk_mem_pages(size);
++ amt = sk_mem_pages(delta);
+ sk->sk_forward_alloc += amt * SK_MEM_QUANTUM;
+ sk_memory_allocated_add(sk, amt);
+
--- /dev/null
+From 3a2dcbaf4d31023106975d6ae75b6df080c454cb Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
+Date: Tue, 19 Jul 2022 18:20:04 -0400
+Subject: tracing: Use a copy of the va_list for __assign_vstr()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Steven Rostedt (Google) <rostedt@goodmis.org>
+
+commit 3a2dcbaf4d31023106975d6ae75b6df080c454cb upstream.
+
+If an instance of tracing enables the same trace event as another
+instance, or the top level instance, or even perf, then the va_list passed
+into some tracepoints can be used more than once.
+
+As va_list can only be traversed once, this can cause issues:
+
+ # cat /sys/kernel/tracing/instances/qla2xxx/trace
+ cat-56106 [012] ..... 2419873.470098: ql_dbg_log: qla2xxx [0000:05:00.0]-1054:14: Entered (null).
+ cat-56106 [012] ..... 2419873.470101: ql_dbg_log: qla2xxx [0000:05:00.0]-1000:14: Entered ×+<96>²Ü<98>^H.
+ cat-56106 [012] ..... 2419873.470102: ql_dbg_log: qla2xxx [0000:05:00.0]-1006:14: Prepare to issue mbox cmd=0xde589000.
+
+ # cat /sys/kernel/tracing/trace
+ cat-56106 [012] ..... 2419873.470097: ql_dbg_log: qla2xxx [0000:05:00.0]-1054:14: Entered qla2x00_get_firmware_state.
+ cat-56106 [012] ..... 2419873.470100: ql_dbg_log: qla2xxx [0000:05:00.0]-1000:14: Entered qla2x00_mailbox_command.
+ cat-56106 [012] ..... 2419873.470102: ql_dbg_log: qla2xxx [0000:05:00.0]-1006:14: Prepare to issue mbox cmd=0x69.
+
+The instance version is corrupted because the top level instance iterated
+the va_list first.
+
+Use va_copy() in the __assign_vstr() macro to make sure that each trace
+event for each use case gets a fresh va_list.
+
+Link: https://lore.kernel.org/all/259d53a5-958e-6508-4e45-74dba2821242@marvell.com/
+Link: https://lkml.kernel.org/r/20220719182004.21daa83e@gandalf.local.home
+
+Fixes: 0563231f93c6d ("tracing/events: Add __vstring() and __assign_vstr() helper macros")
+Reported-by: Arun Easi <aeasi@marvell.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/trace/stages/stage6_event_callback.h | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/include/trace/stages/stage6_event_callback.h b/include/trace/stages/stage6_event_callback.h
+index 0f51f6b3ab70..3c554a585320 100644
+--- a/include/trace/stages/stage6_event_callback.h
++++ b/include/trace/stages/stage6_event_callback.h
+@@ -40,7 +40,12 @@
+
+ #undef __assign_vstr
+ #define __assign_vstr(dst, fmt, va) \
+- vsnprintf(__get_str(dst), TRACE_EVENT_STR_MAX, fmt, *(va))
++ do { \
++ va_list __cp_va; \
++ va_copy(__cp_va, *(va)); \
++ vsnprintf(__get_str(dst), TRACE_EVENT_STR_MAX, fmt, __cp_va); \
++ va_end(__cp_va); \
++ } while (0)
+
+ #undef __bitmask
+ #define __bitmask(item, nr_bits) __dynamic_array(unsigned long, item, -1)
+--
+2.37.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
